CEF (Cisco Express Forwarding)

Hlw Rene,

Its Amazing. I have a questions that All route of RIB table will be install in FIB table??


Dear Rene,

I have one more questions…

How can I check that my router process & forward packet using CEF table . I have read the reply (May 16, 2016 at 21:04) but cann’t undersatnd on it. Please help me to breakdown it .My Router shows Route Catch is Zero…

Router-1#show interfaces stats 

          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor    2611585  221761348     574206   34967664
             Route cache          0          0          0          0
       Distributed cache 4659753014024 361667274043438 4823679979355 373666593999284
                   Total 4659755625609 361667495804786 4823680553561 373666628966948
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor      33260   15899224      31536    2407464
             Route cache          0          0          0          0
       Distributed cache 4789487303687 371034834722617 4659408834513 361522748851756
                   Total 4789487336947 371034850621841 4659408866049 361522751259220


@Davis show cef memory tells us how everything is allocated but it doesn’t really tell us how much memory CEF can use. I compared your two outputs, these are the lines that changed:


CEF: fib                  :  158091136/158520960  ( 99%) [4672]
CEF: terminal fibs list   :        128/312        ( 41%) [2]
TAL: MTRIE n08            :   46892072/47022896   ( 99%) [1422]


CEF: fib                  :     500048/501888     ( 99%) [20]
CEF: terminal fibs list   :         76/168        ( 45%) [1]
TAL: MTRIE n08            :      65952/66136      ( 99%) [2]

So it tells us how much has been allocated but not much what kind of limits we have. There’s a couple of things you can try. I’m not sure if show sdm prefer works on IOS XE but you can try it:

SW1#show sdm prefer 
 The current template is "desktop default" template.
 The selected template optimizes the resources in
 the switch to support this level of features for
 8 routed interfaces and 1024 VLANs. 

  number of unicast mac addresses:                  6K
  number of IPv4 IGMP groups + multicast routes:    1K
  number of IPv4 unicast routes:                    8K
    number of directly-connected IPv4 hosts:        6K
    number of indirect IPv4 routes:                 2K
  number of IPv4 policy based routing aces:         0
  number of IPv4/MAC qos aces:                      0.5K
  number of IPv4/MAC security aces:                 1K

The other two commands that might tell you something are:

show platform hardware qfp active tcam resource-manager usage
show platform hardware qfp active infra exmem statistics user

I only have a virtual IOS XE router here so I can’t try all of these :slight_smile:

@Zaman by default, all routers from the RIB will be installed in the FIB for fast forwarding. Take a look at this output:

Router-1#show interfaces stats 
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor    2611585  221761348     574206   34967664
             Route cache          0          0          0          0
       Distributed cache 4659753014024 361667274043438 4823679979355 373666593999284
                   Total 4659755625609 361667495804786 4823680553561 373666628966948

The distributed cache line shows the packets that have been received/forwarded by CEF:

  • 4659753014024 packets have been received by CEF.
  • 4823679979355 packets have been forwarded by CEF.
  • 2611585 packets have been received by the processor. These are probably packets from routing protocols etc.
  • 574206 packets have been forwarded by the processor. This could be any "management" traffic...stuff like OSPF, EIGRP, etc.


Ok. Thanks Rene.


Hi Rene,Andrew,Laz,

I have two questions :-
1 - In which memory arp table is saved ( CAM or TCAM ) ?
2 - What are the meaning of epoch & dependencies ?

Hussein Samir

  1. The ARP table is stored in RAM, and not in either CAM or TCAM

  2. Here is the Cisco definition of Epoch and how it is used:

The term "epoch" refers to a period of time. A new epoch for a Cisco Express Forwarding table begins when a table rebuild is initiated. The time after this instant is in an epoch different from the time before, and the different epochs are numbered between 0 and 255. Through the use of epochs, the software can distinguish between old and new forwarding information in the same database structure and can retain the old Cisco Express Forwarding database table while the software builds a new table. This is called epoch tracking and it allows Cisco Express Forwarding forwarding to continue uninterrupted while new Cisco Express Forwarding tables are being constructed, and it makes possible a seamless switchover when the new table becomes active

When you issue a show ip cef <route>, the dependencies output means how many other routes depend (are resolvable through) the <route> you looked up via the CEF command.

1 Like

Hi Rene,
Yet again you take the stress out of cisco technology. I find myself ALWAYS falling back on your site for concise, simple, clear and extremely well explained material. You’ve done it again with CEF. THANK YOU &… KEEP UP THE EXCELLENT WORK


HI Rene,

For this example

router# show ip route
D [90/25789217] via
R [120/4] via
O [110/229840] via

RIB or roiting table should have only one route entry(best route) on the basis of lowest AD, so only
D [90/25789217] via should enter ioto routing table not all 3 routes.
only best route go to routing table , why it shows all 3 routes.

What you say is correct assuming that all three routes were the same. In this case they are not. /26, /24, /19 are different routes even though the first three octets are the same.

1 Like

R1(config)#ip route
is wrong.

should be either R2 in place of R1 or should be
R1(config)#ip route


R1(config)#ip route
is wrong.

should be either R2 in place of R1 or should be
R1(config)#ip route

Hello Chandrakant.

I believe you are correct. Actually, those two commands should be on for each of the R1 and R2 routers like so:

R2(config)#ip route

R1(config)#ip route

I will let Rene know so it can be corrected.

Thanks very much!


Hi Chandrakant & Laz,

This part on R1:

R1(config)#ip route
R1(config)#ip route

Was added like this on purpose to demonstrate recursive routing. R1 does a lookup for 3.3.3.X and figures out it has to use It will then do a second lookup for which matches the second static route.


19 posts were merged into an existing topic: CEF (Cisco Express Forwarding)

Hi Rene,

Thanks for your Article .

I want to know about the Hashing Function that CEF use during Laod Banalance /Load share.Would you please clarify in your way dear :slight_smile:

Hello Mohammad

Cisco has a comprehensive explanation of load balancing using CEF and also describes the how a computed hash aids in the load balancing functionality:

A route might have several paths to a destination prefix, such as when a router is configured for simultaneous load balancing and redundancy. For each resolved path a pointer is added for the adjacency corresponding to the next-hop interface for that path. This mechanism is used for load balancing across several paths. For per destination load balancing a hash is computed out of the source and destination IP address. This hash points to exactly one of the adjacency entries in the adjacency table, providing that the same path is used for all packets with this source/destination address pair. If per packet load balancing is used the packets are distributed round robin over the available paths. In either case the information in the FIB and adjacency tables provide all the necessary forwarding information, just like for non-load balancing operation. The additional task for load balancing is to select one of the multiple adjacency entries for each forwarded packet.

You can find more about load balancing and CEF here.

I hope this has been helpful!


Thanks Brian, this has been fixed.

Hi Rene,

The question below is not very much related to CEF but with number of MACs a device has. Just in the beginning of the article:

The destination MAC address changes from FFF (Multilayer switch Fa0/1 ) to BBB (H2).
The source MAC address changes from AAA (H1) to GGG (Multilayer switch Fa0/2).

Can you please explain why switches have several MACs: one for the chassis and one for each port? One type is used for STP and other type for STP BPDUs? Can you please detail a bit on L2 and L3 switches, on routed ports and switched ports and on routers? What about SVIs? What if we build a port channel, do all the MACs of the corresponding switched ports disappear, and switch creates a new MAC for the bundle? What if every device (router or switch) just use a single MAC (say chassis MAC) and that’s it. Would we have a problem then?
I have searched on the net, read some info on Cisco support community but the the concept is still cloudy to me.
“MAC address of the device (chassis) is used in STP when electing the root bridge […]” - that is ok.
“The MAC address of interfaces are for example used in STP BPDUsmessages. It is used there as the source address of the frame.” - would be a problem if switch uses MAC of the chassis instead?

Have read that “Every interface of router have same MAC” - ok what if routers were built having same MAC on every routed interface?
Lots of questions, maybe the topic could be addressed on a new article.
Thank you very much!

Hello Adrian

These are all very good questions and are a good opportunity to clarify issues with MAC addressing.

There are manufacturers that create their switches so that all ports use the same MAC address. Cisco chooses not to do this (of course this depends on the platform. Some platforms do actually have the same MAC address for each port). Depending on the platform, a Cisco switch can have hundreds of MAC addresses available to be used for different purposes. For example, the 4000 and 6000 series Cisco catalyst devices have 1024 MAC addresses assigned to the supervisor, where these can be assigned for use with PVST instances. Other platforms have fewer addresses. The command show mac self will show the range of addresses assigned to the switch.

The MAC address assigned to the switch as a whole is used to determine the root bridge for STP. This is necessary because each switch must be able to be identified with one and only one MAC address for this purpose. The MAC addresses on the ports themselves are used when the destination of a frame is the switch itself. If there is a destination MAC address of a host on a frame, the switch will forward it to the appropriate port, but if the destination MAC address is that of the switch port itself, the switch will know that the destination is the switch itself. This is the case for BPDUs as you mention.

Concerning L2 and L3 switches, @ReneMolenaar has a good lesson that describes these well.

This Cisco documentation describes MAC addresses and SVIs and routed ports as well.

According to Cisco “In Layer 2 EtherChannels, the first port in the channel that comes up provides its MAC address to the EtherChannel. If this port is removed from the bundle, one of the remaining ports in the bundle provides its MAC address to the EtherChannel. For Layer 3 EtherChannels, the MAC address is allocated by the stack master as soon as the interface is created (through the interface port-channel global configuration command).” You can find more info here.

MAC addresses must be unique on any network segment. Theoretically, you can have the same MAC addresses on different network segments without a problem, that’s why the same MAC addresses can function on SVIs or on different ports of the switch, however, in general, MAC addresses are unique within the whole network. I believe this answers most of your next questions.

If you still require some clarification, feel free to respond appropriately!

I hope this has been helpful!