N4N063: Link Layer Discovery Protocol

Ethan Banks and Holly Podibilak discuss LLDP, a Layer 2 discovery protocol defined in IEEE 802.1ab standard (with extensions via ANSI TIA 1057 for LLDP-MED). LLDP operates as a non-interactive advertisement protocol where devices announce information about themselves at configurable intervals (default 30 seconds, range 5 to 32,768 seconds) to help network engineers map topology and identify connected devices without manual inspection. The protocol uses Time-To-Live (TTL) values to manage how long information is retained; the default TTL is calculated by multiplying the message transmission interval by a hold-time multiplier of four, with a hard maximum of 65,535 seconds.

The technical implementation uses Ethernet frames with a source MAC from the sending device and a destination MAC from a special range of MAC Bridge Filtered Group Addresses (0180C2 followed by specific values ending in 00-0E). These multicast addresses signal to receiving switches that frames should never be forwarded further—ensuring LLDP remains local to the direct link. The payload consists of Type-Length-Value (TLV) fields that carry structured information; mandatory TLVs include chassis ID, port ID, and TTL, while optional TLVs can include port description, system name, management address, system capabilities, and proprietary vendor-specific information via Type 127 TLVs.

The hosts discusses practical security considerations: LLDP frames are unencrypted and contain valuable infrastructure information including device names, model numbers, management IP addresses, and capabilities. This makes LLDP a potential security risk on edge ports where unknown devices might connect. Best practices include disabling LLDP on unused ports entirely, configuring ports as send-only or receive-only rather than bidirectional, and avoiding LLDP on ports where untrusted devices might connect. The protocol does not propagate over wireless; access points connected via backhaul will exchange LLDP frames, but wireless clients won't receive LLDP over-the-air because the protocol provides no value for mobile, transient connections and would waste limited airtime.

Historically, numerous vendors created proprietary discovery protocols (Cisco Discovery Protocol/CDP, MikroTik Neighbor Discovery Protocol/MNDP, Extreme Discovery Protocol/EDP, Alcatel Mapping Adjacency Protocol/AMAP) before LLDP became the industry standard. While CDP and MNDP remain in limited use, LLDP's standardized, vendor-neutral approach has become dominant. The hosts note that CDP provides some capabilities LLDP lacks, particularly detecting native VLAN mismatches on trunk ports, but most modern deployments favor LLDP for multi-vendor interoperability. Tools like Wireshark can decode LLDP frames and parse all TLVs, providing network engineers with visibility into device relationships and infrastructure details.