Who is on the other end of this cable?
Network devices announce themselves to their directly connected neighbours every so often. Each neighbour keeps what it heard for a holdtime. Two protocols do this:
| CDP | LLDP | |
|---|---|---|
| Standard | Cisco only | IEEE 802.1AB, any vendor |
| On by default (Cisco) | Yes | No: lldp run |
| Timer / holdtime | 60 s / 180 s | 30 s / 120 s |
| Shows | Device ID, local and remote port, platform, capabilities, IP address, IOS version | System name, port, capabilities, management address, description |
In NetLab
▶ CORE1 CORE1>enable CORE1#show cdp neighbors Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone, D - Remote, C - CVTA, M - Two-port Mac Relay Device ID Local Intrfce Holdtme Capability Platform Port ID ACC1 Fas 0/1 163 S I NL-S2400 Gig 0/1 ACC2 Fas 0/2 163 S I NL-S2400 Gig 0/1 R1 Gig 0/1 163 R B S I NL-R3000 Gig 0/1 Total cdp entries displayed : 3 CORE1#show cdp neighbors detail | include Device ID|IP address|Interface Device ID: ACC1 IP address: 192.168.1.2 Interface: FastEthernet0/1, Port ID (outgoing port): GigabitEthernet0/1 IP address: 192.168.1.2 Device ID: ACC2 IP address: 192.168.1.3 Interface: FastEthernet0/2, Port ID (outgoing port): GigabitEthernet0/1 IP address: 192.168.1.3 Device ID: R1 IP address: 10.0.0.1 Interface: GigabitEthernet0/1, Port ID (outgoing port): GigabitEthernet0/1 IP address: 10.0.0.1
CDP shows only directly connected devices. To map a bigger network, log in to each neighbour and repeat. Each neighbour's IP address in the detail output tells you where to connect next.
LLDP
LLDP must be turned on (lldp run) on both ends. Per interface you can stop sending (no lldp transmit) or listening (no lldp receive).
In NetLab
▶ CORE1 CORE1>enable CORE1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. CORE1(config)#lldp run CORE1(config)#end *Mar 1 00:00:04.000: %SYS-5-CONFIG_I: Configured from console by console ▶ ACC1 ACC1>enable ACC1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. ACC1(config)#lldp run ACC1(config)#end *Mar 1 00:00:08.000: %SYS-5-CONFIG_I: Configured from console by console ACC1#show lldp neighbors Capability codes: (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other Device ID Local Intf Hold-time Capability Port ID CORE1 Gi0/1 120 B,R Fa0/1 Total entries displayed: 1
Security
CDP and LLDP give an attacker your device names, models, software versions and addresses. Turn them off where they aren't needed, typically on ports facing users or the internet: no cdp enable and no lldp transmit on the interface, or no cdp run for the whole device. Keep them where IP phones need them to learn their voice VLAN.
In NetLab
▶ ACC1 ACC1>enable ACC1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. ACC1(config)#interface fa0/5 ACC1(config-if)#no cdp enable ACC1(config-if)#exit ACC1(config)#cdp timer 30 ACC1(config)#end *Mar 1 00:00:07.000: %SYS-5-CONFIG_I: Configured from console by console ACC1#show cdp Global CDP information: Sending CDP packets every 30 seconds Sending a holdtime value of 180 seconds Sending CDPv2 advertisements is enabled ACC1#show cdp interface fa0/5 FastEthernet0/5 is up, line protocol is up CDP is disabled on this interface