lldp

Overview ¶

Package lldp decodes Link Layer Discovery Protocol payloads per IEEE 802.1AB-2009.

Wrap-vs-native judgement

Native. IEEE 802.1AB is fully public; LLDP wire format
is a tight 7-bit-type + 9-bit-length TLV walker over a
small (~10) documented type catalogue plus an
Organizationally Specific escape hatch keyed by OUI.
No crypto, no compression, no varints. Operators paste
the LLDP payload bytes (after the Ethernet header strip,
typically EtherType 0x88CC) from a `tcpdump -i ethX -X
ether proto 0x88CC` line, a Wireshark Follow-Frame
view, or any LLDP-emitting tool and get every documented
field plus per-TLV body decoding for the operationally-
useful types (Chassis ID / Port ID / TTL / System Name /
System Description / Capabilities / Management Address).

What this package covers

• **TLV walker** — each TLV is 16 bits of header (7 bits type + 9 bits length, big-endian) followed by `length` bytes of body. The walker stops at End of LLDPDU (type 0) or at the buffer end.

• **Mandatory TLVs** (must appear in this order at the start of every LLDPDU per §8.1.1):

• Type 1 Chassis ID

• Type 2 Port ID

• Type 3 Time-To-Live (uint16 BE seconds)

• **Optional standardised TLVs**:

• Type 0 End of LLDPDU

• Type 4 Port Description (UTF-8)

• Type 5 System Name (UTF-8)

• Type 6 System Description (UTF-8)

• Type 7 System Capabilities (2 capability flags + 2 enabled flags, total 4 bytes — 11 documented capability bits: Other / Repeater / MAC Bridge / WLAN AP / Router / Telephone / DOCSIS Cable Device / Station Only / C-VLAN Component / S-VLAN Component / Two-port MAC Relay)

• Type 8 Management Address

• **Chassis ID subtypes** (RFC IANA): 1 Chassis component / 2 Interface alias / 3 Port component / 4 MAC address (6 bytes, formatted as XX:XX:XX:XX:XX:XX) / 5 Network address (1-byte AFI + addr) / 6 Interface name / 7 Locally assigned.

• **Port ID subtypes**: 1 Interface alias / 2 Port component / 3 MAC address / 4 Network address / 5 Interface name / 6 Agent circuit ID / 7 Locally assigned.

• **Management Address** body: address string length + address subtype (IANA Address Family Number) + address bytes + interface numbering subtype (1 unknown / 2 ifIndex / 3 systemPortNumber) + interface number (uint32 BE) + OID string length + OID bytes (BER- encoded; surfaced as hex).

• **Organizationally Specific TLV** (type 127): 3-byte OUI + 1-byte subtype + organisation-defined body. Common OUIs surfaced with their canonical name:

• 00-12-0F: IEEE 802.3

• 00-80-C2: IEEE 802.1

• 00-12-BB: LLDP-MED (TIA TR-41)

• 00-13-1F: PROFIBUS (PROFINET)

• **Mandatory-TLV ordering check** — surfaces a note if the first three TLVs are not Chassis ID + Port ID + TTL in that order.

What this package does NOT cover (deliberately out of scope)

• Ethernet framing — feed the payload bytes after the Ethernet header (dst MAC + src MAC + EtherType 0x88CC).

• LLDP-MED extension TLV-by-TLV decoding — the LLDP-MED OUI (00-12-BB) subtypes are surfaced with raw body hex; deep dissection of capabilities, network policy, location identification, and inventory belongs in a sibling Spec.

• IEEE 802.1 / 802.3 OUI subtypes (VLAN ID / link aggregation / max frame size / power-via-MDI) — also surfaced as raw body hex; deep dissection deferred.

• CDP (Cisco Discovery Protocol, proprietary EtherType 0x2000) — a sibling Spec; LLDP is the open multi-vendor standard.