Figure 10 — On the left, the candidate AS A does not implement correct filtering of spoofed packets towards the provider AS B, so the packet reaches the malicious host. In this case, the configuration is not valid. On the right, the candidate filters out spoofed packets towards the provider AS B. Therefore, it complies with the Anti-Spoofing check. The procedure is repeated for IPv6.