Page 220 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Before measuring RTT, a TCP sender should use a one-second RTO; its first sample sets SRTT to the sample, RTTVAR to half the sample, and RTO to SRTT plus the larger of clock granularity or four times RTTVAR.
Read the explainer
The four ordered BGP UPDATE recovery actions are session reset, AFI/SAFI disable, treat-as-withdraw, and attribute discard; discard is restricted to attributes that cannot affect route selection or installation.
Read the guide
An aggregation edge restricts downstream transit traffic to source prefixes that the downstream network intentionally advertises, rejecting sources outside those prefixes. Administrators should log packets rejected by an ingress source-address filter so suspicious activity can be monitored.
Read the playbook
The private IPv4 blocks are 10/8, 172.16/12, and 192.168/16; their addresses are unique only within cooperating private networks. Private routing information must not cross inter-enterprise links, and packets with private sources or destinations should not be forwarded across those links.
Read the briefing
An ICMPv6 error must not be generated in response to another ICMPv6 error or to an ICMPv6 Redirect message. An error must not answer IPv6 or link-layer multicast, except for Packet Too Big and the defined Parameter Problem Code 2 case.
Read the checklist
A unique local IPv6 prefix uses FC00::/7, a local-assignment bit, a 40-bit Global ID, a 16-bit subnet ID, and a 64-bit interface ID. A locally assigned Global ID must be generated with a pseudo-random algorithm to make independent /48 prefix collisions highly unlikely.
Read the explainer
The BGP COMMUNITIES attribute is optional and transitive and contains a variable-length set of four-octet community values.
Read the guide
A host must not send ICMP Source Quench, and TCP must silently discard any Source Quench it receives. A router must ignore every received ICMP Source Quench message. UDP, SCTP, DCCP, and any other transport instance must silently ignore or discard a received Source Quench.
Read the playbook
A confederation member uses its confederation identifier with outside peers and its Member-AS number with peers inside the same confederation.
Read the briefing
The DS field uses a six-bit DSCP to select per-hop behavior; the remaining two bits are excluded from that selection. A compliant node must match the entire six-bit DSCP and support a configurable mapping from codepoints to per-hop behaviors.
Read the checklist