Vol. I · No. 46The protocol sectionSat, 10 Oct 2026
Layer 3 control · Routing · the carrier’s link-state protocol

IS-IS

Intermediate System to Intermediate System

IS-IS is OSPF’s quieter, tougher cousin. It is a link-state protocol that floods link descriptions until every router shares one map, but it runs directly on the link rather than over IP — which is exactly why large carriers and datacentre fabrics prefer it.

IS-IS builds the same shared map as OSPF, but travels below IP — so the routing protocol cannot be attacked through the network it routes.

Kind
Link-state
like OSPF
Runs on
Layer 2
CLNS, not IP
Levels
L1 / L2
area and backbone
Found in
Carriers
and large fabrics

How it works

Two levels: inside an area, and between them
Level 1 — inside an area
Routers flood LSPs describing their own links to every other router in the same area.
Each builds an identical database and runs SPF over it — exactly as OSPF does, with different names.
Level 2 — the backbone between areas
L2 routers form their own contiguous backbone and carry routes between areas.
A router can be L1, L2, or both at once — the boundary sits on the router, not on the link.
Carried in TLVs — which is why it aged so well
Everything IS-IS advertises is a type-length-value, so IPv6, segment routing and traffic engineering were all added without a new protocol version.

Running on the link rather than on IP means an IS-IS adjacency cannot be reached from the routed network at all — and the same protocol instance carries IPv4 and IPv6 together, where OSPF needs two.

The main points

What IS-IS does, step by step

1
Form adjacencies

Hello PDUs on each link find neighbours and agree the level — L1 within an area, L2 across the backbone.

2
Flood link-state PDUs

Each router originates an LSP describing its links and metrics; LSPs are reflooded until all agree.

3
Synchronise the database

CSNPs and PSNPs let neighbours compare summaries and request only what they are missing.

4
Compute shortest paths

SPF runs over the identical database on each router to produce its forwarding table.

Why carriers pick it
Below IP — unreachable from the data plane
One instance — IPv4 and IPv6 together
TLV extensibility — new features, same version
Flat scaling — huge single areas in practice
Segment routing — added as TLVs, cleanly
Fast flooding — tuned for very large fabrics

In cybersecurity

Sitting below IP gives IS-IS a genuinely smaller attack surface than OSPF — but an attacker with access to the link itself is still an adjacency away.

Not IP-reachable

You cannot send an IS-IS packet from across the internet; you have to be on the link.

Authenticate anyway

HMAC-SHA on hellos and LSPs stops a device plugged into the fabric from becoming a neighbour.

LSP flooding attacks

A malicious router can churn LSPs and force constant SPF runs across the whole area.

Metric manipulation

Advertising an attractive metric draws traffic through a router that shouldn’t carry it.

Guard the console

Because the control plane isn’t on IP, physical and management access is the real boundary.

No confidentiality

The topology is readable to anyone on the link — MACsec is what encrypts it.

Sits beside the stack

EthernetIS-ISroutes IP

It routes IP without being carried by it — the protocol travels in its own layer-2 frames, as CLNS always did.

Works with

OSPF

IS-IS or OSPF?

OSPFIS-IS
Carried onIP protocol 89The link itself
IPv6A second instanceSame instance
Extending itNew LSA typesNew TLVs
Typical homeEnterpriseCarrier, fabric