LLDP Advertisement Packet Capture

This packet capture contains one LLDP (Link Layer Discovery Protocol) frame from a Cisco switch. LLDP is the vendor-neutral alternative to CDP: every 30 seconds, each port tells its neighbor who the device is, which port this is, and what the device can do. Everything is in TLVs (type, length, value), one after the other.

Three TLVs are mandatory and always come first: chassis ID, port ID and TTL. The rest is optional, and that’s where the useful details are. The LLDP lesson covers the configuration. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The LLDP frame (packet 1)

I removed the capability bits that are “Not capable” to keep the output short.

Ethernet II, Src: aa:bb:cc:00:67:00 (aa:bb:cc:00:67:00), Dst: Nearest-Bridge (01:80:c2:00:00:0e)
    Destination: Nearest-Bridge (01:80:c2:00:00:0e)
    Source: aa:bb:cc:00:67:00 (aa:bb:cc:00:67:00)
    Type: 802.1 Link Layer Discovery Protocol (LLDP) (0x88cc)
Link Layer Discovery Protocol
    Chassis Subtype = MAC address, Id: aa:bb:cc:00:67:00
        0000 001. .... .... = TLV Type: Chassis Id (1)
        .... ...0 0000 0111 = TLV Length: 7
        Chassis Id Subtype: MAC address (4)
        Chassis Id: aa:bb:cc:00:67:00 (aa:bb:cc:00:67:00)
    Port Subtype = Interface name, Id: Et0/0
        0000 010. .... .... = TLV Type: Port Id (2)
        .... ...0 0000 0110 = TLV Length: 6
        Port Id Subtype: Interface name (5)
        Port Id: Et0/0
    Time To Live = 120 sec
        0000 011. .... .... = TLV Type: Time to Live (3)
        .... ...0 0000 0010 = TLV Length: 2
        Seconds: 120
    System Name = SW1
        0000 101. .... .... = TLV Type: System Name (5)
        .... ...0 0000 0011 = TLV Length: 3
        System Name: SW1
        0000 110. .... .... = TLV Type: System Description (6)
        .... ...0 1111 1111 = TLV Length: 255
        System Description […]: Cisco IOS Software [IOSXE], Linux Software (X86_64BI_LINUX_L2-ADVENTERPRISEK9-M), Version 17.18.2, RELEASE SOFTWARE (fc3)\nTechnical Support: http://www.cisco.com/techsupport\nCopyright (c) 1986-2025 by Cisco Syst
    Port Description = Ethernet0/0
        0000 100. .... .... = TLV Type: Port Description (4)
        .... ...0 0000 1011 = TLV Length: 11
        Port Description: Ethernet0/0
    Capabilities
        0000 111. .... .... = TLV Type: System Capabilities (7)
        .... ...0 0000 0100 = TLV Length: 4
        Capabilities: 0x0014
            .... .... .... .1.. = Bridge: Capable
            .... .... ...1 .... = Router: Capable
        Enabled Capabilities: 0x0014
            .... .... .... .1.. = Bridge: Capable
            .... .... ...1 .... = Router: Capable
    Management Address
        0001 000. .... .... = TLV Type: Management Address (8)
        .... ...0 0000 1100 = TLV Length: 12
        Address String Length: 5
        Address Subtype: IPv4 (1)
        Management Address: 192.168.12.1
        Interface Subtype: System port number (3)
        Interface Number: 7
        OID String Length: 0
    Ieee 802.3 - MAC/PHY Configuration/Status
        1111 111. .... .... = TLV Type: Organization Specific (127)
        .... ...0 0000 1001 = TLV Length: 9
        Organization Unique Code: 00:12:0f (Ieee 802.3)
        IEEE 802.3 Subtype: MAC/PHY Configuration/Status (0x01)
        Auto-Negotiation Support/Status: 0x03
            .... ...1 = Auto-Negotiation: Supported
            .... ..1. = Auto-Negotiation: Enabled
            .... .... .... ...1 = Other or unknown: Capable
        Operational MAU Type: other or unknown (0x0000)
    End of LLDPDU
        0000 000. .... .... = TLV Type: End of LLDPDU (0)
        .... ...0 0000 0000 = TLV Length: 0

Let’s walk through the highlighted fields:

• 01:80:c2:00:00:0e (Nearest-Bridge) and EtherType 0x88cc: switches don’t forward frames to this address. LLDP information only travels to the directly connected neighbor.
• Chassis ID, subtype MAC address: identifies the device. Cisco uses a MAC address of the switch.
• Port ID, subtype interface name: Et0/0: the port that sent the frame. Together with the chassis ID, this is what the neighbor shows in show lldp neighbors.
• Time To Live 120 seconds: how long the neighbor keeps this information without a new frame. The default is 4 × the 30-second timer. A TTL of 0 means “delete my information now”.
• System Name SW1 and System Description: the hostname and the full software version string, so you can see a neighbor’s IOS version without logging in. The description is 255 bytes long, so Wireshark truncates it in the output.
• Capabilities 0x0014: Bridge and Router, both supported and enabled. A Layer 3 switch reports both.
• Management Address 192.168.12.1: the address you can manage the device on, with the interface number it belongs to.
• IEEE 802.3 MAC/PHY Configuration/Status: an organization-specific TLV (type 127, OUI 00:12:0f) with the port’s auto-negotiation settings. Optional TLVs like this one (and LLDP-MED for IP phones) are where LLDP gets its extra details.