has any chance of using bandwidth or reaching a router that is not configured for RPF and thus inappropriately forwarded. Unfortunately, it is often the case on the larger Internet backbone that routing is asymmetric and the routing tables cannot be relied upon to point to the best route for a source to get to a router. Routing tables specify the best forward path and only in the symmetric case does that equate to the best reverse path. It is important when implementing uRPF to be aware of the potential for asymmetry to prevent accidental filtering of legitimate traffic. RFC 3704 gives more details on how to extend strict reverse-path forwarding to include some more relaxed cases that can still be of benefit while allowing for at least some asymmetry. Strict mode In strict mode, each incoming packet is tested against the FIB and, if the incoming interface is not the best reverse path, the packet check will fail. By default failed packets are discarded. Feasible mode In feasible mode, the FIB maintains alternate routes to a given IP address. If the incoming interface matches with any of the routes associated with the IP address, then the packet is forwarded. Otherwise, the packet is dropped. Loose mode In loose mode each incoming packet's source address is tested against the FIB. The packet is dropped only if the source address is not reachable via any interface on that router. Filtering vs. forwarding RPF is often interpreted as reverse-path filtering, particularly when it comes to unicast routing. This is an understandable alternate interpretation of the acronym in that when RPF is used with unicast routing as in RFC 3704, traffic is either permitted or denied based upon the RPF check passing or failing. The thought being that traffic is denied if it fails the RPF check and is therefore filtered. While uRPF is used as an ingress filtering mechanism, it is affected by reverse-path forwarding. Reverse path filters are typically used to disable asymmetric routing where an IP application has a different incoming and outgoing routing path. Its intent is to prevent a packet entering one interface from leaving via the other interfaces. Reverse-path Filtering is a feature of the Linux Kernel. See also Flooding (computer networking) Notes References External links Routing