Decoding Cisco Discovery Protocol (CDP) packets

Submitted by Steven Kohrs on Thu, 11/03/2011 - 08:24.

This how-to enables you to filter network traffic for a single
packet of Cisco Discovery Protocol (CDP). The CDP packet
contains information about the switch port you are connected to,
and Wireshark and Ethereal will decode this information for you.

Wireshark is the name for the program formerly known as Ethereal.
We will be using tshark, the CLI version of Wireshark.
On older systems you may run "tethereal" with the same options
as shown below for tshark.

Choose an interface on which to capture traffic. You specify the
interface in tshark using the -i option and can provide either the numeric
interface from "tshark -D" or the named interface from "ip link show".

The -V option says to display the entire packet in verbose mode.
The -c 1 option says to exit after capturing one packet.

The -f parameter specifies the capture filter.

The following command thus captures and verbosely decodes a single CDP packet:

tshark -i any -V -c1 -f "ether[12:2] <= 1500 && ether[14:2] == 0xAAAA && ether[16:1] == 0x03 && ether[17:2] == 0x0000 && ether[19:1] == 0x0C && ether[20:2] == 0x2000"

Peruse the output for some very interesting information!