Packets destined to the router (OSPF, BGP, SSH, SNMP, ARP, ICMP-to-interface) get punted to the CPU. Without protection, one ICMP flood overloads the CPU, adjacencies flap — data plane healthy, network dead. CoPP rate-limits the punts.

• Only protects traffic addressed to the device. Transit traffic is not CoPP’s job.
• Implements as plain MQC: named ACLs → class-maps → policers, applied under the control plane.
• CPPr (ISR/ASR) extends it with host/ Transit/CEF-exception sub-planes.

ip access-list extended ROUTING
 permit ospf any any
 permit tcp any any eq 179
class-map match-any ROUTING-CLASS
 match access-group name ROUTING
policy-map COPP
 class ROUTING-CLASS
  police cir 1000000 bc 31250 conform-action transmit exceed-action drop
class class-default
 drop
control-plane
 service-policy input COPP

Exam mapping: OSPF flaps under attack → missing CoPP. SSH unstable after you touched CoPP → policer too tight. Dropped user traffic → look elsewhere. Verify: show policy-map control-plane.