Page 223 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Before processing an IPv4 packet, a router must validate minimum lengths, checksum, version, header length, and total length; failures are discarded and should be logged.
Read the explainer
TCP establishes a connection through a three-way handshake, including simultaneous opens in which both peers transition through SYN-SENT and SYN-RECEIVED before ESTABLISHED.
Read the guide
A host must verify the IPv4 header checksum on every received datagram and silently discard a datagram with a bad checksum. A host must generate and validate UDP checksums, enable checksum generation by default, and silently discard a received nonzero checksum that is invalid.
Read the playbook
TLS’s current encryption level determines the QUIC packet type and keys; Initial, 0-RTT, Handshake, and 1-RTT use distinct level secrets, and CRYPTO frames omit 0-RTT.
Read the briefing
HTTP/2 maintains receiver-controlled, hop-by-hop flow-control windows for each stream and for the connection; a sender must honor both advertised limits.
Read the checklist
Static-table and literal QPACK representations cannot block, while an unacknowledged dynamic-table reference can block its request stream after cross-stream reordering.
Read the explainer
A server rejects a WebSocket opening request that lacks the required GET, Host, Upgrade, Connection, 16-byte encoded key, or version-13 fields. Accepting the connection requires status 101, Upgrade and Connection fields, and Sec-WebSocket-Accept computed from the client’s key and the protocol GUID.
Read the guide
QUIC declares an in-flight packet lost only after a later packet is acknowledged and either the packet threshold or time threshold is met. A Probe Timeout sends one or two probe datagrams, but expiration alone does not indicate loss and must not mark prior unacknowledged packets lost.
Read the playbook
Each HTTP/3 request occupies one client-initiated bidirectional stream, with interim and final responses returned on that same stream. Each endpoint creates exactly one control stream, sends SETTINGS first, and keeps that critical stream open for the connection’s lifetime.
Read the briefing
Without resource-specific permission, an origin server must reject early data or defer request processing until the TLS handshake completes. Clients may send known-safe methods in early data but must not send unsafe or unknown-safety methods; a 425 response requires retry without early data.
Read the checklist