OSPF Micro-loops: Transient Loops During SPF Convergence

Every router walks the same five steps after a topology change. A micro-loop forms whenever two adjacent routers are on different sides of step 5 at the same time.

1. Detect the event: loss of light, BFD timeout, or dead-interval expiry. Only routers attached to the failure learn locally; everyone else learns through flooding.
2. Originate a new Router LSA (Type 1), plus a Network LSA (Type 2) if a DR is involved. Gated by timers throttle lsa.
3. Flood hop by hop. Each hop adds receive processing, timers lsa arrival checks and flood pacing. A router five hops away hears later than a direct neighbour.
4. Run SPF, gated by timers throttle spf (initial wait / hold / max wait). Run time grows with LSDB size.
5. Update RIB, then FIB. Often the longest and least predictable step: thousands of prefixes, distributed CEF, line-card and TCAM programming.

These are typical orders of magnitude, not measurements. Measure your own with the commands in section 04.

Four routers in a ring, all in Area 0. The prefix 10.3.3.0/24 is attached to R3. The R2–R3 link fails.

Shortest paths before and after

R2 used to be downstream of R1; now R1 is downstream of R2. R1 used to be downstream of R4; now R4 is downstream of R1. Any pair that reverses direction can loop if the new downstream router updates first.

Timeline

Illustrative, with BFD detection and timers throttle spf 50 200 5000 on all routers. Times are from R2's detection; R1 and R4 differ only in flooding distance and FIB speed.

While looping, each packet circulates until TTL reaches zero. The routers generate a burst of ICMP time-exceeded, and the looping link's utilisation spikes, which can delay unrelated traffic on R1–R2 and R1–R4.

A micro-loop needs one condition: X forwards to Y for a prefix while Y forwards to X for the same prefix. That crossing point is always a pair of routers whose next-hops reverse between the old and new SPF trees. It lasts exactly as long as the gap between their two FIB updates.

Predicting the cross-points

1. Compute the SPF tree toward the destination before the change, and again after it.
2. List every link whose direction of use flips (X→Y before, Y→X after).
3. Each flipped link is a candidate. If the new downstream router is likely to converge first (closer to the failure, fewer prefixes, faster hardware), expect a loop there.

In the example both R1–R2 and R1–R4 flip, so both loop. R3–R4 does not flip; it simply starts carrying traffic, so it never loops.

You prove a micro-loop by lining up three things on one NTP-synchronised clock: when each router ran SPF, when each FIB entry changed, and when traffic saw TTL expiry or loss. Without millisecond timestamps, the evidence can't be correlated.

service timestamps log datetime msec localtime show-timezone
service timestamps debug datetime msec localtime show-timezone
ntp server 10.0.0.1
!
router ospf 1
 log-adjacency-changes detail

Data-plane evidence

• A continuous fast ping or IP SLA UDP jitter probe across the failure. Lost packets × interval = total outage; subtract detection and SPF time and the rest is mostly micro-loop.
• A traceroute started during convergence shows the same two hops repeating: R1, R2, R1, R2…
• A capture on the cross-point link shows identical packets with TTL dropping by 2 on each pass.

Incident report template

Faster, more uniform convergence shrinks micro-loops everywhere. Only ordered or explicitly steered convergence removes them.

router ospf 1
 timers throttle spf 50 200 5000
 timers throttle lsa 0 20 5000
 timers lsa arrival 15
 timers pacing flood 15
 bfd all-interfaces
 fast-reroute per-prefix enable area 0 prefix-priority low
 fast-reroute per-prefix remote-lfa area 0 tunnel mpls-ldp
!
interface GigabitEthernet0/1
 bfd interval 50 min_rx 50 multiplier 3
 carrier-delay msec 0

timers lsa arrival must be lower than the neighbours' LSA throttle hold, or repeated LSAs are dropped. Remote LFA needs LDP on the core links.

router ospf 1
 segment-routing mpls
 microloop avoidance segment-routing
 microloop avoidance rib-update-delay 3000
 area 0
  interface GigabitEthernet0/0/0/0
   fast-reroute per-prefix
   fast-reroute per-prefix ti-lfa enable

The RIB update delay is how long the router uses the temporary SR path before installing the normal path. It must exceed the worst-case convergence time in the area.

1. Pick four core routers that form a ring, set costs 10 / 10 / 40 / 10 as above, and advertise a loopback (10.3.3.1/32) on "R3".
2. Mismatch timers on purpose: leave "R4" at timers throttle spf 5000 10000 10000, the rest at 50 200 5000.
3. Start a fast ping from behind "R1" to 10.3.3.1 and a capture on the R1–R4 link.
4. Shut R2–R3. Record lost packets, TTL-exceeded counters and show ip ospf statistics on all four.
5. Fill in the report template. The R1–R4 loop should last roughly R4's SPF initial wait.
6. Align timers, add BFD, repeat. Then bring the link back up and measure the restoration loop separately.
7. If the image supports it, enable SR with TI-LFA and micro-loop avoidance, and repeat.

References

• RFC 5715: A Framework for Loop-Free Convergence
• RFC 6976: Framework for Loop-Free Convergence Using the Ordered FIB Approach
• RFC 8333: Micro-loop Prevention by Introducing a Local Convergence Delay
• RFC 8405: SPF Back-Off Delay Algorithm for Link-State IGPs

← Back to Overview