This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

CDP question

0

The only thing that is not clear for me is the fact that for example I connect a cisco access point to a cisco swith with cdp enable both running same version and if then I SPAN the port connecting the access point I can clear see that the cdp packet reaching the port on the switch and then I should display at the other end with show cdp nei to say something.

but what happens when I have to switches involved

SW-1----SW-2

Should I see the info of cdp in SW1 of switch 2 and the other way around? applying a double session one span in switch 1 and another session in switch 2.

This question is marked "community wiki".

asked 16 Jan '12, 09:24

JohnRodriguez's gravatar image

JohnRodriguez
6224
accept rate: 0%

edited 16 Jan '12, 13:22

@JohnRodriguez; Please use "add a comment" to follow up, instead of editing the original question. Otherwise, it is very difficult for others to see what was asked and to follow the flow of the conversation.

(16 Jan '12, 16:37) Jim Aragon

One Answer:

2

There is no acknowledgement from the other device. CDP packets are sent to the multicast address 01-00-0c-cc-cc-cc out each connected interface. Because the CDP packet is sent out a directly-connected interface, you can be pretty confident that it will reach the interface of the other system, as long as the interface is up, functioning, and connected. Of course, the other system might not listen for CDP packets. No, there is no way to tell in Wireshark that the other device has received CDP packets. You would have to log in to the other device and display its CDP information.

The devices do not send CDP packets to get information from each other; they send CDP packets to send information.

answered 16 Jan '12, 10:30

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

edited 16 Jan '12, 15:50