DSE security knowledge hub

IT
Knowledge

Page 111 of the DSE IT knowledge center, with source-backed guidance and practical next steps.

DSE-authoredOfficial sourcesReviewed guidance
Search the library
Explore this topic

IT knowledge center

Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.

Start with the cornerstone guide
DSE post stream

IT

1,513 articles
DSE visual briefNetworks & infrastructure

Generate and route ULAs without leaking them as global IPv6 space

A unique local IPv6 prefix uses FC00::/7, a local-assignment bit, a 40-bit Global ID, a 16-bit subnet ID, and a 64-bit interface ID. A locally assigned Global ID must be generated with a pseudo-random algorithm to make independent /48 prefix collisions highly unlikely.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the explainer
DSE visual briefNetworks & infrastructure

Ignore ICMP Source Quench as a congestion-control signal

A host must not send ICMP Source Quench, and TCP must silently discard any Source Quench it receives. A router must ignore every received ICMP Source Quench message. UDP, SCTP, DCCP, and any other transport instance must silently ignore or discard a received Source Quench.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the playbook
DSE visual briefNetworks & infrastructure

Negotiate Add-Path before advertising multiple paths for one prefix

The ADD-PATH capability declares, separately for each AFI/SAFI, whether the sender can receive paths, send paths, or do both. A speaker may send multiple paths for an AFI/SAFI only when it advertised send capability and its peer advertised receive capability for that same AFI/SAFI.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the explainer
DSE visual briefNetworks & infrastructure

Negotiate ECN before treating congestion marks as transport signals

TCP negotiates ECN with ECE and CWR set on the initiating SYN and only ECE set on the responding SYN-ACK; neither endpoint may set ECT on data until both directions complete ECN setup. A receiver echoes a received CE mark with ECE acknowledgments until it receives CWR from the sender.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the guide