Have you ever walked into a server room, seen a wall of switches with dozens of cables, and wondered “what’s actually connected to what”? Layer 2 discovery protocols answer exactly that question — automatically, without you having to trace a single cable.
Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) are protocols that let directly connected network devices learn about each other — device type, hostname, IP address, platform, and which local port connects to which remote port — entirely automatically.
This article explains both protocols in depth, shows how to configure and verify them on Cisco devices, and explains why LLDP has become the preferred choice in modern multi-vendor networks.
Why Discovery Protocols Exist
Without a discovery protocol, documenting a network requires manually tracing cables or relying on outdated diagrams. In a data center with hundreds of switches, this becomes impractical. Discovery protocols solve this by having each device periodically advertise information about itself on every active interface, and listen for advertisements from directly connected neighbors.
This information is enormously useful for:
- Building accurate network diagrams
- Verifying physical cabling matches your intended design
- Troubleshooting (“Is this port even connected to what I think it is?”)
- Automation tools that build topology maps automatically
CDP: Cisco Discovery Protocol
CDP is a Cisco-proprietary Layer 2 protocol. It only works between Cisco devices (or devices from vendors who have licensed/implemented it). It operates directly at Layer 2, using a multicast destination MAC address (01:00:0c:cc:cc:cc), and it works regardless of Layer 3 configuration — even on interfaces with no IP address at all.
CDP Characteristics
- Enabled by default on all Cisco devices (in most versions), globally and per-interface.
- Advertises every 60 seconds by default.
- Holds neighbor information for 180 seconds (holdtime) before discarding it if no update is received.
- Works over trunk links, access links, and even directly connected serial links.
CDP Configuration
CDP is on by default, but here’s how to control it explicitly.
Enable CDP globally (rarely needed, since it’s on by default):
Switch(config)# cdp runDisable CDP globally (for security hardening on edge-facing devices):
Switch(config)# no cdp runDisable CDP on a specific interface (recommended on interfaces facing untrusted networks, like ISP-facing WAN links):
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# no cdp enableRe-enable CDP on a specific interface:
Switch(config-if)# cdp enableAdjust timers (optional):
Switch(config)# cdp timer 30
Switch(config)# cdp holdtime 90CDP Verification Commands
show cdp neighbors — quick summary view:
Switch# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
SW2 Gig 0/1 156 S WS-C3560 Gig 0/2
R1 Gig 0/2 178 R C892FSP Gig 0/0show cdp neighbors detail — full detail, including IP address, software version, and duplex:
Switch# show cdp neighbors detail
-------------------------
Device ID: SW2
Entry address(es):
IP address: 192.168.1.2
Platform: cisco WS-C3560-24PS, Capabilities: Switch IGMP
Interface: GigabitEthernet0/1, Port ID (outgoing port): GigabitEthernet0/2
Holdtime : 145 sec
Version :
Cisco IOS Software, C3560 Software...
advertisement version: 2
Duplex: full
Management address(es):show cdp interface — confirms which interfaces have CDP enabled:
Switch# show cdp interface
GigabitEthernet0/1 is up, line protocol is up
Encapsulation ARPA
Sending CDP packets every 60 seconds
Holdtime is 180 secondsshow cdp entry <device-name> — details for one specific neighbor by name.
LLDP: Link Layer Discovery Protocol
LLDP (IEEE 802.1AB) is the open, vendor-neutral standard equivalent to CDP. Because it’s an IEEE standard, LLDP works across Cisco, Juniper, HP, Arista, Linux servers, IP phones, and virtually any modern networking equipment — making it the correct choice for multi-vendor environments.
LLDP Characteristics
- Disabled by default on most Cisco devices (unlike CDP, which is on by default).
- Also advertises every 30 seconds by default (note: LLDP’s default timer differs from CDP’s 60-second default), with a default hold time of 120 seconds.
- Uses its own multicast destination MAC address (
01:80:c2:00:00:0e). - Widely used to discover VoIP phones (Cisco IP Phones support LLDP-MED, an extension for power and voice VLAN information).
LLDP Configuration
Enable LLDP globally:
Switch(config)# lldp runDisable LLDP globally:
Switch(config)# no lldp runEnable/disable LLDP transmit and receive per interface:
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# lldp transmit
Switch(config-if)# lldp receiveTo disable only transmission (still receive/listen) or vice versa:
Switch(config-if)# no lldp transmit
Switch(config-if)# no lldp receiveAdjust timers (optional):
Switch(config)# lldp timer 30
Switch(config)# lldp holdtime 120
Switch(config)# lldp reinit 2LLDP Verification Commands
show lldp neighbors:
Switch# show lldp neighbors
Capability codes:
(R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
(W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other
Device ID Local Intf Hold-time Capability Port ID
SW2.example.com Gi0/1 120 B Gi0/2show lldp neighbors detail:
Switch# show lldp neighbors detail
------------------------------------------------
Local Intf: Gi0/1
Chassis id: aabb.cc00.0200
Port id: Gi0/2
Port Description: GigabitEthernet0/2
System Name: SW2.example.com
System Description:
Cisco IOS Software...
Time remaining: 98 seconds
System Capabilities: B
Enabled Capabilities: B
Management Addresses:
IP: 192.168.1.2show lldp interface:
Switch# show lldp interface GigabitEthernet0/1
GigabitEthernet0/1:
Tx: enabled
Rx: enabled
Tx state: IDLE
Rx state: WAIT FOR FRAMEVisualizing Discovery Protocol Exchange
sequenceDiagram
participant SW1
participant SW2
SW1->>SW2: CDP/LLDP advertisement (hostname, platform, IP, port ID)
SW2->>SW1: CDP/LLDP advertisement (hostname, platform, IP, port ID)
Note over SW1,SW2: Each device stores neighbor info in local table
SW1->>SW1: show cdp neighbors / show lldp neighbors
SW2->>SW2: show cdp neighbors / show lldp neighbors
CDP vs. LLDP: Comparison Table
| Feature | CDP | LLDP |
|---|---|---|
| Vendor | Cisco proprietary | IEEE 802.1AB open standard |
| Default state | Enabled by default | Disabled by default (on most Cisco platforms) |
| Multi-vendor support | No (Cisco/licensed devices only) | Yes |
| Default advertisement timer | 60 seconds | 30 seconds |
| Default holdtime | 180 seconds | 120 seconds |
| VoIP extensions | Cisco proprietary (CDP-based phone discovery) | LLDP-MED (standardized) |
| Works over Layer 2 only (no IP needed) | Yes | Yes |
| Recommended for multi-vendor networks | No | Yes |
| Security consideration | Can leak topology info to attackers if left on untrusted ports | Same consideration |
A Practical Example: Discovering an Unknown Cable Connection
Imagine you’re troubleshooting and don’t know which physical port on SW1 connects to which port on the core switch. Instead of physically tracing the cable:
SW1# show cdp neighbors detail
-------------------------
Device ID: CORE-SW
Entry address(es):
IP address: 10.1.1.1
Platform: cisco WS-C9300-48P, Capabilities: Switch IGMP
Interface: GigabitEthernet0/24, Port ID (outgoing port): TenGigabitEthernet1/1/1In seconds, you know: SW1’s Gi0/24 connects directly to the core switch’s Te1/1/1 — no physical tracing required.
Python Example: Parsing Discovery Protocol Output for Automation
Network automation scripts frequently parse CDP/LLDP output to auto-generate topology diagrams. Here’s a simplified example:
import re
cdp_output = """
Device ID: SW2
Interface: GigabitEthernet0/1, Port ID (outgoing port): GigabitEthernet0/2
"""
pattern = re.compile(
r"Device ID:\s*(?P<device>\S+).*?"
r"Interface:\s*(?P<local_intf>\S+),\s*Port ID \(outgoing port\):\s*(?P<remote_intf>\S+)",
re.DOTALL
)
match = pattern.search(cdp_output)
if match:
link = match.groupdict()
print(f"Local port {link['local_intf']} connects to "
f"{link['device']} port {link['remote_intf']}")
Output:
Local port GigabitEthernet0/1 connects to SW2 port GigabitEthernet0/2Tools like Nornir, NAPALM, and network topology mapping platforms use exactly this kind of parsing — often at scale across hundreds of devices via SSH or NETCONF — to build automatic network maps.
Security Considerations
Discovery protocols reveal detailed information about your internal network: hostnames, IP addresses, platform/model, and IOS version. This is valuable for legitimate administrators, but equally valuable to an attacker who has gained access to a port.
Best practice: Disable CDP and LLDP on interfaces that face:
- The public Internet
- Unmanaged or untrusted third-party networks
- Guest-facing access ports (unless required for phone discovery)
Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# no cdp enable
Switch(config-if)# no lldp transmit
Switch(config-if)# no lldp receiveException: Leave LLDP (with LLDP-MED) enabled on access ports connecting Cisco IP Phones, since phones rely on it for auto-configuration of voice VLAN and power negotiation.
Best Practices
- Use LLDP in multi-vendor environments — it’s the only discovery protocol guaranteed to work across all manufacturers.
- Keep CDP enabled internally on all-Cisco environments for the richest neighbor detail (Cisco-specific fields).
- Disable both protocols on edge-facing/untrusted interfaces to reduce information leakage.
- Use
show cdp/lldp neighbors detail(not the summary command) when doing serious troubleshooting — the detail view includes IP addresses and software versions critical for diagnosis. - Standardize hostnames across your devices — discovery protocols are only as useful as the naming convention behind them.
- Automate topology documentation using discovery protocol output rather than maintaining static diagrams manually.
Troubleshooting
Symptom: A Neighbor Isn’t Showing Up
Checklist:
- Confirm the protocol is enabled globally:
show cdp/show lldp(no arguments) shows global status. - Confirm the protocol is enabled on the specific interface:
show cdp interface/show lldp interface. - Confirm the physical link is actually up:
show interfaces status. - Confirm there isn’t a firewall, media converter, or unmanaged switch in between silently blocking Layer 2 multicast frames.
- Wait a full advertisement cycle — a brand-new link may take up to 60 seconds (CDP) or 30 seconds (LLDP) to populate.
Symptom: Stale/Outdated Neighbor Entries
Cause: The neighbor was reconfigured/removed but its old entry hasn’t aged out yet.
Fix: Wait for the holdtime to expire (180s CDP / 120s LLDP), or manually clear the table:
Switch# clear cdp table
Switch# clear lldp tableSymptom: IP Phone Not Getting Voice VLAN
Cause: LLDP-MED not enabled or not transmitting correctly on the access port.
Fix: Verify lldp transmit and lldp receive are both enabled, and confirm the voice VLAN is properly configured under the switchport.
Summary
CDP and LLDP are indispensable Layer 2 tools that let devices automatically learn about their directly connected neighbors — no manual cable tracing required. CDP is Cisco-proprietary and on by default; LLDP is the IEEE-standard, vendor-neutral equivalent and must usually be enabled explicitly. In modern, multi-vendor networks, LLDP is the preferred protocol, but many all-Cisco shops still rely heavily on CDP for its richer detail. Either way, mastering show cdp/lldp neighbors detail will make troubleshooting and documentation dramatically faster.