Use CDP and LLDP to map directly connected neighbors, read the useful fields from show cdp neighbors detail and show lldp neighbors, and decide where discovery should be disabled for security.
Week 3 · Lesson 7 · Active ~16 min · Video ~6 min (segment TBD) · Domain: Network Access
This closes the switching module. You already met CDP once — as the protocol that logs a native-VLAN mismatch on a trunk and that tells an IP phone its voice VLAN. Here you use it deliberately to map neighbors.
Prerequisites: trunks-8021q-native-vlan
Baseline check
You inherit an undocumented wiring closet. A switch port is up and passing traffic, but you do not know what is on the other end of the cable. Without walking the cable or logging into the neighbor, which single command tells you the neighbor's name and the port it uses? Commit before you continue.
The answer — show cdp neighbors (or show lldp neighbors) — is the everyday value of discovery protocols.
What discovery does. CDP and LLDP are Layer 2 protocols that let a device advertise its identity to whatever is directly connected on each port. The key scope word is directly connected: discovery does not map the whole network, only your immediate neighbors, one hop away. That is exactly what you want when documenting cabling, confirming which switch an uplink lands on, or catching a cable plugged into the wrong port.
Both protocols report the same essentials for each neighbor:
- Device ID / name of the neighbor
- Local interface (your port) and the neighbor's remote port
- Platform / capabilities (is it a switch, router, phone?)
- In detail output, the neighbor's management IP address and software version
CDP vs LLDP — the distinction to hold onto.
| CDP | LLDP | |
|---|---|---|
| Full name | Cisco Discovery Protocol | Link Layer Discovery Protocol |
| Standard | Cisco proprietary | Open IEEE 802.1AB |
| Default state | Enabled on Cisco gear | Often off — enable with lldp run |
| Use it when | All-Cisco environment | Mixed-vendor environment |
CDP works out of the box between Cisco devices. LLDP is the vendor-neutral equivalent you turn on when Cisco and non-Cisco gear (or a multi-vendor phone via LLDP-MED) need to discover each other.
Security note — discovery leaks topology. Because discovery advertises device names, models, IOS versions, and addresses, it is useful to you and to an attacker. Best practice is to disable discovery on untrusted or edge ports — ports facing the internet, an ISP handoff, or an untrusted access area — so you do not hand out a map of your infrastructure. Turn it off per interface with no cdp enable (and no lldp transmit / no lldp receive), while keeping it on internal switch-to-switch links where it earns its keep.
CDP and LLDP verification commands and mapping workflow (topic guide)
Free CCNA | CDP & LLDP | Day 36 | CCNA 200-301 Complete Course
~6 min
Watch which fields CDP reports for a neighbor and how the detail command adds the neighbor's IP and IOS version; note that LLDP gives the same picture across vendors after lldp run.
The show cdp neighbors detail read and the CDP-vs-LLDP distinction are the required core of this brief lesson.
Watch on YouTubeRead this output from switch SW1.
SW1# show cdp neighbors
Capability Codes: R - Router, S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
SW2 Gig 0/1 145 S WS-C2960 Gig 0/1
R1 Gig 0/24 160 R ISR4331 Gig 0/0/0
SEP0011AABB Fas 0/10 132 H P IP Phone Port 1
Pause and predict
- What is connected to SW1's Gi0/1, and to which of the neighbor's ports?
- You need the IP address and IOS version of R1 (not shown above). Which command gives it?
- SW1's Gi0/24 faces an ISP router you do not control. Should CDP stay enabled on that port?
Reveal answer
- SW2 (a switch, capability S) is on SW1's Gi0/1, connected to SW2's own Gig 0/1. The Local Intrfce column is your port; Port ID is the neighbor's port.
show cdp neighbors detail— the brief table omits addresses and versions; the detail view adds the neighbor's management IP address and IOS version.- No. A port toward an untrusted/ISP device should have discovery disabled (
no cdp enable) so you do not advertise your platform, version, and addressing to an outside party. Keep CDP on the internal SW2 and R1 links where it helps you.
Open the neighbor explorer, read the brief table, then expand to detail and locate the neighbor IP address and software version fields.
Open cdp-lldpQuick check (2 items) · test
Answer from memory:
- Which discovery protocol is Cisco-proprietary and on by default, and which is the open standard that often needs enabling?
- What extra fields does show cdp neighbors detail add over the brief table, and why disable discovery on edge ports?
Review sheet
- CDP / LLDP advertise identity to directly connected neighbors — one hop, not the whole network.
- CDP = Cisco, on by default; LLDP = open IEEE 802.1AB, often needs
lldp run. show cdp neighbors→ device ID, local + remote ports, platform;detailadds IP + IOS version.show lldp neighbors→ the same map across mixed-vendor gear.- Disable discovery on untrusted/edge ports (
no cdp enable) so it does not leak topology.
Drill the CDP-vs-LLDP facts, the brief-vs-detail fields, and the edge-port security note until recall is automatic.
Open flashcardsYou have completed MAC learning, VLANs, trunks, voice VLANs, STP, EtherChannel, and discovery — the full switching module. Consolidate with the Week 3 retrieval check.
Review the Week 3 switching quiz