LinkLayerDiscoveryProtocol

Link Layer Discovery Protocol (LLDP, IEEE 802.1AB)

The Link Layer Discovery Protocol (LLDP) is a vendor neutral layer 2 protocol that can be used by a station attached to a specific LAN segment to advertise its identity and capabilities and to also receive same from a physically adjacent layer 2 peer.

History

After several years of development LLDP was formally defined in May of 2005 as IEEE Std 802.1AB-2005.

LLDP was developed as an open and extendable standard. It was modeled on and borrowed concepts from the numerous vendor proprietary discovery protocols such as Cisco Discovery Protocol (CDP), Extreme Discovery Protocol (EDP) and others.

Protocol dependencies

LLDP Data Units (LLDPDUs) are sent to the destination MAC address 01:80:c2:00:00:0e. This address is defined as the "LLDP_Multicast" address. This address is defined within a range of addresses reserved by the IEEE for protocols that are to be constrained to an individual LAN. AN LLDPDU will not be forwarded by MAC bridges (e.g. switches) that conform to IEEE Std 802.1D-2004.

LLDPDUs can be directly encoded with an Ethertype value of 0x88cc or they may be encapsulated within an SNAP-encoded (Subnetwork Access Protocols - IEEE Std 802-201) LLC frame. If SNAP-encoded, a SNAP discriminator value of aa:aa:03:00:00:00 will be prepended to the LLDP Ethertype value of 0x88cc.

Example traffic

Screenshot: LLDP.png

XXX - Add example traffic here (as plain text or Wireshark screenshot).

Wireshark

Support for LLDP (and the TIA's LLDP-MED extensions) is available since Wireshark 0.10.13 (SVN version 15800).

Preference Settings

N/A

Example capture file

Included below are two very small example LLDP trace files. The lldp.minimal.pcap file includes just a single lldp frame that contains the required minimum LLDP TLV entries. The lldp.detailed.pcap file includes just a single lldp frame that contains many of the optional LLDP TLV entries.

SampleCaptures/lldp.minimal.pcap SampleCaptures/lldp.detailed.pcap

Included below is an example LLDP-MED trace file. The lldpmed_civicloc.pcap file incluces a single lldp-med frame that contains several of the LLDP-MED TLV entries, including civic address location ID, network policy and extended power-via-MDI.

SampleCaptures/lldpmed_civicloc.pcap

Display Filter

A complete list of LLDP display filter fields can be found in the display filter reference

To display only the LLDP based traffic use:

lldp

Capture Filter

To capture only the LLDP based traffic use:

ether proto 0x88cc

External links

The formal LLDP specification is freely available for download at:

Included below are some links with potentially useful information regarding LLDP and/or link layer discovery:

For some perspective on how the LLDP came to be, see the following from ieee802.org:

It's interesting to note that unlike the LLDP drafts referenced above, the final LLDP standard abandoned the notion of an LLDP Header and instead simply mandated the presence of certain TLVs. In the various draft documents the LLDP Header was supposed to include a Version field. The current LLDP standard does not include any notion of a Version.

LLDP agent for Windows:

Open source LLDP projects:

Discussion

There are both mandatory and optional LLDP TLVs defined. All compliant LLDP Data Units (LLDPDUs) must contain at a minimum the following four mandated TLVs in the following order :

If the LLDPDU includes optional TLVs they will be inserted between the Time To Live TLV and End of LLDPDU TLV.

Optional TLVs include the Basic set of TLVS and the Organizationally Specific TLVS.

Besides the four mandated TLVs listed above the Basic set of LLDP TLVs also includes:

Organizationally Specific TLVs

The LLDP specification allows for various organizations to define and encode their own TLVs. These are called Organizationally Specific TLVs. All Organizationally Specific TLVs start with an LLDP TLV Type value of 127.

The length field of an Organizationally Specific TLV is followed by a 3 octet (24 bit) organizationally unique identifier (OUI) value which is then followed by a 1 octet organizationally defined subtype.

The following organizations have published Organizationally Specific TLVs:

LLDP specification defines the following set of IEEE 802.1 Organizationally Specific TLVs reference(02-Dec-2011):

Annex G of the LLDP specification defines the following set of IEEE 802.3 Organizationally Specific TLVs:

The Telephone Industry Association specification ANSI/TIA-1057 (April 2006) defines the LLDP-MED specific TLVs. The formal LLDP-MED specification is freely available for download at:

The LLDP-MED specification defines the following set of TIA Organizationally Specific TLVs:

The following links include some information regarding LLDP-MED.

XXX - Probably LLDP-MED section should be expanded and moved to seperate Wiki page.

The LLDP specification defines the following set of Hytec Organizationally Specific TLVs (Homepage: www.hytec.de, protocol documentation: HYTEC):

Imported from https://wiki.wireshark.org/LinkLayerDiscoveryProtocol on 2020-08-11 23:16:00 UTC