The system-cpu-policer is a software-based policer implemented on the Control Plane Module (CPM). It is designed to rate-limit the aggregate control plane traffic received from all line cards. In contrast, the distributed-policer is the hardware-based policer, implemented on the Network Processor Units (NPUs) of the individual line cards (IOMs/IMMs). Each distributed-policer instance polices traffic on a per-line-card basis before it is forwarded to the CPM. Therefore, the statement that the system-cpu-policer is hardware-based is false.

A. Hierarchical policing is a supported feature, achieved by applying both a distributed-policer (first level, per-card) and a system-cpu-policer (second level, aggregate) to the same traffic flow.

C. The system-cpu-policer is centralized on the CPM, and its specific function is to police the combined, or aggregate, traffic destined for the CPU from all line cards.

D. A single CPM-filter entry can indeed reference both a distributed-policer and a system-cpu-policer. This is the mechanism used to implement hierarchical control plane policing.

1. Nokia 7750 SR OS Router Configuration Guide, Release 22.10.R1, Part: System Management, Section: CPM Filters.

Page/Section Reference: In the "CPM Filter Policers" subsection, the guide describes the two types of policers. It states, "The system CPU policer is implemented on the CPM and polices the aggregate traffic from all line cards." and "The distributed policer is implemented on the line cards (IOM/IMMs)..." This distinction confirms the system-cpu-policer is on the CPM (software) and the distributed-policer is on line cards (hardware). The guide also explicitly mentions that "Hierarchical policing is supported" by using both policer types.