CDP (Cisco Discovery Protocol)

The proprietary protocol CDP (Cisco Discovery Protocol) allows you to access configuration information on other Cisco routers and switches with a single command. By analyzing CDP data, you can characterize the topology of an existing network. CDP uses SNAP (Subnetwork Access Protocol) frames at the Data Link layer, so two devices running different Network layer protocols can still communicate and learn about each other. These devices can include all LANs and most WANs.

CDP starts by default on any router version 10.3 or later and discovers neighboring Cisco routers running CDP by doing a Data Link broadcast. It doesn’t matter which protocol is running at the Network layer.

Once CDP has discovered a router, it can then display information about the upper layer protocols such as IP and IPX. A router caches the information it receives from its CDP neighbors. Any time a router receives updated information that a CDP neighbor has changed, it discards the old information in favor of the new broadcast.

Real World Scenario—The Pros and Cons of CDP

CDP is a very useful protocol and feature of Cisco routers and switching for collecting, analyzing, and documentation purposes. But CDP can also be a security risk in today’s networks.

CDP allows you to collect information from neighboring Cisco devices, depending on your perspective in the Cisco network. With collected CDP data you can display the platform, IOS version, and configured interfaces of neighbors. With the commands show cdp, show cdp entry, show cdp interface, and show cdp neighbors, you can gather plenty of information.

One of the more useful features of CDP is the collection of neighboring device interface IP numbers. With this information, you can telnet further into the network and manage these devices. You can disable CDP on a Cisco router or switch globally or disable it per interface.

CDP is enabled by default on Cisco devices. This means that at a specified interval, each device sends valuable information out each and every port to any other CDP listening device. This information can be intercepted or captured, researched, and exploited. The global configuration command no cdp run will globally disable the CDP announcements. You can also disable CDP per interface in the interface configuration with no cdp enable. You can type show cdp to verify if CDP is enabled and running.