In Nokia's SR Linux, the CPM-filter is a system-generated Access Control List (ACL) specifically designed for control plane protection. It is automatically instantiated on all line cards. Its primary function is to filter and rate-limit traffic from the data plane that is destined for the Control Plane Module (CPM). This mechanism is crucial for preventing Denial-of-Service (DoS) attacks and ensuring the stability of the router's control plane by managing the flow of protocol and management packets directed to the CPU.

A. Capture-filter ACL: This is used for traffic mirroring and debugging purposes to select specific packets to be copied to a destination for analysis, not for system-wide control plane protection.

C. Ingress ACL: This is a user-defined data plane filter applied to a subinterface to control transit traffic entering the router; it does not specifically target CPM-bound traffic by default.

D. Egress ACL: This is a user-defined data plane filter applied to a subinterface to control traffic leaving the router, which is irrelevant for incoming packets destined for the CPM.

---

1. Nokia SR Linux R23.10.R1 System Management Guide, Section: "ACLs".

Page/Section Reference: In the "ACLs" overview section, it states: "SR Linux uses CPM-filter ACLs to protect the CPM from being overwhelmed by traffic from the data plane. CPM-filter ACLs are system-generated and applied to all line card ports." This directly confirms that CPM-filters are instantiated on all line cards to manage traffic to the CPM.

2. Nokia SR Linux R23.10.R1 Data Center Fabric Configuration Guide, Section: "ACL filter policies".

Page/Section Reference: The section on "Filter policies" describes ingress and egress ACLs (ip-filter, ipv6-filter, mac-filter) as user-configured policies applied to subinterfaces for data plane traffic, distinguishing them from the system-level function of the CPM-filter.