What is the difference between process switching, fast switching and CEF?
Show the answer
Say this first
Process switching sends every packet to the CPU for a full routing table and ARP lookup. Fast switching process-switches the first packet to a destination and caches the result, so later packets use the cache, but the cache is built on demand and thrown away when routes change. CEF builds the FIB and adjacency table from the RIB and ARP ahead of time, so every packet, including the first, is forwarded with one lookup. CEF is the default on every current IOS and IOS-XE platform.
Go deeper
| Method | How | Weakness |
|---|---|---|
| Process switching | CPU handles each packet: RIB lookup, ARP lookup, rewrite | slow and CPU bound |
| Fast switching | first packet per destination process switched, result cached | first packet penalty, cache churn when routes change, many new destinations (a worm scan) overwhelm it |
| CEF | FIB and adjacencies prebuilt from the control plane | none of the above; needs memory for the full table |
What CEF still punts to the CPU
- Packets addressed to the router itself (receive).
- TTL expiry, which needs an ICMP time exceeded.
- Packets to a connected host whose ARP is not resolved yet (glean).
- IP options and some features the platform cannot do in the fast path.
Hardware platforms
Catalyst and Nexus switches and large routers program the same FIB and adjacency model into ASIC tables (TCAM and SRAM). Distributed CEF (dCEF) gives each line card its own copy. The CPU only sees punted traffic, which is why control plane policing exists.
They will ask next
Why did old guides say to turn off route caching before running debug ip packet?
debug ip packetonly sees packets the CPU handles.no ip route-cacheon the interface forced process switching so the debug saw everything. On a busy router that can push the CPU to 100 percent, so use an ACL on the debug, a packet capture, or Embedded Packet Capture instead.
Traps
- Describing CEF as fast switching with a bigger cache. CEF is topology-driven, not traffic-driven.