what are the netsh command line options to collect Cisco CDP neighbor information?

Bruce W 6

Bruce W 6 Reputation points

2022-03-01T20:23:11.927+00:00

Or any other way to collect CDP info without winpcap

2 answers

Bruce W 6 Reputation points

2022-03-02T15:04:40.263+00:00

Yes on a wired 802.3 connection. This will help us identify what switch and port that the device is connected to.

It would be a great help of MS collected the DCP and LLDP info and stored it in something like ipconfig. Also if they broadcasted the host name and on CDP and LLDP the network and security folks would jump for joy. This would save countless man hours of time tracking down PC's for troubleshooting and security incidents.
Please sign in to rate this answer.

1 person found this answer helpful.
Amit ak 1 Reputation point

2022-08-04T07:25:55.387+00:00

Hi Bruce,

Did you find the right syntax?
I am also looking for the same thing
Sign in to comment
Gary Nebbett 5,761 Reputation points

2022-03-02T12:01:30.667+00:00

Hello Bruce,

I am fairly sure that there is no "Microsoft provided" tool or API that will do this; there may be third party software.

"Packet capture" would probably be the easiest way to collect the information; there are Microsoft tools that can do this included in the basic operating system (pktmon and "netsh trace" being two examples).

If "without winpcap" is just a specific prejudice against that particular component, then npcap could also be a possibility...

Gary
Please sign in to rate this answer.
Bruce W 6 Reputation points

2022-03-02T13:49:58.32+00:00

Gary,
I should have worded the question differently.
I would like to gather the CDP information on the command line without adding any addition software. I was looking at netsh trace but could not find the correct syntax.

If you can point me in the right direction that would be great.

I know how display lldp and cdp with tshark:

tshark -i eth0 'multicast and (ether[12:2]=0x88cc or ether[20:2]=0x2000)'

Gary Nebbett 5,761 Reputation points

2022-03-02T14:56:40.407+00:00

Hello Bruce,

pktmon and "netsh trace" can capture LLDP and CDP packets, but they don't have any functionality that can display the captured data with protocol decoding.

Both commands can display help about their filter syntax:

netsh trace show CaptureFilterHelp

pktmon filter add help

The problem with MAC level filters is that they can be dependent on the media (e.g. 802.3 vs 802.11); accounting for the impact of SNAP (Subnetwork Access Protocol) on the position of the "ethertype" might also be tricky.

Are you just trying to capture the information on a wired (IEEE 802.3) connection? Is a command without meaningful formatting of the captured data useful or is that not enough?

Gary
Sign in to comment

Share via

what are the netsh command line options to collect Cisco CDP neighbor information?

2 answers