How does OSPF work?

What does R1 need to learn?

A user on LAN A wants to reach the server on LAN B, 192.168.4.0/24. R1 connects to LAN A, and R4 connects to LAN B. R2 and R3 provide two possible routes between them. R1 already knows its directly connected networks, but it needs information about the rest of the network before it can choose a path.

OSPF (Open Shortest Path First) exchanges that information between routers. A link-state advertisement (LSA) is a record describing links or reachable networks. The link-state database (LSDB) stores those records. Each router uses shortest path first (SPF), a lowest-cost path calculation, to turn its database into its own best paths.

Learning a route and forwarding a user's packet are separate jobs. OSPF prepares the information that forwarding uses; a user packet does not travel inside an OSPF update.

Follow the control traffic first, then the route it produces. The five stages below are a learning model: Hellos continue during database exchange, and SPF may run while the network is still converging.

From neighbours to installed routes

Step 1: start the process

Use OSPFv2 for this IPv4 lab. OSPFv3 and its IPv6 examples are covered separately. The commands use Cisco IOS/IOS XE syntax; check interface names and feature support on your image. The four routers already have the shown addresses, operational links and compatible area 0 settings. This page explains the process, rather than supplying a complete initial configuration for every device.

From privileged EXEC, R1#, enter configure terminal to reach global configuration, R1(config)#. The router ospf 1 command then enters R1(config-router)#, where the network statements belong. Use end to return to privileged EXEC for show commands. Set router IDs before forming adjacencies in a new lab; changing an existing process identity can require a disruptive restart.

Process ID and router ID

router ospf 1 starts process 1. The number is local to the router (1 to 65535), so neighbours don't need to match, although most networks use the same number everywhere to keep things tidy. The process then needs a unique router ID, chosen as described in What is OSPF?; set it explicitly with router-id.

The network command picks the interfaces

Starting the process doesn't enable OSPF on any interface. You choose them, with the network command:

In a wildcard mask, a 0 bit must match and a 1 bit is ignored. The network command selects interfaces; it does not advertise the typed range as a summary. A selected, operational interface contributes its connected network; it sends Hellos unless passive. On R1:

The other way is to enable OSPF on the interface itself, which some engineers prefer because it leaves no doubt about which interfaces are in:

Passive does not mean unadvertised. A passive OSPF interface contributes its network but forms no neighbours. An interface outside OSPF needs another route source if its network is to be learned.

Step 2: find neighbours

A Hello is an OSPF packet used to discover another router and check whether it is still reachable. A neighbour is another OSPF router heard on a directly attached link. An adjacency is the closer relationship used to synchronise databases. We need both routers to hear each other before that exchange can succeed.

Enabled, non-passive broadcast and point-to-point interfaces normally send Hellos every 10 seconds to 224.0.0.5 on Cisco IOS. Two routers on the same link confirm two-way communication once each sees its own router ID listed in the other's Hello, with compatible area, addressing and timer settings. They then synchronise databases if an adjacency is required. On a point-to-point link it is; on broadcast Ethernet the designated-router roles determine which pairs synchronise. Here is a simplified exchange between R1 and R2:

Before opening the exchange, keep four packet names in mind. Database description (DBD) packets list LSA headers, identifying records and their versions without carrying the full records. A link-state request (LSR) asks for a record that is missing locally or available in a newer version. A link-state update (LSU) carries the full records. A link-state acknowledgement (LSAck) acknowledges LSAs, not DBD packets.

Full means database synchronisation is complete. On broadcast Ethernet, OSPF elects a designated router (DR) and backup designated router (BDR) to organise database exchanges. The other routers are called DROthers; two DROthers can correctly remain at 2-Way. An MTU mismatch is one possible cause of ExStart or Exchange problems. The neighbours lesson covers each state and the troubleshooting checks; the DR/BDR lesson explains which neighbours form Full adjacencies.

The five OSPF packet types

OSPF runs directly on IP (protocol number 89), not on TCP or UDP, and uses five packet types:

Step 3: share the map (the LSDB)

Comparing headers avoids copying records the neighbour already has in the same version. One LSU can carry several LSAs; an LSA is a record inside the packet, not a sixth packet type. Acknowledgements make this exchange reliable. An LSAck can acknowledge several LSAs at once, and receiving the same LSA instance back from a neighbour can also provide an implicit acknowledgement of a previously sent record.

Database synchronisation happens before a neighbour reaches Full. Routers compare LSA headers, request missing or newer records and acknowledge received LSAs. After convergence, the area-scoped topology records agree. Later updates are reliably flooded through the appropriate adjacencies. Inspect the router LSA section with show ip ospf database:

R1#show ip ospf database
            OSPF Router with ID (1.1.1.1) (Process ID 1)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
1.1.1.1         1.1.1.1         412         0x80000004 0x00A1C3 3
2.2.2.2         2.2.2.2         409         0x80000003 0x0062F1 2
3.3.3.3         3.3.3.3         405         0x80000003 0x00B804 2
4.4.4.4         4.4.4.4         398         0x80000004 0x0024D9 3

Under normal OSPFv2 operation, each router refreshes its own LSAs at 30 minutes even without a topology change. MaxAge is one hour: records at that age are excluded from route calculation and flushed. These are LSA maintenance timers, not failure-detection timers.

Step 4: run SPF

Shortest path first (SPF) is the calculation that turns the stored topology into paths. Each router starts from its own position and adds the cost of outgoing interfaces along each possible path. A smaller total is preferred for these paths within the same area. Cost is a configured routing value, not a live measurement of delay or congestion.

Assume cost 10 in both directions on R1–R3, and cost 1 on every other outgoing interface, including the LAN interfaces. From R3 to LAN A, the path R3 → R4 → R2 → R1 costs 4; its direct high-cost path costs 11.

The result for R1 is its SPF tree, summarised here:

10.0.34.0/30 (the R3–R4 link) is reached through R4 at cost 3 rather than through R3 at cost 11, because the R1–R3 link is expensive.

Step 5: fill the routing table

OSPF offers its best paths to the routing table. If selected over competing route sources, these intra-area routes appear as O, with the default administrative distance 110 and the total cost as the metric. From now on the router forwards packets using these routes; OSPF itself isn't involved in forwarding each packet.

An LSA in the database does not guarantee an installed OSPF route. It must describe usable reachability in the OSPF calculation. For the same destination prefix, a competing source with a lower administrative distance can win the routing-table selection. For example, a normal static route with distance 1 can hide the OSPF route. Forwarding then chooses the longest matching prefix among installed routes; it does not compare every route's OSPF cost.

R1#show ip route ospf
      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
O        10.0.24.0/30 [110/2] via 10.0.12.2, 00:05:41, GigabitEthernet0/1
O        10.0.34.0/30 [110/3] via 10.0.12.2, 00:05:41, GigabitEthernet0/1
O     192.168.4.0/24 [110/3] via 10.0.12.2, 00:05:41, GigabitEthernet0/1

What happens when the R2–R4 link fails

The five steps aren't a one-off. When the R2–R4 link fails:

1. When the interfaces report link-down, R2 and R4 detect the failure without waiting for the dead timer. With a silent failure, detection may wait for the configured dead interval (normally 40 seconds on these interfaces), unless another mechanism detects it sooner.
2. Each sends a new version of its router LSA, without that link, in an LSU to its remaining neighbours (step 3).
3. The changed topology records spread through the appropriate adjacencies in this single area; routers install and acknowledge the newer LSAs.
4. The affected topology calculations use the updated map (step 4). This link failure changes the area's topology; not every kind of OSPF update requires a full SPF rebuild.
5. R1 replaces its routes through R2 with routes through R3, at the higher cost (step 5).

Timing matters: convergence includes detection, flooding, SPF scheduling and forwarding-table updates. There is no guaranteed recovery time from topology size alone.

Short lab: compare the route before and after failure

Use the four-router topology shown above, with cost 10 on R1–R3 and cost 1 on the other interfaces. The command outputs on this page are written examples, not tested router captures. Assume no competing preferred route for LAN B, operational host gateways and a return route. On R1, record the next hop and metric for LAN B before changing anything.

In your isolated lab, shut the R2 interface towards R4. Run the same checks on R1 after convergence. R2 can remain R1's Full neighbour because the failed link is farther away. The LAN B route should instead use R3, 10.0.13.2, at cost 12. Restore the interface with no shutdown and confirm the original route returns.

Next, configure and verify single-area OSPF. That complete configuration lesson uses a separate three-router chain, not this four-router backup-path topology. Check enabled interfaces, neighbours, the LSDB and installed routes in that order.

Test yourself on the five steps

Further reading: Cisco: interpreting OSPF interface output and RFC 2328: OSPFv2.