Default CEF entries

By stretch | Thursday, June 5, 2008 at 5:19 a.m. UTC

It's interesting that even with an empty routing table, a modern Cisco router has several active CEF entries. Fire up an unconfigured router and issue the command show ip cef to view the default entries. The following output was observed on a 3725 running IOS 12.4(9)T1:

Router# show ip cef
Prefix              Next Hop             Interface
0.0.0.0/0           drop                 Null0 (default route handler entry)
0.0.0.0/32          receive
224.0.0.0/4         drop
224.0.0.0/24        receive
255.255.255.255/32  receive

I'm going to take a shot at identifying the purpose of each entry, in reverse order:

  • 255.255.255.255/32 - This is the local broadcast address for a subnet
  • 224.0.0.0/24 - The multicast block reserved for local network control traffic
  • 224.0.0.0/4 - All other multicast traffic (originally Class D space) should be dropped when multicast routing is disabled
  • 0.0.0.0/32 - Not sure, but assumed to be a reserved link-local address
  • 0.0.0.0/0 - Default entry matching all other addresses

Thoughts?

About the Author

Jeremy Stretch is a freelance networking engineer, instructor, and the maintainer of PacketLife.net. He currently lives in Fairfax, Virginia, on the edge of the Washington, DC metro area. Although primarily an R&S guy, he likes to get into everything, and runs a free network training lab out of his basement for fun. You can contact him by email or follow him on Twitter.

Posted in Routing

Comments

Kevin Gillick (guest) commented on Thursday, June 5, 2008 at 1:05 p.m. UTC

Jeremy,

I went to the IANA website and pulled this from RFC 3330

  1. Global and Other Specialized Address Blocks

0.0.0.0/8 - Addresses in this block refer to source hosts on "this" network. Address 0.0.0.0/32 may be used as a source address for this host on this network; other addresses within 0.0.0.0/8 may be used to refer to specified hosts on this network [RFC1700, page 4].

I hope this helps.

Kevin

Ivan Pepelnjak (guest) commented on Thursday, June 5, 2008 at 4:56 p.m. UTC

The 0.0.0.0/32 is the all-zero broadcast (I know, ancient, but obviously still supported).

Leave a Comment


Register to comment as a member. You'll look cooler.

Optional; will not be displayed publicly or given out.

No commercial links. Only personal (e.g. blog, Twitter, or LinkedIn) and/or on-topic links, please.
The four colors of wiring in a Cat 5E cabling are blue, green, orange, and what?