IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

NPU traps

Updated: August 12, 2026

Want to summarize with AI?

Explains the exception, error, and non-LPTS control packets represented by NPU traps. Covers per-NPU policing, accepted and dropped counters, trap-statistics monitoring, and configurable trap policers.

Network Processing Unit (NPU) traps are packet classifications that

identify exception packets such as glean-adjacency traffic and packets with IPv4 options
identify error packets such as packets with an invalid checksum or hop count, and
identify control packets such as LACP and LLDP that do not pass through LPTS flow processing.

NPU traps complement Local Packet Transport Services (LPTS) flow policing. LPTS protects recognized router-bound flows, whereas NPU traps classify exception, error, and non-LPTS control traffic for NPU-level handling.

Trap-statistics indicators

Trap-statistics output uses these indicators:

(D): The NPU drops the trap packet.
(D*): The NPU drops the trap packet but retains statistics for analysis.
Accepted: The packet is available for additional processing or analysis.
Dropped: The packet exceeded the applicable treatment or policer rate.

How NPU trap policing works

A Network Processing Unit (NPU) raises traps for packets that require exception handling, contain errors, or represent control traffic that does not use Local Packet Transport Services (LPTS) flow processing.

Summary

The process uses these elements:

Trap classification: Identifies the reason for the exception or punt.
Trap policer: Limits traffic for the trap on each NPU.
Processing destination: Receives accepted packets that require additional handling.

Workflow

These stages describe how NPU trap policing works:

The NPU classifies an incoming packet and raises the applicable trap.
The per-NPU trap policer compares the packet rate with the programmed rate for that trap.
The NPU accepts packets that are within the policer rate and sends packets that require additional processing toward the CPU.
The NPU drops excess packets according to the system design and increments the dropped counter.

Result

Trap policing protects CPU resources while preserving accepted exception and control packets for required processing or analysis.

Monitor the NPU trap statistics

Use trap statistics to identify packet exceptions, drops, and policer activity at a Network Processing Unit (NPU) location.

Before you begin

Identify the route processor or line-card location and the NPU instance to monitor.

Procedure

Display trap statistics for one NPU or all NPUs at the selected location.

Use location 0/RP0/CPU0 for a fixed system. Use a line-card location, such as 0/1/CPU0, for a distributed system.

Example:

Router# show controllers npu stats traps-all instance all location 0/RP0/CPU0
Trap Type                          NPU  Trap TrapStats  Policer Policer    Packet    Packet

                                   ID   ID   ID                  Rate      Accepted  Dropped
============================================================================================================================
ETHERNET_ACL_DROP(D)               0     0    0x0        1       0          0         0
ETHERNET_ACL_FORCE_PUNT(D*)        0     1    0x0        1       0          0         0
ETHERNET_VLAN_MEMBERSHIP(D*)       0     2    0x0        1       0          0         0
ETHERNET_ACCEPTABLE_FORMAT         0     3    0x0        258     100        0         0
UNKNOWN_VLAN_OR_BUNDLE_MEMBER(D*)  0     4    0x0        259     100        0         0
NOT_MY_MAC(D*)                     0     5    0x0        260     100        0         0  
..                                 .     .    .          .       .          .         . 
ETHERNET_SA_MULTICAST(D*)          0     13   0x0        268     100        0         0
DHCPV4_SERVER                      0     14   0x0        269     542        0         0
DHCPV4_CLIENT                      0     15   0x0        270     200        0         0
ETHERNET_INGRESS_STP_BLOCK(D*)     0     18   0x0        1       0          0         0
PTP_OVER_ETHERNET                  0     19   0x0        274     4000       0         0
..                                 .     .    .          .       .          .         . 
OAMP_PFC_DROP_INVALID_RX(D*)       0    166   0x0        1       0          0         0
APP_SGACL_DROP(D*)                 0    168   0x0        1       0          0         0

Review the trap type, NPU ID, policer rate, accepted count, and dropped count.

Entries marked (D) are dropped by the NPU. Entries marked (D*) are dropped but remain available for statistics analysis.
Clear trap counters when you need a new measurement interval.
Example:
```
Router# clear controller npu stats traps-all instance all location 0/RP0/CPU0
```
Subsequent output reports trap activity accumulated after the counters were cleared.

The output identifies the traps and NPUs that accept or drop packets during the measurement interval.

Configurable trap policers

Configurable trap policers are control plane protection settings that

set a packet-per-second rate for an individual trap
define the expected average packet size for that trap, and
allow traffic treatment to be tuned for deployment-specific traffic patterns.

Per-trap controls help prevent excessive or burst traffic from overwhelming system resources while preserving legitimate protocol and exception traffic.

Table 1. Feature History Table
Feature Name	Release Information	Description
Configurable trap policers	Release 26.2.1	Introduced in this release on: Fixed Systems(8200, 8700)(select variants only*); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200, P100]) Configurable trap policers help prevent unnecessary packet drops, improve control-plane traffic handling, and support efficient scaling across diverse deployment scenarios. Per-trap rate limiting and average packet size tuning provide precise control over control-plane traffic.

Operational benefits

Per-trap configuration provides these operational benefits:

Reduces unintended drops of legitimate control plane traffic.
Adjusts individual trap settings without waiting for system-wide default changes.
Supports different traffic profiles across large-scale deployments.
Uses trap statistics to refine rate and packet-size settings.

Trap policer parameters

Use these values when you configure a policer for an individual Network Processing Unit (NPU) trap.

The table lists the supported trap policer parameters and ranges.

Table 2. Trap policer configuration parameters
Parameter	Description	Configurable value
rate	Sets the number of packets allowed each second.	0–50,000 packets per second
avg-pkt-size	Sets the expected average size of packets for the trap.	64–65,535 bytes

You can configure the rate, the average packet size, or both. Configuring both values aligns policing more closely with the observed packet rate and size.

Best practice: Tune trap policers from observed traffic

Recommendation:

Ensure that you tune trap policers based on actual traffic patterns to avoid unnecessary packet drops.

Start with conservative rate values and increase gradually when statistics show that legitimate traffic is being dropped.
Configure avg-pkt-size when traffic characteristics vary significantly from the default traffic profile.
- Tune traps individually instead of applying one rate to every trap.
- Use regular trap-statistics measurements to validate the settings.
Monitor trap statistics regularly to validate configuration effectiveness.
Adjust per trap instead of applying uniform settings across all traps.
Revisit configurations after topology or traffic changes.

Configure a trap policer

Use this procedure to adapt an individual Network Processing Unit (NPU) trap policer to the traffic profile at a node.

Before you begin

Identify the trap name and node location.

Record the current accepted and dropped counters before changing the policer.

Procedure

Configure and commit the packet rate for the trap at the target location.

Example:

Router# configure
Router(config)# lpts punt police location 0/0/CPU0
Router(config-lpts-policer)# exception isis rate 100
Router(config-lpts-policer)# commit

Optionally configure and commit the expected average packet size with the trap rate.

Example:

Router# configure
Router(config)# lpts punt police location 0/0/CPU0
Router(config-lpts-policer)# exception isis rate 100 avg-pkt-size 512
Router(config-lpts-policer)# commit

Verify the configured rate, hardware rate, average packet size, and packet counters.
Example:
```
Router# show controllers npu stats traps-all instance all location 0/0/CPU0
```
Confirm that the IS-IS trap reports the expected configured rate and average packet size. Use accepted and dropped counters to evaluate the setting.

The selected trap uses the configured per-location policer values.

What to do next

Monitor trap statistics over a representative traffic interval and adjust the values when legitimate traffic is dropped.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.