CoPP (Control Plane Policing) protects the device’s CPU from DoS and unwanted traffic by rate-limiting or filtering traffic destined to the device itself.

Why does it exist?

Without CoPP anyone can send massive ICMP/BGP/OSPF/SSH traffic. Those packets are punted to the CPU → CPU overload → routing adjacencies flap → network down. 👉 The data plane can be healthy while the control plane dies.

What does CoPP protect?

Only traffic destined to the device itself: OSPF, BGP (TCP 179), EIGRP, ARP, ICMP to the router, SNMP, SSH/telnet, NTP. 🚨 Transit traffic is NOT protected.

Where in the architecture

1. Packet arrives
2. If destined to the router → punt to the CPU
3. CoPP policy evaluated
4. Allow / rate-limit / drop

How it works

CoPP uses MQC: ACL identifies traffic → class-map matches it → policy-map defines the action → service-policy input on the control-plane enables it.

CoPP vs CPPr

Feature	CoPP	CPPr
Granularity	Basic	More granular
Subclasses	No	Yes: host, transit, CEF-exception
Platform	IOS	ISR / ASR

Configuration (example)

ip access-list extended MGMT-SSH
 permit tcp any any eq 22
ip access-list extended OSPF-TRAFFIC
 permit ospf any any
ip access-list extended BGP-TRAFFIC
 permit tcp any any eq 179
ip access-list extended ICMP-TRAFFIC
 permit icmp any any
!
class-map match-any ROUTING-CLASS
 match access-group name OSPF-TRAFFIC
 match access-group name BGP-TRAFFIC
class-map match-any MGMT-CLASS
 match access-group name MGMT-SSH
class-map match-any ICMP-CLASS
 match access-group name ICMP-TRAFFIC
!
policy-map COPP-POLICY
 class ROUTING-CLASS
  police cir 1000000 bc 31250 conform-action transmit exceed-action drop
 class MGMT-CLASS
  police cir 256000 bc 8000 conform-action transmit exceed-action drop
 class ICMP-CLASS
  police cir 128000 bc 4000 conform-action transmit exceed-action drop
 class class-default
  drop
!
control-plane
 service-policy input COPP-POLICY

Verification

show policy-map control-plane
show control-plane host open-ports
show processes cpu sorted

Troubleshooting

Symptoms of missing/wrong CoPP: OSPF neighbor flapping, BGP session resets, high CPU, unstable SSH.

Scenario	Think
OSPF flap during DDoS	Missing CoPP
SSH timeout	CoPP too aggressive
Transit traffic dropped	Not a CoPP problem
High CPU with low traffic	Punt traffic

Design tips (CCNP)

• Too aggressive policing → routing flaps – account for bursts (bc parameter)
• Routing classes must never be too restrictive
• Test in a maintenance window; implementation is platform-specific
• Use match-any with care

30-second summary

• CoPP protects the CPU · only router-destined traffic · built on MQC · wrong config can break routing · transit traffic unaffected