Checking network documentation with CDP and LLDP

Why this matters

Network diagrams and port spreadsheets go out of date the week they are drawn. Someone moves a cable during an outage, swaps a failed router for a newer model, or plugs a phone into a port documented as a PC. A network technician sent to a closet, or a junior engineer planning a change, needs to know what is really on the other end of each port before trusting the drawing. Walking the cables is slow and often impossible. Asking the devices is fast.

Two protocols let a device tell its neighbours who it is: Cisco's CDP and the IEEE standard LLDP. Read correctly, their output confirms or corrects the documentation port by port: the neighbour's name, its model, its port, its role and its address. Read wrongly, they send you to fix the wrong end of a link. The commonest mistakes are mixing up the local and remote port columns, and misreading which end of a link a log message blames. This lesson shows how to avoid both.

The lesson

Checking the documentation with CDP and LLDP

How neighbour discovery works

The Cisco Discovery Protocol (CDP) is Cisco proprietary. Each device sends an advertisement out of every CDP-enabled interface, in an Ethernet frame to a multicast MAC address. It describes the sender: its name, model, software version, addresses, capabilities and the port it was sent from.

Three facts follow from that design:

• CDP works at Layer 2. It needs no IP connectivity. If R1 Gi0/0/1 is 10.1.1.1/30 and R2 Gi0/0/1 was mistakenly given 10.1.2.2/30, pings fail, but R1 still lists R2. In fact CDP helps here: the detail output shows R2 advertising 10.1.2.2, which reveals the addressing error.
• CDP is not forwarded. A Cisco device consumes the CDP frames it receives. Each table lists only directly connected neighbours. If R3 connects to SW2 and SW2 connects to SW1, R3 appears on SW2 and never on SW1.
• CDP lists any Cisco device, not just switches: routers, phones and access points appear too.

CDP is on by default on Cisco devices. It sends every 60 seconds and tells neighbours to keep the entry for a holdtime of 180 seconds. Current devices send CDP version 2.

The Link Layer Discovery Protocol (LLDP) is IEEE 802.1AB, vendor-neutral, so Cisco devices and other vendors' devices can read each other. Use it wherever a link joins two vendors. On Catalyst switches running IOS XE, LLDP is off globally by default. Its default timers are a 30-second send interval and a 120-second holdtime. The extension LLDP-MED adds endpoint information, such as the voice VLAN policy that lesson 9 used for third-party phones.

Reading show cdp neighbors

Suppose the site diagram shows SW1 Gi1/0/1 cabled to SW2 Gi1/0/1, R1 on SW1 Gi1/0/24, and a PC on SW1 Gi1/0/5:

SW1# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
                  D - Remote, C - CVTA, M - Two-port Mac Relay

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
R1               Gig 1/0/24        151             R S I  ISR4331   Gig 0/0/1
SW2              Gig 1/0/1         163              S I   C9300-48P Gig 1/0/2
SEP00A1B2C3D4E5  Gig 1/0/5         138            H P M   IP Phone  Port 1

Total cdp entries displayed : 3

Read each column for what it is:

• Device ID: the neighbour's hostname. If the neighbour has an ip domain-name set, the domain is appended, so SW2 may appear as SW2.corp.example.net. That is still the documented SW2; the receiving switch adds nothing to names it receives.
• Local Intrfce: this switch's port.
• Holdtme: seconds left before the entry expires. It counts down from 180 and resets with each update.
• Capability: the neighbour's role codes.
• Platform: the model the neighbour reports about itself.
• Port ID: the neighbour's port, the one that sent the advertisement.

Worked check. Compare the output with the diagram, one link at a time:

1. R1: local Gi1/0/24, remote Gi0/0/1, platform ISR4331, codes R S I. Matches.
2. SW2: local Gi1/0/1 matches the diagram. The Port ID is Gi1/0/2, not Gi1/0/1. The SW2 end of the link is documented wrongly. SW1's end is right.
3. Gi1/0/5: the device is a Cisco IP phone. H, P and M mean host, phone and two-port MAC relay, the codes a Cisco phone sends, and phones use a device ID of SEP plus their MAC address. The documented PC is probably plugged into the phone's PC port. A PC normally sends no CDP, so it would never appear with the phone code.

Capability codes describe features, not a single label. R S I means router, switch and IGMP. On a router such as an ISR, that combination is normal. On a Catalyst C9500-24Y4C, it means a switch that is also routing, typically with ip routing and SVIs. If the diagram calls that switch Layer 2 only, the diagram needs correcting; calling it simply a router misreads the codes.

A low holdtime is a warning. With default timers, a healthy entry shows a value between about 120 and 180. An entry showing 12 means nothing has arrived for about 168 seconds, almost three minutes, so the neighbour has stopped sending or the frames are being lost, and the entry is close to aging out. It does not mean a 12-second timer (that would keep the count near the advertised holdtime) and it says nothing about uptime or distance.

Getting more detail

The plain command gives device ID, local port, holdtime, capabilities, platform and port ID. For IP addresses and the software version, use show cdp neighbors detail, or show cdp entry *, or narrow it to one port:

SW1# show cdp neighbors GigabitEthernet1/0/24 detail
-------------------------
Device ID: R1
Entry address(es):
  IP address: 10.0.0.2
Platform: cisco ISR4331/K9,  Capabilities: Router Switch IGMP
Interface: GigabitEthernet1/0/24,  Port ID (outgoing port): GigabitEthernet0/0/1
Holdtime : 151 sec

Version :
Cisco IOS XE Software, Version 17.09.05

advertisement version: 2
Duplex: full
Management address(es):
  IP address: 10.0.0.2

This is how to fill in each neighbour's management address in the documentation. If the inventory says R1 is an ISR 4331 but the Platform field reads cisco C8200-1N-4T, the router has been replaced with a Catalyst 8200 Series router and the inventory needs updating. CDP reports the model the device reports about itself; it does not misreport models.

Other CDP commands, each with one job:

• show cdp: the global settings, meaning the send interval, the holdtime advertised and whether CDPv2 is enabled.
• show cdp interface: which local interfaces run CDP, and their timers. It says nothing about who is on the far end.
• show cdp traffic: counts of CDP packets sent and received, including errors.
• clear cdp table: deletes the neighbour table. It refills within a minute as neighbours send their next advertisements, so stale entries left after a recabling job disappear.
• clear cdp counters: resets only the statistics in show cdp traffic.

SW1# show cdp
Global CDP information:
        Sending CDP packets every 60 seconds
        Sending a holdtime value of 180 seconds
        Sending CDPv2 advertisements is  enabled

CDP log messages

Because each advertisement carries the sender's native VLAN and duplex, CDP can spot a mismatch from one end and log it. The rule for reading these messages: the first interface and value are local; the one after "with" is the neighbour's.

SW1# show logging | include CDP
%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/0/1 (1), with SW2 GigabitEthernet1/0/2 (99).

SW1's Gi1/0/1 uses native VLAN 1, SW2's Gi1/0/2 uses 99. If the design says 99, fix SW1. CDP itself does not need any particular VLAN; the point is that both ends of a trunk must agree on which VLAN is untagged (lesson 8).

R1# show logging | include DUPLEX
%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet0/0/1 (not full duplex), with SW1 GigabitEthernet1/0/24 (full duplex).

Logged on R1, this blames R1's own Gi0/0/1, which is not at full duplex. SW1's end already matches a full-duplex design. Lesson 1 covers duplex faults.

Controlling CDP

• no cdp run in global configuration stops CDP on the whole device. cdp run starts it.
• no cdp enable on an interface stops CDP on that interface only. This is the right command for R1's internet link, GigabitEthernet0/0/0, when CDP must keep running internally.
• no cdp advertise-v2 drops the device back to version 1. It does not stop CDP.

Reading and controlling LLDP

Turn LLDP on for the whole switch with lldp run. Each interface has two settings, lldp transmit and lldp receive, both enabled by default, so they do nothing until LLDP runs globally:

SW1(config)# lldp run
SW1(config)# interface GigabitEthernet1/0/3
SW1(config-if)# lldp transmit
SW1(config-if)# lldp receive

The two directions can fail separately. If the neighbour on Gi1/0/3 lists SW1 but SW1 shows nothing on Gi1/0/3, SW1 is probably sending but not listening: check the port for no lldp receive, and check that the neighbour is transmitting. The reverse case, SW1 learns the neighbour but the neighbour cannot see SW1, points to no lldp transmit. If LLDP was turned off with no lldp run and the port also has no lldp transmit, both lldp run and lldp transmit are needed before the neighbour can learn SW1. CDP commands never help a neighbour that speaks only LLDP.

SW1# show lldp neighbors
Capability codes:
    (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
    (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

Device ID           Local Intf     Hold-time  Capability      Port ID
edge-sw7            Gi1/0/48       105        B               ge-0/0/1
fw-edge             Gi1/0/47       98         R               eth1/1

Total entries displayed: 2

LLDP has no separate switch code. IEEE 802.1AB reports a switch as a MAC bridge, code B, so edge-sw7 matches a diagram that calls it a switch. S in LLDP means station, an end host such as a server, which is the opposite of CDP's S. The columns otherwise read as in CDP: Local Intf is SW1's port, Port ID is the neighbour's.

With default timers a neighbour keeps SW1's entry for up to 120 seconds after the last advertisement. clear lldp table removes entries early, but they age out on their own.

For a neighbour's full record, including its management address, use show lldp entry with its name, or show lldp neighbors detail for all of them:

SW1# show lldp entry fw-edge
------------------------------------------------
Local Intf: Gi1/0/47
Chassis id: 0050.56aa.0101
Port id: eth1/1
Port Description: inside-trunk
System Name: fw-edge

System Description:
Edge firewall, software 10.2

Time remaining: 98 seconds
System Capabilities: R
Enabled Capabilities: R
Management Addresses:
    IP: 192.168.100.1

show cdp entry fw-edge would find nothing, because a non-Cisco firewall advertises through LLDP. show lldp interface shows only the local transmit and receive settings, and show lldp traffic only counters.

Where not to run them

CDP and LLDP send the device name, platform, software version and management addresses in clear frames. That helps an attacker choose an exploit. They do not let a neighbour change VLANs, and they carry no passwords; the risk is information disclosure. Hardening guides therefore turn them off on ports facing the internet or untrusted users, with no cdp enable and no lldp transmit on those interfaces, and leave them on where the neighbour is trusted.

What the exam is really asking

• Local Intrfce vs Port ID. The first is your port; the second is the neighbour's. Most documentation questions turn on this.
• Which end a log message blames. The first interface is local; the one after "with" belongs to the neighbour.
• Timers. CDP 60 and 180 seconds; LLDP 30 and 120 seconds. They are easy to swap.
• Defaults. CDP on; LLDP off globally on Catalyst IOS XE until lldp run.
• Global vs interface. no cdp run stops CDP everywhere; no cdp enable stops it on one port. lldp run is global; lldp transmit and lldp receive are per port.
• Plain vs detail. IP address and software version need detail or show cdp entry.
• Capability codes. R S I on a Catalyst means a routing switch. H P M is a Cisco phone. LLDP B is a switch, LLDP S is a station.
• Directly connected only, Layer 2 only. CDP is not forwarded and needs no IP.
• CDP for Cisco, LLDP between vendors.
• Why disable them. Information disclosure, not configuration changes.