Now, you may also want to disable CDP, especially on Internet-facing interfaces. In this example,
by simply enabling CDP on this interface of the router, I'm able to see a lot of information on the
local network.
So let's have a look at details.
Here's the command show CDP neighbors, detail, I can see as an example that there is a Cisco unified
communications manager with this IP address on the local network.
I could then simply connect to that server and see what I can do, perhaps try and log in
via trial and error and eventually discover what devices, phones and gateways are available on this
server.
I could even use this to access a device.
So as an example, we can see that this phone is a Cisco DX 650.
If we're not sure what that is, we can do a simple search in Google
and we'll be able to find what kind of device that is.
This phone runs the Android operating system, and then we could try and find vulnerabilities on that
device.
So it's as simple as that for a hacker to determine which devices are out there.
Here's a Cisco switch with its IP address, and we could try and telnet to that.
Here's the phone.
So Cisco IP phone DX 650,
here's another phone,
7970.
We can even see how much power that phone is drawing from the local switch
and scrolling back, we can see that the Cisco DX 650 is drawing this amount of power. A lot of information
can be discovered through CDP and other protocols, such as LLDP.
You could look for vulnerabilities in a specific version of IOS and then try and hack that device.
So on this interface.
We would type no CDP enable and that would disable CDP on that interface, these entries in the table
will eventually time out, so we'd have to wait until they hit 0.
Notice as an example that router 1 on this interface has a whole time of this value, which is a lot
higher than some of the other values.
In the output here, the should be refreshed
because we're still running CDP on FastEthernet 00
but we've disabled CDP on FastEthernet 01.
You can see as an example that at this point, the core 3750 is 93 seconds as a whole time and eventually
eventually that's going to time out.
You can also disable CDP globally by typing, no CDP run, I'm not going to do that now because
I want to keep CDP running to the internal GNS3 part of the network. Notice router 1 once again
has refreshed, whereas the other values are counting down and I won't bore you waiting for that.
They will eventually time out and be removed from the CDP table.
So the moral of the story is disable unnecessary services.
Use this command to check what's enabled on your Cisco device, disable CDP on interfaces where it's
not required.
If you're connecting to an IP phone, you may require CDP or Link Layer Discovery protocol or LL
DP, but you wouldn't need that on an Internet-facing interface.
So disable what's not required.
While I was talking, there notice the 3750s hit 0 as a whole time, this phone is hit 2.
So that's now timed out, so 0 seconds and 2 seconds, next refresh interval, those have timed out
and the same will happen for the remaining devices in the table, they'll all eventually time out.
So here's the phone and if you wait a few more seconds notice, we see the publisher now
and eventually, all we see is the router internally.