OSPF: routers that agree on the same map

Older routing protocols worked by rumour: a router told its neighbours which networks it could reach and how far away they were, and everyone believed it. OSPF works by cartography. Every router describes only its own links, floods that description to everyone, and each router independently builds an identical map and computes its own shortest paths across it. That shift — from believing summaries to sharing raw facts — is what makes OSPF converge in seconds and scale to networks that RIP could never hold together.

The map

Read this first when short on time. Every branch is a section below.

Why link-state beat distance-vector

A distance-vector protocol such as RIP tells its neighbours conclusions: "I can reach 10.2.0.0/16, and it is three hops away." The neighbour has no idea how, through whom, or whether that path also passes through itself. Everything is second-hand, which produces two chronic problems: convergence takes many rounds of updates, and routing loops form easily enough that half the protocol is devoted to preventing them.

A link-state protocol shares facts instead. Each router describes only what it can see directly — its own interfaces, their costs, and its neighbours — in a link-state advertisement. Every LSA is flooded unchanged to every router in the area. Each router assembles them into a link-state database, and every router in the area ends up with an identical copy.

Then each router runs Dijkstra's shortest path first algorithm against that database, with itself as the root, producing a tree of shortest paths to every destination. The best routes from that tree go into the routing table.

The cost of the approach is exactly where you would expect: memory to hold the database and CPU to run SPF. That cost is why areas exist, and it is the reason the whole second half of OSPF's design is about limiting how far information has to travel.

Becoming neighbours

Before anything is exchanged, two routers must agree that they are neighbours. They discover each other with hello packets sent to the multicast address 224.0.0.5, every 10 seconds on Ethernet, with a dead interval of 40 seconds — four missed hellos and the neighbour is declared gone.

A hello carries a list of conditions, and every one of them must match or the adjacency never forms:

The MTU one is the cruellest, because the neighbour relationship starts forming and then hangs. The states are worth knowing for exactly this reason:

stateDiagram-v2
  [*] --> Down
  Down --> Init: hello received
  Init --> TwoWay: my router ID is in their hello
  TwoWay --> ExStart: adjacency needed
  ExStart --> Exchange: master and slave agreed
  Exchange --> Loading: database headers swapped
  Loading --> Full: missing LSAs requested and received

Two-way deserves a note, because it looks like a failure and often is not. On a multi-access segment, two routers that are both neither the designated router nor its backup stop at two-way deliberately. They know about each other and do not exchange databases directly, because they will both synchronise with the designated router instead. Seeing 2WAY/DROTHER in the neighbour table is normal and correct.

Router# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address       Interface
2.2.2.2           1   FULL/DR         00:00:33    10.255.0.2    GigabitEthernet0/1
3.3.3.3           1   FULL/BDR        00:00:31    10.255.0.3    GigabitEthernet0/1
4.4.4.4           0   2WAY/DROTHER    00:00:35    10.255.0.4    GigabitEthernet0/1
5.5.5.5           1   FULL/  -        00:00:38    10.255.1.6    Serial0/0/0

The dash in the last line is a point-to-point link, where there is no designated router because there are only ever two routers on the segment.

The designated router

Put five routers on one Ethernet segment and full adjacencies between every pair would need ten relationships, each flooding to the others — ten copies of everything. With n routers it is n(n−1)/2, which grows badly.

OSPF elects a designated router to act as the hub. Every router forms a full adjacency with the DR and with the backup designated router, and only two-way with everyone else. Updates are sent to the DR at 224.0.0.6, and the DR floods them to everyone at 224.0.0.5. Five routers need eight adjacencies instead of ten, and fifty routers need ninety-eight instead of 1,225.

The election has two rules and one surprise:

1. Highest interface priority wins. Default is 1; a priority of 0 means the router will never be DR or BDR.
2. Ties are broken by the highest router ID.
3. There is no preemption. A router that boots later with a better priority does not take over. The existing DR keeps the role until it fails.

That third rule catches everyone. Whichever router happened to be powered on first becomes DR and stays DR — which is often a small access-layer router rather than the well-connected core switch you would have chosen. Setting priority does not fix it retroactively; you have to clear the OSPF process or bounce the interfaces for a new election.

! make this router the preferred DR on this segment
Router(config-if)# ip ospf priority 255

! and take this one out of the running entirely
Router(config-if)# ip ospf priority 0

The database: what is actually flooded

OSPF carries several LSA types. Four matter for most purposes.

The type 1 and type 2 LSAs together are the map: type 1 says "I am router 2.2.2.2, I have these links at these costs", type 2 says "on this segment, these routers are present". Everything else is a way of talking about places you cannot see the map of.

LSAs are re-flooded every 30 minutes even when nothing changes, so that a database entry cannot silently rot; and a genuine change floods immediately, which is where the fast convergence comes from. Each LSA carries a sequence number and an age so routers can tell a newer copy from an older one.

Router# show ip ospf database

            OSPF Router with ID (1.1.1.1) (Process ID 1)

                Router Link States (Area 0)
Link ID         ADV Router      Age    Seq#       Checksum Link count
1.1.1.1         1.1.1.1         412    0x80000009 0x00A1B2  3
2.2.2.2         2.2.2.2         388    0x8000000C 0x0044F1  4

                Net Link States (Area 0)
Link ID         ADV Router      Age    Seq#       Checksum
10.255.0.2      2.2.2.2         388    0x80000003 0x00E2A9

Every router in an area holds an identical copy of this. If two routers in the same area show different databases, they are not fully adjacent — and that is a more precise diagnosis than any amount of staring at routing tables.

Areas: keeping the database small

Everything above happens per area. All routers in an area hold the same database and run SPF over it, so a single flapping link makes every router in that area recompute. In a network of five hundred routers that is unworkable, and the answer is to divide it.

OSPF areas have one structural rule: every area must connect to area 0, the backbone. Traffic between two non-backbone areas always passes through it. This is not a suggestion — it is what makes the design loop-free, because inter-area routing behaves like distance-vector between areas and needs a hub to stay safe.

flowchart TD
  A1["Area 1<br/>internal routers"] --- ABR1["ABR<br/>one foot in each area"]
  ABR1 --- A0["Area 0<br/>the backbone"]
  A0 --- ABR2["ABR"]
  ABR2 --- A2["Area 2<br/>internal routers"]
  A0 --- ASBR["ASBR<br/>redistributes external routes"]

The benefit is containment. A link flapping in area 1 causes SPF to run in area 1. Routers in area 2 see, at most, a type 3 summary appear or disappear, which is far cheaper to process. Area borders are also the only place OSPF can summarise, which is why address plans are designed so that each area owns a contiguous block.

For anything under about fifty routers, a single area 0 is entirely reasonable and much simpler to operate. Areas are a scaling tool, not a badge of seriousness.

Cost, and the mistake everyone makes once

OSPF's metric is cost, and the cost of an interface is:

cost = reference bandwidth / interface bandwidth

default reference bandwidth = 100 Mbps

Look at the middle column. The formula rounds anything below 1 up to 1, so every link at 100 Mbps or faster has a cost of 1. A gigabit link and a ten-gigabit link are indistinguishable, and OSPF cheerfully sends traffic down the slower one.

The fix is to raise the reference bandwidth so that modern links produce distinct values:

Router(config-router)# auto-cost reference-bandwidth 100000   ! 100 Gbps, in Mbps

It must be set identically on every router in the domain. A mismatch means routers compute different costs for the same links, producing asymmetric paths and occasionally routing loops. Cisco logs a warning when you set it, and the warning is worth heeding.

Individual interfaces can also be set directly with ip ospf cost 50, which overrides the formula entirely and is the cleanest way to steer traffic away from a link you know to be expensive or unreliable.

Configuring it

Two syntaxes exist for saying which interfaces participate. The traditional one uses network statements with wildcard masks:

Router(config)# router ospf 1
Router(config-router)# router-id 1.1.1.1
Router(config-router)# network 10.1.1.0 0.0.0.255 area 0
Router(config-router)# network 10.255.0.0 0.0.0.3 area 0
Router(config-router)# passive-interface default
Router(config-router)# no passive-interface GigabitEthernet0/1

The newer per-interface syntax is clearer and increasingly preferred:

Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip ospf 1 area 0

Four details are worth stating plainly.

The process ID is local. router ospf 1 on one router happily forms adjacencies with router ospf 47 on another. It has no protocol meaning at all — unlike BGP's autonomous system number, which must match.

The network statement selects interfaces, not networks. It means "any interface whose address falls in this range participates, in this area". The wildcard mask is the usual inverted mask, so 0.0.0.255 matches a /24. Getting this backwards is the most common OSPF configuration error there is.

The router ID matters and should be set. Chosen in order: an explicitly configured router-id, else the highest loopback address, else the highest active physical interface address. It is picked once at startup and does not change while the process runs. A loopback is the conventional source because it never goes down — but setting it explicitly is better still, because then it does not depend on addressing at all.

passive-interface default is a habit worth forming. It stops OSPF sending hellos out every interface while still advertising those interfaces' subnets, then you re-enable it only on the links that actually face another router. Without it, a router sends hellos onto user VLANs, which is wasted traffic at best and an invitation to a rogue neighbour at worst.

Advertising a default route

Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
Router(config)# router ospf 1
Router(config-router)# default-information originate

OSPF does not advertise a default route just because one exists. default-information originate tells the router that owns the internet connection to inject 0.0.0.0/0 into OSPF as an external route, so every other router learns where the exit is. Adding always makes it advertise even when it has no default route of its own, which is occasionally useful and usually a way to black-hole traffic.

Checking it

Router# show ip ospf neighbor          ! who am I adjacent to, and in what state
Router# show ip ospf interface brief   ! which interfaces run OSPF, in which area, at what cost
Router# show ip ospf database          ! the map itself
Router# show ip route ospf             ! what made it into the routing table
Router# show ip protocols              ! process ID, router ID, networks, passive interfaces

Those five in order answer nearly every OSPF question. Neighbours first — if the adjacency is not full, nothing else matters. Then interfaces, to check area and cost. Then the database, which is the ground truth. Then the routing table, to see what survived.

LSA

Link-state advertisement: one router's description of part of the topology, flooded unchanged to every router in its scope.

LSDB

Link-state database: the collection of LSAs, identical on every router in an area.

Designated router

The router elected on a multi-access segment to be the flooding hub, so adjacencies scale linearly rather than quadratically.

ABR

Area border router: has interfaces in two or more areas including the backbone, and translates topology into summary prefixes between them.

Reference bandwidth

The numerator in the cost formula. Must be identical on every router, and must be raised above the 100 Mbps default on any modern network.

Recap