Summary

  • OSPFv2 orders instances of one LSA with signed 32-bit sequence numbers, from 0x80000001 to 0x7fffffff; it cannot wrap directly because a surviving maximum-valued copy would defeat a newly issued minimum-valued one.
  • The originator therefore floods the maximum instance at MaxAge, waits until the withdrawal is acknowledged and safe to remove, and only then originates a new initial instance—an explicit boundary between two sequence epochs.

The circle that OSPF removed

The first published OSPF specification did not treat its sequence counter as a simple line. RFC 1131, issued in October 1989, drew a lollipop: a startup stem led into a circular sequence space. The shape tried to solve two problems at once. A router coming to life needed values that could outrank state left from an earlier incarnation, while a router that stayed alive needed to keep issuing fresh link-state advertisements.

Two years later, OSPF version 2 abandoned the circle. RFC 1247 listed the lollipop space among the problems corrected from version 1. The replacement was a line of signed 32-bit integers. The reserved value 0x80000000 was excluded; 0x80000001 became the first and therefore oldest usable value, and 0x7fffffff the last and newest.

Linear order made comparison wonderfully plain. For two instances of the same link-state advertisement, the larger signed sequence number was newer. But a line has an edge. Once an LSA reached the maximum, the protocol could not pretend that the next increment returned to the beginning without consequences.

Why arithmetic wrap would reverse truth

An OSPF LSA is identified by its type, Link State ID and Advertising Router. The sequence number does not order the whole link-state database; it orders successive versions inside that identity. A neighbor holding sequence 0x7fffffff must prefer it to a copy numbered 0x80000001.

That comparison remains correct even when the originator has exhausted the counter. If it simply wrapped and sent a changed LSA at the initial value, every router still retaining the maximum copy would call the old contents newer. Flooding would preserve the past precisely when the originator meant to replace it.

Clock time cannot quietly settle the dispute. LS age advances as an advertisement travels and waits, and routers may restart with different local memories. Nor can silence prove that the maximum copy has vanished. A neighbor may keep it, retransmit it or present it during database synchronization.

OSPFv2 therefore did not define clever wraparound arithmetic. It defined an epoch boundary.

Withdrawal became a flooded object

When an originator needs another version after MaxSequenceNumber, RFC 2328 makes it take the existing maximum-valued instance and set its LS age to MaxAge. The router refloods that instance through the routing domain. This deliberate early expiry is called premature aging.

The act is narrowly authorized. A router may prematurely age an LSA that it originated; it does not gain a general right to erase another router's advertisements. The identity remains the same, and so do the maximum sequence and content checksum. What changes is the age field, which is excluded from the LSA checksum because it must increase in transit.

MaxAge is not passive decay in this setting. If two otherwise identical instances have the same sequence and checksum, the MaxAge instance is considered newer than the non-MaxAge copy. The tombstone can therefore displace a still-living copy rather than waiting for every copy's independent clock to reach one hour.

The withdrawal also has a precise scope. It removes this LSA instance from OSPF's flooding database. It does not prove that a physical link is down, that a router is unreachable, or that no other LSA can support a route to a destination.

Forgetting had to be demonstrated

Issuing the tombstone was only half the transition. An OSPF router cannot discard a MaxAge LSA while it remains on a neighbor's link-state retransmission list. It also waits while any neighbor is in Exchange or Loading, because a database synchronization in progress could otherwise reintroduce the departing epoch.

At sequence exhaustion, the originator waits for all adjacent neighbors to acknowledge the flushed maximum instance. Only after the old LSA can be removed does it originate the identity again at InitialSequenceNumber.

This makes the apparent sequence decrease meaningful. The low value is not competing against a high value in the same generation. The high generation has been explicitly withdrawn, carried across the relevant adjacencies and retired from synchronization. The first low value belongs to a new epoch.

RFC 1247's change log made the race visible. OSPFv2 revised database-description processing so an advertisement could not be flushed while a neighbor might still be learning database summaries that referenced it. The protocol did not claim one simultaneous global commit; it created enough adjacency evidence to keep two epochs from passing each other unnoticed.

A reboot could meet its own past

The same rule matters long before a counter is naturally exhausted. Imagine that a router restarts and loses volatile state. A neighbor may still hold a self-originated LSA from before the reboot with a sequence far above the router's newly initialized value. From the neighbor's perspective, the durable old copy really is newer.

RFC 2328 makes the returning originator listen to that evidence. If it still wants to originate the LSA, it issues an instance one sequence number beyond the received self-originated copy. If it no longer originates that identity, it sets the received identity to MaxAge and refloods the withdrawal. When the returned copy is already at the sequence maximum, the router uses the flush-and-restart procedure rather than wrapping through it.

This behavior is often called LSA fight-back. The name can sound adversarial, but the ordinary cause is memory asymmetry. The neighbor is not necessarily an attacker, and the rebooted router is not blindly authoritative because it owns the Router ID. Authorship determines who may refresh or flush the LSA; distributed evidence determines which sequence the author must beat.

Newer was decided by more than one field

Sequence number is the first recency test, not the only one. If two instances of the same LSA have equal sequences, OSPF compares their checksums and treats the larger unsigned checksum as newer. If both sequence and checksum match, MaxAge and then defined age differences can decide which instance wins. Copies whose ages are close enough are treated as the same instance.

Those rules serve different failure boundaries. Sequence expresses intentional reorigination. Checksum distinguishes different contents that somehow share a sequence. Age allows an explicit flush to outrank its live twin and prevents ordinary propagation delay from manufacturing endless new versions.

None is a timestamp for unrelated information. Reading 0x7fffffff as “the newest state in this network” would discard the LSA identity and invent an authority the field never possessed.

Refresh reduction did not abolish revocation

Ordinary OSPFv2 refreshes a self-originated LSA every 30 minutes so it does not naturally reach the one-hour MaxAge limit. That periodic reorigination advances the sequence even in an unchanged topology. Demand circuits made such traffic expensive, so RFC 1793 introduced DoNotAge behavior. RFC 4136 later generalized refresh and flooding reduction for stable topologies.

DoNotAge changed the need for routine refresh; it did not turn an LSA into an immortal entitlement. A content change still triggers reorigination and flooding. A legitimate withdrawal still uses MaxAge. Origination authority, recency comparison and the need to separate old and new state remain.

RFC 5340 carried the fundamental flooding and recency machinery into OSPFv3 for IPv6 while changing addressing and LSA scope details. The problem was not peculiar to one address format. Replicas can preserve an old maximum in any distributed link-state database.

One sequence number was not every sequence number

OSPF packets contain other counters. Database Description packets use their own sequencing while neighbors synchronize. Cryptographically authenticated packets can carry anti-replay sequence state. RFC 6863 treats packet replay protection separately from the sequence embedded in each LSA.

The distinction is operationally important. An LSA sequence answers, “Which version of this routing claim should win?” An authentication sequence helps answer, “Is this protected packet an old packet being replayed under this security context?” Their owners, lifetimes and rollover failures differ. Fixing one does not repair the other.

The vanishing act was the protocol

OSPF's answer to sequence exhaustion was not a larger number or a guess about elapsed time. It was an explicit, attributable deletion that had to travel before creation could resume. The maximum LSA became its own withdrawal; acknowledgements and synchronization state showed when the old epoch was no longer circulating; only then could the oldest legal number mean “new” again.

That design exposes a durable lesson in Internet history. In a distributed system, forgetting is not the absence of a message. It is a state transition with an owner, a propagation path and evidence of completion. OSPF made the empty space between two sequence epochs do real protocol work.

Sources and evidence limits

The standards establish the state machine and its evolution. They do not show how often current implementations reach sequence exhaustion, identify a vendor default or defect, or explain a particular outage. MaxAge is an LSA withdrawal inside OSPF, not proof of global loss of a link, router or destination. The self-originated-LSA response can follow an ordinary restart and does not by itself establish hostile injection.