What is the difference between CDP and LLDP?
Show the answer
Say this first
Both are layer 2 discovery protocols: each device announces its name, port, platform and management
address to directly connected neighbours. CDP is Cisco proprietary, on by default on Cisco gear, sent
every 60 seconds with a 180 second holdtime. LLDP is the IEEE 802.1AB standard every vendor speaks,
sent every 30 seconds with a 120 second hold time, and often off by default on Cisco (lldp run
turns it on). LLDP-MED extends it for phones: voice VLAN, PoE power and location.
Go deeper
| CDP | LLDP | |
|---|---|---|
| Standard | Cisco | IEEE 802.1AB |
| Destination MAC | 01:00:0C:CC:CC:CC | 01:80:C2:00:00:0E |
| Timers | 60 s, holdtime 180 s | 30 s, hold multiplier 4, so a TTL of 120 s |
| On by default on Cisco IOS | yes | usually no |
| Extras | v2 reports native VLAN and duplex mismatches | LLDP-MED: network policy (voice VLAN, DSCP), PoE, inventory, location |
LLDP frames use EtherType 0x88CC. The mandatory TLVs are Chassis ID, Port ID, TTL and End of LLDPDU.
Security
Both give away platform, software version and addresses, which is useful reconnaissance for an attacker. Keep them on infrastructure links and turn them off on internet-facing and untrusted ports:
lldp run
interface GigabitEthernet0/0/0
no cdp enable
no lldp transmit
no lldp receiveA subtle one
A switch that does not understand CDP floods it like any other multicast. Two Cisco devices behind an unmanaged switch then list each other as direct neighbours. Standard bridges never forward LLDP sent to the nearest-bridge address.
Verify with show cdp neighbors detail and show lldp neighbors detail; on Linux, lldpctl from
lldpd.
They will ask next
How does an IP phone learn its voice VLAN?
A Cisco phone learns it from the switch through CDP. Other vendors' phones use the LLDP-MED network policy TLV. Some fall back to DHCP options when neither is available.
Two Cisco routers list each other as CDP neighbours, but a switch sits between them. How?
The switch does not run CDP, for example an unmanaged switch, so it floods the CDP multicast to all ports and the routers hear each other.
Traps
- Leaving CDP enabled on the internet-facing interface.