If a neighbor goes down ospfd resets the crypt_seq_num. This in theory
allows an attacker to issue a replay attack. This reset was done on
purpose because if the other system restarted then a new sequence number
is generated and that on may be lower than our crypt_seq_num.
As a result the peer would not reconnect until the DEFAULT_NBR_TMOUT (24h)
fired.

-- 
:wq Claudio

Index: neighbor.c
===================================================================
RCS file: /cvs/src/usr.sbin/ospfd/neighbor.c,v
diff -u -p -r1.51 neighbor.c
--- neighbor.c	8 Mar 2023 04:43:14 -0000	1.51
+++ neighbor.c	20 May 2026 12:33:07 -0000
@@ -610,7 +610,12 @@ nbr_act_delete(struct nbr *nbr)
 	/* stop timers */
 	nbr_stop_itimer(nbr);
 
-	/* XXX reset crypt_seq_num will allow replay attacks. */
+	/*
+	 * XXX reset crypt_seq_num will allow replay attacks.
+	 * We accept this because if the remote system restarted
+	 * the new initial crypt_seq_num may be lower and so the
+	 * neighbor would not reconnect for DEFAULT_NBR_TMOUT.
+	 */
 	nbr->crypt_seq_num = 0;
 
 	/* schedule kill timer */