OSPF Problems in the routing table

[pflunkert]

Hi,

we have a big network with nearly 1000 routing entries. When i made a "show ip route" i can saw that the 95% of the entries are "new".

Example:

O IA 198.0.140.0/24 [110/103] via 10.26.4.29, 00:05:00, Vlan11

O 4.192.198.0/24 [110/4] via 10.26.6.29, 00:05:54, Vlan32

With the command "show ip ospf stat" i can see this:

SPF calculation time

Delta T Intra D-Intra Summ D-Summ Ext D-Ext Total Reason

1d04h 12 4 44 0 8 0 72 R, X

1d03h 12 4 40 4 8 0 72 R, X

1d03h 12 4 40 0 8 0 68 R, X

1d02h 12 4 36 4 8 0 68 R, X

1d02h 12 4 40 0 8 0 68 R, X

1d02h 12 4 40 0 8 0 68 R, X

00:43:04 12 4 40 4 8 0 72 R, X

00:41:19 12 4 36 4 8 0 72 R, X

00:08:04 12 4 40 4 8 0 72 R, X

00:07:44 12 4 36 0 8 0 64 R, X

My question is, why change the time in the routing table and how can i troubleshoot this. The networks looks stable.

Regards

Peter

[jroyster]

I believe LSAs are flooded every 30 minutes within an area which explains why the routes look "new"

[Harold Ritter]

The LSA refresh doesn't necessarely trigger an SPF recalculation and route re-installation.

Hope this helps,

[Ahmede]

Debug ospf, and you will see who is sending LSA..

[Kevin Dorrell]

Peter,

Looking in the excellent "Troubleshooting IP Routing Protocols" book, they suggest three reasons for frequent SPF re-calculation:

1. link flap

2. neighbor flap (common in FR hub-and-spoke)

3. Duplicate router ID (wouldn't have thougth of this one myself).

Looking at show ip ospf on a router in the area giving problems, does it indeed show a constantly increasing "SFP algorithm executed n times"? If so, how often, and regularly? That might give some clues.

The best-targetted debug for SPF recalculation seems to be debug ip ospf monitor on any router in the area that is giving problems. It tells you when the SPF is being recalculated, and each time why.

Do you have ospf log adjacency-changes configured under the ospf process? That could be useful, and it may be worth leaving it on all the time so that you get early warning of any instability.

Another useful diagnostic is show ip ospf database router, and look for any router apparently giving inconsistent data.

Good luck, and let us know the result.

Kevin Dorrell

Luxembourg

[Kevin Dorrell]

Peter,

Just to add to that ... a simpler approach. Go to any router in the troublesome area, and do show ip ospf database a few times. Look for sequence numbers that are constantly increasing. If it's a type 1, then it's a neighbor flap or duplicate RID; if it's a type 2 then its a link flap, etc. etc.

Kevin Dorrell

Luxembourg