DR/BDR election — designated router, broadcast vs point-to-point, and why the DR exists

On a multi-access segment (Ethernet), every OSPF router must know about every other router on the segment. Without a central coordinator, that produces n*(n-1)/2 adjacencies for n routers on the segment — and no compact way to describe the segment itself in the link-state database. The Designated Router (DR) is the solution: one router on the segment becomes the central point and originates a single Type 2 Network LSA describing the whole segment; the others become DROther routers that hold a Full adjacency only with the DR and the BDR, not with each other.

This lesson explains why the DR exists, the election rule, the operational controls (priority, network-type), and the production failure modes that show up as misconfigured elections or unwanted DR positions.

The n*(n-1)/2 problem

A naive broadcast design has every router form an adjacency with every other router:

flowchart TB
  subgraph "Naive full mesh"
    A[Router A]
    B[Router B]
    C[Router C]
    D[Router D]
    A --- B
    A --- C
    A --- D
    B --- C
    B --- D
    C --- D
  end

For 4 routers that is 6 adjacencies, each maintaining LSDB synchronisation. For 10 it is 45. For 30 it is 435. The control plane grows quadratically with a linear amount of network.

The DR is the structural fix:

flowchart TB
  subgraph "DR-coordinated design"
    DR[DR]
    BDR[BDR]
    D1[DROther]
    D2[DROther]
    D3[DROther]
    DR --- BDR
    DR --- D1
    DR --- D2
    DR --- D3
    BDR --- D1
    BDR --- D2
    BDR --- D3
  end

Count the adjacencies in that second diagram. The DR is adjacent to all n-1 other routers. The BDR is adjacent to all n-1 as well, but the DR-BDR pair has already been counted once, so the BDR contributes n-2 new ones. Total: 2n - 3.

The crossover is unremarkable at four routers and decisive at thirty: quadratic versus linear. But adjacency count is only half of what the DR buys. The other half is representation. Without a DR, each of n routers must describe the segment in its own Type 1 by listing n-1 point-to-point neighbours, so the segment costs n(n-1) link records across the LSDB. With a DR, each router’s Type 1 carries one “transit network” link pointing at the DR, and the DR originates one Type 2 that lists every attached router. The segment is described once instead of n times.

The DR/BDR election rule

Election happens when a router’s OSPF interface comes up and it finds no DR already claimed on the segment. The rule is strict:

flowchart TB
  Start["Interface reaches the Wait Timer expiry<br/>with no DR claimed"] --> Step1["Priority 0 routers are<br/>excluded from the running"]
  Step1 --> Step2["Elect the BDR first, from<br/>routers not claiming DR"]
  Step2 --> Step3["Elect the DR; if nobody<br/>claims it, the BDR is promoted"]
  Step3 --> Step4["Ties on priority are broken<br/>by the highest router-id"]
  Step4 --> Stable["Stable: no re-election<br/>while the DR is alive"]

In detail:

1. Priority 0 means ineligible. A router whose interface priority is 0 can never become DR or BDR on that segment. It is DROther for the life of the interface. This is the canonical “this router must never be DR” configuration.

2. Highest priority wins. The default is 1. An operator who wants a specific router to be DR raises its priority; everyone else stays at the default.

3. Ties break on the highest router-id. Two routers at priority 100 are separated by router-id, higher wins.

4. BDR is elected before DR. RFC 2328 section 9.4 runs the BDR calculation first over the routers that are not already claiming DR, then the DR calculation. The practical summary — “BDR is the runner-up” — is right, but the ordering is why a segment that loses its DR does not need a full election: the BDR is already synchronised and is simply promoted.

5. There is no preemption. Once a DR is established, a new router joining the segment becomes DROther, however high its priority. Changing priority on a running router does not change its role either. The only thing that re-runs an election is the current DR going away.

Election is a snapshot, not a standing rule

The election runs against whoever is present when it runs. A router that joins later sees an existing DR advertised in the Hellos already on the wire and accepts it.

• All routers come up together. Nobody knows of a DR, so every Hello carries DR = 0.0.0.0 and BDR = 0.0.0.0. Each interface starts a Wait Timer, which RFC 2328 sets equal to the RouterDeadInterval — 40 seconds with the VyOS defaults — and defers the election until it expires or until a Hello arrives naming a DR. The election then runs over the full set of candidates.
• One router joins an established segment. Its first received Hello already names a DR, so the Wait Timer is cut short and no election runs. The newcomer becomes DROther whatever its priority.

That distinction is the whole of this lesson’s failure surface. The two examples below both look like “the priority did not take effect”, and only one of them is:

# Sequence A - the outcome the design wanted
# Priority is already 200 on R-DR before anything is up.
# All four routers boot. Wait Timers expire together.
# Election sees priority 200 vs 1 vs 1 vs 1. R-DR wins.

# Sequence B - the outcome operators actually get
# R2, R3, R4 have been up for weeks; R3 is DR.
# The operator sets priority 200 on R-DR and commits.
# R-DR's first Hello already names R3 as DR.
# No election runs. R-DR is DROther, with priority 200.

The fix for sequence B is to remove the reason the segment believes it already has a DR — which means the current DR has to stop being present, on that segment, for longer than the dead interval.

The “the DR is wrong, force a re-election” recipe:

1. Confirm the new priority is committed on the intended DR: show configuration commands | match priority.
2. Take the current DR off the segment — either disable its interface, or bounce its OSPF process (both are shown under Rollback below). Nothing less will do it: OSPF has no “resign as DR” primitive.
3. Wait out the dead interval, 40 seconds by default, so the remaining routers stop believing in the old DR.
4. Confirm with show ip ospf interface eth0 that the intended router now shows State DR.
5. Bring the previous DR back. It returns as DROther, which is what you wanted.

Configuration — priority and network type

VyOS exposes both controls under protocols ospf interface:

# Prefer this router as DR
set protocols ospf interface eth0 priority 200

# Never be DR or BDR on this segment
set protocols ospf interface eth0 priority 0

# Skip DR election entirely on this interface
set protocols ospf interface eth0 network point-to-point

# Restore the default (broadcast on Ethernet)
delete protocols ospf interface eth0 network

The network node accepts broadcast, non-broadcast, point-to-multipoint and point-to-point. Ethernet defaults to broadcast.

Choosing point-to-point on a segment changes three things at once:

• No DR or BDR is elected, and the DR/BDR fields in the Hellos go to 0.0.0.0.
• No Type 2 Network LSA is originated for the segment.
• Each router describes the link in its Type 1 as a point-to-point link to each neighbour it finds.

point-to-point is right:

• On a link with exactly two routers — a serial link, a GRE or WireGuard tunnel, or an Ethernet segment that is genuinely a two-router crossover.
• Because it removes the Wait Timer from the adjacency path. Without a DR to wait for, the neighbours go to Full without the 40-second deferral, which is why point-to-point links converge visibly faster than broadcast ones.

point-to-point is wrong on a multi-access segment with three or more routers. RFC 2328’s point-to-point network type describes a link with one neighbour; using it where there are several gives up the Type 2 abstraction and puts the full mesh back into the Type 1s.

How the DR is reflected in the LSDB

The DR originates exactly one Type 2 for the segment. Its Link State ID is the DR’s own interface address on that segment, its Advertising Router is the DR’s router-id, and its body lists every router attached to the segment — including the DROthers, which is how they get described without describing each other.

vyos@r1:~$ show ip ospf database network

       OSPF Router with ID (1.1.1.1)

Net Link States (Area 0.0.0.0)

LS age: 800
Options: 0x2  : *|-|-|-|-|-|E|-
LS Flags: 0x3
LS Type: network-LSA
Link State ID: 10.0.0.2 (address of Designated Router)
Advertising Router: 2.2.2.2
LS Seq Number: 80000002
Length: 36
Network Mask: /24
Attached Router: 2.2.2.2
Attached Router: 1.1.1.1
Attached Router: 3.3.3.3

Reading it: the Advertising Router 2.2.2.2 is the DR, the Link State ID 10.0.0.2 is the DR’s address on this segment, and all three routers on the segment are listed as attached. R1, whose LSDB this is, appears in the list without having originated anything.

If the DR fails, the BDR is promoted, flushes the old Type 2 and originates its own with a new Link State ID (its own interface address) and its own router-id as Advertising Router. A new BDR is elected from the remaining eligible routers.

Diagnosing a partitioned segment

A segment that has been split at layer 2 — a VLAN misconfigured on one switch, a trunk pruning the wrong VLAN — produces two independent OSPF segments that both think they are the whole one. Each half elects its own DR.

The signal is not two Type 2 LSAs with the same Link State ID; that cannot happen, because the Link State ID is the DR’s own interface address and the two DRs have different addresses. The signal is:

• Two routers on the same IP subnet both report State DR in show ip ospf interface.
• Two Type 2 LSAs in show ip ospf database network carrying the same Network Mask and overlapping subnet but different Link State IDs and different Advertising Routers.
• Each DR’s Attached Router list contains only its own half of the routers, and the two lists do not overlap.
• show ip ospf neighbor on a router in one half never lists the routers in the other half, while ARP and ping to them may or may not work depending on where the break is.

That third bullet is the confirmation. One segment, one Type 2, one list containing everyone. Anything else is a layer-2 problem wearing an OSPF costume.

The Hello DR/BDR fields

The OSPF Hello carries a DR field and a BDR field:

• If the sender believes a DR exists, the field names it (by router-id).
• If it does not, the field is 0.0.0.0.

The sequence during a cold start:

1. Every router sends Hellos with DR = BDR = 0.0.0.0 and starts its Wait Timer.
2. Hellos are exchanged; each router builds its list of candidates and their priorities.
3. The Wait Timer expires. Each router runs the RFC 2328 section 9.4 calculation over the candidates it knows about, and because they all know the same candidates, they all reach the same answer.
4. Subsequent Hellos carry the elected DR and BDR, and the segment is stable.

The Wait Timer is what makes step 3 deterministic. Without it, the first router to boot would elect itself before anyone else had spoken.

How it fails — production DR failure modes

Stuck DR on a failed router

The DR loses power. The other routers keep believing in it until the dead interval expires — 40 seconds by default — because nothing else tells them it is gone.

Diagnostic: show ip ospf neighbor on any router; the DR’s entry disappears once the dead timer runs out and the BDR’s state changes from Full/BDR to Full/DR.

Fix: none. This is self-healing and the timing is the timing. If 40 seconds of black-holing is unacceptable, that is an argument for BFD on the segment, not for tuning the DR.

Wrong DR elected

The operator wanted R-A as DR; R-B holds the role because it was up first, or because R-A’s priority was set after the fact.

Diagnostic: show ip ospf interface eth0 on R-A shows State DROther while show configuration commands | match priority confirms priority 200 is committed. The configuration is right and the role is wrong, which is exactly the no-preemption signature.

Fix: force a re-election as described above. The priority change alone will never do it.

DR elected on a link that should not have one

A point-to-point link left at the default broadcast network type elects a DR and a BDR between its two routers. It works, but it carries a pointless Type 2 and a pointless Wait Timer on every adjacency formation.

Diagnostic: show ip ospf interface on a two-router link shows Network Type BROADCAST and a DR and BDR that are the two routers.

Fix: set protocols ospf interface eth0 network point-to-point on both ends, then commit. Doing one end only produces the mismatch described in the callout above, which is worse than leaving it alone.

DROther on the router the design calls the hub

The hub came up after the spokes had already elected a DR among themselves. Its priority is correct and its role is not.

This is only a fault if the design actually requires it. The DR does not forward traffic and carries no routing preference — it originates one LSA. Before scheduling a window to fix it, be honest about whether “the hub should be DR” is a requirement or a habit. If the concern is that a spoke leaving the segment should not disturb it, the answer is priority 0 on every spoke, applied before the next time they boot.

Operational commands

# Current role, network type, priority, DR and BDR on a segment
show ip ospf interface eth0

# Neighbour roles as this router sees them
show ip ospf neighbor

# Per-neighbour detail, including the DR and BDR each one claims
show ip ospf neighbor detail

# The Type 2 for the segment; the Advertising Router is the DR
show ip ospf database network

# What is actually committed, as opposed to what was typed
show configuration commands | match priority

vyos@r1:~$ show ip ospf interface eth0

eth0 is up
ifindex 2, MTU 1500 bytes, BW 1000 Mbit <UP,BROADCAST,RUNNING,MULTICAST>
Internet Address 10.0.0.1/24, Broadcast 10.0.0.255, Area 0.0.0.0
MTU mismatch detection: enabled
Router ID 1.1.1.1, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State DROther, Priority 1
Designated Router (ID) 2.2.2.2 Interface Address 10.0.0.2
Backup Designated Router (ID) 3.3.3.3 Interface Address 10.0.0.3
Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
Neighbor Count is 2, Adjacent neighbor count is 2

Reading this:

• R1 (router-id 1.1.1.1) is DROther, at the default priority 1.
• R2 (2.2.2.2) is the DR; R3 (3.3.3.3) is the BDR.
• Wait 40s is the Wait Timer, and it tracks the dead interval.
• Neighbor Count 2, Adjacent neighbor count 2 is the DROther signature on a three-router segment: two neighbours, both of them adjacent, because both happen to be the DR and the BDR. Add a fourth router and R1 would report three neighbours but still only two adjacent — that gap is the DR design working.

The roles are relative to the router you ask. R2 reports State DR, R3 reports State BDR, and all three agree on who holds which.

Configuration examples

# Hub-and-spoke on one segment: the hub should describe it
# Hub - raise the priority before the spokes ever boot
set protocols ospf interface eth0 priority 200

# Spokes - make them structurally ineligible, so no boot order
# can ever hand one of them the role
set protocols ospf interface eth0 priority 0

# Two-router tunnel or crossover: no DR needed, and the
# adjacency skips the Wait Timer. Set this on BOTH ends.
set protocols ospf interface tun0 network point-to-point

# Multi-access segment with three or more routers: leave the
# default broadcast type alone

The priority 0 line on the spokes is the part worth copying. Raising the hub’s priority expresses a preference that a boot order can defeat; making the spokes ineligible expresses a constraint that it cannot.

Rollback

# Revert a priority or network-type change
rollback 1
commit
save

# Or remove the specific nodes
delete protocols ospf interface eth0 priority
delete protocols ospf interface eth0 network
commit
save

Reverting the configuration does not revert the role. If the change caused a re-election, the segment keeps whichever DR it elected until that DR leaves, exactly as before. Plan the rollback as a second election, not as an undo.

A reasonable sequence for a planned DR promotion, with evidence captured on each side:

# 1. Snapshot from the shell, where redirection is available
vtysh -c 'show ip ospf interface eth0' | tee /tmp/ospf-before.txt
vtysh -c 'show ip ospf database network' | tee /tmp/netlsa-before.txt

# 2. Commit the new priority on the intended DR
configure
set protocols ospf interface eth0 priority 200
commit
save
exit

# 3. Force the election by removing the current DR from the
#    segment for longer than the dead interval (see the callout
#    above for both variants)

# 4. Validate
show ip ospf interface eth0
show ip ospf database network

Compare the two Type 2 captures. The Advertising Router should have changed to the intended DR and the Attached Router list should still contain every router on the segment. If a router has gone missing from that list, the promotion cost you an adjacency.

Production discipline

Cross-course references

• RFC 2328 section 7.3 (the Designated Router) and section 9.4 (the election calculation) for the canonical rules.
• Part XVIII lesson 2 (vyos-xviii-02-neighbours-and-adjacency) covers the FSM that runs on every interface; this lesson shows how the FSM extends to include DR/BDR roles on broadcast segments.
• Part XVIII lesson 3 (vyos-xviii-03-lsa-types) covers the Type 2 Network LSA that the DR exists to originate.
• Part XX (XX-VyOS-OSPFAreas) lesson 1 — the area-0 segment is a broadcast segment with elected DR/BDR; area design affects which routers are on which segments.

Quiz