CDP and LLDP: discovering neighbours

What problem do they solve?

You join a company as a network engineer. The diagram on the wiki is three years old. Which switch is connected to which port of the core? What model is it? What is its management IP address? Walking to every rack and tracing cables takes days. Discovery protocols answer these questions in seconds from the command line.

A discovery protocol makes each device send a small message out of every port at a regular interval, saying "I am SW2, a Cisco 2960, this is my port Gi0/1, my IP address is 10.0.0.2". The devices directly connected (the neighbours) store this information. Messages are not forwarded further, so you only learn about devices one hop away.

CDP: Cisco Discovery Protocol

• Cisco proprietary: mainly Cisco devices (and some others, like IP phones) understand it.
• Enabled by default on Cisco IOS routers and switches.
• Sent every 60 seconds by default (the CDP timer).
• Holdtime 180 seconds: if no message arrives for 180 seconds, the neighbour is removed from the table.
• Works at layer 2, so it works even before IP addresses are configured.

SW1# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
R1               Gig 0/1           163          R B S I   ISR4331   Gig 0/0/0
SW2              Gig 0/2           141          S I       WS-C2960  Gig 0/1

Read each line as: "On my port (Local Intrfce) I can see device (Device ID), which is a (Platform), connected through its port (Port ID)." Holdtme counts down from 180 and is reset each time a message arrives.

show cdp neighbors detail adds the neighbour's IP address, full software version, native VLAN and duplex. That is how you find the management address of a switch you cannot reach otherwise, and spot native VLAN or duplex mismatches.

SW1(config)# no cdp run
SW1(config)# cdp run
SW1(config)# interface gigabitEthernet 0/5
SW1(config-if)# no cdp enable
SW1(config-if)# exit
SW1(config)# cdp timer 60
SW1(config)# cdp holdtime 180

LLDP: the open standard

LLDP (Link Layer Discovery Protocol) is defined in IEEE 802.1AB. It does the same job as CDP but works across vendors: Cisco, Juniper, Aruba, Linux servers and many IP phones. In a mixed network, LLDP is what lets your Cisco switch see the HPE server or the Juniper firewall next to it.

• Sent every 30 seconds by default; holdtime 120 seconds.
• Off by default on many Cisco IOS devices. Turn it on globally with lldp run.
• Per interface you can control sending and receiving separately: lldp transmit and lldp receive.
• LLDP-MED, an extension, tells IP phones which voice VLAN to use, like CDP does for Cisco phones.

SW1(config)# lldp run
SW1(config)# interface gigabitEthernet 0/5
SW1(config-if)# no lldp transmit
SW1(config-if)# no lldp receive
SW1(config-if)# end
SW1# show lldp neighbors
SW1# show lldp neighbors detail

Security: why you turn them off at the edge

CDP and LLDP messages are sent in clear text to anyone connected. A visitor who plugs a laptop into a meeting-room port can capture one message and learn the switch name, exact model, software version and management IP address. With the version, they can look up known vulnerabilities. So the usual rule is: keep CDP or LLDP on links between your own network devices, and turn them off on ports facing users, the internet or other companies.

Using them to draw a network diagram

1. Start at the core switch. Run show cdp neighbors (or show lldp neighbors).
2. For each neighbour, draw a box and a line labelled with both port names, for example "CORE Gi1/0/1 to SW2 Gi0/1".
3. Use show cdp neighbors detail to note each neighbour's management IP address.
4. Log in to each neighbour in turn and repeat, until you find no new devices.