I am a Systems Administrator at a small firm. We are latency sensitive. When forwarding packets, what protocols use the CPU and which use the ASICs?

We have mostly Arista 7124's (for the most latency sensitive bits) and Cisco 4948's. I imagine that the architecture for an Arista and a Cisco Nexus switch would be similar, so if you are a Cisco guy I'd be happy to hear from you.

I have installed Rancid (http://www.shrubbery.net/rancid/) on a machine here and I am grabbing switch configs every hour. This means that:

  1. There is an ssh login.
  2. Then the switch goes to enable mode.
  3. Then a show run is performed.

All of that uses CPU. My boss has asked me: Am I impacting latency? How do I know?

I don't think I am impacting latency, but I don't know that for sure. I have taken it on faith that I am not; that's why the ASICs are there, to do the heavy lifting and bring some determinism to switching speeds. Of course, some technologies could not be ASIC'ed like NAT but let's assume we are not doing that.

Our machines connected to the switches use a few different VLANs, and they need rather straightforward IP services I'd say: exchanging TCP and multicast UDP data- that's all. (Besides the usual supporting cast such as ARP that are necessary for TCP and UDP to work).

Edit: that I mention the Arista and the Cisco Nexus because they are called "Layer 3 switches", as described here for the Cisco 3548 or here for the Arista 7124SX.


  • 2
    Per your edit, layer-3 switch are, first, layer-2 switches. The ports to which end-devices connect are layer-2 ports, just as if they were layer-2 switches. A layer-3 switch has a router (usually not as powerful as a stand-alone router) built into it, but layer-3 only happens between layer-3 interfaces. Layer-3 switches may be impacted in routing by using the CPU for other tasks, but it is highly dependent on the switch model. You need to track the CPU utilization. – Ron Maupin Jun 9 '16 at 14:58

This article has a decent breakdown of what a Catalyst 3750 will use its CPU for. Notice the CPU doesn't normally process any "user" frames, it mainly deals with management tasks, like STP and routing tables.

At least one exception is mentioned (emphasis mine):

As part of normal Layer 3 switch operation, when the IP route is not programmed into the switch hardware, the hardware punts IP packets to the CPU for IP routing. Punting occasional IP packets to the CPU is normal and expected, but if too many IP packets are punted, the CPU becomes too busy.

Later on:

If the switch TCAM is full, the hardware routes packets only for destination IP addresses that are in the TCAM. All other IP packets that had a TCAM miss are punted to the CPU.

Note that during normal operation, few or no frames or packets are sent to a 3750 CPU.


Switches operate at layer-2. They do not get into the frames to look at the packets (IP) or segments (TCP/UDP); all they see is the layer-2 frame header, and that is the basis for switching. Cisco switches don't do NAT, that is done on a router or firewall.

Most modern switches do the switching in hardware, and very little CPU is used for this. Consequently, switches don't normally have powerful CPUs or a lot of RAM, but this is highly dependent on the switch model.

I don't understand the need to grab the switch configuration every hour. This is not something that is practiced to any degree. If you insist on doing this, you could also grab the CPU utilization when logged into the switch, but it is doubtful you are impacting much.

  • Thanks for the reply. Regarding grabbing the switch config every hour: see networklore.com/rancid-getting-started ("Schedule RANCID" section), or itnotes.eu/?p=365, or ihazem.wordpress.com/2011/10/24/… . So it is practiced to some degree. The purpose is to known what changed within a certain timeslice. Another method may be to do it after every change, which is a nice idea: binaryroyale.com/2013/05/… . However your workgroup must adhere to this discipline. – Mike S Jun 9 '16 at 14:31
  • 1
    There are much better ways to track network device changes (logs, SNMP, TACACS, etc.). There are a lot of ways to do this, but in the real world, what you are doing is not really something that is done. You should have only a few people allowed to make changes to network equipment, and they should need to use something which can log everything done on the device. – Ron Maupin Jun 9 '16 at 14:37
  • 1
    If you find yourself making a lot of changes to the network equipment where it needs to be tracked hourly, you probably need to redesign your network. You should also have specific hours when changes can be made. – Ron Maupin Jun 9 '16 at 14:39
  • 1
    There are many automated network management applications which do this. From the perspective of the network device, what you are doing is cumbersome. It is a simple matter to enable logging and capture any changes made to a network device on a log server. SNMP can also send traps. Having something log into a network device every hour is a rather crude method. – Ron Maupin Jun 9 '16 at 15:02
  • 1
    Unfortunately, product or resource recommendations are explicitly off-topic here. My company tracks network changes in multiple ways. We also have specific hours when changes can be made, but any change at any time is captured in multiple systems. Changes must be approved ahead of time, and unauthorized changed can result in termination. We can get the configurations of any of the 100,000 or so network devices at any time, and even decommissioned device configurations are kept. – Ron Maupin Jun 9 '16 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.