So let’s do a capture on this link between router 1 and router 2
we can see some loop messages which are used to ensure that the interface is up
and we may have to wait a while for CDP message to be sent.
We can see that by typing sh cdp and pressing enter.
CDP only sends packets every 60 seconds
so we may have to wait a while as you can see in the output here
CDP packets are sent every 60 seconds
and an entry in the table is held for 180 seconds
I’ll show you more about that later but scrolling down
here’s a CDP message
we can see that it's using 802.3 Ethernet
and is using a specific Cisco address which I'll talk about in more detail later.
It's using logical link control with the organizational or unit of Cisco
in other words, the protocol used at a high layer is CDP
and here’s the CDP information version 2
we can see that it's router 2 advertising itself
with it's platform, port number and other details
what’s interesting is you can get a lot of detail through a CDP message
which is great for discovering the network
but is bad from a security point of view
you can see version of software, you can see platform
you can see IP addresses configured, so IP address port number
you can see its capabilities and so forth
here's router 1, so you can see the device ID is router 1, as an example
So the important thing to remember is the CDP does not rely
on higher layer protocols, messages are sent every 60 seconds by default.
You can use CDP to map an entire network
so as an example, if you were connected to router 1
and you use the command sh cdp neighbors
you could discover which device you directly connected to
and then you could use details
so show CDP neighbor details
to see detailed information about that neighbor including its IP address
and then if telnet is enabled on your network
you could telnet from router 1 to router 2
and then use the command CDP neighbors
to discover what devices are connected to that router.
So as an example, here’s a core 3750 router
let’s see what's connected to that switch.
So I could use this command sh cdp entry
and the name of the device, to just see the output for the specific device
here’s its IP address, so I'll telnet to that IP address
I can log in assuming that I know the username and password
and once again I could use the command
sh cdp neighbors
to discover what's connected to that device.
And here as an example, we can see some other devices
which we weren't seeing previously, such as the Cisco 1841 router.
So you could map out the entire network by simply using CDP on 1 device
and telnetting to the next device using CDP
to discover what’s connected to that and then telnetting to the next device
and discovering what’s connected to that device.
Now the Cisco APIC-EM SDN software does a lot of this for you
and so does othersSCNMP or Simple Network Management Protocol
management software such as software from Solarwinds
you could do this manually but there is software out there
that can help you automate this process.
You could also use a combination of protocols.
So as an example, here’s router 2
sh cdp neighbors
shows me that I have this core 3750 switch
I could then discover the IP address of that switch
which in this example is this and then I could simply telnet to that switch
and then use a protocol such as LLDP to discover devices connected to that switch.
In this example, you can see the 2 Cisco IP phones, and an Ubuntu hypervisor
I could look at details.
So sh lldp neighbors detail
and here I can see the IP address
and model of phone as well as the firmware being used by that phone
and other information about it.
Scrolling down, lot of detail notice firmware revision
serial number and quite a bit of other information
such as the layer 2 quality of service and layer 3 quality of service
set on that phone, we'll talk more about quality of service later.
Here's the Cisco DX650, so we can see its system name
we can see an IP address we can see a firmware version
we can see quality of service information
we can see once again that it's a Cisco phone
we can see how much power is being used a lot of detail
here’s Linux so we can see Ubuntu server running Ubuntu 14.04 LTS
you can see the name of the server and it's IP address.
So once again CDP and LLDP allows you to discover devices in your network
and also allow you to see how the devices
are connected to each other in your network.