A company plans to use BFD between its routers to detect a connectivity problem inside the switched network. An IPS is transparently installed between the switches. Which packets shold the IPS…

A packet cannot be simultaneously fragmented and have the do-not-fragment bit set since these conditions are mutually exclusive, and BFD does not use such packets in any mode.

Broadcast IP source addresses are invalid per RFC standards and are never used by BFD control or echo packets.

Multicast IP addresses are not valid as source addresses in standard unicast IP communication and are not used by BFD in any operational mode.

BFD control packets are sent to the unicast address of the directly connected peer, not to a multicast destination, so forwarding multicast-destined packets alone would not ensure full BFD functionality.

BFD Echo mode transmits packets using the local router's own IP address as both the source and destination, expecting the adjacent device to forward them back without BFD-level processing. An IPS that drops packets with matching source and destination IP addresses - treating them as spoofed or malformed - will break BFD echo sessions and prevent fast failure detection. Allowing these echo packets ensures BFD can detect link failures independent of routing protocol convergence timers.

BFD does not use the all-zeros destination address 0.0.0.0; that address is reserved for DHCP discovery and similar bootstrap functions, not BFD echo or control sessions.