A co-op's edge router faces the public internet, and the engineer wants it to drop any incoming packet whose source address doesn't have a matching route pointing back out the same interface it arrived on, catching spoofed traffic using the router's own routing table rather than a separately written filter. Which mechanism does this?

Unicast reverse-path forwarding takes a packet's source address and performs a route lookup against it exactly as if it were a destination, then compares the interface that lookup would use against the interface the packet actually arrived on; a mismatch, or no route at all, means the source is implausible for that arrival point, and the packet is dropped, all driven automatically by whatever is already in the routing table rather than by a hand-maintained list. A static discard route targets a specific, known-bad destination prefix chosen in advance by an administrator; it says nothing about validating an arriving packet's source address against topology, and it has to be manually written for each block instead of reacting automatically to whatever shows up. Longest-match route selection decides which route wins when multiple routes could forward a packet toward its destination; it never inspects or validates a source address, so it can't catch a spoofed sender on its own. Matching only a fixed list of known private address ranges in a firewall filter misses spoofed addresses that are technically public but simply implausible for that interface, which is exactly the gap a routing-table-driven check closes. A caveat is that strict uRPF can drop legitimate traffic on links with asymmetric routing, so it's typically deployed at single-homed edges rather than multi-path cores. An operational check after enabling it is confirming legitimate subscriber traffic from known-good source ranges still passes while a spoofed test source from an unauthorized range is dropped.