Layer 2 Discovery Protocols

Layer 2 discovery protocols allow network devices to learn about their directly connected neighbors without requiring IP connectivity. This is invaluable for network documentation, troubleshooting, and topology discovery.

CDP (Cisco Discovery Protocol)

CDP is a Cisco-proprietary Layer 2 protocol that discovers directly connected Cisco devices.

Key Characteristics:

• Enabled by default on all Cisco devices
• Sends advertisements every 60 seconds
• Hold time: 180 seconds (3x the advertisement interval)
• Operates at Layer 2 (does not require IP addresses)
• Discovers only directly connected devices (does not cross routers)

Information Discovered by CDP

CDP Commands

Switch# show cdp neighbors              ! Summary of all neighbors
Switch# show cdp neighbors detail       ! Detailed info (including IP addresses)
Switch# show cdp entry *                ! Same as neighbors detail
Switch# show cdp interface              ! CDP status per interface

Switch(config)# no cdp run              ! Disable CDP globally
Switch(config)# cdp run                 ! Enable CDP globally

Switch(config-if)# no cdp enable        ! Disable CDP on a specific interface
Switch(config-if)# cdp enable           ! Enable CDP on a specific interface

Sample "show cdp neighbors" Output

Device ID   Local Intrfce   Holdtme    Capability  Platform      Port ID
Switch2     Gig 0/24        155             S I     WS-C3850     Gig 0/24
Router1     Gig 0/1         167             R S I   ISR4331      Gig 0/0/0
AP-Floor2   Gig 0/12        140             T       AIR-AP2802   Gig 0

LLDP (Link Layer Discovery Protocol)

LLDP is the IEEE 802.1AB standard for Layer 2 neighbor discovery. It is vendor-neutral and works across different manufacturers' equipment.

Key Characteristics:

• Disabled by default on Cisco devices (must be enabled)
• Sends advertisements every 30 seconds
• Hold time: 120 seconds
• Operates at Layer 2
• Uses multicast address 01:80:C2:00:00:0E

LLDP vs. CDP Comparison

LLDP Commands

Switch(config)# lldp run                            ! Enable LLDP globally
Switch(config)# no lldp run                          ! Disable LLDP globally

Switch(config-if)# lldp transmit                     ! Enable sending LLDP on interface
Switch(config-if)# lldp receive                      ! Enable receiving LLDP on interface
Switch(config-if)# no lldp transmit                  ! Disable sending LLDP on interface

Switch# show lldp neighbors                          ! Summary of neighbors
Switch# show lldp neighbors detail                   ! Detailed info

Security Considerations

Both CDP and LLDP share sensitive information about your network devices. An attacker connected to a switch port could learn:

• Device hostnames and IP addresses
• Hardware models and software versions
• Network topology information

Best practices:

• Disable CDP/LLDP on external-facing interfaces (internet edge, guest ports)
• Disable CDP/LLDP on access ports where not needed
• Consider running LLDP instead of CDP in multi-vendor environments
• Leave CDP/LLDP enabled on inter-switch links for troubleshooting

On the Exam: Know that CDP is enabled by default and LLDP is disabled by default on Cisco devices. Questions may ask about the commands to verify neighbors or the information that can be discovered.