The Hook: Busting the Myth
Let’s start with a reality check that 90% of networking articles get wrong: Distance Vector protocols aren’t the ones eating your CPU.
If you are running RIP or EIGRP, your router is essentially “routing by rumor.” It takes a neighbor’s word for it, drops it in a table, and moves on. It’s lazy, it’s low-CPU, but it’s heavy on bandwidth.
OSPF is a completely different beast. OSPF is a control-plane monster because it doesn’t trust anyone. It insists on building a complete, high-definition mathematical map of the entire network. And when that map shifts? Your CPU pays the tax.
The Scenario: The Morning Meltdown
Picture a classic hub-and-spoke network with an aggregation router (like a Cisco ASR 1000) holding down 1,000 OSPF neighbor adjacencies to remote branches in a single flat area.
A localized power grid failure knocks out 600 of those branches. Thirty seconds later, power restores, and 600 branches storm back online simultaneously.
What happens next is a control plane cascade failure:
The Hello Storm: The ASR Route Processor is flooded with thousands of raw OSPF packets, pinning the CPU at 100% just trying to parse them.
The Database Avalanche: 600 routers enter the
EXCHANGEstate at once. The ASR must duplicate its entire topology database in memory for each neighbor, serializing millions of LSAs into packets.The Collateral Damage: Because the CPU is completely choked running Dijkstra’s algorithm and processing database requests, it stops responding to the 400 healthy neighbors. Their dead timers expire. They drop. Now all 1,000 routers are flapping in a continuous, compounding loop of doom.
The Anatomy of an OSPF Flap: 1 Prefix = 1 LSA
Why does a flap cause so much churn? Because of how OSPF counts.
Inside the Area: If an interface flaps, the router increments the sequence number on its Type 1 Router LSA and floods it. Every single router in that area must drop what it’s doing and recalculate the entire shortest-path tree using Dijkstra’s algorithm ($O(E \log V)$ math).
The Explosion: If you have 500 prefixes to pass to another area, the Area Border Router (ABR) strips them out of the topology map and generates 500 individual Type 3 Summary LSAs. One prefix = one LSA.
If those 500 links flap unsummarized, you are forcing the backbone to process 500 distinct LSA updates and execute 500 partial route updates.
How the Cloud Fakes It
How do hyperscale cloud providers run OSPF across thousands of devices without melting their infrastructure? They trick OSPF into thinking the network is tiny.
If a cloud provider uses OSPF within a region, they map it strictly to their physical architecture using a rigid, repetitive blueprint:
One Area Per Availability Zone (AZ): They isolate the blast radius. A link flap in AZ-1 stays in AZ-1. The core backbone (Area 0) never executes a full SPF calculation for a localized rack failure.
Aggressive ABR Summarization: They don’t leak individual server or rack IPs. An entire AZ is assigned a massive, contiguous block (like
10.1.0.0/12). The ABR condenses the entire data center floor into exactly one Type 3 LSA. If 1,000 subnets inside that data center flap, the single summary route stays completely stable. The rest of the region’s CPU feels absolutely nothing.Banning Externals (Totally Stubby Areas): They configure the data center floor as a Totally Stubby Area. They block all Type 5 and Type 3 LSAs from entering, replacing them with a single default route ($0.0.0.0/0$). The Top-of-Rack switches only hold their local links, keeping the database minuscule and SPF calculations instantaneous.