← Interview Prep

IS-IS — Theory

A link-state IGP from the OSI world that runs directly on Layer 2: levels, NET addressing, adjacencies, TLV-based PDUs, and why large ISP and DC cores favor it.

IS-IS (Intermediate System to Intermediate System, ISO 10589) is a link-state interior gateway protocol — the same SPF/Dijkstra family as OSPF — but it descends from the OSI protocol suite rather than TCP/IP. The single most important structural fact: IS-IS PDUs ride directly over Layer 2 (Ethernet, PPP), not over IP. It has no IP header, no port, no protocol number — routed IP prefixes are just data it carries.

IS-IS reputation in one line: the carrier/hyperscaler IGP. Because it runs on L2 and encodes everything in TLVs, it is exceptionally extensible (IPv6, MPLS-TE, Segment Routing all slotted in without a new protocol version) and scales to very large single areas — which is why most large ISP backbones and many DC fabrics run IS-IS instead of OSPF.

Overview & positioning

Link-state: every router floods a description of its local links; all routers build an identical link-state database (LSDB) and run Dijkstra SPF to compute shortest paths. Same core algorithm as OSPF.
Runs on Layer 2: PDUs use a dedicated OSI Layer-2 protocol (LLC/SNAP, Ethertype not used the way IP is) with multicast destination MACs 01:80:C2:00:00:14 (AllL1ISs) and 01:80:C2:00:00:15 (AllL2ISs). Because there is no IP dependency, the control plane cannot be attacked over IP and IPv6 needs no separate transport.
Protocol-independent: IS-IS routes reachability information for whatever address family you carry in TLVs. It was retrofitted to route IP (Integrated IS-IS, RFC 1195) and later IPv6 — both handled by one protocol instance.
Where it wins: large ISP cores, transit backbones, and modern DC leaf/spine fabrics — chosen for scalability (large flat areas), stability, and clean extensibility.

Levels and the area model

IS-IS builds a two-level hierarchy. The distinction from OSPF here is the classic interview trap.

Router type	Role	Analogy
Level 1 (L1)	Intra-area routing only. Knows the topology of its own area; reaches other areas via the nearest L1/L2 router (default route toward the attached bit).	OSPF internal (non-backbone) router
Level 2 (L2)	Inter-area backbone routing. The set of L2-capable routers forms a contiguous L2 backbone spanning areas.	OSPF backbone (area 0)
Level 1/2 (L1L2)	Runs both — an area's border, maintains an L1 LSDB for its area and an L2 LSDB for the backbone.	OSPF ABR

The L2 backbone must be contiguous (an unbroken chain of L2/L1L2 routers) — analogous to OSPF area 0 needing to stay connected, but there is no numbered "area 0": the backbone is simply wherever L2 adjacencies form.
An L1/L2 router sets the ATT (attached) bit in its L1 LSP to tell L1-only routers "I can reach the rest of the network" — they install a default route toward the nearest such router.

KEY difference vs OSPF — area boundaries are on links, not routers

In OSPF, the boundary runs through a router: an ABR has interfaces in area 0 and interfaces in another area, so a single router straddles two areas. In IS-IS, an entire router lives in exactly one area; the boundary falls on the link between two routers in different areas. Two L1L2 routers in different areas form an L2 adjacency across that link, while each keeps its own L1 database internal. "Areas are on links, not on routers" is the one-sentence answer to give.

Addressing — NET / NSAP

An IS-IS router identifies itself with an OSI NSAP address; the specific form assigned to a router (with the N-selector 0) is the NET (Network Entity Title). It has nothing to do with IP — it names the router, not an interface.

NET:  49.0001.1921.6800.1001.00
      └┬─┘ └─┬─┘ └──────┬──────┘ └┬┘
   AFI+ Area  Area ID   System ID  NSEL
   (variable, 1–13 B)  (6 bytes)   (1 byte = 00)

  Area ID   : 49.0001   → AFI 49 = "private" (like RFC1918), area 0001
  System ID : 1921.6800.1001  (6 bytes, must be unique per router)
  NSEL      : 00        → identifies the router itself (Network entity)

Component	Length	Meaning
Area ID (incl. AFI)	1–13 bytes	Which area the router is in. `49` is the common private AFI. All routers in an area share the same Area ID; an L2 adjacency simply spans two different Area IDs.
System ID	6 bytes (fixed)	Uniquely identifies the router within the domain — like an OSPF Router-ID. Often derived from a loopback IP (e.g. `192.168.0.1` → `1921.6800.0001`) or a MAC.
NSEL (N-selector)	1 byte	Service selector; always `00` for a NET, meaning "this is the routing node itself."

How to read a NET: strip the last byte (NSEL = 00), take the 6 bytes before it as the System ID, and everything remaining at the front is the Area ID. So in 49.0001.1921.6800.1001.00 the area is 49.0001, the system is 1921.6800.1001.

Adjacencies, the DIS, and pseudonodes

Routers discover neighbors with IIH (IS-IS Hello) PDUs and form adjacencies per level. Two interface types behave differently:

	Point-to-point	Broadcast / LAN
Hello	P2P IIH	L1 LAN IIH and/or L2 LAN IIH (separate per level)
Handshake	Three-way handshake (RFC 5303) — each side confirms it sees the other before the adjacency goes Up	Two-way; adjacency reported via neighbor TLV
Designated router	None	DIS elected to represent the LAN

The DIS (Designated Intermediate System)

On a multi-access LAN, IS-IS elects a DIS — the analogue of OSPF's DR — to reduce flooding overhead. The DIS creates a virtual node representing the LAN, called the pseudonode: every router on the segment reports a single adjacency to the pseudonode instead of a full mesh of adjacencies, which keeps the LSDB O(n) instead of O(n²).

Property	IS-IS DIS	OSPF DR (for contrast)
Election tiebreak	Highest interface priority, then highest MAC/SNPA	Highest priority, then highest Router-ID
Backup	No backup DIS — if the DIS dies, a new one is simply re-elected fast	BDR pre-elected
Preemption	Preemptive — a higher-priority router that appears takes over the DIS role	Non-preemptive
Adjacencies	All routers adjacent to all others (report via pseudonode); DIS floods CSNPs frequently	DROTHERs are only FULL with DR/BDR

Because there is no backup and election is cheap and preemptive, IS-IS DIS behavior is simpler than OSPF's DR/BDR dance — losing the DIS just triggers a quick re-election, and a priority-0 interface still participates.

PDUs and TLV encoding

IS-IS uses four PDU types. The database-sync PDUs (CSNP/PSNP) are the reliable-flooding machinery; there is no separate ack/update pair as in OSPF — the SNPs are the acknowledgment and request mechanism.

PDU	Name	Job
IIH	Hello	Discover neighbors, build/maintain adjacencies, elect the DIS. Sent per level.
LSP	Link-State PDU	The actual link-state advertisement — a router's links, prefixes, and capabilities. Flooded through the level; each has a sequence number, remaining lifetime, and checksum.
CSNP	Complete Sequence Number PDU	A summary of the entire LSDB (all LSP IDs + sequence numbers). The DIS multicasts CSNPs periodically on a LAN so neighbors can spot anything they are missing — like an OSPF DBD.
PSNP	Partial Sequence Number PDU	Two jobs: request an LSP a router is missing/stale, and acknowledge received LSPs (on P2P links). "Partial" = lists only some LSPs.

Why TLVs make IS-IS trivially extensible

Every piece of information inside an LSP (or IIH) is a TLV: Type–Length–Value. The fixed PDU header is tiny; all semantics live in a bag of TLVs (and nested sub-TLVs).

LSP body = [ TLV ][ TLV ][ TLV ] ...

  ┌──────┬────────┬──────────────────┐
  │ Type │ Length │ Value ...        │
  │ 1 B  │  1 B   │ (Length bytes)   │
  └──────┴────────┴──────────────────┘

  Type 128 : IP Internal Reachability
  Type 135 : Extended IP Reachability (wide metrics, sub-TLVs)
  Type 232 : IPv6 Reachability
  Type 22  : Extended IS Reachability (TE, SR sub-TLVs live here)

Adding a new capability = defining a new TLV type. An old router that doesn't understand a TLV simply ignores it and floods it onward transparently — no version bump, no new PDU.
This is exactly how IPv6 (new reachability TLVs), MPLS Traffic Engineering (extended IS-reach sub-TLVs), and Segment Routing (SID/label sub-TLVs) were bolted on without ever changing the protocol machinery. OSPF, by contrast, needed new LSA types and an entire new protocol version (OSPFv3) for IPv6.

Metrics and SPF

SPF is Dijkstra over the LSDB, per level, using link metrics. IS-IS has two metric styles:

Style	Range	Notes
Narrow (original)	Per-link 0–63, path max 1023	The legacy 6-bit metric field. Far too coarse for modern networks; only default (interface) metric is widely used.
Wide (RFC 3784)	Per-link up to 2^24−1 (24-bit), path 32-bit	Carried in the Extended IS/IP Reachability TLVs. Required for TE and Segment Routing (they need the sub-TLV space) and is the recommended default everywhere.

Migrate with metric-style wide; running wide everywhere is standard practice.
Metric is not auto-derived from bandwidth by default (unlike OSPF's cost) — the default interface metric is 10; you set metrics explicitly (or via reference-bandwidth on some vendors). SPF runs independently for L1 and L2, producing separate trees.

IPv6 and multi-topology (MT)

A single IS-IS process handles IPv4 and IPv6 together — this is a headline advantage over OSPF, where v4 (OSPFv2) and v6 (OSPFv3) are separate protocol instances.

Native dual-stack: because addresses are just TLVs, one IS-IS instance advertises IPv4 reachability (TLV 128/135) and IPv6 reachability (TLV 236/232) in the same LSPs over the same L2 adjacencies.
Single-topology (default): assumes v4 and v6 share the same topology — one SPF tree, one set of metrics. Simple, but breaks if some links carry only one address family (SPF may compute a path over a link that lacks IPv6).
Multi-topology (MT, RFC 5120): runs a separate SPF per topology (e.g. MT-0 for IPv4, MT-2 for IPv6), each with its own metrics, so a v6-incapable link is excluded from the v6 tree. Signaled with MT-specific TLVs. Use MT when the v4 and v6 topologies genuinely differ.

IS-IS vs OSPF

	IS-IS	OSPF
Origin / transport	OSI (ISO 10589); runs directly on Layer 2, no IP	TCP/IP; runs over IP (protocol 89)
Area boundary	On the link — a whole router is in one area	On the router — an ABR straddles two areas
Hierarchy	L1 (intra) / L2 (inter) backbone; contiguous L2	Area 0 backbone + non-backbone areas
Encoding	TLV-based — new features = new TLVs, no version change	Fixed LSA types; IPv6 needed OSPFv3 (new protocol)
IPv4 + IPv6	One instance (optionally MT)	Separate: OSPFv2 (v4) + OSPFv3 (v6)
LAN election	DIS + pseudonode; no backup, preemptive	DR/BDR; backup pre-elected, non-preemptive
Router identity	NET / System ID (6-byte OSI address)	32-bit Router-ID (IP-like)
Metric	Narrow 0–63 / wide 24-bit; not bandwidth-derived by default	Cost = reference-bw / bandwidth
Scalability / reputation	Very large flat areas; ISP/DC cores	Enterprise standard; more numerous, smaller areas

Interview one-liner: same link-state math, different packaging — IS-IS is the more extensible, L2-native, carrier-scale option (areas on links, everything in TLVs, one process for v4/v6), while OSPF is the more common, IP-native enterprise choice (areas on routers, LSA types, separate v6 protocol).

Likely follow-up questions

How do IS-IS areas differ from OSPF areas? (boundary on the link vs the router; a whole router is in one area)
Why does IS-IS run on Layer 2, and what does that buy you? (no IP dependency, IPv6 needs no new transport, harder to attack over IP)
Walk me through reading a NET — where's the System ID and Area ID? (strip NSEL 00, 6-byte System ID, rest is Area ID)
What is the DIS, how is it elected, and how does it differ from an OSPF DR? (pseudonode, priority then MAC, no backup, preemptive)
What is a pseudonode and why does it exist? (represent the LAN, keep LSDB O(n) not O(n²))
Roles of CSNP vs PSNP in database sync? (CSNP = full LSDB summary; PSNP = request + ack)
Why is TLV encoding a big deal? (add features — IPv6/TE/SR — with new TLVs, unknown TLVs ignored/flooded, no version change)
Narrow vs wide metrics — why do you need wide for Segment Routing / TE? (24-bit metric + sub-TLV space)
How does one IS-IS instance route both IPv4 and IPv6, and when do you need multi-topology?
Why do large ISPs tend to prefer IS-IS over OSPF? (scalability of flat areas, extensibility, stability)

Related: Life of a Packet · TCP — Theory & Mechanisms.