A police records bureau enables uRPF on an edge and wants visibility into dropped spoof attempts for forensic review. What operational approach supports that visibility?
Select an answer to reveal the explanation.
Short Explanation
A silent dumpster behind the station doesn't help forensics. Turn on the counters and ACL logging so spoof drops leave a paper trail you can actually read.
Full Explanation
A police records bureau enabling uRPF on an edge and wanting visibility into dropped spoof attempts should use uRPF with ACL logging options or drop counters/logging features so rejected packets can be observed and investigated. Forensic value requires evidence: which sources were dropped, on which interface, and at what rate. The correct operational approach works because silent drops without counters or logs cannot support incident review or tuning of false positives on civic edges. Disabling all logging because uRPF drops are never countable fails because IOS can expose RPF drop information and ACL-related logging when configured appropriately. Mirroring only OSPF hellos to NetFlow because uRPF cannot log or count drops fails conceptually: OSPF hello mirroring does not substitute for RPF drop visibility, and the premise that uRPF is uncountable is wrong. Relying on DNS TTL alone to reconstruct spoofed source attempts fails because DNS caching timers do not record uRPF drops. Exam caveat: verbose ACL logging can overload the CPU on a busy civic Internet edge—prefer counters, sampled logging, or targeted ACLs for suspicious prefixes. Operational check: enable appropriate uRPF ACL logging or monitor interface/RPF drop counters, generate a controlled spoof test in a maintenance window, confirm drops are visible, and retain logs for the records bureau forensic workflow.