IS-IS Explained: The Routing Protocol Carriers and Hyperscalers Actually Run

Think of a postal system. Every town's post office knows its own streets cold — every house, every shortcut. But no town office keeps a street map of the country. For that, towns connect to an interstate backbone reaching every other town, each with an on-ramp onto it.

That is how IS-IS splits the routing problem. Level-1 routers are the town offices: they know every street — every prefix — inside their own area. Level-2 routers are the interstate system, connecting the areas. A Level-1-2 router is the town with an on-ramp, where local streets meet the interstate.

What IS-IS actually is

IS-IS stands for Intermediate System to Intermediate System. "Intermediate System" is OSI language for a router: the box in the middle, forwarding traffic onward. The name is a fossil from that other world.

It was designed for the OSI suite and standardised as ISO/IEC 10589. RFC 1195 then taught it to carry IP routes too, and that adapted version — Integrated IS-IS — is what every modern network runs.

Underneath the vocabulary, IS-IS is a link-state protocol, the same family as OSPF (Open Shortest Path First). Every router describes its links and floods the description to its peers, so all routers in an area hold the same map — then each runs Dijkstra's SPF (Shortest Path First) algorithm over it. The differences from OSPF are in the plumbing — which is why the big operators chose it.

Two levels: the town and the interstate

Level 1 routes inside one area: a Level-1 router knows every local prefix and nothing of the outside world. Level 2 routes between areas: Level-2 routers form a single contiguous backbone — one unbroken chain — that every area hangs off. The rule is hard: partition the backbone, and areas either side cannot reach each other.

Level-1-2 routers do both jobs, sitting at an area's edge with a Level-1 map of home and a Level-2 map of everywhere else. So how does a Level-1 router send traffic out of town with no world map? It hands anything non-local to its nearest Level-1-2 router — the on-ramp. (Technically, it sets an "attach bit" in its advertisements — "I can reach the outside" — which Level-1 routers take as their default exit.)

One more plumbing difference: the area boundary sits on the link in IS-IS — a router belongs wholly to one area — but on the router in OSPF, which can span several areas at once.

The NET address, decoded

Here is where newcomers bounce off: IS-IS routers are not addressed by IP. Each gets one NET — a Network Entity Title, an OSI-style address naming the router itself:

49.0001.1921.6800.1001.00

49 — the AFI. The Address Family Identifier says which addressing family this is. 49 marks privately administered addresses — the OSI equivalent of RFC 1918 private IP space.

0001 — the area address. With the AFI, this identifies the area. Every router in a Level-1 area must carry the same one: mismatch it on one router and its Level-1 adjacency never forms.

1921.6800.1001 — the System ID. Six bytes naming this one router — unique in the area, or two routers become indistinguishable and their updates corrupt each other. The memorable trick: pad each octet of the loopback IPv4 address to three digits, then regroup in fours. Loopback 192.168.0.1 becomes 192.168.000.001, whose digits regroup as 1921.6800.0001. The example above follows that same padded-digit style.

00 — the NSEL. The final byte is the selector (SEL): which process on the device the address refers to. In a NET it is always 00 — "the router itself," the whole network entity, not a service on it.

A complete NET runs 8 to 20 bytes, untied to any interface: one per router suffices.

LSPs and TLVs: two scopes, endless envelopes

Routers share their maps by flooding LSPs — Link-State PDUs (Protocol Data Units; a PDU is OSI-speak for a packet). Each router originates an LSP describing itself and its links; neighbours relay copies until everyone holds it. There are exactly two flooding scopes: Level-1 LSPs stay inside the area; Level-2 LSPs travel the backbone. Two scopes, full stop.

Inside an LSP, everything is a TLV — Type (what this is), Length (how long), Value (the data). One TLV lists reachable neighbours (Extended IS Reachability, TLV 22); another lists IPv4 prefixes (Extended IP Reachability, TLV 135); IPv6 prefixes ride in TLV 236. TLV 137 carries the hostname, so database output shows names instead of hex.

TLVs are why IS-IS absorbed decades of change without a redesign: unknown TLVs are flooded onward and ignored. IPv6 arrived as new TLVs; Segment Routing arrived as new TLVs. Nobody had to invent IS-IS version 3 — the envelope never changed, only the letters.

The DIS: one speaker per link, no understudy

On a shared Ethernet link, if every router advertised a link to every other, the map would swell with noise. So the link's routers elect one Designated IS — the DIS — to speak for it. The DIS speaks for the link as a virtual router (a pseudonode); everyone else advertises just a connection to that pseudonode.

Two contrasts with OSPF matter. First, there is no backup DIS: if it fails, the link holds a fresh election — quick, but a real re-convergence, with no warmed-up understudy like OSPF's DR/BDR pair (Designated Router, Backup Designated Router). Second, the DIS is preemptive: a router with a better claim takes the job at once. "Better" means highest configured priority, ties broken by highest SNPA — on Ethernet, the highest MAC address.

IS-IS vs OSPF, honestly

Neither is "better" in the abstract — OSPF runs happily in thousands of networks. Side by side, though, the design choices explain the big operators' pick:

Read together, a theme emerges: smaller machinery. Two flooding scopes instead of many; one instance for both address families; adjacencies that form whether or not IP works — a real comfort when bringing a broken network back.

Why the biggest networks run it

That is why IS-IS turns up in large ISP cores, hyperscaler backbones and some data-center fabrics: at that scale, simpler flooding and TLV extensibility stop being elegance and start being uptime. It was also the first underlay Segment Routing was built on — SR's extensions were defined natively as IS-IS TLVs (see our segment routing guide).

Where does a normal enterprise meet it? Mostly inside the carrier network their WAN rides on, and in larger data-center designs. Plenty run OSPF everywhere and never need IS-IS — but the biggest networks, ones you may one day run, buy transit from, or interview at, chose it deliberately.

A minimal working configuration

The whole protocol starts from that one address:

router isis
 net 49.0001.1921.6800.1001.00
 is-type level-1-2
!
interface GigabitEthernet0/0
 ip router isis

Use level-2-only instead for a pure backbone router. Then verify with three commands: show isis neighbors (adjacencies and levels), show isis database (each level's LSP map), show clns neighbors (the OSI-flavoured view).

Five common mistakes

1. Duplicating a System ID. Two routers, one identity: their LSPs overwrite each other and routes flap.
2. Mismatching the area address. One router in the wrong area, and its Level-1 adjacency never forms. Check the NET before the cable.
3. Partitioning the Level-2 backbone. It must stay one unbroken chain. Split it, and areas become unreachable islands.
4. Making every router Level-1-2. Then the hierarchy stops existing. Level-1-2 belongs at edges.
5. Mismatching levels on a link. One side level-1-only, the other expecting level 2 — an is-type or circuit-type mismatch — and the wanted adjacency never comes up, even while pings pass.