cdp

Overview ¶

Package cdp decodes Cisco Discovery Protocol packets per the publicly-documented wire format (reverse-engineered and documented in Wireshark dissectors, tcpdump output, and the CDP protocol whitepapers Cisco has historically published).

Wrap-vs-native judgement

Native. CDP is a proprietary Cisco protocol but the wire
format has been openly documented for decades — every
Wireshark dissector, every `tcpdump -X ether proto 0x2000`
parser, and every Linux `cdpr`/`cdptools` utility agrees
on the layout. Four bytes of fixed header (version + TTL
+ checksum) followed by a TLV walker over ~17 documented
TLV types. No crypto, no compression, no varints.
Operators paste CDP payload bytes (after the SNAP/LLC
header strip, EtherType 0x2000 with OUI 00-00-0C and
PID 0x2000) from a Wireshark Follow-Frame view, a
`tcpdump -i ethX -X ether proto 0x2000` line, or any
CDP-emitting tool and get every documented field.

What this package covers

• **4-byte header**: Version (1 byte; usually 2) + TTL (1 byte seconds, default 180) + Checksum (2 bytes BE). Checksum verification is out of scope (requires the standard one's-complement Internet checksum over the whole CDPDU); the value is surfaced as hex.

• **TLV walker** — each TLV is Type (2 bytes BE) + Length (2 bytes BE, includes the 4 header bytes) + Value (Length-4 bytes). The walker iterates until the buffer is consumed.

• **~17 documented TLV types** with per-type body decoding:

• 0x0001 Device ID (UTF-8 string)

• 0x0002 Addresses (list of protocol-typed addresses)

• 0x0003 Port ID (UTF-8 string)

• 0x0004 Capabilities (uint32 BE bitfield — 10 documented bits: Router / Transparent Bridge / Source Route Bridge / Switch / Host / IGMP / Repeater / VoIP Phone / Remotely Managed Device / CVTA)

• 0x0005 Software Version (UTF-8 string — typically multi-line Cisco IOS version banner)

• 0x0006 Platform (UTF-8 string — e.g. "cisco WS-C2960")

• 0x000A Native VLAN (uint16 BE)

• 0x000B Duplex (1 byte: 0 half-duplex / 1 full-duplex)

• 0x000E VoIP VLAN Reply

• 0x000F VoIP VLAN Query

• 0x0010 Power Consumption (uint16 BE milliwatts)

• 0x0011 MTU (uint32 BE bytes)

• 0x0012 Trust Bitmap (1 byte)

• 0x0013 Untrusted Port CoS (1 byte)

• 0x0014 System Name (UTF-8 string)

• 0x0015 System Object ID (ASN.1 OID bytes)

• 0x0016 Management Address (list, same shape as 0x0002)

• **Addresses TLV body** (used by both Addresses and Management Address):

• Number of addresses (uint32 BE)

• For each: Protocol Type (1 byte, typically 1=NLPID) + Protocol Length (1 byte) + Protocol bytes (e.g. 0xCC for IPv4 NLPID) + Address Length (uint16 BE) + Address bytes (4 for IPv4, 16 for IPv6).

What this package does NOT cover (deliberately out of scope)

• SNAP/LLC framing — feed the CDP payload bytes after the 802.2 LLC SNAP header (DSAP/SSAP 0xAA / Control 0x03 / OUI 00-00-0C / PID 0x2000). The dissector starts at the CDP version byte.

• Checksum verification — the value is surfaced as hex; operators can compute the standard one's-complement checksum over the whole CDPDU if they need to verify.

• CDP version 1 (deprecated; the protocol is essentially a subset of v2). The walker handles v1 TLVs that overlap; v1-only behaviours are not flagged.

• LLDP (the open IEEE 802.1AB-2009 equivalent) — handled by `lldp_decode`. CDP and LLDP often coexist on the same wire because Cisco switches typically run both.