3 Spanning Tree

How STP prevents loops

Switches exchange Bridge Protocol Data Units (BPDUs) and use their information to build a loop-free logical topology. Unneeded paths remain in a nonforwarding state, preventing Layer 2 loops and broadcast storms. If an active link fails, STP can recalculate and activate a redundant path.

Each STP instance elects one root bridge. Other switches choose a best path toward it, and each network segment selects a designated port to provide its active connection into the tree. In Per-VLAN STP modes such as PVST+, each VLAN has its own spanning-tree instance and can have a different topology.

Root bridge election

The root bridge is the switch with the lowest Bridge ID (BID) for that STP instance. A BID includes a configurable priority, the extended system ID (commonly the VLAN ID in per-VLAN STP), and a MAC address. STP compares the complete BID numerically: lower priority wins; if priorities tie, the lower MAC address wins.

It is usually best to choose the intended root and a backup deliberately rather than let the default election decide. On Cisco IOS/IOS XE, typical configuration commands are:

These commands are examples; confirm support and the resulting priorities on the switch platform in use. Verify the elected root rather than assuming the configuration made the switch root:

Look for the Root ID and compare it with the local Bridge ID. If they match, the local switch is the root for that instance.

Path selection and port roles

STP compares BPDU information to choose a preferred path. Path cost represents the cost of a link, and the path with the lower total cost to the root is preferred. If candidates tie, further comparisons, including bridge IDs and port IDs, break the tie. A path with fewer physical links is not necessarily preferred if its total STP cost is higher.

STP assigns each participating port a role describing its place in the topology:

• Root port: On a non-root switch, the single port with the best path toward the root bridge. The root bridge itself has no root port.

• Designated port: The forwarding port selected for a segment; it advertises the best path from that segment toward the root.

• Alternate port: A standby path toward the root, normally not forwarding. It can take over if the current root path fails.

• Backup port: A standby port for a segment where another port on the same switch already provides the designated connection. This role is uncommon in ordinary point-to-point Ethernet designs.

Root and designated ports normally forward traffic in a stable topology. Alternate and backup ports provide standby paths without creating a forwarding loop.

Port states and rapid STP

A port’s role and state describe different things: its role says what it does in the topology, while its state says whether it forwards frames and learns MAC addresses.

Traditional 802.1D STP uses these states:

• Blocking: Does not forward user frames or learn MAC addresses; prevents a loop while processing BPDUs.

• Listening: Does not forward user frames or learn MAC addresses; participates in STP while the topology is assessed.

• Learning: Does not forward user frames but learns MAC addresses, building the MAC address table before forwarding.

• Forwarding: Forwards user frames and learns MAC addresses; carries ordinary traffic and participates in STP.

• Disabled: Does not forward user frames or learn MAC addresses and does not participate in STP.

Rapid STP (RSTP, IEEE 802.1w) uses discarding, learning, and forwarding states. Discarding combines the nonforwarding behavior of the traditional disabled, blocking, and listening states. RSTP also uses alternate and backup roles and can move eligible ports to forwarding more quickly than traditional STP.

STP protection features

Protection settings should match the port’s purpose and topology. A wrong setting can block a legitimate link or leave a loop unprotected.

• PortFast / edge port: Intended for a host-facing port; it allows the port to enter forwarding promptly but does not disable STP. Do not use it on switch-to-switch links as a substitute for correct STP configuration.

• BPDU Guard: Commonly enabled on edge ports with PortFast. If a BPDU arrives, the switch disables the port, often placing it in an err-disabled state, to guard against an unexpected switch or loop on a host-facing connection.

• Root Guard: Use where a downstream switch must not become root. If superior BPDUs arrive, the port enters a root-inconsistent state rather than allowing the root to move to that side of the network.

• Loop Guard: Helps prevent a blocked or alternate port from mistakenly transitioning to forwarding when expected BPDUs stop arriving. The affected port is held in a loop-inconsistent state until BPDUs resume.

BPDU Guard and PortFast are commonly paired on access ports connected to end devices. Root Guard is more appropriate on a designated link toward a downstream switch where the local design must retain root placement. Check platform documentation and network policy before applying protection features.

Verification and troubleshooting

Start with the affected VLAN or STP instance, then inspect relevant interfaces. On Cisco switches, these commands are examples; exact syntax and output vary by vendor, software, and platform:

show spanning-tree vlan 10 typically displays the root ID, local bridge ID, root port, and interface roles and states. Interface detail and summary commands help identify BPDU counts, protection settings, and disabled ports.

Use this troubleshooting sequence:

1. Confirm the instance and intended root. Check that the VLAN exists and is carried across the expected links. Compare Root ID and Bridge ID on multiple switches.

2. Check the root port and cost. Confirm that the selected root port is the expected path. If it is not, compare configured priorities, path costs, and any tie-breaking information shown by the switch.

3. Inspect roles and states on the link. A redundant link may correctly be alternate or blocking. If an expected forwarding link is not forwarding, check its role, state, VLAN membership, and whether the link is physically up.

4. Check BPDU reception and protection states. A port in root-inconsistent or loop-inconsistent state points to Root Guard or Loop Guard behavior. An err-disabled port may have received a BPDU with BPDU Guard enabled; verify the cause before restoring it.

5. Look for instability. Repeated topology changes, changing root IDs, or changing root ports can indicate a flapping link, unexpected switch, inconsistent STP configuration, or missing BPDUs. Use detailed STP output and system logs to trace the affected interface.

6. Make one controlled change, then verify again. After correcting the cause, recheck the root, port roles and states, and topology-change behavior. Do not force a port into forwarding simply because its current state is inconvenient.

• Spanning Tree Protocol (STP)