ospf

Overview ¶

Package ospf decodes OSPFv2 packets per RFC 2328. OSPFv3 (RFC 5340) uses a different header layout and is not covered here.

Wrap-vs-native judgement

Native. RFC 2328 is fully public; OSPFv2 wire format is
a tight 24-byte common header followed by per-type bodies
that are themselves bit-packed binary fields. No crypto
at the parse layer (Authentication field is surfaced as
hex; cryptographic verification belongs to a separate
Spec). Operators paste OSPF packet bytes (IP protocol
number 89, multicast to 224.0.0.5 / 224.0.0.6) from a
`tcpdump -X proto 89` line, a Wireshark Follow-IP-Stream
view, a Quagga / FRR / GoBGP / BIRD debug log, or any
OSPF-speaking router's tcpdump and get the documented
header + per-type body breakdown.

What this package covers

• **24-byte common header** (RFC 2328 §A.3.1):

• Version (1 byte; 2 for OSPFv2)

• **Type** (1 byte) with **5-entry name table**:

• 1 Hello

• 2 Database Description (DBD)

• 3 Link State Request (LSR)

• 4 Link State Update (LSU)

• 5 Link State Acknowledgment (LSAck)

• Packet Length (uint16 BE)

• Router ID (4 bytes; IPv4-formatted)

• Area ID (4 bytes; IPv4-formatted, where 0.0.0.0 is the backbone area)

• Checksum (uint16 BE; surfaced as hex)

• **AuType** (uint16 BE) with **3-entry name table**:

• 0 Null (no authentication)

• 1 Simple Password (cleartext password in the Authentication field)

• 2 Cryptographic Authentication (MD5; the Auth field carries metadata, the MD5 digest follows the packet)

• Authentication (8 bytes; opaque per AuType)

• **Hello body** (RFC 2328 §A.3.2):

• Network Mask (4 bytes IPv4)

• HelloInterval (uint16 BE seconds)

• **Options** (1 byte) with bit-name decoding (E / MC / NP / EA / DC / O)

• Rtr Pri (1 byte; designated-router election priority)

• RouterDeadInterval (uint32 BE seconds)

• Designated Router (4 bytes IPv4)

• Backup Designated Router (4 bytes IPv4)

• List of Neighbors (4 bytes IPv4 each, until end of packet)

• **Database Description body** (RFC 2328 §A.3.3):

• Interface MTU (uint16 BE)

• Options (1 byte; same bits as Hello)

• I (Init), M (More), MS (Master/Slave) flag byte

• DD Sequence Number (uint32 BE)

• List of LSA Headers (20 bytes each)

• **Link State Request body** (RFC 2328 §A.3.4):

• List of LSA-request entries (12 bytes each: LS Type uint32 BE + Link State ID 4 bytes + Advertising Router 4 bytes)

• **Link State Update body** (RFC 2328 §A.3.5):

• Number of LSAs (uint32 BE)

• LSAs follow (each starts with a 20-byte LSA Header; we surface header info + remaining body as hex)

• **Link State Acknowledgment body** (RFC 2328 §A.3.6):

• List of LSA Headers (20 bytes each)

• **LSA Header** (20 bytes, used by DBD / LSU / LSAck):

• LS Age (uint16 BE seconds since origination)

• Options (1 byte)

• **LS Type** (1 byte) with **9-entry name table**:

• 1 Router LSA

• 2 Network LSA

• 3 Summary LSA (network)

• 4 Summary LSA (ASBR)

• 5 AS-External LSA

• 7 NSSA External LSA (RFC 3101)

• 9 Link-Local Opaque (RFC 5250)

• 10 Area-Local Opaque

• 11 AS-wide Opaque

• Link State ID (4 bytes IPv4)

• Advertising Router (4 bytes IPv4)

• LS Sequence Number (int32 BE; signed, starts at 0x80000001 and increments)

• LS Checksum (uint16 BE; surfaced as hex)

• Length (uint16 BE; total LSA size including this 20-byte header)

What this package does NOT cover (deliberately out of scope)

• IP framing — feed the OSPF bytes after the IPv4 / IPv6 header strip. OSPFv2 runs over IP protocol 89.

• OSPFv3 (RFC 5340) — different header layout (no Auth field; uses IPsec for authentication); a future Spec.

• LSA body deep dissection — the LSA Header is decoded but Router LSA links, Network LSA attached routers, Summary LSA metric/cost, AS-External LSA forwarding address are all surfaced as raw hex past the header.

• Cryptographic verification — AuType 2 (MD5) is recognised but the digest verification belongs in a separate Spec.

• Opaque LSA TLV walking (RFC 5250) — type 9/10/11 surface the LS Type name; the opaque payload is hex.