IS-IS does the same job as OSPF: every router learns the whole map and runs a shortest-path calculation over it. But it was designed for a different network layer, it does not run on IP at all, and it describes everything it knows as a row of small typed records. Those three facts explain why so many large backbones run it, and why it absorbed IPv6, traffic engineering and segment routing with so little fuss.
Common mix-up: running IS-IS does not mean running OSI. Your network still forwards IPv4 and IPv6 packets, and IS-IS still computes IPv4 and IPv6 routes. The only OSI thing left is the protocol's own plumbing: each router needs an OSI-style name, its NET, and IS-IS packets are framed for an OSI link layer. "Intermediate system" is simply OSI's word for a router; a host is an "end system."
If link-state routing is new to you, start with dynamic routing on networks.jelia.nyc, which floods a small network and runs Dijkstra on it. This chapter assumes that picture and goes inside one particular protocol. The previous chapter, OSPF in depth, does the same for OSPF; here we only borrow OSPF for comparison.
In the late 1980s the world was expected to move from TCP/IP to the OSI protocol suite, a set of standards from the International Organization for Standardization. OSI had its own network layer, the Connectionless Network Protocol (CLNP), with its own addresses, called NSAPs. It needed a routing protocol, and engineers at Digital Equipment Corporation designed one: the Intermediate System to Intermediate System intra-domain routeing protocol. It became the international standard ISO/IEC 10589. In February 1990 the IETF republished a draft of it as RFC 1142 so that internet engineers could read it. That RFC is now only of historic interest: RFC 7142 moved it to Historic status in 2014 and pointed everyone at the current ISO edition, ISO/IEC 10589:2002.
Ten months later, in December 1990, Ross Callon of DEC published RFC 1195, "Use of OSI IS-IS for Routing in TCP/IP and Dual Environments." Its idea was simple and lasting. Keep IS-IS exactly as it was, and add a few new records to its packets that describe IP prefixes. One protocol, one set of adjacencies, one shortest-path calculation, and routes for both CLNP and IP come out of it. This is "Integrated IS-IS," and it is what everyone means by IS-IS today.
OSI never displaced TCP/IP. CLNP is gone from almost every network. Integrated IS-IS stayed, because it turned out to be a very good IP routing protocol, especially for large service-provider backbones that want one simple, fast, flat interior protocol under BGP. The rest of this chapter explains why.
OSPF is an IP protocol. Its packets are IP packets with protocol number 89 (RFC 2328), and OSPF for IPv6 is a separate protocol version with its own packets (RFC 5340). IS-IS packets are not IP packets. On Ethernet they are carried in an 802.2 LLC frame addressed to the OSI network layer's service access point, 0xFE, and sent to one of two multicast MAC addresses that ISO 10589 reserves: 01-80-C2-00-00-14 for all level 1 routers and 01-80-C2-00-00-15 for all level 2 routers. If Ethernet frames, MAC addresses and multicast are hazy, Ethernet on networks.jelia.nyc covers them.
That one design choice has three consequences you can feel in day-to-day operation.
Every IS-IS router has a Network Entity Title, or NET: an OSI address that names the router itself rather than any interface. It is written in dotted hexadecimal and has three parts. Read it right to left.
The last byte, the selector, is always 00 in a NET; it means "the routing entity itself." The six bytes before it are the system ID, which must be unique in the whole IS-IS domain; it is the router's real identity, and it appears in every hello and every LSP. Everything to the left is the area address. A router can list up to three area addresses, which is how areas are merged or renumbered without an outage.
Operators often build the system ID from the router's IPv4 loopback address, so that 192.0.2.1 becomes 1920.0000.2001 and the two identities are easy to match by eye. The 49 at the front is the prefix you will see in almost every lab and in documentation, FRRouting's own examples included. There is nothing to route to here: the NET is a name the protocol needs for itself, and it has no effect on the IP addresses the network carries.
A link-state database grows with the network, and every change makes every router recompute. Both OSPF and IS-IS answer this with a two-level hierarchy, but they cut the network in different places.
In OSPF, an area boundary runs through the middle of a router. Each interface belongs to an area, and an area border router has interfaces in area 0 and in another area. In IS-IS, each router belongs to exactly one area, and the boundary between areas runs along the links between routers. A router plays one of three roles.
So the IS-IS backbone is not an area in the OSPF sense. It is the set of routers running level 2, joined by level 2 adjacencies, and it may pass through any number of areas, as long as it is contiguous. A level 2 adjacency never cares about area addresses; a level 1 adjacency requires them to match.
A level 1 router has no idea what lies beyond its area, so how does it send anything there? Through the attached bit. An L1/L2 router that can reach some other area through the level 2 backbone sets the ATT bit in the header of the LSP it floods into level 1. Every level 1 router treats the nearest router with ATT set as the way out, and installs a default route toward it (RFC 1195).
"Nearest" is the catch. The level 1 router measures the distance to the edge of its own area and stops there, because it cannot see past it. If the closest door opens onto a long road, traffic takes the long road. This is the suboptimal exit problem, and the fix is route leaking: the L1/L2 routers copy specific prefixes from level 2 down into their level 1 LSPs, with their full costs, so a level 1 router can compare doors by the whole trip. Leaked prefixes carry the up/down bit so that no L1/L2 router ever copies them back up into level 2, which could otherwise create a loop (RFC 5302).
Ten routers, twelve links, and you decide the hierarchy. Tap a router to change its level or area, tap a link to change its cost, then pick a source and a destination. The program does what the routers would do: it works out which adjacencies form, builds each router's level 1 and level 2 databases, decides who sets the attached bit, runs Dijkstra in every database, and then forwards a packet hop by hop, each router consulting only its own tables. Try "Suboptimal exit," then switch route leaking on.
| Router | Role · NET | Level 1 database (LSPs from) | Level 2 database | Route to destination |
|---|
Legend: thin line = level 1 adjacency, thick line = level 2 adjacency, thick double line = both, dashed line marked ✕ = the link is up but no adjacency forms. The chosen path is the bold line with arrows; the dashed line with arrows is the path the other leaking setting would take. Every link here is point to point, so there are no pseudonodes; loopbacks are 192.0.2.1 to 192.0.2.10.
Real L1/L2 routers inject their level 1 prefixes into level 2 automatically; the designer does the same, with the cost of the level 1 path added. It treats every prefix as internal, ignores external routes and the older "narrow" metric limit of 63 on inter-area routes, and it decides the attached bit the way ISO 10589 describes: an L1/L2 router is attached when its level 2 database shows a router in some other area. Vendors add knobs on top, such as suppressing the attached bit or ignoring it on receipt; FRRouting's attached-bit command is one example.
Route leaking in a real router is a policy you write, usually "leak only these loopbacks," not a switch that copies everything. The designer leaks every level 2 prefix, which is the simplest case to watch.
OSI calls packets protocol data units, PDUs. IS-IS has four kinds, each in a level 1 and a level 2 flavor, and every one starts with the same 8-byte header whose first byte is 0x83, the number ISO assigned to say "this is IS-IS."
| PDU | Type codes | What it does | Closest OSPF relative |
|---|---|---|---|
| IIH | 15, 16 (LAN L1, L2) · 17 (point to point) | IS-IS hello: discovers neighbors, carries area addresses, priority and the protocols supported, and keeps adjacencies alive. | Hello |
| LSP | 18 (L1) · 20 (L2) | Link state PDU: one router's whole description of itself (neighbors, prefixes, capabilities) as a list of TLVs, with a sequence number and a remaining lifetime. | All the LSA types, inside Link State Updates |
| CSNP | 24 (L1) · 25 (L2) | Complete sequence numbers PDU: a summary of every LSP in the database (ID, sequence number, lifetime, checksum). Sent periodically by the DIS on a LAN and once when a point-to-point adjacency comes up. | Database Description |
| PSNP | 26 (L1) · 27 (L2) | Partial sequence numbers PDU: "I am missing these" on a LAN, or "I got these" as an acknowledgment on a point-to-point link. | Link State Request and Link State Ack |
An LSP is the router's whole self-description, not a family of separate advertisements. When something changes, the router bumps the sequence number and floods a new copy; newer sequence numbers replace older ones everywhere. Every LSP also carries a remaining lifetime, counted down in seconds while it sits in a database. In ISO 10589 the maximum is MaxAge, 1200 seconds, so a router refreshes its LSPs before they run out; an LSP whose lifetime reaches zero is purged from every database. The lifetime sits outside the checksum, so routers can count it down without recomputing anything. If one router's self-description is too long for one packet, it is split into numbered fragments; the last byte of the LSP ID is the fragment number.
On a shared segment such as an Ethernet LAN, IS-IS elects a designated intermediate system, the DIS. ISO 10589 makes the rule plain: the router with the highest priority wins, and the numerically highest MAC address breaks ties. The DIS does two jobs. It originates a pseudonode LSP on behalf of the segment, so that a LAN with ten routers appears in the database as eleven nodes in a star (ten routers each linked to the pseudonode) rather than as 45 router-to-router links. And it multicasts CSNPs, so every router on the LAN can spot what it is missing and ask with a PSNP.
| On a LAN | IS-IS DIS | OSPF designated router |
|---|---|---|
| Who wins | Highest priority, then highest MAC address | Highest priority, then highest router ID |
| Backup | None. If the DIS fails, a new one is elected, and its new pseudonode LSP replaces the old one. | A backup designated router, already adjacent to everyone, takes over at once |
| Pre-emption | Yes. A newcomer with higher priority becomes DIS as soon as the election runs again. | No. A router that joins accepts the existing DR "regardless of its Router Priority" (RFC 2328) |
| Adjacencies | Every router is adjacent to every other router on the LAN | Routers become fully adjacent only with the DR and backup |
In OSPF, routers on a LAN synchronize their databases only with the DR and the backup, so losing the DR without a backup would cut the LAN off from flooding while a new one caught up. In IS-IS every router on the LAN is adjacent to every other, and every router multicasts its LSPs to all of them. The DIS only adds a safety net (the periodic CSNP) and a bookkeeping node (the pseudonode). If it disappears, flooding carries on; the next election picks a successor, which issues its own pseudonode LSP, and the stale one ages out or is purged. Losing the DIS is a small event, so there is little to gain from a standby.
Point-to-point links have no DIS at all. The original standard assumed point-to-point links were reliable at the link layer and used a two-way hello; RFC 5303 added a three-way handshake so that a router only declares an adjacency up once it has seen itself listed in its neighbor's hello. It is common to configure an Ethernet link that joins exactly two routers as point to point to skip the DIS election entirely.
After its fixed header, every IS-IS PDU is a sequence of records in one shape: one byte of type, one byte of length, then that many bytes of value. A TLV. A router reads the type, reads the length, and knows exactly where the next record starts, whether or not it understands this one. ISO 10589 makes the rule explicit for LSPs: codes that a router does not recognize are "ignored and passed through unchanged." A router that predates a feature still floods the records that describe it.
That is why IS-IS grew so easily. IP support in 1990 was a handful of new TLV types. Every later feature was too.
| TLV | Name | Defined in | What it carries |
|---|---|---|---|
| 1 | Area addresses | ISO 10589 | The router's area address or addresses |
| 2 | IS reachability | ISO 10589 | Neighbors, each with a 6-bit cost ("narrow" metric) and three unused metric bytes |
| 128 · 130 | IP internal / external reachability | RFC 1195 | IPv4 prefixes as address and mask, with 6-bit costs |
| 129 | Protocols supported | RFC 1195 | Network-layer protocol IDs: 0xCC for IPv4, 0x8E for IPv6 |
| 132 | IP interface address | RFC 1195 | The router's IPv4 addresses |
| 22 | Extended IS reachability | RFC 5305 | Neighbors with a 24-bit cost and room for sub-TLVs (bandwidth, admin groups for traffic engineering) |
| 135 | Extended IP reachability | RFC 5305 | IPv4 prefixes with a 32-bit cost and the up/down bit |
| 137 | Dynamic hostname | RFC 5301 | A readable name, so tools can show "core1" instead of 0000.0000.0001 |
| 232 · 236 | IPv6 interface address · IPv6 reachability | RFC 5308 | IPv6 addresses and prefixes, 32-bit cost, up/down bit |
The "wide metrics" story shows the pattern. The original IS reachability TLV gave each neighbor one byte of default metric, two bits of which were flags, leaving a cost of 0 to 63; RFC 5305 calls this "one of the restrictions that we would like to lift." With a ceiling that low, a 100 Gb/s link and a 1 Gb/s link are hard to tell apart. Rather than change TLV 2, RFC 5305 defined new types, 22 for neighbors and 135 for IPv4 prefixes, with 24-bit and 32-bit costs and space for sub-TLVs. IPv6 (TLV 236) was born wide. Multi-topology routing (RFC 5120) adds topology-tagged copies of the same records, and segment routing (RFC 8667) hangs a Prefix-SID sub-TLV inside TLVs 135 and 236; Chapter 12 explains what those segment IDs are for.
A router that only understands narrow metrics ignores TLVs 22 and 135, so it sees a network with no neighbors and no prefixes from the routers that send only wide ones. Every router in an area must agree. Implementations therefore offer a transition mode that sends both encodings and accepts both; FRRouting calls the three settings metric-style narrow, transition and wide. The usual migration is to move every router to transition, then every router to wide, then raise the link costs that were squeezed under 63.
This builds a real level 1 or level 2 LSP, byte for byte, from the TLVs you tick, and decodes it the way a router would: header first, then type, length, value, until the bytes run out. Click a decoded row to see its bytes, or click a byte to see what it means. The hex box is editable, and the decoder reads whatever is in it, so you can change a byte by hand. Then try the buttons that damage the packet: a TLV whose length points past the end of the PDU is exactly the kind of fault a parser must catch.
Both protocols flood link-state information, both run Dijkstra, and both can be tuned to converge quickly (Chapter 7 covers how). The differences are in structure and habit, not in raw ability.
| Question | IS-IS | OSPF |
|---|---|---|
| Carried in | Link-layer frames, no IP | IP packets, protocol 89 (RFC 2328) |
| IPv4 and IPv6 | One instance carries both (RFC 5308) | OSPFv2 for IPv4, OSPFv3 for IPv6 (RFC 5340), which can also carry IPv4 with address families |
| Area boundary | On links; each router is in one area | Inside routers; each interface is in one area |
| Backbone | Any contiguous set of level 2 routers | Area 0, which all other areas must touch (or reach by a virtual link) |
| Leaving a small area | Default route toward the nearest attached L1/L2 router; leaking optional | Summary LSAs bring inter-area routes in by default; stub areas trade them for a default |
| What a router floods | One LSP per router (in fragments), made of TLVs | Many LSA types, each with its own fixed format |
| Adding a feature | New TLV or sub-TLV; unknown ones are flooded on unchanged | New LSA type or opaque LSA; OSPFv3 made unknown-LSA handling explicit |
| On a LAN | DIS: pre-emptive, no backup, pseudonode LSP | DR and BDR: not pre-emptive, network LSA |
| Router identity | 6-byte system ID inside a NET | 32-bit router ID, written like an IPv4 address |
| Reachable from off-link | No: frames are never routed | Yes, unless filtered: packets are routed IP |
OSPF's advantages are familiarity and fit. It is IP-native, taught everywhere, and its rich area types (stub, totally stubby, not-so-stubby) give enterprise networks fine control over what each area sees. IS-IS's advantages show up at scale and over time: a flat single-level design is easy to run, the protocol is indifferent to the IP version, and the TLV format has let operators turn on new features without redesigning the protocol. Neither is "better." Large backbones often choose IS-IS for those reasons; enterprises more often choose OSPF.
Many large IS-IS backbones run a single level, often level 2 only, across hundreds of routers. Routers are fast enough to flood and compute a database of that size quickly, and one level means no attached bits, no suboptimal exits and no leaking policy to maintain. Levels are still there for the day the network outgrows one database. Because areas in IS-IS end at routers, a level 1 area can later be carved out of a flat level 2 network by changing the role of a few routers, without renumbering interfaces.