Exam Objective 2.3: Validate the accuracy of network documentation using CDP and LLDP.
Network diagrams and documentation drift out of date the moment someone moves a cable, replaces a switch, or adds a new device without updating the paperwork. CDP and LLDP are Layer 2 discovery protocols that let a device directly ask its neighbors "who are you and how are we connected," giving you ground truth about the actual physical topology — which you can then compare against existing documentation to find discrepancies, undocumented devices, or incorrect port mappings.
CDP is a Cisco-proprietary Layer 2 protocol that allows directly connected Cisco devices to automatically discover and exchange information about each other. Because it's proprietary, CDP only works between Cisco devices — it will not discover or be discovered by non-Cisco equipment.
How CDP works: Enabled devices periodically send CDP advertisements out every CDP-enabled interface as multicast frames at Layer 2, which neighboring Cisco devices receive and store in a local CDP neighbor table (without ever forwarding the advertisement onward as if it were normal traffic). This means CDP information is inherently limited to directly connected neighbors — one hop away — not devices further out in the topology.
Information advertised/learned via CDP:
Device ID (hostname of the neighboring device)
Local and remote interface/port used for the connection
IOS software version and platform/hardware model
IP address of the neighboring device
VTP domain (if configured)
Native VLAN on the connecting interface (useful for spotting native VLAN mismatches, tying back to objective 2.1)
Duplex setting on the connecting interface (useful for spotting duplex mismatches, tying back to objective 1.1)
Capabilities of the neighboring device (router, switch, IGMP capable device, etc.)
Key verification commands:
show cdp neighbors — a summary view listing each directly connected neighbor, the local interface used, the neighbor's device ID, its capabilities, its platform, and the neighbor's remote interface
show cdp neighbors detail — the full detail view, including the neighbor's IP address, IOS version, native VLAN, and duplex setting for each connection
show cdp interface — displays which interfaces currently have CDP enabled and their CDP timer/holdtime settings
show cdp entry [device name] — displays full detail for one specific neighbor by name, rather than the entire neighbor table
CDP timers:
cdp timer — sets how frequently CDP advertisements are sent (default 60 seconds)
cdp holdtime — sets how long a receiving device should keep a neighbor's information before discarding it if no new advertisement arrives (default 180 seconds)
Enabling/disabling CDP:
cdp run (global configuration) — enables CDP globally on the device (enabled by default on Cisco equipment)
no cdp run — disables CDP globally, a security best practice on devices facing untrusted networks, since CDP advertisements reveal detailed information about the device to anyone who can capture them
cdp enable / no cdp enable (interface configuration) — enables or disables CDP on a specific interface without affecting the rest of the device; commonly disabled on interfaces facing the internet or an untrusted third party, while leaving CDP enabled internally
Exam Alert: CDP is Cisco-proprietary and only discovers directly connected neighbors (one hop). Know that show cdp neighbors detail is specifically where you'll find the neighbor's IP address, IOS version, native VLAN, and duplex — information the basic show cdp neighbors summary view does not display.
LLDP (IEEE 802.1AB) is the vendor-neutral, industry-standard equivalent of CDP, designed to work across multi-vendor environments rather than being restricted to Cisco-only devices. Functionally, LLDP and CDP accomplish nearly the same goal — directly connected neighbor discovery — using a very similar mechanism, but LLDP is the protocol to use whenever a network includes non-Cisco equipment (or when documenting an environment where future hardware vendor changes are expected).
How LLDP works: Like CDP, LLDP-enabled devices periodically send Layer 2 advertisements (called LLDPDUs, LLDP Data Units) out each enabled interface, and neighboring devices store the received information in a local LLDP neighbor table. Also like CDP, LLDP information is limited to directly connected, one-hop neighbors.
Information advertised/learned via LLDP:
Chassis ID and system name of the neighboring device
Port ID (local and remote interface information)
System description (platform/software details, vendor-dependent in exact format)
Management IP address
System capabilities (similar in spirit to CDP's capabilities field)
Optionally, power-related information via LLDP-MED (Media Endpoint Discovery), an LLDP extension specifically designed for VoIP phones and similar endpoint devices, covering details like PoE power requirements and voice VLAN assignment
Key verification commands:
show lldp neighbors — a summary view of directly connected LLDP neighbors, similar in structure to show cdp neighbors
show lldp neighbors detail — full detail per neighbor, similar in structure to show cdp neighbors detail
show lldp interface — displays which interfaces have LLDP enabled
Enabling/disabling LLDP:
lldp run (global configuration) — enables LLDP globally; unlike CDP, LLDP is not enabled by default on many Cisco platforms and must be explicitly turned on
no lldp run — disables LLDP globally
lldp transmit / lldp receive (interface configuration) — LLDP separately controls whether an interface sends its own advertisements (transmit) and whether it processes advertisements received from a neighbor (receive), a more granular per-direction control than CDP offers
Exam Alert: Unlike CDP, LLDP is not enabled by default on Cisco IOS and must be explicitly enabled with lldp run. Also know that LLDP separately controls transmit and receive per interface (lldp transmit, lldp receive), a level of granularity CDP's simpler cdp enable/no cdp enable does not provide.
CDP:
Cisco-proprietary
Only works between Cisco devices
Enabled by default on Cisco equipment
Default advertisement timer: 60 seconds, holdtime 180 seconds
Simple enable/disable per interface (cdp enable / no cdp enable)
Verified with show cdp neighbors [detail]
LLDP:
IEEE 802.1AB open standard
Works across multi-vendor environments (Cisco and non-Cisco)
Not enabled by default on many Cisco platforms; must be explicitly enabled with lldp run
Separate transmit/receive controls per interface (lldp transmit, lldp receive)
Includes LLDP-MED extension for VoIP/endpoint-specific details
Verified with show lldp neighbors [detail]
Exam Alert: In a mixed-vendor environment, LLDP is the only one of the two protocols that will actually discover non-Cisco equipment. A network with only Cisco gear can rely on either, but CDP being Cisco-only is one of the most directly and repeatedly tested facts under this objective.
The core practical skill this objective tests is comparing what CDP/LLDP actually reports against what existing documentation (network diagrams, cable/port-mapping spreadsheets, asset inventories) claims — and identifying discrepancies.
Typical documentation-validation workflow:
Run show cdp neighbors detail (and/or show lldp neighbors detail) on each switch/router in the topology.
Record the actual neighbor device ID/hostname, the local interface, and the neighbor's remote interface for every connection discovered.
Compare this ground-truth connectivity map against the existing network diagram or port-mapping documentation.
Flag any discrepancies: a port documented as connecting to "Switch-B Gi0/3" that CDP actually shows connecting to "Switch-C Gi0/5," an undocumented device appearing in the neighbor table that isn't on the diagram at all, or a documented connection that no longer appears in the neighbor table because the cable was moved or removed.
Cross-check native VLAN and duplex settings reported by CDP/LLDP against documented standards, to catch silent misconfigurations (native VLAN mismatch, duplex mismatch) that wouldn't otherwise be obvious just from a link being up.
Common discrepancies this process reveals:
A device physically moved to a different switch port than documentation shows
A completely undocumented device connected somewhere in the topology (a rogue switch, an unauthorized AP, or simply a forgotten/unlabeled legacy device)
Incorrect hostname or IP address recorded in documentation versus what the device is actually currently configured with
A native VLAN or duplex setting that doesn't match the organization's documented standard configuration for that link type
Exam Alert: Expect a scenario question presenting sample show cdp neighbors (or show lldp neighbors) output alongside a claimed piece of documentation, asking you to identify the specific discrepancy — this is the most practically-oriented way this objective is tested, rather than pure protocol-trivia questions.
Because both CDP and LLDP broadcast detailed information about a device — hostname, IOS version, IP address, hardware platform — to any directly connected neighbor, they represent a modest reconnaissance/information-disclosure risk if left enabled on interfaces facing untrusted parties (a public-facing port, a port in a lobby or other physically uncontrolled area, or a link toward a third-party/customer network).
Best practice: Leave CDP/LLDP enabled on internal, trusted interfaces where the discovery/documentation benefit is valuable, but disable them (no cdp enable, or the appropriate LLDP transmit/receive commands) on any interface facing an untrusted network segment or the public internet.
Confirm CDP and/or LLDP is actually enabled on the devices and interfaces you intend to survey — remember LLDP is not on by default, unlike CDP.
Run show cdp neighbors detail and/or show lldp neighbors detail across each relevant device.
Build (or update) a ground-truth connectivity table from the collected output: local device, local interface, neighbor device, neighbor interface.
Compare the ground-truth table against existing documentation, flagging any mismatches in connectivity, hostname, IP address, or interface mapping.
Cross-check native VLAN and duplex fields (from CDP/LLDP detail output) against your organization's documented standards to catch silent configuration drift.
Update the official documentation to reflect the validated, actual topology, and investigate any undocumented or unexpected devices discovered in the process.
Q1. Which statement correctly distinguishes CDP from LLDP?
A. CDP is an open IEEE standard, while LLDP is Cisco-proprietary
B. CDP is Cisco-proprietary and only works between Cisco devices, while LLDP is a vendor-neutral open standard
C. CDP and LLDP both require third-party licensing to operate
D. LLDP only functions between Cisco devices
Answer: B. CDP (Cisco Discovery Protocol) is Cisco-proprietary and will only discover and be discovered by other Cisco equipment. LLDP (IEEE 802.1AB) is an open, vendor-neutral standard designed to work in multi-vendor environments, making it the appropriate choice whenever non-Cisco devices are part of the topology.
Q2. An administrator wants to view the native VLAN and duplex setting reported by a directly connected Cisco neighbor. Which command provides this information?
A. show cdp neighbors
B. show cdp neighbors detail
C. show lldp interface
D. show vlan brief
Answer: B. The basic show cdp neighbors command provides only a summary (device ID, local/remote interface, capabilities, platform), while show cdp neighbors detail provides the full detail per neighbor, including the neighbor's IP address, IOS version, native VLAN, and duplex setting on the connecting interface.
Q3. By default on most Cisco IOS platforms, which of the following is true?
A. Both CDP and LLDP are enabled by default
B. CDP is enabled by default, while LLDP must be explicitly enabled with lldp run
C. LLDP is enabled by default, while CDP must be explicitly enabled with cdp run
D. Neither protocol is enabled by default
Answer: B. CDP is enabled by default on Cisco equipment. LLDP, being the open-standard protocol, is generally not enabled by default on many Cisco platforms and requires an administrator to explicitly enable it globally using the lldp run command before it becomes active.
Q4. A network engineer is documenting a topology that includes a mix of Cisco switches and a third-party vendor's switches. Which discovery protocol should be used to accurately map connections to the third-party equipment?
A. CDP, since it is enabled by default
B. LLDP, since it is a vendor-neutral open standard supported across multiple vendors
C. Neither protocol will work with non-Cisco equipment
D. VTP, since it handles VLAN documentation
Answer: B. Because CDP is Cisco-proprietary, it will not discover or exchange information with non-Cisco devices. LLDP, as an open IEEE 802.1AB standard, is supported broadly across vendors, making it the correct protocol to use for accurately mapping and documenting connections to third-party equipment in a mixed-vendor topology.
Q5. Which LLDP-related commands allow an administrator to separately control whether an interface sends its own advertisements versus processes advertisements received from a neighbor?
A. cdp enable and no cdp enable
B. lldp transmit and lldp receive
C. show lldp neighbors and show lldp neighbors detail
D. cdp timer and cdp holdtime
Answer: B. LLDP provides granular per-direction control at the interface level using lldp transmit (controls whether the interface sends its own LLDP advertisements) and lldp receive (controls whether the interface processes advertisements received from a neighbor) — a level of separate control that CDP's simpler cdp enable/no cdp enable command does not offer.
Q6. An administrator runs show cdp neighbors detail on a core switch and discovers a device connected to Gi0/12 that does not appear anywhere on the current network diagram. What is the most appropriate next step?
A. Ignore it, since CDP information is not considered reliable
B. Disable CDP globally so the unknown device stops appearing
C. Investigate the undocumented device and update the network documentation to reflect its actual presence and connection point
D. Assume the diagram is correct and that CDP is misreporting the neighbor
Answer: C. CDP (and LLDP) directly reflect the actual, current physical topology as reported by the connected devices themselves, making them a reliable ground-truth source. An undocumented device appearing in the neighbor table should be investigated to confirm what it is and why it isn't documented, and the official network documentation should then be updated to accurately reflect reality.