IEEE Link Layer Discovery Protocol
IEEE has specified IEEE 802.1AB, also known as Link Layer Discovery Protocol (LLDP3), which is similar in goal and design to CDP. Some differences include the following:
• Multicast MAC address. Address is 0180.C200.000E.
• Ethernet type. LLDP does not use SNAP encapsulation; instead, it uses Ethernet II framing with 88-CC as the Ethernet type.
• Packet format. As Figure 11-3 shows, the packet format consists of several fields encoded as <Tag, Length, Value> (TLV) with the first three and the last being mandatory (all others are optional).
Figure 11-3 Order of TLV in an LLDP Packet
_Chassis ID TLV
Port ID TLV Time to Live TLV
Other Optional TLV ■
End of LLDP TLV
|
Type |
Name |
|
0 |
End of LLPD, it signals that there is no more TLV after this one. |
|
1 |
Chassis ID. |
|
2 |
Port ID. |
|
3 |
TTL. |
|
4 |
Port description. |
|
5 |
System name. |
|
6 |
System description. |
|
7 |
System capabilities (router, switch, and so on). |
|
8 |
Management address. |
|
127 |
Reserved for vendor extensions and IEEE extensions: native VLAN for untagged frames, power of Ethernet class. |
As with CDP, and for good reasons, there is neither authentication or confidentiality built into LLDP. The transmission and reception protocols are also mostly identical to CDP. Hence, the risk analysis is equivalent.
At the time of this writing, there is no LLDP implementation yet in Cisco devices. Thus, although mitigation techniques are identical (that is, disable LLDP on all ports except uplinks, ports to IP phones, or ports to other managed network devices), the exact syntax is yet unknown.
Continue reading here: VTP Risk Analysis
Was this article helpful?