You typed router ospf 1, added your network statements, brought the interface up — and instead of FULL, the neighbor is parked in EXSTART, ticking up retransmits, never reaching the routing table. Or it's stuck in INIT. Or it's flapping every 40 seconds. Or you can't even see a neighbor at all.
Every one of those failures has a signature. OSPF's adjacency state machine is the most useful diagnostic surface in the protocol — the state tells you exactly which step failed, which means you can usually fix it in one command. This is the field guide for that.
If you want the conceptual scaffolding behind why these states exist (LSDB, LSAs, SPF, etc.), the OSPF concepts article is the foundation. This one is the troubleshooter.
★ THE 8 STATES IN 30 SECONDS
DOWN — No Hellos received from this neighbor yet. Default starting state.
ATTEMPT — Used only on non-broadcast multi-access networks (frame relay, etc.). Router is actively trying to reach a manually configured neighbor.
INIT — Hello received from neighbor, but my own router-ID isn't in their Hello yet. One-way communication.
2-WAY — Both routers see each other's router-IDs in the Hellos. Bi-directional. On broadcast networks, DR/BDR election happens here.
EXSTART — Routers negotiate which one will be master for the database exchange.
EXCHANGE — Routers send Database Description (DBD) packets summarizing their LSDB.
LOADING — Each router requests the actual LSAs for any database entries it doesn't already have.
FULL — Databases synchronized. Adjacency is complete. This is where you want to live.
If show ip ospf neighbor shows anything other than FULL (or 2-WAY on a DROTHER ↔ DROTHER pair — that one's normal, more on it below), something is broken. The state tells you where.
★ STUCK IN INIT — ONE-WAY HELLOS
Symptom: Neighbor appears in show ip ospf neighbor with state INIT and stays there.
Cause: You're hearing Hellos from them, but they're not hearing yours. The Hellos they send don't list your router-ID in their neighbor field — that's literally the INIT definition.
Fix: Check that your Hellos can actually leave the interface. Common culprits: an inbound ACL on their side blocking OSPF (protocol 89 or multicast 224.0.0.5), a misconfigured passive-interface on your side (you're sending no Hellos at all — but then they shouldn't even show you), or asymmetric L1/L2 issues (one direction of the cable bad).
Verify with debug ip ospf hello on both sides. You should see Hellos going out yours and coming in theirs. If your Hello is missing on the far side, the L2/ACL path is broken.
★ "STUCK" IN 2-WAY — OFTEN NOT A PROBLEM
On a broadcast multi-access network (Ethernet LAN) with three or more OSPF routers, OSPF elects a Designated Router (DR) and Backup Designated Router (BDR). Every other router (a DROTHER) forms a FULL adjacency only with the DR and BDR.
DROTHER pairs only reach 2-WAY with each other. That's by design, not a bug. They exchange LSAs through the DR — they don't need a direct full adjacency.
So if you see two DROTHERs sitting in 2-WAY and panic, don't. Check show ip ospf neighbor and confirm both have FULL with the DR. That's a healthy network.
Real "stuck in 2-WAY" — where a router should be reaching FULL with the DR but isn't — is rare and usually a follow-on symptom of the EXSTART problem below.
★ STUCK IN EXSTART (OR EXCHANGE) — THE MTU TRAP
Symptom: Adjacency reaches EXSTART or EXCHANGE, retransmit counter climbs, never gets to FULL. Often flaps between the two states.
Cause: Interface MTU mismatch between the two routers. OSPF includes its interface MTU in the DBD packet. If the receiving router's MTU is smaller, it rejects the DBD — and the database exchange can't complete.
Fix: Match the MTUs (mtu 1500 under both interfaces), or tell OSPF to skip the MTU check with ip ospf mtu-ignore on the interface. The mtu-ignore option is a workaround, not a real fix — different MTUs in production cause downstream fragmentation problems even if OSPF is happy.
This is the single most common "OSPF won't come up" issue in the field and the exam loves it. If you see EXSTART or EXCHANGE in show ip ospf neighbor, your first thought should be MTU. Verify with show ip ospf interface — it prints the MTU OSPF is using.
The lab on this site lets you reproduce the EXSTART hang on purpose: set mtu 1400 on one side of the uplink and watch the adjacency die. Worth doing once so you recognize the signature instantly.
★ ADJACENCY FLAPPING — TIMER, AREA, OR AUTH MISMATCH
Symptom: Adjacency reaches FULL, then drops, then comes back, then drops again. Routing table churn. Syslog full of %OSPF-5-ADJCHG.
Causes (in order of how often you'll see them):
• Hello/dead timer mismatch — one side hits dead time before the other re-Hellos.
• Area ID mismatch — adjacency forms briefly, breaks when LSAs disagree.
• Authentication mismatch — packets drop, dead timer expires.
Fix: show ip ospf interface <int> on both sides. Compare the Hello, Dead, Area, and Authentication lines. They have to match exactly.
Hello and dead timers are configurable per interface but default to 10 seconds Hello / 40 seconds dead on broadcast networks. If someone has tuned one side and not the other, you've got a flap.
★ NEVER SEEING A NEIGHBOR AT ALL
Symptom: show ip ospf neighbor is empty. No state, no router-ID, nothing.
Causes:
• Interface not actually included in OSPF — wrong wildcard in network.
• Interface configured as passive-interface on one or both sides.
• L1/L2 down — port not up/up, wrong VLAN, wrong cable.
• OSPF area or process not actually configured on the remote side.
Fix: show ip ospf interface brief on both sides. If your interface isn't in the list, OSPF isn't running on it — fix the network statement or add ip ospf 1 area 0 directly to the interface.
show ip protocols is also useful here — it prints the network statements and the list of passive interfaces. Easier to scan than the full running-config.
★ TROUBLESHOOTING DECISION TREE
No neighbor at all → network statement / passive-interface / L1-L2
Stuck in INIT → one-way Hellos: ACL, asymmetric L2
Stuck in 2-WAY (DROTHER) → expected — check FULL with the DR
Stuck in EXSTART/EXCHANGE → MTU mismatch (90% of the time)
FULL → DOWN flapping → hello/dead, area, or auth mismatch
★ VERIFICATION COMMAND CHEAT SHEET
show ip ospf neighbor — the headline output. Read the State column first.
show ip ospf interface <int> — area, MTU, Hello/Dead timers, auth, network type. Run this on both sides and diff in your head.
show ip ospf interface brief — quick list of every OSPF-enabled interface. Good for "is OSPF even on this port."
show ip protocols — process ID, router-ID, network statements, passive interfaces. The config-as-shown-to-OSPF.
show ip ospf database — the LSDB itself. Useful for confirming both routers really do see the same map after FULL.
debug ip ospf adj / debug ip ospf hello — when you've tried everything else. Reach for undebug all the moment you have your answer.