Vol. I · No. 46The protocol sectionSat, 10 Oct 2026
Layer 3 control · Routing · everyone draws the same map

OSPF

Open Shortest Path First

OSPF is how routers inside one organisation agree on the shape of it. Every router floods a description of its own links to all the others, so each builds an identical map of the network and then runs Dijkstra on it to find the shortest path to everywhere.

OSPF gives every router the same map of the network — then each computes its own shortest paths from it.

Kind
Link-state
a map, not rumours
Protocol
IP 89
straight on IP
Scope
Within an AS
an interior gateway protocol
Metric
Cost
from bandwidth

How it works

Flood the links, build the map, run the algorithm
This routerEvery other router in the area
1 · Hello — find the neighbours
Multicast to 224.0.0.5 until both sides list each other — adjacency formed
2 · Flood link-state advertisements
“I connect to A at cost 10, and to B at cost 100”
Every LSA is passed on unchanged, so all routers receive all of them
3 · Everyone holds the same database
The link-state database is identical on every router in the area
Run Dijkstra over it and the shortest path to each prefix falls out

Because the map is shared rather than summarised, OSPF converges fast and cannot form the loops distance-vector protocols can. A link failure floods one small update and everyone recomputes.

The main points

What OSPF does, step by step

1
Meet the neighbours

Hello packets on each interface find adjacent routers and keep the adjacency alive.

2
Describe your links

Each router originates LSAs listing its interfaces, their neighbours and the cost of each.

3
Flood and synchronise

LSAs are reflooded until every router in the area holds an identical link-state database.

4
Run shortest path first

Each router runs Dijkstra over that database to build its own routing table — cheapest total cost wins.

Structure and terms
Area 0 — the backbone every area attaches to
ABR — a router between two areas
DR / BDR — elected, to stop full-mesh flooding
Cost — reference bandwidth ÷ link speed
LSA types — router, network, summary, external
OSPFv3 — the same idea, for IPv6

In cybersecurity

A routing protocol decides where every packet goes, so a router that is allowed to speak OSPF and shouldn’t be can pull traffic wherever it likes.

Authenticate adjacencies

Without it, any host that sends Hellos becomes a neighbour — use HMAC-SHA, not the old MD5.

Passive interfaces

Turn OSPF off on ports facing users; only router-to-router links should carry it.

False LSAs

A rogue router advertising an attractive cost draws traffic through itself.

Database overload

Flooding excessive LSAs exhausts memory and CPU on every router in the area.

Filter redistribution

Routes pulled in from BGP or elsewhere should be filtered, or a mistake propagates everywhere.

It carries no encryption

The topology of your whole network is on the wire in the clear; segment where that matters.

Rides in the stack

EthernetIPOSPF

Carried straight in IP as protocol 89, with its own reliable flooding — it does not use TCP the way BGP does.

Works with

IS-ISBGPIPv4

See it on Linux

ip route

OSPF or BGP?

BGPOSPF
BetweenOrganisationsInside one
KindPath-vectorLink-state
Chooses byPolicyLowest cost
ConvergesSlowlyIn seconds