What is cpu defense?

Hi hasanarcas,

The CPU attack defense function can limit the rate of all the packets sent to the CPU to protect the CPU and ensure that the CPU can properly process services.

The core of CPU attack defense is the Control Plane Committed Access Rate (CPCAR). The CPCAR limits the rate of protocol packets sent to the control plane to ensure security of the control plane. The rate of packets can be limited in the following ways:
Scheduling and limiting based on the queue
Limiting for all packets
The device allocates a queue for packets of each protocol. Queues are scheduled based on weights. Services with the highest priority are processed first.

After the rate limit for all packets is set, the number of packets sent to the CPU is limited and more protocol packets can be processed. This function cannot protect the CPU when the CPU exception occurs.

CPU attack defense provides the blacklist function. A blacklist references an ACL. The device discards all packets matching the characteristics in the blacklist. You can add the known attackers to the blacklist.
For more information, you can refer to CPU-Defend Policy: Local Attack Defense