Clear To Send: Wireless Network Engineering

Rowell Dionicio and François Vergès

Clear To Send: Wireless Network Engineering
33 MIN2018 JAN 8
Play Episode


In this episode, we go over the Cisco Neighbor Discovery Protocol. The basis of Cisco RRM.
This episode is sponsored by Metageek.

Cisco WLC Neighbor Discovery Protocol (NDP)
Cisco NDP, short for Neighbor Discovery Protocol and Neighbor Discovery Packets, is a critical component of Cisco’s auto RF feature, Radio Resource Management (RRM). The purpose of NDP is to provide over the air (OTA) messages between access points (AP). It monitors and manages what each AP sees in the radio frequency (RF). It’s essentially how every AP sees other APs in an RF Group or Neighborhood. The end result is actual RF path loss between APs.
I see NDP as a way for APs to build a map of their locations in relation to each other based on RF propagation and path losses. Every 180 seconds (3 minutes), an AP will send an over the air (OTA) message to a multicast address, 01:0B:85:00:00:00, from each channel.
NDP messages are sent at the highest transmit power and at the lowest data rate supported for the channel being transmitted on. The transmit power and data rate selection is not configurable by the end user and is hard coded.
Cisco Neighbor Discovery Protocol forms the basis of many algorithms within Cisco RRM. Because of that, it goes without saying, if NDP doesn’t work neither does RRM.
Learn more RRM from the white paper.
NDP is used by the following

* RF Grouping Algorithm
* Transmit Power Control (TPC – basis calculation for TPCv2)
* Flexible Radio Architecture (FRA – basis for coverage overlap factor)
* Rogue detection (If AP isn’t sending NDPs or unintelligible NDP then it is a rogue)
* CleanAir (Used for interference reports)
* CMX (For AP RF distance and path loss measurements)

As you can see, NDP is very important for RRM.
What’s inside a Cisco NDP Packet?

Field Name


Radio Identifier

Slot ID for the sending radio

Group ID

IP Address and Priority code of sends WLC


RF Group name converted to a hash for authentication

IP address

IP of sending AP’s RRM Group Leader

Encrypted ?

Are we using Encrypted NDP?


Version of NDP

APs Channel

Operating channel of the sending radio

Encryption Key Length

Encryption Key Name

Message Channel

Channel the NDP was sent on

Message Power

The power (in dBm) the message was sent at


Antenna pattern of the sending radio

When an AP hears and receives an NDP message, it will validate the message from the transmitting AP to determine if it is a member of the same RF group. If it’s a valid NDP, the receiving AP will forward the message to the controller along with information such as the received channel and RSSI.
If the message is not in the same RF group it will be invalid and the packet will be dropped.
The message is added to a neighbor database. Each radio on each AP can store up to 34 neighbors ordered by RSSI, high to low.
There are two measurements taken: