What is the difference between CAM and TCAM in a switch?
Show the answer
Say this first
CAM is exact-match memory: give it VLAN plus MAC and it returns the port in one lookup, so it holds the MAC table. TCAM stores a value and a mask, so each bit can be 0, 1 or don't-care. That lets it do longest-prefix-match routing, ACL, QoS and PBR lookups in one parallel step. TCAM is costly, hot and small, so its size sets how many routes and ACL entries a switch can hold in hardware.
Go deeper
Why the mask matters
An ACL entry permit tcp 10.10.0.0 0.0.0.255 any eq 443 becomes a TCAM row where the first 24 bits
of the source must match and the last 8 are don't-care, alongside protocol and port fields. A packet is
compared against every row at once and the first matching row (highest priority) wins. A route lookup
works the same way, with longer prefixes placed first.
Carving up TCAM
Catalyst switches divide TCAM with SDM templates: more space for routes, or for ACLs, or for IPv6.
show sdm prefer shows the current split, and changing it needs a reload. Nexus uses TCAM carving
commands for the same idea.
When it runs out
The switch logs a resource error. Routes or ACL entries that do not fit are either not installed or handled by the CPU in software, which is many times slower and can push the CPU to 100%. Symptoms look random: some prefixes are slow, some ACL lines do not work.
They will ask next
Why not keep routes in ordinary RAM like a server does?
Software routers do, using tree structures. A hardware switch must look up every packet at line rate, hundreds of millions per second, and TCAM returns the answer in one step. Many modern ASICs also use hash and algorithmic tables in SRAM to save TCAM space.
Traps
- Saying the MAC table lives in TCAM. It is an exact-match table; TCAM is for masked lookups.