cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4952
Views
5
Helpful
13
Replies

Query regarding OSPF Layer

There is a common understanding that OSPF operates at Layer 3. However, as per wikipedia, it operates at Link Layer i.e., Layer 2. 

OSPF multicast IP packets never traverse IP routers (never traverse Broadcast Domains), they never travel more than one hop. OSPF is therefore a link layer protocol "

https://en.wikipedia.org/wiki/Open_Shortest_Path_First

To verify this, I have tried to capture the OSPF packets sitting in Layer 2 environment and it worked. Wireshark Traces has been attached.

I have connected 2 routers from a switch and my PC in GNS3. Both were in different segment. I have enabled OSPF on both the routers. By that I was getting the OSPF packets. Where as any L3 protocols Like ICMP were did not captured.

Finally, my question is, where exactly OSPF works? Is Wikipedia is right?

1 Accepted Solution

Accepted Solutions

Peter Paluch
Cisco Employee
Cisco Employee

Dear friends,

Please allow me to join.

I have found several threads where we have extensively discussed the principle by which protocols can be unambiguously classified into OSI or TCP/IP layers:

https://supportforums.cisco.com/discussion/12114921/eigrp-ospf-layer-3-or-4

https://supportforums.cisco.com/discussion/11875956/hsrp-layer-2-or-layer-3-protocol

https://supportforums.cisco.com/discussion/11381171/what-layer-2-and-layer-3-protocols

https://supportforums.cisco.com/discussion/11368931/why-we-say-bgp-application-layer-protocol

https://supportforums.cisco.com/discussion/11013256/could-someone-explain-which-routing-protocolsripeigrpospfbgp-work-which-osi

I personally dislike the often-stated rule that "if a protocol X inserts its messages into datagrams of Layer N then it belongs itself into Layer N+1". Just recently, I have tried to reason with a student of mine about this very issue, pointing out that, for example, STP inserts its BPDUs into Ethernet frames but we would never consider STP to be a Layer3 protocol as it has nothing to do with end-to-end communication, routing and addressing between end hosts.

Instead, I personally propose classifying protocols into layers by the services they provide, because a protocol is an embodiment, an implementation of (a subset of) the services abstractly described by the specification of a particular layer. Every layer has a purpose, a set of functions and services it is responsible for, and a protocol can be classified into a layer by carefully looking at the services the protocol itself is providing, and matching them against the services provided by individual layers. Because OSPF, just like EIGRP, RIP, ISIS and BGP, provides vital control information for the operation of the Network layer in OSI terms and Internet layer in TCP/IP terms, it belongs to these layers.

It should be said that neither the OSI nor the TCP/IP model cope well with control plane protocols. Control plane protocols are practically always implemented as a software application, yet they assist different lower layers to perform their tasks. This breaks the strict layering and causes the very confusion we're now trying to clear. The only reference model that acknowledged the fact that control plane protocols do not really observe strict layering rules was the ATM reference model that defined planes pervading all layers of the model.

http://docwiki.cisco.com/wiki/Asynchronous_Transfer_Mode_Switching#ATM_Reference_Model

This being said, I strongly disagree with the Wikipedia article that places OSPF into Link Layer of whatever model (OSI or TCP/IP). In my view, OSPF is a part of Network layer (OSI terminology) or Internet layer (TCP/IP terminology), implementing the control plane functions these layers depend on.

Best regards,
Peter

View solution in original post

13 Replies 13

e.ciollaro
Level 4
Level 4

In my understanding OSPF operates at layer 3 if we mean the layer the OSPF is interested in layer 3, it is intended to rule layer 3. The reason why it doesn't travel more then one hop is because it uses link local multicast address not because it is not routable.

May be, in some sense, it also possible to say that it is a layer 4 protocol (or an application protocol)  meaning that it encapsulated over a layer 3 packet.

Bye,

enrico

I agree. And I was also believed this only. But when I captured using Wireshark in a Layer 2 environment, I am able to see OSPF packets. That is what Wikipedia is trying to say. Then, is Wikipedia is right? or its a contradiction?

All OSPF packet's TTL is 1 whatever it is hello packet or LSA exchange packet. Hello packet use multicast address 225.0.0.5/6 to discovery neighbor and keep track of them. However LSA exchange use unicast IP to exchange LSA update.

OSPF working as routing protocol, its primary and only task is to build routing table independently. In other words, OSPF can generate routing table without any help of any other routing protocol. This means OSPF must work on the local link. If OSPF can traverse beyond the local link, OSPF need the routing table to help routing OSPF packet. This is totally not acceptable.

It is an interesting approach to say that since OSPF packets are not forwarded that OSPF is a link layer protocol. But I believe that this is fundamentally not the correct analysis of the layer for OSPF. Its function is to contribute to IP routing which is clearly a layer 3 function. And there is an IP protocol number allocated for OSPF. If it were a layer 2 protocol there would be no need for an IP protocol number.

I believe that there are valid arguments that OSPF operates at a layer higher than layer 3 and that it legitimately can be treated as an application layer process.

HTH

Rick

HTH

Rick

Thank Richard very much for the comments.

It is no doubt that OSPF works on top of IP layer as its IP protocol type 89. But all OSPF packets are limited to only local link as its TTL=1. When LSA update need flooding to the whole area, LSA update are advertised to directly connected neighbor. After the directly connected neighbors receive the LSA update, they extract the LSA and repacket the LSA, then advertised to their directly neighbors until all the OSPF routers in this area get this LSA update.

You seem to agree with my point that OSPF has an IP protocol number of 89 and therefore works on top of IP layer. Which means it is at least layer 3 or probably higher and not layer 2 as the original post asks. You then have a good explanation of the flooding process. But I am not clear what, if anything, that says about the layer that OSPF operates at.

HTH

Rick

HTH

Rick

Yes, I totally disagree with OSPF working on data link layer.

Joseph W. Doherty
Hall of Fame
Hall of Fame

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages wha2tsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

I would disagree with that Wiki statement.

As routing protocol, OSPF isn't logically part of OSI layer model.  I recall if you read the ISO documents, you'll find they treat routing protocols as outside the 7 layer OSI model.

If OSPF was L2, then it wouldn't work across a GRE tunnel, correct?

Consider, what "layer" is static routing?  It configures L3, but what is it itself?

Consider BGP, it uses TCP, a L4 protocol, but it too configures L3.  So what layer is it?

If you consider a routing protocol an application between L3 devices, then you might consider routing protocols as L7.

Peter Paluch
Cisco Employee
Cisco Employee

Dear friends,

Please allow me to join.

I have found several threads where we have extensively discussed the principle by which protocols can be unambiguously classified into OSI or TCP/IP layers:

https://supportforums.cisco.com/discussion/12114921/eigrp-ospf-layer-3-or-4

https://supportforums.cisco.com/discussion/11875956/hsrp-layer-2-or-layer-3-protocol

https://supportforums.cisco.com/discussion/11381171/what-layer-2-and-layer-3-protocols

https://supportforums.cisco.com/discussion/11368931/why-we-say-bgp-application-layer-protocol

https://supportforums.cisco.com/discussion/11013256/could-someone-explain-which-routing-protocolsripeigrpospfbgp-work-which-osi

I personally dislike the often-stated rule that "if a protocol X inserts its messages into datagrams of Layer N then it belongs itself into Layer N+1". Just recently, I have tried to reason with a student of mine about this very issue, pointing out that, for example, STP inserts its BPDUs into Ethernet frames but we would never consider STP to be a Layer3 protocol as it has nothing to do with end-to-end communication, routing and addressing between end hosts.

Instead, I personally propose classifying protocols into layers by the services they provide, because a protocol is an embodiment, an implementation of (a subset of) the services abstractly described by the specification of a particular layer. Every layer has a purpose, a set of functions and services it is responsible for, and a protocol can be classified into a layer by carefully looking at the services the protocol itself is providing, and matching them against the services provided by individual layers. Because OSPF, just like EIGRP, RIP, ISIS and BGP, provides vital control information for the operation of the Network layer in OSI terms and Internet layer in TCP/IP terms, it belongs to these layers.

It should be said that neither the OSI nor the TCP/IP model cope well with control plane protocols. Control plane protocols are practically always implemented as a software application, yet they assist different lower layers to perform their tasks. This breaks the strict layering and causes the very confusion we're now trying to clear. The only reference model that acknowledged the fact that control plane protocols do not really observe strict layering rules was the ATM reference model that defined planes pervading all layers of the model.

http://docwiki.cisco.com/wiki/Asynchronous_Transfer_Mode_Switching#ATM_Reference_Model

This being said, I strongly disagree with the Wikipedia article that places OSPF into Link Layer of whatever model (OSI or TCP/IP). In my view, OSPF is a part of Network layer (OSI terminology) or Internet layer (TCP/IP terminology), implementing the control plane functions these layers depend on.

Best regards,
Peter

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages wha2tsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Please allow me to join.

No - stay away - shoo.  (Laugh)

Seriously, Peter, thanks for jumping in.

Your compilation of other support forum links on this subject - very nice!

I think at one time, in a similar subject thread, I posted the ISO reference document, that distinguished routing protocols from their model.  If I did once post such, I don't think it's in the set you've listed.  (Such might be another document, besides your ATM reference link, that makes clear routing protocols don't fall directly into the OSI model.)

This evening, returning from work, I thought of another interesting consideration.  Peter's posting got me to think of a couple more.

Let's consider a topology running both OSPF and EIGRP covering all the same links/networks.  I.e. effectively, both protocols have the same identical topology.

On Cisco platforms, by default, EIGRP has a better AD metric than EIGRP, so each L3 device's route table would be populated by EIGRP.  In such a case, OSPF wouldn't have any bearing on the network's actual L3 operation.  Yet, OSPF is still running on all the L3 devices, it "knows" the topology and will keep itself sync'ed with the current topology.

What I just described, isn't much different from Packet Design's Route Explorer, which taps into OSPF's LSAs.  We don't, or a least I don't, say Route Explorer is a L2, or L3 protocol.

Or, somewhat along the same line, we might run MTRG, monitoring every interface.  It uses SNMP to query different devices, but do we say that MTRG is a L2 or L3 protocol?

Everyone might agree Route Explorer and MTRG are network applications.  Routing protocols, like OSPF, to me, are also network applications, they, however, are applications that support L3, but they are not L3.

Consider NTP.  It's a network application that runs across the network, that works to insure the local system clock is accurate, but it's not the clock.

The reason I mentioned NTP because it dynamically keeps the clock accurate, but the clock continues to function, without it.  It can also be manually set.

Likewise, a routing protocol like OSPF can dynamically keep L3 information accurate, but routing can function without it.  Routing information can also be manually set.

Finally, consider Cisco's PfR.  It can share information from multiple routers, it dynamically injects and/or remove routes, it can make decisions based on link loading, latency, packet loss, QoS policies, etc.  Do we call this a network application or a L3 or L4 protocol?

I very, very seldom disagree with Peter, and when I do he often nicely shows me the error of my ways (and maybe he will here too - hehe), but I believe routing protocols are best understood as network applications that dynamically provide information to L3.  For communication, routing protocols use whatever other layers they believe they need, just as do other network applications, where one might chose UDP to communicate and another TCP.

Rolf Fischer
Level 9
Level 9

Hello,

you already got a lot of excellent anwers, I'd just like to add some thoughts.

OSPF multicast IP packets never traverse IP routers (never traverse Broadcast Domains), they never travel more than one hop. OSPF is therefore a link layer protocol.

I think the last sentence (in red) is just infelicitous wording and should be revised. IP Multicast Packets belonging to the Local Network Control Block (224.0.0.x) are always link local - this is their scope by definition but that doesn't make them link layer protocols.

As already stated elaborately in the other posts, you need to distinguish between the service a control protocol provides on the one hand and the encapsulation it uses to do that on the other. I'd also like to add a link to another thread about some of the pros and cons of using a particular layer for encapsulation: https://supportforums.cisco.com/discussion/10686071/osi-layer-routing-protocol

Some additional thoughts against the argumentation in the wikipedia article:

  • Can you run OSPF on non-IP interfaces (like IS-IS)? - No!
  • OSPF control traffic is not always link-local, have a look at the attached Hello Packet captured on a Virtual Link (especially Source/Destination and TTL in the IP header!).

HTH
Rolf

Ah, Rolf referenced the thread where I posted links to the ISO documents I was referencing.

Thanks.

Thanks all for your answers. It helped me a lot.

Review Cisco Networking products for a $25 gift card