How does CEF forward a packet? Explain the FIB and the adjacency table.
Show the answer
Say this first
CEF keeps two tables built before any traffic arrives. The FIB has every prefix with its resolved next hop. The adjacency table has one entry per next hop with the full layer 2 header already built from ARP. For each packet the router does one FIB lookup, takes the matching adjacency, writes the prebuilt header and sends it. Special adjacencies cover the rest: glean, receive, drop, null and punt.
Go deeper
The FIB
R1# show ip cef
Prefix Next Hop Interface
0.0.0.0/0 203.0.113.1 GigabitEthernet0/0/0
0.0.0.0/8 drop
0.0.0.0/32 receive
10.0.12.0/30 attached GigabitEthernet0/0/1
10.0.12.0/32 receive GigabitEthernet0/0/1
10.0.12.1/32 receive GigabitEthernet0/0/1
10.0.12.2/32 attached GigabitEthernet0/0/1
10.0.12.3/32 receive GigabitEthernet0/0/1
10.1.0.0/24 10.0.12.2 GigabitEthernet0/0/1
127.0.0.0/8 drop
203.0.113.0/30 attached GigabitEthernet0/0/0
203.0.113.0/32 receive GigabitEthernet0/0/0
203.0.113.1/32 attached GigabitEthernet0/0/0
203.0.113.2/32 receive GigabitEthernet0/0/0
203.0.113.3/32 receive GigabitEthernet0/0/0
224.0.0.0/4 drop
224.0.0.0/24 receive
240.0.0.0/4 drop
255.255.255.255/32 receiveattachedon a subnet is a glean adjacency: the subnet is connected, but hosts in it still need ARP.attachedon a /32 such as 10.0.12.2 is a resolved neighbor with a complete adjacency.receiveis for the router itself: its addresses, and the network and broadcast addresses of its subnets.
The adjacency
R1# show adjacency GigabitEthernet0/0/1 detail
Protocol Interface Address
IP GigabitEthernet0/0/1 10.0.12.2(9)
0 packets, 0 bytes
epoch 0
sourced in sev-epoch 2
Encap length 14
00A0C9AA0202005056B1120A0800
L2 destination address byte offset 0
L2 destination address byte length 6
Link-type after encap: ip
ARPThe 14-byte string is the Ethernet header CEF will paste on: destination MAC 00A0.C9AA.0202 (R2),
source MAC 0050.56B1.120A (R1's Gi0/0/1), EtherType 0800 (IPv4). ARP says where it was learned.
Special adjacencies
| Type | Meaning |
|---|---|
| glean | connected subnet, MAC not known yet: punt to trigger ARP |
| receive | packet is for the router: send to the CPU |
| drop | discard (reserved ranges, failures) |
| null | route to Null0: discard |
| punt | feature needs the CPU to handle the packet |
| incomplete | ARP was sent but not answered |
They will ask next
Why is the first ping from a router to a new neighbor often lost?
The first packet hits a glean adjacency. The router sends an ARP request and drops that packet while it waits, so you see
.!!!!. Once ARP completes the adjacency is complete and the rest succeed.
Traps
- Saying CEF is a cache built from traffic. That was fast switching. CEF is built from the RIB and ARP before traffic arrives.