CEF is the default forwarding engine: no per-packet CPU work. Two precomputed structures:
- FIB — optimised copy of the RIB, longest-prefix entries, best path per prefix.
- Adjacency table — the rewritten L2 header per next-hop (MAC + outgoing interface), built from ARP/ND.
Flow: RIB → FIB → Adjacency. Both update event-driven on routing or ARP changes — hardware (ASIC) handles the hot path, the CPU only sees packets the ASIC punts it: traffic to the router itself, ACL-logged packets, unresolved adjacencies, IP options and other “complex” packets.
The lineage
| Method | Lookup | Status |
|---|---|---|
| Process switching | every packet: RIB + ARP | fallback only |
| Fast switching | first packet, then shortcut cache | deprecated |
| CEF | FIB + adjacency, no CPU | default |
Inspect: show ip cef (and show ip cef <prefix> detail to see the exact adjacency, i.e. the rewrite string). CEF is also the prerequisite everything else hangs off — NetFlow accounting and VRF-lite switching both ride on it.