Spanning Tree Protocol

Why Layer-2 loops are dangerous

Ethernet frames do not have a hop-count field like IP TTL. A physical Layer-2 loop can therefore cause broadcast storms, repeated frames and rapid MAC-table instability.

Spanning Tree Protocol builds a loop-free logical topology while preserving redundant physical links that can become active after a failure.

Root bridge election

The switch with the lowest Bridge ID becomes root. Bridge ID selection considers configured bridge priority and then MAC-related identifier values. Engineers should deliberately place the root and secondary root instead of leaving the outcome to default values.

Design point: Root placement should align with Layer-3 gateways and traffic paths. An accidental access-switch root can create inefficient forwarding.

RSTP port roles and states

Role / state	Meaning
Root port	Best path from a non-root switch toward the root bridge.
Designated port	Best forwarding port for a network segment.
Alternate port	Backup path toward the root; can rapidly replace the root port.
Backup port	Backup for a designated port on the same shared segment; uncommon in modern switched designs.
Discarding	Does not forward user frames or learn MAC addresses.
Learning	Learns MAC addresses but does not yet forward user frames.
Forwarding	Learns and forwards user traffic.

BPDUs and convergence

Switches exchange Bridge Protocol Data Units to elect the root and calculate roles. RSTP improves convergence by using explicit proposal/agreement behaviour and alternate ports rather than relying only on long timers.

Important protection features

Feature	Purpose
PortFast / edge port	Moves an endpoint-facing port to forwarding quickly; should not be used blindly on switch links.
BPDU Guard	Disables or protects an edge port if BPDUs appear, preventing an unexpected switch from influencing topology.
Root Guard	Prevents a port from accepting a superior root claim.
Loop Guard	Helps prevent a blocked/alternate port from incorrectly forwarding when expected BPDUs stop.
UDLD or link monitoring	Detects certain unidirectional-link failures; vendor/platform dependent.

Configuration and verification

Cisco IOS-style example

spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
!
interface range GigabitEthernet1/0/1-24
 spanning-tree portfast
 spanning-tree bpduguard enable
!
show spanning-tree root
show spanning-tree vlan 10
show spanning-tree inconsistentports

Troubleshooting method

Identify the intended root and the actual root.
Check topology-change frequency and MAC flapping.
Trace root ports and designated ports hop by hop.
Check blocked/inconsistent ports and protection events.
Inspect physical redundancy, EtherChannel consistency and unidirectional links.
Do not “fix” a loop by disabling STP; correct the design or misconfiguration.

Quick self-check

1. Why can an Ethernet loop persist?

Answer: Frames do not have an IP-style TTL at Layer 2.

2. Which switch becomes root?

Answer: The switch with the lowest Bridge ID.

3. What is the root port?

Answer: A non-root switch’s best path toward the root bridge.

4. What should protect endpoint PortFast ports from an unexpected switch?

Answer: BPDU Guard.

5. What are the main RSTP states?

Answer: Discarding, Learning and Forwarding.

Frequently asked questions

1. Does STP block an entire switch?

Answer: No. It assigns roles and states to ports to create a loop-free logical topology.

2. Can EtherChannel prevent STP?

Answer: An EtherChannel appears as one logical link to STP when configured consistently, but STP still operates and protects the broader topology.

3. What is MAC flapping?

Answer: The same MAC address is learned repeatedly on different ports, often indicating a loop or topology problem.

Standards and further reading

Editorial note: Vendor commands and best-path tie-breakers can differ by platform and software release. Always verify production configuration against the device vendor documentation.