{
  "port": 711,
  "protocol": "both",
  "service": "Cisco TDP",
  "oneLiner": "Cisco's pre-standard Tag Distribution Protocol, the ancestor of MPLS LDP on 646.",
  "whatItIs": "TDP is Cisco's proprietary label distribution protocol from before the IETF standardised LDP. Cisco's MPLS FAQ states plainly that \"LDP uses TCP port 646, and TDP uses TCP port 711\", and that the port only opens on an interface once `mpls ip` is configured; TDP hellos are sent to UDP 711. Routers use the TCP session to advertise label bindings to their TDP peers. Anything still speaking TDP instead of LDP is old IOS running a legacy MPLS core.",
  "exposure": {
    "verdict": "never",
    "note": "This is an MPLS control-plane session between trusted routers; reachable from outside the core it lets an attacker attempt to inject label bindings."
  },
  "checkCommand": "nmap -p 711 TARGET",
  "links": [
    {
      "title": "Cisco — MPLS FAQ For Beginners",
      "url": "https://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/mpls/4649-mpls-faq-4649.html",
      "kind": "official-docs"
    },
    {
      "title": "RFC 5036 — LDP Specification (the standardised successor)",
      "url": "https://www.rfc-editor.org/rfc/rfc5036.html",
      "kind": "spec"
    }
  ]
}