uRPF (unicast reverse path forwarding) works by asking where the router would send a reply to a packet's source address, rather than by checking that source against a list someone has to write and maintain. It is one of the anti-spoofing controls a DDoS test has to take into account at the network edge: if the routing table has no sensible path back to the source, the packet is treated as forged and dropped. Because the check reads the forwarding table the router already keeps, it updates itself whenever routing changes, which is what makes it the automated form of BCP 38 ingress filtering.
Three modes, three different questions
RFC 3704 describes the variants, and they differ in how much they demand of the route back.
Strict mode requires the best route to the source to point out of the same interface the packet came in on. It is precise, and it is the right setting on a link to a single-homed customer, where traffic arrives and leaves by one path.
Loose mode only requires that some route to the source exists, on any interface. It cannot catch a forged address that happens to be routable, which is nearly all of them, but it does drop unallocated and bogon sources. A default route satisfies it for every address unless the platform is told to ignore the default during the check.
Feasible-path mode sits between them: the source must be reachable through the ingress interface by any route the router has learned, not only the best one. It exists for customers connected to the same provider more than once.
Why the strict setting is often switched off
Internet routing is frequently asymmetric. A multihomed network may send traffic out through one provider while the return path for that source runs through another. Strict mode on the wrong interface then drops genuine packets, and the fault looks like intermittent packet loss for some users, which is hard to trace back to a security feature.
The usual response is to fall back to loose mode or to disable the check altogether, and that is why so much of the internet still forwards spoofed packets. On some platforms the reverse-path lookup also costs forwarding capacity, which makes operators reluctant to enable it on high-speed transit links.
uRPF has a second use in DDoS response. Source-based RTBH, set out in RFC 5635, null-routes the attacking source addresses and relies on loose-mode uRPF to drop any packet whose source now resolves to the discard interface. It only works when the sources are real; against forged ones it blocks innocent addresses.
What a DDoS test measures
uRPF does not protect the network that enables it from a reflection flood aimed at it; the forged packets were sent from someone else's network. What a test can check is the part the tested organisation controls.
On its own edge, a test confirms which mode is actually configured on each customer-facing and peering interface, and whether a forged source from inside the network is dropped on the way out. Configuration audits often find strict mode on paper and loose mode, or nothing, in production.
Where the organisation uses source-based RTBH, the test confirms that the check is enabled on every ingress the plan relies on. If one interface lacks it, the black-holed sources simply come in that way.
The reflection and amplification classes that depend on spoofed sources, and that uRPF is meant to starve, are covered in Understanding DDoS Attack Vectors.