# Tuesday, September 30, 2008

Cisco Discovery Protocol or CDP is a proprietary protocol developed by Cisco that allows Cisco devices to share information with other directly connected Cisco equipment [More Info]. The CDP protocol has some really useful information in it such as the IP of the device, the port you're attached to and even VLAN information. This is really helpful when you want to find out which switch port you are connected to without leaving your desk.

Firstly go to WinPcap site and download WinPcap and WinDump. After installing WinPcap I placed windump.exe in C:\Tools with the rest of my toolkit.

The procedure to find your switch port is:
Run windump.exe -D

C:\Tools>windump -D
1.\Device\NPF_{DAA1C207-9CDF-4FB9-92B6-162E447B55EF} (MS Tunnel Interface Driver)
2.\Device\NPF_{D47A6165-BF3D-47FE-B3AD-59A97CDE2A60} (Microsoft)
3.\Device\NPF_{AD370DA2-E8A2-47EA-9AA5-10B152DED150} (Intel(R) 82566MM Gigabit Network Connection)

Remembering the interface number run windump -nn -v -i 3 -s 1500 -c 1 ether[20:2] == 0x2000"
** -i 3 is your interface number, so to listen on the first interface use -i 1.

15:50:45.039275 CDPv2, ttl: 180s, checksum: 692 (unverified), length 384
        Device-ID (0x01), length: 27 bytes: '16-C4506.domain.com.'
        Version String (0x05), length: 251 bytes:
          Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000-I9S-M), Version 12.2(25)EWA8, RELEASE SOFTWARE (fc1)
          Technical Support:
http://www.cisco.com/techsupport
          Copyright (c) 1986-2007 by Cisco Systems, Inc.
          Compiled Wed 24-Jan-07 14:38 by pwade
        Platform (0x06), length: 14 bytes: 'cisco WS-C4506'
        Address (0x02), length: 13 bytes: IPv4 (1) 172.16.3.100
        Port-ID (0x03), length: 19 bytes: 'GigabitEthernet5/32'
        Capability (0x04), length: 4 bytes: (0x00000029): Router, L2 Switch, IGMP snooping
        VTP Management Domain (0x09), length: 3 bytes: 'bdo'
        Native VLAN ID (0x0a), length: 2 bytes: 1
        Duplex (0x0b), length: 1 byte: full
        AVVID trust bitmap (0x12), length: 1 byte: 0x00
        AVVID untrusted ports CoS (0x13), length: 1 byte: 0x00
1 packets captured
602 packets received by filter
0 packets dropped by kernel

And there you have it! You can see Port-ID and Native VLAN ID are your Port and VLAN information.

posted on Tuesday, September 30, 2008 3:56:05 PM (E. Australia Standard Time, UTC+10:00)  #    Comments [0]
Related posts:
Using Powershell to find information from Cisco switches