I would like to put my router in a listen-only mode for CDP i.e. it should allow CDP packets to only arrive while not advertising so that I can glimpse into physical topology while remaining hidden to other nodes.

Currently neither I am unable to filter CDP packets per interface in egress direction with an access list as CDP runs on data link layer AFAIK nor suppress advertisements with a specific CDP command syntax.

  • CDP has no native ability to do this. EDITED to add: I can't think of a way to do this unless you're doing frame inspection inbetween this device and others. – Panther Modern May 22 '14 at 21:57
  • 1
    @dprogrammer, what platform(s) and IOS(s) do you need to do this on? – This May 22 '14 at 22:37
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 20:58

you can't do this on router level, if your device are Cisco switch you can apply mac access-list which will drop outgoing CDP packets, and because CDP use ARPA code (EtherType) 0x2000, mac access-list will contain: access-list 10 deny 0x2000

  • Wow, that's interesting! Is this used exclusively for CDP, or do I risk blocking something else? Where did you come across this info? – user6169 Jun 20 '14 at 1:12
  • no this will block CDP only , you can block any Datalink protocol using mac acl and you can find more info here :cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0/… – Mr.lock Jun 21 '14 at 15:09

Your best option is likely to disable CDP on WAN ports and enable it on your management interfaces, otherwise there is not a listen only equivalent up to ios 15 on routers that I'm aware of.
See the following for step by step:

Router(config)# no cdp run
Router(config)# end
Router# show cdp
% CDP is not enabled
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# interface TenGigabitEthernet4/1
Router(config-if)# cdp enable

The above is sourced from: https://www.cisco.com/c/en/us/td/docs/optical/cpt/r9_5/command/reference/cpt95_cr/cpt95_cr_chapter_01101.pdf

  • I disagree on that. CDP is enabled by default at the global level and on each supported interface to send or receive CDP information. If CDP is disabled globally, you cannot enable it on each interface using the cdpenable interface configuration mode command. – Andrey Prokhorov Jan 13 '20 at 9:11
  • Hmm I recall that being the case on older IOS. However that list of commands is directly from a Cisco command reference. I have a few older routers at home I can test with at a later date but unfortunately my work consists entirely of Mikrotik routers these days... – Tmanok Jan 13 '20 at 17:37
  • This is still actual. If you will globally disable CDP then you will not be able to turn it on for specific interface: % Cannot enable CDP on this interface, since CDP is not running – Andrey Prokhorov Jan 14 '20 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.