2.5 L2 Discovery Protocols

Mapping the undocumented network. Master Cisco Discovery Protocol (CDP), Link Layer Discovery Protocol (LLDP), and edge reconnaissance mitigation.

Core Explanations

The Purpose of Discovery

Discovery protocols operate entirely at Layer 2. They allow physical network devices to broadcast their identity, capabilities, hardware platform, and IP address to directly connected neighbors. If you lose your documentation, these protocols allow you to manually rebuild the network map port-by-port.

CDP (Cisco Discovery Protocol)

Cisco proprietary. Enabled globally by default on all Cisco routers and switches. Broadcasts its information every 60 seconds (with a Holdtime of 180 seconds).

LLDP (Link Layer Discovery Protocol)

The IEEE 802.1AB open standard. Vendor-neutral (works seamlessly across Cisco, Juniper, HP, etc.). Often disabled by default on older Cisco IOS versions. Broadcasts every 30 seconds (Holdtime 120s).

IOS Command Reference

Mapping the Network (Verification)

! The most used commands in a Network Engineer's toolkit

SW1# show cdp neighbors

SW1# show lldp neighbors

! Add 'detail' to reveal the neighbor's Management IP Address

SW1# show cdp neighbors detail

Global Protocol Toggles

! Disabling/Enabling CDP entirely across the whole device

R1(config)# no cdp run

R1(config)# cdp run

! Turning on the open-standard LLDP

R1(config)# lldp run

Per-Interface Security Configuration

SW1(config)# interface g0/1

! Disabling CDP on a specific edge port (Security Best Practice)

SW1(config-if)# no cdp enable

! LLDP offers granular control (transmit vs. receive)

SW1(config-if)# no lldp transmit

SW1(config-if)# no lldp receive

CCNA Exam Gotchas

The Reconnaissance Threat

Because CDP broadcasts unencrypted management IPs and native VLAN IDs, it is a goldmine for attackers. Anyone running Wireshark on an access port can read these frames. You must use 'no cdp enable' on all edge ports facing users or the public internet.

CDP Voice VLAN Requirement

The one exception to disabling CDP on access ports is when deploying Cisco IP Phones. The switch uses CDP to dynamically tell the IP Phone which Voice VLAN tag to use. If you disable CDP, the phone falls back to the data VLAN and causes QoS issues.

Syntax Discrepancy (Run vs. Enable)

Cisco loves to test on exact syntax. Remember that the global configuration command is 'cdp run', but the interface-level command is 'cdp enable'. Mixing those up is a guaranteed missed point on simulation questions.