What is the difference between CDP and LLDP?

Both let a device tell its directly connected neighbours who it is. CDP (Cisco Discovery Protocol) is Cisco's own protocol and is enabled by default on Cisco devices. LLDP (Link Layer Discovery Protocol, IEEE 802.1AB) is the open standard that every vendor supports, but it is disabled by default on most Cisco IOS devices. CDP sends every 60 seconds with a 180-second holdtime; LLDP every 30 seconds with a 120-second holdtime.

Can CDP see devices two hops away?

No. A Cisco device receives CDP messages and does not forward them, so you only ever see devices on the other end of your own links. To map a bigger network you log in to each neighbour in turn and run show cdp neighbors there.

Do CDP and LLDP need IP addresses to work?

No. They are Layer 2 protocols sent in Ethernet frames to a multicast MAC address. They work as long as the link is up at Layer 2, which makes them useful for finding out what is connected before IP is configured, or when IP is broken.

Should I disable CDP?

Disable it on interfaces facing networks you don't control, such as an internet link or ports where untrusted users connect. It advertises the device name, model, software version and addresses, which is useful to an attacker. Keep it on internal links between your own devices, and on ports with Cisco IP phones that rely on it.

Discovering neighbours with CDP and LLDP | CCNA

A real-life situation

You inherit a network with no diagram. You are logged in to R1 and need to know what is plugged into each port and which port on the other device the cable lands in. Walking to the wiring closet and tracing cables takes an afternoon. A neighbour discovery protocol answers the question in one command.

What CDP and LLDP are

A neighbour discovery protocol lets a device send a short "this is me" message out of each of its interfaces. Devices on the other end store what they hear in a neighbour table. There are two you need to know:

CDP (Cisco Discovery Protocol): Cisco's own protocol. Enabled by default on Cisco routers, switches, IP phones and access points.
LLDP (Link Layer Discovery Protocol): the open IEEE 802.1AB standard, used by every vendor. Supported on Cisco devices but disabled by default on most IOS and IOS XE platforms. A variant called LLDP-MED adds features for phones and other endpoints.

Both share information such as:

the neighbour's name (the Device ID, usually its hostname),
the neighbour's own interface the cable is plugged into (the Port ID),
its capabilities (router, switch, phone, access point),
its model (platform) and software version,
a management IP address, and on switches the native VLAN and duplex.

1. SW1 and SW2 advertise to R1. Each switch sends a CDP message out of every port; R1 records both, with the port at each end.
2. R1 advertises back. Discovery runs in both directions, so each switch also lists R1.
3. The third-party AP speaks only LLDP. SW1 sees AP-FLOOR1 only if LLDP is enabled on SW1. CDP alone would miss it.
4. CDP toward the ISP is a leak. R1 would advertise its model and IOS version to a network you don't control. Turn CDP off on Gi0/0.
5. Only one hop. SW1 does not pass the AP's or anyone else's messages on. R1 never learns about AP-FLOOR1 or PC1.

Why it works that way

CDP and LLDP run at Layer 2. Each message is an Ethernet frame sent to a reserved multicast MAC address (CDP uses 01:00:0C:CC:CC:CC, LLDP uses 01:80:C2:00:00:0E). Because no IP is involved, discovery works even before addresses are configured or when IP is misconfigured. That is exactly when you need it most.

A device that understands the protocol keeps the frame and does not forward it. That is deliberate: the table should describe the cable you are standing at, not a device three switches away. A Cisco switch therefore never lists a device it isn't directly cabled to.

How it works step by step

Each message carries a holdtime: how long the receiver should keep the entry if it hears nothing more. The sender repeats its message on a timer well inside that holdtime, so a healthy neighbour never expires.

Step 1 of 4 · CDP advertisement

SW1

Gi1/0/24

One Ethernet link

Layer 2 only, no IP needed

Gi0/1

LLDP behaves the same way with different defaults: every 30 seconds, holdtime 120 seconds.

	CDP	LLDP
Standard	Cisco proprietary	IEEE 802.1AB (open)
Default on Cisco IOS	Enabled	Disabled
Advertisement timer	60 s	30 s
Holdtime	180 s	120 s
Turn on/off globally	`cdp run` / `no cdp run`	`lldp run` / `no lldp run`
Per interface	`cdp enable` / `no cdp enable`	`lldp transmit` and `lldp receive` (separately)

How to configure it on Cisco IOS

⚠️ Based on Cisco IOS / IOS XE documentation, not run on a lab device.

CDP

cdp run
interface GigabitEthernet0/0
 no cdp enable

cdp run is the default, shown for completeness. Turn CDP off on the interface that faces the ISP. no cdp run would turn it off on every interface at once.

cdp timer 30
cdp holdtime 90

Optional: change how often CDP is sent and how long neighbours keep the entry. Keep the holdtime longer than the timer (three times is the usual ratio).

LLDP

lldp run
interface GigabitEthernet1/0/20
 lldp transmit
 lldp receive

On SW1: enable LLDP globally. Once it runs, every interface sends and receives by default; the interface lines are only needed if they were turned off before.

interface range GigabitEthernet1/0/2 - 19
 no lldp transmit
 no cdp enable

On user-facing access ports where no network device or phone connects, stop advertising. You can keep receiving with lldp receive if you want to see what users plug in.

lldp timer 30
lldp holdtime 120
lldp reinit 2

The defaults: advertise every 30 s, hold for 120 s, and wait 2 s before restarting LLDP on an interface after it is re-enabled.