OSPF

Routers greet neighbours with Hellos, become Full neighbours, and flood LSAs describing their links and costs. Every router holds the same link-state database and runs Dijkstra on it. The lowest total cost wins; when a link or router fails, the map changes and every router recomputes within seconds.

How OSPF works, step by step

OSPF (version 2, RFC 2328) is a link-state protocol: instead of passing routes along, routers share a map of the network and each computes its own routes from it. It runs directly on IP, protocol number 89, with no TCP or UDP, and its packets on a link carry TTL 1.

1. Hello. Every OSPF interface sends a Hello to 224.0.0.5 (all OSPF routers) every hello interval, 10 seconds by default on Ethernet. A Hello carries the sender's router ID, its area, mask, timers, priority and the list of neighbours it has heard. Two routers become neighbours only if area, subnet, hello and dead intervals, authentication and MTU agree.
2. 2-Way. When a router finds its own ID in a neighbour's Hello, both know they hear each other. On a link with several routers they elect a designated router (DR) and a backup (BDR); everyone exchanges maps with those two only.
3. ExStart, Exchange, Loading. The pair agree who leads, swap Database Description packets listing what each holds, request what they lack (Link State Request), and send it (Link State Update, acknowledged by LSAck).
4. Full. Both now hold the same link-state database: every router's Router LSA ("I am on these links, at these costs"), plus a Network LSA for each multi-access link, written by its DR.
5. SPF. Each router runs Dijkstra's shortest-path algorithm with itself at the root. The path with the lowest total cost wins. By default an interface's cost is 100 Mb/s divided by its bandwidth, so every link of 100 Mb/s or faster costs 1 unless the reference is raised.
6. Change. If no Hello arrives for the dead interval (40 seconds by default), the neighbour is dropped. The router floods a new LSA with a higher sequence number, and every router reruns SPF.

Large networks are split into areas around a backbone, area 0, so a change in one area does not make every router recompute.

What it looks like on a Linux machine

In the OSPF lab three routers run FRR, an open-source routing suite, with fast timers: a Hello every second, dead after 4. A capture shows the Hellos:

$ tcpdump -lnni any -v proto ospf
    10.0.12.2 > 224.0.0.5: OSPFv2, Hello, length 48
	Router-ID 10.0.1.2, Backbone Area, Authentication Type: none (0)
	  Hello Timer 1s, Dead Timer 4s, Mask 255.255.255.0, Priority 1

FRR's shell, vtysh, shows the neighbours and the routes:

$ vtysh -c 'show ip ospf neighbor'
Neighbor ID     Pri State           Up Time         Dead Time Address         Interface
10.0.12.3         1 Full/DR         4m12s              3.402s 10.0.12.3       eth1:10.0.12.2
10.0.23.3         1 Full/DR         4m12s              3.391s 10.0.13.3       eth2:10.0.13.2

$ vtysh -c 'show ip route ospf'
O>* 10.0.2.0/24 [110/30] via 10.0.12.3, eth1, weight 1, 00:04:05

[110/30] is the administrative distance, 110 for OSPF, then the cost: 10 to the core, 10 to the data center, 10 for its network. The backup link costs 50 + 10 = 60 and waits. FRR installs the route in the kernel, where ip route shows it with proto ospf. Lower the backup link's cost to 15 and the route moves within a second; stop the core router and after 4 seconds it moves to the backup on its own.

What goes wrong, and how you see it

No neighbour at all. Hellos are sent but never answered: check that area, subnet mask, hello and dead timers and authentication match on both ends, and that the interface is not passive. A firewall dropping protocol 89 has the same effect.

Stuck in ExStart or Exchange. The classic cause is an MTU mismatch: one side's Database Description packets are too big for the other, and the pair never reach Full.

Stuck in 2-Way. On a multi-access link two routers that are neither DR nor BDR stay 2-Way on purpose. It is only a problem if one of them should have been the DR. The OSPF network types lab covers it.

A path you did not expect. Costs belong to the outgoing interface, so each direction can take a different path: asymmetric routing, which confuses traceroutes and stateful firewalls. Compare show ip route on both ends.

Slow failover. With default timers a silent failure takes up to 40 seconds to notice. BFD detects it in under a second.

Questions people ask

What is the difference between OSPF and BGP? OSPF finds the fastest path inside one organisation, from a shared map. BGP connects organisations and chooses routes by policy and AS path, not link speed.

What is OSPF's administrative distance? 110: preferred to RIP's 120, less trusted than a static route (1) or eBGP (20).

What is the router ID? A 32-bit number written like an address that names the router in OSPF. It is set by hand or taken from an interface address; two routers with the same ID break the database.

See it on real machines