Learning Objectives

• Understand the purpose of LLDP and CDP in network discovery
• Different between the two protocols and their TLV structures
• Identify when each protocol is appropriate

Link Layer Discovery Protocol

LLDP (IEEE 802.1AB) is a vendor-neutral protocol that allows network devices to advertise their identity, capabilities, and neighbors. Think of it as a "hello" message that every switch port sends, telling any nearby device who it is and what it can do.

LLDP operates at Layer 2. Devices send LLDP frames periodically (default: 30 seconds) to the multicast MAC address 01:80:C2:00:00:0E. The information is organized into TLVs (Type-Length-Value) structures — each TLV carries a specific piece of data.

Cisco Discovery Protocol

CDP (Cisco Discovery Protocol) is Cisco's proprietary alternative to LLDP. It was invented before LLDP existed and is enabled by default on all Cisco devices. CDP sends frames to the multicast address 01:00:0C:CC:CC:CC.

CDP and LLDP serve the same purpose but have key differences:

| Feature | LLDP (802.1AB) | CDP | |---|---|---| | Standard | IEEE vendor-neutral | Cisco proprietary | | Default interval | 30 seconds | 60 seconds | | Hold time multiplier | 4 (120 seconds) | 3 (180 seconds) | | Transport | Ethernet (type 0x88CC) | Ethernet (type 0x2000) | | Multicast MAC | 01:80:C2:00:00:0E | 01:00:0C:CC:CC:CC | | TLVs sent | Chassis ID, Port ID, TTL, System Name, Capabilities, Management Address | Device ID, Port ID, Capabilities, Platform, Software Version, VTP Domain | | Vendor support | Multi-vendor | Cisco-only |

TLV Comparison

LLDP has a strict TLV structure defined in the standard. Mandatory TLVs include Chassis ID (the device's MAC or hostname), Port ID (the port name or MAC), and TTL (how long to hold the information). Optional TLVs include system name, system description, capabilities, management address, and VLAN information.

CDP carries richer Cisco-specific information. It announces the exact software version running on the device, the VTP domain (if using Cisco VLAN Trunking Protocol), the native VLAN on a trunk, and the power draw for PoE (Power over Ethernet) — critical information when designing power budgets.

Security Considerations

Both LLDP and CDP are enabled by default on most devices, and this default is a security concern. An attacker connected to an LLDP-enabled port receives detailed information about the switch — its hostname, model, software version, and management IP. This is reconnaissance gold.

Consider disabling both protocols on ports that connect to untrusted devices (guest networks, public areas, external connections). Cisco's security best practice is to use no cdp enable or no lldp receive on edge ports while leaving it enabled on infrastructure links.

Troubleshooting with LLDP and CDP

When diagnosing network issues, LLDP and CDP are invaluable. A few common uses:

• VLAN mismatch — CDP advertises the native VLAN on trunk ports. If two ends disagree, CDP reports a native VLAN mismatch in the logs.
• Duplex mismatch — Both protocols advertise port capabilities. If one side is full-duplex and the other half-duplex, the mismatch is visible in the neighbor entries.
• Cabling errors — The neighbor device identity tells you exactly what is connected. If you intended a switch-to-switch link but the neighbor is a router, you'll see it immediately.
• Power over Ethernet — CDP reports the power request and allocation, helping troubleshoot PoE budget exhaustion.

The show lldp neighbors and show cdp neighbors commands (or their equivalents) display all discovered neighbors in a compact table, showing the device ID, local interface, hold time, and capabilities.

Key Takeaways

• LLDP (IEEE 802.1AB) is a vendor-neutral Layer 2 discovery protocol
• CDP is Cisco's proprietary alternative with richer device information
• Both use TLV structures to advertise device identity, capabilities, and management addresses
• CDP includes Cisco-specific information like software version, VTP domain, and PoE power
• Disable both protocols on untrusted edge ports to prevent information leakage
• Both are essential troubleshooting tools for verifying VLAN, duplex, and neighbor connectivity