CDP spoofing

In computer networking, CDP spoofing is a technique employed to compromise the operation of network devices that use Cisco Discovery Protocol (CDP) for discovering neighboring devices. CDP spoofing is a network security threat that can be mitigated by taking precautionary measures. CDP was created by Cisco in 1994. Its original intent was to make it easier to find other devices on a network. CDP may be used between Cisco routers, switches and other network equipment to advertise their software version, capabilities and IP address. The two versions of CDP are CDPv1 and CDPv2: CDPv1 could discover basic information between networking devices. These devices were only able to receive information about a networking device that was directly connected to it. CDPv2 includes more utilities such as checking if errors were made while configuring two devices (e.g.; configuring mismatched native VLANs). CDP is enabled by default on all Cisco routers, switches and servers. The protocol can be disabled across a network; however, if it is disabled on an interface and the encapsulation is changed, it will be re-enabled on that interface. The protocol is most often used to aid network administrators by finding and discovering devices easier. When devices are discovered easier, it can help with certain network problems, device arrangement, network management and other networking tasks. Although these can be beneficial features, attackers can accumulate this information about the devices, which leaves the device's type, IP address and IOS version exposed and vulnerable. Attackers can use this information to mimic other devices, steal information and create other various network problems. Popeskic recommends disabling CDP on the entire device, rather than just the interfaces, to fully mitigate the threat of CDP Spoofing or attacks through CDP. Some suggest disabling CDP if it is not in use on the device or if it is not a necessity for the device. CDP will only function when a packet contains the Subnetwork Access Protocol (SNAP) header.