cdp VoIP VLAN Reply and Query

Unanswered Question
Oct 9th, 2009


I was doing some sniffing of phone and switch packets being send using various vlan option (vvid, untagged, none, dot1p). Looking at the CDP exchanged I noticed that when using the untagged option (switchport voice vlan untagged) the switch sends VOIP VLAN Reply 4095 (reserved vlan) while the phone sends out VOIP VLAN Query 512 (then 2130). Why does the switch tell the phone to use 802.1q vlan tag 4095 and what is the Query 512 and 2130 coming from the phone?

During my traffic captures i didn't see the phone traffic being tagged in either vlan 4095 or 512. Could this be a driver issue sniffing it? I did see traffic using the VVID option with the vlan set there encapsulated with 802.1q tags so I don't think it is.

Any ideas?

Thank you,


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
Giuseppe Larosa Sat, 10/10/2009 - 02:49

Hello Tom,

you have made a nice job with these packet captures.

However, you are digging into low level details:

the exact specification of how CDP (Cisco proprietary) frames are used to allow communication between switch and Cisco IP phone is not available as far as I know.

We can guess that a Vlan field exists in the CDP frame and that the switch puts in it the right vlan-id when using voice vlan and then has to use special values to indicate other options.

For example I had read that also reserved vlan0 can be used in the case of 802.1p encapulation in the vlan-id of the 802.1Q header that needs to be used.

You say that when using untagged you see vlan field = 4095 in message from switch to phone.

This is possible and can be the way to say use untagged option.

All depends on how information is encoded if no flags bits are available and you have only vlan-id field using reserved values to indicate other possible encapsulations is reasonable.

For example, in MPLS LDP there is the so called implicit null label, but this is sent as a specific reserved value (3) in the label field of LDP message.

Hope to help



This Discussion