N4N063: Link Layer Discovery Protocol

0:00on today's end is for networking Holly and I will break down link layer discovery protocol for you. I'm Ethan Banks with Holly and Holly is Holly pod and just check them out lots of lots of good information out there for you and it's all free for you. We have sponsors that make it all possible so go subscribe to things get smarter. And it's for networking by the way is also available on YouTube and Spotify as video if you would like to see Holly and my smiling faces while we have this LLDP discussion.

1:09So Holly we were chatting before we had the record button I said LLDP any questions and you got that look on your face. I'm actually really excited for this episode because all DPS one of those things that I came into a lot I disgusted with customers why it's important. I never looked into how it worked or the standards behind it or pretty much anything I just knew that it existed it's a protocol and the benefits of it so this will be a great learning experience. Well in fairness this is one of those topics where I said hey we need a shorter show today we need a simple topic what's something like that that we have in coverage. Oh LLDP that's a good one we should talk about everybody should know and that I started to my research. It's like come on this well doesn't need to go this deep it's almost annoying to be fair it's not that complicated but there is a good bit of interesting detail and things for us to talk through.

2:13So okay link layer discovery protocol you've worked with it some used to talk about it with customers how would you explain how would you pitch it. So I wouldn't necessarily pitch it it's a feature but it's a feature yeah yeah. Where would come into conversation is specifically multi vendor deployments and why is that important is because you want let's say you're on. I don't know a junior box and you want to know what the Cisco box plugged into it what it is what is plugged into this port without having to I don't know going to your data center and follow the cable. What's nice is LLDP can help you with that because it is when a device announces some things about itself. Hey I am this box plugged into this port this is my system name and now you know what's plugged into port one for example. Yep. Now it's interesting you suggested multi vendor as an important part of that because LLDP is a standard and it is interoperable if you run LDP it doesn't matter what box you run it on anyone else that it can be a Cisco box talking to a junior box.

3:22As long as they're both speaking LLDP they can exchange information but it doesn't have to be multi vendor in other words I wouldn't say all if I got a multi vendor network I need a LLDP. I mean you could have an all junior per network and it's all LLDP you can have an all Cisco network and you're using LLDP to share that information between network devices. So it just. Yeah I was going to say I think the reason why I think of it particularly with multi vendor environments is because if you have a homogenous single vendor environment typically your management platform knows all the information about. That your vendors devices so LLDP becomes beneficial I would say in a multi vendor environments it is useful in general but it's got last Howard pitch it that that's where the value add is so it's. Yeah yeah I see I see where you're I see how you the the the angle that you're coming at it from so let's let's let's back up a second link layer discovery protocol let's take that name apart so link layer.

4:25What layer of the OSI stack are we talking about we talk about the link layer so that would be layer two you're looking at the ethernet layer there. Yeah exactly layer two so link layer so we're down a layer to we're not talking about IP up at layer three and we're doing discovery we are saying we want to discover what's on this link that is what LLDP is good for here and it works as you described. There if you are an LLDP speaker like you're in network switch you're going to announce something about yourself your system name and maybe your system description and various capabilities that you have as a device in the form of an LLDP frame that you send to whatever is listening on the other side. And LLDP is is interesting in that it is it's an advertisement protocol it's not interactive there's no dialogue happening between LDP LDP speakers there's no hello frame there's no neighbor relationship that forms it's just I'm an LDP speaker.

5:29These are the things I know about myself I'm going to bundle all that information into an LLDP frame and send it out across the wire to whatever might be listening on the other side on some specified interval some configurable interval we get into intervals and stuff as we go on one of those things I didn't know where things until I decided researching this intervals we'll get there. So go ahead I was going to say so in maybe we get to this later I'm not sure but one thing that's interesting to me is that you know in that frame there's a bunch of information about that device right that it's advertising is that information configurable. There is standard information required information that you're going to send out I'm sorry the correct word is mandatory there is mandatory information that you're going to send out in an LLDP advertisement and there is optional information that you're going to send out as well. As far as I know it is not configurable by you the network engineer but it is configurable in software by the vendor so a Cisco box might send out an LDP advertisement that has some information that's unique to that that Cisco world the same thing with with any other vendor and we are going to talk about that in more detail as we go we're going to talk about TLVs and what those TLVs how they've been doing.

6:54And then established by the standard and how they're used by various vendors. One of the things that LDP is really good for is mapping an entire network now as you said if you're looking dealing with a management platform it's a Juniper management platform for an all Juniper network it knows everything that's about the network it's got some discovery mechanism that it used to build that now we're developing now it might be used LDP under the hood to help with that might use the SNMP might use other kinds of telemetry and discovery to build that and you kind of don't care. There is the engineer it's just there it's there and you're interacting with that that UI but what if you don't have that well LDP is a tool that would help you map an entire network because you can see what switches connected to what other switch and what the two ports are that they're using and with that information you could diagram the whole network out log into switch show LDP neighbors and it's going to list for you all the LDP advertisements that the switch is seen all the different ports and you can start making notes and sketching out a diagram. With that it's awesome LDP data is like it's a really useful repository of information that you can figure out what the network looks like super useful.

8:05Yep when you've plugged something into the wrong port and you can't understand why it's coming up and you go into your LDP neighbors often you're on cellized there. Yep software is going to use that information to we can use it as network engineers but then you know a software developers will use LDP for that checking that the wire was plugged in from the right port so you can tell if there's a cabling problem LDP is one of the ways that you would determine probably the best way to determine that that happened super useful stuff. So LDP is a standard that is a thing that we we've defined here it's not an IETF RFC although there may be some RFCs that refer to it but it was defined as an IEEE standard 802.1 AB is the main one that defines LDP which as far as I know you can't just read that because it's not available to you unless you're a member of the IEEE it's not just out there as a public document not that you'd want to read it. So it's all so kind of heavy network engineers we're going to think of LDP speakers as routers and switches right those are the things that are most interesting to us as we build our network topologies but because it is a standard you can run LDP on hosts you can run it on like like a windows box or a Linux box or a Mac device and the LDP capability there might be baked right into the operating system by the vendor.

9:35So if you want to do this on a host device for example that host device is going to have to be wired in because it's a layer to protocol right. Yes although I have a question for us to discuss a bit later about wireless and LDP but but you are exactly correct you need to be plugged into a network switch via an ethernet cable and what would happen there if you're running the LDP Damon on your host is your host would announce itself to the switch and the switch would announce itself to the host and they could know about each other by reading the LDP frames that they exchange with one other well technically they don't exchange them because they're not neighbors. Right we establish that there but they're going to read each other's announcements as they come by on the wire they just two people walking past each other that's about it. Yeah yeah yeah one of the comment about standards we mentioned 802.1 AB as the main stand for LDP well there's another standard to not an IEEE standard but there was something added to LDP a little later in its life called media and point discovery extensions.

10:49And it's a med LDP dash med media and point discovery extensions that this enhances LDP it so it gives us a whole bunch of other interesting things that you could pack into an LDP frame like power over ethernet capabilities and maybe QOS settings and things like the system serial number that would help us with inventory management let's say and that from what I could tell is antsy TIA 1057 standard because you know nerds need to know okay there you go so LDP is a standard med media and point discovery was where our extensions that were added to LDP and so we can pack a lot of cool information about a device into an LDP frame. All right so far so good Holly yeah that you're going to talk about I was going to say that's where my knowledge probably goes off to all the things about it. This is a 90 ready to talk about how LDP actually works and what it does there was more here now is expecting although it's not that complicated to be fair it's just it does get into some you know nerdy details.

11:52So LDP we described as an advertisement protocol it's doing announcements on an interval the standard message transmission interval which is like the official term there the standard message transient mission interval is 30 seconds. So every 30 seconds by default if you don't change anything the standard says an LDP speaker is going to make its announcement about itself. You could adjust that though as an outweigh engineer you could just to be close five seconds and as high as 32,768 seconds which is just over nine hours. Now logically can you think of a reason why you'd ever want to do just over nine hours of an announcement interval. Well I mean you wanted to announce itself once twice a day maybe yeah I don't know that seems yeah I don't know I'm trying to get in a super long interval like that and I got nothing. Well I guess the static data center like nothing's moving around so well that okay so there's a there's more context that would actually help us answer that question how do you set message transmission interval why if if you needed to master that for some reason how.

13:03Would you make the decision of what the right interval time is. And the answer has to do with the the the the neighbor whoever's across the wire listening. They're going to store that information so when an LDP advertisement comes in they're going to grab onto it and store it well how long are they going to store it they're going to store it for a TTL value time to live value. TTLs are something we run into all the time in networking where here's some information I'm going to give you I want you to keep it but I want you to keep it forever I want you to keep it until the time to live value expires you can't count on this being good forever and I only the time to live is only an hour and after an hour I want you to make that call way just to leave that information because it's probably no good anymore. And so you see TTLs again and all kinds of different things in networking in LLDP the time to live value is baked into the announcement so the speaker is going to have its own TTL value so that the receiver knows I'm supposed to keep this for only this long this long no more.

14:12And by default that TTLs calculated using a hold time multiplier hold time multiplier how am I going to hold on to this information the hold time multiplier that multiplier is for so the default message transmission interval was how long Holly 30 seconds 30 seconds and so if we have a hold time multiplier of four by default our TTL value would be what 120 seconds 120 seconds that's right go ahead. Yeah I was going to say okay wait hold on I need I need a pause moment here because that means that your announcements happening every 30 seconds but your TTL is 120 seconds so then you've got technically out of date LLDP information assuming that you've hold on to every frame because they are too for 120 seconds unless every time a new one comes in you overriding. And so that's the way that the old information anyways that that's what happens the latter so when a new frame comes in that that now takes precedence that's the new thing you know in reality what happens is you're going to hear the same announcement the same LLDP announcement over and over and over again.

15:32So if you're going to kick in if you haven't heard from that neighbor so if that information sitting there in your cash and your old non to it and you haven't heard anything you haven't heard anything you haven't heard anything and finally on 20 seconds close by you're like I haven't heard anything I guess they're just a gone and then you remove that information from your cash that's not there anymore as long as you're hearing something from that neighbor you've got a refreshed entry in the TTL clock starts over again in conjunction with the recipient of the receiving of that new announcement make sense. Yeah that makes sense. Cool. Okay a couple of really trivial details that you absolutely don't need to know but I went into them so I have to share this hold on before we even get to those I want to take us you were talking about the longest is just over nine hours right that means a TTL for like the longest one is nine times for what like 36 hours like you have a LLDP notification sitting there for like over a day. But it's not because there's some weird quirkiness here that we're going to get into so let's so actually this one of the things I want to bring up so let's say you went with that absolutely bonkers max maximum message transmission interval time with 32,768 seconds that nine hour plus interval.

16:50The TTL will not actually be 32,768 times four because the max TTL was defined in the standard as only 65,535 seconds so you get this weird exception where if you're your interval time is too big is feel like you're bigger than the max of 65 535 so your TTL is 65 535 and stop being insane so that makes sense because 36 hours and networking time is a very very long. time is very much that is forever but that's trivia honestly we're talking about these super long intervals you'd never do that I mean you want to have a regular LLDP announcement coming from your neighbor you you want to hear that on a regular basis you don't want it to go out for hours and hours and hours one again I don't. If you have a use case for that was like well I need to set my LDP to max time and years why would love to hear that that would be a cool story because I got I got nothing I can't think of a use case for that.

17:54We've emphasized this already Holly but LDP is not transmitted over IP LDP is an ethernet frame which I think might be like. You know a little bit but. Ethernet frames it's a transport like anything else it's in some cases we have IP packets inside of it in the case of this discussion we have LDP information inside of that frame there's a source Mac there's a destination Mac and switches know how to move that date around so the fact that it doesn't have IP inside. Isn't the problem it's more highlighting the fact that not all you can pack whatever you want to an ethernet frame IP is just the most common thing we see. But you can put whatever you want inside that layer to frame that work for you. It kind of makes sense because usually like LDP is not necessarily being shared like across the network it's between two devices that are usually directly linked to one another so you don't only need. IP at that point it's straight over the cable. Exactly and in fact when your IP packet in tradition and that work like we've been talking about for so many shows now.

19:04When your ethernet switches delivering that IP packet to you it doesn't care about the IP packet unless it's a we're routing it okay to forget that we're just down we're at the layer to level we're delivery on the last hop here at the edge to deliver that ethernet frame to the host. It's not forwarding that frame to the host based on the IP information it's already figured all that stuff out and all it cares about is the ethernet frame i'm going to deliver from from me and i'm going to send it to the host and the fact that there's an IP packet inside is incidental now the host will receive that frame. Take the ethernet wrapper off and begin processing what's inside if it's an IP packet it'll send it up to the IP stack and and go from there to deliver to the application that can process whatever it is probably HTTP. Now you said something interesting you said LDP is typically going from one switch to others it's not transmitted across the whole network. That's actually very important point it's exactly true with LDP exactly what you said LDP frames are not relayed through a switch it only goes to a neighbor and that's it an LDP frame is not carried any further than that do you know both why and how.

20:22Well why I guess the whole point of wise they're not forming a naborship like it's not building a day like if you think about like a bgp table or something like that it's not building a table of these are all of my neighbors and then i'm going to share these neighbors with everybody else so everybody knows that stuff it's just like kiss some information about something that's plugged into me that's it. That's it so why would that information be useful downstream you it's it's very local information it's local to that that link specifically is the only place the data carried in that LDP frame is relevant so that that that's an excellent reason why so how then is this enforced. So I mean how is this enforced did I know this before reading this script no I didn't think about it. Because why would you it's it's a local thing you see it pop up you know but it's actually very interesting because you know you could go listen to our multi cost episode before this and then come back.

21:24But do tell us what you've learned even okay okay okay so we have an LDP frame is made up of a source Mac and a very unique destination Mac the destination Mac address is one of a few very special multicast addresses. And as Holly said go listen to the multicast episodes we did with Lenny I forget the episode numbers with their excellent know help you with a lot of this stuff and I think in the second episode we did with Lenny we talked a little bit about. Ethan at frames and the unique Mac addresses that you get from multicast Ethan at frames well they come into play here a little bit and these very special multicast addresses that are forming our destination Mac. Are called Mac bridge filtered group addresses and these Macs are special because they've been defined as addresses that the receiver never forwards any further one hop and no more. And and those are there's three different addresses that begin with well there's there's a range of them for LDP it uses three different Macs that start with 0 1 8 0 C 2.

22:29And then they end in then there's zero and events and 0 0 0 3 or 0 E. When a receiver gets that Mac addresses got this very special address oh I see a 0 1 8 0 C 2 0 0 0 0 0 E I know that that's a bridge filtered group address and I'm not allowed to send that any further it ends with me one hop and no more and I got it so we're done here. And there's a bunch of weird Mac addresses like that in again as you dig into not just with LDP but I mean you dig into networking and start digging into Ethan at frames and unique Ethan at Mac addresses there's a ton of them and they're annoying just trying to get you to get around and remember what they all do. Wait a minute this is the IPv 6 1 that does the what is that again and there's a bunch of funky ones that have like weird. You calculate this this and you flip this bit and do this and and there it's not isn't it obvious no no it is.

23:31So as you get into your search and start dig digging into Ethan at Mac addresses and stuff you will find odd Ethan at addresses like this. And again in the case of LDP there they are using these Mac bridge filtered group addresses 0 1 8 0 C 2 0 0 0 0 and then I think it's 0 0 through 0 E all of those are part of that very special group an LDP like I did a wire shark capture and pulled an LDP frame. Off the wire right here on my my studio network and and it ended in 0 E the destination Mac was 0 1 8 0 C 2 0 0 0 0 0 E coming from a ubiquity switch that I happen to be running here at the house. This is not a question I was going to say this is not a question that you're going to on some like. This is a multi-cost question but I'm like how does it choose like oh what is there any rhyme or reason like why 0 E versus 0 3 versus 0 0 would be used.

24:32I don't think so. I thought that specific identification of those three addresses for LDP were pulled out of a Wikipedia article that as I was doing my research for this that explain that you're going to see one of those three for LDP. Why it did not distinguish and I couldn't find any explanation of why any one of those three were used and again in my wire shark capture the ubiquity switch that I was happened to receive an LDP frame from and did in 0 E why I I don't know if it's arbitrary or not it could be. But any of those three would work in certain my mind would serve the same function because the goal here signal to the receiver this is a bridge filtered group address and you're not supposed to send this ethernet frame any further. Alright so that's the source Mac the source Mac is going to be whatever the sending devices the destination Mac is going to be one of these funky bridge filtered group addresses well what's inside the frame and I mentioned TLVs earlier have you run it to TLVs before.

25:37When you said that early I was like I have run into TLVs I cannot for the life of me remember what that acronym stands for. Type length values and that's another one of those things that shows up all over the place in network. Yeah they they're used in routing protocols they're used here in LDP they're used in a variety of places so don't think LTLV is like unique to LDP TLV type length values are just. Fields that are defined as having a specific purpose to carry a specific kind of information there's a type with that is represented by a number they're going to have some length they're going to be a certain amount number of bytes that that takes up and then there's a value that is going to live inside of those however many bytes were assigned for the length and that's it they're interesting because. When you are a your software engineer and you need to write the LDP protocol for the stack that you're working on you would need to know well how do I.

26:47How many bytes do I have to work with so that for the type one LDP TLV here of the chassis ID how many bytes do I have to work with that chassis ID in you're going to code that you're right into your software do you need to know that is a network engineer. No you don't mean that's super trivia right but. TLV pop up because there are way to give people that need to code this information and need to know how to interpret this information as you're getting what is basically a bunch of numbers coming at you buried inside this LDP frame how do I ask this what is what is all this information crammed together. And so you get a series of TLVs that can be included inside your LDP frame that give you a bunch of information there's mandatory ones there's optional ones. And because they've been defined in a particular way you the software will know how to parse this and give you all of this information back an example of software that can do this for you was wire shark.

27:52Wire shark is a packet's different we've talked about a number of times on the show I used a wire shark turned it on to capture a wired ethernet port going to a switch and told it to show me all the LDP frames and it pulled one off the wire I stopped the capture I started looking at that ethernet frame and wire shark can decode that frame it knows that's an LDP frame. It can read all the TLV so it knows exactly like oh this is your chassis ID TLV this is your port ID TLV this is your time to live TLV and it understands because those have been defined with specific lengths exactly how to parse those out so it gives you back all the information that you're looking for. You need boundaries you need something called it's called marshaling in networking where you got to have a boundary around the data. Software's looking at a bit stream it's ones and zeros down there and so the software's got to know this set of ones is zeros that starts here and ends here contain this information and so then it knows how to pull that data out that's really what a TLV is all about again as an engineer.

28:59It is trivia holly to be fair I mean you. I mean yes and no I think it's important to know what the TLVs are for some protocols like this like it helps you to understand what for example I don't know what cases could possibly ever happen but like I don't know LDP is not working and somehow some things broken and one of the mandatory TLVs is not being shared I don't even think that's possible. But yeah in theory you know it's good to know what you're looking for and also it's good to know what kind of information you can receive from something which helps you to make decisions on. I don't know protocols to use or processing or things like that when you get into TLVs and routing protocols like OSPF can carry some pretty interesting information because of new TLVs that have been defined in standards that came after. OSPF OSPFs original standards not everything was thought of and you can extend the capabilities of OSPF using a variety of different TLVs same thing with ISIS is a lot of TLVs there that carry you can kind of carry anything you want as long as a TLV that defines it as part of a standard.

30:16You can carry that information in there and so when use cases pop up in the networking industry I want to carry this sort of information in ISIS okay there's a TLV for that or there will be a TLV for that assuming the standards development organizations decide agree with your use case and decide to make one. And so yeah it's good stuff to be aware of and when you're looking at added in wire shark and it's parsing all this out for you it shows them as TLVs and so you're like what is a TLV it's a timeline that's all it is super common. So for LDP there's mandatory and optional TLVs is a few I want to highlight them the mandatory ones include chassis ID port ID and time to live and those are what they sound like chassis ID like the switch what what is this thing what ID has been assigned to it. A port ID it's ethernet zero slash 17 or whatever it is time to live we talked to length about the time to live field those are mandatory so you're going to see those in any LDP announcement that's made there's a ton of optional once the whole bunch of them optional means they don't have to be there but if they're appropriate to show up then that announcement will probably have that information in it things like a port description and the system name.

31:35And the system description system capabilities I'm a router I'm up switch I'm a this I'm a that there can be a whole bunch of different capabilities that are listed there management address you know you've got an IP address that you might use for management and you want to announce that to to your neighbors that can be helpful information in LDP. Now here's a really interesting one that's worth mentioning is the TLV type 127 type 127 is like we didn't define it as a standard it's optional but it's up to you guys vendors make your own organization at least specific TLVs fall under type 127 and so you can see. Basically any weird proprietary thing that you want to shove into an LDP advertisement you can do it with type 127's. I haven't seen anything like that I mean the system name I like system name you see all the time. Oh yeah that's very common but I feel like it could be kind of fun you're like a new vendor and type 127 you put some fun announcement.

32:42I think there's some proprietary stuff like some voice over IP stuff you've got an IP phone that needs to plug into the network and it's got to know like it's voice feeling I don't know if those are optional you wear those might fit into the rank is I think stuff like that where there's special magic happening between the phone and the switch those might be encoded in 127's I just want to fund message like I don't know I'm the best switch out there. Have something you know. So if you want to have fun with that there's you could do that with ICMP echo ping which is an ICMP echo request you can encode anything in the echo payload you want if you if you have the software that can encode that and send it along there's not to be anything magical inside the ICMP echo request that payload can be whatever you want it to be. Side note okay so I got a question for you now Holly. Do wireless clients receive LLDP frames. This is a great question because I did read this and I was like well why am I even thinking about this because LLDP as we said is layer two over ethernet and wireless clients are speaking over like radios wireless radios which technically is not ethernet.

34:01They share technically but they still share frame types and source and destination MAC addresses and all of that but it's a different wave so to speak it's different. Why this is different thing but that's not the deciding point that's not the deciding point. Why why we'd receive LLDP frames what are they're doing they don't they don't but it's not because of the ethernet versus versus radio thing. Think think about it this way wireless is we actually as we're recording this we just recorded three different episodes on wireless trying to help everybody get started with that and within the most precious resources air time right. Yeah why would you be announcing LLDP using LDP to announce to hosts that are hanging off an access point LLDP so this is a few different things here let's think about an LDP flow. That makes sense. Would you have LLDP between an access point that is wired to a network switch the back all.

35:02Yeah you've got that. Yeah you would 100% you would have you would have that that's going to be used for Peele negotiation between the access point and the switch and then all the system level kind of stuff and what ports plugged into who and all of that that for sure. But what what would the benefit of sending an LLDP frame out the radio is into the air you know as a you know as a broadcast to the host why would you why would you take up air air space with that. Especially when you've got all these other when you dig under the under the hood of wireless you've got all these other control and management frames beacons and so on that take up the air space to help manage clients LDP is not providing anything useful there. So go ahead. No it's just like also if you think about it like LLDP is hoping you discover something that is. Houghts specific as well that is going to be there probably for a while wireless clients come and go if you have every single wireless client being like hey this is me.

36:08And then they gone in the next like who cares is the question like it writes what value would that be yeah so if you fired up a wireless client expecting to see LLDP frames. Being showing up on their transmission interval and you expect to see those announcements you're not going to see them there's no LLDP coming to you over the air. I mean maybe if something's not configured it's got like a software bug or there's some really cheap device that's like a wireless bridge and it's leaking LLDP frames I guess maybe you might see something like that but but generally speaking no you're never going to see an LLDP frame if you're sniffing. The air with your wireless client. Okay. I thought that was just fun to bring up because it's an interesting thought exercise. I've never like it. I didn't think about it because yeah no right. I did a little digging to be like well no you wouldn't right and I did a little digging and found out no you don't.

37:10That's not a thing. A security point I wanted to raise about LLDP is related to edge ports. How would you define an edge port? Well it's the edge of your network so an edge port is usually going out to your host for example. I do want to clarify something that before we even discuss edge point edge ports. Okay. They are security concerns with LLDP whether they edge port or not. They are customers who don't want to turn on regardless where it is just because you know you've got something advertising a bit of information every 30 seconds. That pay one valuable and it's not encrypted. Yeah. Anybody can read that stuff. There's no yeah there's no encryption. There's no it's not cyphered. Yeah. So you do want to be really thoughtful about anywhere that you turn LLDP on. You want it to be basically you want it to be between two devices you own. Yeah. I've worked in data centers where we hosted customer equipment. Not our equipment but it was customer equipment that was housed in our data center because reasons.

38:12You don't send your infrastructures LLDP frames up to that customer's equipment. You don't want them to see that. That's not that's not the thing you're looking to do. No it's bad practice. And if they're sending them to you you should be like hey don't send me that. I want that. With me. I bring up edge ports because it in enterprise networks where there's a lot of office space and you've got wall jacks all over the place perhaps in some public areas. Why would you send LLDP frames out there kind of the same logic that wireless access points don't send LLDP frames out to all the clients. Do you should you be sending LLDP frames out to random ports and you don't know what's plugged in there. Yeah. Of course. The little hackers sitting there with his laptop plugged in and and your your edge routers like hey this is me and here's some information and oh actually my the person who manages me wants to share my management IP as well because that was one of the optional fields.

39:14Here you go. Maybe not exactly. It's a treasure trove information for the bad guys and again it's not encrypted. It's the easiest thing in the world. You could have someone literally walk in a crop from the street sit down in the waiting area and there's a jack sitting there. They plug in with their laptop turn on wire shark and they're pulling in LLDP frames and now they know you've got a Cisco network and you've got a switch with this name and its management IP is this. So now you have a sense of this is a Cisco shop. Okay. And they're running this kind of a host because it gave me its model name and their IP scheme is something like this because I at least know that one management IP address. It's it's bad man. Don't do it. So not good. So you want to be thoughtful about where you are you where you are enabling LLDP and you can configure ports. This generally speaking you can configure ports on switches to be senders only receivers only both senders and receivers or completely dark.

40:15It's going to ignore any LLDP it sees and it's not going to send anything out. So you got all that that functionality available to you and for those edge ports those ports at the edge of your network where we're host typically plug in. I would not I would disable it. I would not turn it on. I will add this in this specific scenario. If you're really serious about your network security you're going to leave unused ports like that conference room that no one ever uses or that waiting area where there's it's the building was wired that way but there's actually no reason anyone to ever plug into that port. You're going to shut that port down entirely anyway. It's just that would be a best practice. Most of the networks that I've administered although it can be a little annoying at times I shut down any port that's not actively in use which made the server guys in the data center really annoyed with me. I plugged it in and nothing happened the networks broke. It's not broke. I need you to tell me what you're plugging in. I have to do things before we turn that port up.

41:18Right? Right guys and I finally trained them to send me help that's taken to configure the port before turn up day with their new server so I could put it in the right VLAN and set all the proper parameters and all that stuff. Shutting down the port was a good way to maintain control of the network even though it was a little tedious at times to deal with that. Tidious is best sometimes otherwise you have people just plugging in this stuff and everything breaks. Now, by the way, I'm not saying never turn LLDP on a port that's an edge port because there might be reasons you do want to turn on like the edge port is feeding an access point. Well, yeah, you want LDP on there. There might be other reasons that you need to turn it on. It's not a all or nothing like most things in networking. It depends. So, you know, but yeah, just something to be thoughtful about. It's a good thing to think of because I also you don't want to leak. You don't want to lose that information. And it seems harmless. It's, you know, good information. It's helpful, but with everything in networking, like you should, what do you always say? I don't know, something, this is more something you say along those lines.

42:23What does the thing you say? Do I have sex? Yes, you do. You do. I can't think of what it is now, but pretty much don't just turn everything on for the sake of it. It's as simple as possible, but no simpler. That's one of the things I say that might be. I don't think so. I'm including thoughts here about LODP, Holly. There are a lot of other protocols that are similar to LODP and some of them are just history. They're long gone, but we're around before LODP came. There's a few of these protocols that are like LDP and they're still in use in fact. So they're still in use ones. You've heard of CDP perhaps this could have scabbard protocol? That have run into. Yeah, you're going to see that. CDP is very similar to LODP. In fact, most scotovis really any scotovis is going to support both. You're going to have CDP and LODP available to you very probably. In Cisco Voice Up, right? P-Networks care about CDP. There's some helpful information that CDP gives you that LODP doesn't.

43:28I didn't begin to all of that to know exactly why and what the distinctions are. There's some proprietary Cisco magic there where CDP, Cisco Discovery Protocol, is something that'll be required in certain circumstances. Most of the Cisco shops that I was in, I went through a process of disabling CDP and migrating everything to LODP and didn't have any problems. But as I understand it, there are circumstances where CDP might be required and you're going to see it. CDP is also interesting and it seems to be the mechanism for detecting native VLAN mismatches, which you may run into this on a Cisco switch where it's logging native VLAN mismatch detected and it's on a trunk port, a VLAN trunk port where you're tagging all of your VLANs with 8.2.1Q tagging. But the native VLAN, that is what VLAN does the untagged packet belong to, are mismatched on either side. Apparently CDP can uncover that misconfiguration and then you see that and you go, oh, you go

44:33and fix the problem where LODP can't tell you that. As far as I know, I can't tell you that. Although in theory, with the right TLV that someone would define as standard, if you could, I don't know. Those are what my research turned up that that was a thing. So maybe that's still true in 2026 and maybe not. Okay, so CDP was one still in use, MNDP, MicroTick, Neighbor Discovery Protocol. Have you ever heard of MicroTick, Holly? Run into them. No, CDP is the only one that I've run into in this list. Have you heard about MicroTick, the networking vendor? No. No, okay. So they are a vendor out of Europe. They make, it's a weird command line interface. I know that much, but they make these really powerful boxes, really capable boxes that can do, by anything you're looking for, for very affordable prices. I forget what company they're based out of. But they are pretty well known in the small ISP, wireless ISP space. They MicroTick does really well. And anyway, MicroTick, M-I-K-R-O-T-I-K, MicroTick, Neighbor Discovery Protocol is still a thing

45:39that they use for part of their management. You can manage a device over NMDP, as I understand it, even if that device doesn't have a management IP. And there's other funky stuff that the MicroTick world, they want MNDP to be turned on. You might run into that if you run into a MicroTick shop, which is kind of rare, I think, unless you're in that wireless ISP, small ISP world. But certainly there's plenty of folks I know from my work at packet pushers that I've run into. People love this stuff. They really get into MicroTick heavily. One more that might still be in use that's kind of like LLDP, but isn't extreme. You've heard of extreme networks? Yes. Yeah, you probably, I'm sure you've run into them because of your wireless work. When you were at HP, they, they, they, more, most likely would have run into, run into some of your deals now and again, but they had extreme discovery protocol, EDP. And from what I can tell, that's still around, it's still in use on certain extreme operating systems, but it does seem to be fading out in favor of LLDP.

46:43And then if you, you guys were to dig on this, you'd find a lot of history because basically every networking vendor had some kind of a discovery protocol like this before LLDP became the standard. Like there was a company called Foundry Way back in the day that got acquired. They had Foundry Discovery Protocol. Alcatel Lucent. Well, Alcatel had Alcatel mapping a Jocency Protocol. Again, it's another one that died in favor of LLDP. And there's a, there's a ton more if you were to research this. And so it's kind of, you know, a fun bit of history. I know that everybody kind of had their own way of doing this until LLDP came along. And since LLDP came along, not too many of the other ones survived. Again, they got CDP, MNDP, a little bit of EDP. You're still kicking around from what I can tell. And maybe, maybe some of you can well actually us with some of your own weird discovery protocols that you're still using in 2026 and not LLDP would love to, love to hear about those. Okay, we kept it under an hour. We did, but one thing to note, like the reason why you have LLDP and not all of these

47:46vendor specific discovery mechanisms is because they don't talk to each other. And that's going to my point in the beginning, a lot of the benefit of LLDP is when you have a multi-vendor environment. Well, now you've got CDP and MNDP. And now they don't speak to each other. Then, well, that doesn't help you much. So. And that's why I was migrating shops that even though they were Cisco shop, I take them from CDP to LLDP just to have better interoperability if I didn't need CDP for any particular reason. Now that said, Cisco has been such a dominating network vendor for so long that there are some companies, non-sysco companies that will support CDP. That's something I've run into, but my preference has been to move to LLDP, which would be cool because you'd get things like, I've got this VMware server running the ESXi distributed switch and it can speak LLDP and tell me interesting things about itself as plugged into the physical switch.

48:47Things like that are cool. That LLDP just makes it easier to get those kind of things done. Because again, that whole multi-vendor thing, if you can do it, if you're a Cisco shop running EIGRP, migrate to OSP after your life's going to get easier with all the other non-sysco boxes that you have that probably don't speak EIGRP, for example. Okay, well, again, we did keep it under an hour. I'm proud of us. Very proud of us. Those are fun episodes. I learned some things. And you did too, I guess. I did. Hi. You know, the funny thing about doing all the certs I did for all those years is no doubt some amount of that information was in my brain somewhere, but still I started digging and researching and reviewing. It's just like, yeah, like that multi-cast Mac address. I didn't know that. Did I have to know that before, for an exam? Maybe. But, you know, Luxus forgot about it.

49:48And then no doubt learned new things. So, all right, everybody. Thank you for listening to End is for networking today. I have been Ethan Banks, along with Holly, Poddelac. And if you have questions, comments are those well actually feedback for us. Please send us those things via packetpushers.net slash follow up. We really enjoy hearing from you. We love all the comments that we get from you. A lot of you that are sending us DMs or sending us these follow up messages letting us know how much you enjoy the show, which you get out of it, are correcting us or sharing anecdotes. It's awesome. Keep doing it. We'll do another well actually episode. At some point in the future when we collect enough, we'll do another one and share all the everybody's thoughts. And is for networking is part of the packet purchase podcast network of technical content for IT engineers. If you like this sort of a show that you just watched or listen to, I think you're going to like most of the podcast series that we produce at packet pushers. We try to keep the signal to noise ratio as high as possible so that you're getting maximum benefit for your time spent. We care about you out there. We really do. We're rooting for you. If you try to move up from the help test to your first networking job, you're working on your certification, you're grinding through classes on your way to a degree, we see

50:51it. We do. Keep going. We're making these shows for you. Keep your goals in mind. You got this and be kind to yourself too. And then finally just remember networking isn't hard. For people figured it out so you can too.