A forwarding information base (FIB), also known as a forwarding table or MAC table, is most commonly used in network
bridging,
routing
Routing is the process of selecting a path for traffic in a network or between or across multiple networks. Broadly, routing is performed in many types of networks, including circuit-switched networks, such as the public switched telephone netw ...
, and similar functions to find the proper output
network interface controller
A network interface controller (NIC, also known as a network interface card, network adapter, LAN adapter or physical network interface, and by similar terms) is a computer hardware component that connects a computer to a computer network.
Ear ...
to which the input interface should forward a packet. It is a dynamic table that maps MAC addresses to ports. It is the essential mechanism that separates
network switch
A network switch (also called switching hub, bridging hub, and, by the IEEE, MAC bridge) is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device.
A netw ...
es from
Ethernet hub
An Ethernet hub, active hub, network hub, repeater hub, multiport repeater, or simply hub is a network hardware device for connecting multiple Ethernet devices together and making them act as a single network segment. It has multiple input/out ...
s.
Content-addressable memory
Content-addressable memory (CAM) is a special type of computer memory used in certain very-high-speed searching applications. It is also known as associative memory or associative storage and compares input search data against a table of stored d ...
(CAM) is typically used to efficiently implement the FIB, thus it is sometimes called a CAM table.
Applications at data link layer
At the
data link layer
The data link layer, or layer 2, is the second layer of the seven-layer OSI model of computer networking. This layer is the protocol layer that transfers data between nodes on a network segment across the physical layer. The data link layer p ...
, a FIB is most notably used to facilitate Ethernet bridging based on
MAC address
A media access control address (MAC address) is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. This use is common in most IEEE 802 networking techno ...
es. Other data-link-layer technologies using FIBs include
Frame Relay
Frame Relay is a standardized wide area network (WAN) technology that specifies the physical and data link layers of digital telecommunications channels using a packet switching methodology. Originally designed for transport across Integrated Se ...
,
Asynchronous Transfer Mode
Asynchronous Transfer Mode (ATM) is a telecommunications standard defined by American National Standards Institute (ANSI) and ITU-T (formerly CCITT) for digital transmission of multiple types of traffic. ATM was developed to meet the needs of ...
(ATM) and
multiprotocol label switching
Multiprotocol Label Switching (MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on labels rather than network addresses. Whereas network addresses identify endpoints the labels identif ...
(MPLS).
Bridging
The role of an Ethernet switch is to forward
Ethernet frame
In computer networking, an Ethernet frame is a data link layer protocol data unit and uses the underlying Ethernet physical layer transport mechanisms. In other words, a data unit on an Ethernet link transports an Ethernet frame as its payload ...
s from one port to another. The presence of a FIB is one attribute that separates a switch from a hub. Without a functional FIB, all frames received by a network switch would be echoed back out to all other ports, much like an
Ethernet hub
An Ethernet hub, active hub, network hub, repeater hub, multiport repeater, or simply hub is a network hardware device for connecting multiple Ethernet devices together and making them act as a single network segment. It has multiple input/out ...
. In bridging packets between ports, a switch should only emit a frame on the port where the destination network device resides (
unicast
Unicast is data transmission from a single sender (red) to a single receiver (green). Other devices on the network (yellow) do not participate in the communication.
In computer networking, unicast is a one-to-one transmission from one point in ...
), unless the frame is for all nodes on the switch (
broadcast
Broadcasting is the distribution of audio or video content to a dispersed audience via any electronic mass communications medium, but typically one using the electromagnetic spectrum ( radio waves), in a one-to-many model. Broadcasting began ...
), multiple nodes (
multicast
In computer networking, multicast is group communication where data transmission is addressed to a group of destination computers simultaneously. Multicast can be one-to-many or many-to-many distribution. Multicast should not be confused with ...
) or if the switch doesn't know where the destination device resides (
unicast flood
In computer networking, a unicast flood is when a switch receives a unicast frame and treats it as a broadcast frame, flooding the frame to all other ports on the switch.
Background
The term ''unicast'' refers to a one-to-one transmission from one ...
).
Switches learn the port on which they first saw a particular source address and associate that port with that address. When the bridge subsequently receives a frame with a destination address in its FIB, it sends the frame out the port stored in the FIB entry.
The FIB is a memory construct used by Ethernet switch to map a station's MAC address to the switch port the station is connected to. This allows switches to facilitate communications between connected stations at high speed.
Frame Relay
While the exact mechanics of a forwarding table is implementation-specific, the general model for Frame Relay is that switches have statically defined forwarding tables, one per interface. When a frame with a given
data link connection identifier
A data link connection identifier (DLCI) is a Frame Relay 10-bit-wide link-local virtual circuit identifier used to assign frames to a specific PVC or SVC. Frame Relay networks use DLCIs to statistically multiplex frames. DLCIs are preloaded int ...
(DLCI) is received on one interface, the table associated with that interface gives the outgoing interface, and the new DLCI to insert into the frame's address field.
Asynchronous Transfer Mode
ATM switches have link-level forwarding tables much like those used in Frame Relay. Rather than a DLCI, however, interfaces have forwarding tables that specify the outgoing interface by ''virtual path identifier'' (VPI) and ''virtual circuit identifier'' (VCI). These tables may be configured statically, or they can be distributed by the
Private Network-to-Network Interface
The Private Network-to-Network Interface (PNNI) is a link-state routing protocol used in Asynchronous Transfer Mode (ATM) networks. PNNI is similar to the open shortest path first (OSPF) used for IP routing.
PNNI is a suite of network protocols th ...
(PNNI) protocol. When PNNI is in use, the ATM switches at the edges of the network map one of the standard ATM end-to-end identifiers, such as an
NSAP address, to the next-hop VPI/VCI.
Multiprotocol label switching
MPLS has many similarities, at the forwarding level, to ATM. The label edge routers at the edges of an MPLS cloud map between the end-to-end identifier, such as an IP address, and a link-local label. At each MPLS hop, there is a forwarding table that tells the label switched router which outgoing interface is to receive the MPLS packet, and what label to use when sending the packet out that interface.
Applications at the network layer
Network layer
In the seven-layer OSI model of computer networking, the network layer is layer 3. The network layer is responsible for packet forwarding including routing through intermediate routers.
Functions
The network layer provides the means of transfe ...
addresses, such as
IP address
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
es, are used on different types of media and can be handled similarly in all cases.
Forwarding
FIBs are optimized for fast lookup of destination addresses and can improve performance of forwarding compared to using the
routing information base
In computer networking, a routing table, or routing information base (RIB), is a data table stored in a router or a network host that lists the routes to particular network destinations, and in some cases, metrics (distances) associated with th ...
(RIB) directly. The RIB is optimized for efficient updating by
routing protocol
A routing protocol specifies how routers communicate with each other to distribute information that enables them to select routes between nodes on a computer network. Routers perform the traffic directing functions on the Internet; data packets ...
s and other
control plane
In network routing, the control plane is the part of the router architecture that is concerned with drawing the network topology, or the information in a routing table that defines what to do with incoming packets. Control plane functions, such as ...
methods, and contain the full set of routes learned by the router. Earlier implementations cached only a subset of the routes most frequently used in actual forwarding, and this worked reasonably well for enterprises where there is a meaningful most-frequently-used subset. Routers used for accessing the entire Internet, however, experienced severe performance degradation in refreshing routes cached in a small FIB, and various implementations moved to having FIBs in one-to-one correspondence with the RIB.
Ingress filtering against denial of service
FIBs can also play a role in an Internet
best current practice
A Best Current Practice (BCP) is a ''de facto'' level of performance in engineering and information technology. It is more flexible than a standard, since techniques and tools are continually evolving.
The Internet Engineering Task Force publish ...
(BCP) of
ingress filtering
In computer networking, ingress filtering is a technique used to ensure that incoming Packet (information technology), packets are actually from the networks from which they claim to originate. This can be used as a countermeasure against various ...
. Though the simplest form of ingress filtering is to use
access-control list
In computer security, an access-control list (ACL) is a list of permissions associated with a system resource (object). An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on give ...
s to drop packets with improper source addresses, the use of access lists becomes difficult on routers with a large number of adjacent networks, and traditional access lists are not used in high-performance router forwarding paths.
While the
IETF
The Internet Engineering Task Force (IETF) is a standards organization for the Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster or requirements and a ...
document BCP 38 on ingress filtering does not specify a method of implementing source address filtering, some router vendors have implemented a mechanism that employs
reverse-path forwarding
Reverse-path forwarding (RPF) is a technique used in modern routers for the purposes of ensuring loop-free forwarding of multicast packets in multicast routing and to help prevent IP address spoofing in unicast routing.
In standard unicast IP r ...
lookups in the router's tables to perform this check. This is often implemented as a lookup in the FIB of the ''source'' address of the packet. If the interface has no route to the source address, the packet is assumed to be part of a denial of service attack, using a
spoofed source address, and the router discards the packet.
When the router is
multihomed
Multihoming is the practice of connecting a host or a computer network to more than one network. This can be done in order to increase reliability or performance.
A typical host or end-user network is connected to just one network. Connecting t ...
, ingress filtering becomes more complex. There are perfectly reasonable operational scenarios in which a packet could arrive on one interface, but that specific interface might not have a route to the source address. For the routers near the edge of the Internet, packet filters can provide a simpler and more effective solution than methods that employ routing information lookup, though this approach can be challenging when managing routers that are reconfigured often. Ingress filtering for multihomed routers will accept the packet if there is a route back to its source address from ''any'' interface on the router. For this type of filtering, the router may also maintain an ''adjacency table'', also organized for fast lookup, that keeps track of the router interface addresses that are on all directly connected routers.
Quality of service
Differentiated services
Differentiated services or DiffServ is a computer networking architecture that specifies a mechanism for classifying and managing network traffic and providing quality of service (QoS) on modern IP networks. DiffServ can, for example, be used t ...
provides an additional method to select outgoing interfaces, based on a field that indicates the forwarding priority of the packet, as well as the preference of the packet to be dropped in the presence of congestion. Routers that support differentiated service not only have to look up the output interface for the destination address, but need to send the packet to the interface that best matches the differentiated services requirements. In other words, as well as matching the destination address, the FIB has to match differentiated services code points (DSCP).
Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers
RFC 2474, K. Nichols ''et al.'', December 1998
Access control and accounting
Specific router implementations may, when a destination address or other FIB criterion is matched, specify another action to be done before forwarding (e.g., accounting or encryption), or apply an access control list
In computer security, an access-control list (ACL) is a list of permissions associated with a system resource (object). An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on giv ...
that may cause the packet to be dropped.
Attacks
CAM tables can be targeted for setting up a man-in-the-middle attack
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
. A threat agent
In computer security, a threat is a potential negative action or event facilitated by a vulnerability that results in an unwanted impact to a computer system or application.
A threat can be either a negative "intentional" event (i.e. hacking: a ...
which has control of a device connected to an Ethernet switch can use MAC flooding
In computer networking, a media access control attack or MAC flooding is a technique employed to compromise the security of network switches. The attack works by forcing legitimate MAC table contents out of the switch and forcing a unicast floodin ...
to attack the switch's CAM table. If the table fills up, other traffic is treated as broadcast, unknown-unicast and multicast traffic
Broadcast, unknown-unicast and multicast traffic (BUM traffic) is network traffic transmitted using one of three methods of sending data link layer network traffic to a destination of which the sender does not know the network address. This is a ...
and is forwarded to all ports making it available to the attacker.
References
External links
*{{citation , title=RIBs and FIBs (aka IP Routing Table and CEF Table) , author=Ivan Pepelnjak , url=http://blog.ipspace.net/2010/09/ribs-and-fibs.html
Routing
Ethernet