What Does Dead timer Mean?

Think of the OSPF Dead timer like a countdown clock in a team coordination exercise. Imagine you and a coworker are in different rooms and must check in every 10 seconds by shouting. If you don't hear from them for 40 seconds, you assume they left or are unable to continue, and you adjust your plan accordingly. That 40-second period is the Dead timer. In OSPF, routers act like team members. They send short messages called Hello packets at a regular interval, defined by the Hello timer. The Dead timer is typically four times the Hello timer, giving the router a reasonable chance to miss a few Hellos due to network delay or brief congestion before being declared dead. Once the Dead timer expires, the router updates its Link State Database, recalculates routes via Shortest Path First (SPF), and removes the dead neighbor from its routing table. This prevents the router from trying to send data through a failed path. The Dead timer ensures the network reacts quickly to failures without being too sensitive to occasional lost packets. It balances stability with fast convergence, which is critical in large enterprise networks where every second of downtime can affect thousands of users.

On broadcast networks like Ethernet, the default Dead timer is 40 seconds with a Hello interval of 10 seconds. On non-broadcast multi-access (NBMA) networks or point-to-point links, the defaults may differ, but the four-to-one ratio usually holds. Network engineers can adjust these timers, but they must be consistent across all routers on the same link. If one router has a different Dead timer, it might declare a neighbor dead prematurely or never declare them dead at all, causing routing loops or black holes. The Dead timer is part of the OSPF protocol defined in RFC 2328, and understanding it is crucial for designing reliable and fast-converging IP networks.

The OSPF Dead timer is a configurable interval that defines how long a router will wait for a Hello packet from a neighboring router before considering the neighbor down. According to RFC 2328, the default Dead interval is four times the Hello interval, which is 40 seconds on broadcast and point-to-point networks where the default Hello interval is 10 seconds. This ratio provides a tolerance for occasional packet loss while still enabling relatively quick detection of link failures. The Dead timer operates at the OSPF interface level. Each OSPF-enabled interface maintains a neighbor state machine. When a router first discovers a neighbor via a received Hello, it starts a Dead timer for that neighbor. Every time a new Hello is received from that neighbor, the router resets the Dead timer. If the timer expires before a Hello arrives, the neighbor state transitions from a full adjacency (Full) to Down. The router then removes all Link State Advertisements (LSAs) originated by that neighbor from its Link State Database. This triggers a new SPF calculation, updating the routing table to exclude routes that depended on that neighbor.

The Dead timer must be identical on all routers sharing a link for OSPF to form a stable adjacency. This is verified during the Hello packet exchange. Each Hello includes the Router Dead Interval field. If two routers advertise different Dead intervals, they will not become neighbors. This ensures that no router assumes a neighbor is alive longer than the neighbor itself expects. Engineers can adjust the Hello and Dead timers using the ip ospf dead-interval command in Cisco IOS. On very fast networks, they might set a 1-second Hello with a 4-second Dead timer for sub-second convergence. However, this increases protocol overhead and can cause flapping on unstable links. On slow or congested links, longer timers prevent unnecessary adjacency resets. The Dead timer also interacts with OSPF network types. On NBMA networks like Frame Relay, where Hellos are unicast, the Dead timer might need to be longer to account for slower link propagation. The timer is also used in OSPF virtual links and sham links. Understanding the Dead timer is essential for troubleshooting adjacency issues. If routers are not forming adjacencies, mismatched Dead timers are one of the first things to check. Tools like debug ip ospf adj or show ip ospf neighbor detail reveal timer values and neighbor state. The Dead timer is a fundamental OSPF mechanism that balances fast failure detection with network stability, and its correct configuration is critical for robust routing.

The Dead timer matters because it directly impacts how quickly a network can recover from a failure. In a production network, every second of routing convergence delay can result in lost packets, dropped VoIP calls, or disrupted transactions. The Dead timer determines the detection phase of convergence.

Once a router declares a neighbor dead, it can recalculate routes and inform other routers via LSAs. Setting the Dead timer too high means that a link failure might go undetected for 40 seconds or more, causing traffic to be sent into a black hole. Setting it too low makes the network overly sensitive to transient issues like packet loss or CPU spikes, leading to unnecessary SPF calculations and route flaps.

Flapping can destabilize the entire OSPF domain, causing routers to constantly update their databases and potentially overwhelming CPU and memory resources. Network administrators must choose Dead timer values that match the characteristics of the link. For high-speed data center links with redundant paths, aggressive timers (like 1-second Hello and 4-second Dead) provide fast failover.

For satellite links with high latency, longer timers (like 60-second Dead) might be necessary to avoid false positives. The Dead timer also matters in multi-area OSPF designs because an Area Border Router (ABR) with a flapping interface can cause Type 3 LSAs to be withdrawn, affecting routes in other areas. The Dead timer is a key factor in OSPF neighbor state transitions.

A mismatch in Dead timer values between two routers on the same link will prevent them from forming an adjacency at all. This can result in incomplete routing tables and loss of connectivity. Therefore, when adding a new router to an existing network, verifying timer consistency is a standard part of the configuration checklist.

The Dead timer is a small but critical lever that engineers tune to balance detection speed against network stability, directly affecting the reliability and performance of the IP network.

Exam questions about the Dead timer appear in three main formats: direct knowledge, scenario-based troubleshooting, and configuration verification. Direct knowledge questions are straightforward: 'What is the default OSPF Dead interval on an Ethernet network?' or 'A router has not received a Hello from its neighbor for 45 seconds.

What will happen?' The answer involves the Dead timer being set to 40 seconds, so the neighbor is declared down. Another variant: 'Which OSPF timer is used to detect a failed neighbor?'

This directly tests the definition. Scenario-based questions give a more complex setup. For example: 'Router A and Router B are OSPF neighbors on the same Ethernet segment. The network administrator configures ip ospf hello-interval 5 on Router A.

What else must be configured to ensure the adjacency forms?' The correct answer is that the Dead timer must also be modified, or Router B must match the Hello timer. A mismatch in Dead timers will prevent adjacency.

Troubleshooting questions often present show command output. For instance: 'R1# show ip ospf neighbor' shows R2 in the INIT state. The candidate is asked why. A possible reason is that R1 has a Dead timer of 40 seconds while R2 expects a Dead timer of 80 seconds.

Questions might also ask 'Which command would you use to verify the OSPF Dead timer on an interface?' The answer is show ip ospf interface. Configuration questions might say: 'Configure Router A to detect a neighbor failure within 4 seconds.'

The candidate must set the Hello timer to 1 second and the Dead timer to 4 seconds using ip ospf hello-interval 1 and ip ospf dead-interval 4. Some questions combine dead timer with other OSPF parameters like network type. For example: 'On a point-to-point link, the default Hello is 10 seconds.

If you change the Dead timer to 20 seconds, what is the effect?' The answer: the adjacency will still form as long as both routers have the same Dead timer, but the detection time is halved. Another tricky question: 'What is the result of setting the Dead timer to 0?'

This is invalid and OSPF will use default. Exam trap questions might also involve virtual links or non-broadcast networks where timers differ. Overall, the Dead timer is tested as a fundamental parameter that must be understood both theoretically and practically.

Candidates should practice reading interface configurations and neighbor outputs to spot timer mismatches.

In practice, the OSPF Dead timer is one of the first parameters you will verify when building or troubleshooting an OSPF network. As a network professional, you need to know how to view, configure, and troubleshoot this timer. The command to view the dead timer on an interface is show ip ospf interface.

This output shows both the Hello and Dead timer values for that specific interface. For example: 'Dead timer due in 00:00:37' indicates that the router expects a Hello within 37 seconds on that interface. If you see 'Dead timer due in 00:00:01' repeatedly after a Hello, the timer is being reset correctly.

To configure the timers, you use interface configuration mode. The command ip ospf hello-interval seconds sets the Hello timer. The command ip ospf dead-interval seconds sets the Dead timer independently.

If you only change the Hello timer, the Dead timer does not automatically change, so you must adjust it manually to maintain the appropriate ratio for your design. Common practice is to set the Dead timer to 4 times the Hello interval for consistency, but you can use other values if needed, as long as they match on both ends. One professional tip: when migrating from a legacy routing protocol like EIGRP to OSPF, consider the impact of the Dead timer on convergence.

EIGRP has a default hold timer of 15 seconds (Hello 5 seconds), which is faster than OSPF's 40-second Dead. If you need sub-second convergence, you can configure OSPF with Hello 1 second and Dead 4 seconds using ip ospf hello-interval 1 and ip ospf dead-interval 4. However, be cautious because this increases protocol overhead and CPU usage.

On unstable links, you might experience flapping. A better approach is to use OSPF fast hello or BFD (Bidirectional Forwarding Detection) for sub-second detection without changing timers. BFD is a separate protocol that can detect failures in milliseconds and is integrated with OSPF.

Another common issue: if you change timers on a live network without coordinating with the other side, the adjacency will drop. Always plan timer changes during maintenance windows. Also, note that the Dead timer is reset only upon receiving a valid Hello.

If you have ACLs blocking OSPF packets or IP options, the timer will expire even if the neighbor is alive. Therefore, when troubleshooting 'Dead timer expired' syslog messages, check for connectivity issues, ACLs, or MTU mismatches. Finally, the Dead timer value is included in the OSPF Hello packet.

When capturing packets with Wireshark, you can see the 'Router Dead Interval' field in the Hello packet. This is useful for verifying that both sides agree. The Dead timer is a straightforward but powerful knob.

Know how to check it, set it, and troubleshoot it. It is a fundamental skill for any CCNA-level engineer.