Control Plane Policing (CoPP)

Control Plane Policing (CoPP) is a Cisco IOS feature that protects the router CPU by controlling how much traffic is allowed to reach the control plane. The goal is to keep the device stable and manageable (SSH responsive, routing adjacencies stable, control protocols healthy) even when the router receives unexpected or excessive traffic.

Control Plane vs Data Plane

A router is divided into two main parts: the Control Plane and the Data Plane. These two planes do not have the same role, and that is exactly why CoPP is so important.

Figure 1 - Control Plane vs Data Plane

• The Data Plane is responsible for forwarding transit traffic (packets that go through the router).
  This is the normal job of the router: receive packets and forward them out the correct interface.

• The Control Plane is responsible for “router brain” traffic: routing protocol packets, management traffic (SSH, SNMP), control traffic destined to the router itself, and anything that requires CPU processing.

So when you hear “protect the control plane,” it really means: protect the CPU, because if the CPU is overloaded, everything that depends on it becomes slow or unstable.

When the Control Plane is Overloaded

Now look at what happens when a malicious flow targets the router itself.
This is often called “host → router” traffic (traffic destined to the device, not passing through it).

Figure 2 - Control Plane Overload

In this example, suspicious traffic floods the router interface and reaches the control plane.
Because the traffic is destined to the router, it is punted to the CPU. If the rate is high enough, the CPU gets overloaded.

When this happens, the router struggles to process important tasks.
Even if the Data Plane continues forwarding traffic, the router becomes unstable from a control perspective:

• SSH access becomes slow or unusable

• routing adjacencies can flap (OSPF/EIGRP/BGP instability)

• control packets can be delayed or dropped

• the device may become unreliable during the attack

This is exactly the type of situation CoPP is designed to mitigate.

How CoPP Protects the Control Plane

CoPP acts like a protection shield placed in front of the control plane. Instead of allowing any traffic to reach the CPU at any rate, CoPP forces the router to classify control-plane traffic and apply policing.

Figure 3 - CoPP Protecting the Control Plane

In this example, a CoPP policy is applied to detect and limit suspicious traffic before it can overload the CPU.
The principle is:

• legitimate traffic is allowed to reach the control plane (within a configured rate)

• unwanted traffic is rate-limited or dropped, so it cannot consume all CPU resources

This means the Control Plane stays protected, and the router can keep making the correct decisions:

• routing remains stable

• management access stays usable

• the router continues to operate normally even under attack attempts

In this section, you will build a basic CoPP policy.