CDP(1)

✨ NAME ✨

cdp — bestie, it's literally a cdp packet generator 💖

---

🌸 SYNOPSIS 🌸

cdp -i <interface> [-v -n x -l x -c c -r] [-D <string> -P <string> -L
<string> -S <string> -F <ip address> -C <capabilities>]

okay so it's giving "one required thing, a whole buffet of optional ones" 🍓

---

💅 DESCRIPTION 💅

Okay so this page is the brief rundown of the cdp command — and ngl, this manual page was written for the Debian distribution because the original program didn't have a manual page at all. So Debian said "fine, I'll do it myself" 💀

CDP is a layer 2 protocol used by Cisco routers to discover each other on the same link (segment). It is not routed, so this tool is only useful in the local segment. No cap — if you're off-segment, it's not the moment.

CDP messages carry info about the sending Cisco router, and the list is honestly kind of a lot:

• the device ID (hostname)
• the port ID (which port was the sender)
• the platform running on
• the software incl. version
• what the box is capable of
• which network address (IP address) the interface has

If not configured otherwise, Cisco routers send these messages out every 30 seconds. In our case (ethernet), they are sent to a special MAC address — 01:00:0C:CC:CC:CC — and therefore are received from every Cisco router in the same segment. Other routers store the data and hold it for a time defined in the message (this tool uses the maximum of 255 seconds).

Very interesting is that Cisco IOS uses the device ID as the key to figure out whether the received message is an update and the neighbor is already known or not. But if the device ID is too long, this test seems to fail and you're constantly filling up the router's memory 😭 so that's a whole thing.

---

🦋 the two modi 🦋

🌊 Flood mode

Flood mode is used to send garbage CDP messages to the wire, which has different effects on the routers depending on their IOS version. It is not tested very well — which version of IOS reacts in which way on which kind of Cisco hardware, nobody fully knows. So if you come across something, please report it 🙏

Here's what we do know:

• IOS 11.1(1) was tested and the router could match even long device id's — but it rebooted after receiving three or four random device id names 💀
• Most other IOS versions just store the message and fill up the memory
• When you try to debug CDP events, all IOS we tested crashed and reboot

To use CDP, you have to specify the ethernet interface you'll be working on: -i eth0

Everything else is optional ✨

• -v — verbose
• -n x — send x packets
• -l x — length of the device id string. Keep in mind that the whole ethernet frame has to be smaller than 1514 bytes, so the maximum length is therefore 1480 for the device id (default is 1400)
• -c c — fills the device id with the char 'c' (default is 'A')
• -r — makes the device id a random string of characters, which leads to no matching on the receiver Cisco and to memory fillup or crash 🔥

Example:

cdp -i eth0 -n 10000 -l 1480 -r

Hint: if you want to flood the routers completely, start two processes of cdp with different sizes. One of them running on full size (1480) to fill up the major part of the memory, and another to fill up the rest with a length of 10 octets. Iconic combo move, fr fr 🫶

🎭 Spoofing mode

The second mode for CDP is spoofing. You can enable this mode with the command line option -m 1. It has no actual use for attacking a router, and it's mostly targeted for social engineering or just to confuse the local administrator 😈 It's used to send out 100% valid CDP information packets which look like they were generated by other Cisco routers. Here, you can specify any part of a CDP message yourself.

• -i <interface> — ethernet interface
• -v — verbose
• -D <string> — device id string
• -P <string> — port id string
• -L <string> — platform string
• -S <string> — software string
• -F <ip address> — ip address of the interface
• -C <capabilities> — the capabilities of the device you are claiming to be:
  • R - Router
  • T - Trans Bridge
  • B - Source Route Bridge
  • S - Switch
  • H - Host
  • I - IGMP
  • r - Repeater

Combine the letters to a string: RI means Router and IGMP 💡

Example:

cdp -v -i eth0 -m 1 -D 'Linuxfirewall' -P 'Ethernet0' -C R -L 'Intel'
-S "`uname -a`" \
      -F '10.1.1.1'

Which results on the cisco router in the following information:

cisco#sh cdp neig detail

-------------------------

Device ID: Linuxfirewall

Entry address(es):

IP address: 10.1.1.1

Platform: Intel,  Capabilities: Router

Interface: Ethernet0,  Port ID (outgoing port): Ethernet0

Holdtime : 238 sec

Version :

Linux vince 2.4.18-686 #1 Sun Apr 14 11:32:47 EST 2002 i686 unknown
unknown GNU/Linux

---

🫶 AUTHOR 🫶

This manual page was written by Vince Mulhollon <vlm@debian.org>, for the Debian GNU/Linux system (but may be used by others) 💖

---

and that's the whole page bestie!! this one's from January 1, 2003, part of the General Commands Manual, and it's the CDP(1) page — slay, go flood responsibly 💅✨🦋