LLDP and CDP: Network Neighbour Discovery

Use the LLDP / CDP Neighbour Analyser → to parse exported neighbour information, compare snapshots and review discovered relationships locally in your browser.

What are LLDP and CDP?

LLDP (Link Layer Discovery Protocol) is an IEEE standards-based Layer 2 neighbour discovery protocol. Devices advertise information such as chassis ID, port ID, system name, system description, capabilities and management address using TLVs. Wireshark exposes these fields through its LLDP dissector. citeturn0search0turn0search3

CDP (Cisco Discovery Protocol) is Cisco's neighbour discovery protocol. It can advertise information including device identity, addresses, port ID, capabilities and platform. Wireshark has a CDP dissector for inspecting these fields. citeturn0search1turn0search2

LLDP vs CDP

Reading neighbour output

The most useful relationship is normally local interface → remote device → remote port. For example, if a switch reports:

Local Interface: Gi1/0/24
Device ID: DIST-SW-01
Port ID: Gi1/0/48

the evidence says that the local switch's Gi1/0/24 has discovered DIST-SW-01, which advertises Gi1/0/48 as its port. Management addresses, platform and capabilities add useful context but should not be treated as proof of every aspect of the physical topology.

Finding your switch port with Wireshark

This is particularly useful for technicians who arrive at a desk, classroom or cabinet and need to know which switch port the Ethernet socket leads to.

1. Connect the laptop

Connect your laptop directly to the network socket. Make sure you are using the Ethernet adapter that is physically connected to the switch. You do not need an IP address for the discovery frame itself because LLDP is a Layer 2 protocol.

2. Start Wireshark

Open Wireshark and select the Ethernet interface that is connected to the network. Start a short capture — normally a minute or two is enough if the switch is advertising periodically.

3. Filter for LLDP or CDP

In the display-filter box, try:

lldp

For Cisco discovery traffic, try:

cdp

Wireshark supports both protocols and exposes fields such as LLDP Chassis ID, Port ID and System Name. citeturn0search0turn0search1

4. Open the discovery packet

Select an LLDP or CDP packet and expand the protocol section in the packet-details pane.

For LLDP, look for:

• Chassis ID — identifies the advertising device.
• Port ID — identifies the switch interface that sent the advertisement.
• System Name — often the switch hostname.
• System Description — useful for identifying platform/software.
• Management Address — where advertised.

These are standard LLDP fields; the mandatory LLDPDU includes Chassis ID, Port ID, TTL and End TLV, with fields such as system name and management address commonly appearing as optional TLVs. citeturn0search3

For CDP, look for Device ID, Port ID, platform, capabilities and address information. The Wireshark CDP dissector exposes these fields directly. citeturn0search1turn0search2

5. The answer you are looking for

If you are connected to a Cisco switch and see something similar to:

Device ID: ACCESS-SW-03
Port ID: GigabitEthernet1/0/18
Platform: cisco C9300-48P
Address: 10.20.30.13

you have strong evidence that the wall port is connected to Gi1/0/18 on ACCESS-SW-03.

Why this works

LLDP is carried in Layer 2 frames and uses a link-local multicast destination; compliant bridges do not forward LLDP frames beyond the local link. LLDP uses EtherType 0x88cc. citeturn0search3 This means a directly connected endpoint can receive the switch's neighbour advertisement without needing routed connectivity.

When it does not work

• LLDP/CDP is disabled: there may simply be no discovery frames.
• The switch does not advertise to that port: configuration can suppress neighbour discovery.
• The NIC or driver filters the frames: try another adapter or capture method.
• You are behind another device: a phone, dock, unmanaged switch or other intermediate device can change what you observe.
• Wireless: this technique is aimed at a wired Ethernet connection; Wi-Fi clients do not normally receive the wired switch's LLDP frame in the same way.

LLDP-MED and phones

LLDP-MED extends LLDP with information useful for endpoint devices such as IP phones. Depending on the platform and configuration, network policy and power-related information can be advertised. This is one reason LLDP is particularly useful when troubleshooting voice deployments.

Using LLDP/CDP during troubleshooting

1. Confirm the physical endpoint and cable.
2. Capture LLDP/CDP from the endpoint where possible.
3. Record the advertised switch name and port ID.
4. Check that the switch's own neighbour table agrees.
5. Check the port configuration, VLAN assignment, PoE state and errors.
6. If the topology is unexpected, capture from the adjacent device as well and compare both directions.

Topology evidence

Neighbour discovery is evidence, not magic topology reconstruction. A switch stack, chassis, LAG, virtual system or multiple links can produce several relationships that need to be interpreted alongside interface configuration and physical documentation. The Ingenix analyser therefore reports discovered relationships rather than inventing links that are not supported by the supplied data.

Useful Wireshark filters

Related tool

LLDP / CDP Neighbour Analyser →