How to Configure Microsoft LLDP Protocol Driver

Question

Windows 10 has activated the "MsLldp" Service on Network Adapters. This "MsLldp" Service sends LLDP Ethernet-Frames to managed Switches so that they show up in the LLDP Neighbors Table.

I like to get Information how to Configure this Service.

Default configuration is, that it only sends the MAC-Address of the Ethernet-Adapter as "LLDP Chassis Subtype". How to Configure this Service to send for example "System name" or "Port Description" Information ...?

Answer 1

Hello @Gunnar Haslinger ,

Unfortunately, using the registry to change the behaviour of Mslldp looks like a dead end.

This is what I have found: the driver always tries to read a REG_SZ value named ChassisId from the service's Parameters subkey; if this fails, the service reads the ComputerName value from the key HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName. The result of this process (i.e. either the ChassId or ComputerName value) is stored in a global variable which appears not to be used (apart from initialization and cleanup).

It is still possible that Mslldp is capable of more than we suspect (perhaps controlled via IOCTLs) but I doubt it.

Gary

Answer 2

Thanks @Gary Nebbett for the hint,

I already tried to:

1. disable the MSLLDP Service
2. reboot the machine with disabled MSLLDP Service
3. Start ProcMon and watch all registry-Access filtering Path "MsLldp"
4. Now with running ProcMon I start MSLLDP Service and wait for first LLDP Frames sent on network (Wireshark running to check this)
5. Check ProcMon if there are any interesting Registry-request like e.g. Service Parameters with suspicious Names which could be helpful

=> but no luck with this so far, didn't see anything worth to check in detail

Answer 3

Hello @Gunnar Haslinger ,

I can see one of the strings I mentioned earlier (ChassisId) being queried. What do you see?

Gary

Answer 4

Your Screenshot is very interesting @Gary Nebbett ,
seems you have some "Agents" registered.

I have no entries in "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp\Parameters\Agents" at all, this Key exists, but no SubKeys or Values there.
And of course I don't have this "ChassisId" entry nor can I see a request like this using ProcMon.

Answer 5

Thanks @Gary Nebbett for this instructions.

Can see the Request for "HKLM\System\CurrentControlSet\Services\MsLldp\Parameters\ChassisId" now.

Hint to myself: ProcMon Filter-Configuration: Remove Default Filter "System" to see Kernel-Activity! :-)