1 - 2 - 3 - 6 - 8 - A - B - C - D - E - F - G - H - I - K - L - M - N - O - P - Q - R - S - T - U - V - W - X
OSPF
Click on the red underlined text to get to the source
... This document is a specification of the Open Shortest Path First
(OSPF) TCP/IP internet routing protocol ...
... routing information between routers belonging to a single Autonomous
System. The OSPF protocol is based on link-state or SPF technology.
...
...
The OSPF protocol was developed by the OSPF working group of the
Internet Engineering Task Force ...
...
The OSPF protocol was developed by the OSPF working group of the
Internet Engineering Task Force. It has been designed expressly for
...
... CIDR
and the tagging of externally-derived routing information. OSPF
also provides for the authentication of routing ...
... encapsulated in any further protocol
headers as they transit the Autonomous System. OSPF is a
dynamic routing protocol. It quickly detects topological
...
...
OSPF allows sets of networks to be grouped together. Such a
grouping is called an area. The topology ...
... IP subnets. Each
route distributed by OSPF has a destination and mask. Two
different subnets ...
... advertised throughout the Autonomous System. This externally
derived data is kept separate from the OSPF protocol's link
state data. Each external route can also be tagged by the
...
...
This section provides definitions for terms that have a specific
meaning to the OSPF protocol and that are used throughout the
text. The reader unfamiliar with the Internet Protocol Suite is
...
... A 32-bit number assigned to each router running the OSPF
protocol. This number uniquely identifies the router within
an Autonomous System ...
... Neighboring routers are discovered dynamically on these nets
using OSPF's Hello Protocol. The Hello Protocol itself
...
... Hello Protocol itself
takes advantage of the broadcast capability. The OSPF
protocol makes further use of multicast capabilities, if
they exist. Each pair of routers ...
... broadcast capability. Neighboring routers are maintained
on these nets using OSPF's Hello Protocol. However, due to
the lack of broadcast ...
... neighbors. On non-broadcast networks, OSPF protocol packets
that are normally multicast need to be sent to each
...
... non-broadcast multi-access or NBMA,
simulates the operation of OSPF on a broadcast network. The
...
... Neighbor relationships are maintained by, and usually
dynamically discovered by, OSPF's Hello Protocol.
...
...
The part of the OSPF protocol used to establish and maintain
neighbor relationships. On broadcast ...
... services to the Internet Protocol and in turn the OSPF
protocol. Examples of these are the X.25 packet and frame
levels for X.25 ...
...
OSPF is a link state routing protocol. Such protocols are also
referred to in the literature as SPF ...
... the developments in link-state technology that have influenced
the OSPF protocol.
...
... OSPF Working Group of the IETF has extended this work in
developing the OSPF protocol. The Designated Router concept has
been greatly enhanced to further reduce the amount of routing ...
... Burgan, Rob Coltun, Dino Farinacci, Vince Fuller, Phanindra
Jujjavarapu, Milo Medin, Tom Pusateri, Kannan Varadhan, Zhaohui
Zhang and the rest of the OSPF Working Group for the ideas and
support they have given to this project.
...
...
The OSPF Point-to-MultiPoint interface is based on work done by
Fred Baker.
...
...
The OSPF Cryptographic Authentication option was developed by
Fred Baker and Ran Atkinson.
...
...
When no OSPF areas are configured, each router in the Autonomous
System has an identical link-state ...
...
OSPF supports two types of external metrics. Type 1 external
metrics are expressed in the same units as OSPF interface ...
... OSPF supports two types of external metrics. Type 1 external
metrics are expressed in the same units as OSPF interface cost
(i.e., in terms of the link state ...
... Network N6, called Router RTX. Suppose further that RTX does
not participate in OSPF routing, but does exchange BGP
...
... router RT7. Then, Router RT7
would end up advertising OSPF external routes for all
destinations that should be routed to RTX. An extra hop will
...
...
To deal with this situation, the OSPF protocol allows an AS
boundary router to specify a "forwarding address ...
... The OSPF backbone is the special OSPF Area 0 (often written as
Area 0.0.0.0, since OSPF Area ID ...
... backbone is the special OSPF Area 0 (often written as
Area 0.0.0.0, since OSPF Area ID's are typically formatted as IP
addresses). The OSPF ...
... OSPF Area ID's are typically formatted as IP
addresses). The OSPF backbone always contains all area border
routers. The backbone ...
...
Before the introduction of areas, the only OSPF routers having a
specialized function were those advertising external routing
information, such as Router ...
... Router RT5 in Figure 2. When the AS is
split into OSPF areas, the routers are further divided according
to function into the following four overlapping categories:
...
... ..........................
Figure 6: A sample OSPF area configuration
...
... IP subnetted network might be configured as a
single OSPF area. In that case, a single address range could be
configured: a class ...
... LSA is usually flooded throughout the entire AS. However, OSPF
allows certain areas to be configured as "stub areas". AS-
...
...
In order to take advantage of the OSPF stub area support,
default routing must be used in the stub area. This is
...
...
The OSPF protocol ensures that all routers belonging to an area
agree on whether the area has been configured as a stub. This
...
...
OSPF does not actively attempt to repair area partitions. When
an area becomes partitioned, each component simply becomes a
...
... over IP, using IP protocol 89.
OSPF does not provide any explicit fragmentation/reassembly
support. When fragmentation ...
... IP
fragmentation/reassembly is used. OSPF protocol packets have
been designed so that large protocol packets can generally be
split into several smaller protocol packets. This practice is
...
... traffic, both
when being sent and received. As an aid to accomplishing this,
OSPF protocol packets should have their IP precedence field set
to the value Internetwork Control (see [Ref5 ...
...
All OSPF protocol packets share a common protocol header that is
described in Appendix A. The OSPF packet ...
... OSPF protocol packets share a common protocol header that is
described in Appendix A. The OSPF packet types are listed below
in Table 8. Their formats are also described in Appendix A.
...
... Flooding acknowledgment
Table 8: OSPF packet types.
...
... Link State Request packets are used in the forming of
adjacencies. OSPF's reliable update mechanism is implemented by
the Link State ...
... Each LSA also has a type field; the different types of OSPF LSAs
are listed below in Table 9.
...
...
OSPF routing packets (with the exception of Hellos) are sent
only over adjacencies. This means that all OSPF protocol ...
... OSPF routing packets (with the exception of Hellos) are sent
only over adjacencies. This means that all OSPF protocol
packets travel a single IP hop, except those that are sent over
...
... IP hop, except those that are sent over
virtual adjacencies. The IP source address of an OSPF protocol
packet is one end of a router adjacency, and the IP ...
...
An implementation of OSPF requires the following pieces of
system support:
...
... IP multicast datagrams used by
OSPF never travel more than one hop. For this reason, the
ability to forward IP multicast datagrams ...
... Ethernet data link layer.
Indications must be passed from these protocols to OSPF as
the network interface goes up and down. For example, on an
...
... On non-broadcast networks, the OSPF Hello Protocol can be
aided by providing an indication when an attempt is made to
send a packet to a dead or non-existent router ...
... X.25 clear with an
appropriate cause and diagnostic, and this information would
be passed to OSPF.
List manipulation primitives
...
...
List manipulation primitives
Much of the OSPF functionality is described in terms of its
operation on lists of LSAs. For example, the collection of
...
... acknowledged are described as a list. Any particular LSA
may be on many such lists. An OSPF implementation needs to
be able to manipulate these lists, adding and deleting
constituent LSAs ...
... Optional OSPF capabilities ...
...
The OSPF protocol defines several optional capabilities. A
router indicates the optional capabilities that it supports in
...
... router indicates the optional capabilities that it supports in
its OSPF Hello packets, Database Description packets and in its
LSAs ...
...
The OSPF optional capabilities defined in this memo are listed
below. See Section A.2 for more information.
...
... LSAs will not be flooded into stub areas.
This capability is represented by the E-bit in the OSPF
Options field (see Section A.2). In order to ensure
...
...
The OSPF protocol is described herein in terms of its operation on
various protocol data structures. The following list comprises the
...
... data structures. The following list comprises the
top-level OSPF data structures. Any initialization that needs to be
...
... data structures. Any initialization that needs to be
done is noted. OSPF areas, interfaces and neighbors also have
...
... router's OSPF Router ID is changed, the router's OSPF software
should be restarted before the new Router ID takes effect. In
...
... data structure. This data structure describes the working
of the basic OSPF algorithm. Remember that each area runs a
separate copy of the basic OSPF ...
... Backbone (area) structure
The OSPF backbone area is responsible for the dissemination of
inter-area ...
... configuration information, or through a combination of the two
(e.g., dynamic external information to be advertised by OSPF
with configured metric). Any router having these external routes
...
... The area data structure contains all the information used to run the
basic OSPF routing algorithm. Each area maintains its own link-state
...
... The OSPF backbone is the special OSPF area responsible for
disseminating inter-area routing information ...
...
Unless otherwise specified, the remaining sections of this document
refer to the operation of the OSPF protocol within a single area.
...
... routers' link-state databases to stay synchronized. OSPF
simplifies this by requiring only adjacent routers to remain
...
...
This section discusses the general processing of OSPF routing
protocol packets. It is very important that the router link-state
...
... router sends a routing protocol packet, it fills in the
fields of the standard OSPF packet header as follows. For more
details on the header format ...
...
Packet length
The length of the entire OSPF packet in bytes, including the
standard OSPF packet header ...
... bit one's complement checksum of the
entire OSPF packet, excluding the 64-bit authentication
...
... checksum is calculated as part of the
appropriate authentication procedure; for some OSPF
authentication types, the checksum calculation ...
... network types (including virtual links), the majority of
OSPF packets are sent as unicasts, i.e., sent directly to the
other end of the adjacency. In this case, the IP ...
...
For more information on the format of specific OSPF packet
types, consult the sections listed in Table 10.
...
... Link state ack Section 13.5
Table 10: Sections describing OSPF protocol packet transmission.
...
... consider the Router RT11 depicted in Figure 6. If RT11 receives
an OSPF protocol packet on its interface to Network N8, it may
...
... In order for the packet to be accepted at the IP level, it must
pass a number of tests, even before the packet is passed to OSPF
for processing:
...
... The IP protocol specified must be OSPF (89).
...
... Locally originated packets should not be passed on to OSPF.
That is, the source IP address should be examined to make
...
... The Area ID found in the OSPF header must be verified. If
both of the following cases fail, the packet should be
...
... authentication procedure may also
verify the checksum field in the OSPF packet header (which,
when used, is set to the standard IP ...
... bit one's complement
checksum of the OSPF packet's contents after excluding the
64-bit authentication ...
... Link state ack Section 13.7
Table 11: Sections describing OSPF protocol packet reception.
...
...
An OSPF interface can be considered to belong to the area that
contains the attached network ...
... subnet.
Authentication types are defined in Appendix D. All OSPF packet
exchanges are authenticated. Different authentication ...
... This configured data allows the authentication procedure to
generate and/or verify OSPF protocol packets. The
Authentication key can be configured on a per-interface ...
... verification
of message digests which are appended to the OSPF protocol
packets. When Cryptographic authentication is used, multiple
...
... events are pictured as the labelled arcs in Figure 11. The
label definitions are listed below. For a detailed explanation
of the effect of these events on OSPF protocol operation,
consult Section 9.3.
...
... Options field describes the router's optional
OSPF capabilities. One optional capability is defined in this
specification (see Sections 4.5 and A.2). The E-bit of the
...
...
An OSPF router converses with its neighboring routers. Each
separate conversation is described by a "neighbor ...
... neighbor data structure".
Each conversation is bound to a particular OSPF router interface,
and is identified either by the neighboring router ...
... interface,
and is identified either by the neighboring router's OSPF Router ID
or by its Neighbor IP address ...
... or by its Neighbor IP address (see below). Thus if the OSPF router
and another router have multiple attached networks ...
... Neighbor Options
The optional OSPF capabilities supported by the neighbor.
Learned during the Database ...
... Database Exchange process (see Section 10.6).
The neighbor's optional OSPF capabilities are also listed in its
Hello packets. This enables received Hello Packets to be
rejected (i.e., neighbor ...
... neighbor relationships will not even start to
form) if there is a mismatch in certain crucial OSPF
capabilities (see Section 10.5). The optional OSPF capabilities
...
... form) if there is a mismatch in certain crucial OSPF
capabilities (see Section 10.5). The optional OSPF capabilities
are documented in Section 4.5.
...
... This section explains the detailed processing of a received
Hello Packet. (See Section A.3.2 for the format of Hello
packets.) The generic input processing of OSPF packets will
have checked the validity of the IP header ...
... have checked the validity of the IP header and the OSPF packet
header. Next, the values of the Network ...
... The receiving interface attaches to a single OSPF area (this
could be the backbone). The setting of the E-bit ...
... the source is identified by the Router ID found in the Hello's
OSPF packet header. The interface's current list of neighbors ...
... Neighbor ID equal to the Router ID found in the
packet's OSPF header. For these network types, the neighbor ...
... o If the packet's Options field indicates a different set
of optional OSPF capabilities than were previously
received from the neighbor (recorded in the Neighbor ...
... the packet's Options field should match the set of optional
OSPF capabilities previously indicated by the neighbor
(stored in the neighbor ...
...
The router's optional OSPF capabilities (see Section 4.5) are
transmitted to the neighbor in the Options field ...
... provides the next hop towards the packet's destination. OSPF also
provides for the existence of a default route (Destination ...
... destination is a router this field indicates the
optional OSPF capabilities supported by the destination router.
...
...
The set of paths to use for a destination may vary based on the OSPF
area to which the paths belong. This means that there may be
multiple routing table ...
... Inter-area paths are paths to
destinations in other OSPF areas. These are discovered through
the examination of received summary-LSAs. AS ...
... LSA. The Link State Origin field
is not used by the OSPF protocol, but it is used by the routing
table calculation in OSPF's Multicast routing ...
... is not used by the OSPF protocol, but it is used by the routing
table calculation in OSPF's Multicast routing extensions
(MOSPF ...
...
When an IP data packet is received, an OSPF router finds the
routing table entry that best matches the packet's destination ...
...
Consider the Autonomous System pictured in Figure 2. No OSPF
areas have been configured. A single metric is shown per
outbound interface ...
...
Consider the previous example, this time split into OSPF areas.
An OSPF area configuration is pictured in Figure 6. Router ...
... Consider the previous example, this time split into OSPF areas.
An OSPF area configuration is pictured in Figure 6. Router
RT4's routing table ...
... header indicates which optional
capabilities are associated with the LSA. OSPF's optional
capabilities are described in Section 4.5. One optional
capability is defined by this specification, represented by
...
...
An implementation of OSPF must be able to access individual
pieces of an area database. This lookup function ...
... OSPF LSAs is specified in Table 17. That table relates
the OSPF encoding to the IP packet header ...
... actively attached to two or more areas, even if the router
is not currently attached to the OSPF backbone area. Bit E
...
... link descriptions added to the router-LSA
depend on the OSPF interface type. Link descriptions
...
... routers that are fully adjacent to the Designated
Router; each fully adjacent router is identified by its OSPF
Router ID. The Designated Router includes itself in this
list.
...
... The algorithm in Section 12.4.3 is optional when Area A
is an OSPF stub area. Area border routers connecting to
a stub area can originate summary-LSAs ...
... the external destination should be forwarded to the
advertising OSPF router (RT7). This is not always
desirable. Consider the example pictured in Figure
16. There are three OSPF routers ...
... OSPF router (RT7). This is not always
desirable. Consider the example pictured in Figure
16. There are three OSPF routers (RTA, RTB and RTC)
connected to a common network. Only one of these
...
... routers, RTA, is exchanging BGP information with the
non-OSPF router RTX. RTA must then originate AS-
external-LSAs ...
... LSA
originated by the router having the highest OSPF
Router ID is used. The router having the lower OSPF
Router ID can then flush its LSA ...
... router having the highest OSPF
Router ID is used. The router having the lower OSPF
Router ID can then flush its LSA. Flushing an LSA
...
... flooding or a newly self-originated LSA, may cause the OSPF
routing table structure to be recalculated. The contents of the
...
... router goes down, retransmissions may occur until
the adjacency is destroyed by OSPF's Hello Protocol. When the
adjacency is destroyed, the Link state ...
... neighbor's IP address. These are used when sending OSPF
protocol packets over the virtual link. Note that when one (or
both) of the virtual link endpoints ...
... Link ID is set to the
virtual neighbor's OSPF Router ID and whose Link Data is set to
the virtual interface ...
...
This section details the OSPF routing table calculation. Using its
attached areas' link state ...
...
The OSPF routing table's organization is explained in Section 11.
Two examples of the routing table ...
... Changes made to routing table entries as a result of these
calculations can cause the OSPF protocol to take further actions.
For example, a change to an intra-area route ...
... area
border router to originate new summary-LSAs (see Section 12.4). See
Section 16.7 for a complete list of the OSPF protocol actions
resulting from routing table changes.
...
... router
vertices the Vertex ID is the router's OSPF Router ID. For
network vertices, it is the IP address ...
... consistent with the tie-breakers that were introduced in the
modified Dijkstra algorithm used by OSPF's Multicast routing
extensions (MOSPF ...
... router.
The outgoing interface in this case is simply the OSPF
interface connecting to the destination ...
... cost; when there are multiple least cost routing table
entries the entry whose associated area has the largest OSPF
Area ID (when considered as an unsigned 32-bit ...
...
Changes to routing table entries sometimes cause the OSPF area
border routers to take additional actions. These routers need
...
...
The OSPF protocol maintains multiple equal-cost routes to all
destinations. This can be seen in the steps used above to
...
... There is no requirement that a router running OSPF keep track of
all possible equal-cost routes to a destination. An
...
... address space of IP networks and the address space of OSPF
Router IDs may overlap. That is, a network may have an IP address
...
... assumption. Such subnet mask configurations cannot be handled by the
OSPF protocol.
...
... deSouza, O., and M. Rodrigues, "Guidelines for Running OSPF Over Frame Relay Networks", RFC 1586 ...
... OSPF data formats ...
...
This appendix describes the format of OSPF protocol packets and OSPF
LSAs. The OSPF protocol ...
... layer.
Before any data formats are described, the details of the OSPF
encapsulation are explained.
...
...
Next the OSPF Options field is described. This field describes
various capabilities that may or may not be supported by pieces of
...
... Options field is described. This field describes
various capabilities that may or may not be supported by pieces of
the OSPF routing domain. The OSPF ...
... OSPF routing domain. The OSPF Options field is contained in OSPF
Hello packets, Database Description ...
... domain. The OSPF Options field is contained in OSPF
Hello packets, Database Description packets and in OSPF LSAs ...
... Options field is contained in OSPF
Hello packets, Database Description packets and in OSPF LSAs.
...
... OSPF packet formats are detailed in Section A.3. A description of
OSPF LSAs appears in Section A.4.
...
... A.1 Encapsulation of OSPF packets ...
... Internet Protocol's network layer. OSPF
packets are therefore encapsulated solely by IP and local data-link ...
... the network MTU. If necessary, the length of OSPF packets can be up
to 65,535 bytes (including the IP header). The OSPF packet ...
... OSPF packets can be up
to 65,535 bytes (including the IP header). The OSPF packet types
that are likely to be large (Database Description Packets, Link
State ...
... fragmentation should be avoided whenever possible. Using this
reasoning, an attempt should be made to limit the sizes of OSPF
packets sent over virtual links to 576 bytes unless Path MTU
Discovery is being performed (see [Ref22 ...
...
The other important features of OSPF's IP encapsulation are:
...
... multicast address has been assigned the value
224.0.0.5. All routers running OSPF should be prepared to
receive packets sent to this address. Hello packets are
...
... address. Hello packets are
always sent to this destination. Also, certain OSPF
protocol packets are sent to this address during the
flooding ...
... Designated
Router must be prepared to receive packets destined to this
address. Certain OSPF protocol packets are sent to this
address during the flooding ...
... flooding procedure.
o OSPF is IP protocol number 89. This number has been registered
with the Network ...
... Routing protocol packets are sent with IP precedence set to
Internetwork Control. OSPF protocol packets should be given
precedence over regular IP data traffic ...
... The OSPF Options field is present in OSPF Hello packets, Database
Description packets and all LSAs. The Options field ...
... Database
Description packets and all LSAs. The Options field enables OSPF
routers to support (or not support) optional capabilities, and to
communicate their capability level to other OSPF routers. Through
...
... Options field enables OSPF
routers to support (or not support) optional capabilities, and to
communicate their capability level to other OSPF routers. Through
this mechanism routers of differing capabilities can be mixed within
...
... this mechanism routers of differing capabilities can be mixed within
an OSPF routing domain.
...
... A.3 OSPF Packet Formats ...
...
There are five distinct OSPF packet types. All OSPF packet types
begin with a standard 24 byte header ...
...
There are five distinct OSPF packet types. All OSPF packet types
begin with a standard 24 byte header. This header ...
...
All OSPF packet types (other than the OSPF Hello packets) deal with
lists of LSAs. For example, Link State ...
... routing domain. Because of
this, OSPF protocol packets cannot be parsed unless the format of
LSAs is also understood. The format of LSAs ...
...
The receive processing of OSPF packets is detailed in Section 8.2.
The sending of OSPF packets is explained in Section 8.1.
...
... The receive processing of OSPF packets is detailed in Section 8.2.
The sending of OSPF packets is explained in Section 8.1.
...
... A.3.1 The OSPF packet header ...
...
Type
The OSPF packet types are as follows. See Sections A.3.2 through
A.3.6 for details.
...
...
Packet length
The length of the OSPF protocol packet in bytes. This length
includes the standard OSPF header ...
... The length of the OSPF protocol packet in bytes. This length
includes the standard OSPF header.
...
... A 32 bit number identifying the area that this packet belongs
to. All OSPF packets are associated with a single area. Most
travel a single hop only. Packets travelling over a virtual
link ...
... IP checksum of the entire contents of the packet,
starting with the OSPF packet header but excluding the 64-bit
...
...
Hello packets are OSPF packet type 1. These packets are sent
periodically on all interfaces (including virtual links ...
...
Database Description packets are OSPF packet type 2. These packets
are exchanged when an adjacency is being initialized. They describe
the contents of the link-state ...
...
Link State Request packets are OSPF packet type 3. After exchanging
Database Description packets with a neighboring router ...
... Link State Update packets are OSPF packet type 4. These packets
implement the flooding of LSAs ...
... LSAs may also be originated (see Section 12.4). All LSAs are
then flooded throughout the OSPF routing domain. The flooding ...
... LSAs, the Link State ID field is set to the router's OSPF
Router ID. Router-LSAs are flooded throughout a single area only.
...
... backward compatibility with previous versions of the OSPF
specification ([Ref9]). Within each link ...
... Link State ID field is the AS boundary router's OSPF Router
ID. (To see why it is necessary to advertise the location of each
ASBR ...
... backward compatibility with previous versions of the OSPF
specification ([Ref9]). For each desired TOS ...
... 32-bit field attached to each external route. This is not
used by the OSPF protocol itself. It may be used to communicate
information between AS boundary routers ...
... backward compatibility with previous versions of the OSPF
specification ([Ref9]). For each desired TOS ...
...
Several OSPF protocol parameters have fixed architectural values.
These parameters have been referred to in the text by names such as
LSRefreshTime. The same naming convention is used for the
...
...
The OSPF protocol has quite a few configurable parameters. These
parameters are listed below. They are grouped into general
...
...
In general, a separate copy of the OSPF protocol is run for each
area. Because of this, most configuration parameters are
...
... OSPF Router ID is
changed, the router's OSPF software should be restarted
before the new Router ID takes effect. Before restarting ...
...
In order to minimize the chance of routing loops, all OSPF
routers in an OSPF routing domain ...
... In order to minimize the chance of routing loops, all OSPF
routers in an OSPF routing domain should have
...
... IP subnetted network is to be its
own OSPF area. The area would be configured as a single
address range, whose IP address ...
... network. The
smaller the HelloInterval, the faster topological changes
will be detected; however, more OSPF routing protocol
traffic will ensue. Sample value for a X.25 ...
... This configured data allows the authentication procedure to
verify OSPF protocol packets received over the interface.
For example, if the AuType ...
... password.
Authentication keys associated with the other OSPF
authentication types are discussed in Appendix D.
...
... address is used as the IP source in
OSPF protocol packets it sends along the virtual link, and is
set dynamically during the routing table ...
... All OSPF protocol exchanges are authenticated. The OSPF packet
header (see Section A.3.1) includes an authentication ...
... 64-bit
authentication field in the OSPF header can contain anything; it
is not examined on packet reception. When employing Null
authentication ...
... header can contain anything; it
is not examined on packet reception. When employing Null
authentication, the entire contents of each OSPF packet (other
than the 64-bit authentication ...
... network basis. All packets sent on a particular network
must have this configured value in their OSPF header 64-bit
...
... authentication field. This essentially serves as a "clear" 64-
bit password. In addition, the entire contents of each OSPF
packet (other than the 64-bit authentication field) are
...
... network/subnet.
For each OSPF protocol packet, the key is used to
generate/verify a "message digest" that is appended to the end
...
... generate/verify a "message digest" that is appended to the end
of the OSPF packet. The message digest is a one-way function of
...
... message digest is a one-way function of
the OSPF protocol packet and the secret key. Since the secret
key is never sent over the network ...
... are specified implicitly by the secret key. This specification
completely defines the use of OSPF Cryptographic authentication
when the MD5 ...
... In addition, a non-decreasing sequence number is included in
each OSPF protocol packet to protect against replay attacks.
This provides long term protection; however, it is still
...
... replay attacks.
This provides long term protection; however, it is still
possible to replay an OSPF packet until the sequence number
changes. To implement this feature, each neighbor ...
... Figure 18: Usage of the Authentication field
in the OSPF packet header when Cryptographic
Authentication is employed
...
... neighbor's state transitions to "Down". Whenever an
OSPF packet is accepted as authentic, the cryptographic sequence
number is set to the received packet's sequence number ...
... neighbors
will reject the router's OSPF packets for a period of
RouterDeadInterval, and then the router will be forced to
...
... 64-bit
Authentication field in the standard OSPF packet header is
redefined as shown in Figure 18. The new field definitions ...
... create the message digest appended to the OSPF packet. Key
Identifiers are unique per-interface ...
...
The message digest appended to the OSPF packet is not actually
considered part of the OSPF protocol packet: the message digest ...
... message digest appended to the OSPF packet is not actually
considered part of the OSPF protocol packet: the message digest
is not included in the OSPF ...
... OSPF protocol packet: the message digest
is not included in the OSPF header's packet length, although it
is included in the packet's IP header length ...
...
After building the contents of an OSPF packet, the
authentication procedure indicated by the sending interface ...
... Autype value is called before the packet is sent. The
authentication procedure modifies the OSPF packet as follows.
...
... IP checksum of the entire contents of the
packet, starting with the OSPF packet header but
excluding the 64-bit ...
... IP checksum of the entire contents of the
packet, starting with the OSPF packet header but
excluding the 64-bit ...
...
(2) The checksum field in the standard OSPF header is not
calculated, but is instead set to 0.
...
... Auth Data Len field is set to the length in bytes of
the message digest that will be appended to the OSPF
packet. When using MD5 as the authentication algorithm,
...
... (6) The message digest is then calculated and appended to
the OSPF packet. The authentication algorithm to be
used in calculating the digest is indicated by the key
...
... itself. Input to the authentication algorithm consists
of the OSPF packet and the secret key. When using MD5 as
...
... (a) The 16 byte MD5 key is appended to the OSPF packet.
(b) Trailing pad and length fields are added, as
...
... algorithm is run over the
concatenation of the OSPF packet, secret key, pad
and length fields, producing a 16 byte ...
...
(d) The MD5 digest is written over the OSPF key (i.e.,
appended to the original OSPF packet). The digest is
...
... MD5 digest is written over the OSPF key (i.e.,
appended to the original OSPF packet). The digest is
not counted in the OSPF packet's length field, but
...
... appended to the original OSPF packet). The digest is
not counted in the OSPF packet's length field, but
is included in the packet's IP ...
... authentication procedure is indicated by
the setting of Autype in the standard OSPF packet header, which
matches the setting of Autype ...
...
If an OSPF protocol packet is accepted as authentic, processing
of the packet continues as specified in Section 8.2. Packets
which fail authentication ...
... Null authentication, the checksum field in the
OSPF header must be verified. It must be set to the 16-bit
...
...
When using Simple password authentication, the received OSPF
packet is authenticated as follows:
...
...
When using Cryptographic authentication, the received OSPF
packet is authenticated as follows:
...
... receiving interface's configured key having
Key ID equal to that specified in the received OSPF
packet (see Figure 18). If the key is not found, or if
the key is not valid for reception (i.e., current time <
...
... valid for reception (i.e., current time <
KeyStartAccept or current time >= KeyStopAccept), the
OSPF packet is discarded.
(2) If the cryptographic ...
... (2) If the cryptographic sequence number found in the OSPF
header (see Figure 18) is less than the cryptographic ...
... sequence number recorded in the sending neighbor's data
structure, the OSPF packet is discarded.
(3) Verify the appended message digest ...
...
(c) The calculated and received digests are compared. If
they do not match, the OSPF packet is discarded. If
they do match, the OSPF protocol packet is accepted
...
... they do not match, the OSPF packet is discarded. If
they do match, the OSPF protocol packet is accepted
as authentic, and the "cryptographic sequence
number ...
... Link State ID whenever
possible; this maximizes interoperability with OSPF implementations
predating RFC 1583(-> 2178(-> 2328std54)).
...
... link-state protocol (see
[Ref26]). OSPF guards against this problem in two ways: a) the
LS age field is used like a TTL field in flooding ...
... All OSPF protocol exchanges are authenticated. OSPF supports
multiple types of authentication; the type of authentication ...
... can be configured on a per network segment basis. One of OSPF's
authentication types, namely the Cryptographic authentication ...
... Cryptographic authentication option, each router appends a "message
digest" to its transmitted OSPF packets. Receivers then use the
shared secret key ...
... shared secret key and received digest to verify that each received
OSPF packet is authentic.
...
... correct implementation of the security mechanism in all
communicating OSPF implementations. It also requires that all
parties maintain the secrecy of the shared secret key.
...