← Interview Prep

OSPF — Theory

Everything worth being able to explain about OSPF at a whiteboard: link-state mechanics, areas, LSAs, adjacencies, SPF, and convergence.

OSPF (Open Shortest Path First) is a link-state interior gateway protocol (IGP). Every router floods a description of its own links, so all routers in an area build an identical map of the topology — the Link-State Database (LSDB) — and then run Dijkstra's SPF algorithm independently to compute shortest paths. This differs fundamentally from distance-vector (RIP/EIGRP), where routers exchange computed routes and never see the full map.

Keep the mental model straight: link-state = flood the topology, compute routes locally. Because every router in an area has the same LSDB, routing loops within an area are structurally avoided. The metric is cost (lower is better), derived from interface bandwidth.

Overview: what OSPF is

OSPFv2 vs OSPFv3

The area concept

An area is a set of routers that share an identical LSDB and run SPF together. Areas bound the scope of flooding and SPF, so a topology change in one area does not force every router in the domain to re-run SPF. Inter-area routing is summarized at Area Border Routers, which reintroduces a distance-vector-like behavior between areas (routers trust the summary, they don't see the far area's topology).

Router roles and the backbone rule

The area 0 rule

            +----------------+
            |    Area 0      |   (backbone — every area
            |   backbone     |    must touch it)
            +--+---------+---+
   ABR1 -----/           \----- ABR2
      |                          |
  +---------+               +---------+
  | Area 1  |               | Area 2  |
  +---------+               +---------+

• All inter-area traffic must transit area 0. Areas connect to each other only through the backbone — there is no direct Area 1 ↔ Area 2 path.
• This enforces a loop-free two-level hierarchy (hub-and-spoke of areas) and prevents inter-area loops.
• Virtual link: if an area is physically disconnected from area 0 (e.g. a remote area only reaches the backbone through a transit area), a virtual link tunnels area-0 connectivity across the transit (non-backbone) area to logically extend the backbone. It is a repair mechanism, not a design goal — treat it as a red flag in a design question.

Neighbors, adjacencies, and the Hello protocol

OSPF discovers neighbors and maintains liveness with Hello packets, sent to 224.0.0.5. Two routers become neighbors when their Hellos agree on a set of parameters; only some neighbor pairs go on to form full adjacencies (exchange full LSDBs).

Parameters that must match to form an adjacency

• Area ID, Hello and Dead intervals, authentication, the stub-area flag, and the subnet/mask (OSPFv2, must be on the same subnet).
• The Router ID (RID) must be unique per router (highest loopback IP, else highest active interface IP, else manually set). It identifies the router in all LSAs.
• MTU should match (a mismatch stalls in ExStart/Exchange in most implementations).

Adjacency state machine

Down ─▶ Init ─▶ 2-Way ─▶ ExStart ─▶ Exchange ─▶ Loading ─▶ Full
 │        │        │         │           │           │         │
 │        │        │         │           │           │         └ full LSDB sync, adjacency up
 │        │        │         │           │           └ send LSRs for missing LSAs, get LSUs
 │        │        │         │           └ trade DBD (database description) headers
 │        │        │         └ elect master/slave, pick initial DBD seq #
 │        │        └ saw own RID in neighbor's Hello (bidirectional); DR/BDR election happens here
 │        └ received a Hello but not yet bidirectional
 └ no Hellos received

Interview trap: on a broadcast segment it is normal for two DROTHER routers to be stuck at 2-Way — they only go Full with the DR and BDR. Only stuck states like ExStart (MTU mismatch) or Init (one-way Hello / ACL) indicate a problem.

Network types

DR/BDR election and why the DR exists

On a multi-access segment with n routers, forming a full mesh of adjacencies would need n(n-1)/2 adjacencies and each router would flood to every other — an O(n²) explosion of LSAs. OSPF elects a Designated Router (DR) that becomes the hub: every router forms a full adjacency only with the DR and the Backup DR (BDR), cutting adjacencies to O(n). The DR also originates the Type 2 (Network) LSA representing the segment as a pseudonode.

• Election order: highest OSPF priority (0–255, default 1; 0 = never DR) wins; tie broken by highest Router ID.
• Election is non-preemptive: a new higher-priority router joining does not take over an existing DR. You must clear the process to force re-election.
• Routers send LSAs to the DR/BDR on 224.0.0.6 (AllDRouters); the DR floods to everyone on 224.0.0.5 (AllSPFRouters).
• The BDR listens to everything and takes over instantly if the DR fails — avoiding a full re-election and re-sync storm.

LSA types and the LSDB

The LSDB is built from Link-State Advertisements (LSAs). Each LSA type describes a different piece of the topology and has a defined flooding scope.

(Types 6 group-membership/MOSPF, 8–11 opaque LSAs exist; opaque Type 10 carries TE data for MPLS-TE. Types 1–5 and 7 are the interview core.)

Reliable flooding, sequence numbers, and age

• LSAs propagate by reliable flooding: a router receives an LSU, installs new/newer LSAs, acknowledges (LSAck), and floods them out all other interfaces. Retransmitted until ACKed.
• Sequence number: a 32-bit linear counter (0x80000001 upward). A higher sequence number = a newer instance of the same LSA — this is how routers decide which copy to keep.
• LS Age: counts up from 0; an LSA is refreshed every 30 minutes (LSRefreshTime) and aged out at MaxAge = 3600 s if not refreshed. Flooding an LSA at MaxAge is how a router withdraws it.
• Comparison to pick the freshest copy: higher sequence number, then higher checksum, then lower age (with the MaxAge special case).

SPF, cost, and ECMP

Each router runs Dijkstra's shortest-path-first over its LSDB, placing itself at the root of the SPF tree, then summing link costs to every destination.

cost = reference-bandwidth / interface-bandwidth

Cisco default reference-bandwidth = 100 Mbps
  10 Mbps  Ethernet   -> 100/10   = 10
  100 Mbps FastEth    -> 100/100  = 1
  1 Gbps   GigE       -> 100/1000 = 1  (rounds to 1 — a problem!)
  10 Gbps  10GigE     ->           = 1  (same as GigE)

• Because integer cost has a minimum of 1, the default 100 Mbps reference bandwidth cannot distinguish Gig, 10-Gig, 100-Gig links. Fix: raise it consistently everywhere with auto-cost reference-bandwidth (e.g. to 100000 for 100 G). It must match domain-wide.
• Total path cost is the sum of the outgoing interface costs along the path.
• ECMP: OSPF installs multiple equal-cost paths (Cisco default up to 4, configurable), load-sharing traffic across them. Unequal-cost load balancing is not supported (unlike EIGRP).

Area types

Special area types reduce LSDB size by blocking certain LSAs at the ABR and substituting a default route. The tradeoff is always the same: less state, less optimal/granular routing.

• Stub: blocks external (Type 5) LSAs; the ABR advertises a default route so the area can still reach the outside world. Every router in the area must agree on the stub flag (it's a Hello match).
• Totally stubby (Cisco): also blocks inter-area Type 3s — the area knows only its own routes plus a single default. Smallest LSDB.
• NSSA (Not-So-Stubby Area): a stub area that still needs a local ASBR. Since Type 5 is banned, the local ASBR uses Type 7; the ABR translates Type 7 → Type 5 when flooding into the backbone (the P-bit controls translation).
• ABR route summarization: area X range aggregates intra-area prefixes into one Type 3 (inter-area); summary-address on an ASBR aggregates externals into one Type 5. Summarization shrinks LSDBs and hides flaps behind the summary.
• Default injection: default-information originate makes an ASBR advertise a default route (Type 5) into normal areas; stub/totally-stubby ABRs inject it automatically.

Redistribution and external routes: E1 vs E2

When a route is redistributed into OSPF at an ASBR, it becomes an external route with one of two metric types:

• E2 ignores the internal path cost: all routers see the redistributed metric only, so with two ASBRs advertising the same E2 route, tie-breaking falls to the forwarding address / lowest cost to ASBR only after the identical E2 metrics tie.
• E1 adds the intra-domain cost to reach the ASBR, so each router naturally prefers the nearest exit. Preference order overall: intra-area < inter-area < E1 < E2.
• N1/N2 are the NSSA equivalents (carried in Type 7): N1 = external + internal cost, N2 = external only — same semantics as E1/E2.
• Forwarding address: the Type 5/7 LSA can carry a forwarding address so other routers send traffic directly to the real next hop (e.g. a shared redistribution segment) rather than routing to the ASBR itself — avoiding a suboptimal hairpin.

Convergence, resilience, and authentication

• Timers: default Hello 10 s / Dead 40 s on broadcast & p2p (Hello 30 s / Dead 120 s on NBMA). Lowering them speeds failure detection but risks false downs.
• BFD (Bidirectional Forwarding Detection): a lightweight sub-second hello run beside OSPF to detect link failure in milliseconds and trigger reconvergence — far faster and cheaper than shrinking OSPF Dead timers.
• SPF throttling: after a change, routers wait an initial delay, then use exponential backoff (initial/increment/max) so a flapping link doesn't cause continuous SPF runs. LSA generation is throttled similarly.
• LFA / rLFA (Loop-Free Alternate / remote LFA): precompute a loop-free backup next hop so forwarding can switch instantly on failure (fast reroute) before SPF even reconverges.
• Incremental / partial SPF: a change that only affects leaf prefixes (e.g. a Type 3) can be processed without a full SPF-tree recomputation.
• Authentication: OSPFv2 supports null, plaintext, and cryptographic (MD5/SHA) per interface/area to stop rogue adjacencies and forged LSAs. OSPFv3 delegates this to IPsec.

OSPFv3 differences in depth

• Runs natively over IPv6; adjacencies use link-local addresses as the source, and neighbors are identified by Router ID (still a 32-bit dotted value) rather than by IP subnet.
• Adjacencies form per link, not per subnet — multiple IPv6 subnets can share one link and one adjacency; routers need not share a subnet to become neighbors.
• Addressing is decoupled from topology: Router (Type 1) and Network (Type 2) LSAs no longer carry prefixes — they describe topology only. Prefixes move into two new LSAs: Link LSA (Type 8, link-local scope) and Intra-Area-Prefix LSA (Type 9). This lets addressing change without re-running SPF on the topology.
• LSA type numbering is encoded with scope/flag bits (U/S2/S1), making the address family extensible.