If you're troubleshooting a network and you're not using Wireshark to look at LLDP and CDP packets, you're potentially missing some incredibly useful information. Link Layer Discovery Protocol (LLDP) and Cisco Discovery Protocol (CDP) are designed to help network devices identify their neighbors, and Wireshark lets you see exactly what those devices are advertising. Instead of relying entirely on switch management interfaces or guessing which device is connected to which port, you can capture the Layer 2 discovery traffic and inspect the information packet by packet. This can be particularly valuable when documenting an unfamiliar network or troubleshooting a connection where the switch configuration doesn't tell the whole story.
One of the biggest advantages of capturing LLDP traffic is network discovery. Depending on the device and configuration, LLDP can provide information such as the system name, port identifier, device capabilities and management address. Because LLDP operates at Layer 2, it doesn't depend on IP connectivity between the neighboring devices. If you can capture the Ethernet frames, you can potentially see the discovery information being advertised. LLDP normally uses the reserved multicast destination MAC address 01:80:c2:00:00:0e, and its EtherType is 0x88cc. That makes LLDP particularly easy to identify in a packet capture. In Wireshark, the display filter lldp is usually all you need to isolate the protocol.
CDP provides similar neighbor-discovery functionality and is particularly useful in Cisco environments. Depending on the Cisco device and configuration, a CDP packet can contain information including the neighboring device's hostname, platform, software version, connected interface, capabilities and other device-specific details. This can be extremely useful when troubleshooting Cisco switches, routers, IP phones and access points. CDP can also provide information related to power and device capabilities, which makes it interesting when investigating PoE-related problems. Instead of simply looking at what the switch believes is connected, you can examine the actual CDP advertisements and see what the neighboring device is reporting.
Wireshark makes analyzing these protocols straightforward. For a display filter, use lldp to isolate LLDP packets or cdp to display Cisco Discovery Protocol traffic. If you're starting the capture from scratch, you can use capture filters to reduce the amount of traffic being recorded. A useful LLDP capture filter is ether proto 0x88cc. To capture both LLDP and CDP, you can use ether proto 0x88cc or ether proto 0x2000. On Ethernet captures where the protocol-offset expression is useful, ether[20:2] = 0x2000 can also be used to identify CDP traffic. Once the packets are captured, expanding the LLDP or CDP protocol tree in Wireshark lets you inspect the individual fields rather than simply knowing that discovery traffic exists.
The real benefit of using Wireshark for LLDP and CDP is that network discovery becomes packet-level evidence rather than guesswork. You can use these protocols to help map switch ports, identify neighboring equipment, verify device advertisements, investigate unexpected connections and troubleshoot discrepancies between what a switch reports and what an endpoint appears to be advertising. I also like this approach because the capture can be saved and reviewed later or shared with another engineer. When a network problem comes down to "the switch says one thing, but the device appears to be doing something else," a short Wireshark capture of LLDP and CDP traffic can provide the evidence needed to determine what is actually happening on the wire.
Quick Wireshark LLDP and CDP Filters
LLDP capture filter
ether proto 0x88cc
LLDP display filter
lldp
CDP capture filter
ether proto 0x2000
CDP display filter
cdp
Capture both LLDP and CDP
ether proto 0x88cc or ether proto 0x2000
LLDP destination MAC
01:80:c2:00:00:0e
