CDP and LLDP

Cisco Discovery Protocol (CDP) is a Cisco-proprietary Layer 2 protocol that runs on all Cisco devices — routers, switches, firewalls, access points, and IP phones. It enables devices to discover each other, learn their device type, hostname, IP address, IOS version, and platform, even if they are not configured with the same Layer 3 protocol. CDP operates at Layer 2 (data link layer) and sends frames to the multicast destination address 01:00:0C:CC:CC:CC. It is enabled by default on Cisco devices.

Link Layer Discovery Protocol (LLDP) is the IEEE standard (802.1AB) equivalent. It is vendor-neutral and allows devices from different vendors to discover each other. LLDP sends frames to the multicast address 01:80:C2:00:00:0E (or 01:80:C2:00:00:03 for LLDP-MED). On Cisco devices, LLDP is disabled by default and must be enabled globally and per interface.

Both protocols serve the same fundamental purpose: neighbor discovery and topology mapping. However, the exam focuses on their configuration, verification, and differences.

- Device ID (hostname) - Addresses (network layer addresses, usually IP) - Port ID (interface name) - Capabilities (e.g., router, switch, host) - Software Version - Platform (e.g., Cisco 2960) - VTP Management Domain - Native VLAN (for switches) - Full/Half Duplex

LLDP works similarly but with these differences: - Multicast Address: 01:80:C2:00:00:0E - Timers: Default LLDP timer is 30 seconds; holdtime multiplier is 4, so holdtime = 120 seconds (4 x 30). - TLVs: LLDP uses a standard set of TLVs defined by IEEE 802.1AB. Cisco also supports LLDP-MED (Media Endpoint Discovery) for VoIP devices, which adds TLVs for power negotiation, network policy, and location. - Configuration: On Cisco IOS, you must enable LLDP globally with lldp run and per interface with lldp transmit and lldp receive.

| Parameter | CDP Default | LLDP Default | |-----------|-------------|--------------| | Global state | Enabled | Disabled | | Timer | 60 seconds | 30 seconds | | Holdtime | 180 seconds | 120 seconds | | Per interface | Enabled (transmit & receive) | Disabled | | Version | 2 | IEEE 802.1AB |

CDP Commands: - show cdp neighbors – Displays a summary of CDP neighbors. - show cdp neighbors detail – Shows detailed information including IP address, IOS version, and capabilities. - show cdp interface [interface-id] – Shows CDP status and timers on an interface. - show cdp traffic – Shows CDP packet statistics. - show cdp entry * – Shows all CDP entries with details.

Example output of `show cdp neighbors`:

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
                  D - Remote, C - CVTA, M - Two-port Mac Relay

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
Switch-2         Gig 0/1           152         S I        WS-C2960  Gig 0/2
Router-A         Gig 0/2           175         R S I      ISR4321   Gig 0/0

LLDP Commands: - show lldp neighbors – Similar output to CDP. - show lldp neighbors detail – Detailed neighbor info. - show lldp interface [interface-id] – Shows LLDP status on an interface. - show lldp traffic – Statistics. - show lldp entry * – All entries.

Example output of `show lldp neighbors`:

Capability codes:
    (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
    (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

Device ID           Local Intf     Hold-time  Capability      Port ID
Juniper-1           Gi0/0          120        R               ge-0/0/0

CDP and LLDP are independent of STP, VLANs, and routing protocols. They operate at Layer 2 and do not rely on IP connectivity. However, they can be used by other protocols: for example, Cisco IP phones use CDP to learn the voice VLAN and power requirements (PoE). CDP also assists in Dynamic Trunking Protocol (DTP) and VLAN Trunking Protocol (VTP) advertisements, though these are less common now.

Because CDP and LLDP send information about the device, they can be a security risk. Attackers can learn device types, IOS versions, and IP addresses. Best practice is to disable CDP/LLDP on interfaces that connect to untrusted networks (e.g., internet-facing) or where discovery is not needed. Use no cdp enable or no lldp transmit / no lldp receive on specific interfaces.

In enterprise networks, CDP and LLDP are invaluable for automated topology discovery and troubleshooting. Here are three common scenarios:

1. VoIP Deployment with CDP Cisco IP phones use CDP to learn the voice VLAN ID and negotiate Power over Ethernet (PoE) power levels. When a phone plugs into a switch port, CDP frames carry the voice VLAN TLV, and the phone automatically tags its traffic with that VLAN. Without CDP, the phone might use the access VLAN (usually data) and cause voice quality issues or fail to get an IP address. Network engineers ensure CDP is enabled on access ports connecting to phones. They also use show cdp neighbors to verify the phone is detected and check its power negotiation.

2. Multi-Vendor Environment with LLDP In a data center with Cisco switches and Juniper routers, LLDP is the common language. Engineers enable LLDP on all devices to build a network map using tools like Cisco Prime or open-source LLDP daemons. LLDP-MED is used for IP phones from different vendors. Misconfiguration occurs when LLDP is enabled globally but not on specific interfaces, or when the holdtime is too short, causing flapping neighbor entries. Engineers adjust timers with lldp timer and lldp holdtime to match the network's stability requirements.

3. Security Hardening Security teams often disable CDP and LLDP on interfaces facing the internet or untrusted networks to prevent information leakage. For example, on a router's WAN interface, no cdp enable is configured. However, internal interfaces usually keep CDP/LLDP enabled for operational visibility. A common mistake is disabling CDP globally (no cdp run) and then wondering why IP phones don't work. The solution is to disable only on external interfaces.

Scale and Performance: CDP/LLDP generate minimal overhead — a few frames per minute per interface. Even in large networks with thousands of devices, the CPU impact is negligible. However, if timers are set too low (e.g., 5 seconds), the control plane can be overwhelmed. Always use default timers unless you have a specific need.