US How LLDP works
LLDP (Link Layer Discovery Protocol) is a discovery protocol that lets a switch, router, computer, IP phone or camera tell the devices on the other end of each cable what it is. The IEEE standardized it as 802.1AB in 2005, as a vendor-neutral alternative to proprietary protocols such as Cisco Discovery Protocol (CDP).
Each LLDP-enabled port sends a small Ethernet frame at a fixed interval, every 30 seconds by default. The frame goes to a reserved multicast address that switches never forward, so it only reaches the directly connected neighbour. The receiving device stores the information in its LLDP neighbour table and keeps it for a time-to-live, 120 seconds by default, then deletes it if no new frame arrives.
LLDP only advertises. There is no request and no reply, and a device does not have to send in order to receive. Each port can be set to send, receive, both or neither.
What an LLDP frame contains
The information travels as a list of type-length-value fields, called TLVs. Four are mandatory and the rest are optional, so what a neighbour table shows depends on what each device chooses to send.
-
//
Mandatory fields. Chassis ID, usually a MAC address; port ID; time-to-live; and an end marker.
-
//
Basic optional fields. Port description, system name, system description (often model and firmware), system capabilities such as bridge, router or phone, and a management IP address.
-
//
IEEE 802.1 extensions. Port VLAN ID and VLAN names, useful for spotting a VLAN mismatch between two ends of a link.
-
//
IEEE 802.3 extensions. Speed and duplex settings, link aggregation status, maximum frame size and power via MDI, which PoE devices use to negotiate power.
LLDP neighbours and network mapping
The LLDP neighbour table is the practical payoff. A command such as “show lldp neighbors” on a switch, or the same view in its web interface, lists each port with the name, model, port and management address of whatever is plugged into it. That answers the most common commissioning question, which device is on which port, without tracing cables in a cabinet.
Network management software reads the same tables over SNMP, through the standard LLDP-MIB, and stitches them together into a live map. Our guide to network topology types shows the layouts such a map typically reveals. LLDP also feeds PoE: under IEEE 802.3at and 802.3bt, a powered device can use LLDP to request a precise power level from the switch after the initial hardware classification, explained in our introduction to Power over Ethernet.
LLDP vs CDP vs LLDP-MED
LLDP has a proprietary predecessor and a standard extension. Many switches run more than one, and they can coexist on the same port.
| Protocol | Defined by | Sent every / held for | What it adds | Typical use |
|---|---|---|---|---|
| LLDP | IEEE 802.1AB | 30 s / 120 s by default | Identity, capabilities, VLAN, link and PoE details | Multi-vendor switches, servers and industrial devices |
| CDP | Cisco (proprietary) | 60 s / 180 s by default | Similar identity details plus Cisco-specific fields | All-Cisco networks and Cisco IP phones |
| LLDP-MED | ANSI/TIA-1057 | As LLDP, faster at start-up | Voice VLAN and priority policy, location, extended PoE, inventory | IP phones, PoE endpoints and media devices |
Troubleshooting with LLDP
Because both ends of a link describe themselves, LLDP turns several common faults into a quick table check.
-
//
Finding a device. Locate the switch port for a camera, HMI or controller from its name or MAC address, then trace it back to the cabinet drawing.
-
//
Checking cabling against the design. Compare the neighbour table with the network drawing after installation to catch crossed or missing patch leads.
-
//
Spotting a VLAN mismatch. If the two ends of a link report different port VLAN IDs, traffic will not pass as intended.
-
//
Catching speed and frame-size mismatches. The IEEE 802.3 fields show each end’s speed, duplex and maximum frame size, which explains many slow or dropped links.
LLDP in industrial networks
On a plant network LLDP is more than a convenience. PROFINET uses LLDP to learn the neighbourhood of each device, which supports topology diagnostics and lets a failed device be swapped for a new one and recognized by its position in the network, without reconfiguring it from an engineering laptop. Network monitoring tools for operational technology use the same data to detect an unexpected device appearing on a port.
Many of our managed industrial switches list LLDP among their management features, and some also list LLDP-MED. The one caution is security. LLDP tells anyone connected to a port the model, firmware version and management address of the switch, so the usual hardening practice, in line with the IT and OT security split, is to keep it on between trusted infrastructure devices and turn it off on ports that face untrusted networks or public areas.
Quick answers on LLDP
LLDP: common questions
What does LLDP stand for?
Link Layer Discovery Protocol. It is the IEEE 802.1AB protocol that network devices use to advertise their identity to directly connected neighbours.
What is an LLDP neighbor?
The device at the other end of a link. Each LLDP neighbour entry shows the connected device’s name, port, capabilities and management address, as learned from its last LLDP frame.
Is LLDP better than CDP?
It is more widely supported. LLDP works across vendors, while CDP is Cisco’s own. Mixed networks normally run LLDP, and Cisco switches support both.
Should LLDP be enabled or disabled?
Enabled on trusted links, disabled on exposed ports. It is valuable for troubleshooting and PoE, but it reveals device details to anything plugged into the port.
What is the Microsoft LLDP protocol driver?
Windows support for LLDP. It lets a Windows computer receive, and on some versions send, LLDP frames, so management tools can see which switch port it is connected to.
We supply managed switches as part of complete edge and control systems, and as standard we enable LLDP where it helps commissioning and turn it off where it should not be exposed before the system ships.