pfSense » pfSense Packages

Summary¶

The pfSense lldpd package advertises a 283-octet LLDP System Description TLV. IEEE 802.1AB System Description is limited to 255 octets. A connected switch rejects the LLDPDU with LEN_INVALID/FRAME_DROP and does not learn pfSense as an LLDP neighbor.

Replacing lldpd with the LADVD pfSense package on the same pfSense interface, cable, and switch port works immediately, which isolates the failure to the lldpd advertisement.

Environment¶

• pfSense Plus 26.03.1, amd64
• pfSense package: lldpd 0.9.13
• Installed daemon: lldpd-1.0.19_1

Steps to reproduce¶

1. Install and enable lldpd 0.9.13 on pfSense Plus 26.03.1.
2. Enable active LLDP on LAN/ix1 connected to the YuanLey switch.
3. Capture an outbound LLDP frame: tcpdump -eni ix1 -vvv -s0 ether proto 0x88cc
4. Observe that lldpd encodes a System Description TLV with length 283.
5. Observe that the switch logs LEN_INVALID followed by FRAME_DROP and does not create a neighbor entry.
6. Replace lldpd with LADVD without changing the interface, cable, or switch port.
7. Observe that the switch immediately learns the pfSense neighbor.

Sanitized tcpdump evidence¶

[time/source MAC redacted] > 01:80:c2:00:00:0e,
  ethertype LLDP (0x88cc), length 379: LLDP, length 365
    Port ID TLV (2), length 4
      Subtype Interface Name (5): ix1
    System Name TLV (5), length 10: [redacted]
    System Description TLV (6), length 283
      [pfSense/FreeBSD build string redacted]
    Management Address TLV (8), length 12
      [address redacted]
    End TLV (0), length 0

The full packet decodes cleanly; the offending field is 28 octets over the 255-octet System Description limit.

Switch log:

LLDP-5-LEN_INVALID: Received invalid length on port TenGigabitEthernet5
LLDP-0-FRAME_DROP: Drop invalid packet on port TenGigabitEthernet5

Expected result¶

lldpd should advertise a standards-compliant System Description no longer than 255 octets, and the connected switch should learn pfSense as an LLDP neighbor.

Actual result¶

lldpd advertises a 283-octet System Description. The switch rejects and drops each LLDPDU, records the length error, and never creates the neighbor entry.

Suggested resolution¶

Clamp/truncate the generated System Description to 255 octets before encoding the TLV, or provide a package setting for a compliant custom description. This appears to be upstream lldpd behavior inherited by the pfSense package, but it causes a reproducible interoperability and standards-compliance failure.