CCNP ENCOR reference
Control Plane Policing (CoPP) Quick Reference
Protecting the route processor without starving legitimate traffic — tested in ENCOR objective 5.5.
What CoPP protects
CoPP protects traffic destined TO the device's own route processor — not transit traffic passing through the device (that's regular data-plane QoS/ACL territory). The route processor has far less capacity than the hardware forwarding path, so an unclassified flood aimed at the device itself can disrupt routing protocols and management access even while data-plane forwarding continues normally.
The sizing trade-off
Too permissive: fails to actually protect the route processor from a genuine flood. Too restrictive: rate-limits and drops legitimate control-plane traffic (like routing protocol hellos), causing self-inflicted instability that looks exactly like a routing protocol problem — checking 'show policy-map control-plane' for a nonzero, growing 'exceeded' count on a critical class is the way to catch this.
Applied via 'service-policy input' under 'control-plane' configuration — a distinct application point from a regular interface's service-policy.