Layer 2 Discovery with CDP and LLDP

What it is

CDP and LLDP let devices announce themselves to the neighbours they are directly connected to.

A network diagram is often out of date. Discovery protocols give you the real picture. From any device, you can see which neighbours it has, what port they are on, and what type of device they are.

There are two protocols to know:

• CDP (Cisco Discovery Protocol): developed by Cisco and used on Cisco devices.
• LLDP (Link Layer Discovery Protocol): an open standard, IEEE 802.1AB, that works between devices from different vendors.

Both work at Layer 2, so they do not need IP addresses to function. They only reach the device on the other end of the cable. They are not forwarded by switches or routers.

How it works

Each device advertises itself on a timer, and each neighbour stores what it hears until the entry expires.

What the protocols share

Each device sends periodic advertisements out of its interfaces. A neighbour reads the information and stores it in a table until the entry expires.

Typical information includes:

• the neighbour's name (hostname)
• the local port and the neighbour's port
• the device type or capability, such as router or switch
• the platform model
• the management IP address

This helps with documenting a network, troubleshooting a link and checking that a cable goes where it should.

CDP

CDP is enabled by default on most Cisco devices. It sends advertisements every 60 seconds and keeps neighbour information for 180 seconds, by default. Frames go to a Cisco multicast address.

show cdp
show cdp neighbors
show cdp neighbors detail
show cdp interface

show cdp neighbors gives a short table with the neighbour's device ID, the local interface, the holdtime, the capability, the platform and the remote port ID. show cdp neighbors detail adds the IP address and software version of each neighbour.

CDP can be turned off on the whole device, or on one interface.

no cdp run
interface GigabitEthernet0/1
 no cdp enable

To change the timers:

cdp timer 30
cdp holdtime 120

LLDP

LLDP does a similar job, but it is a standard, so it can be used with phones, servers and other vendors' switches.

On Cisco devices, LLDP is usually not enabled by default and must be turned on. Its default timers are 30 seconds between advertisements and a holdtime of 120 seconds.

lldp run
interface GigabitEthernet0/1
 lldp transmit
 lldp receive

lldp run turns it on for the device. The interface commands lldp transmit and lldp receive control whether the port sends and listens. By default, both are on, once LLDP is running.

To look at the results:

show lldp
show lldp neighbors
show lldp neighbors detail

An extension called LLDP-MED adds extra information for voice and video devices, such as which VLAN a phone should use.

Side by side

Security note

Discovery protocols reveal useful details to anyone who can listen on a link, such as device models and software versions.

On ports that face users or the outside world, it is good practice to switch them off. Keep them on between your own infrastructure devices, where they are useful.