A service provider runs Cisco IOS XR on its aggregation routers. The security team wants to protect the router from being overwhelmed by high rates of exception and for-us packets (such as ARP, ICMP, and routing protocol traffic) punted to the CPU, without manually configuring a policy for every protocol. Which built-in IOS XR mechanism automatically polices these locally destined packet flows in hardware to protect the control and management planes?