CDP and LLDP are network management protocols that expose detailed device information to potential attackers, making it essential to disable them on interfaces or globally when not in use.
CDP & LLDP Security
Cisco Discovery Protocol and Link Layer Discovery Protocol are two protocols that can really help us manage our network. It gives us some additional information and allows us to manage and be able to view our network to see what's happening on it. The problem is, it also gives visibility to attackers. It gives them a bunch of information that they can really utilize to hack the network.
CDP is a Cisco proprietary protocol, which means it's just on Cisco equipment. Link Layer Discovery Protocol is an open protocol that is available on a lot of different equipment. Both of these are very similar in how they operate, though: they pass layer 2 frames back and forth between devices so it can communicate different aspects of this equipment.
It helps from a management standpoint. You can map out your network and you can find out additional information. You can see what's working and what's not working. It can really provide a lot of valuable information for you — and it also can provide valuable information for the attacker. One thing that an attacker will do is look for those CDP frames that are coming across, to find additional information and find out how to attack your network.
The thing is, it's very simple to do, and all you need is a packet sniffer like Wireshark to be able to view the packets, and you're going to get some really great information. The simple way to mitigate against this is just to turn these services off. You can turn it off globally, or you can turn it off on the interfaces, and we'll cover both of those.
I'm on my demo laptop, which is plugged into switch 2. The first thing that I want to do is pull up Wireshark so we can see what kind of information we can find. I'm going to pull up this ethernet and monitor the frames coming across this ethernet connection right here, which is plugged directly into that switch.
We see some spanning tree protocol frames that are coming across, so we can actually take a look at what those are. CDP sends out this notification every so often, so we need to wait 30 seconds or so for one of those CDP frames to come in here.
There we have one. I'm going to open it up, and you can see we've got some information about CDP itself, some time to live with it, or at least this device. We've got a device ID, so we've got the device name — that's something. And then I look at software versions. So, interesting: I can see that this is a 2960, and I can see what version it's running at, 15.02 se8. That's getting very specific. If I know that there are certain vulnerabilities that this particular switch has, I can now go look that up and find out how to attack this piece of equipment.
You can see that this is information that would be very valuable if I was trying to hack this network. If you look further in here, I have the management address, so I can come down here and take a look at the management address of this device. Just a lot of information on how I can leverage this information to get into the network and start attacking the network.
What I'm going to do is a few configurations on switch 2 to mitigate this issue, to turn this issue off.
I'm on switch 2, and the first command I want to do is a show CDP neighbors, so we can see this is all of the equipment that's connected to this device specifically. Once again, a lot of great information that is being passed back and forth.
Next I'm going to do a show CDP neighbor detail, and once again I can see a lot of great information here as well — the same information that we were seeing in Wireshark.
What I'm going to do next is turn this off. Now, preferably I would turn this off from a global level, but maybe I need it on — maybe I am utilizing it for some sort of feature and I need to keep it on on some of my ports, so I can turn it off on specific ports.
What I'm going to do is get into the global configuration mode and then get into one of my interfaces. We'll do fa 034, since that's the one that's connected to this demo laptop. I'm into there, and I'm going to just do no CDP enable, and that'll turn it off. So now if I were to pull up Wireshark, I shouldn't see those frames coming across, that information coming across to this demo laptop.
Next, let's say I can actually disable this on a global level — let's say I'm not actually utilizing it for anything. To do that I'm just going to be in the global configuration mode and I'm going to do a no CDP run, and that's going to turn off the service altogether. That's for CDP: it's turned off, it's no longer a security risk.
I'm going to next do a show lldp, and it's not enabled. So by default we don't need to worry about LLDP. But let's say I do need to utilize it — there's some sort of feature that I need, so I have to turn it on. Let's learn how to turn it on, but turn it off on certain ports.
What I'm going to do is get into the global configuration mode, and I'm going to turn it on by typing lldp run. So now it's turned on. Then I'm going to get into my interface again, and I actually have to turn off both the transmit and receive, so: no lldp transmit. Now I've got it turned off on that interface, but it's running globally on this device. Once again, preferably I would have it turned off altogether, so I'd say no lldp run to turn it off.
So you can see how there is a reconnaissance that can happen. Reconnaissance means that you're finding out information about the network, and this is just a whole bunch of great information for an attacker. So I probably want to turn this off wherever I can on my network.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →