Page 137 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
Canonical IPv6 text suppresses leading zeroes in each 16-bit field while representing a single all-zero field as 0. The double-colon form compresses the longest eligible zero run, never a single zero field, and selects the leftmost run when equal-length runs tie.
Read the guide
In a synchronized state, TCP resets only on an RST whose sequence exactly equals RCV.NXT; it discards an out-of-window RST and challenges an in-window nonmatching RST with an ACK before dropping it.
Read the playbook
Strict reverse-path forwarding accepts a source only when the packet arrived on the interface selected by the best forwarding path back to that source.
Read the briefing
An IPv6 unicast address identifies one interface, and traffic sent to it is delivered to that interface. An IPv6 anycast address identifies multiple interfaces and delivers a packet to the nearest one according to routing distance.
Read the checklist
Before measuring RTT, a TCP sender should use a one-second RTO; its first sample sets SRTT to the sample, RTTVAR to half the sample, and RTO to SRTT plus the larger of clock granularity or four times RTTVAR.
Read the explainer
The four ordered BGP UPDATE recovery actions are session reset, AFI/SAFI disable, treat-as-withdraw, and attribute discard; discard is restricted to attributes that cannot affect route selection or installation.
Read the guide
An aggregation edge restricts downstream transit traffic to source prefixes that the downstream network intentionally advertises, rejecting sources outside those prefixes. Administrators should log packets rejected by an ingress source-address filter so suspicious activity can be monitored.
Read the playbook
The private IPv4 blocks are 10/8, 172.16/12, and 192.168/16; their addresses are unique only within cooperating private networks. Private routing information must not cross inter-enterprise links, and packets with private sources or destinations should not be forwarded across those links.
Read the briefing
An ICMPv6 error must not be generated in response to another ICMPv6 error or to an ICMPv6 Redirect message. An error must not answer IPv6 or link-layer multicast, except for Packet Too Big and the defined Parameter Problem Code 2 case.
Read the checklist
A unique local IPv6 prefix uses FC00::/7, a local-assignment bit, a 40-bit Global ID, a 16-bit subnet ID, and a 64-bit interface ID. A locally assigned Global ID must be generated with a pseudo-random algorithm to make independent /48 prefix collisions highly unlikely.
Read the explainer