I am reading the ENARSI chapter on CoPP, and it had just occurred to me that if we are protecting the CPU from unnecessary burden/ attacks, where are the ACL's processed in the router? Are the processed in CEF at the data plane? I cant seem to remember where the matching/ processing occurs and google wont help. Thanks everyone!