--- title: Cache-Based Packet Forwarding « ipSpace.net blog | daily.dev description: A deep dive into cache-based packet forwarding, tracing the history from Cisco's fast switching through to Cisco Express Forwarding (CEF). Fast switching... canonical: https://daily.dev/posts/cache-based-packet-forwarding-ipspace-net-blog-ciapydefx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cache-Based Packet Forwarding « ipSpace.net blog | daily.dev og:description: A deep dive into cache-based packet forwarding, tracing the history from Cisco's fast switching through to Cisco Express Forwarding (CEF). Fast switching... og:url: https://daily.dev/posts/cache-based-packet-forwarding-ipspace-net-blog-ciapydefx og:image: https://api.daily.dev/og/posts/cIapydeFX.png og:image:alt: Cache-Based Packet Forwarding « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cache-Based Packet Forwarding « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 8 min read · 0 upvotes · 0 comments ## Summary A deep dive into cache-based packet forwarding, tracing the history from Cisco's fast switching through to Cisco Express Forwarding (CEF). Fast switching cached the results of routing and ARP lookups to avoid expensive process switching, but suffered from fundamental problems: incomplete ECMP support, difficult cache invalidation (ultimately solved by flushing the entire cache on any routing change), and catastrophic performance collapse under cache thrashing — a vulnerability exploitable by simple port scans. The post argues that cache-based forwarding never truly scaled, and uses the evolution of LISP (which abandoned its original demand-based/cache-based model in favor of full routing tables with PubSub) as proof. The conclusion: any cache-based forwarding scheme, whether fast switching, conversation learning, or original LISP, can be defeated by address scanning, and if the cache is large enough to hold all destinations with infrequent changes, it's just unnecessary complexity over a proper FIB. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did Cisco replace fast switching with CEF (Cisco Express Forwarding)? Fast switching was replaced by CEF because its cache-based model had fatal scalability flaws. Cache invalidation was never properly solved — Cisco ultimately flushed the entire cache on any routing table change. More critically, port scans could pollute the fast switching cache and force a router into slow process switching, causing regional Internet brownouts. CEF uses a fully pre-evaluated forwarding table, eliminating these vulnerabilities. _Network engineers debugging CEF vs. fast switching behavior track these architectural trade-offs on daily.dev._ ### What information was stored in the Cisco IOS fast switching cache? The fast switching cache stored four items per entry: the IP prefix (using a calculated subnet mask based on a non-standard algorithm, possibly host entries in early versions), the IP next hop (used only for cache invalidation), the outgoing interface, and the complete pre-computed layer-2 header. This avoided recursive routing table lookups for subsequent packets to the same destination. _Engineers working through Cisco IOS forwarding internals find historical and current networking deep-dives on daily.dev._ ### How did cache-based forwarding handle ECMP load balancing in Cisco fast switching? Fast switching load-balanced per destination IP address, not per packet. When a destination not in the cache arrived, it was process-switched, and the routing table's round-robin next-hop pointer advanced to the next path, which was then cached for that IP. This meant all subsequent packets to the same IP used one cached path, unlike process switching which balanced per packet across all ECMP paths. _Architects evaluating load-balancing behavior across forwarding planes find relevant comparisons on daily.dev._ ## Similar posts on daily.dev - [So long, and thanks for all the fish: how to escape the Linux networking stack](https://daily.dev/posts/so-long-and-thanks-for-all-the-fish-how-to-escape-the-linux-networking-stack-jwvm9hpw7) · Cloudflare · 29 upvotes · 1 comments - [The world in which IPv6 was a good design](https://daily.dev/posts/the-world-in-which-ipv6-was-a-good-design-tj3i8ov0s) · Hacker News · 0 upvotes · 0 comments --- Tags: [#lisp](https://daily.dev/tags/lisp) [View this post on daily.dev](https://daily.dev/posts/cache-based-packet-forwarding-ipspace-net-blog-ciapydefx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cache-Based Packet Forwarding « ipSpace.net blog","url":"https://daily.dev/posts/cache-based-packet-forwarding-ipspace-net-blog-ciapydefx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cache-based-packet-forwarding-ipspace-net-blog-ciapydefx"},"datePublished":"2026-08-11T08:53:41.342Z","dateModified":"2026-08-11T09:14:33.966Z","description":"A deep dive into cache-based packet forwarding, tracing the history from Cisco's fast switching through to Cisco Express Forwarding (CEF). Fast switching...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cache-based-packet-forwarding-ipspace-net-blog-ciapydefx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"lisp","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Cache-Based Packet Forwarding « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cache-based-packet-forwarding-ipspace-net-blog-ciapydefx#faq","mainEntity":[{"@type":"Question","name":"Why did Cisco replace fast switching with CEF (Cisco Express Forwarding)?","acceptedAnswer":{"@type":"Answer","text":"Fast switching was replaced by CEF because its cache-based model had fatal scalability flaws. Cache invalidation was never properly solved — Cisco ultimately flushed the entire cache on any routing table change. More critically, port scans could pollute the fast switching cache and force a router into slow process switching, causing regional Internet brownouts. CEF uses a fully pre-evaluated forwarding table, eliminating these vulnerabilities. Network engineers debugging CEF vs. fast switching behavior track these architectural trade-offs on daily.dev."}},{"@type":"Question","name":"What information was stored in the Cisco IOS fast switching cache?","acceptedAnswer":{"@type":"Answer","text":"The fast switching cache stored four items per entry: the IP prefix (using a calculated subnet mask based on a non-standard algorithm, possibly host entries in early versions), the IP next hop (used only for cache invalidation), the outgoing interface, and the complete pre-computed layer-2 header. This avoided recursive routing table lookups for subsequent packets to the same destination. Engineers working through Cisco IOS forwarding internals find historical and current networking deep-dives on daily.dev."}},{"@type":"Question","name":"How did cache-based forwarding handle ECMP load balancing in Cisco fast switching?","acceptedAnswer":{"@type":"Answer","text":"Fast switching load-balanced per destination IP address, not per packet. When a destination not in the cache arrived, it was process-switched, and the routing table's round-robin next-hop pointer advanced to the next path, which was then cached for that IP. This meant all subsequent packets to the same IP used one cached path, unlike process switching which balanced per packet across all ECMP paths. Architects evaluating load-balancing behavior across forwarding planes find relevant comparisons on daily.dev."}}]} ```