Policy-Based Routing Calculator
Estimate matched traffic, ACE evaluations and CPU cost when PBR runs in hardware versus in software.
Inputs
Packets Matched by the Policy
150,000pps
Packets Following the Route Table
350,000pps
ACE Evaluations per Second
16,000,000
CPU Load from PBR
375.00%
Added Latency per Matched Packet
25.00µs
Software Forwarding Ceiling
40,000pps
Step by step
Values used
Total packet rate = 500,000 pps; Traffic matching the policy = 30 %; Route-map clauses = 8 clauses; Average ACEs evaluated per packet = 4 ACEs; Matched in hardware (TCAM) = No; Software cost per matched packet = 25 µs
Policy-Based Routing
Matched packets = rate × match percentage; in software each one costs the per-packet processing time, so CPU load = matched pps × µs per packet ÷ 1,000,000.
Punt-path capacity
software forwarding ceiling = 1,000,000 ÷ µs per matched packet.
Packets Matched by the Policy
= 150,000 pps
Packets Following the Route Table
= 350,000 pps
ACE Evaluations per Second
= 16,000,000
CPU Load from PBR
= 375.00
Added Latency per Matched Packet
= 25.00 µs
Software Forwarding Ceiling
= 40,000 pps
How it works
In hardware, PBR is a TCAM lookup that costs essentially nothing per packet. Once the policy exceeds TCAM capacity or uses an unsupported match, packets are punted to the CPU and cost is linear in rate — which is what a CPU load above 100 percent in this calculator is telling you. A policy that works in the lab and melts in production is almost always one that fell out of TCAM, and the software ceiling tells you the packet rate at which that happens rather than after the outage.
Formulas
Policy-Based Routing
Matched packets = rate × match percentage; in software each one costs the per-packet processing time, so CPU load = matched pps × µs per packet ÷ 1,000,000.
- TCAM
- Ternary content-addressable memory — matches an ACE in a single hardware lookup
- µs per packet
- Software forwarding cost, typically tens of microseconds
- software ceiling
- 1,000,000 ÷ µs per packet — the packet rate one CPU core can sustain
Punt-path capacity
software forwarding ceiling = 1,000,000 ÷ µs per matched packet.
Frequently Asked Questions
How is Policy-Based Routing calculated?
Matched packets = rate × match percentage; in software each one costs the per-packet processing time, so CPU load = matched pps × µs per packet ÷ 1,000,000. In hardware, PBR is a TCAM lookup that costs essentially nothing per packet. Once the policy exceeds TCAM capacity or uses an unsupported match, packets are punted to the CPU and cost is linear in rate — which is what a CPU load above 100 percent in this calculator is telling you.
Why does Policy-Based Routing matter?
A policy that works in the lab and melts in production is almost always one that fell out of TCAM, and the software ceiling tells you the packet rate at which that happens rather than after the outage.
What values do I need to enter?
This calculator takes 6 inputs: Total packet rate, Traffic matching the policy, Route-map clauses, Average ACEs evaluated per packet, Matched in hardware (TCAM), Software cost per matched packet. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I confirm PBR is in hardware?
Check the TCAM or ACL resource utilisation counters and the CPU punt rate on the platform. Hardware PBR shows no growth in punted packets under load; if the punt counter tracks the matched rate, the policy is running in software.