Page 221 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
The ADD-PATH capability declares, separately for each AFI/SAFI, whether the sender can receive paths, send paths, or do both. A speaker may send multiple paths for an AFI/SAFI only when it advertised send capability and its peer advertised receive capability for that same AFI/SAFI.
Read the explainer
TCP negotiates ECN with ECE and CWR set on the initiating SYN and only ECE set on the responding SYN-ACK; neither endpoint may set ECT on data until both directions complete ECN setup. A receiver echoes a received CE mark with ECE acknowledgments until it receives CWR from the sender.
Read the guide
MP_REACH_NLRI advertises reachable prefixes and their next hop, with AFI and SAFI identifying the address-family semantics. MP_UNREACH_NLRI withdraws multiple routes for the AFI and SAFI carried in that attribute.
Read the playbook
IPv6 optional internet-layer headers form a Next Header chain, and the first value that is not an extension header identifies the following upper-layer header.
Read the briefing
The defined ICMPv4 and ICMPv6 error messages gain an original-datagram length field so an appended extension structure can be located after that field.
Read the checklist
A route reflector creates ORIGINATOR_ID from the original speaker’s BGP Identifier, and a router should ignore a route whose ORIGINATOR_ID equals its own identifier.
Read the explainer
An ICMP Extended Echo Request MUST contain exactly one Interface Identification Object; with L set it may identify a local interface by name, index, or address, while L clear requires an address.
Read the guide
A dual-stack client SHOULD issue AAAA first and A immediately afterward, treat resolution asynchronously, and avoid waiting for both address families before beginning connection establishment.
Read the playbook
An individual Master Key Tuple cannot change during a connection, but implementations may add or remove tuples and switch which installed tuple the connection uses.
Read the briefing
When an autoconfiguration prefix has no temporary address, a host should create one unless a prefix-specific policy says otherwise.
Read the checklist