What is the difference between the FIB and the routing table?

The routing table (RIB) is the control plane's view - it is built by routing protocols and holds the best path per prefix along with metrics and administrative distance. The FIB is the data plane's copy, derived from the RIB and optimised purely for lookup speed. It contains no metrics or protocol information because forwarding does not need them. When the RIB changes, the FIB is updated to match.

What is the adjacency table used for?

The FIB tells the router which next hop and interface a packet should use; the adjacency table holds the pre-computed Layer 2 header for reaching that next hop. Keeping them separate means an ARP change only rewrites one adjacency entry rather than every FIB entry pointing at that next hop.

What does it mean when a packet is punted to the CPU?

Punting is when a packet cannot be handled by the fast forwarding path and is passed up to the CPU. Common causes are traffic destined for the router itself, an unresolved ARP entry so no adjacency exists yet, a TTL of one so an ICMP time-exceeded must be generated, packets carrying IP options, and packets needing fragmentation. Heavy punting is a classic cause of high CPU on an otherwise healthy router.

Is fast switching still used?

It is legacy. Fast switching process-switched the first packet to a destination and cached the result so later packets to the same destination bypassed the CPU - route once, switch many. CEF replaced it because the cache was built reactively, so the first packet of every new flow still paid the CPU cost and the cache could be invalidated in bursts. CEF builds its tables ahead of time instead.

What is the difference between CEF and dCEF?

With central CEF the route processor holds the FIB and adjacency table. With distributed CEF each line card holds its own copy, so forwarding decisions are made on the card without involving the route processor at all. The distinction matters on modular chassis platforms; the forwarding logic is identical either way.

CEF vs Process Switching: How a Router Actually Forwards a Packet

Q: What is the difference between CEF and process switching?

Process switching hands every packet to the CPU, which performs a full routing-table lookup and builds the Layer 2 header for each one. CEF does the work in advance: it pre-builds a Forwarding Information Base from the routing table and an adjacency table holding the Layer 2 rewrite information, so forwarding becomes a fast lookup with no per-packet CPU involvement. Process switching is the slowest method and CEF is the default on modern Cisco platforms.

By Moussa BENALI, Senior Network & Security Engineer · CCNP ENCOR 350-401 · Domain 3.0 Infrastructure (~30%)

The short answer: process switching makes the CPU look up the route and build the Layer 2 header for every single packet. CEF does that work in advance and stores the answers in two tables - the FIB and the adjacency table - so forwarding becomes a lookup rather than a computation. Fast switching sits between them historically and is now legacy.

💡

The one idea to hold on to: all three methods produce the same forwarding decision. They differ only in when the work happens. Process switching computes on demand, fast switching computes once then caches the result, and CEF computes everything up front before any packet arrives. Every other detail follows from that.

Your free ENCOR exam code

Infrastructure is ~30% of ENCOR. Is it your strong domain or your weak one?

A full-length ENCOR 350-401 practice exam on the v1.2 blueprint, with an explanation on every item and a coach that ranks the concepts costing you marks. The code applies itself when you create the account.

CCNP-EXAM-FULL Redeem the code

Free, no credit card. Already have an account? Log in to start · Or keep reading - 5 free practice questions at the end.

Side by side

	Process switching	Fast switching	CEF
Who forwards	CPU, every packet	CPU for the first packet	Data plane, no CPU
Lookup against	Routing table (RIB)	Route cache	FIB + adjacency table
Tables built	Nothing cached	Reactively, on first packet	Proactively, in advance
First packet of a flow	Slow	Slow	Fast - no penalty
CPU load	Very high	Moderate	Low
Load balancing	Per packet	Per destination	Per destination or per packet
Status today	Fallback / punted traffic	Legacy	Default

Process switching: correct, and slow

A packet arrives. The interface interrupts the CPU, the CPU walks the routing table to find the longest prefix match, works out the next hop, consults ARP for that next hop's MAC address, builds a new Layer 2 header and sends the packet out. Then the next packet arrives and it does the whole thing again.

It is completely correct and completely unscalable. It is still what happens to traffic that cannot take the fast path - see punting below - which is why a router with a forwarding problem shows up as a router with a CPU problem.

Fast switching: route once, switch many

Fast switching was the first optimisation. The first packet to a given destination is process-switched as normal, but the result is written into a route cache. Subsequent packets to that destination are forwarded from the cache without troubling the CPU. Hence the phrase you will see in older material: route once, switch many.

Two problems killed it. The cache is built reactively, so the first packet of every new flow still pays full price - painful on a router facing many short-lived flows. And when the routing table changes the cache is invalidated, so traffic falls back to the CPU in exactly the moment the network is least stable.

CEF: build the answers before the questions arrive

CEF removes the reactive cache entirely. Instead it maintains two tables, populated in advance from the control plane:

The FIB

The Forwarding Information Base is the data plane's copy of the routing table. It is derived from the RIB but stripped of everything forwarding does not need - no metrics, no administrative distance, no protocol origin - and organised for the fastest possible longest-prefix lookup. When the RIB changes, the FIB is updated to match.

📋

RIB versus FIB, the distinction the exam wants: the RIB is the control plane's best-path decision, complete with metrics and administrative distance. The FIB is the data plane's lookup structure, containing only what is needed to move a packet. One is about choosing, the other is about doing.

The adjacency table

The FIB says which next hop and outgoing interface to use. The adjacency table holds the pre-computed Layer 2 header for reaching each next hop - the MAC rewrite, learned from ARP on Ethernet.

The reason these are two tables rather than one is worth understanding, because it explains why CEF handles change well. Hundreds of FIB prefixes may point at the same next hop. If that next hop's MAC address changes, CEF rewrites one adjacency entry and every prefix using it is immediately correct. Fold the two together and you would have to touch hundreds of entries instead.

In hardware

On Layer 3 switches the FIB is programmed into TCAM, which performs a longest-prefix match on the whole table in a single lookup rather than walking it. This is what "hardware forwarding" means, and it is why a Catalyst forwards at line rate while a software router does not. It also introduces a real-world limit: TCAM is finite. Exceed it and the platform falls back to software forwarding, which is precisely the failure mode that turns a healthy switch into a slow one.

Punting: when the fast path gives up

Some packets cannot be CEF-switched and are handed to the CPU. This is called punting, and knowing the causes is worth marks:

Traffic for the router itself - routing protocol hellos, SSH sessions, SNMP. It is not being forwarded, it is being consumed.
No adjacency yet - the next hop's MAC is unknown, so ARP must resolve before an adjacency can exist. This is a glean adjacency.
TTL expiring - the router must generate an ICMP time-exceeded, which is a CPU job. This is why traceroute is CPU work at every hop.
IP options set - the header needs interpreting rather than just forwarding.
Fragmentation required - the packet exceeds the egress MTU and DF is not set.
Features the hardware cannot do - certain NAT, encryption or ACL logging cases, depending on platform.

⚠️

The troubleshooting instinct this should give you: high CPU on a router that is only forwarding traffic almost always means something is being punted. A misconfigured ACL with log, an ARP problem, or a routing loop driving TTL expiry will all do it. Control Plane Policing (CoPP) exists precisely to stop punted traffic from overwhelming the CPU - which is why CoPP sits in ENCOR's Security domain and connects straight back to this one.

Verifying it

The commands worth recognising:

show ip cef - the FIB. Prefix, next hop, outgoing interface.
show adjacency - the adjacency table and its Layer 2 rewrite strings.
show ip cef exact-route <src> <dst> - which path a specific flow actually takes across an equal-cost set.
show ip interface - confirms CEF is enabled on the interface.
show processes cpu sorted - if IP Input is high, packets are being process-switched.

CEF is on by default and disabling it globally is a diagnostic step, not a configuration choice. no ip cef on a production router drops it to process switching - and on a busy device that is how you turn a performance question into an outage.

Practice questions (5 free)

Same style as the full ENCOR exam - an explanation on every option, not just the right one.

Your free ENCOR exam code

Five questions is a taster. A full exam is a diagnosis.

Infrastructure is one of six domains and the heaviest at ~30%. A complete ENCOR exam shows you which domains are actually costing you marks - then the pack adds the rest as a one-time purchase with lifetime access, not an annual licence.

CCNP-EXAM-FULL Redeem the code

Free, no credit card. Already have an account? Log in to start

Frequently asked questions

What is the difference between CEF and process switching?

Process switching gives every packet to the CPU for a full routing lookup and Layer 2 header build. CEF does that work in advance and stores it in the FIB and adjacency table, so forwarding is a lookup with no per-packet CPU involvement. CEF is the default on modern platforms; process switching is what handles traffic the fast path cannot.

What is the difference between the RIB and the FIB?

The RIB - the routing table - is the control plane's view, with metrics, administrative distance and protocol origin. The FIB is the data plane's copy, derived from it and stripped to just what forwarding needs, organised for lookup speed. One chooses the path, the other executes it.

Why are the FIB and adjacency table separate?

So that Layer 2 changes are cheap. Many prefixes can share one next hop; when that next hop's MAC changes, CEF updates a single adjacency entry rather than every prefix pointing at it.

What causes a packet to be punted to the CPU?

Traffic destined for the router itself, an unresolved ARP so no adjacency exists, TTL expiry requiring an ICMP message, IP options, required fragmentation, and platform-specific features hardware cannot handle. Sustained punting is the usual reason a forwarding router shows high CPU.

Is fast switching still relevant?

Only historically, and for the exam. Its reactive cache meant the first packet of every flow still hit the CPU, and routing changes invalidated the cache at the worst moment. CEF's proactive tables solve both.

What is dCEF?

Distributed CEF. Each line card holds its own FIB and adjacency table and forwards without involving the route processor. Relevant on modular chassis platforms; the forwarding logic itself is unchanged.