12 · Routing fundamentals, OSPF (vs BGP) and IS-IS Network

RIB vs FIB · longest prefix, admin distance, metric · link-state: hellos, LSDB, SPF · areas and scale limits · why OSPF can't run the whole Internet · IS-IS in a paragraph

Why it matters for NPE. 8 of 22 reports asked OSPF, almost always as 'why BGP instead of OSPF' or 'explain an IGP in depth'. You need one IGP cold and the comparison fluent. IS-IS is a preferred qualification in the posting, so know what it is.

Primer: a router is a lookup table with opinions about how to fill it

Every router does two separate jobs. The control plane learns routes (static config, OSPF, IS-IS, BGP) and argues about which one is best. The data plane looks up each packet's destination, rewrites the layer-2 header and sends it out an interface, millions of times a second, without thinking. An IGP (interior gateway protocol) is the control-plane protocol that one organisation runs inside its own network, where every router is trusted and the goal is simply the shortest path. OSPF and IS-IS are the two link-state IGPs; both give every router a complete map and let it compute its own shortest-path tree. BGP, covered in topic 14, is the protocol between organisations where trust and policy replace "shortest".

Watch

Reading: RFC 7938 §7 gives the convergence vocabulary (detection, propagation, SPF, FIB update) you want in the "how fast does it converge" answer.

RIB, FIB and the two planes

Why this matters: a route can be in the RIB and still not forward (next hop unresolvable, interface down, FIB full). Hardware FIBs have a fixed size; that is why the Internet's million prefixes do not fit on a cheap switch and why Meta summarises aggressively inside its fabrics.

How one route is chosen

1. Longest prefix match. For a given packet the most specific route wins. A /32 beats a /24 beats 0.0.0.0/0 whatever their source. This is a per-packet lookup rule, not a RIB rule.
2. Administrative distance (Cisco) or route preference (Juniper). When two sources offer the same prefix, the more trusted source is installed in the RIB.
3. Metric. Within one protocol, lowest metric wins (OSPF cost, IS-IS metric, RIP hops, BGP's attribute chain).
4. ECMP. Equal-metric routes from the same protocol are all installed and traffic is hashed across them (OSPF: 4 by default on Cisco, up to 64 or 128 on modern platforms).

Two things to say out loud: the numbers are vendor conventions, and Juniper prefers OSPF over eBGP while Cisco does the opposite. The plain Linux kernel has no administrative distance at all: it keeps one route per prefix per metric and a protocol tag (proto bgp, proto ospf), so the routing daemon (FRR, BIRD, Meta's own agent) must do the comparison before it installs. Multiple routing tables plus policy rules (ip rule) give Linux policy routing that Cisco does with route-maps.

Static routes, default, floating, recursive

ip route 10.9.0.0/16 via 192.0.2.1            # static: next hop on a connected subnet
ip route 0.0.0.0/0  via 192.0.2.1             # default route: the /0 that matches when nothing else does
ip route 0.0.0.0/0  via 198.51.100.1 metric 250   # floating static: higher cost, installed only when the primary disappears
ip route 172.16.0.0/12 via 10.9.1.1           # recursive: 10.9.1.1 is not connected, so the router
                                              # looks up 10.9.1.1 (hits 10.9.0.0/16) to find the real egress

A floating static on Cisco is a static with a higher AD than the dynamic route (ip route 0.0.0.0 0.0.0.0 198.51.100.1 250); it floats in only if OSPF or BGP stops offering that prefix. A recursive next hop that points at a prefix learned by BGP gives you the classic "route is there but traffic blackholes" when the inner route flaps. Static routes never go away on their own unless the interface drops, which is why operators pair them with BFD or IP SLA tracking.

Distance-vector vs link-state

OSPF in depth

Packets and addresses

OSPF rides directly in IP as protocol 89, no TCP or UDP. On broadcast segments it multicasts to 224.0.0.5 (AllSPFRouters) and 224.0.0.6 (AllDRouters, listened to by the DR and BDR). OSPFv3 for IPv6 uses ff02::5 and ff02::6. Five packet types:

Neighbour states

• Down: no hello heard yet. Init: I heard your hello but you have not listed me. 2-Way: we both list each other; DR/BDR election happens here.
• ExStart: pick master (higher router ID) and the starting sequence number. Stuck in ExStart almost always means an MTU mismatch, because the DBD carries the MTU and the smaller side rejects it.
• Exchange: swap DBDs (headers). Loading: request and receive the LSAs I lack. Full: identical LSDBs. Only Full neighbours (and 2-Way for DROther pairs) are healthy.

What must match for an adjacency

Hellos do not need matching priority, cost or router ID. Cost mismatches only make paths asymmetric.

DR and BDR on broadcast segments

On a multi-access segment with n routers, full adjacencies between all pairs would mean n(n-1)/2 flooding relationships and n Network LSAs' worth of mess. OSPF elects a Designated Router and a Backup DR; every other router (a DROther) forms a Full adjacency only with the DR and BDR and stays in 2-Way with the rest. DROthers send updates to 224.0.0.6, the DR re-floods to 224.0.0.5. Election: highest priority (default 1, 0 means never), tie broken by highest router ID. The election is not preemptive: a new router with a higher priority waits until the current DR goes away. The DR generates the type 2 Network LSA for the segment. Point-to-point links skip all of this, which is why fabric links are configured ip ospf network point-to-point.

LSA types

Types 1 and 2 are the topology. Types 3, 4, 5 and 7 are reachability only, which is the point: inter-area and external routes are carried distance-vector style so the SPF tree is computed per area.

LSDB, SPF and cost

Every router in an area holds the same link-state database (LSDB): the set of all type 1 and 2 LSAs for that area plus the 3/4/5s it has received. On any change it runs Dijkstra with itself as the root to build a shortest-path tree, then installs the leaves into the RIB. SPF cost is O(E log V), so a few thousand nodes is fine and a hundred thousand is not. Each interface has a cost = reference bandwidth / interface bandwidth, with reference bandwidth 100 Mbit/s by default: 10 Mbit = 10, 100 Mbit = 1, and everything from 1 Gbit upward also rounds to 1, so a 1G link and a 100G link look identical until you raise the reference (auto-cost reference-bandwidth 100000, identically on every router). Cost is cumulative along the path and asymmetric costs are allowed. IS-IS does not care about bandwidth at all: every interface is 10 unless you set it.

Areas, ABR and ASBR

Areas exist because flooding and SPF do not scale: a flapping link anywhere in an area makes every router in that area re-flood and recompute. An ABR (area border router) sits in two or more areas, holds an LSDB per area, and injects type 3 summaries in each direction; it is the only place you can summarise intra-OSPF prefixes. An ASBR redistributes external routes in as type 5. The backbone, area 0, must be contiguous and every other area must attach to it (or be stitched with a virtual link, which is a hack to admit). Area types in one line each: a stub area blocks type 5 and gets a default from the ABR; a totally stubby area also blocks type 3; an NSSA is a stub that is still allowed its own ASBR via type 7. The practical limit is a few hundred routers per area and a few hundred areas; beyond that is where BGP starts.

Convergence, step by step

1. Detect: carrier loss (instant), BFD (tens of ms) or the dead timer (40 s by default; that is the number to quote and then say "which is why you tune it or run BFD").
2. Originate: the routers on each side issue a new type 1 (and the DR a new type 2) with a higher sequence number.
3. Flood: LSUs to every neighbour, acknowledged, hop by hop, through the area. Milliseconds across a campus.
4. SPF: each router waits its SPF throttle (initial 50 ms on modern defaults, backing off under churn) and recomputes. Partial or incremental SPF for type 3/5 changes.
5. RIB then FIB: new next hops installed, ASIC programmed. Total: well under a second with BFD, 40 seconds or more without it.

During steps 3-5 different routers hold different views for a few ms, so micro-loops are possible; that is the honest answer to "is link-state always loop-free".

What you'd type and see

! Cisco IOS-style
router ospf 1
 router-id 10.0.0.1
 auto-cost reference-bandwidth 100000     ! 100 Gbit/s = 1, must match everywhere
 network 10.0.0.0 0.0.255.255 area 0
 passive-interface default
 no passive-interface GigabitEthernet0/1
interface GigabitEthernet0/1
 ip ospf network point-to-point
 ip ospf hello-interval 1
 ip ospf dead-interval 3

R1# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/  -        00:00:02    10.0.12.2       GigabitEthernet0/1   ! "-" = p2p, no DR
10.0.0.3          1   FULL/DR         00:00:35    10.0.13.3       GigabitEthernet0/2
10.0.0.4          1   2WAY/DROTHER    00:00:38    10.0.13.4       GigabitEthernet0/2   ! normal on a LAN

R1# show ip route ospf
O     10.0.23.0/30 [110/2] via 10.0.12.2, 00:04:11, GigabitEthernet0/1      ! [AD/cost]
O IA  10.1.0.0/16  [110/3] via 10.0.12.2, 00:04:11, GigabitEthernet0/1
O E2  0.0.0.0/0    [110/1] via 10.0.13.3, 00:02:50, GigabitEthernet0/2

# FRR on Linux
vtysh -c 'show ip ospf neighbor'
vtysh -c 'show ip ospf database'
tcpdump -ni eth0 'ip proto 89'          # hellos every 10 s to 224.0.0.5

Why OSPF cannot run the whole Internet (and why not everywhere)

This is the question behind half the OSPF questions in the reports. Give four reasons, then the comparison.

• Trust. Link-state assumes every router tells the truth and every router sees everything. The Internet is tens of thousands of organisations who do not trust each other and do not want to show their topology.
• Policy. OSPF has one metric and one answer: shortest. It cannot say "prefer the cheaper provider", "do not carry transit for them", or "accept only these prefixes from that neighbour". BGP's whole design is per-neighbour policy.
• Scale of flooding and SPF. A million prefixes and every link flap on Earth flooded to every router, with every router rerunning Dijkstra, is not a plan. Areas help by a factor of hundreds, not millions.
• Administrative boundaries. OSPF has no notion of "my network ends here"; BGP's AS number is exactly that boundary, and it hides everything behind it.

Inside a large data center the same argument applies at smaller scale (see topic 16 and RFC 7938): thousands of switches make a single LSDB fat and flooding noisy, and operators want per-link policy and summarisation that OSPF's area model gives awkwardly. eBGP between every tier, with a private ASN per tier, is simpler to reason about and to write software for.

IS-IS in a compact section

IS-IS (Intermediate System to Intermediate System, ISO 10589, RFC 1195 for IP) is the other link-state IGP and does the same thing as OSPF: hellos (called IIH), a flooded database of LSPs (link-state PDUs, one per router rather than many small LSAs), synchronised with CSNP/PSNP packets, and Dijkstra on every router. The differences are what interviewers want:

• It runs directly over layer 2 (its own Ethertype / LLC, not inside IP), so it needs no IP addresses on links to form adjacencies and cannot be attacked with spoofed IP packets. That also means you capture it with tcpdump isis, not ip proto.
• Routers have one NET (network entity title) such as 49.0001.1921.6800.1001.00: area 49.0001, a 6-byte system ID (here the IP 192.168.1.1 padded), NSEL 00. Area membership is a property of the router, not of each link.
• Hierarchy is Level 1 (intra-area) and Level 2 (backbone); routers are L1, L2 or L1/L2 and the area boundary falls on a link between them, where OSPF's falls on the ABR itself. Many backbones run a single flat L2.
• Everything is a TLV (type-length-value), so new address families and features (IPv6, traffic engineering, segment routing) were added without a new protocol version. OSPF needed OSPFv3 for IPv6.
• Default metric is 10 on every interface regardless of bandwidth; wide metrics (24-bit) are standard now.
• Large ISPs and backbones chose it in the 1990s for stability, fewer LSA types to reason about, bigger areas, and extensibility, and most of them never left. Meta's posting lists IS-IS as a preferred qualification because the backbone world (MPLS, segment routing, traffic engineering) grew up on it; Meta's own Express Backbone uses its in-house Open/R as the IGP, which is a link-state protocol in the same family. See topic 16.

The one-line answer: "IS-IS is link-state like OSPF, but it runs on layer 2 instead of IP, uses levels instead of areas, and its TLV encoding made it easy to extend, which is why ISPs and backbones prefer it."

Interview questions

Traps

• Saying administrative distance is checked before longest prefix. Longest prefix is the per-packet lookup rule; AD only breaks ties between sources offering the same prefix.
• Quoting Cisco's AD table as universal. Juniper prefers OSPF (10) over BGP (170); the Linux kernel has no AD at all.
• Calling 2-Way between two DROthers a fault. It is correct behaviour on a broadcast segment.
• Saying OSPF uses TCP or UDP. It is IP protocol 89 and does its own reliable flooding with LSAcks.
• Saying every router in the network has the same LSDB. Only within an area; ABRs hold one per area and only reachability crosses.
• Forgetting that cost floors at 1, so 1G and 100G links tie unless you raise the reference bandwidth.
• Describing OSPF's loop freedom as absolute. Micro-loops during convergence are real and interviewers who know will ask.
• Saying IS-IS runs over IP, or calling it "OSPF for IPv6". It runs over layer 2 and predates OSPFv3's IPv6 support by a decade.

Scenario

After a maintenance, a new switch was added to a broadcast segment in area 0. Its OSPF neighbours show EXSTART/DR toward the existing core router and never move. Users behind the new switch cannot reach anything beyond it. Walk through it.

← 11 · Stacks, queues, intervals and 2D grids · all topics · 13 · Graphs: BFS and DFS on grids and adjacency lists →