Policy-Based Routing Calculator
Estimate matched traffic, ACE evaluations and CPU cost when PBR runs in hardware versus in software.
About Policy-Based Routing Calculator
In hardware, PBR is a TCAM lookup that costs essentially nothing per packet. Once the policy exceeds TCAM capacity or uses an unsupported match, packets are punted to the CPU and cost is linear in rate — which is what a CPU load above 100 percent in this calculator is telling you. A policy that works in the lab and melts in production is almost always one that fell out of TCAM, and the software ceiling tells you the packet rate at which that happens rather than after the outage.
Formulas
Policy-Based Routing
Matched packets = rate × match percentage; in software each one costs the per-packet processing time, so CPU load = matched pps × µs per packet ÷ 1,000,000.
- TCAM
- Ternary content-addressable memory — matches an ACE in a single hardware lookup
- µs per packet
- Software forwarding cost, typically tens of microseconds
- software ceiling
- 1,000,000 ÷ µs per packet — the packet rate one CPU core can sustain
Punt-path capacity
software forwarding ceiling = 1,000,000 ÷ µs per matched packet.
Worked example
With the default values below, Policy-Based Routing Calculator returns Packets Matched by the Policy of 150,000. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Total packet rateminimum 0 pps
- 500,000 pps
- Traffic matching the policyaccepts 0–100 %
- 30 %
- Route-map clausesaccepts 1–256 clauses
- 8 clauses
- Average ACEs evaluated per packetaccepts 1–1,000 ACEs
- 4 ACEs
- Matched in hardware (TCAM)
- No
- Software cost per matched packetaccepts 0.01–1,000 µs
- 25 µs
Results
- Packets Matched by the Policy
- 150,000 pps
- Packets Following the Route Table
- 350,000 pps
- ACE Evaluations per Second
- 16,000,000
- CPU Load from PBR
- 375.00%
- Added Latency per Matched Packet
- 25.00 µs
- Software Forwarding Ceiling
- 40,000 pps
Step by step
- 1Values used
- 2Policy-Based Routing
- 3Punt-path capacity
- 4Packets Matched by the Policy= 150,000 pps
- 5Packets Following the Route Table= 350,000 pps
- 6ACE Evaluations per Second= 16,000,000
- 7CPU Load from PBR= 375.00
- 8Added Latency per Matched Packet= 25.00 µs
- 9Software Forwarding Ceiling= 40,000 pps
Assumptions and limits
- The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Policy-Based Routing calculated?
Matched packets = rate × match percentage; in software each one costs the per-packet processing time, so CPU load = matched pps × µs per packet ÷ 1,000,000. In hardware, PBR is a TCAM lookup that costs essentially nothing per packet. Once the policy exceeds TCAM capacity or uses an unsupported match, packets are punted to the CPU and cost is linear in rate — which is what a CPU load above 100 percent in this calculator is telling you.
Why does Policy-Based Routing matter?
A policy that works in the lab and melts in production is almost always one that fell out of TCAM, and the software ceiling tells you the packet rate at which that happens rather than after the outage.
What values do I need to enter?
This calculator takes 6 inputs: Total packet rate, Traffic matching the policy, Route-map clauses, Average ACEs evaluated per packet, Matched in hardware (TCAM), Software cost per matched packet. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I confirm PBR is in hardware?
Check the TCAM or ACL resource utilisation counters and the CPU punt rate on the platform. Hardware PBR shows no growth in punted packets under load; if the punt counter tracks the matched rate, the policy is running in software.