Question

A network engineer notices that a Nexus 9000 switch in a production data center is experiencing high CPU utilization due to a burst of ARP and glean traffic from a misbehaving host subnet. Legitimate management (SSH) and routing (BGP) sessions are beginning to flap because control-plane packets are being dropped. The engineer wants to protect the supervisor CPU while ensuring critical protocol traffic is prioritized over the offending traffic. Which action best addresses this problem?

Accepted Answer

Apply Control Plane Policing (CoPP) with a strict profile so that traffic classes such as ARP/glean are rate-limited separately from critical classes like BGP and management

Answer

Configure an ingress ACL on all data-plane interfaces to deny ARP traffic from the offending subnet

Answer

Disable CoPP entirely so that no control-plane packets are policed and all traffic reaches the CPU

Answer

Increase the MTU on the supervisor inband interface to buffer the burst of ARP and glean packets