Questions? Call 1.800.716.8955

Chapter 14

CDP and LLDP

Exam topics covered

2.3 Configure and verify Layer 2 discovery protocols (Cisco Discovery Protocol and LLDP)

Foundation. You have just been handed console access to a switch in a network you have never seen, and there is no up-to-date diagram. What is connected to each port? Which device is at the other end of that uplink, what model is it, and what is its management IP address? Layer 2 discovery protocols answer those questions. Each device periodically announces itself to its directly connected neighbors, and each device keeps a table of what it has heard. Cisco's proprietary Cisco Discovery Protocol (CDP) and the IEEE standard Link Layer Discovery Protocol (LLDP) do essentially the same job. This chapter covers how they work, their timers and defaults, configuration, output, topology mapping and security.

14.1 How Discovery Protocols Work

CDP and LLDP are Layer 2 protocols. A device sends a small advertisement out of each enabled interface to a reserved multicast MAC address at a fixed interval. The advertisement carries information about the sender (its name, the port it was sent from, its capabilities, addresses and software) encoded as a series of TLVs (Type-Length-Value fields). The receiving device stores this information in a neighbor table, along with a countdown timer called the holdtime. If no new advertisement arrives before the holdtime expires, the entry is removed. Three properties are worth understanding from the start:

Neighbors only. Discovery messages are consumed by the receiving device and never forwarded. A switch does not flood CDP or LLDP frames, so you learn only about devices directly connected to you, not about devices two hops away.

No IP needed. Because they run directly over Ethernet, CDP and LLDP work even if no IP addresses are configured, or if IP addressing is wrong. That makes them excellent for troubleshooting Layer 1 to Layer 3 problems.

R1 SW1 SW2

"I am R1, Gi0/0/0, router" "I am SW1, Gi1/0/1, switch"

R1's advertisement is NOT forwarded to SW2: SW2 knows only SW1 consumed

Figure 14-1 Discovery messages are exchanged only between directly connected neighbors.

14.2 Cisco Discovery Protocol (CDP)

CDP is a Cisco-proprietary protocol supported on almost every Cisco router, switch, IP phone, access point and wireless controller, and on some third-party devices under licence. It is enabled by default on Cisco IOS devices, globally and on every interface that supports it. CDP frames are sent to the multicast MAC address 0100.0CCC.CCCC using a SNAP header. The current version, CDPv2, is sent by default and adds information such as the native VLAN, duplex and VTP domain, which lets CDP detect mismatches (for example the %CDP-4- NATIVE_VLAN_MISMATCH message you saw in Chapter 12, and %CDP-4-DUPLEX_MISMATCH ).

Table 14-1 Key CDP facts

Item Value

Standard Cisco proprietary

Default state on Cisco IOS Enabled globally and on all supported interfaces Advertisement timer 60 seconds ( cdp timer )

  • Holdtime 180 seconds ( cdp holdtime ), three times the timer
  • Destination MAC 0100.0CCC.CCCC
  • Version CDPv2 by default ( no cdp advertise-v2 reverts to v1)

Each CDP advertisement carries TLVs for the Device ID (hostname), one or more addresses (typically the management IP), the Port ID it was sent from, capabilities (router, switch, host, phone, IGMP), platform and full software version, plus the CDPv2 extras: native VLAN, duplex, VTP domain, PoE power requirements and the voice VLAN for Cisco IP phones.

14.2.1 Configuring CDP

Because CDP is on by default, configuration is mostly about turning it off where it is not wanted. The global command controls the whole device; the interface command controls a single port. The interface command has no effect while CDP is globally disabled.

R1(config)# no cdp run ! disable CDP on the whole device
R1(config)# cdp run ! re-enable globally (default)
R1(config)# interface gigabitethernet0/0/2
R1(config-if)# no cdp enable ! disable on this interface only (e.g., ISP link)
R1(config-if)# exit
R1(config)# cdp timer 30 ! send every 30 s (default 60)
R1(config)# cdp holdtime 90 ! neighbors keep our entry 90 s (default 180)

The holdtime is advertised: R1's cdp holdtime tells R1's neighbors how long to keep R1's entry. It does not control how long R1 keeps its neighbors' entries.

14.2.2 Verifying CDP

The commands below are the ones you will use daily. show cdp displays the global settings, show cdp interface lists the interfaces running CDP, and show cdp traffic shows packet counters. The most useful are the neighbor commands. (All terminal output in this chapter is illustrative of Cisco IOS 15.x / IOS XE.)

SW1 — console

SW1# show cdp
  • Global CDP information:
  • Sending CDP packets every 60 seconds
  • Sending a holdtime value of 180 seconds
  • Sending CDPv2 advertisements is enabled
SW1# show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,

  • D - Remote, C - CVTA, M - Two-port Mac Relay
  • Device ID Local Intrfce Holdtme Capability Platform Port ID
  • R1 Gig 1/0/24 163 R B S I ISR4331 Gig 0/0/0
  • SW2 Gig 1/0/1 138 S I C9200L-24 Gig 1/0/1
  • SEP00562B4A1F20 Gig 1/0/5 151 H P M CP-8845 Port 1
  • Total cdp entries displayed : 3

Figure 14-2 show cdp and show cdp neighbors on SW1. Local Intrfce is SW1's port; Port ID is the neighbor's port.

Read each row carefully. Device ID is the neighbor's hostname. Local Intrfce is this device's port that hears the neighbor. Holdtme counts down from 180 and resets each time an advertisement arrives. Capability and Platform describe the neighbor. Port ID is the neighbor's interface. So the first row says: "SW1's Gi1/0/24 connects to R1's Gi0/0/0, and R1 is an ISR4331 router." The third row is a Cisco IP phone (hostnames starting with SEP followed by the phone's MAC address).

The exam loves to ask which column shows which end of the link. Local Interface = the port on the device where you typed the command. Port ID = the port on the neighbor. Also remember that show cdp neighbors does not show IP addresses or IOS versions; for those you need show cdp neighbors detail or show cdp entry .

SW1 — console

SW1# show cdp neighbors gigabitethernet1/0/24 detail
  • -------------------------
  • Device ID: R1
  • Entry address(es):
  • IP address: 10.1.99.1
  • Platform: cisco ISR4331/K9, Capabilities: Router Switch IGMP

Interface: GigabitEthernet1/0/24, Port ID (outgoing port): GigabitEthernet0/0/0 Holdtime : 147 sec

Version :

Cisco IOS Software [Cupertino], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 17.9.4a, RELEASE SOFTWARE (fc3)

Figure 14-3 show cdp neighbors detail adds the neighbor's IP address, full software version, native VLAN and duplex.

show cdp neighbors detail without an interface lists every neighbor in this format. To display a single neighbor by name, use show cdp entry name ; show cdp entry * is equivalent to the detail command for all neighbors. You can also limit the entry output with keywords, as Figure 14-4 shows.

SW1 — console

SW1# show cdp entry SW2 protocol

Protocol information for SW2 :

IP address: 10.1.99.3

SW1# show cdp entry SW2 version

Version information for SW2 :

Cisco IOS Software [Cupertino], Catalyst L3 Switch Software (CAT9K_LITE_IOSXE), Version 17.9.4, RELEASE SOFTWARE (fc5)

Figure 14-4 show cdp entry with the protocol and version keywords, for a single neighbor.

14.3 Link Layer Discovery Protocol (LLDP)

LLDP, defined in IEEE 802.1AB, is the vendor-neutral equivalent of CDP. It is the protocol to use in multivendor networks. LLDP frames use EtherType 0x88CC and are sent to the multicast address 0180.C200.000E , which standards-compliant bridges never forward.

On Cisco IOS devices, LLDP is disabled by default. Once enabled globally, it runs on all supported interfaces, and you can control transmit and receive separately on each interface. An LLDP interface can therefore listen for neighbors without advertising itself.

14.3.1 LLDP timers and TLVs

LLDP sends advertisements every 30 seconds by default, with a holdtime of 120 seconds (four times the timer). It also has a reinitialization delay of 2 seconds: the time an interface waits after LLDP is disabled on it before it can be re-initialized.

Every LLDP frame (an LLDP Data Unit, LLDPDU) carries four mandatory TLVs, in this order: Chassis ID (often a MAC address), Port ID, Time To Live (the holdtime), and End of LLDPDU. Cisco devices also send optional TLVs by default: Port Description, System Name, System Description (the software version), System Capabilities and Management Address. An extension called LLDP-MED (Media Endpoint Discovery) adds TLVs for endpoints such as IP phones, including network policy (voice VLAN and QoS markings), location and extended PoE information. LLDP-MED is how third-party IP phones learn their voice VLAN, much as Cisco phones do through CDP.

LLDPDU (inside an Ethernet frame, EtherType 0x88CC, dst 0180.C200.000E)

  • Chassis ID
  • type 1
  • Port ID
  • type 2

Ttl

Every TLV has the same Type-Length-Value structure; blue TLVs are mandatory

Figure 14-5 Structure of an LLDPDU: four mandatory TLVs plus optional TLVs, each in Type-Length-Value format.

14.3.2 Configuring LLDP

SW1(config)# lldp run ! enable LLDP globally (off by default)
SW1(config)# lldp timer 30 ! advertisement interval (default 30 s)
SW1(config)# lldp holdtime 120 ! advertised holdtime (default 120 s)
SW1(config)# lldp reinit 2 ! re-initialization delay (default 2 s)
SW1(config)# interface gigabitethernet1/0/48
SW1(config-if)# no lldp transmit ! stop sending on this port
SW1(config-if)# no lldp receive ! stop processing received LLDPDUs

To disable LLDP completely on one interface, configure both no lldp transmit and no lldp receive . To disable it on the whole device, use no lldp run . The interface commands lldp transmit and lldp receive are the defaults once LLDP is running globally.

14.3.3 Verifying LLDP

The LLDP verification commands mirror the CDP ones: show lldp , show lldp neighbors , show lldp neighbors detail , show lldp entry name , show lldp interface and show lldp traffic . show lldp confirms the global status ( Status: ACTIVE ) and the 30-second timer, 120-second holdtime and 2-second reinit delay.

SW1 — console

SW1# show lldp neighbors

Capability codes:

(R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

  • Device ID Local Intf Hold-time Capability Port ID
  • R1 Gi1/0/24 107 R Gi0/0/0
  • SW2 Gi1/0/1 98 B,R Gi1/0/1
  • SEP00562B4A1F20 Gi1/0/5 111 B,T 00562B4A1F20:P1
  • AP-FLOOR2 Gi1/0/12 103 B,W eth0
  • Total entries displayed: 4

Figure 14-6 The LLDP neighbor table. The access point (a non-Cisco device) appears only in LLDP.

SW1 — console

SW1# show lldp neighbors gigabitethernet1/0/24 detail

Cisco IOS Software [Cupertino], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 17.9.4a, RELEASE SOFTWARE (fc3)

  • Time remaining: 101 seconds
  • System Capabilities: B,R
  • Enabled Capabilities: R
  • Management Addresses:
  • IP: 10.1.99.1

... output truncated ...

Figure 14-7 show lldp neighbors detail : chassis ID, port ID, system name and description, capabilities and management address.

Note the two capability lines in the detail output: System Capabilities lists what the device can do, and Enabled Capabilities what it is actually doing. R1 could bridge, but it is operating as a router.

14.4 CDP and LLDP Compared

Table 14-2 CDP versus LLDP

  • Feature CDP LLDP
  • Standard Cisco proprietary IEEE 802.1AB (open)
  • Default on Cisco IOS Enabled Disabled
  • Advertisement timer 60 s 30 s
  • Holdtime 180 s 120 s
  • Enable/disable globally [no] cdp run [no] lldp run

Enable/disable per interface [no] cdp enable [no] lldp transmit and [no] lldp receive Destination MAC 0100.0CCC.CCCC 0180.C200.000E

Voice VLAN to phones Yes (Cisco phones) Yes, via LLDP-MED

Exam alert

Memorize the defaults and timers: CDP on, 60/180; LLDP off, 30/120 (plus reinit 2). Also note the different interface model: CDP uses one command ( no cdp enable ), LLDP uses two independent commands ( no lldp transmit , no lldp receive ). Both protocols can run on the same device simultaneously.

14.5 Mapping a Topology with CDP and LLDP

Because discovery protocols reveal only directly connected neighbors, you build a map one hop at a time. Start on the device you can reach, list its neighbors, note the management IP address of each from the detail output, then SSH to each neighbor and repeat. Record each link as "local device / local port ↔ neighbor / neighbor port". Figure 14-8 shows the map you would draw for the network used in this chapter after running the commands in Figures 14-2 through 14-7 on SW1, plus the same commands on SW2 and R1.

Isr4331, 10.1.99.1

R2

Isr4331, 10.0.12.2

visible; use the MAC table.

Figure 14-8 A topology map built from CDP and LLDP neighbor tables collected on R1, SW1 and SW2.

When mapping, run both protocols (third-party devices may appear only in LLDP), and compare both ends of each link: if SW1 says Gi1/0/1 connects to SW2 Gi1/0/1, SW2 should report the reverse; a mismatch suggests an unmanaged switch or hub in between. End hosts normally run neither protocol, so locate them with show mac address-table and ARP (Chapter 4).

14.6 Security Considerations

Everything that makes CDP and LLDP useful to you also makes them useful to an attacker. A single captured CDP or LLDP frame reveals the device's hostname, model, exact software version (which can be matched against known vulnerabilities), management IP address, native VLAN and VTP domain. Both protocols are unauthenticated, and there have been denial-of-service vulnerabilities in which a flood of crafted CDP frames exhausted a device's memory. Best practice is therefore to run discovery protocols only where they are needed: Disable on untrusted links: interfaces facing the Internet, ISPs, partners and other administrative domains ( no cdp enable ; no lldp transmit and no lldp receive ). Consider disabling on user-facing access ports, except where IP phones or access points need CDP or LLDP-MED for voice VLAN and PoE negotiation.

Keep enabled on infrastructure links between your own switches and routers, where the troubleshooting value is high and the exposure is low.

Disable globally with no cdp run or no lldp run on devices where you do not want them at all, and enable LLDP deliberately rather than everywhere.

Device-hardening questions (Chapter 29) often include "disable CDP on interfaces facing untrusted networks" as a correct answer. If a scenario says an engineer wants to stop sending CDP on one interface but keep it elsewhere, the answer is no cdp enable on that interface, not no cdp run .

LAB Discover and document a network with CDP and LLDP

Goal: Use CDP and LLDP to identify every neighbor of SW1, record a link table, compare CDP with LLDP, and disable discovery on an untrusted interface.

  • R1 SW1 SW2
  • Gi0/0/0 Gi1/0/24 Gi1/0/1 Gi1/0/1
  • Gi1/0/48: untrusted (e.g., to a partner network)

Figure 14-9 Lab topology. Hostnames and management IPs are configured; no diagram is given to you. Steps:

  • 1. On SW1, run show cdp to confirm CDP is running with default timers (60/180), then show cdp neighbors . Record the Device ID, Local Interface and Port ID of each neighbor.
  • 2. Run show cdp neighbors detail and record each neighbor's IP address, platform and IOS version.
  • 3. Enable LLDP on all three devices with lldp run . Wait 30 seconds, then run show lldp neighbors on SW1 and compare the results with CDP.
  • 4. Secure the untrusted port:
SW1(config)# interface gigabitethernet1/0/48
SW1(config-if)# no cdp enable
SW1(config-if)# no lldp transmit
SW1(config-if)# no lldp receive

Verify:

SW1# show cdp interface gigabitethernet1/0/48
SW1# show lldp interface gigabitethernet1/0/48

Figure 14-10 CDP returns nothing for Gi1/0/48 (disabled) and LLDP shows Tx and Rx disabled.

Expected results: CDP and LLDP both list R1 on Gi1/0/24 (Port ID Gi0/0/0) and SW2 on Gi1/0/1 (Port ID Gi1/0/1). Your link table should match Figure 14-9. After step 5, Gi1/0/48 no longer sends or processes CDP or LLDP, while all other interfaces are unaffected. Chapter review

Ieee 802.1ab

Lldp-med

Tlv

Lldpdu

  • 1. What are the default CDP advertisement and holdtime values?
  • A. 30 s and 120 s
  • B. 60 s and 180 s
  • C. 10 s and 40 s
  • D. 30 s and 90 s
  • 2. What are the default LLDP advertisement and holdtime values?
  • A. 30 s and 120 s
  • B. 60 s and 180 s
  • C. 30 s and 90 s
  • D. 60 s and 240 s
  • 3. Which statement about default behaviour on Cisco IOS switches is correct?
  • A. CDP and LLDP are both enabled.
  • B. CDP is enabled and LLDP is disabled.
  • C. LLDP is enabled and CDP is disabled.
  • D. Both are disabled.
  • 4. In show cdp neighbors output on SW1, which column shows the neighbor's interface?
  • A. Device ID
  • B. Local Intrfce
  • C. Port ID
  • D. Platform
  • 5. Which two commands display a CDP neighbor's IP address? (Choose two.)
  • A. show cdp neighbors
  • B. show cdp neighbors detail
  • C. show cdp entry R1
  • D. show cdp interface
  • E. show cdp
  • 6. An engineer wants to stop sending CDP on G0/0/2, which faces an ISP, but keep CDP elsewhere. Which command achieves this?
  • A. no cdp run
  • B. no cdp enable on G0/0/2
  • C. no cdp advertise-v2
  • D. cdp holdtime 0
  • 7. Which two commands together completely disable LLDP on a single interface? (Choose two.)
  • A. no lldp run
  • B. no lldp transmit
  • C. no lldp enable
  • D. no lldp receive
  • E. no cdp enable
  • 8. Which command enables LLDP globally on a Cisco switch?
  • A. lldp enable
  • B. lldp run
  • C. lldp start
  • D. feature lldp
  • 9. Which TLVs are mandatory in every LLDPDU?
  • A. System Name, System Description, Management Address, End
  • B. Chassis ID, Port ID, Time To Live, End of LLDPDU
  • C. Device ID, Platform, Capabilities, Version
  • D. Port Description, VLAN ID, TTL, End
  • 10. SW3 is connected to SW2, which is connected to SW1. Which devices appear in SW1's CDP neighbor table?
  • A. SW2 and SW3
  • B. SW2 only
  • C. SW3 only
  • D. None; CDP requires IP routing
  • 11. Why should CDP be disabled on Internet-facing interfaces?
  • A. It consumes significant bandwidth.
  • B. It reveals device details such as model, IOS version and IP address.
  • C. It conflicts with LLDP.
  • D. It disables STP on that port.
  • 12. An engineer runs lldp holdtime 60 on SW1. What is the effect?
  • A. SW1 deletes neighbor entries after 60 seconds.
  • B. SW1's neighbors keep SW1's entry for up to 60 seconds without a new advertisement.
  • C. SW1 sends LLDPDUs every 60 seconds.
  • D. LLDP re-initializes every 60 seconds.

Answers

  • 1. B. CDP sends every 60 seconds with a 180-second holdtime.
  • 2. A. LLDP sends every 30 seconds with a 120-second holdtime (and a 2-second reinit delay).
  • 3. B. CDP is on by default; LLDP must be enabled with lldp run .
  • 4. C. Port ID is the neighbor's port; Local Intrfce is the port on the device where the command was entered.
  • 5. B and C. The detail and entry commands include the entry addresses; the summary does not.
  • 6. B. no cdp enable works per interface; no cdp run would disable CDP everywhere.
  • 7. B and D. LLDP transmit and receive are controlled independently. no lldp run is global.
  • 8. B. lldp run is the global enable command.
  • 9. B. Chassis ID, Port ID, TTL and End of LLDPDU are mandatory; the others are optional.
  • 10. B. Discovery messages are not forwarded, so only directly connected neighbors appear.
  • 11. B. The information helps attackers fingerprint and target the device; CDP's bandwidth use is trivial.
  • 12. B. The holdtime is advertised to neighbors and tells them how long to keep this device's entry.
Use ← → to move between sections