CDP vs LLDP: Timers, Defaults, and What Each Neighbor Table Reveals

Both protocols let a device announce itself to whatever is on the other end of a cable, and both stay on the local link. CDP (Cisco Discovery Protocol) is Cisco-proprietary, enabled by default, sends every 60 seconds, and holds a neighbor entry for 180 seconds. LLDP (Link Layer Discovery Protocol) is the IEEE 802.1AB standard, disabled by default on Cisco gear, sends every 30 seconds, and holds entries for 120 seconds. Because a neighbor advertisement identifies the platform, software version, port, and management address in clear text, both protocols are turned off on ports facing anything untrusted.

Discovery protocol operation

Every enabled port periodically emits a frame describing the device that sent it. The receiving device stores what it learns in a neighbor table and starts a countdown, the holdtime. Each new advertisement resets that countdown; when no advertisement arrives before it expires, the entry is aged out. With default CDP timers, a router that loses power stays in its neighbor’s table for the full 180-second holdtime before disappearing, so a table is a snapshot of recent history rather than a live link test.

These frames are not IP packets, are not routed, and never leave the segment. That is what makes the table trustworthy for cabling work: an entry means a direct physical adjacency, with the qualification that an unmanaged media converter or hub in the middle is invisible.

CDP mechanics

CDP is on by default both globally and on each interface, so two Catalyst switches cabled together with blank configurations exchange CDP immediately and exchange nothing over LLDP.

Control happens at two levels, and mixing them up is a common error:

SW1(config)# no cdp run
SW1(config)# interface gigabitethernet0/0/0
SW1(config-if)# no cdp enable

no cdp run in global configuration mode stops the protocol on the entire device in one command. no cdp enable in interface configuration mode stops it on that interface only, which is the correct tool when policy forbids advertising toward a service provider circuit while the LAN ports must keep running CDP. There is no no cdp run at the interface prompt and no cdp disable at the global prompt.

Timers are global and are set with two separate commands:

SW1(config)# cdp timer 30
SW1(config)# cdp holdtime 90

cdp timer sets the advertisement interval and cdp holdtime sets how long a neighbor keeps the entry. They are not combined into one command and they are not interface subcommands.

CDP version 2, the default, adds fields that are useful and sensitive in equal measure, including the native VLAN, the port duplex, and the VTP domain name.

Two of those fields do troubleshooting work. When the two ends of a trunk disagree about the untagged VLAN, CDPv2 is what generates the %CDP-4-NATIVE_VLAN_MISMATCH log message described in native VLAN mismatch, and the duplex field exposes a half-to-full mismatch that otherwise surfaces only as late collisions on a slow link. The VTP domain name is the third, and comparing it against the neighbor’s is the quick way to explain why a new VLAN failed to propagate across a VTP domain.

The CDP neighbor tables

The summary view fits one neighbor per line:

SW1# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
                  M - Two-port Mac Relay

Device ID         Local Intrfce    Holdtme   Capability   Platform       Port ID
R1                Gig 1/0/1         156        R B        C1111-8P       Gig 0/0/1
SW2               Gig 1/0/24        143        S I        C9200-24T      Gig 1/0/23
SEP00AABBCCDDEE   Gig 1/0/6         148        H P M      IP Phone 8845  Port 1

Two columns name interfaces and they belong to different devices. Local Intrfce is the port on the switch you typed the command on. Port ID is the port on the far end. The second line above documents one cable: SW1’s GigabitEthernet1/0/24 to SW2’s GigabitEthernet1/0/23. Reversing those two columns is the single most common mistake on cabling questions, and the same rule applies to the detail output, where the fields are labelled Interface: (local) and Port ID (outgoing port): (remote).

Capability letters are case-sensitive. Uppercase R is a router; lowercase r is a repeater. S is a switch, H a host, P a phone, B a source-route bridge, I IGMP, T a transparent bridge, M a two-port MAC relay. A Cisco IP phone typically shows H, P, and M together.

Neither show cdp neighbors nor the platform column gives you an IP address. For that, and for the software version, use show cdp neighbors detail:

SW1# show cdp neighbors detail
-------------------------
Device ID: SW4.campus.example.com
Entry address(es):
  IP address: 10.20.30.4
Platform: cisco C9200-48P,  Capabilities: Switch IGMP
Interface: GigabitEthernet1/0/47,  Port ID (outgoing port): GigabitEthernet1/0/2
Holdtime : 137 sec

Version :
Cisco IOS Software, Catalyst L3 Switch Software (CAT9K_LITE_IOSXE)

advertisement version: 2
Native VLAN: 300
Duplex: full

Every field in that block describes the neighbor, including the address you would SSH to. On a device with dozens of neighbors, show cdp entry <device-id> prints the same detail for one named device instead of paging through all of them; show cdp entry * prints them all. show cdp neighbors takes no device-name argument.

The remaining CDP commands each answer a different question. show cdp interface reports which interfaces have CDP enabled and the timers in use. show cdp traffic gives packet counters, including CDP frames sent, received, and received with errors, which is how you confirm advertisements are actually flowing and whether any arrive malformed. clear cdp table empties the neighbor table so it repopulates from current cabling after a re-patch; clear cdp counters resets the traffic statistics instead, and no cdp run disables the protocol rather than refreshing it.

LLDP mechanics

LLDP is defined by IEEE 802.1AB and works with equipment from any vendor. It ships disabled, so show lldp neighbors on a fresh switch reports that LLDP is not enabled.

SW1(config)# lldp run
SW1(config)# lldp timer 30
SW1(config)# lldp holdtime 120
SW1(config)# lldp reinit 2
SW1(config)# interface gigabitethernet1/0/5
SW1(config-if)# no lldp transmit

lldp run is the global on switch. Per-interface control is split in two: lldp transmit and lldp receive are separate knobs, so a port can be configured to listen to neighbors while advertising nothing about itself. CDP has no equivalent split; cdp enable covers both directions. The reinitialization delay, default 2 seconds, is the pause before LLDP restarts on a port after being disabled.

LLDP-MED (Media Endpoint Discovery) is the extension aimed at IP phones and similar endpoints. It carries the voice VLAN assignment, fine-grained PoE power negotiation, and civic or emergency location data. It is why a standards-based phone can learn which VLAN to tag its voice traffic with, the same job CDP does for a Cisco phone in a voice VLAN deployment.

The verification commands mirror CDP’s: show lldp neighbors, show lldp neighbors detail, show lldp entry <name>, show lldp interface, show lldp traffic, and clear lldp table.

Feature comparison

	CDP	LLDP
Standard	Cisco-proprietary	IEEE 802.1AB
Default state	Enabled globally and per interface	Disabled
Advertisement timer	60 seconds	30 seconds
Holdtime	180 seconds	120 seconds
Global enable	cdp run	lldp run
Interface control	cdp enable (both directions)	lldp transmit and lldp receive separately
Timer commands	cdp timer, cdp holdtime	lldp timer, lldp holdtime, lldp reinit
Endpoint extension	Native phone and power fields	LLDP-MED
Multivendor	Cisco devices only	Any compliant vendor

Security exposure

Advertisements are unauthenticated and unencrypted. Anyone who can capture frames on the segment reads the device model, the software version, the management IP address, the local port name, and with CDPv2 the native VLAN and duplex. That collection is a starting point for two kinds of attack: matching the exact software version against published vulnerabilities, and profiling the trunk configuration well enough to attempt VLAN hopping. Nothing in the protocol lets a listener change the port’s VLAN, and nothing routes the frames beyond the local segment, but the disclosure alone justifies turning discovery off on user-facing ports, lobby jacks, and any circuit you do not control. Interior links between managed infrastructure keep it, because the operational value there is real.

How the 200-301 exam tests this

• Default state and timer recall. Two blank switches are cabled together and you are asked what is running. CDP is exchanging, LLDP is silent. Timer items ask how long a powered-off neighbor lingers in the table, which is the holdtime, not the advertisement interval.
• Global versus interface scope. A stem forbids discovery toward one circuit while requiring it everywhere else. The answer is no cdp enable under that interface, and no cdp run is the trap because it is the correct syntax for the wrong scope.
• Which command yields which field. A neighbor’s management IP address or software version comes from the detail views, a named single neighbor comes from show cdp entry, error counters come from show cdp traffic, and a stale table is emptied with clear cdp table.
• Topology from output. You are given the neighbor tables of two or three devices and asked what is physically cabled. Match the Local Intrfce column of one device against the Port ID column of the other, and note that an absent entry is evidence of no direct link. A phone’s Port ID such as Port 1 is the phone’s own uplink name, not a switch port.
• Security rationale. Multi-select items pair the true facts (clear-text disclosure of model, version, and management address; CDPv2 leaking native VLAN and duplex) with false ones about frames being routed enterprise-wide or a host rewriting the access VLAN.

The defaults and timers are recall items, and recall fades — a pass through practice questions a week out tells you whether the numbers stuck.

Quick reference

• CDP: Cisco-proprietary, on by default, 60-second timer, 180-second holdtime.
• LLDP: IEEE 802.1AB, off by default, 30-second timer, 120-second holdtime, 2-second reinit.
• cdp run and lldp run are global; cdp enable, lldp transmit, and lldp receive are per interface.
• LLDP separates transmit from receive; CDP does not.
• Local Intrfce is your port, Port ID is the neighbor’s port.
• Uppercase R is router, lowercase r is repeater.
• show cdp neighbors detail or show cdp entry <name> for IP address and version; show cdp traffic for counters; clear cdp table to repopulate.
• LLDP-MED carries voice VLAN, PoE, and location data to endpoints.
• Advertisements are clear text and unauthenticated; disable them on untrusted ports.