# Hello timer

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/hello-timer

## Quick definition

The Hello timer is the frequency (in seconds) at which an OSPF router sends Hello packets out its interfaces. These packets help routers discover each other, establish neighbor relationships, and confirm that a neighbor is still alive. The default Hello interval is typically 10 seconds on broadcast and point-to-point networks, and 30 seconds on non-broadcast and point-to-multipoint networks.

## Simple meaning

Imagine you are a security guard in a large building with many other guards. To stay coordinated, you call out “All clear?” every ten seconds. If a guard in a distant wing stops responding, you know something is wrong. In the same way, OSPF routers use Hello timers to regularly announce “I am here and working fine.” Each router sends a small packet called a Hello packet at a set interval. If another router hears this packet, it knows the first router is alive and can keep using it to exchange routing information.

Think of the Hello timer like a heartbeat for router connections. Just as doctors check a patient’s pulse to ensure the heart is beating, routers check the Hello timer to ensure the neighbor router is still online. If a router misses several Hello packets in a row, it assumes the neighbor has failed and updates its routing table to avoid sending data through that dead link. The timer is configurable but must be the same on both routers for them to become neighbors.

In everyday life, you can compare it to a group chat where friends check in every few minutes. If one friend stops typing, others might ask if they’re okay. Similarly, the Hello timer is how routers in OSPF keep their “friendship” alive. Without it, a router would have no way to know whether a neighbor has crashed, disconnected, or simply become unreachable. This mechanism is essential for OSPF to quickly detect network changes and reroute traffic around failures.

## Technical definition

The Hello timer is a fundamental OSPF (Open Shortest Path First) protocol timer that controls the frequency of Hello packet transmission on an interface. OSPF is a link-state routing protocol defined in RFC 2328. Hello packets are used for neighbor discovery, neighbor maintenance, and as keepalive messages. The default Hello interval is 10 seconds on broadcast and point-to-point (P2P) network types, and 30 seconds on non-broadcast multi-access (NBMA) and point-to-multipoint network types. The timer is configured per interface and must be consistent between neighboring routers for the OSPF adjacency to form. If two routers have mismatched Hello timers, they will not become neighbors, and the adjacency will not establish.

The Hello timer works in conjunction with the Dead interval (also called Router Dead Interval), which is typically four times the Hello interval. The Dead interval defines how long a router waits without receiving a Hello packet before declaring the neighbor as down. For example, with a 10-second Hello timer, the default Dead interval is 40 seconds. The Dead interval is also configurable and must match between neighbors. When a router sends a Hello packet, it includes the router ID, the area ID, the network mask, the Hello interval, the Dead interval, the router priority, and a list of neighbors the sender already sees (the neighbor list).

Hello packets are multicast to the OSPF reserved multicast addresses: 224.0.0.5 (AllSPFRouters) for all OSPF routers on the segment, and 224.0.0.6 (AllDRouters) for communication with the Designated Router (DR) and Backup Designated Router (BDR) on broadcast multi-access networks. On point-to-point links, Hello packets are sent to the neighbor directly. The Hello timer affects convergence time. A shorter Hello timer allows faster detection of neighbor loss but increases overhead on the network and CPU usage. A longer timer reduces overhead but delays failure detection.

In practice, network engineers sometimes adjust the Hello timer to balance between fast convergence and resource usage. For example, on critical links, they might set a 1-second Hello with a 4-second Dead interval for rapid failure detection. However, the Hello and Dead timers must be uniform across all routers on the same segment. The Hello packet format contains an authentication field if OSPF authentication is configured. OSPFv3 (IPv6) uses the same Hello mechanism but with IPv6 multicast addresses.

## Real-life example

Think of the Hello timer like a group of friends hiking together on a trail. The group decides that every ten minutes, each person will shout “I’m here!” to confirm they are still on the path. This regular check keeps everyone connected and aware of the group’s status. If someone does not hear from a friend for 40 minutes (four missed shouts), they assume that friend has taken a wrong turn or fallen behind, and they adjust the group plan accordingly.

In this analogy, the Hello packet is each friend’s shout. The Hello timer is the 10-minute interval between shouts. The Dead interval is the 40-minute silence that triggers concern. If two friends have different shout intervals, one shouts every 10 minutes, another every 20, they will not coordinate well. One might think the other is missing when they simply haven’t shouted yet. Similarly, OSPF routers must agree on the Hello and Dead intervals to become neighbors.

Another analogy is a workplace where security guards do radio check-ins every hour. The regular check-in is the Hello packet. The manager expects to hear from each guard within that hour. If a guard misses two check-ins (two hours), the manager knows something is wrong. OSPF works exactly like this, but much faster, on a typical LAN, check-ins happen every 10 seconds. The Hello timer ensures that routers maintain a live “pulse” on their connections, allowing the network to quickly react to failures without waiting for manual intervention.

## Why it matters

The Hello timer is critical for OSPF because it directly affects how quickly a network can detect and react to router failures. In any network, downtime is costly. A slow failure detection means data may be sent into a dead link, causing packet loss and application delays. By tuning the Hello timer, network engineers can balance between fast detection and overhead. For example, on high-availability links between data centers, a short Hello timer (like 1 second) can help failover in under 5 seconds. On less critical links, a longer timer reduces bandwidth usage.

Hello timers also influence CPU utilization. Each Hello packet requires the router to process and respond. On routers with many OSPF neighbors, a very short Hello timer can increase CPU load. Professionals must consider the network’s size and the router’s capability when selecting timer values. The Hello timer is a key part of OSPF authentication. If authentication is configured, the Hello packet includes the authentication data, ensuring that only trusted routers can form adjacencies.

Understanding the Hello timer is essential when troubleshooting OSPF adjacency issues. One of the most common causes of OSPF neighbor problems is mismatched timers. If two routers have different Hello or Dead intervals, they will remain stuck in the INIT state and never become full neighbors. This is a frequent exam and real-world scenario. Network engineers must verify timer consistency when connecting different OSPF routers, especially in multi-vendor environments where default timers may differ. For instance, some manufacturers set non-standard default timers for certain network types, leading to adjacency failures unless corrected.

## Why it matters in exams

The Hello timer is a core concept in OSPF-related questions on exams like the Cisco CCNA, CCNP, CompTIA Network+, and Juniper JNCIA. On the CCNA, objectives such as “Configure and verify OSPF neighbor relationships” and “Describe OSPF operations” include understanding the Hello timer’s role in forming and maintaining adjacencies. At the CCNP level, candidates must also understand how timers affect network convergence and how to modify them in multi-area OSPF. CompTIA Network+ covers OSPF as a routing protocol, and questions often test the purpose of Hello packets and default timer values.

Exam questions may directly ask: “What is the default Hello interval on an Ethernet network?” Answer: 10 seconds. They may also present a scenario where an OSPF neighbor is failing to form, and the candidate must identify that the Hello timers are mismatched. Another common question type: “If the Dead interval is 40 seconds, what is the Hello interval?” The answer is 10 seconds, based on the default 4:1 ratio. Candidates must also know that on non-broadcast networks like Frame Relay, the default Hello interval is 30 seconds, and the Dead interval is 120 seconds.

At more advanced levels, exams may ask about the effect of changing the Hello timer on convergence time and network overhead. For example, a candidate might be asked to calculate failover time given a specific Hello and Dead interval. Knowledge of the Hello packet format, including the neighbor list field, can appear in packet flow analysis questions. It is also important to know that Hello packets use multicast addresses 224.0.0.5 and 224.0.0.6. One frequent exam trap is that the Hello timer must be the same on both routers, but the Dead timer is derived from the Hello timer and must also match, a simple mismatch will break the adjacency.

## How it appears in exam questions

Exam questions about the Hello timer appear in several patterns. The first is direct knowledge recall: “What is the default OSPF Hello interval on a point-to-point link?” The correct answer is 10 seconds. Second, scenario-based questions: “Router A has a Hello timer of 10 seconds and a Dead timer of 40 seconds. Router B has a Hello timer of 30 seconds and a Dead timer of 120 seconds. Will these routers form an OSPF adjacency? Why or why not?” The answer: No, because Hello timers do not match. The candidate must recognize that both Hello and Dead intervals must be identical.

Third, configuration questions: “Which command sets the OSPF Hello interval to 5 seconds on an interface?” On Cisco IOS, the command is “ip ospf hello-interval 5” under interface configuration. Candidates should also know that changing the Hello interval automatically adjusts the Dead interval to four times the new value, but this can be overridden with “ip ospf dead-interval”. Fourth, troubleshooting questions: “A network engineer notices that an OSPF neighbor is stuck in the INIT state. What is the most likely cause?” The answer could be a mismatched Hello or Dead timer. The candidate must also consider other causes like mismatched area ID, network type, or authentication.

Fifth, performance questions: “What is the impact of reducing the Hello timer from 10 seconds to 1 second?” Correct answers: Faster failure detection, increased CPU usage, more bandwidth consumed by Hello packets. Sixth, design questions: “In a highly redundant core network, which Hello timer would provide the fastest convergence?” The candidate should propose a shorter timer but also note the trade-off. These question types appear in both multiple-choice and simulation-based exams. Candidates must be comfortable with both the concept and the Cisco IOS configuration syntax.

## Example scenario

A small company has two OSPF routers, R1 and R2, connected via a point-to-point serial link. Both are configured with default OSPF settings. R1 is a Cisco router with a Hello interval of 10 seconds and a Dead interval of 40 seconds. R2 is a Juniper router that defaults to a Hello interval of 30 seconds on serial links. When the network engineer tries to establish OSPF adjacency, the show ip ospf neighbor command on R1 shows R2 in the INIT state, and the adjacency never becomes FULL.

The engineer checks the logs and sees “Hello timer mismatch” error messages. She uses the “ip ospf hello-interval 30” command on R1’s serial interface to match R2’s timer. Within seconds, the two routers form a FULL adjacency. This scenario illustrates the most common real-world issue with OSPF timer configuration. The engineer also notices that after changing the Hello interval, the Dead interval on R1 changed to 120 seconds (4 x 30), which matched R2’s Dead interval of 120 seconds, confirming the adjacency formed.

In a follow-up test, the engineer wants to achieve faster convergence. She sets the Hello interval to 1 second and the Dead interval to 4 seconds on both routers. The adjacency forms immediately. She then simulates a link failure by shutting down R2’s interface. R1 detects the failure within 4 seconds and reroutes traffic through an alternative path. This demonstrates how Hello timer tuning directly affects network recovery time. The company’s mission-critical applications experience less downtime, improving overall reliability.

## Common mistakes

- **Mistake:** Assuming the Hello timer and Dead timer are independent and can be set arbitrarily without coordination.
  - Why it is wrong: OSPF requires that both Hello and Dead intervals match between neighbors. The Dead timer is typically four times the Hello timer by default, but if modified, both must be explicitly matched on both ends.
  - Fix: Always configure the Hello and Dead intervals as a pair. Use the same values on both routers. Use the “ip ospf dead-interval” command if you want a ratio different from 4:1.
- **Mistake:** Thinking that the Hello timer only affects how often routers hear from each other, not the actual neighbor state.
  - Why it is wrong: The Hello timer directly determines how quickly the Dead interval expires. If the Hello timer is long, failure detection is slow. Also, mismatched timers prevent the adjacency from forming at all.
  - Fix: Understand that Hello timers are a key part of the neighbor establishment process. Always verify timers with “show ip ospf interface” when troubleshooting.
- **Mistake:** Believing that the Hello timer on broadcast networks is 30 seconds because it is on NBMA networks.
  - Why it is wrong: The default Hello interval on broadcast (Ethernet) and point-to-point networks is 10 seconds, not 30 seconds. NBMA and point-to-multipoint networks default to 30 seconds.
  - Fix: Memorize the default timers per network type: broadcast and P2P = 10s; NBMA and P2MP = 30s. This is essential for exam questions.
- **Mistake:** Assuming that changing the Hello timer on one router automatically updates the neighbor’s timer.
  - Why it is wrong: OSPF does not synchronize timers between neighbors. Each router must be configured individually. The neighbor will not adjust its timer; it will simply reject the adjacency if timers differ.
  - Fix: Always configure the same timer values on all routers that need to form adjacencies. Use network automation or templates to ensure consistency.
- **Mistake:** Overlooking that the Dead interval defaults to four times the Hello interval, but if the Hello interval is changed, the Dead interval updates automatically on Cisco routers, but not on all vendors.
  - Why it is wrong: Some vendors do not auto-adjust the Dead interval. If the administrator only changes the Hello interval without explicitly setting the Dead interval, the Dead interval may remain at its previous value, causing a mismatch.
  - Fix: Always display the current timers after making changes using “show ip ospf interface”. If needed, set the Dead interval explicitly with “ip ospf dead-interval”.

## Exam trap

{"trap":"A question shows two routers with Hello intervals of 10s and 30s, but the Dead intervals are both 120 seconds. The candidate might think the adjacency will form because the Dead intervals match.","why_learners_choose_it":"Learners often focus on the Dead interval because it is the timeout that triggers neighbor down status. They mistakenly believe that as long as the Dead interval matches, the adjacency is fine, ignoring the Hello interval requirement.","how_to_avoid_it":"Remember that OSPF requires both Hello and Dead intervals to match between neighbors. The Hello interval is checked during neighbor discovery. If Hello timers differ, the routers will not even reach the 2-WAY state. Always verify both values with “show ip ospf interface”."}

## Commonly confused with

- **Hello timer vs Dead interval:** The Dead interval is the time (typically 4x Hello interval) a router waits without receiving a Hello packet before declaring the neighbor as down. The Hello timer is the frequency of sending Hello packets. They work together but are distinct: Hello is the heartbeat interval, Dead is the timeout after which the neighbor is considered dead. (Example: If Hello is 10s, Dead is 40s by default. A router expects a Hello every 10s, but if it misses four in a row (40s), it declares the neighbor down.)
- **Hello timer vs OSPF Hello packet:** The Hello packet is the actual message sent at each Hello interval. The Hello timer is the timing mechanism that dictates how often the Hello packet is sent. You could say the Hello timer is the schedule, and the Hello packet is the content. (Example: A Hello packet contains router ID, timers, neighbor list, etc. The Hello timer says when to send it. They are different but tightly related.)
- **Hello timer vs Hold time (in EIGRP):** EIGRP uses a ‘Hold time’ similar to OSPF’s Dead interval, but EIGRP sends Hello packets at a variable rate (default 5s on high-bandwidth links, 60s on low-bandwidth). Unlike OSPF, EIGRP’s Hold time is sent in the Hello packet and the receiving router uses the sender’s Hold time, not its own. In OSPF, both routers must have the same Dead interval. (Example: In OSPF, if Router A has a Dead interval of 40s and Router B has 120s, they won’t form an adjacency. In EIGRP, each router uses the other’s advertised Hold time, so mismatched configs can still work.)
- **Hello timer vs Update timer (in RIP):** RIP sends routing updates every 30 seconds by default (similar to a timer), but RIP does not use Hello packets for neighbor discovery. OSPF uses Hello packets specifically for neighbor maintenance and keeps the neighbor table separate from the routing update process. (Example: RIP updates contain the entire routing table. OSPF Hello packets contain only neighbor information and are much smaller. They serve different purposes.)

## Step-by-step breakdown

1. **Router powers on and enables OSPF on its interfaces** — When OSPF is configured on an interface, the router starts the OSPF process for that interface. It initializes its OSPF data structures, including the neighbor state machine. The Hello timer is set to the default interval for the network type (e.g., 10s for Ethernet).
2. **First Hello packet is sent** — As soon as the interface is up, the router sends its first Hello packet to the multicast address 224.0.0.5 (or 224.0.0.6 if it is a DR/BDR election). This packet announces the router’s presence to potential neighbors on the link.
3. **Neighbor router receives the Hello packet** — The neighbor router checks the contents of the Hello packet, including the Hello and Dead intervals. It verifies that these timers match its own. If they match, the neighbor moves to state INIT, indicating it has seen the Hello but the neighbor relationship is not yet bidirectional.
4. **Bidirectional communication established** — The neighbor sends its own Hello packet back, which includes the first router’s router ID in its neighbor list. When the first router receives this Hello, it sees itself listed, confirming bidirectional communication. The state then moves to 2-WAY, and if it is a broadcast network, the DR/BDR election may occur.
5. **Hello packets continue periodically** — Both routers now send Hello packets at every Hello interval. These act as keepalives. The routers track the time since the last Hello from each neighbor. If no Hello is received within the Dead interval, the neighbor is declared dead and the adjacency is torn down, triggering a new SPF calculation.
6. **Failure detection and convergence** — When the Dead interval expires without a Hello, the router changes the neighbor state to DOWN, removes all routes learned from that neighbor, and runs the SPF algorithm to find alternative paths. The speed of detection depends directly on the Dead interval, which in turn depends on the Hello timer.

## Practical mini-lesson

The Hello timer is one of the first things you configure and verify when setting up OSPF in a real network. In practice, you will use the “ip ospf hello-interval” command under interface configuration mode to change it. But before you change it, you must understand what happens to the Dead interval. On Cisco routers, if you set the Hello interval to 5 seconds, the Dead interval automatically becomes 20 seconds. That is fine if both ends use Cisco defaults. But if your neighbor is a different vendor, you must set both timers explicitly.

When you verify OSPF timers, use “show ip ospf interface [interface]”. This command shows the current Hello interval, Dead interval, network type, and neighbor state. For example, “show ip ospf interface GigabitEthernet0/1” might show “Hello due in 00:00:07” and “Dead timer due in 00:00:37”. That tells you the last Hello was sent 3 seconds ago, and the next is due in 7 seconds. The Dead timer counts down from 40 seconds. If you see the Dead timer staying near 40 seconds without resetting, it means Hello packets are not being received properly.

In real networks, the biggest mistake is forgetting to configure timers on both ends. You add a new router to an existing OSPF area and copy the configuration from a template. But someone earlier changed the Hello timer on the old routers to 1 second for disaster recovery links. If your new router defaults to 10 seconds, the adjacency fails. Always check timers after adding a new neighbor. Also, be careful with network types. On a Frame Relay network, the default Hello is 30 seconds. If you change the network type to point-to-point, the Hello defaults to 10 seconds. This can cause adjacency failures if the neighbor still uses the NBMA default.

For performance tuning, some engineers use sub-second Hello timers on sensitive links. For example, Hello 333 milliseconds with Dead 1 second. But this requires careful planning. It increases CPU usage because Hello packets are processed more often. It also increases bandwidth usage, though Hello packets are small. Many organizations limit sub-second timers to critical links only. Finally, always document your timer changes. Without documentation, months later a new engineer may wonder why the OSPF timers are non-standard and mistakenly revert them, causing unexpected convergence delays.

## Memory tip

Hello every 10, Dead times 4: on Ethernet, Hello is 10, Dead is 40. Keep them matched to avoid a neighbor’s fate.

## FAQ

**What happens if two OSPF routers have different Hello timers?**

They will not form an OSPF adjacency. The routers will remain stuck in the INIT state because the Hello interval must match for the adjacency to proceed to 2-WAY.

**How do I change the OSPF Hello timer on a Cisco router?**

Use the “ip ospf hello-interval seconds” command in interface configuration mode. For example, “ip ospf hello-interval 5” sets the Hello timer to 5 seconds.

**What is the default Hello timer on an Ethernet interface in OSPF?**

The default Hello timer on broadcast and point-to-point networks (including Ethernet) is 10 seconds.

**Does the Dead timer change automatically when I change the Hello timer?**

On Cisco routers, yes, the Dead timer defaults to four times the Hello interval. But you must check if the neighbor uses the same logic. It is safer to set both explicitly.

**Can I use a Hello timer of 0 seconds?**

No. A Hello timer of 0 would mean no Hello packets are sent, which would make neighbor discovery and maintenance impossible. OSPF requires periodic Hello packets to function.

**Why is the Hello timer important for convergence?**

The Hello timer determines how quickly a router can detect a neighbor failure. A shorter Hello timer leads to faster detection and faster rerouting, but at the cost of more overhead.

**Is the Hello timer the same for OSPFv3 (IPv6)?**

Yes, OSPFv3 uses the same Hello timer concept and default values as OSPFv2, but the multicast addresses and authentication methods differ.

## Summary

The Hello timer is a foundational element of the OSPF routing protocol, controlling the frequency of Hello packet transmissions used for neighbor discovery and keepalive. Without the Hello timer, OSPF routers cannot establish or maintain adjacency, and the network would be unable to react to link failures. The default values vary by network type: 10 seconds on broadcast and point-to-point links, 30 seconds on NBMA and point-to-multipoint links. The Dead interval is typically four times the Hello interval, and both must match between neighbors for the adjacency to form.

For IT certification candidates, mastering the Hello timer means knowing its default values, how it interacts with the Dead interval, and what commands are used to configure and verify it. It is a frequent topic on CCNA, CCNP, CompTIA Network+, and JNCIA exams, appearing in direct recall questions, scenario-based troubleshooting, and performance analysis. The most common exam trap is overlooking that both Hello and Dead intervals must match, not just one.

In real-world practice, the Hello timer is a key tool for tuning network convergence. Network engineers adjust it on critical links to reduce failover time, but must balance against increased CPU and bandwidth overhead. Understanding the Hello timer is essential for anyone building or troubleshooting OSPF networks. Always document timer changes, verify with “show ip ospf interface”, and ensure consistency across all routers in the same OSPF area.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/hello-timer