# Hello packet

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/hello-packet

## Quick definition

A Hello packet is a short message that routers using the OSPF routing protocol send to each other. It helps routers find other nearby OSPF routers on the same network segment. Once routers receive Hello packets, they can become neighbors and start sharing routing information. Hello packets are also used to confirm that a neighbor is still working properly.

## Simple meaning

Imagine you are moving into a new apartment building and want to meet your neighbors. You could knock on each door and say hello, telling them your name and that you are friendly. If they answer and say hello back, you now know they are there and ready to talk. This is similar to how a Hello packet works in computer networking.

In computer networks, routers use a protocol called OSPF to share information about the best paths to send data. But before routers can share that information, they need to know who else is there. The Hello packet is the first step: a router broadcasts a Hello packet to all routers on its local network. The Hello packet includes the router's ID, its OSPF network area, and other settings like the timer intervals.

When another router receives this Hello packet, it checks if the settings match its own. For example, if both routers are in the same OSPF area and use the same timers, they become neighbors. From that point, the routers can start exchanging detailed routing information using other OSPF messages.

What makes the Hello packet special is that it keeps working even after the initial meeting. Routers send Hello packets every few seconds to let neighbors know they are still active. If a router stops sending Hello packets for a certain amount of time, its neighbor assumes it has failed and no longer uses it for routing. This helps the network automatically adjust when a router goes down.

In short, the Hello packet is the handshake and heartbeat of OSPF. Without it, routers would not know who is on the network, and they could not keep the network running smoothly when problems happen.

## Technical definition

In OSPF (Open Shortest Path First), the Hello packet is defined in RFC 2328, section 9. It is a type 1 OSPF packet used for neighbor discovery, adjacency establishment, and keepalive signaling. Hello packets are encapsulated directly in IP packets with protocol number 89, not using TCP or UDP. They are multicast to the address 224.0.0.5 (AllSPFRouters) on point-to-point links and broadcast networks, or unicast in non-broadcast multiaccess (NBMA) environments.

The Hello packet contains several critical fields: the Router ID of the sending router, the Area ID, authentication data if configured, the network mask, HelloInterval (default 10 seconds on broadcast networks), RouterDeadInterval (default 40 seconds), the router's priority for Designated Router (DR) election, the Designated Router ID and Backup Designated Router ID (0.0.0.0 if not yet elected), and a list of neighbors known to the sender.

When a router receives a Hello packet on an OSPF-enabled interface, it examines these fields. For the router to become an OSPF neighbor, several conditions must match: both routers must be in the same OSPF area, the subnet mask must match on the same network segment, the Area ID must be identical, the authentication information (if any) must be consistent, and the HelloInterval and RouterDeadInterval must be equal. If these match, the receiving router adds the sender to its neighbor table and responds with its own Hello packet. The two routers then progress through OSPF states: Init state, 2-Way state (when both see each other's Router ID in the neighbor list), and then possibly to ExStart state if they decide to form a full adjacency.

On multiaccess networks like Ethernet, the Hello packet also serves to elect a Designated Router (DR) and Backup Designated Router (BDR). The router with the highest priority (or highest Router ID as tiebreaker) becomes the DR. Only the DR and BDR form full adjacencies with all other routers on the segment; other routers remain in 2-Way state but still send Hello packets to maintain connectivity.

Hello packets also play a key role in network convergence. If a router stops receiving Hello packets from a neighbor for longer than the RouterDeadInterval, it declares that neighbor dead, recalculates its shortest path tree, and updates other routers via Link State Advertisements (LSAs). This ensures fast detection of failures.

In real-world IT implementations, adjusting Hello and Dead intervals is common to speed up or slow down convergence. For example, in a data center with high-speed links, administrators might set HelloInterval to 1 second and RouterDeadInterval to 3 seconds (BFD-like fast failure detection). On slower WAN links, intervals might be increased to reduce overhead.

Authentication in Hello packets is also important. OSPF supports plaintext, MD5, and SHA authentication. Without authentication, an attacker could send forged Hello packets to disrupt routing, so many enterprise networks require authentication on all OSPF interfaces.

## Real-life example

Think of a neighborhood watch program in a suburban community. Each household has a volunteer who is responsible for keeping an eye on the street. To start, each volunteer needs to know who else is part of the watch. So, the coordinator sends out a simple greeting card to every house asking, "Are you in the watch? If so, please respond with your name and the house number." This card is just like a Hello packet.

When a household receives the card, they check if they are in the same watch area. If they belong to the same neighborhood, they send a card back saying, "Yes, I am here at house 12 and my name is Bob." The coordinator records that house 12 is participating. Even after the initial setup, the coordinator sends a quick text message to all members every hour: "Still active?" Each member replies with a simple "Yes." If someone does not reply within three hours, the coordinator assumes they have moved or stopped volunteering, and removes them from the active list.

Now map this to OSPF. The neighborhood is the OSPF area. The coordinator is a router sending Hello packets. The initial greeting card is the Hello packet that contains the router's ID, the area, and other settings. The response card is the neighbor's Hello packet back. The hourly text messages are the periodic Hello packets sent every 10 seconds. The three-hour timeout is the RouterDeadInterval, which is typically 40 seconds. If a router misses four Hello packets in a row (40 seconds without hearing a neighbor), it declares the neighbor dead.

In a more complex scenario, the neighborhood might have multiple coordinators. To avoid chaos, they elect one main coordinator (the Designated Router) and a backup coordinator (the Backup Designated Router). The main coordinator keeps a master list of all households and updates everyone only when something changes. Other households only talk to the main coordinator and the backup, not to every other house. This saves a lot of paperwork and traffic, just like OSPF uses DR and BDR on Ethernet networks.

This analogy helps you see that Hello packets are about discovery, agreement on basic rules, and ongoing health checks. Without these polite greetings, the network would quickly fall into confusion and wasted resources.

## Why it matters

Hello packets are the foundation of OSPF operation. Without them, a router cannot discover its neighbors, cannot form adjacencies, and therefore cannot build a complete map of the network. In practical IT terms, if Hello packets are blocked or misconfigured, routing will fail entirely for that segment. This makes understanding Hello packets essential for any network engineer or IT professional who works with OSPF.

From a design perspective, the Hello interval and Dead interval directly affect network convergence time. A shorter Hello interval means faster detection of a neighbor failure, which is critical in environments where downtime costs money, such as financial trading systems or cloud data centers. However, shorter intervals also increase CPU load and bandwidth usage because Hello packets are sent more frequently. Network administrators must balance speed against overhead.

Another reason Hello packets matter is their role in security. OSPF authentication is carried in Hello packets. If a rogue device sends a Hello packet with matching parameters, it could become a neighbor and inject false routes. This is why many organizations require MD5 or SHA authentication on all OSPF interfaces, especially on shared network segments.

Hello packets also affect multicast and broadcast traffic. On Ethernet, Hello packets are sent to the multicast address 224.0.0.5, which all OSPF routers listen to. This can have implications for switch MAC address tables and multicast snooping configurations. If a switch is not configured properly, Hello packets may not reach all routers.

Finally, understanding Hello packets helps in troubleshooting. When a neighbor relationship fails to form, the first thing to check is whether Hello packets are being sent and received. Common issues include mismatched subnet masks, mismatched areas, ACLs blocking multicast traffic, or authentication mismatches. Being able to analyze Hello packet fields using debug or packet capture tools is a key skill for network engineers.

## Why it matters in exams

For IT certification exams like Cisco CCNA, CompTIA Network+, and Juniper JNCIA, OSPF is a core topic, and the Hello packet is one of the most tested subtopics. In the CCNA exam (200-301), OSPF neighbor states and the Hello protocol appear under objective 3.1 (Configure and verify single-area OSPF). Candidates must know the contents of a Hello packet, how it is used for neighbor discovery, and the default timers (Hello 10 sec, Dead 40 sec on broadcast; Hello 30 sec, Dead 120 sec on NBMA). Questions often ask which fields must match for two routers to become neighbors. The correct answer includes Area ID, subnet mask, Hello/Dead intervals, and authentication.

In CompTIA Network+ exams (N10-008), OSPF is covered under network troubleshooting and routing protocols. While the focus is less on packet format, you must understand that OSPF uses Hello packets to form neighbor relationships and maintain them. You might see a question about the purpose of the Hello timer, or why two routers fail to form an adjacency. Also, the concept of DR and BDR election on broadcast networks is often linked to Hello packets.

For Juniper JNCIA-Junos (JN0-104), OSPF Hello packets are part of the routing fundamentals section. Juniper uses a slightly different default configuration: the Hello interval is 10 seconds and Dead interval is 40 seconds on all network types, but the election process is the same. You may be asked about protocol 89 and the multicast address 224.0.0.5.

In all these exams, typical question formats include multiple-choice on OSPF packet types, fill-in-the-blank for timer values, and scenario-based questions where you must identify why a router is stuck in the INIT state. For example: "Router A shows neighbors in the INIT state. What is the most likely cause?" The answer could be that Hellos are not being received due to a misconfigured subnet mask.

simulation or lab questions may ask you to verify Hello interval settings using commands like show ip ospf interface or debug ip ospf hello. Knowing these commands and interpreting their output is essential.

Because Hello packets are fundamental to OSPF, exam questions often test this concept in combination with other OSPF topics like LSA types, SPF algorithm, and route summarization. A solid grasp of Hello packets will help you answer questions about neighbor states, DR/BDR election, and timers, which are all high-yield exam points.

## How it appears in exam questions

Hello packet questions appear in several distinct patterns across certification exams. The most common is the scenario where a router fails to form a neighbor adjacency. The question provides a diagram or output from show ip ospf neighbor showing routers stuck in the INIT state. You are asked to identify the root cause. Options may include: mismatched area ID, mismatched subnet mask, different Hello timer, ACL blocking multicast, or authentication mismatch. The correct answer almost always involves one of those mismatches.

Another pattern involves DR and BDR election. The question might show the output of show ip ospf interface with priority values and Hello packet contents, then ask which router will become the DR. You must know that the highest priority wins, with Router ID as tiebreaker. The Hello packet includes the router's priority and the current DR/BDR.

A third pattern is about timer values. You may be given a scenario where an administrator changes the Hello interval on one router but not on the neighbor. You must explain why the adjacency does not form. The answer is that the Hello and Dead intervals must match for OSPF neighbors to become fully adjacent.

Configuration-based questions also appear. For example: "A network engineer configures OSPF on two routers connected via Ethernet. After configuration, the routers do not become neighbors. Which configuration parameter should be checked first?" The answer involves verifying that both routers are in the same area and that the Hello and Dead intervals are identical.

Troubleshooting questions often use debug commands. You might see an output from debug ip ospf hello showing Hello packets being sent but not received. The question asks what the likely issue is. The correct answer might involve a firewall ACL blocking multicast to 224.0.0.5, or a switchport configuration that drops multicast traffic.

Finally, some exams test theoretical knowledge. A question might ask: "Which OSPF packet type is used to discover neighbors and maintain neighbor relationships?" The answer is Hello packet. Or: "What multicast address is used for OSPF Hellos on broadcast networks?" Answer: 224.0.0.5.

In lab-based exams like the CCNA lab, you might be asked to configure OSPF and then verify that Hello packets are being exchanged. You could be asked to use the show ip ospf neighbor command to confirm that the routers have reached the FULL state, which is only possible after successful Hello exchange and adjacency formation.

## Example scenario

You are a network administrator for a mid-sized company. You have two routers, RouterA and RouterB, connected directly through a single Ethernet cable. Both routers run OSPF, and you want them to share routes so that all networks in the company are reachable. You configure OSPF on both routers, assigning them to area 0. However, when you check the neighbor status, you see that RouterA's neighbor table shows RouterB in the INIT state, meaning RouterA received a Hello from RouterB but did not see its own Router ID in RouterB's Hello packet.

You suspect a mismatch. You decide to investigate. On RouterA, you run show running-config | section router ospf and find that the network statement includes the correct subnet, but the router-id is set to 1.1.1.1. On RouterB, you run the same command and find router-id 2.2.2.2. Both are in area 0. The subnet mask on the connecting interface is /24 on RouterA but /25 on RouterB. This mismatch prevents the routers from becoming neighbors because OSPF checks that the subnet masks match on the same network segment.

You correct the subnet mask on RouterB to /24 and wait a few seconds. Now you run show ip ospf neighbor again, and this time you see RouterB in the 2-WAY state, then quickly moving to FULL state. The routers have now successfully exchanged Hello packets, agreed on the subnet mask, and formed a full adjacency. They begin exchanging LSAs and building their OSPF databases.

Later, you notice that RouterA and RouterB are sending Hellos every 10 seconds, which is the default. However, on a different link to a remote office, the network is slower and you increase the Hello interval to 30 seconds to reduce overhead. You also increase the Dead interval to 120 seconds (four times the Hello interval). This allows the WAN link to tolerate occasional packet loss without declaring a neighbor dead prematurely.

This scenario shows how Hello packets are the gatekeeper of OSPF neighbor relationships. Without matching parameters, no routes are exchanged. With correct configuration, the network runs smoothly. Understanding how Hello packets behave in real configuration helps you diagnose issues quickly.

## Common mistakes

- **Mistake:** Thinking OSPF Hellos use TCP or UDP
  - Why it is wrong: OSPF packets, including Hellos, are encapsulated directly in IP protocol number 89, not TCP or UDP. This means OSPF does not rely on transport layer reliability; it handles its own.
  - Fix: Remember that OSPF protocol number 89 is a separate protocol. Use 'show ip ospf interface' to see that Hellos are sent directly over IP.
- **Mistake:** Believing all OSPF routers on a multiaccess network must form full adjacencies with each other
  - Why it is wrong: On broadcast networks, only the DR and BDR form full adjacencies with all other routers. Other routers stay in 2-WAY state with each other to reduce LSA flooding overhead.
  - Fix: Check neighbor states: if a router is not the DR or BDR, it only needs full adjacency with the DR and BDR. Other neighbors in 2-WAY state is normal.
- **Mistake:** Assuming Hello and Dead intervals can be different on two routers as long as they are close
  - Why it is wrong: OSPF requires that the HelloInterval and RouterDeadInterval match exactly between neighbors. Even a difference of one second will prevent adjacency formation.
  - Fix: Always verify that 'ip ospf hello-interval' and 'ip ospf dead-interval' commands are set identically on both routers (or use defaults). The dead interval should be four times the hello interval.
- **Mistake:** Configuring OSPF authentication on one router only
  - Why it is wrong: OSPF authentication must match on both routers. If one has MD5 authentication enabled and the other does not, Hellos are dropped because the authentication field does not match.
  - Fix: Use 'area 0 authentication message-digest' on both routers and configure identical key chains. Use 'show ip ospf neighbor' to verify the state.
- **Mistake:** Forgetting that Hello packets are multicast to 224.0.0.5, not broadcast
  - Why it is wrong: This matters for switch configuration. If multicast filtering is enabled, Hellos may be blocked. Also, some older routers may not support multicast properly.
  - Fix: Ensure switches allow IP multicast for 224.0.0.5. Use 'debug ip ospf hello' to confirm Hellos are sent and received.

## Exam trap

{"trap":"A question shows two routers with different Hello intervals (e.g., 10 seconds on RouterA and 15 seconds on RouterB). The question states they are in the same area and subnet, yet they do not become neighbors. Some answer choices suggest the subnet mask is wrong, or the area ID is wrong. The trap is that the Hello interval mismatch is the actual problem.","why_learners_choose_it":"Learners often overlook the fact that Hello and Dead intervals must match. They focus on more common issues like subnet match or area ID because those are frequently tested. The mismatch in timers is less obvious, especially if the difference is small.","how_to_avoid_it":"Always remember the OSPF neighbor requirements: same area, same subnet mask, same Hello/Dead intervals, and matching authentication. When a question provides specific timer values, check them against each other. If they differ, that is almost certainly the issue. Remember the default: Hello 10, Dead 40. Any deviation must be identical on both sides."}

## Commonly confused with

- **Hello packet vs LSU (Link State Update) packet:** LSU packets are OSPF type 4 packets that contain actual routing information (LSAs) to advertise network topology. In contrast, Hello packets are type 1, used only for neighbor discovery and keepalive. LSU packets are sent after neighbor adjacency is established, while Hellos are sent continuously from the start. (Example: Hello is like introducing yourself; LSU is like showing a map of your street.)
- **Hello packet vs BGP Hello (Keepalive) packet:** BGP uses TCP connection for its sessions, and BGP Keepalive messages are sent over TCP to maintain the session. OSPF Hellos are sent directly over IP (protocol 89) and do not rely on TCP. BGP has a Keepalive timer (default 60 seconds) while OSPF has a Hello timer (default 10 seconds on broadcast). Also, BGP does not use the Hello packet for neighbor discovery; BGP neighbors must be manually configured. (Example: BGP works like a pre-arranged phone call; OSPF works like shouting into a room to see who answers.)
- **Hello packet vs EIGRP Hello packet:** EIGRP also uses Hello packets for neighbor discovery and keepalive, but EIGRP Hellos are sent to multicast address 224.0.0.10 (all EIGRP routers), whereas OSPF uses 224.0.0.5. EIGRP's Hello interval is 5 seconds on high-speed links (default) and 60 seconds on low-speed links. The EIGRP Hello packet carries different information, like K-values, which must match for neighbor formation. OSPF Hellos require matching Area ID and subnet mask, not K-values. (Example: EIGRP and OSPF both send greetings, but they speak different languages and look for different details.)

## Step-by-step breakdown

1. **Router sends Hello packet** — The router sends a Hello packet out of every OSPF-enabled interface. The packet is multicast to 224.0.0.5 (AllSPFRouters) on broadcast and point-to-point networks. The packet includes the router's Router ID, Area ID, subnet mask, Hello and Dead intervals, priority, and any neighbors it already knows.
2. **Neighbor receives the Hello packet** — A neighboring OSPF router receives the Hello packet on its interface. It checks the parameters: Area ID, subnet mask, authentication, and timers. If all match its own configuration, the neighbor is considered valid and is added to the list of potential neighbors.
3. **Neighbor responds with its own Hello** — The neighbor sends back a Hello packet in response. This packet includes the original router's Router ID in the neighbor list. This is how routers acknowledge each other and move from the INIT state to the 2-WAY state.
4. **DR and BDR election (multiaccess networks only)** — On Ethernet and other broadcast networks, Hello packets include the router's priority and the current DR and BDR. Routers compare priorities to elect a Designated Router and Backup Designated Router. The DR becomes the central point for LSA exchanges.
5. **Forming full adjacency** — After reaching 2-WAY state, routers decide whether to form a full adjacency based on the network type. On point-to-point links, all neighbors become fully adjacent. On multiaccess, only DR and BDR form full adjacency with all others. The adjacency progresses through ExStart, Exchange, Loading, and finally FULL.
6. **Periodic Hello packets maintain the relationship** — Once the adjacency is formed, routers continue to send Hello packets every Hello interval (default 10 seconds). These serve as keepalives. If a router does not receive a Hello from the neighbor within the Dead interval (default 40 seconds), it declares the neighbor dead and recalculates routes.

## Practical mini-lesson

The Hello packet is the first and most persistent message in OSPF communication. As a network professional, you must understand more than just its definition, you need to know how to configure, verify, and troubleshoot it in real environments.

Let's walk through a practical configuration scenario. You have two Cisco routers connected via a FastEthernet link. You want to enable OSPF in area 0. On RouterA, you enter interface FastEthernet 0/0 and configure the IP address 192.168.1.1/24. Then you enter router ospf 1 and use network 192.168.1.0 0.0.0.255 area 0. On RouterB, you do the same with IP 192.168.1.2/24 and the same network statement. At this point, the routers should automatically send Hellos and form a neighbor adjacency. You can verify with show ip ospf neighbor on either router. You should see the other router listed with state FULL.

Now, what if the adjacency does not form? The most common issue is a mismatch in the subnet mask. For example, if RouterA is configured with a /24 mask but RouterB is using /16, the Hellos will be sent but the routers will not become neighbors because OSPF checks the mask on the Hello packet. Use show ip ospf interface to see the configured network mask on each interface.

Another practical scenario: you want to change the Hello interval to 5 seconds for faster convergence. On RouterA, you enter interface FastEthernet 0/0 and ip ospf hello-interval 5. The router automatically sets the dead interval to 20 seconds (four times the hello). However, if you do not make the same change on RouterB, the neighbors will not match. Always configure the same timer values on both sides.

Authentication is also common. To enable MD5 authentication, use area 0 authentication message-digest on the OSPF process, then on each interface use ip ospf message-digest-key 1 md5 secretpassword. Both routers must use the same key ID and password, or Hellos will be dropped.

When troubleshooting, the command debug ip ospf hello is invaluable. It shows every Hello packet sent and received, including any errors. If you see "Hello received from 192.168.1.2 but not accepted because of mismatch...," it will tell you exactly what field is wrong.

In enterprise networks, always document your timer changes. Many production outages happen because someone changed Hello interval on one router but forgot the neighbor. Also, on NBMA networks like Frame Relay, you may need to manually configure neighbors with neighbor command because Hellos are unicast, not multicast.

Finally, be aware that Hello packets are small (typically 44 bytes plus authentication). On a busy router with hundreds of OSPF neighbors, the CPU impact of processing thousands of Hellos per second can be significant. Use the passive-interface command on interfaces that should not form OSPF neighbor relationships, such as those facing end users, to stop sending Hellos and save resources.

## Memory tip

Think of the four must-match fields for OSPF neighbors: Area, Mask, Timers, Auth (AMTA). If any one of these is different in the Hello packet, the neighbor relationship fails.

## FAQ

**What is the purpose of a Hello packet in OSPF?**

A Hello packet is used for neighbor discovery, forming and maintaining neighbor relationships, and electing a Designated Router on multiaccess networks. It acts as a keepalive to confirm that neighbors are still operational.

**What fields must match for two OSPF routers to become neighbors using Hello packets?**

The Area ID, subnet mask, Hello interval, Dead interval, and authentication information must all match. If any of these differ, the routers will not form a neighbor relationship.

**What multicast address does OSPF use for Hello packets?**

OSPF uses the multicast address 224.0.0.5 (AllSPFRouters) for Hello packets on broadcast and point-to-point networks. On NBMA networks, Hellos may be unicast to specifically configured neighbors.

**How often are Hello packets sent by default?**

On broadcast and point-to-point networks, Hello packets are sent every 10 seconds. On non-broadcast multiaccess (NBMA) networks, the default is 30 seconds. The Dead interval is typically four times the Hello interval (40 seconds on broadcast, 120 seconds on NBMA).

**Can Hello packets be authenticated?**

Yes, OSPF supports plaintext, MD5, and SHA authentication for Hello packets. All routers on the same network segment must use the same authentication type and credentials, or Hellos will be rejected.

**Why is my OSPF neighbor stuck in the INIT state?**

The INIT state means your router received a Hello from the neighbor but did not see its own Router ID in the neighbor's Hello packet. This often indicates a mismatch in the subnet mask, area ID, or timers. Check those parameters with 'show ip ospf interface'.

**What is the difference between a Hello packet and a Database Description packet?**

A Hello packet (type 1) is used for neighbor discovery and keepalive. A Database Description packet (type 2) is exchanged after adjacency is established to summarize the link-state database. They serve very different purposes in the OSPF state machine.

## Summary

The Hello packet is the essential first message in the OSPF routing protocol. It allows routers to discover each other on a network, agree on basic parameters, and maintain ongoing communication. Without Hello packets, OSPF cannot form neighbor relationships, and without those relationships, routers cannot share routing information. This makes the Hello packet the literal 'hello' that starts every OSPF conversation.

Understanding Hello packets requires knowing both the conceptual role and the technical details. The packet is encapsulated directly in IP with protocol 89, uses multicast address 224.0.0.5, and carries key fields such as Router ID, Area ID, subnet mask, and timers. For a neighbor relationship to form, these fields must match on both routers. On broadcast multiaccess networks, Hello packets play a role in electing the Designated Router and Backup Designated Router, which reduce routing traffic overhead.

For certification exams like CCNA, JNCIA, and Network+, the Hello packet is a high-yield topic. You must know the default timers, the neighbor state progression from INIT to FULL, and common troubleshooting steps. Questions often appear as scenario-based problems where a mismatch causes a neighbor failure. By learning the common causes of OSPF neighbor issues, mismatched area, subnet mask, timers, or authentication, you can quickly identify the correct answer.

In real-world IT work, the Hello packet remains critical. Configuring appropriate timer intervals, enabling authentication, and using debug commands to verify Hello exchange are all part of a network engineer's daily tasks. A deep understanding of Hello packets leads to faster problem resolution and more reliable network design. Whether you are studying for a certification or managing a production network, mastering the Hello packet is a foundational skill that will serve you well.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/hello-packet