OSPF Hello packets unicast and multicast

On a broadcast network, as soon as OSPF is enabled on a router, it starts sending Multicast hello packets to the well-known multicast address of 224.0.0.5. When these are received by an OSPF router, it responds with unicast hello packets. Subsequent exchange of hello packets takes place using unicast communication in both directions.

This is the way the protocol is designed, and the most likely scenario. However, the OSPF definition gives some leeway concerning how vendors choose to implement these rules. The RFC 2328 states that:

The IP source address of an OSPF protocol packet is one end of a router adjacency, and the IP destination address is either the other end of the adjacency or an IP multicast address.

Also it says:

On broadcast networks, each router advertises itself by periodically multicasting Hello Packets.

So although the general rule is the one mentioned above, it’s not always implemented strictly. It may take a couple of exchanges of hellos before the OSPF algorithm switches over to unicast.

Links

https://networklessons.com/ospf/ospf-packets-and-neighbor-discovery https://www.cloudshark.org/captures/111cb2076caa https://www.ietf.org/rfc/rfc2328.txt