OSPF packets, neighbour discovery and LSDB flooding

Five packet types

OSPF runs straight on top of IP as protocol 89, with no TCP or UDP underneath. Because of that it has to provide its own reliability, and it does this with five packet types that all share a common header carrying the router ID and area ID of the sender.

Most packets go to the multicast address 224.0.0.5 (all OSPF routers). On shared segments, routers that are not the DR send updates to 224.0.0.6, which only the DR and BDR listen to. These addresses are link-local, so OSPF packets never leave the segment they were sent on.

From first hello to Full

When OSPF is enabled on an interface, the router starts sending hellos. When a hello arrives from a router it has not heard before, the neighbour moves to Init. Each hello lists the router IDs the sender has already heard, so once a router sees its own ID listed, the relationship is 2-Way. On a shared segment this is also where the DR and BDR are chosen.

Routers that need a full adjacency then enter ExStart. They agree who is master (the higher router ID) and which DBD sequence number to start from. In Exchange they swap DBD packets describing their databases. Each side compares the list with what it holds and sends LSRs for anything missing or out of date; that is Loading. When every request has been answered with an LSU and acknowledged, the neighbours are Full.

Tip: a neighbour that stays in ExStart or Exchange almost always points to an MTU mismatch, because the large DBD packets from one side are being dropped by the other.

Inside an LSA header

Every LSA, whatever its type, starts with the same header. Four fields matter most when you read a database:

• Link-state ID and advertising router: together with the type, these identify the LSA uniquely.
• Sequence number: starts at 0x80000001 and goes up by one each time the originator changes or refreshes the LSA. A higher number always wins.
• Age: counts up in seconds from 0. The originator refreshes its own LSAs every 30 minutes; if an LSA reaches 3600 seconds (MaxAge) without a refresh, it is removed.
• Checksum: catches corruption while the LSA is stored or flooded.

Flooding and acknowledgement

When a link changes, the router that owns it builds a new LSA with a higher sequence number and sends it in an LSU. A neighbour that receives it checks whether it is newer than its own copy. If it is, the neighbour stores it, acknowledges it with an LSAck and floods it out of its other OSPF interfaces. If the copy is the same, it simply acknowledges it. If an acknowledgement does not come back, the LSU is retransmitted, every 5 seconds by default. That is how a single change reaches every router in the area within moments.

To withdraw an LSA early, the originator floods it with its age set to MaxAge. Every router then deletes it. You will see this when a router is removed from the network or an external route is withdrawn.

Real-world example: a flapping link

A hospital's network team noticed that SPF was running on every router in area 0 several times a minute. Looking at show ip ospf database on two routers, they saw the router LSA from one distribution switch had a sequence number far higher than all the others and an age of only a few seconds. That switch was regenerating its LSA constantly. The cause was a damaged fibre to a lab building that went up and down many times an hour. Each flap produced a new LSA, which was flooded and acknowledged everywhere. Replacing the patch lead stopped the churn; they also enabled SPF and LSA throttling so that a future flapping link would cause less disruption.

show ip ospf neighbor
show ip ospf interface GigabitEthernet0/1
show ip ospf statistics
show ip ospf database router 10.0.0.3