Page 140 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
A NAT must translate a TCP RST that matches an existing mapping and should retain the associated session state for four minutes unless another packet arrives.
Read the guide
The configurable address-selection policy table supplies destination precedence and labels that favor source and destination prefixes with matching labels.
Read the playbook
The /127 recommendation applies only to point-to-point links with exactly two routers and no attached hosts; router-to-host and mixed links are outside its scope.
Read the briefing
A validating BGP speaker must determine egress origin-validation state from the effective origin AS after outbound configuration and policy have been applied.
Read the checklist
Before processing an IPv4 packet, a router must validate minimum lengths, checksum, version, header length, and total length; failures are discarded and should be logged.
Read the explainer
TCP establishes a connection through a three-way handshake, including simultaneous opens in which both peers transition through SYN-SENT and SYN-RECEIVED before ESTABLISHED.
Read the guide
A host must verify the IPv4 header checksum on every received datagram and silently discard a datagram with a bad checksum. A host must generate and validate UDP checksums, enable checksum generation by default, and silently discard a received nonzero checksum that is invalid.
Read the playbook
TLS’s current encryption level determines the QUIC packet type and keys; Initial, 0-RTT, Handshake, and 1-RTT use distinct level secrets, and CRYPTO frames omit 0-RTT.
Read the briefing
HTTP/2 maintains receiver-controlled, hop-by-hop flow-control windows for each stream and for the connection; a sender must honor both advertised limits.
Read the checklist
Static-table and literal QPACK representations cannot block, while an unacknowledged dynamic-table reference can block its request stream after cross-stream reordering.
Read the explainer