Control Plane Policing (CoPP) Tutorial

Every packet a Cisco device deals with can be thought of as belonging to one of four conceptual “planes,” and understanding this distinction is the key to understanding why Control Plane Policing (CoPP) exists in the first place.

The Four Packet Planes

• Data plane — ordinary user traffic being forwarded between end hosts; the device is simply passing it along.
• Services plane — user traffic that needs some extra handling beyond plain forwarding, such as GRE, QoS, MPLS VPN, or IPsec. Depending on the feature involved, some of this traffic gets punted up to the CPU for processing, while the rest continues to be handled entirely by CEF.
• Control plane — packets the device itself generates or receives in order to build and operate the network: routing protocol updates, CDP, BPDUs, and the like.
• Management plane — traffic used to actually manage the device, such as Telnet, SSH, SNMP, and NTP.

Both control-plane and management-plane traffic are ultimately processed by the device’s route processor, which makes that route processor an attractive target: an attacker (or simply an overloaded or misconfigured network) can flood it with enough traffic to degrade or even crash the device. Typical kinds of traffic that end up consuming CPU cycles this way include routing protocol packets, any packet addressed directly to the router itself, management protocol traffic, ICMP, various Layer 2 protocols, and traffic related to AAA, syslog, and NTP.