Where OSPF fits: IGP and the link-state principle
OSPF (Open Shortest Path First) is an interior routing protocol (IGP — Interior Gateway Protocol), designed for routing within a single organization or a single autonomous system (AS) — unlike BGP, which routes between autonomous systems. OSPF is defined in RFC 2328 (the IPv4 version, OSPFv2) and is a standardized, vendor-independent protocol — hence the word "Open" in its name.
The key feature that sets OSPF apart from older protocols like RIP is the link-state principle. Instead of a router only remembering "which way and how far" (as with distance-vector protocols), every OSPF router builds a complete, identical map of the entire network topology — the so-called Link-State Database (LSDB) — and calculates the shortest path to every destination from it, locally, on its own.
Dijkstra's algorithm: how OSPF calculates paths
Once a router has a complete map of the network (the LSDB), it uses Dijkstra's algorithm (referred to in the OSPF context as SPF — Shortest Path First) to compute a tree of shortest paths from its own position to every other node in the network. The algorithm progressively examines the nearest unprocessed nodes, continuously updates the shortest known distances, and never has to "go back" and recompute nodes it has already closed off — which makes it computationally efficient even on large topologies.
The result is that every router in the network independently arrives at the same global view of the topology, but each one computes its own shortest-path tree oriented around itself from that view — and that's ultimately what gets translated into its routing table.
Building adjacencies: the Hello protocol and neighbor states
Before two OSPF routers can exchange topology information, they first have to discover each other and establish a neighbor relationship (adjacency). This is handled by the Hello protocol — routers periodically (every 10 seconds by default on Ethernet interfaces) send multicast Hello packets to the address 224.0.0.5. If a router doesn't receive a Hello from a neighbor within the Dead Interval (four times the Hello interval by default, i.e. 40 seconds), it considers that neighbor unreachable.
Building an adjacency goes through a precisely defined sequence of states:
| State | What happens |
|---|---|
| Down | No communication with the neighbor has occurred yet |
| Init | A Hello packet has been received, but two-way communication hasn't been confirmed yet |
| 2-Way | Two-way communication confirmed — the router sees itself in the neighbor's Hello packets |
| ExStart | The routers negotiate which one will be "master" during database exchange |
| Exchange | Exchange of LSDB content descriptions (Database Description packets) |
| Loading | Downloading missing detailed LSA records |
| Full | The adjacency is fully established, the LSDB is synchronized |
DR and BDR election on multi-access networks
On Ethernet-type segments, where multiple routers can be connected at once (so-called multi-access networks), forming a full adjacency between every pair of routers (a full mesh) would lead to an unnecessarily large amount of duplicate communication — with N routers, that would produce N×(N-1)/2 adjacencies. OSPF therefore elects a Designated Router (DR) and a backup Backup Designated Router (BDR) on such segments. All other routers on the segment form a full adjacency only with the DR and BDR, not with each other — the DR then acts as the central point through which topology information is further disseminated to everyone.
DR election is based on the highest configured interface priority (a router with priority 0 doesn't participate in the election at all); ties are broken by the highest Router ID. An important property: DR election is not preemptive — if a router with a higher priority joins later, it will not "unseat" the existing DR.
LSA types: the building blocks of the topology map
Topology information is disseminated between routers in the form of LSA (Link-State Advertisement) records, which together make up the LSDB. There are several LSA types, each serving a different purpose:
| Type | Name | Purpose |
|---|---|---|
| 1 | Router LSA | Describes a router's directly connected links and neighbors; flooded only within a single area |
| 2 | Network LSA | Generated by the DR on a multi-access segment, describes all routers connected to that segment |
| 3 | Summary LSA (Inter-Area) | Created by an ABR router, summarizes networks from one area and floods them into other areas |
| 4 | ASBR Summary LSA | Informs other areas where the router that imports external routes (the ASBR) is located |
| 5 | AS External LSA | Routes imported from another routing protocol (e.g. BGP), flooded across the entire domain |
| 7 | NSSA External LSA | Equivalent of type 5, but used only within special "Not-So-Stubby" areas |
Area hierarchy: why OSPF scales
Across a very large network footprint, maintaining a single shared LSDB across all routers would lead to an enormous database and increasingly costly SPF recalculations on every change. OSPF therefore introduces an area hierarchy — the network is split into smaller units, with Area 0 (the backbone) always mandatory, and every other area required to connect directly to it.
There are several area types with different behavior toward external routes:
- Standard area — accepts all LSA types, including external routes (type 5).
- Stub area — does not accept external routes (type 5); the ABR injects only a default route instead — this shrinks the LSDB in end-point areas that don't need to know the details of the outside world.
- Totally Stubby area (a vendor-specific extension) — goes even further and blocks inter-area routes (type 3) as well, again replacing them with just a default route.
- NSSA (Not-So-Stubby Area) — a compromise: it forbids classic type-5 external LSAs, but allows locally importing external routes via a special type 7, which gets converted to type 5 at the area boundary.
Metric: cost instead of hop count
Unlike RIP, which only counts hops, OSPF uses a metric called cost, derived from an interface's bandwidth. The default formula is cost = reference bandwidth / interface bandwidth, with a default reference value of 100 Mb/s (on modern high-speed links, it's therefore common practice to manually raise this reference value — otherwise multiple fast links would all get the same, lowest possible cost of 1). The total path cost is the sum of the costs of every interface along the route — Dijkstra's algorithm then picks the path with the lowest total.
OSPFv2 vs OSPFv3: IPv4 and IPv6
OSPFv2 (RFC 2328) is the original version for IPv4. OSPFv3 (RFC 5340) adds IPv6 support, but the fundamental principles — the link-state model, Dijkstra's algorithm, the area hierarchy, LSA types — stay the same. Key differences: OSPFv3 operates independently of specific IP addressing (adjacencies are identified by Router ID, not IP address), it supports multiple protocol instances on a single interface, and it handles security differently — where OSPFv2 had authentication built directly into the protocol, OSPFv3 relies on IPsec at the IPv6 level.
Authentication and security risks
OSPFv2 supports three levels of neighbor-relationship authentication: none, a simple plaintext password (easily intercepted, not recommended today), and MD5 authentication, which cryptographically signs OSPF packets using a shared key.
Without authentication, an attacker with network access can send forged Hello or LSA packets, establish a fake adjacency, and inject false topology information into the LSDB — allowing them to reroute traffic through themselves (a form of Man-in-the-Middle, see our article on cyberattacks) or cause part of the network to go down. In production networks, it's therefore recommended to always deploy at least MD5 authentication and passive interfaces (passive-interface) on ports where an adjacency isn't expected.
Summary
OSPF replaced simple distance-vector protocols like RIP wherever fast convergence and scalability mattered — because every router maintains a complete topology map (the LSDB) and runs Dijkstra's algorithm on it itself, it can adapt to a network change an order of magnitude faster than distance-vector protocols. The area hierarchy around the mandatory Area 0 backbone keeps database size under control even in large networks, and the various LSA types allow precise control over what information spreads where. The price for this sophistication is greater configuration complexity, and the need to carefully plan area design and authentication from the very start.