CCNA CDP, LLDP, Ping, Traceroute and Show Command Troubleshooting

CDP and LLDP let every device tell its directly connected neighbors who it is, which port it is sending from and what it can do, so you can check a cabling diagram against what the cables actually connect. Each device sends a small advertisement out each enabled port at a fixed interval; the neighbor stores it in a neighbor table and keeps it for a holdtime carried inside the advertisement. Neither protocol needs IP connectivity: the frames are Layer 2 multicasts (CDP to 0100.0ccc.cccc, LLDP to 0180.c200.000e) that a Cisco device consumes and never relays, and standards-compliant bridges do not forward LLDP's nearest-bridge address either, so an entry normally describes the device on the other end of that one cable. The exception is a device in between that does not process the protocol: a hub, an unmanaged switch or a switch without CDP floods the multicast like any other frame, so a port can list neighbors that are not cabled to it directly. Two or more neighbors on one local port is the classic sign of such a device, and that is itself a finding for the diagram.

The two protocols are independent and can run at the same time. A Cisco neighbor that runs both appears in both tables on the same pair of ports, which is one link seen twice, not two cables. A third-party neighbor normally appears only in the LLDP table. Validating documentation means comparing, for each documented link, the device name, the local port and the remote port with what the tables report, ideally from both ends.

In show cdp neighbors, Local Intrfce is the port on the device where you typed the command, and Port ID is the port on the neighbor that sent the advertisement. Swapping those two columns is the most common misreading, and it produces exactly the "wrong end of the diagram" conclusions that documentation checks are meant to catch.

DSW2# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
                  D - Remote, C - CVTA, M - Two-port Mac Relay
Device ID   Local Intrfce   Holdtme  Capability  Platform    Port ID
ACC-B7      Gig 1/0/15      164      S I         C9200-24T   Gig 1/0/21
WAN-R2      Gig 1/0/2       133      R I         C8200-1N-4T Gig 0/0/0

This says DSW2's Gi1/0/15 reaches ACC-B7, and the cable lands on ACC-B7's Gi1/0/21. The Port ID is the evidence for the neighbor's end of the cable, so a diagram that disagrees with it needs correcting at the neighbor's end, not at the local one. The columns are:

• Device ID: the neighbor's hostname (an IP phone uses SEP plus its MAC address).
• Holdtme: seconds left before this entry is deleted unless a new advertisement arrives. It counts down and jumps back up with each advertisement.
• Capability and Platform: what the neighbor is (next section).
• Port ID: the neighbor's sending port.

Validating from both ends

A link is confirmed when the two ends agree: my Local Intrfce must equal your Port ID, and your Local Intrfce must equal my Port ID. Running the command on both devices catches swapped uplinks, for example a router whose Gi0/0/0 and Gi0/0/1 are documented the wrong way round. Some further patterns:

• The same Device ID on two rows whose holdtimes keep refreshing means two separate cables to that neighbor. EtherChannel members still advertise individually, so a bundle shows one row per member.
• Several different Device IDs on one Local Intrfce means a hub or unmanaged switch between them is passing the CDP multicasts through; the diagram is missing that device.
• A neighbor missing from CDP is often simply not a Cisco device; look in the LLDP table.
• show cdp neighbors <interface> limits the table to one local port.

The Capability column lists the roles the neighbor advertises, and together with the Platform field it identifies what kind of device is on a port, which is how undocumented devices are found. The CDP legend is printed above the table:

Read them together with the platform and name:

• S I with a Catalyst model: a Layer 2 switch. A management SVI does not add R.
• R S I from a Catalyst: a switch that has IP routing turned on, acting as a Layer 3 switch. If the design calls it a Layer 2 access switch, the documentation (or the configuration) is wrong.
• H P M with an IP Phone platform and a SEP-prefixed Device ID: a Cisco IP phone with a PC port.
• A port documented for a printer or a wall jack that shows S I and a switch model has an unrecorded switch on it, which matters for the diagram and for loop prevention.

A Cisco device consumes CDP and never relays it, so a row normally describes the directly connected device, not one behind it. Only a device that ignores CDP, such as a hub or an unmanaged switch, lets frames from further away through, which shows up as extra neighbors on the same port.

Use show cdp neighbors detail for every neighbor, or show cdp entry <name> for one; the brief table never shows addresses or software versions. The detail record contains what the neighbor advertised: its IP (management) addresses, platform and capabilities, the local and remote interfaces, the holdtime, the full software version string, the CDP advertisement version, its native VLAN and its duplex.

ACC-B7# show cdp neighbors gi1/1/1 detail
-------------------------
Device ID: DSW4
Entry address(es):
  IP address: 172.20.0.4
Platform: cisco C9300-24T,  Capabilities: Router Switch IGMP
Interface: GigabitEthernet1/1/1,  Port ID (outgoing port): GigabitEthernet1/0/20
Holdtime : 129 sec
Version :
Cisco IOS Software [Cupertino], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 17.9.5
advertisement version: 2
Native VLAN: 300
Duplex: full

Read it carefully. Interface is the local (receiving) port; Port ID (outgoing port) is the neighbor's port. Native VLAN and Duplex are the neighbor's settings, not the local port's. An address learned through CDP says nothing about whether you can ping it, because CDP works at Layer 2 even when IP is broken.

Output filters such as | include work line by line: they keep only the lines that contain the pattern. They cannot pull one neighbor's multi-line record out of the detail output, so use show cdp entry when you need one neighbor's full record.

CDP sends an advertisement every 60 seconds by default and tells neighbors to keep it for 180 seconds; an entry disappears only when its holdtime counts down to zero without a fresh advertisement. That has three practical consequences:

• Stale entries after a recable. When a cable moves from one port to another, the neighbor appears on both ports for up to three minutes. The old entry's holdtime keeps falling (below about 120 seconds means it has missed at least one refresh) while the new one is refreshed. It is not a second cable.
• Holdtime is the sender's value. cdp timer and cdp holdtime (global commands) set what a device advertises about itself. The receiver keeps the entry for whatever holdtime the neighbor advertised, so changing the receiver's holdtime does nothing to how long it keeps that neighbor. If a sender advertises a holdtime shorter than its advertisement interval, its entry expires before the next advertisement arrives and keeps disappearing and reappearing in neighbors' tables. Only the sender's settings can fix that: its holdtime must be longer than its timer (the defaults keep it at three times the timer).
• Clearing the table. clear cdp table is an exec command that deletes learned entries immediately without changing configuration; live neighbors reappear with their next advertisement. clear cdp counters only resets the traffic statistics. Toggling no cdp run / cdp run also empties the table, but it is a configuration change.

Unplugging a cable brings the port down and flushes that port's entries; a fault that keeps the port up (a media converter or provider circuit dropping frames) leaves the entries to age out by holdtime.

Turning CDP off for the device or one port

no cdp run in global configuration disables CDP on the whole device, while no cdp enable in interface configuration disables it on that one port, in both directions. Cisco devices run CDP by default on supported interfaces, which means they announce hostname, platform, addresses and software version to anyone on the link. The usual hardening is no cdp enable on Internet-facing, provider-facing and other untrusted ports, while internal ports keep CDP for documentation and for IP phones, which learn their voice VLAN from it.

interface GigabitEthernet0/0/0
 description Link to ISP
 no cdp enable

• The global setting wins: with no cdp run configured, cdp enable on an interface has no effect and show cdp neighbors answers % CDP is not enabled. Enter cdp run first.
• no cdp advertise-v2 only drops back to CDP version 1 advertisements; it does not stop CDP.
• CDP and LLDP are controlled separately. Silencing a port completely takes no cdp enable and no lldp transmit (if LLDP runs); an LLDP command never changes CDP, and the reverse is also true.

On Cisco Catalyst switches running IOS XE, LLDP is disabled globally by default, so you enable it with lldp run; after that every supported port both transmits and receives LLDP by default. The interface commands lldp transmit and lldp receive only fine-tune ports once LLDP runs globally; on their own they enable nothing. Discovery needs LLDP running on both ends: a factory-default Catalyst neighbor still has LLDP off and sends nothing, even though it appears in the CDP table.

ACC-B7# show lldp neighbors
Capability codes:
    (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
    (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

Device ID       Local Intf   Hold-time  Capability   Port ID
PA-FW1          Gi1/0/24     104        R            ethernet1/7
DSW4            Gi1/1/1      87         B,R          Gi1/0/20
AP-2F-11        Gi1/0/8      115        B,W          Gi0
NAS-02          Gi1/0/17     99         S            eth0

As in CDP, Local Intf is your port and Port ID is the neighbor's port. The capability letters, however, mean different things:

So in LLDP a Layer 2 switch shows B, a routing switch B,R, an access point B,W, an IP phone with a PC port B,T and a server S. Reading an LLDP S as "switch" turns a NAS into a switch on the diagram. The Hold-time column counts down between advertisements just like CDP's Holdtme, so the lowest value is the entry closest to ageing out. Use show lldp neighbors detail or show lldp entry <name> for the neighbor's management address and system description, show lldp for the global status and timers, and show lldp interface for the per-port transmit and receive state. The LLDP table is not a list of non-Cisco devices: any Cisco switch, router or access point with LLDP running appears there as well.

Transmit, receive and timers

LLDP's per-port transmit and receive are independent one-way switches, and its default timers are a 30-second advertisement interval, a 120-second hold time and a 2-second reinitialisation delay.

• no lldp transmit: the port stops advertising this device but still learns neighbors, so it can identify an untrusted far end without disclosing anything about itself.
• no lldp receive: the port keeps advertising but learns nothing.
• Compare no cdp enable, which stops CDP in both directions on that port.

Discovery is therefore one-sided when one direction is off. When device A lists B but B lists nothing on that link, B's advertisements are reaching A; the broken direction is A to B, so either A is not transmitting or B is not receiving. Because the protocols are independent, work out each one separately: turning CDP off on a port removes the CDP entries at both ends, while a port that only stops receiving LLDP still advertises, so its partner keeps an LLDP entry for it.

DSW4# show lldp
Global LLDP Information:
    Status: ACTIVE
    LLDP advertisements are sent every 20 seconds
    LLDP hold time advertised is 90 seconds
    LLDP interface reinitialisation delay is 2 seconds

This switch has been tuned with lldp timer 20 and lldp holdtime 90; at defaults the lines read 30 and 120. As with CDP, the hold time travels in each advertisement, so a neighbor keeps an entry for the hold time the sender advertised; the receiver's own timers describe only what it sends. The global commands are lldp timer, lldp holdtime and lldp reinit. When a neighbor goes silent but your port stays up, each entry lasts for the hold time that neighbor last advertised: about two minutes for LLDP and three for CDP at defaults. The reinitialisation delay plays no part in that.

IOS ping prints one character per echo: ! means a reply arrived, . means the echo timed out with no answer, and other letters mean a device sent back an ICMP error. The success rate and round-trip times follow.

Two patterns are normal. .!!!! to a neighbor never contacted before is the first echo lost while ARP resolves the next-hop MAC address. Alternating results such as U.U.U or M.M.M come from ICMP rate limiting: IOS sends at most one unreachable per 500 ms by default, so every other echo gets no message and times out. &&&&& means echoes circled until their TTL ran out; follow it with traceroute to find the two routers involved.

Extended ping options

Typing ping alone starts the interactive extended ping; the same options exist as keywords:

• Source (source 192.168.10.1 or source Gi0/0/1): a router's normal ping uses its exit interface address, which only proves the return path to that link. Sourcing from the LAN address tests the route back to the users' subnet. If a ping from the WAN address works and the LAN-sourced ping fails, a router further on has no route back to the LAN.
• Repeat (repeat 1000): five echoes rarely catch loss that happens a few times an hour; a high count does and gives a precise success rate.
• Size and DF bit (size 1500 df-bit): with DF set, routers may not fragment, so oversized echoes fail. Large DF pings failing with M while smaller ones succeed brackets the path MTU. If oversized DF echoes simply time out with no M at all, the too-small hop is not returning (or something filters) the could-not-fragment message, a path-MTU black hole that makes large TCP transfers hang while small requests work. Without DF the same large pings succeed because routers fragment them.
• Sweep range of sizes: sends echoes from a minimum to a maximum size in steps. With a repeat count of 1 the output prints one character per size in ascending order, so map each character to its size: the size of the final success before the failures begin is the largest packet the path carries unfragmented.
• Timeout: how long each echo waits; it adds no samples.

Traceroute shows each router on the path and where replies stop: IOS sends UDP probes (three per hop) with TTL 1, 2, 3 and so on, each router that decrements a probe's TTL to zero returns ICMP time exceeded, and the destination ends the trace with a port-unreachable reply. Ping says whether a destination answers; traceroute says where the path goes and fails.

• *: no reply for that probe. A hop of * * * in the middle of a trace that still reaches later hops and the destination is a router that forwards traffic but does not send (or rate-limits) time-exceeded messages; it is silent, not broken. A real failure leaves every later line as stars.
• !A administratively prohibited (a filter such as an ACL), !H host unreachable, !N network unreachable, !P protocol unreachable. A mix like !A * !A is a filter plus ICMP rate limiting.

R5# traceroute 192.168.140.9
  1 10.1.45.4 1 msec 1 msec 1 msec
  2 10.1.46.6 1 msec 1 msec 2 msec
  3 10.1.46.4 2 msec 2 msec 2 msec
  4 10.1.46.6 2 msec 2 msec 3 msec
  5 10.1.46.4 3 msec 3 msec 3 msec

Two addresses taking turns, hop after hop, is a routing loop: each router sends the packet back to the other until the TTL expires. Equal-cost load sharing looks different: several addresses within the same hop line. To fix a loop, compare the two routers' show ip route entries for the destination: each one's next hop is the other. Correct whichever router should be forwarding onward instead, usually by giving it a specific route toward the destination's real next hop. A common cause is a router whose only match is a default route pointing back at the neighbor that just sent it the packet; because longest match wins, a specific route overrides that default.

Work from the evidence the device already holds: the log buffer, the MAC address table, the ARP table, the interface and routing tables, and show version.

Log messages worth recognising

• %LINK-3-UPDOWN and %LINEPROTO-5-UPDOWN: an interface went down or up; match them to the time users reported a drop.
• %SW_MATM-4-MACFLAP_NOTIF: the same MAC in the same VLAN keeps being learned on two ports. One move relearns once; constant flapping between two uplinks is the fingerprint of a Layer 2 loop.
• %IP-4-DUPADDR: another device answered for this device's own address and the message gives its MAC. Follow that MAC hop by hop: MAC table, then CDP on that port to find the next switch, then the MAC table there, until it is learned on an access port. These lookups change nothing, whereas disabling a port along the way disconnects every user who reaches the network through it, not just the offending device.
• %CDP-4-NATIVE_VLAN_MISMATCH and %CDP-4-DUPLEX_MISMATCH: written from the local device's point of view: the port after "discovered on" with its value in parentheses is local, the device and port after "with" are the neighbor's. Fix whichever end breaks the documented standard; changing the correct end also silences the message but breaks the standard. Neither mismatch brings the link down, but neither is harmless: with a native VLAN mismatch the trunk stays up while untagged traffic leaks between the two VLANs, and Catalyst switches running per-VLAN spanning tree block the affected VLANs on that port as port-VLAN-ID (PVID) inconsistent until the native VLANs match; a duplex mismatch causes collisions, errors and slow transfers. (Configuring trunks belongs to topic 2.1, and decoding syslog severities to 5.6.)

MAC and ARP evidence

A host that cannot reach its gateway: if its MAC is learned in a different VLAN from the one its subnet and gateway SVI belong to, the access port is assigned to the wrong VLAN. Fixing the port's access VLAN keeps the host's documented address; readdressing the host into the other VLAN's subnet would only move the documentation error. On a router, an ARP entry stuck at Incomplete means it asked and nobody answered: the host is off, disconnected, in the wrong VLAN or using a different address; the problem is not the router's routing. To find which port a laptop uses, look up its MAC in the switch's MAC table (if it is an uplink, follow it to the next switch); ARP maps IP to MAC on a VLAN interface, not to a port.

Device operations: uptime, reload reason and lost logs

Subtract the uptime from show clock to date the last restart, and read the Last reload reason beside it, which distinguishes, for example, a loss of power from an operator's reload. The local log buffer lives in RAM, so a reload erases everything logged before it; only a syslog server keeps messages across a power loss. A new image copied to flash and set as the boot image runs only after the next reload: the version line in show version is the release running now. If the uptime reaches back to before the image was installed, the device has not restarted onto it, whatever the boot setting says.

A capture shows what actually crossed one point in the network, so the question is always what arrived at the capture point and how the other end reacted. Captures come from Wireshark on a mirrored port or from Embedded Packet Capture on Cisco IOS XE devices; the summary lines look the same: time, source, destination, protocol and a description.

A host that is already sending unicast frames to an off-subnet destination has resolved its gateway's MAC address, because those frames are addressed to the gateway; ARP is not the problem there. Where you capture decides what you can conclude. A capture beside the server that shows SYNs arriving proves the forward path works; a capture at the client's port that shows only retransmissions proves the frames leave the client but says nothing yet about where they are lost.