LLDP and CDP: Neighbour Discovery, and What It Tells an Attacker

Link Layer Discovery Protocol lets a device tell its directly connected neighbours what it is. Switches, routers, phones and access points advertise their identity, capabilities and port details, and each builds a picture of what is on the other end of every cable. It is genuinely useful and it is an information disclosure waiting to happen on the wrong port.

What gets advertised

LLDP frames are sent periodically to a reserved multicast address and are not forwarded by switches, so they reach only the directly connected device. Each frame carries a set of typed fields.

Mandatory: the chassis identifier, the port identifier, and a time-to-live after which the neighbour entry expires.

Optional and commonly enabled: the system name, a system description including the software version, the port description, the device's capabilities and which are enabled, the management address, and the VLAN identifier.

That optional set is the security problem. A device advertising its model, its firmware version and its management address has told anyone who can plug in exactly what it is and where to reach it, which turns reconnaissance into reading a frame.

LLDP-MED

The media endpoint extension, and the reason LLDP is enabled in most offices.

When an IP phone connects, LLDP-MED lets the switch tell it which voice VLAN to use and the phone tell the switch how much power it needs. The phone tags its own traffic onto the voice VLAN automatically while a computer connected through the phone's pass-through port stays untagged on the data VLAN.

Power negotiation is the other half: the phone requests precisely what it draws rather than the switch reserving a whole class, which matters when the switch's total budget is the constraint — the arithmetic under Power over Ethernet.

Location information can also be carried, which is used by emergency calling to report where a handset physically is.

CDP and the choice between them

Cisco Discovery Protocol does the same job and predates LLDP. Functionally similar, vendor specific, and both can run simultaneously — which many networks do, with CDP between Cisco devices and LLDP for everything else.

LLDP is the standard and the right default in a mixed environment. Where a network is single-vendor, either works.

The troubleshooting value

This is why it stays enabled. Neighbour tables answer the question that otherwise requires walking to the comms room: which switch and which port is this device connected to.

That makes tracing a connection a command rather than an expedition with a toner and probe, and it makes automated topology mapping possible — documentation generated from what the network actually reports rather than from a diagram somebody drew two reorganisations ago. Feeding that discovery into the asset inventory is one of the more reliable ways to keep a CMDB current.

It also catches mistakes: a neighbour appearing where none should be, or a cable patched into the wrong port, shows up immediately.

Why it belongs off on user ports

An attacker who plugs into a wall jack receives an LLDP frame within seconds and learns the switch model, its software version, the port they are on, the VLAN, and the management address. That is the reconnaissance phase completed passively, before sending a single packet.

The frames are also unauthenticated, so a device can advertise whatever it likes — claiming to be a phone to be placed on the voice VLAN is a straightforward way onto a segment that is frequently less restricted than the data VLAN.

The configuration rule is therefore simple. Disable discovery on ports facing users and untrusted networks, and enable it only on inter-switch links and ports serving devices that need it. Where phones require LLDP-MED, enable transmit but consider disabling the optional fields that disclose version and management address.

Make sure it is off on internet-facing interfaces entirely, which is a configuration error that still appears in assessments.

Underneath this, the port-level protections matter more — a device that cannot authenticate never gets far enough to read a frame, which is the argument for 802.1X and the wider checklist under switch port hardening.

Exam angles

Know LLDP as the vendor-neutral layer 2 neighbour discovery protocol and CDP as the Cisco equivalent, both sending periodic frames to directly connected devices only. Know LLDP-MED as the extension providing voice VLAN assignment, PoE power negotiation and location information for IP phones. Recognize that advertised system descriptions, versions and management addresses are information disclosure, that the frames are unauthenticated, and that discovery should be disabled on user-facing and untrusted ports.