CDP and LLDP: discovering neighbours, mapping networks and locking them down

What discovery protocols do

A discovery protocol lets a device announce "who I am and how I am connected" to the device at the other end of each cable. Messages are sent to a special multicast MAC address and are not forwarded by switches, so you only ever learn about direct neighbours. They work even before IP is configured, which makes them very useful when you are building or troubleshooting a network.

A typical advertisement contains the device name, the local port the message left from, the platform or model, software version, management IP address, capabilities (router, switch, phone, access point) and sometimes the native VLAN and duplex.

CDP and LLDP compared

Using them at work

show cdp neighbors
show cdp neighbors detail          (adds IP address and software version)
lldp run                           (enable LLDP globally)
show lldp neighbors
show lldp neighbors detail

Common uses:

• Mapping an undocumented network: log in to the core switch, list its neighbours, then hop to each one in turn and repeat. Within an hour you can draw the physical topology.
• Finding where something is plugged in: an IP phone or AP reports the switch port it is connected to.
• Spotting mistakes: CDP logs a warning when the native VLAN or duplex differs on the two ends of a link.
• Automation and monitoring: network management systems read neighbour tables over SNMP or APIs to build live topology maps.
• Servers and hypervisors: many can run LLDP, so you can confirm which switch port a server NIC uses.

Security: turn them off where they are not needed

Discovery messages are sent in clear text and are not authenticated. Anyone who plugs a laptop into a port can capture them and learn the switch model, software version and management IP: an easy start for reconnaissance. Forged messages have also been used to exploit software bugs. Good practice is:

1. Disable CDP and LLDP on interfaces facing the internet, ISPs and other organisations.
2. Disable them on user-facing access ports where no phones or APs need them, or leave only LLDP-MED where phones need it.
3. Keep them on infrastructure links between your own switches and routers.
4. Keep device software patched, since parsing bugs in discovery protocols are found from time to time.

interface GigabitEthernet0/0
 description Link to ISP
 no cdp enable
 no lldp transmit
 no lldp receive

Real-world example: while cleaning up a school network, an engineer found an unknown "switch" on a classroom port through show cdp neighbors. It was a small unmanaged switch with a cheap wireless router behind it, set up by a teacher. Discovery protocols turned a vague "Wi-Fi is weird in room 12" complaint into a five-minute fix.

Tip: when you document a site, save the output of show cdp neighbors detail or show lldp neighbors detail from every switch alongside the configuration backups. If a cable is later moved or a device replaced, comparing the saved neighbour lists with the current ones shows exactly what changed, which is far faster than tracing cables by hand in a crowded comms cabinet.

Inside the frames: headers and TLVs

Both protocols use the same simple idea: a short header followed by a list of TLVs (type, length, value). The type says what the item is, the length says how many bytes follow, and the value holds the data. A receiver that does not understand a type can skip it using the length, which is how vendors add features without breaking older devices.

• CDP frames go to the multicast MAC address 01:00:0C:CC:CC:CC. The CDP header has a version, a TTL (the holdtime, telling the neighbour how long to keep the entry) and a checksum. Common TLVs carry the device ID, addresses, port ID, capabilities, software version, platform, native VLAN and duplex.
• LLDP frames use EtherType 0x88CC and are usually sent to 01:80:C2:00:00:0E, which bridges do not forward. Four TLVs are mandatory: chassis ID, port ID, TTL and end of LLDPDU. Optional TLVs add the system name, description, capabilities and management address, and LLDP-MED adds voice VLAN and power details for IP phones.

cdp timer 30
cdp holdtime 90
show cdp traffic
show lldp neighbors detail
show lldp traffic

Mismatched native VLAN or duplex messages in the logs come from these TLVs: the switch compares what its neighbour reports with its own settings and warns you.