How does OSPF work?

A real-life situation

You have just cabled the four routers of the square network and typed a few OSPF commands on each. Thirty seconds later, every router can reach both LANs, and if you pull a cable the traffic moves to the other path. Between your last command and that working network, each router went through the same five steps. This lesson walks through them in order, so that when OSPF doesn't work you know which step to check.

The five steps at a glance

1. 1Start the processEnable OSPF, choose a router ID, and pick the interfaces that take part.
2. 2Find neighboursSend hellos on those interfaces and agree with the routers that answer.
3. 3Share the mapExchange LSAs until every router in the area holds the same LSDB.
4. 4Run SPFCalculate the lowest-cost path from this router to every network.
5. 5Fill the routing tableInstall the best paths and start forwarding packets with them.

Step 1: start the process

Which OSPF version?

This course is about OSPFv2, the version the CCNA has you configure.

Process ID and router ID

router ospf 1 starts process 1. The number is local to the router (1 to 65535), so neighbours don't need to match, although most networks use the same number everywhere to keep things tidy. The process then needs a unique router ID, chosen as described in What is OSPF?; set it explicitly with router-id.

Which interfaces take part

Starting the process doesn't enable OSPF on any interface. You choose them, usually with the network command:

The wildcard mask works like an inverted subnet mask: a 0 bit means "this bit must match" and a 1 bit means "any value". A matching interface gets two things: it starts sending hellos, and its subnet is advertised in the router's LSA. On R1 in the square network:

The other way is to enable OSPF on the interface itself, which some engineers prefer because it leaves no doubt about which interfaces are in:

Either way, an interface that doesn't match sends no hellos and its subnet is not advertised: the rest of the network simply won't know that subnet exists.

Step 2: find neighbours

Each OSPF interface now sends a hello every 10 seconds (on Ethernet) to 224.0.0.5. Two routers on the same link become neighbours once each sees its own router ID listed in the other's hello, and only if settings such as the area, subnet and timers match. Then they synchronise their databases. Here is the whole conversation between R1 and R2:

The neighbour states at a glance

Where two routers get stuck tells you what to check. A neighbour that never appears, or stays in Init, points at the hello settings (area, subnet, timers, authentication). Stuck in ExStart or Exchange points at an MTU mismatch or a duplicate router ID. The full checklist is in the neighbours lesson.

On a shared Ethernet segment with several routers, routers don't form a full adjacency with every other router; a designated router (DR) is elected to keep things efficient. The states, the matching rules and the DR are covered in depth in OSPF neighbours and adjacencies and DR/BDR election.

The five OSPF packet types

OSPF runs directly on IP (protocol number 89), not on TCP or UDP, and uses five packet types:

Step 3: share the map (the LSDB)

Once neighbours are Full, any new or changed LSA is flooded: sent in an LSU to every neighbour, acknowledged, and passed on until every router in the area has it. Every router stores every LSA in its LSDB, so all routers in the area hold the same map. You can see it with show ip ospf database: one router LSA per router, the same list on every router.

R1#show ip ospf database
            OSPF Router with ID (1.1.1.1) (Process ID 1)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
1.1.1.1         1.1.1.1         412         0x80000004 0x00A1C3 3
2.2.2.2         2.2.2.2         409         0x80000003 0x0062F1 2
3.3.3.3         3.3.3.3         405         0x80000003 0x00B804 2
4.4.4.4         4.4.4.4         398         0x80000004 0x0024D9 3

LSAs are refreshed every 30 minutes even when nothing changes, and an LSA that isn't refreshed for an hour is removed. That way a router that has vanished can't leave stale information behind for ever.

Step 4: run SPF

The LSDB is a map, not a list of directions. Think of a sat-nav: every car has the same map, but each one plans its journey from where it is. Each router runs SPF (Dijkstra's algorithm) with itself as the starting point and finds the cheapest path to every network, adding the cost of each outgoing interface on the way. With the R1–R3 link at cost 10 and every other link at cost 1:

The result for R1 is its SPF tree, summarised here:

10.0.34.0/30 (the R3–R4 link) is reached through R4 at cost 3 rather than through R3 at cost 11, because the R1–R3 link is expensive.

Step 5: fill the routing table

The best path to each network is installed in the routing table, marked O, with administrative distance 110 and the total cost as the metric. From now on the router forwards packets using these routes; OSPF itself isn't involved in forwarding each packet.

R1#show ip route ospf
      10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks
O        10.0.24.0/30 [110/2] via 10.0.12.2, 00:05:41, GigabitEthernet0/1
O        10.0.34.0/30 [110/3] via 10.0.12.2, 00:05:41, GigabitEthernet0/1
O     192.168.4.0/24 [110/3] via 10.0.12.2, 00:05:41, GigabitEthernet0/1

When something changes

The five steps aren't a one-off. When the R2–R4 link fails:

1. R2 and R4 notice at once because their interfaces go down (a silent failure is noticed when the 40-second dead timer runs out).
2. Each sends a new version of its router LSA, without that link, in an LSU to its remaining neighbours (step 3).
3. The new LSAs are flooded and acknowledged until every LSDB is updated.
4. Every router reruns SPF on the new map (step 4).
5. R1 replaces its routes through R2 with routes through R3, at the higher cost (step 5).

Only the changes are sent, so reconvergence takes well under a second in a network this size, compared with the minutes an engineer would need to fix static routes.

Why one area works only up to a point

Every change is flooded to every router in the area and makes all of them rerun SPF, and every router stores the whole map. With a few dozen routers that is nothing for modern hardware. With hundreds of routers and links that flap, it adds up, which is why large networks are split into several areas, each with its own smaller LSDB. For the CCNA, a single area 0 is all you configure.

Common mistakes

• Using a subnet mask instead of a wildcard mask in the network command (0.0.0.255, not 255.255.255.0).
• Forgetting a network command for a LAN: the routers become neighbours but nobody learns that LAN.
• Thinking the network command advertises exactly the range typed. It selects interfaces; each interface's own subnet is advertised.
• Expecting OSPF to resend everything periodically. It sends changes, plus a 30-minute refresh.
• Forgetting that each router runs SPF itself: a wrong cost on one router changes paths through that router.

💡 Exam tip: match each packet to its job (Hello, DBD, LSR, LSU, LSAck) and each step to its show command: show ip protocols (step 1), show ip ospf neighbor (step 2), show ip ospf database (step 3), show ip route ospf (step 5). Expect a network command question: which interfaces does network 10.1.0.0 0.0.255.255 area 0 enable?

Key takeaways

Check yourself