Why Forwarding Speed Became a Bottleneck
The basic routing table lookup discussed earlier in this series describes the logical process of finding the best matching route, but says nothing about how efficiently a router performs that lookup for every single packet at line-rate speeds of millions of packets per second. Early Cisco routers used a forwarding method called Process Switching, which performed a complete routing table lookup and ARP resolution, discussed earlier in this series, for every individual packet — a process far too slow for anything beyond very low traffic volumes.
The Older Alternative: Fast Switching
An intermediate improvement, Fast Switching, cached the result of the first packet's lookup in a route cache, so subsequent packets to the same destination could skip the full lookup process. This worked reasonably well, but had a critical weakness: the cache was built reactively, based on traffic that had already been seen, meaning the very first packet to any new destination always incurred the full, slow lookup penalty, and the cache itself could become a significant source of memory and processing overhead at very large scale.
CEF: Precomputing the Forwarding Decision
Cisco Express Forwarding (CEF), the modern default forwarding method on virtually all current Cisco platforms, solves this by proactively precomputing forwarding information for every known destination before any traffic for it even arrives, rather than reactively caching based on observed traffic.
CEF's two core data structures:
FIB (Forwarding Information Base):
A streamlined, hardware-optimized copy of the
routing table, containing only the information
needed to make a forwarding decision — essentially
a precomputed version of "show ip route,"
discussed earlier in this series, optimized
specifically for lookup speed
Adjacency Table:
Contains the Layer 2 rewrite information needed
to actually forward a packet — the destination
MAC address and outgoing interface, essentially
a precomputed version of the ARP table, discussed
earlier in this series regarding IPv4 addressingBecause both structures are built proactively from the routing and ARP tables whenever they change, rather than reactively from observed traffic, CEF eliminates the "first packet penalty" that Fast Switching suffered from — even the very first packet to a brand-new destination benefits from the same precomputed forwarding speed as every subsequent packet.
How a CEF Forwarding Decision Actually Works
Simplified CEF forwarding process for an arriving packet:
1. Router examines the packet's destination IP address
2. Performs a lookup directly against the FIB
(a highly optimized data structure, often a
trie-based structure similar in spirit to the
tree-based indexing discussed earlier in this
series regarding databases)
3. The FIB entry points directly to a pre-built
adjacency table entry
4. The adjacency entry provides the exact Layer 2
header rewrite needed
5. The packet is forwarded with minimal additional
computation requiredThis separation of the "where to send it" decision (FIB) from the "how to format it for the next hop" decision (adjacency table) is what allows CEF to be implemented efficiently in specialized forwarding hardware (ASICs) on high-end platforms, achieving forwarding rates far beyond what a general-purpose CPU performing the equivalent logical steps could sustain.
Verifying CEF Operation
Router# show ip cef
Prefix Next Hop Interface
0.0.0.0/0 203.0.113.1 GigabitEthernet0/0
192.168.1.0/24 attached GigabitEthernet0/1
192.168.2.0/24 10.0.0.2 GigabitEthernet0/0
Router# show adjacency detail
IP GigabitEthernet0/0 10.0.0.2(5)
0 packets, 0 bytes
00000C9FF23300000C9FF2340800
ARP 03:58:22show ip cef confirms the FIB matches what would be expected from the routing table, and show adjacency detail reveals the actual precomputed Layer 2 rewrite information — the hexadecimal string shown represents the exact destination MAC address and header bytes that get stamped onto every packet forwarded to that destination, confirming CEF has everything it needs without performing per-packet ARP resolution.
CEF Load Balancing Across Multiple Paths
When multiple equal-cost paths exist to the same destination, discussed earlier in this series regarding routing metrics, CEF must decide how to distribute traffic across them, offering two distinct load-balancing modes.
Per-Destination Load Balancing (default):
All packets to the same destination IP address
consistently use the same path, while different
destinations may use different paths
Benefit: preserves packet ordering within a
single flow, which many applications expect
Per-Packet Load Balancing:
Packets are distributed across available paths
in round-robin fashion, regardless of destination
Benefit: more even bandwidth utilization across
paths, but risks packets arriving out of order,
since different packets in the same flow may
take paths with different latencyRouter(config)# interface gigabitethernet 0/0
Router(config-if)# ip load-sharing per-packet
-- Per-destination is the default and is strongly
-- preferred for most applications, since out-of-order
-- packet delivery can degrade TCP performance and
-- disrupt certain real-time applicationsPer-destination load balancing is the correct choice for the vast majority of production networks, since the risk of out-of-order delivery under per-packet load balancing typically outweighs the marginal improvement in bandwidth utilization evenness it provides.
Why Understanding CEF Matters for Troubleshooting
CEF operates automatically and transparently by default on modern Cisco devices, and most administrators never explicitly configure it — but a handful of specific troubleshooting scenarios require understanding it directly, such as diagnosing a router that continues forwarding traffic to a destination whose route was just removed (indicating the FIB has not yet synchronized with the routing table) or diagnosing unexpected load-sharing behavior across redundant paths.
Router# clear ip cef inconsistency-checkers
-- Occasionally used in troubleshooting when the
-- FIB and routing table appear to have fallen
-- out of sync, forcing a rebuild of CEF's
-- forwarding structures from the current
-- routing table stateWhy CEF's Architecture Underlies Modern Network Performance
Every high-throughput forwarding feature covered later in this series, along with the sheer traffic volumes modern enterprise and service provider networks routinely handle, depends on the efficient, precomputed forwarding architecture CEF provides. Understanding the distinction between the FIB and adjacency table, and knowing how to verify both are correctly populated, is essential troubleshooting knowledge that goes beyond what the basic "show ip route" verification covered earlier in this series can reveal.