Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2SecurityMedium
A network security engineer is implementing Control Plane Policing (CoPP) on a Cisco router to protect the router's CPU from excessive traffic destined for the control plane. Which type of traffic should be classified and rate-limited to mitigate reconnaissance attacks like port scans or excessive SSH connection attempts?
- AForwarding plane traffic
- BManagement plane traffic
- CData plane traffic
- DControl plane exception traffic
Show answer & explanationAnswer & explanation
Correct answer: D. Control plane exception traffic
Control plane policing (CoPP) specifically protects the control plane of the router, which handles packets destined for the router itself. Reconnaissance attacks like port scans or excessive SSH attempts directly target the router's services, making them 'control plane exception traffic' that needs to be classified and rate-limited to protect the CPU.
Why the other options are wrong
- A. Forwarding plane traffic is synonymous with data plane traffic and is not the primary target of CoPP.
- B. Management plane traffic involves protocols like Telnet, SSH, SNMP, HTTP for managing the device, which is part of the control plane, but 'control plane exception traffic' is a more specific and encompassing term for the type of unwanted traffic CoPP targets.
- C. Data plane traffic is forwarded through the router, not processed by its CPU for routing decisions, and is not directly targeted by CoPP for CPU protection.
Control Plane Policing (CoPP)
A security feature that protects the router's CPU from excessive traffic destined for the control plane, such as routing updates, management protocols, and packets that require CPU processing, thereby preventing DoS attacks and maintaining router stability.
- Uses QoS policies to classify and rate-limit traffic to the CPU.
- Protects against reconnaissance, DoS, and malformed packet attacks.
- Targets traffic that is 'for' the router, not 'through' the router.
Memory trick: CoPP protects the CPU from Control Plane Chaos!