OSPF in depth
Dynamic routing: why static isn’t enough, how OSPF routers find each other (Hello, DR/BDR), the shared map (LSDB), Dijkstra, areas, convergence and OSPF in context.
Lesson 1: When static isn’t enough
Hand-built routes don’t scale
In the Routing and IP addresses course you set routes by hand (static routes). Great for a few networks – but what if you have dozens of routers and hundreds of networks? On every router you’d have to maintain a route to every network by hand, and rewrite it everywhere on each change. That’s unmaintainable and error-prone. Hence dynamic routing: routers tell each other which networks they know and together compute the best paths. The most common interior protocol is OSPF – you know its principle from the Routing and IP addresses course, now we’ll look under the hood.
Step by step
- A network with four routers and two LANs. Imagine there are dozens.
- With static routes you’d have to describe a route to every network by hand on every router. A nightmare.
- OSPF does it automatically: routers exchange information and compute the best paths themselves. How? That’s this whole course.
Static doesn’t survive failures
The second problem with static routing: it doesn’t survive failures. When a link on the main path goes down, the static route doesn’t know – packets keep heading into a dead end until you rewrite it by hand. There’s a "floating static" backup, but it’s a crutch. A dynamic protocol detects the failure within seconds, recomputes and sends traffic another way – by itself. That’s called convergence.
Step by step
- Traffic flows the top path R1→R2→R4. All good.
- The R1–R2 link fails. The static route doesn’t know → packets drop into the void until someone fixes it by hand.
- With OSPF traffic would reroute itself the bottom path R1→R3→R4 within seconds. That’s the power of dynamic routing.
The idea of OSPF
How does OSPF do it? You know the principle from the Routing and IP addresses course – here we’ll take it apart in depth, in three steps we’ll cover in the next lessons: (1) routers find each other and become neighbors. (2) Each tells the others what it sees (its links and networks) – so everyone ends up with the same map of the network (the LSDB). (3) From that map each router computes the shortest paths to all networks (Dijkstra’s algorithm). That’s why "link-state": everyone knows the state of all links, not just what a neighbor said.
Step by step
- Step 1: routers discover each other and become neighbors (lesson 2).
- Step 2: each tells what it sees; everyone gets the same map (lesson 3).
- Step 3: from the map each computes the shortest paths (Dijkstra, lesson 4). Let’s go step by step.
Lesson 2: How OSPF routers find each other
Hello packets
Before routers share anything, they must find each other. On each OSPF interface they send small Hello packets (multicast to 224.0.0.5 – an address for a group of receivers, not everyone like broadcast nor one like unicast) – like "hi, I’m router R1, I’m here". When two routers on the same link see each other’s Hellos and agree on the basic parameters (area, masks, timers…), they recognize each other as neighbors. Hellos keep flowing periodically – they also act as a heartbeat: when they stop, the neighbor is considered dead.
Step by step
- R1 sends Hello on all interfaces: "I’m here, I’m in area 0…".
- Neighbors reply with their own Hellos. If parameters match, they accept each other as neighbors.
- Done – the routers know each other. Hello keeps flowing as a heartbeat; when it goes quiet, the neighbor is declared dead (dead interval).
Adjacency
Note the difference: a neighbor ≠ a fully established adjacency. Finding each other via Hello is the first step. To actually exchange the database of links (the LSDB), routers go through several states: from Init and Two-Way (we see each other) through exchanging a database description to Full – fully synchronized. Only in the Full state do both hold the same map. On an ordinary point-to-point link Full forms between both; on a shared network it’s handled smarter (next module).
Step by step
- After Hello, R1 and R2 are Two-Way – they see each other. But they don’t yet share the map. (The states are shown simplified.)
- They exchange a database description and fill in what each is missing (Exchange/Loading).
- State Full: both hold an identical LSDB. Now they’re a true adjacency and can compute paths.
DR and BDR
On a shared network (several routers on one switch) every router would form an adjacency with every other – the number of relationships would explode (n×(n−1)/2). OSPF solves it by electing a DR (Designated Router) and a backup BDR. Everyone forms Full only with the DR/BDR, not among themselves; the DR then distributes changes to the rest. Election is by priority (router ID breaks ties). This keeps a shared network manageable even with many routers. (On a point-to-point link there’s no DR – there are only two.)
Step by step
- Four routers on one shared network = up to 6 relationships. With ten routers, 45. Unsustainable.
- A DR (and backup BDR) is elected by priority. Here DR = R2, BDR = R3.
- Everyone forms Full only with the DR. The DR distributes changes to the rest. The shared network stays manageable.
Lesson 3: The shared map (LSDB)
LSA: a piece of the map
Now the routers know each other – but still don’t know the whole network. Each only knows its own direct links so far. So it sends an LSA (Link-State Advertisement) = a little note "I, R1, have a link to R2 (cost 10) and to R3 (cost 10) and network LAN-A". An LSA is a piece of the map – it describes only one router’s surroundings. When every router makes such a note, together they form the complete map.
Step by step
- R1 creates its LSA: "I have links to R2 and R3 (cost 10) and network LAN-A".
- Every router does the same – each describes only its surroundings. Four routers = four pieces.
- The pieces together = the complete map. How LSAs reach everyone is the next module (flooding).
Flooding
How does an LSA reach all routers? Via flooding: when a router receives a new LSA, it forwards it out every other interface (except the one it came in on). The neighbor does the same – so the LSA spreads through the area like an avalanche in moments. To stop it looping forever, each LSA has a sequence number: a duplicate (same number) is dropped, and if a neighbor offers an older version the router sends its newer one back. That makes flooding terminate reliably.
Step by step
- R1 floods its LSA to neighbors R2 and R3.
- R2 and R3 forward it on to R4 (not back where it came from). The avalanche continues.
- R4 gets the LSA from both sides – the second is a duplicate, dropped by sequence number. Flooding ends, everyone has it.
The same LSDB for everyone
After flooding, every router in the area holds exactly the same database of all LSAs – the LSDB (Link-State Database). That’s the key difference from older protocols (distance-vector), where a router only trusted what a neighbor told it ("second-hand"). Here everyone has the complete map first-hand. And from an identical map they all compute the same, loop-free paths. The map = a single truth everyone agrees on.
Step by step
- All four routers now hold an identical map of the network (LSDB).
- From that same map each computes paths itself – and because the map is the same, the results fit together without loops.
- How does the map turn into a shortest path? That’s Dijkstra’s algorithm – next lesson, no math.
Lesson 4: Dijkstra without the math
Cost by speed
OSPF doesn’t pick a path by hop count, but by cost – and cost goes by link speed: a fast link = low cost, a slow one = high. The cost of a whole path is the sum of the link costs along it. So OSPF will happily choose a longer path over more routers if it’s faster (cheaper) than a single slow link. That’s smarter than just "fewest hops".
Step by step
- Each link has a cost by speed. Top path R1→R2→R4 = 10+10 = 20. Bottom R1→R3→R4 = 5+5 = 10.
- Both paths have the same hop count (2), but the bottom is cheaper (10 < 20) → OSPF picks the bottom.
- By hop count alone it’d be a toss-up. OSPF is smarter: it decides by speed. You set the cost in the simulator by right-clicking a link.
The shortest-path tree
The Dijkstra algorithm (SPF – Shortest Path First) sounds complex, but the idea is simple: each router puts itself in the middle of the map and gradually discovers the cheapest path to every network – always picking the nearest not-yet-discovered node and computing onward from it. The result is a shortest-path tree from that one router’s point of view (the SPF tree). It fills the routing table: the cheapest next hop to each network. Every router computes its own tree – but from the same map, so it all fits together.
Step by step
- R1 puts itself in the center: cost to itself = 0. It starts exploring outward.
- It finds the nearest node (lowest cost), locks it in and computes onward. Step by step it discovers the whole network.
- The result = R1’s shortest-path tree. It fills the routing table. Every router has its own tree from the same map.
In the simulator
All of this runs in this simulator too. Build a few routers with redundant paths, right-click a link to set its cost – and watch the cheapest path recompute itself. Raise the cost of the main path and traffic spills over to the other, cheaper one. That’s exactly what OSPF does: not the shortest distance, but the lowest cost. Try it in the ospf-cost task.
Step by step
- The cheap bottom path (5+5=10) is active.
- You raise the bottom path’s cost to 50+50=100. Now it’s more expensive than the top (20).
- OSPF recomputes itself and sends traffic over the top (20 < 100). You see it live in the simulator.
Lesson 5: Areas
A big area = a problem
OSPF with one big map is great up to a point. In a large network (hundreds of routers) one huge LSDB means: lots of memory, a long Dijkstra recompute, and every tiny change floods the whole network. The fix: split the network into areas. Inside an area routers know each other in detail; between areas only a summary is sent. A change in one area then doesn’t bother the others.
Step by step
- A small network? One area is enough. But imagine hundreds of routers in one map…
- A big map = lots of memory, slow recompute, and every change floods the whole network. That can’t scale forever.
- The fix: split into areas. Each has its own smaller map; only a summary between them. Details next module.
The backbone: area 0
OSPF areas have a firm rule: there is a backbone "area 0" and all other areas attach to it (not to each other). Traffic between two areas always passes through area 0. This gives the area topology a star shape, loop-free and predictable. A router sitting on the border of two areas is called an ABR – and it does the important work (next module).
Step by step
- In the middle is area 0 – the backbone everything connects to.
- Other areas (area 1, 2…) hang off area 0, never directly between themselves. Inter-area traffic always goes through the backbone.
- The router on the border of two areas = ABR. It holds both maps and translates summaries between them.
ABR and summaries
What an ABR does exactly: inside each area it knows the full map, but toward the other area it sends only a reachability summary – "behind me are the networks of the area (e.g. from the 10.1.0.0/16 block) at this cost", i.e. where you can get and for how much, not the detailed link topology. So a foreign area isn’t flooded with every little thing and maps stay small. When a link fails inside an area, only that area recomputes; the others don’t even notice (the summary didn’t change). That’s the whole magic of OSPF scaling.
Step by step
- The ABR holds the full map of both areas.
- To the other area it sends only a summary – not all the details. The foreign area stays small and calm.
- A link fails in area 0 → only area 0 recomputes. Area 1 doesn’t care – the summary didn’t change. That’s how OSPF scales.
Lesson 6: Convergence
Failure and recompute
Back to why we started with OSPF: self-healing after a failure (convergence). When a link fails, the router detects it (Hellos stop / the interface goes down), creates a new LSA "this link is gone", it floods the area, everyone updates the map and recomputes Dijkstra. The result: traffic flows another way – with no human action. The whole thing typically takes a few seconds (when the router detects the failure immediately; otherwise only after the dead interval – next module).
Step by step
- Traffic flows the top path R1→R2→R4.
- The R1–R2 link fails. R1 and R2 send a new LSA, it floods, everyone recomputes the map.
- Dijkstra finds the new best path R1→R3→R4 and traffic keeps flowing. No human action. Done in a few seconds.
Speed: Hello/Dead and BFD
How fast does OSPF detect a failure? The Hello/Dead interval guards it: Hello goes out regularly (by default, say, every 10 s) and when none arrives for the whole dead interval (typically 4× hello, i.e. 40 s), the neighbor is declared dead. That’s on the order of seconds to tens of seconds. When an even faster reaction is needed (milliseconds), BFD is added – a tiny fast "heartbeat" on the link that tells OSPF "it’s down" before Hello would even notice. Timers can be tuned, but overly aggressive settings cause false alarms.
Step by step
- Hello flows regularly (by default, say, every 10 s) – the heartbeat between neighbors.
- When no Hello arrives for the whole dead interval (typically 4× hello), the neighbor is dead → recompute starts. On the order of seconds to tens of seconds.
- Need milliseconds? Add BFD – a lightning heartbeat that reports a failure to OSPF instantly. Beware overly aggressive timers (false alarms).
Reroute in the simulator
You’ll try reroute live: build redundant paths, set costs and then down the active device or link (in the simulator you can administratively disable it). Watch traffic move to the other path by itself – exactly like OSPF convergence. In the simulator the ospf-fix task shows this: raise the cost on the blocking path and traffic spills over to the clean one.
Step by step
- Traffic flows over the top. Now in the simulator we down the R4–R2 link.
- Link down → OSPF detects it and recomputes.
- Traffic spills over to the bottom path by itself. You’ll click through this in the ospf-fix task.
Lesson 7: OSPF in context
Default route to the internet
OSPF knows the company’s internal networks. But the internet is far too big for anyone to pour it whole into OSPF (flooding). The fix: one router (on the border to the ISP) has a default route (0.0.0.0/0) out and tells OSPF "send everything unknown to me" – this is called default-information-originate. OSPF spreads that default route to everyone and each internal router then knows: whatever I don’t know (= the internet) I send to that gateway.
Step by step
- R4 is on the border to the ISP and has a default route 0.0.0.0/0 out.
- R4 tells OSPF "send the unknown to me". The default route spreads to everyone.
- Every router now knows: internal networks from OSPF, anything else → to R4 out. Inside and internet both covered.
Redistribution
In reality everything rarely runs in OSPF. Somewhere a static route stays (e.g. to a partner), elsewhere a different protocol runs. Redistribution is a "bridge": you take routes from one source (static, another protocol) and let them into OSPF so others know about them too. It’s powerful but handle with care – bad redistribution can cause loops (a packet circles between routers forever, never arrives and eventually its TTL expires) or break metrics. So what flows where is watched closely.
Step by step
- R1 has a static route to a partner network – OSPF doesn’t know it yet.
- With redistribution you inject that static route into OSPF. Now everyone knows it.
- It works great – but carefully. Bad redistribution makes loops. So exactly what flows is controlled.
The whole path and what’s next
Let’s tie it together. OSPF gives a network self-managing routing: routers find each other (Hello), share a map (LSDB), compute shortest paths (Dijkstra), scale via areas and after a failure reroute themselves (convergence) – plus a default route to the internet and redistribution with the surroundings. That covers the internal backbone. What’s next? Traffic flows inside – now let’s protect it: deep inspection (DPI), IDS/IPS and real attacks. That’s the Advanced security course.
Step by step
- The routers found each other, share a map, compute shortest paths and after a failure self-heal. That’s OSPF.
- Plus a default route to the internet and redistribution with static/other protocols. The internal backbone is done.
- Traffic flows reliably. Now let’s protect it in depth – DPI, IDS/IPS, real attacks. The Advanced security course.
OSPF vs. the others
OSPF is just one of several routing protocols — they differ in their metric (how they pick a path) and their purpose. RIP counts hops (obsolete today), EIGRP has a composite metric (Cisco), IS-IS runs on ISP backbones and BGP holds the whole internet between carriers. Who wins when several run at once? Administrative distance decides. You walked through this comparison at the end of the routing course (the “The internet and who wins” lesson) – this is just a quick reminder, because this whole course goes deep on OSPF itself.