OSPF timers, DR/BDR election, and why yours is stuck in EXSTART

Three OSPF failures account for maybe 80% of the neighbor-adjacency questions in the field and on the CCNA exam. All three show up as “the neighbor never reaches FULL.” Different show output for each. Different fix for each.

The OSPF neighbor state machine (fast recap)

DOWN → INIT → 2WAY → EXSTART → EXCHANGE → LOADING → FULL

• DOWN — no hellos received.
• INIT — first hello received but the neighbor doesn’t see us yet.
• 2WAY — both sides see each other in the hello’s neighbor list. On broadcast networks, DROTHER-to-DROTHER stays here (this is fine).
• EXSTART — master/slave negotiation for the DBD exchange. If you’re stuck here, it’s almost always MTU.
• EXCHANGE — DBD packets flowing, listing what each side has.
• LOADING — the routes each side is missing are being pulled via LSR/LSU.
• FULL — LSDBs are synchronized. Traffic can now use the routes.

Which state your show ip ospf neighbor output stops at tells you exactly what’s broken.

Problem 1: Hello / Dead timer mismatch — stuck at DOWN or INIT

Symptom. show ip ospf neighbor on one or both routers is empty. Or worse, one side sees INIT with a partial hello, and it never advances.

Cause. OSPF exchanges hellos every 10 s on broadcast networks (default). If the two routers disagree on hello or dead timers, they detect the mismatch and refuse to form. Any of these fields on both sides must match: hello interval, dead interval, area ID, subnet mask, authentication, MTU. If any differ, no adjacency.

Common way this happens:

• Someone tuned one side with ip ospf hello-interval 5 and forgot the neighbor.
• Two different network types (broadcast vs point-to-point) end up with different defaults.

Diagnose.

R1# show ip ospf interface Gi0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 10.0.0.1/30, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

R2# show ip ospf interface Gi0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 10.0.0.2/30, Area 0
  Timer intervals configured, Hello 30, Dead 120, Wait 120, Retransmit 5

R1 is at 10/40, R2 is at 30/120. That’s why the adjacency never forms.

Fix.

R2(config)# interface Gi0/0
R2(config-if)# ip ospf hello-interval 10
R2(config-if)# ip ospf dead-interval 40

Or if you’d rather tune the other side. Either way, both must match.

Problem 2: DR / BDR election picks the wrong router

Symptom. On a shared broadcast segment (multiple routers on the same VLAN), a low-end or edge router unexpectedly wins the DR election. Traffic hairpins through it or routing is slow.

Cause. DR/BDR is decided by:

1. Highest OSPF priority (default 1, range 0–255). Priority 0 = “never elect me.”
2. Tiebreaker: highest router-ID. Which is set explicitly, or picked from the highest loopback IP, or from the highest active interface IP.

If nobody manually sets priority, whoever booted first (once the network was up) tends to win. That’s usually random and rarely the right router.

Diagnose.

R1# show ip ospf neighbor
Neighbor ID   Pri   State           Dead Time   Address       Interface
2.2.2.2         1   FULL/DR         00:00:36    10.0.0.2      Gi0/0
3.3.3.3         1   FULL/BDR        00:00:35    10.0.0.3      Gi0/0
4.4.4.4         1   FULL/DROTHER    00:00:37    10.0.0.4      Gi0/0

R2 (2.2.2.2) won DR by having the highest router-ID. If R1 was supposed to be the DR (typically the highest-CPU router — the distribution or backbone one), this is wrong.

Fix.

R1(config)# interface Gi0/0
R1(config-if)# ip ospf priority 100

R4(config)# interface Gi0/0
R4(config-if)# ip ospf priority 0

Priority 100 pushes R1 above the default 1, guaranteeing DR. Priority 0 on R4 explicitly opts it out of election. DR/BDR is not re-elected until adjacencies drop — you need to clear ip ospf process on both R1 and R2 to force the re-election immediately.

Real-world note. In modern designs with only two routers on a subnet, DR/BDR still elects but is meaningless. On point-to-point links (network point-to-point on the interface), no DR/BDR is elected at all. That’s usually cleaner.

Problem 3: Stuck in EXSTART — the classic MTU mismatch

Symptom. show ip ospf neighbor shows the peer at EXSTART or EXCHANGE for minutes, then drops to DOWN, then cycles. The adjacency never reaches FULL.

Cause. In EXSTART, routers negotiate master/slave for the DBD exchange. The first DBD packet the master sends is often slightly under 1500 bytes (all its LSA summaries). If the receiving interface has a smaller MTU, the packet is dropped silently — OSPF just times out and restarts EXSTART.

The trap: one side may have MTU 1500 (default Ethernet) and the other MTU 1400 (a tunnel, GRE, IPsec, or a mistakenly configured mtu 1400 on an interface).

Diagnose.

R1# debug ip ospf adj
*Jul 15 14:22:03: OSPF: Rcv DBD from 2.2.2.2 on Gi0/0 seq 0x2011 opt 0x52 flag 0x2 len 1476  mtu 1476 state EXSTART
*Jul 15 14:22:03: OSPF: Nbr 2.2.2.2 has smaller interface MTU

R1# show ip ospf interface Gi0/0 | include MTU
  Neighbor 2.2.2.2, MTU 1476

The Neighbor has smaller MTU debug line is the smoking gun.

Fixes (pick one).

Option A — align the MTUs:

R2(config)# interface Gi0/0
R2(config-if)# ip mtu 1500

Option B — tell OSPF to ignore the mismatch (won’t fix packet loss, but forms adjacency):

R1(config-if)# ip ospf mtu-ignore
R2(config-if)# ip ospf mtu-ignore

Option B is what to do if the MTU difference is deliberate (like a tunnel underlying a GRE tunnel). Option A is the fix for a real misconfig.

Bonus: EXCHANGE stall (rare)

If the peer sits at EXCHANGE for minutes, an ACL is blocking the LSU packets carrying the actual LSAs. Check for an ACL on either interface that could deny multicast to 224.0.0.5.

Show commands you must know cold

show ip ospf neighbor              # is it FULL?
show ip ospf interface <int>       # timers, priority, DR/BDR, MTU
show ip ospf interface brief       # one-line-per-interface summary
show ip ospf database              # the LSDB (LSAs by type)
show ip ospf                       # process-level, router-ID, area count
debug ip ospf adj                  # neighbor state transitions (use sparingly)
debug ip ospf hello                # hello packets in real time

show ip ospf interface brief gives you 90% of the answer to “which of my OSPF interfaces is having a problem.” Learn this one first.

Common exam / interview traps

1. Q: Two routers on the same subnet, same area, hellos correct — no adjacency. What one command reveals the problem? A: show ip ospf interface on both, compare the timers and MTU. This is the interview question.

2. Q: What is the default OSPF hello / dead interval on a broadcast network? A: 10 / 40 s. On non-broadcast (frame-relay, NBMA): 30 / 120 s.

3. Q: On a point-to-point OSPF link, are DR/BDR elected? A: No. Only on broadcast and NBMA networks.

4. Q: Router-ID selection order? A: Explicitly-configured router-id x.x.x.x → highest loopback IP → highest active interface IP.

5. Q: What OSPF network type does ip ospf network point-to-point produce? A: Point-to-point. No DR/BDR. Fast convergence. Best for GRE tunnels, back-to-back links.

Cheat strip

Symptom	Likely cause	Quick fix
Empty neighbor table	Hellos not exchanged	Check interface up, ACL, wrong area
INIT state persists	One side sees hellos but not neighbor list	Timer mismatch — align hello/dead
Stuck in EXSTART	MTU mismatch	Align MTU or ip ospf mtu-ignore
Stuck in EXCHANGE	LSU packets dropped	Check ACL for 224.0.0.5 blocks
Wrong DR elected	Priority 1 everywhere	Set higher priority on the right router; clear ip ospf process
DR/BDR reelection needed	Priority changed but state stuck	clear ip ospf process on both routers
Cost seems too low everywhere	Reference bandwidth = 100 Mbps default	auto-cost reference-bandwidth 10000

The 20-minute lab you should run tonight

1. Build a triangle of 3 routers, all on one shared switch (broadcast segment).
2. Configure OSPF with default settings. Watch the DR/BDR election in real time with debug ip ospf adj.
3. Set priority 100 on one router. Bounce OSPF (clear ip ospf process). Watch that router become DR.
4. Change hello timer on one to 5. Watch the adjacency go DOWN. Restore. Watch it come back.
5. Change MTU on one interface to 1400. Watch the neighbor stall at EXSTART. Add ip ospf mtu-ignore on both. Watch it succeed.

Twenty minutes of that drill locks in what an hour of reading can’t.