Which IDS guidelines should be followed, according to SAFE SMR?

Which IDS guidelines should be followed, according to SAFE SMR?

A.
use shunning on only UDP traffic, as it is more difficult to spoof than TCP

B.
use shunning on only TCP traffic, as it is more difficult to spoof than UDP

C.
use shunning no longer than 15 minutes

D.
use TCP shunning as opposed to TCP resets