A company plans to use BFD between its routers to detect a connectivity problem inside the switched network. An IPS is transparently installed between the switches. Which packets should the IPS forwar

BFD control packets use unicast source addresses of the local router, never broadcast source addresses.

In BFD echo mode, a router sends packets using its own IP as both the source and destination so the remote device loops them back unchanged, confirming the forwarding path is alive. An IPS that drops packets with matching source and destination IPs - a signature commonly associated with LAND attacks - will silently break BFD echo sessions, so the IPS must be explicitly configured to pass these packets for BFD to function under all circumstances.

BFD control packets are small fixed-size PDUs and are never fragmented; the DF bit scenario is irrelevant to BFD operation.

BFD does not use multicast source addresses; all BFD packets use the unicast IP of the sending router as the source.

BFD does not use multicast destination addresses in standard implementations; control packets are sent unicast to the peer's IP address.

BFD does not send packets to destination 0.0.0.0; that address is associated with default route contexts, not BFD session packets.