EtherChannel, CDP and LLDP: bundling links and finding your neighbours

Because spanning tree sees a loop and blocks one of the two ports, leaving the original capacity plus an idle standby.

• The blocked port only becomes useful after the active link fails.
• That failover also triggers a topology change and a burst of flooding.
• EtherChannel removes the loop by presenting both links as one interface, so nothing blocks.

The bundle's failover is also cleaner: losing a member changes capacity but not topology, so spanning tree never reconverges.

By hashing selected header fields and mapping the result to a member, so each conversation is pinned to one link.

• The hash can use source MAC, destination MAC, both, IP addresses, or transport ports.
• The same source and destination always produce the same result, preserving packet order.
• Load is only even if the chosen fields actually vary across the traffic.

Members ideally number a power of two, because the hash space is divided across them and three members give a 3:3:2 split.

Because member links have slightly different queueing delays, so packets of one flow would arrive out of order.

• A TCP receiver seeing out-of-order segments sends duplicate acknowledgements.
• Three duplicates trigger fast retransmit, so the sender retransmits data that was never lost.
• The result is a bundle that performs worse than a single link.

This is the same reason equal-cost multipath routing hashes per flow rather than per packet, even though at layer 3 there is no bundle involved.

Because a backup is one conversation between two hosts, and one conversation always uses one member link.

• The hash produces a single value for that source and destination pair.
• No load-balancing method splits a single flow across members.
• The fix is a faster link, or splitting the job into parallel streams between different addresses.

Some applications work around this deliberately by opening several connections from different source ports and using a port-based hash, which does then spread across members.

Active with active, and active with passive. Passive with passive does not.

• Active sends LACP packets and actively tries to form the bundle.
• Passive responds but never initiates, so two passive ends wait forever.
• The PAgP equivalents are desirable and auto, with the same pattern.

Active on both ends is the usual recommendation because it converges faster and neither end depends on the other to start.

No channel forms, and the static end bundles the links anyway while the other end treats them as independent — which is a loop.

• Mode on does not send or expect any negotiation packets.
• The active end never receives an answer, so it leaves its ports as individual links.
• Spanning tree may or may not block them in time, depending on timing and configuration.

This is exactly why static mode is discouraged: it removes the verification that would have caught the mismatch before any traffic flowed.

Speed, duplex, switching mode, allowed VLAN list, native VLAN, and whether the port is layer 2 or layer 3.

• A mismatch suspends the offending port rather than bringing down the whole bundle.
• The configuration must also match the corresponding ports on the far switch.
• Changes should be made on the port-channel interface so they propagate to all members.

Configuring the physical ports identically before creating the channel, and afterwards only touching the logical interface, avoids essentially all of these faults.

The flags after the port-channel name give its state, and the flags after each member give that member's status.

• SU is a layer 2 channel in use, RU a layer 3 channel in use, SD a channel that is down.
• (P) means the port is bundled, (I) means stand-alone, (s) means suspended.
• Stand-alone usually means a negotiation mismatch; suspended usually means a configuration difference.

Reading both ends matters, because a port can be bundled locally while the far end has suspended its partner, which produces very confusing traffic behaviour.

The member ports are taken out of switching with no switchport before bundling, and the IP address goes on the port-channel interface.

• The bundle then behaves as a single routed interface with the combined bandwidth.
• It carries no VLANs, so allowed lists and native VLANs are irrelevant.
• It is the normal way to join layer 3 switches in a routed campus core.

Because it is routed, spanning tree is not involved at all, which removes an entire category of failure from the core of the network.

The neighbour's device name, platform, capabilities, management address, the port at its end, its software version and its native VLAN — advertised every 60 seconds and held for 180.

• show cdp neighbors detail gives all of it for every port at once.
• It works with no IP addressing and no configuration.
• It also detects and logs native VLAN and duplex mismatches.

Walking a site with this one command is the fastest way to build an accurate topology diagram of a network nobody documented.

Because it advertises device model, software version and management address to anyone connected, with no authentication.

• A socket in a lobby or meeting room hands that information to any visitor.
• Software version in particular tells an attacker which vulnerabilities apply.
• no cdp enable disables it per port; no cdp run disables it globally.

The usual balance is to keep it on switch-to-switch links and phone ports, where it does real work, and turn it off everywhere facing users or other organisations.

CDP is Cisco proprietary and enabled by default; LLDP is the IEEE 802.1AB standard, works between vendors, and is disabled by default on Cisco devices.

• LLDP advertises every 30 seconds with a 120-second hold time, against CDP's 60 and 180.
• LLDP transmit and receive are configured separately, so both must be enabled.
• LLDP-MED is the extension covering voice VLAN, quality of service and power for endpoints.

In a mixed-vendor network LLDP is the only one that sees the whole topology, which is why monitoring tools ask for it to be enabled everywhere.

From the switch, over CDP or LLDP-MED, once a voice VLAN is configured on the port.

• The switch advertises the voice VLAN ID and the phone begins tagging its traffic with it.
• The PC behind the phone keeps sending untagged frames, which land in the access VLAN.
• LLDP-MED also negotiates the exact Power over Ethernet allocation the phone needs.

This is why disabling both discovery protocols on a phone port breaks the phone even though the VLAN configuration is correct — the phone never learns what to tag with.

A bundle whose two ends terminate on two different physical switches that present themselves as one, so a device survives losing an entire switch.

• Cisco implements it as VSS or StackWise on Catalyst and vPC on Nexus.
• The attached device runs an ordinary LACP bundle and needs no special support.
• It removes the need for spanning tree to block a redundant uplink to a second switch.

It is the mechanism that made fully active-active campus and data centre designs practical, because before it, redundancy to two switches always meant a blocked link.

The load-balancing method, from a MAC-based hash to one based on IP addresses or transport ports.

• Every frame heading to the router has the router's MAC as its destination, so a MAC hash produces almost no variation.
• port-channel load-balance src-dst-ip uses the addresses that do vary.
• If only a few hosts are involved, a port-based hash spreads their individual connections.

The load-balance setting is global on most platforms rather than per channel, so changing it affects every bundle on the switch and is worth checking before applying.