CCNA online course

Use Cisco Discovery Protocol (CDP) to Identify Directly Connected Devices

Learn how CDP discovers directly connected Cisco devices and how to interpret show cdp neighbors and detailed neighbor output.

Cisco Discovery Protocol (CDP) helps you discover and document Cisco devices directly connected to a router or switch. With two IOS show commands, you can identify a neighboring device, map both ends of a physical link, and inspect advertised hardware, software, addressing, and capability information.

This lesson assumes basic router and switch operation, Cisco IOS command-line navigation, interface naming, and basic Layer 2 and Layer 3 concepts. For background, review the OSI reference model and computer networking fundamentals.

What CDP Is and What It Discovers

Cisco Discovery Protocol (CDP) is a Cisco-proprietary Layer 2 neighbor-discovery protocol. A Cisco device uses CDP to advertise information about itself to devices connected directly to its interfaces.

A neighbor is a device directly connected to a local interface and discovered through CDP advertisements. CDP does not discover every device somewhere else in the routed network. It identifies the adjacent device on the local link.

CDP is commonly used to collect:

  • Basic physical topology information
  • Neighbor hostnames or device identifiers
  • Local and remote interface relationships
  • Hardware platform or model information
  • Cisco IOS or other software version information
  • Network and data-link addressing information
  • Supported capabilities, such as routing or switching

How CDP Operates

CDP-enabled Cisco devices transmit periodic CDP advertisements from their interfaces. A CDP advertisement is a message containing information about the sending device.

  1. A local Cisco interface sends a CDP advertisement.
  2. A directly connected device receives the advertisement at the data-link layer.
  3. The receiving device extracts fields such as the sender's identity, platform, capabilities, and remote interface.
  4. The receiving device adds or updates an entry in its CDP neighbor table.
  5. If advertisements stop arriving, the entry remains temporarily valid until its holdtime expires.

Holdtime is the interval for which a learned CDP neighbor entry remains valid without another received advertisement. When the holdtime expires, the neighbor is aged out of the table. This prevents a device from displaying a neighbor that is no longer reachable on the local link.

CDP is a data-link-layer protocol, so it can operate without relying on IP connectivity. This makes it useful during early-stage troubleshooting, when an interface may be physically connected but Layer 3 configuration is incomplete.

Information Advertised by CDP

Depending on the platform and software version, CDP can advertise several categories of information:

  • Device identifier: Usually the hostname of the neighboring device.
  • Address information: Network or protocol addresses that can help with management and diagnosis.
  • Platform: The hardware family or model of the neighbor.
  • Software: Cisco IOS or other software version information, especially in detailed output.
  • Capabilities: Functions supported by the neighbor, such as routing or switching.
  • Remote port: The interface on the neighboring device from which the advertisement was sent.
  • Additional link information: Native VLAN or duplex information when the device advertises those fields.

View Directly Connected Neighbors

Enter privileged EXEC mode and run the concise neighbor summary command:

show cdp neighbors

This command displays a compact table of discovered neighbors. The most important use of the table is mapping a local interface to the corresponding interface on the remote device.

Router# show cdp neighbors

Capability Codes: R - Router, S - Switch

Device ID        Local Interface   Holdtime   Capability   Platform   Port ID
HQ_SWITCH        Fa0/1              142        S            ...        Fa0/5

In this example, the router receives CDP information on its local FastEthernet0/1 interface. The advertisement came from FastEthernet0/5 on the device named HQ_SWITCH. The S capability indicates that the neighbor supports switching.

Interpret the show cdp neighbors Fields

Field | Meaning | Example interpretation

Device ID | The identifying name or hostname of the neighboring device. | HQ_SWITCH is the adjacent device identifier.

Local Interface | The interface on the current device that receives the neighbor's CDP information. | Fa0/1 is the router interface connected to the neighbor.

Holdtime | The remaining time the entry is retained if no additional CDP message arrives. | 142 means the entry is currently valid for the displayed remaining interval.

Capability | A code indicating functions supported by the neighbor. | S indicates switching capability; R indicates routing capability.

Platform | The advertised hardware family or device model, with associated software information shown by some output formats. | The value helps identify the neighbor's device family.

Port ID | The interface identifier on the neighboring device associated with the link. | Fa0/5 is the remote port connected to the local Fa0/1.

Read the interface relationship in both directions: Local Interface identifies the port on the device where you ran the command, while Port ID identifies the remote port.

Common Capability Indicators

Indicator | Meaning | Example device type

R | The neighbor advertises routing capability. | Router or multilayer switch.

S | The neighbor advertises switching capability. | Layer 2 switch.

A device can advertise more than one capability. Always use the Platform field and detailed output as additional evidence rather than identifying a device from one letter alone.

Obtain Detailed Neighbor Information

Use the detailed form of the command when the summary table is not enough:

show cdp neighbors detail

show cdp neighbors detail displays expanded information for each discovered neighbor. Useful fields may include:

  • Device identifier and hostname
  • Management or protocol addresses
  • Hardware platform or model
  • Cisco IOS or other software version information
  • Advertised capabilities
  • Native VLAN information when available
  • Duplex information when available
  • Local interface and remote Port ID association

For example, the detailed output can help you identify an unknown device before changing its configuration:

Router# show cdp neighbors detail
-------------------------
Device ID: HQ_SWITCH
Entry address(es):
  IP address: 192.0.2.20
Platform: Cisco switch, Capabilities: Switch
Interface: FastEthernet0/1, Port ID (outgoing port): FastEthernet0/5
Version: Cisco IOS Software ...
Duplex: full

Exact labels and available fields vary by Cisco platform and software release. Treat the output as information advertised by the neighbor, then verify important facts through the appropriate management or interface commands.

Practical CDP Examples

Identify a Switch Connected to a Router

  1. Run show cdp neighbors on the router.
  2. Find the neighbor with Device ID HQ_SWITCH.
  3. Match the router's Local Interface, FastEthernet0/1, to the neighbor's Port ID, FastEthernet0/5.
  4. Use the S capability indicator to recognize the neighbor as a switch.

The resulting physical-link record is: router Fa0/1 ↔ HQ_SWITCH Fa0/5.

Verify a Physical Cabling Map

For each active local interface, inspect the CDP neighbor table and record:

  • Local interface
  • Neighbor hostname or Device ID
  • Remote Port ID
  • Platform

Pairing the two interface identifiers creates a practical topology record. This is often faster and more reliable than tracing cables manually in a populated rack.

Investigate an Unknown Connected Device

  1. Run show cdp neighbors to locate the device and interface pair.
  2. Run show cdp neighbors detail to inspect identity, platform, software, capabilities, and advertised address data.
  3. Use the local and remote port identifiers to locate the physical connection.
  4. Use the discovered hostname or address as a starting point for further management and diagnosis.

Operational Uses of CDP

  • Topology documentation: Discover adjacent devices and build interface-level topology records.
  • Port mapping: Map a local switch or router port to the exact port on the neighboring device.
  • Troubleshooting: Verify what device is connected to an interface instead of relying only on labels or diagrams.
  • Device identification: Learn the neighbor's hostname, platform, software, and capabilities.
  • Management preparation: Use advertised names and addresses as starting points for controlled follow-up access and diagnosis.

CDP and LLDP

Link Layer Discovery Protocol (LLDP) is an IEEE-standard, vendor-neutral neighbor-discovery protocol. Like CDP, LLDP advertises device and interface information at the data-link layer.

Characteristic | CDP | LLDP

Protocol ownership | Cisco-proprietary. | IEEE-standard and vendor-neutral.

Vendor interoperability | Primarily designed for Cisco-to-Cisco discovery. | Designed to exchange information across different vendors.

Primary use | Discover adjacent Cisco devices and their link information. | Discover adjacent devices in a multivendor environment.

Appropriate environment | Cisco-focused networks. | Networks containing Cisco and non-Cisco switches, routers, phones, access points, or other equipment.

Use CDP when the adjacent devices are Cisco devices and CDP is available. In a mixed-vendor environment, LLDP may be needed because a non-Cisco device may not understand or transmit CDP advertisements.

Troubleshoot Missing or Unexpected Neighbors

Expected Device Is Absent

If an expected adjacent device does not appear in the CDP table, work through these checks:

  1. Confirm that the devices are directly connected. CDP does not reveal devices elsewhere in the routed network.
  2. Check that the physical link and relevant interfaces are operational.
  3. Verify that CDP is available and enabled on the relevant devices and interfaces.
  4. Consider whether the neighbor is non-Cisco and may be using LLDP instead.
  5. Allow enough time for advertisements to be sent and the neighbor table to update.

Neighbor Entry Disappears

A previously visible entry can disappear when advertisements stop arriving and its holdtime expires. Investigate the physical link, interface state, and CDP operation on both devices. The disappearance does not necessarily mean the device was intentionally removed; it can indicate a link, interface, or protocol problem.

Discovered Device Type Is Unexpected

  1. Check the Capability and Platform fields in the summary output.
  2. Use show cdp neighbors detail to review advertised platform, software, and address information.
  3. Confirm the local and remote interface identifiers so that you are examining the correct cable and neighbor.

Exam-Relevant Summary

  • CDP is a Cisco-proprietary Layer 2 neighbor-discovery protocol.
  • It discovers directly connected neighboring devices, not devices throughout the network.
  • CDP advertisements allow a receiving device to build a neighbor table.
  • Neighbor entries age out when advertisements stop arriving before the holdtime expires.
  • show cdp neighbors provides a concise summary.
  • show cdp neighbors detail provides expanded identity, address, platform, software, capability, and link information.
  • Local Interface is the port on the device running the command; Port ID is the remote port.
  • R commonly indicates routing capability, and S commonly indicates switching capability.
  • LLDP is the IEEE vendor-neutral alternative, especially useful in mixed-vendor networks.

CDP is most valuable when you use its output as a link map: identify the neighbor, match both interface names, inspect the advertised device details, and then use that evidence to document or troubleshoot the physical network.