IS-IS FOR OSPF USERS

A FUN & PRACTICAL GUIDE FOR CISCO

27-MARCH-2025

TOPOLOGY
INTERMEDIATE SYSTEM TO INTERMEDIATE SYSTEM

IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
INTRODUCTION - WHAT IS IS-IS?
IS-IS (Intermediate System to Intermediate System) is a link-state routing protocol like OSPF. It
builds a map of the network and calculates the best path using the Shortest Path First (SPF)
algorithm.
But IS-IS has its quirks:
1. It was originally designed for OSI (not TCP/IP) but adapted for IP.
2. It runs directly over Layer 2 (no IP headers like OSPF’s use of IP protocol 89).
3. It doesn’t have Area 0 drama—just Levels (Level 1 for intra-area, Level 2 for inter-area).
Think of IS-IS as OSPF’s cousin—the one that’s quieter, efficient, and doesn’t make a fuss about
areas.

IS-IS VS OSPF - WHAT’S DIFFERENT?

Feature OSPF IS-IS

Runs on IP (Protocol 89) Layer 2 (No IP header)

Area Structure Strict Area 0 Backbone Levels (L1, L2)

Addressing Uses IP Addresses Uses NSAP Addresses

Neighbor Discovery Multicast Hello (224.0.0.5) Directly over Layer 2

Metric Cost (default 100 on interfaces) Cost (default 10 on interfaces)

So if OSPF is a strict schoolteacher demanding Area 0, IS-IS is the laid-back professor

who says, “Just call them Levels, and we’ll be fine.”

2 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
IS-IS AT THE PACKET LEVEL - THE GEEKY, FUN VERSION
Alright, let’s get real—understanding IS-IS packets can sound as exciting as watching
paint dry. But fear not! We’re going to make this an IS-IS deep dive that even your non-
techie friend would (almost) enjoy.

IS-IS PACKET TYPES - THE FANTASTIC FIVE

IS-IS doesn’t use traditional IP packets. Nope, it’s too cool for that. Instead, it has its
own special PDUs (Protocol Data Units). Think of these like different types of emails in
your inbox—some are useful, some are annoying, and some are just plain weird.

PDU Type Purpose (a.k.a. Why You Should Care)

Hello (IIH - IS-IS Hello) "Hey neighbor, wanna be friends?" Establishes adjacencies.
LSP (Link-State PDU) "Here’s my resume!" Advertises routes and capabilities.
CSNP (Complete Sequence Number "Here’s a full directory of what I know." (Like a database
PDU) backup).
PSNP (Partial Sequence Number "Hey, I think I missed something. Can you resend that?"
PDU)
LSP Fragment "Oops, my LSP was too big. Let me break it into smaller
pieces."

Now, if you’re thinking, “Wait, why does IS-IS have a whole system that sounds like
postal mail?”—well, that’s because it’s like an old-school librarian. Everything must be
logged, checked, and cross-checked.

3 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
IS-IS HEADER - THE ID BADGE FOR EVERY PACKET
Since IS-IS skips IP altogether (yup, it doesn’t even use IP headers), it has a unique
packet structure. Here’s what a typical IS-IS packet looks like:

IS-IS PACKET ANATOMY (BECAUSE DISSECTIONS ARE FUN)

Protocol ID (1 byte) 0x83 (Tells us it's IS-IS)

Length Indicator (1 byte) "Hey, this is how long I am"
Version (1 byte) "I’m Version 1. You’re stuck with me."
LSP ID (8 bytes) "My name tag: Unique router ID"
Sequence Number (4 bytes) "How many times have I updated?"
TLVs (Variable) "Here’s where the juicy info is!"
PDU Type (1 byte) "What kind of IS-IS packet am I?"

It’s like a VIP pass—without it, your IS-IS updates aren’t getting past the bouncer.

4 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
IS-IS TLVS (TYPE-LENGTH-VALUE FIELDS) - THE SECRET
SAUCE

IS-IS relies on TLVs to carry the actual routing info. It’s like a buffet—only take what
you need. OSPF, on the other hand, is that restaurant where you must order a full
meal even if you just wanted fries.

TLV Type What It Does

1 (Area Address) "Hey, I belong to Area 49.0001"
2 (IS Reachability) "Here are the routers I can talk to!"
6 (IS Neighbors) "These are my cool friends."
10, 128-131 (IP Reachability) "I know these networks exist."
135 (Extended IP Reachability) "I can do fancy things like Traffic Engineering!"

EXAMPLE OF AN IS-IS LSP TLV

Inside an IS-IS LSP, you might see:

TLV Type: 135 (Extended IP Reachability)

Length: 12
IPv4 Prefix: 192.168.1.0/24
Metric: 10
Sub-TLV: "I support Segment Routing, deal with it."

Translation: "I can get you to 192.168.1.0/24 in 10 hops. Also, I’m cool enough for
Segment Routing!"

5 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
ACTUAL EXAMPLE BREAKDOWN OF THE SUB-TLV FOR
SEGMENT ROUTING

TLV Type: 135 (Extended IP Reachability)

Length: 12
IPv4 Prefix: 192.168.1.0/24
Metric: 10
Sub-TLVs:
- Type: 31 (Prefix-SID)
- Length: 7
- Flags: 0x40 (No-php)
- Algorithm: 0 (SPF-based Algorithm)
- MPLS Label: 16010

What This Means:

• TLV 135 advertises reachability for 192.168.1.0/24.

• Sub-TLV 31 (Prefix-SID) indicates that this prefix has a Segment Routing MPLS Label
16010.

• Flags (0x40, No-PHP) means Penultimate Hop Popping (PHP) is disabled (i.e., the label
stays until the final destination).

• Algorithm 0 means the label is assigned using default SPF routing.

6 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
IS-IS NET ADDRESS - THE ROUTER'S SECRET IDENTITY
Ever wondered what the NET address in IS-IS actually means? If you're coming from OSPF, you’re
probably thinking, "Just give me a router ID and be done with it!" But IS-IS is a bit more...
sophisticated. Instead of a simple IP-based identity, it has its own special Network Entity Title
(NET)—think of it as a router’s secret superhero identity that makes IS-IS work.

WHAT ARE IS-IS NET ADDRESS?

The NET (Network Entity Title) is a 10-byte (or longer) address that uniquely identifies a
router in an IS-IS network. It’s like a router’s passport number, except instead of boring digits, it
follows a cool hierarchical format.

The NET address is made up of three parts:

Area Address → "Which neighborhood am I in?"

System ID → "Who am I, really?"
NSEL (NSAP Selector) → "What’s my role at the party?" (Always 00 for IS-IS routers)

BREAKING DOWN A NET ADDRESS

Let’s say you have the following NET address:

49.0001.1921.6800.1001.00

Here’s what each part means:

Component Value Meaning

Area Address 49.0001 "I belong to Area 49.0001" (Think of this as an OSPF Area)
System ID 1921.6800.1001 "I am Router X!" (Similar to a Router ID, but 6 bytes long)
NSEL 00 "I'm a router, not an application" (Always 00 for IS-IS)

Now, if routers were in a club, the Area Address would be their table number, the System ID
would be their name tag, and the NSEL would tell the bouncer if they were a VIP or just a regular
guest (spoiler: routers are always "00").

7 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
HOW TO CHOOSE A SYSTEM ID?
Unlike OSPF, where the Router ID is just a single IP address, IS-IS wants a 6-byte System ID.
You can pick any unique value, but a common trick is:

Use an IP address (without dots!)

• Example: If the loopback IP is 192.168.1.1, you can format it as 1921.6800.1001

Use a simple numbering scheme

• Example: R1 = 0000.0000.0001, R2 = 0000.0000.0002

Use MAC addresses (if you like long and messy things)

Whatever you pick, just make sure it's unique across the IS-IS domain!

HOW IS-IS HANDLES UPDATES (AKA "WHY IT DOESN’T

FREAK OUT LIKE OSPF")

OSPF floods LSAs like a panicked intern sending mass emails. IS-IS? Nah, it’s way more relaxed.

1. New LSPs are generated when topology changes. (Think: “Hey, new route available!”)

2. LSPs have sequence numbers to keep track of updates. (Like version numbers on a
document.)

3. CSNPs act like a full index of known LSPs. (Sent periodically to ensure everyone is on the
same page.)

4. PSNPs help routers request missing LSPs. (Like asking for a re-send of an email you missed.)

5. LSP Aging makes sure expired routes get tossed. (No hoarding of old data!)

END RESULT? IS-IS is more efficient and doesn’t have the same LSA flooding headaches as
OSPF.

8 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
WIRESHARK TIME - CATCHING AN IS-IS HELLO PACKET IN
ACTION
If you fire up Wireshark and capture an IS-IS Hello packet, here’s what you might see:

Frame 1: 100 bytes on wire

Ethernet II
Destination: 01:80:C2:00:00:14 (IS-IS multicast)
Source: 00:1A:2B:3C:4D:5E (Router MAC)
Type: IS-IS (0x8100)
IS-IS Hello
Protocol Discriminator: 0x83
PDU Type: 15 (IIH)
Circuit Type: Level 2
Holding Time: 30 seconds
TLVs:
Area Address TLV: 49.0001
IS Neighbors TLV: 00:1A:2B:3C:4D:5E (Neighbor Router)

What this means:

• "Hey, I’m sending an IS-IS Hello!"

• "I belong to Area 49.0001!"
• "I want to be friends with 00:1A:2B:3C:4D:5E"

If the neighbor likes your back, an adjacency forms. If not? Well, it’s not you, it’s them.

WHY IS-IS IS MORE EFFICIENT THAN OSPF AT THE PACKET

LEVEL

1. No LSA Types Mess – OSPF has 11 types of LSAs, IS-IS has just LSPs.
2. No IP Overhead – Runs directly on Layer 2, skipping unnecessary IP processing.
3. Faster SPF Computation – Thanks to its streamlined database and simple flooding
mechanism.
4. Smaller Packet Sizes – TLVs allow compact updates instead of rigid, bloated LSAs.

IS-IS IS LIKE A MINIMALIST—NO UNNECESSARY COMPLEXITY, JUST EFFICIENCY.

9 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
NETWORK TOPOLOGY – ISIS

All routers will run Cisco IOS XR and form an IS-IS Level 2 network (like OSPF Area 0).

10 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
STEP-BY-STEP IS-IS CONFIGURATION ON CISCO

STEP 1: ENABLE IS-IS ON ALL ROUTERS

Go to each router and enable IS-IS in Level-2 mode (like OSPF Area 0).

R1 CONFIGURATION

router isis CORE

net 49.0001.0000.0000.0001.00
is-type level-2
interface GigabitEthernet0/0/0/0
point-to-point
address-family ipv4 unicast
enable
interface GigabitEthernet0/0/0/1
point-to-point
address-family ipv4 unicast
enable

R2 CONFIGURATION

router isis CORE

net 49.0001.0000.0000.0002.00
is-type level-2
interface GigabitEthernet0/0/0/0
point-to-point
address-family ipv4 unicast
enable
interface GigabitEthernet0/0/0/1
point-to-point
address-family ipv4 unicast
enable

11 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
R3 CONFIGURATION

router isis CORE

net 49.0001.0000.0000.0003.00
is-type level-2
interface GigabitEthernet0/0/0/0
point-to-point
address-family ipv4 unicast
enable
interface GigabitEthernet0/0/0/1
point-to-point
address-family ipv4 unicast
enable

R4 CONFIGURATION

router isis CORE

net 49.0001.0000.0000.0004.00
is-type level-2
interface GigabitEthernet0/0/0/0
point-to-point
address-family ipv4 unicast
enable
interface GigabitEthernet0/0/0/1
point-to-point
address-family ipv4 unicast
enable

12 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
STEP 2: IS-IS VERIFICATION

R1# show isis adjacency

IS-IS CORE adjacencies:

System ID Interface State Hold Time Type
Priority
0000.0000.0002 Gi0/0/0/0 Up 23s L2 64
0000.0000.0004 Gi0/0/0/1 Up 29s L2 64

R1# show isis database

IS-IS CORE Level-2 Link State Database:

LSPID Seq Num Checksum Holdtime ATT/P/OL
0000.0000.0001-00 0x00000003 0x1234 645 0/0/0
0000.0000.0002-00 0x00000007 0x5678 660 0/0/0
0000.0000.0003-00 0x00000005 0x9abc 578 0/0/0
0000.0000.0004-00 0x00000008 0xdef0 599 0/0/0

R1# show route isis

I L2 10.2.2.0/24 [115/20] via 192.168.12.2, Gi0/0/0/0

I L2 10.3.3.0/24 [115/30] via 192.168.12.2, Gi0/0/0/0
I L2 10.4.4.0/24 [115/20] via 192.168.14.4, Gi0/0/0/1

13 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!
IS-IS KEY TAKEAWAYS FOR OSPF USERS
• Forget Area 0 Drama – Just set Level 2 for all routers.

• No Need for IP in Hello Packets – IS-IS runs directly on Layer 2.

• IS-IS Uses a Single SPF Tree – No multiple databases like OSPF.

• Metrics Work Similarly – Default cost is 10 instead of 100.

• Faster Convergence – No LSA flooding issues like OSPF.

FINAL WORDS: WHY SHOULD YOU CARE?

If OSPF is a dramatic soap opera (with Area 0 politics, ABRs, and LSAs causing drama), IS-IS is a
chill, organized documentary—clean, structured, and free of unnecessary emotions.

IS-IS may not be as common as OSPF, but it’s widely used in service provider networks due to its
simplicity, scalability, and stability. If OSPF is your first love, IS-IS might just be your cool, low-
maintenance second relationship.

Now that you know how IS-IS works at the packet level, go ahead and fire up Wireshark! Capture
some IS-IS packets, analyze them, and see just how efficient it really is.

Next time, we’ll dive into ECMP, Traffic Engineering, and Segment Routing—because why
settle for basic routing when you can optimize the path like a pro? Stay tuned!

HAPPY LABBING!

14 IS-IS FOR OSPF USERS | By Meraj Hassan – Keep Calm & Route On!