5.3CoPP (Control Plane Policing)

Forwarding on a router or switch happens in hardware (the data plane), but packets the device itself must process—OSPF hellos, BGP updates, ARP, ICMP, SNMP, SSH—are punted to the CPU for software handling. If an attacker floods that path, the CPU saturates: adjacencies time out, routes drop, and even management access is lost—the network collapses even though forwarding hardware is untouched. An interface ACL can drop transit traffic, but it cannot govern the volume of packets that legitimately target the device. CoPP is the mechanism built for that job.

5.3.1Why the control plane needs protection

• The control plane is the CPU-based processing that computes routes, maintains adjacencies, and manages the device. Packets that reach it leave ASIC fast-path forwarding and are handled one at a time in software, so its throughput is orders of magnitude lower than the data plane's. That is why even a modest attack volume can incapacitate a device.
• CoPP applies a service policy to the virtual interface named control-plane, policing traffic bound for the CPU class by class. The key is that it is rate limiting rather than blocking: legitimate protocols still pass while only abnormal volume is dropped, aiming to keep adjacencies and management alive precisely when the device is busiest (that is, under attack).
• Two mechanisms are easily confused with CoPP: CPPr (Control Plane Protection), which further subdivides the control plane into host, transit, and CEF-exception subinterfaces, and access-class, which controls reachability of the management plane. Keep the mapping between planes (data, management, control) and tools straight.