Parse extended ICMP objects only after the original datagram and length fields
The defined ICMPv4 and ICMPv6 error messages gain an original-datagram length field so an appended extension structure can be located after that field.
Read the checklistDSE security knowledge hubIT
IT
Knowledge
Page 112 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide IT knowledge center
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
DSE post stream
1,513 articlesIT
Prevent route-reflector loops with cluster and originator attributes
A route reflector creates ORIGINATOR_ID from the original speaker’s BGP Identifier, and a router should ignore a route whose ORIGINATOR_ID equals its own identifier.
Read the explainer
Probe a specific interface with ICMP Extended Echo under authorization
An ICMP Extended Echo Request MUST contain exactly one Interface Identification Object; with L set it may identify a local interface by name, index, or address, while L clear requires an address.
Read the guide
Race IPv6 and IPv4 connection attempts from one interleaved candidate list
A dual-stack client SHOULD issue AAAA first and A immediately afterward, treat resolution asynchronously, and avoid waiting for both address families before beginning connection establishment.
Read the playbook
Rotate TCP-AO keys without breaking authenticated connection segments
An individual Master Key Tuple cannot change during a connection, but implementations may add or remove tuples and switch which installed tuple the connection uses.
Read the briefing
Rotate temporary IPv6 addresses within lifetime and regeneration bounds
When an autoconfiguration prefix has no temporary address, a host should create one unless a prefix-specific policy says otherwise.
Read the checklist
Run duplicate-address detection before assigning a SLAAC address
Duplicate Address Detection must run before assigning each unicast address, including SLAAC, DHCPv6, and manually configured addresses, except for the specified disabled and anycast cases.
Read the explainer
Scope OSPFv3 packets and LSAs correctly on IPv6 links
OSPFv3 packets use the interface’s link-local IPv6 address on ordinary interfaces, while packets on a virtual link must use a global-scope source address. Link-local addresses may appear in link-LSAs but must not be advertised in inter-area-prefix, AS-external, NSSA, or intra-area-prefix LSAs.
Read the guide
Separate Diffserv edge conditioning from core per-hop forwarding
A differentiated-services domain’s boundary nodes classify and condition ingress traffic so its DS codepoints select supported per-hop behaviors.
Read the playbook
Separate IPv6 router discovery, address resolution, and reachability
A valid Router Advertisement adds, refreshes, or immediately expires its source in the Default Router List according to the advertised Router Lifetime.
Read the briefing