TTL Security check

---

The OSPF TTL security check is a mechanism that protects OSPF against remote attacks. When you enable this feature, OSPF will send packets with a TTL of 255 and rejects any packets with a TTL that are smaller than a configured threshold. By default, once you enable this it will only accept packets with a TTL of 255. Since routing decrements the TTL by one, this means that only OSPF packets from directly connected devices will be accepted.

Lets enable TTL-Security and check the behaviour

Router-3
Router-5
interface FastEthernet0/0
ip ospf ttl-security
exit
interface FastEthernet0/0
ip ospf ttl-security
exit

In this packet capture we can see TTL is now 255, and now whenever router will get packet with any other TTL, it will discard it.


Rollover process in OSPF authentication
If one user is using new key and another user is using old key then server will show rollover process with one user using older key

Convergence time (recovery time)

---

OSPF fast hello
         We can define no of hellos router will send in 1 sec.
         CPU process OSPF fast hello
        Dead timer=1sec
         It will increase control plane traffic in network.
         Int f0/0
         Ip ospf dead-interval minimal hello-multiplier _
         Exit
BFD (bidirectional forwarding)
         Line card process BFD
LSA throttling
         After how long router will regenerate LSA-1
         Router ospf 1
         Timers throttle LSA ________ ____
Prefix suppression
        Router will suppress links that are present btw routers
         Router ospf 1
         Prefix-suppression
         Bydefault loopbacks are not suppress it u want to suppress loopback (ip ospf prefix-suppression)

Pasing time…..
Timers pasing LSA-group __75
        The group pacing feature looks at LSA’s that are expiring at the same time and group these together. LSA’s that expire within 75 seconds will be grouped together , the default value is 240 second

Timers LSA arrival _______(in milliseconds)
         How long to wait before accepting the same LSA. If it is received faster than this timer The LSA will be dropped. This timer should be set to less than or equal to the hold-interval of the timer throttle LSA all command.
IP ospf transmit-delay seconds……