Does anyone know that how does AP find it's neighbor?
What does NDP do? Is that possible to find it from capture?
NDP (Neighbor Discovery Protocol) is a specificCisco OTA (Over the Air) mechanism available in some versions of their RRM (Radio Resource Management) facility. They make it sound like this is "completely" detached from other network based discovery methods.
Personally, I have never been impressed with RRM. Regardless of the marketing blather, It still requires manual intervention to adjust it's behavior. It is not a panacea for ignorant planners or admins.
See the following link for more details
thank you so much!
You're very welcome.
There is also CDP, (Cisco Discovery Protocol). I think it might be restricted to the same broadcast Domain. I first ran across it on Ethernet links. It's probably more prevalent than NDP. However, some network admins have disabled CDP in the belief that it is a security hole.
Whether or not it's a weakness is debatable, but then many protocols get disabled due to security weaknesses, and others because they use up bandwidth. In my QA Lab environment, it helped to leave such things enabled - unless I was specifically testing for maximum throughput.