OSPF Version 2
obsoletes
- rfc-2178 — OSPF Version 2
updated by
- rfc-5709 — OSPFv2 HMAC-SHA Cryptographic Authentication
- rfc-6549 — OSPFv2 Multi-Instance Extensions
- rfc-6845 — OSPF Hybrid Broadcast and Point-to-Multipoint Interface Type
- rfc-6860 — Hiding Transit-Only Networks in OSPF
- rfc-7474 — Security Extension for OSPFv2 When Using Manual Key Management
- rfc-8042 — OSPF Two-Part Metric
- rfc-9355 — OSPF Bidirectional Forwarding Detection (BFD) Strict-Mode
- rfc-9454 — Update to OSPF Terminology
also
- std-54
Extracted elements (28)
Area routing hides topological detail: intra-area routing is determined solely by the area's own topology, protecting it from injection of bad routing data from outside. This also enables a marked reduction in routing traffic compared to running the entire AS as a single link-state domain.
NBMA mode is more efficient (smaller database, less traffic) but requires full mesh connectivity among all attached routers. Point-to-MultiPoint mode avoids this constraint by treating each router-to-router connection as an independent point-to-point link, at the cost of larger databases. The choice depends on the underlying network's connectivity properties.
The AS-external-LSA 'forwarding address' field allows an ASBR to direct traffic directly to a non-OSPF next-hop router, avoiding an extra hop through the advertising ASBR. It also enables interior routers to function as 'route servers' that redistribute external routes with correct exit points.
The Designated Router concept was adopted from ISO IS-IS but greatly enhanced in OSPF: on a broadcast or NBMA network with N routers, only N adjacencies are required (each router to the DR) rather than N*(N-1)/2. This sharply reduces routing protocol traffic and link-state database size.
Type 2 external metrics are intentionally an order of magnitude larger than any intra-AS path cost, encoding the assumption that inter-AS routing cost dominates. This eliminates the need for unit conversion between external and internal metrics and simplifies tie-breaking.
Implementations of RFC 2328 are backward-compatible with implementations of RFCs 2178, 1583, and 1247. All differences introduced in RFC 2328 relative to RFC 2178 are backward-compatible in nature.
All OSPF protocol exchanges are authenticated. Only trusted routers can participate in the Autonomous System's routing, and separate authentication schemes can be configured for each IP subnet.
AS-external-LSAs must not be flooded into or throughout stub areas; routing to AS external destinations in stub areas is based on a per-area default only.
The OSPF backbone (Area 0.0.0.0) must be contiguous and must contain all area border routers. If physical contiguity is not possible, backbone connectivity must be established through virtual links.
The OSPF protocol ensures that all routers belonging to an area agree on whether the area has been configured as a stub, guaranteeing no confusion in the flooding of AS-external-LSAs.
Virtual links cannot be configured through stub areas, and AS boundary routers cannot be placed internal to stub areas.
When an IP packet is forwarded, it must always be forwarded to the network that is the best (longest/most specific) match for the packet's destination. Subnet masks must be assigned so the best match is unambiguous.
LSAs are aged using the LS age field; an LSA reaching MaxAge (3600 seconds) is flushed from the database. Premature aging can be triggered by a router to withdraw an LSA before its natural expiration.
OSPF defines four LSA types: Router-LSA (originated by every router), Network-LSA (originated by the DR), Summary-LSA (originated by ABRs), and AS-external-LSA (originated by ASBRs). Each LSA is flooded throughout its scope.
OSPF supports equal-cost multipath (ECMP): when multiple equal-cost routes to a destination exist, all are discovered and traffic is distributed equally among them. No algorithmic changes are needed; the SPF tree naturally captures all equal-cost next hops.
The Designated Router (DR) is elected on each broadcast and NBMA network with at least two attached routers. The DR generates a Network-LSA for the network and reduces the number of required adjacencies, cutting routing traffic and link-state database size.
The flooding procedure reliably distributes LSAs throughout the OSPF routing domain. Each LSA is acknowledged, retransmitted if not acknowledged, and installed in the link-state database upon receipt.
The Hello Protocol establishes and maintains neighbor relationships, and on broadcast networks dynamically discovers neighboring routers. It also elects the Designated Router and Backup Designated Router.
Virtual links connect backbone routers across non-backbone areas, allowing the backbone to remain logically contiguous even when it is not physically contiguous. Virtual links belong to the backbone and use intra-area routing for their traffic.
Cryptographic authentication (Appendix D.3) uses a per-interface Key ID, authentication data length, and a non-decreasing cryptographic sequence number appended to each packet. MD5 is the default hash; the digest is appended after the OSPF packet, not in the authentication field.
Simple password authentication places an 8-byte plaintext password in the authentication field of every OSPF packet. This provides minimal security and is vulnerable to passive eavesdropping; cryptographic authentication is strongly preferred.
The interface state machine defines states Down, Loopback, Waiting, Point-to-Point, DROther, BDR, and DR. Events include InterfaceUp, WaitTimer, BackupSeen, NeighborChange, LoopInd, UnloopInd, and InterfaceDown. DR/BDR election occurs during the Waiting state.
The neighbor state machine defines states Down, Attempt, Init, 2-Way, ExStart, Exchange, Loading, and Full. Adjacency formation progresses through ExStart (master/slave negotiation), Exchange (DD packets), Loading (LSR/LSU), to Full (synchronized databases).
Router-LSAs encode each router link as a 12-byte structure: Link ID (4 bytes), Link Data (4 bytes), Type (1 byte, values 1=point-to-point, 2=transit network, 3=stub network, 4=virtual link), TOS count (1 byte), metric (2 bytes).
The Database Description (DD) packet carries Interface MTU (2 bytes), Options (1 byte), a flags byte (I/M/MS bits), DD sequence number (4 bytes), and a variable list of LSA headers. The I-bit signals the first packet; MS-bit indicates master role.
The Hello packet contains Network Mask (4 bytes), HelloInterval (2 bytes), Options (1 byte), Rtr Pri (1 byte), RouterDeadInterval (4 bytes), Designated Router (4 bytes), Backup Designated Router (4 bytes), followed by a variable list of neighbor Router IDs.
The LSA header is 20 bytes: LS age (2 bytes), Options (1 byte), LS type (1 byte), Link State ID (4 bytes), Advertising Router (4 bytes), LS sequence number (4 bytes, signed 32-bit), LS checksum (2 bytes, Fletcher), and Length (2 bytes).
The OSPF packet header is 24 bytes: Version (1 byte, value 2), Type (1 byte), Packet Length (2 bytes), Router ID (4 bytes), Area ID (4 bytes), Checksum (2 bytes), AuType (2 bytes), and Authentication (8 bytes). All OSPF packet types share this header.