Protocol Atlas

L2 · switching · reviewed

CDP

Cisco Discovery Protocol

Cisco’s proprietary neighbour advertisement — still required by some phones for voice VLAN.

Presenter modeEmbed this figure

Why it exists

Some endpoints still speak only CDP for voice VLAN and power. It also surfaces native VLAN mismatches between Cisco trunks.

Leave CDP on toward phones and trusted inter-switch links; disable it toward untrusted edges.

Cisco neighbours exchange TLVs

Two Cisco switches exchange CDP frames. Version 2 TLVs can carry native VLAN and power information that LLDP base does not.

SW1SW2Neighbour: SW1trunk
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
SW1switch—
SW2switchNeighbour: SW1
SW1 — SW2linkup · trunk
1 / 2

SW1 sends a CDP frame to 01:00:0C:CC:CC:CC. SW2 records platform, software, and interface.

What changed

  • CDP: SW1 → SW2
  • SW2: Neighbour → SW1

How it works

Version 2 TLVs carry native VLAN and power. Frames are consumed by the first Cisco device that receives them. It is not a translation of LLDP.

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

An ordinary frame. The group bit in the first octet of the destination is clear, so a switch forwards it to one port rather than flooding it.

Physical
A preamble and start-of-frame delimiter precede this, and the hardware removes them before any capture sees the frame. IEEE 802.3-2022
MAC header
Destination address, source address, and the EtherType naming the payload. IEEE 802.3-2022
Payload and FCS
Between 46 and 1500 octets, padded to the minimum, followed by a four-octet frame check sequence. IEEE 802.3-2022

Configure it

Global CDP with an access interface participating in neighbour exchange.

Cisco IOS-XE 17.12 · Catalyst 9300, ISR 4451draft

  1. cdp run

    Turns on CDP system-wide. Many platforms enable it by default; explicit `cdp run` documents intent after a disable.

    Cisco IOS XE — Configuring CDP §Information About CDP

  2. interface GigabitEthernet1/0/1
 cdp enable

    Per-interface enable when global CDP is on but the port was previously silenced. Edge ports facing untrusted hosts are often left disabled.

    Common mistake: Disabling CDP on the uplink that phones still need for voice-VLAN advertisement.

    Cisco IOS XE — Configuring CDP §How to Configure CDP

  3. cdp timer 60
cdp holdtime 180

    Advertisement interval and holdtime. Holdtime must stay greater than timer so a missed advertisement does not immediately flush the neighbour.

    Cisco IOS XE — Configuring CDP §Information About CDP

Verify

show cdp neighbors
Device ID, local interface, and capability for each neighbour.
show cdp neighbors detail
Platform, software version, and native VLAN where advertised.

Caveats

  • Marked draft: syntax has not been checked against Cisco documentation or a device.
  • CDP is Cisco-proprietary (destination 01:00:0C:CC:CC:CC). No Junos/FRR stanza belongs here — use LLDP for multi-vendor discovery.
  • Do not invent CDP TLV captures; verify only with show commands on real gear.

When it breaks

Symptom first, because that is what you have when it happens.

  1. Expected Cisco neighbour missing from the CDP table.

    Narrow it down

    1. show cdp neighbors
    2. Check no cdp enable on the interface
    3. Confirm the peer is Cisco and speaking CDP

    Cause

    CDP disabled on one side, or the peer only speaks LLDP.

    Fix

    Enable CDP where phones/Cisco neighbours need it; use LLDP for mixed vendors.

  2. CDP reports a native VLAN mismatch on a trunk.

    Narrow it down

    1. Compare native VLAN on both ends
    2. Check trunk encapsulation

    Cause

    Different native VLANs on a trunk — a VLAN-hopping setup waiting to happen.

    Fix

    Align native VLANs or tag the native VLAN consistently.

  3. Phone never learns voice VLAN after LLDP-only enable.

    Narrow it down

    1. Confirm phone vendor docs for CDP vs LLDP-MED
    2. Check CDP on the phone port

    Cause

    Some phones still learn voice VLAN only from CDP.

    Fix

    Leave CDP on the phone port; disable it on untrusted edges.

  4. Internet-facing port advertises platform and software via CDP.

    Narrow it down

    1. List interfaces with CDP enabled
    2. Confirm the related configuration and counters.

    Cause

    CDP left on an untrusted edge.

    Fix

    no cdp enable on untrusted edges.

  5. CDPv1 neighbour lacks TLVs operators expect.

    Narrow it down

    1. Check CDP version
    2. Compare detail output

    Cause

    Version 1 omits TLVs Version 2 carries (for example native VLAN).

    Fix

    Prefer CDPv2 where supported.

Design notes

Leave CDP on toward phones and trusted inter-switch links; disable it toward untrusted edges.

Misconceptions

“CDP is harmless because it is only informational.”
It advertises model, software version, and native VLAN to anything listening. On an untrusted edge that is an inventory leak.
“CDP and LLDP are interchangeable.”
They do not interoperate. A phone that only speaks CDP will not learn voice VLAN from LLDP-MED unless it also speaks MED.
“Disabling CDP everywhere is always safer.”
On phone ports and trusted trunks it still earns its keep. Disable it where the listener is untrusted, not as a blanket.

More walkthroughs

Native VLAN mismatch warningfailure

CDP compares the native VLAN it advertises with what it hears. Untagged frames land in different VLANs at each end while the link still looks up.

SW1 · native 10CDP: native mismatchNative: 10SW2 · native 20Native: 20Silent VLAN leak
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
SW1 · native 10switchNative: 10
SW2 · native 20switchNative: 20
SW1 · native 10 — SW2 · native 20linkup · trunk
1 / 2

Both ends forward; CDP logs a native VLAN mismatch. Untagged frames from SW1 enter VLAN 20 on SW2.

What changed

  • SW1 · native 10: Native → 10
  • SW2 · native 20: Native → 20
  • CDP: native mismatch
  • Emphasis: Silent VLAN leak

Phone learned voice VLAN from CDP onlyfailure

A phone that learned its voice VLAN from CDP fails on a non-Cisco switch that only speaks LLDP-MED.

IP phoneVoice VLAN: missingNon-Cisco · LLDP onlyNo CDP
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
IP phonehostVoice VLAN: missing
Non-Cisco · LLDP onlyswitch—
IP phone — Non-Cisco · LLDP onlylinkup
1 / 2

The phone waits for CDP voice-VLAN information. The switch advertises LLDP correctly and never speaks CDP.

What changed

  • IP phone: Voice VLAN → missing
  • No CDP

Check yourself

  • CDP logs a native VLAN mismatch. What is actually wrong?
  • Two Cisco switches do not show as CDP neighbours. First check?
  • A phone gets voice VLAN on Cisco but not on another vendor. Likely cause?
  • Why is “CDP is only informational” misleading?
  • Best practice for CDP on an untrusted edge port?
  • Do CDP and LLDP interoperate?
  • Who consumes a CDP frame?
  • On many Cisco platforms CDP is: