Cisco IOS Field Notes: OSPFv2

This article is being continuously updated - consider it a work in progress! [2026-03-03]

ACT I — Control Plane Model

OSPF as a Distributed Graph Computation System

OSPF (Open Shortest Path First) is an Interior Gateway Protocol (IGP) that builds a synchronized network graph and derives forwarding decisions by computing a shortest-path tree using Dijkstra’s SPF algorithm.

Unlike distance-vector protocols (such as RIP), OSPF does not exchange routes. It exchanges topology information and derives routes from a synchronized graph model; it is hence more like a distributed network synchronization system.

OSPF is a link-state protocol - and that classification is fundamental since that OSPF is event-driven, dynamic, and autonomously convergent:

• Event-driven because topology changes trigger incremental LSA^⬧ flooding and SPF^⬧ recalculation.
• Dynamic because neighbor and database state continuously adapt to link and node conditions (hence link-state).
• Autonomously convergent because each router independently recomputes shortest paths from the synchronized LSDB^⬧ until the network reaches a stable equilibrium (and it does this pretty fast!).

OSPF is an eventually consistent topology replication system with bounded failure domains (areas).

The LSDB — What Actually Gets Replicated

The Link-State Database (LSDB) is the replicated state of OSPF. It is not a routing table and it is not “routes.” It's a topology model encoded as Link-State Advertisements (LSAs).

Each router maintains an LSDB per area (even in single-area designs, that still means “Area 0”). In steady state, all routers inside the same area converge to the same LSDB content.

At minimum in a clean single-area Ethernet design you will primarily see:

• Type 1 (Router LSA): originated by every router; describes that router’s links and costs inside the area.
• Type 2 (Network LSA): originated by the DR on broadcast/NBMA segments; describes the shared multi-access network and attached routers.

That’s the key mental model:

• Adjacency exists to establish a trusted replication channel.
• LSAs are the replication payload.
• LSDB is the synchronized dataset.
• SPF converts the dataset into best paths.
• RIB/FIB are derived consequences.

Control Plane Mechanics and Derived State

OSPF operates entirely in the control plane; it does not forward any data traffic (forwarding plane). Its packets (IP protocol 89) are control traffic and are punted to the CPU — never CEF^⬧-switched.

Through neighbor discovery and reliable LSA flooding, routers construct a synchronized Link-State Database (LSDB) that represents the network as a graph. Each router then runs SPF locally against that database and installs the resulting best paths into its routing table (RIB -> FIB).

Routes are therefore locally derived state — not the primary payload (which are the LSA's). OSPF does not transmit user data either; it simply derives best OSPF routes, inserts them into the RIB^⬧ and the winners of those are inserted into the FIB^⬧ and used in the forwarding-plane.

The Adjacency State Machine

OSPF is a deterministic state machine. This means that adjacency formation progresses through fixed states in a defined order — and if adjacency fails, it fails at a specific state for a well-defined reason we are simply able to determine.

Adjacency formation is about establishing reliable database replication and avoiding corrupting the LSDB. OSPF does not trust neighbors until database synchronization is proven reliable.

States Explained

OSPF adjacency is not “a connection.” It’s a controlled process for building a trusted replication channel for link-state data. The state machine exists to prevent polluted or partial databases from entering the LSDB.

The first states (Down / Init / 2-Way) are Hello-level liveness and compatibility. The later states (ExStart → Exchange → Loading) are database synchronization. Full simply means: “for this neighbor relationship, the LSDBs are synchronized enough to flood reliably.”

• Down: No Hellos received yet (or the dead timer expired and the neighbor was declared gone).
• Init: I received your Hello, but you haven’t acknowledged me (I’m not in your neighbor list).
• 2-Way: Bidirectional Hellos are confirmed (we see each other in our Hellos).
• ExStart: We decide who is master/slave and begin DBD negotiation (sequence numbers).
• Exchange: We swap DBD packets (LSA headers) to summarize our databases.
• Loading: We request what we’re missing (LSR) and receive it (LSU), acknowledging with LSAck.
• Full: Databases are synchronized (for this adjacency); the neighbor relationship is stable.

OSPF Packet Types

Adjacency fails where packet exchange breaks, OSPF adjacency formation (and maintenance) uses five packet types.

Control-Plane Exchange Trace

The following sequence shows the actual packet-level exchange that drives the adjacency state transitions shown above.

Think of it as a runtime trace of the OSPF state machine: Hello establishes liveness, DBD negotiates synchronization, and LSR/LSU/LSAck complete database replication.

The Hello Packet

The Hello packet is what initially transitions the router from DOWN to INIT when it recieves a neighbors Hello.

But for the 2-WAY state transition, the following Hello requirements must match between two neighbors communicating:

• Area ID
• Hello timer
• Dead timer
• Authentication
• Router ID uniqueness
• MTU (mismatch breaks DBD stage (ExStart), not Hello validation)
• Network type

Mismatch in any of these prevents adjacency formation and result in a transition failure.

The DBD Packet

The (DB) database (D) descriptor is used to exchange summaries (headers) of the neighbor routers LSAs.

MTU size must match for this stage to complete or it will revert back to 2-Way

The LSR Packet

The LSU Packet

The LSAck Packet

ACT II — Design Mechanics

DR / BDR Election (Broadcast Networks)

On broadcast networks (Ethernet), OSPF elects:

• DR (Designated Router)
• BDR (Backup Designated Router)

This reduces adjacency count from N² to N.

Election priority:

1. Highest OSPF interface priority
2. Highest Router ID

Verify:

show ip ospf neighbor

If no FULL adjacency to DR → topology knowledge incomplete.

To influence:

interface g0/0
ip ospf priority 200

Setting priority 0 → router will not become DR/BDR.

Router ID Determinism

Router-ID selection order:

1. Manually configured
2. Highest loopback IP
3. Highest active interface IP

router ospf 10
router-id 1.1.1.1

Duplicate Router IDs prevent adjacency.

After change:

clear ip ospf process

This resets adjacency and rebuilds LSDB.

Multi-area OSPF

Multi-area OSPF exists to contain state propagation.

Single-area is the optimal solution for smaller networks but starts degrading slowly along very specific control-plane stress vectors as the area grows.

A 100-router backbone with flappy links can become troublesome whereas a stable 250-router backbone won't exhibit the same symptoms.

Single-area OSPF stops scaling when:

• SPF runs become frequent under normal operation (adjacency teardowns and restablisments from link flaps).
• LSA flooding causes noticeable CPU spikes.
• Convergence events affect the entire domain unnecessarily.
• Troubleshooting becomes cognitively expensive.
• It is a control-plane saturation problem, not a route-count problem.

Area Types

Multi-area introduces:

• LSDB scoping
• Summarization
• Reduced flooding
• Reduced SPF scope
• Failure containment

And it is all about constraining blast radius.

Think of area types as: Policies for LSA admission and flooding scope.

Area types do not change SPF mechanics.

They change which LSAs are allowed to exist inside an area.

That is the entire game; think of it as scaling valves.

Area 0

The central transit area of a multi-area OSPF domain. All other areas must connect to Area 0 (logically or physically). Area 0 is the global transit fabric.

OSPF Synchronization Mechanics

LSA Types and Flooding

OSPF topology is encoded as LSAs as we talked about in the beginning, and LSAs get flooded to synchronize the LSDB.

How, when and why they're flooded matters.

Area Type Behaviour and LSA Propagation

Verify LSDB:

show ip ospf database

All routers in same area must share identical LSDB (but during convergence, transient divergence exists).

If LSDB differs → SPF differs → routing differs.

Network Types

OSPF behavior depends on network type.

Mismatch in network type causes adjacency asymmetry.

Verify:

show ip ospf interface g0/0

SPF Mechanics in OSPF

Cost and Path Selection

Default reference bandwidth = 100 Mbps.

This is obsolete in modern networks.

If not changed, 1G and 10G links share identical cost.

Set globally:

router ospf 10
auto-cost reference-bandwidth 10000

Must match across all routers.

Manual override:

interface g0/1
ip ospf cost 50

ACT III — Failure & Doctrine

Troubleshooting OSPF - Failure Pattern Recognition

OSPF does not fail randomly it fails at a specific layer for a specific reason; we talked briefly about this earlier regarding adjacency-formation:

Adjacency formation progresses through fixed states in a defined order — and if it fails, it fails at a specific state for a specific reason.

— This Article

If the neighbor is not FULL, stay in the adjacency layer -- do not inspect routes yet.

If You're Stuck, This Is Where to Look First

Deterministic Troubleshooting

Never jump randomly.

Follow this order:

1. Interface up?
2. Hello seen?
3. Neighbor state?
4. LSDB identical?
5. Cost logical?
6. Route installed?

Do not inspect routing table before verifying adjacency.

Mental Compression

If you remember nothing else:

• OSPF is distributed topology synchronization.
• LSA flooding maintains shared state (LSDB).
• SPF converts shared state into forwarding decisions.
• The RIB/FIB are derived consequences.

All OSPF failures reduce to one of four categories:

1. Adjacency failure → no synchronization
2. Flooding failure → inconsistent databases
3. Cost model error → incorrect path selection
4. Instability → constant recomputation (CPU churn)

Convergence is not magic — it is the network reaching equilibrium after state change.

If adjacency is unstable, flooding is unstable.

If flooding is unstable, SPF thrashes.

If SPF thrashes, routing oscillates.

Field doctrine:

• Stabilize adjacency.
• Verify LSDB integrity.
• Normalize cost.
• Then inspect routes.

And lastly: if adjacency breaks, everything upstream collapses.

Reference Tables

Common Failure Modes

Appendix

Terminology, Abbreviations & Acronyms