Career

Making Sense of RIBs, FIBs, CEF, and CAM - ENCORE Study Notes

Mark Daniel

• 2 min read
Making Sense of RIBs, FIBs, CEF, and CAM - ENCORE Study Notes

While studying for the ENCOR has its fair share of technical information and labbing that needs to be done to fully grasp the technical details of how networks work, there are also conceptual ideas that can be really difficult to keep straight.

One of the early things that trips me up are differentiating some of the early hardware and software switching mechanisms from the names to tables and other vocabulary. This can be tough because of the amount of 3 Letter Acronyms and similarity between names and concepts.

💡
1.7 Differentiate hardware and software switching mechanisms* 1.7.a Process and CEF* 1.7.b MAC address table and TCAM* 1.7.c FIB vs. RIB

I think when it comes to this, it makes more sense to start with what the MAC Address table and TCAM are.

The MAC Address Table is stored in what’s called the CAM, or Content Addressable Memory. It’s used for very fast lookups, and is called Content Addressable because you search by the content itself. The MAC Address Table maps Interfaces and VLANs with MAC Addresses. One limitation is that CAM lookups can only match based on exact matches. The CAM Table is populated by examining the source MAC address of frames it receives on its interfaces.

The TCAM is the Ternary Content Addressable Memory. Ternary by definition means three, so matches can be made based on 0 (true), 1 (false) and X is do not care. Items in the TCAM tables are stored in a VMR format for Value, Mask and Result. Because masks are heavily used in IP routing, Quality of Service and ACLs, TCAMs are heavily relied on.

The Routing Information Base (RIB) is essentially the routing table and is built from routing protocols and directly connected routes.

So after vocabulary, you get into the actual processes themselves.

Process Switching is the process by which a router makes a forwarding decision, calculates the cyclic redundancy check and rewrites the header of each frame before sending it off, which can be taxing to the CPU.

Fast Switching only interrupts the CPU for the first packet it receives, but then creates a cache in hardware that can be used by all subsequent frames.

Cisco Express Forwarding (CEF) is another (proprietary of course) switching mode that’s supposed to be even faster, and is differentiated also by building two other tables (and in turn two other vocabulary terms to remember):

  • Forwarding Information Base (FIB) - Built from the Routing Table (RIB) and has the next-hop IP address for each destination in the network.
  • Adjacency Table - Built using the ARP Table, and has each directly connected next-hop IP address and their next-hop IP address.

Remembering the FIB and Adjacency table as subitems to Cisco Express Forwarding helps keep them separate from all of the other items in my mind.

So to map it out, it would look like this: