question

Gunnar-Haslinger avatar image
0 Votes"
Gunnar-Haslinger asked GaryNebbett answered

How to Configure Microsoft LLDP Protocol Driver

Windows 10 has activated the "MsLldp" Service on Network Adapters. This "MsLldp" Service sends LLDP Ethernet-Frames to managed Switches so that they show up in the LLDP Neighbors Table.

I like to get Information how to Configure this Service.

Default configuration is, that it only sends the MAC-Address of the Ethernet-Adapter as "LLDP Chassis Subtype". How to Configure this Service to send for example "System name" or "Port Description" Information ...?

windows-10-network
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GaryNebbett avatar image
0 Votes"
GaryNebbett answered

Hello @gunnar-haslinger,

Unfortunately, using the registry to change the behaviour of Mslldp looks like a dead end.

This is what I have found: the driver always tries to read a REG_SZ value named ChassisId from the service's Parameters subkey; if this fails, the service reads the ComputerName value from the key HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName. The result of this process (i.e. either the ChassId or ComputerName value) is stored in a global variable which appears not to be used (apart from initialization and cleanup).

It is still possible that Mslldp is capable of more than we suspect (perhaps controlled via IOCTLs) but I doubt it.

Gary

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Gunnar-Haslinger avatar image
0 Votes"
Gunnar-Haslinger answered CandyLuo-MSFT commented

Thanks @GaryNebbett for this instructions.

Can see the Request for "HKLM\System\CurrentControlSet\Services\MsLldp\Parameters\ChassisId" now.

Hint to myself: ProcMon Filter-Configuration: Remove Default Filter "System" to see Kernel-Activity! :-)

· 5
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Please try to mark the replies which help you. It will encourage the person who help you.
Appreciate your understanding. :)

1 Vote 1 ·

@CandyLuo-MSFT there is only a possibility to press "thumbs up" / upvote on those replies which are comments. But almost all Answers given are "Answers" which I can only "upvote" by pressing "Accept Answer", they do not have a "thumbs up" button. But it seems I can only accept ONE answer, trying to mark more than one just leads to error "We're sorry, but this question already has an accepted answer."

0 Votes 0 ·

Yes, Q&A platform can only accept ONE answer. It doesn't matter, just choose the one you prefer as the answer. It will be very beneficial for other community members who have similar questions to find answers quickly.

Appreciate your understanding. :) Wish you a nice day!

1 Vote 1 ·
Show more comments
Gunnar-Haslinger avatar image
0 Votes"
Gunnar-Haslinger answered GaryNebbett commented

Your Screenshot is very interesting @GaryNebbett,
seems you have some "Agents" registered.

I have no entries in "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp\Parameters\Agents" at all, this Key exists, but no SubKeys or Values there.
And of course I don't have this "ChassisId" entry nor can I see a request like this using ProcMon.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @gunnar-haslinger,

I did not have the Agents subkey initially - in my first capture I could see "open" requests for that key, so I created the key (the GUID is a network interface GUID) and repeated the test.

A quick look at the binary code of mmlldp.sys suggests that the ComputerName registry entry is only requested if the ChassisId value has been successfully read. It will take some more effort to work out exactly what values are needed where and what impact that has on the behaviour of the service.

Gary

1 Vote 1 ·
GaryNebbett avatar image
0 Votes"
GaryNebbett answered

Hello @gunnar-haslinger,

I can see one of the strings I mentioned earlier (ChassisId) being queried. What do you see?

93363-image.png

Gary


image.png (261.2 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Gunnar-Haslinger avatar image
0 Votes"
Gunnar-Haslinger answered

Thanks @GaryNebbett for the hint,

I already tried to:
1. disable the MSLLDP Service
2. reboot the machine with disabled MSLLDP Service
3. Start ProcMon and watch all registry-Access filtering Path "MsLldp"
4. Now with running ProcMon I start MSLLDP Service and wait for first LLDP Frames sent on network (Wireshark running to check this)
5. Check ProcMon if there are any interesting Registry-request like e.g. Service Parameters with suspicious Names which could be helpful

=> but no luck with this so far, didn't see anything worth to check in detail






5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GaryNebbett avatar image
0 Votes"
GaryNebbett answered

Hello @gunnar-haslinger,

Just like Candy, I could not find any information on the web. However looking at the strings inside mslldp.sys and the debug symbols, it might be possible to send the computer name. The strings include:

ChassisId
ComputerName
Mslldp\Parameters
ComputerName\ComputerName
Mslldp\Parameters\Agents\%s-%u

The symbols include:

mslldp!lldpReadComputerName

It might take some trial and error or reverse engineering, but sending the computer name may well be possible...

Gary

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CandyLuo-MSFT avatar image
0 Votes"
CandyLuo-MSFT answered

Hi @gunnar-haslinger,

Since there are limited Microsoft documents talking about MSLLDP Service, I am not sure whether there is someplace in windows can configure this service to send for other Information.

If you want to get exact confirm, I would suggest you open a case with Microsoft where more in-depth investigation can be done so that you would get a more satisfying explanation and solution to this. Here is the link:

https://support.microsoft.com/en-us/gp/customer-service-phone-numbers

Appreciate your understanding. :)

Best Regards,
Candy


If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Gunnar-Haslinger avatar image
0 Votes"
Gunnar-Haslinger answered

Thanks for your pointer @CandyLuo-MSFT

I already tried WinLLDPservice as alternative which works fine, but sends wrong "System Capabilities / Auto Negotiation" (which is sent correct by MSLLDP).



If the only functionality of MSLLDP Service is to send the MAC-Address, why is this Service existing? MAC-Addresses could be even identified by Checking the SourceAddressTable of a switch, therefore no LLDP would be needed.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CandyLuo-MSFT avatar image
0 Votes"
CandyLuo-MSFT answered

Hi,

Based on my research, it seems that Microsoft LLDP can only send the MAC-Address to managed switch.

The similar thread has discussed before, you could have a look:

LDWin - Link Layer Discovery Client for Windows (LLDP/CDP)

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Best Regards,
Candy


If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.