flowscope/cdp/mod.rs
1//! CDP (Cisco Discovery Protocol) parser.
2//!
3//! Gated by the `cdp` feature. CDP is the Cisco-proprietary
4//! L2 discovery protocol — the LLDP sibling for environments
5//! with Cisco gear. Operationally identical signal (asset /
6//! rogue-switch / topology visibility), but wire-format-wise
7//! completely different:
8//!
9//! - LLDP: EtherType 0x88cc, 7-bit-type / 9-bit-length TLVs.
10//! - CDP: LLC+SNAP-encapsulated 802.3 frame, dst MAC
11//! `01:00:0c:cc:cc:cc`, OUI `00:00:0C`, PID `0x2000`,
12//! 16-bit type / 16-bit length TLVs.
13//!
14//! # Operational signals
15//!
16//! - **Asset discovery on Cisco infrastructure**: Device-ID,
17//! Platform, Software-Version, Capabilities, Mgmt-Address.
18//! - **Topology mapping**: Port-ID + Device-ID identifies the
19//! peer port of the directly-connected switch.
20//! - **Rogue-switch detection**: a CDPDU on a port where one
21//! isn't expected (or a Device-ID that doesn't match the
22//! asset register) is a high-confidence MITM signal.
23//!
24//! # Wire shape
25//!
26//! - [`parse`] — pure CDPDU payload (after the LLC+SNAP+OUI+PID
27//! header). Use when the consumer has already validated the
28//! encapsulation.
29//! - [`parse_frame`] — full Ethernet frame; validates the
30//! reserved Cisco multicast dst MAC + LLC + SNAP + OUI + PID
31//! sequence.
32//! - [`CdpParser`] — stateless marker.
33//!
34//! Issue #25 (0.18).
35
36mod parser;
37mod types;
38
39pub use parser::{CDP_DST_MAC, CDP_OUI, CDP_PID, CdpParser, ParseError, parse, parse_frame};
40pub use types::{CdpAddress, CdpCapabilities, CdpMessage};