Understanding How Control Plane Policing Works - Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Software Configuration Manual

Understanding How Control Plane Policing Works

MCAST IPv6 *G BRIDGE
MCAST IPv6 SG BRIDGE
MCAST IPv6 ROUTE CNTL
MCAST IPv6 DFLT DROP
MCAST IPv6 SECOND. DR
Router#
To display the usage of the hardware rate limiters, use the show mls rate-limit usage command:
Router# show mls rate-limit usage
Layer3 Rate Limiters:
Layer2 Rate Limiters:
Router#
Understanding How Control Plane Policing Works
The control plane policing (CoPP) feature increases security on the Catalyst 6500 series switch by
protecting the PISA from unnecessary or DoS traffic and giving priority to important control plane and
management traffic. The PFC3B provides hardware support for CoPP. CoPP works with the PFC3B rate
limiters.
The Supervisor Engine 2 does not support CoPP.
Note
The PFC3B supports the built-in "special case" rate limiters that can be used when an ACL cannot
classify particular scenarios, such as IP options cases, TTL and MTU failure cases, packets with errors,
and multicast packets. When enabling the special-case rate limiters, the special-case rate limiters
override the CoPP policy for packets matching the rate-limiter criteria.
The traffic managed by the PISA is divided into three functional components or planes:
•
•
•
Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY
33-18
Off
Off
Off
Off
Off
RL# 0: Free
RL# 1: Free
RL# 2: Free
RL# 3: Used
RL# 4: Free
RL# 5: Free
RL# 6: Used
RL# 7: Used
RL# 8: Rsvd for capture
RL# 9: Reserved
RL#10: Reserved
RL#11: Free
RL#12: Free
Data plane
Management plane
Control plane
-
-
-
-
-
Rate Limiter Type
---------------------
-
-
-
MCAST DFLT ADJ
-
-
IP RPF FAILURE
ICMP UNREAC. NO-ROUTE
ICMP UNREAC. ACL-DROP
IP ERRORS
ACL VACL LOG
-
-
-
Chapter 33 Configuring Denial of Service Protection
- -
- -
- -
- -
- -
Packets/s Burst
--------- -----
- -
- -
- -
100000 100
- -
- -
100 10
100 10
100 10
100 10
2000 1
- -
- -
- -
OL-11439-03