RSTP

Why it exists

Classic spanning tree makes a port wait through listening and learning before it forwards — thirty seconds by default. The delay is not caution about the port; it is caution about the rest of the network, which might not have finished agreeing.

RSTP replaces that wait with a conversation. A bridge proposes, its neighbour blocks anything that could loop and agrees, and the link forwards at once. The safety property is preserved by the neighbour’s guarantee rather than by elapsed time. IEEE 802.1Q-2022 §13.4

It is defined as a modification of spanning tree, not a replacement. The bridge identifier, the priority vector and the comparison order are all unchanged — which is why the two interoperate at all, and why the fallback is so seamless that it goes unnoticed. IEEE 802.1D-2004 §17.4

Asking permission instead of waiting

A new link forwards in milliseconds because the two bridges negotiate. The price is that the downstream bridge has to block everything else first.

How it works

The proposal and agreement handshake runs only on point-to-point links, which a bridge infers from full duplex. Before agreeing, the downstream bridge syncs: every non-edge designated port goes to discarding, which is its guarantee that nothing behind it can loop. IEEE 802.1D-2004 §17.10

Edge ports are exempt from sync. Declaring host-facing ports as edge is what stops the handshake briefly interrupting every host on the switch each time an uplink changes.

Port roles are named rather than implied. An alternate port is the next-best path to the root and is promoted immediately when the root port fails; a backup port is a second port onto a segment this bridge is already designated for, which on point-to-point media almost always means a cabling mistake. IEEE 802.1D-2004 §17.10

A topology change flushes the filtering database on every port except the one it arrived on, rather than shortening the ageing timer as classic spanning tree does. Faster, and much noisier — which is why an undeclared edge port is expensive.

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. A link takes thirty seconds to forward on a network that is supposed to be running RSTP.

   Narrow it down

   1. Capture a BPDU on the segment and read the protocol version — 0 is STP, 2 is RSTP.
   2. Check whether the neighbour runs RSTP at all.
   3. Look for a port still reporting the peer as an STP bridge after the peer was replaced.

   Cause

   One end fell back to compatibility mode. A bridge that hears a version 0 BPDU sends version 0 on that port from then on, and the fast handshake is unavailable wherever either end cannot do it.

   Fix

   Bring the neighbour to RSTP, then force protocol migration — the fallback is per port and latched, so it does not clear itself.

   IEEE 802.1D-2004 §17.4

2. A single access port going up or down causes a network-wide burst of flooding.

   Narrow it down

   1. Check the topology change counters and find which port originated the last change.
   2. Confirm whether that port is configured as an edge port.
   3. Correlate the flooding with the change rather than with traffic volume.

   Cause

   A non-edge port generates a topology change when it starts forwarding, and RSTP flushes MAC tables across the network rather than shortening an ageing timer. A laptop unplugging should not be able to do that.

   Fix

   Configure every host-facing port as an edge port, and pair it with BPDU guard so a switch plugged into one is shut down rather than believed.

3. Convergence is fast between some switches and slow between others, with no pattern.

   Narrow it down

   1. Check the link type each port has inferred: point-to-point or shared.
   2. Compare against the duplex setting on those interfaces.
   3. Look for a hub or a half-duplex link in the slow path.

   Cause

   The handshake only runs on a point-to-point link, and a bridge infers that from full duplex. A half-duplex link is treated as shared media and falls back to timers.

   Fix

   Fix the duplex, or set the link type explicitly. Auto-negotiation settling on half duplex degrades far more than spanning tree.

4. Two bridges keep proposing to each other and the link stays blocked, cycling rather than settling.

   Narrow it down

   1. Watch the proposal and agreement flags in the BPDUs on that link.
   2. Check whether either side has a stale or duplicated bridge identifier.
   3. Look for a unidirectional link — one side hearing nothing will keep proposing.

   Cause

   The handshake needs the downstream bridge to sync and reply. If the reply never arrives — a unidirectional fibre, a duplicate bridge identifier — the upstream keeps proposing and never gets agreement.

   Fix

   Check the optics and the bridge identifiers, and enable loop guard so a port that stops hearing BPDUs becomes inconsistent rather than deciding it may forward.

5. A port configured as an edge port starts behaving like a normal one — slow to forward, and generating topology changes.

   Narrow it down

   1. Check whether that port has received a BPDU.
   2. Look at what is plugged into it — a small switch, a virtualisation host bridging, a phone.
   3. Confirm whether BPDU guard is configured on it.

   Cause

   Edge status is a declaration that is revoked the moment a BPDU arrives, because something that sends BPDUs might create a loop. The revocation is correct and it is silent.

   Fix

   Add BPDU guard so the port is shut down instead of quietly demoted, which turns an invisible degradation into an alert with a port number on it.

Design notes

Declare every host-facing port as an edge port and pair it with BPDU guard. Without the declaration, a laptop being unplugged generates a topology change that flushes MAC tables across the network; without the guard, anything that sends a BPDU can silently revoke the declaration.

Enable loop guard on inter-switch links. RSTP promotes an alternate port as soon as BPDUs stop arriving, which is exactly the wrong response to a unidirectional link — and the speed that makes RSTP good makes this failure faster too.

Fix duplex mismatches before blaming spanning tree. A half-duplex link is inferred to be shared media, the handshake will not run on it, and everything falls back to timers — a symptom far downstream of a negotiation problem.

After replacing a legacy switch, force protocol migration on the ports that faced it. The compatibility fallback is latched per port, so the symptom outlives the cause and gets rediscovered much later by someone with no reason to connect the two. IEEE 802.1D-2004 §17.4

Misconceptions

“RSTP is a different protocol from STP.”

It is defined as a modification of it. Port roles, the priority vector and the comparison order are unchanged; what changed is that a port can be granted forwarding by an explicit handshake instead of waiting out two timers, and that the backup path is named in advance. IEEE 802.1D-2004 §17.4

“RSTP removed the forward delay timer.”

The timer still exists and still applies wherever the handshake cannot run — a shared-media link, or a neighbour that has fallen back to STP. Fast convergence is the common case, not a guarantee.

“A topology change in RSTP behaves like one in STP.”

It is more aggressive. STP shortens the filtering database ageing time; RSTP flushes entries outright on all ports except the one that received the change. That is why an undeclared edge port causes visibly more disruption under RSTP.

“Alternate and backup are two words for a blocked port.”

An alternate port is the next-best path to the root and exists on any redundant topology. A backup port is a second port of the same bridge onto one segment, which needs shared media to happen at all — so on a modern network its appearance is a cabling mistake worth investigating. IEEE 802.1D-2004 §17.10

More walkthroughs

Terms

Root port

The single port on a non-root bridge with the lowest-cost path to the root. Every non-root bridge has exactly one.

Designated port

The one port on each segment that forwards toward the root on that segment’s behalf. Every segment has exactly one.

Proposal/agreement

RSTP handshake on a point-to-point designated port. A Proposal bit asks the neighbor to agree; Agreement lets the port skip listening/learning timers.

Alternate port

A port with a path to the root that is not the best one, held discarding and ready to be promoted. Naming the backup in advance is where most of RSTP’s speed comes from.

Edge port

A port declared to face a host, so it forwards immediately and is skipped by the sync procedure. The declaration is revoked silently the moment a BPDU arrives, which is what BPDU guard turns into an alert.

Check yourself

• An RSTP bridge receives a version 0 BPDU on a port. What happens?

  • It discards the BPDU as malformed
  • It falls back to STP on that port and loses fast convergence there
  • It converts the neighbour to RSTP
  • It blocks the port
• Why does the proposal and agreement handshake not run on a half-duplex link?

  • Half duplex is too slow
  • The bridge infers shared media from half duplex, and the handshake requires point-to-point
  • BPDUs cannot be sent at half duplex
  • It does run; duplex is irrelevant
• What does an RSTP topology change do to the filtering database?

  • Shortens the ageing time to the forward delay, as in STP
  • Flushes entries on all ports except the one that received the change
  • Nothing; only the root reacts
  • Doubles the ageing time
• What is an alternate port?

  • A second root port used for load sharing
  • A port with a path to the root that is not the best one, held ready to take over
  • A port facing a host
  • A blocked port on a shared segment
• What must a bridge do before it may send an agreement?

  • Wait one forward delay
  • Sync — move every non-edge designated port to discarding, guaranteeing nothing behind it can loop
  • Elect a new root
  • Flush its MAC table
• You find a backup port on a modern switched network. What does it suggest?

  • Normal redundancy
  • Two ports of one bridge landed on the same segment — usually a cabling mistake
  • The root bridge has changed
  • A duplex mismatch
• How long does an RSTP bridge wait before declaring a silent neighbour gone?

  • Twenty seconds, the max age
  • Three missed hellos, about six seconds
  • One forward delay
  • It never does; it waits for link down
• A port configured as an edge port receives a BPDU. What happens by default?

  • The BPDU is ignored because the port is edge
  • The port stops being an edge port and starts participating normally — silently
  • The port is disabled
  • The bridge re-elects the root

Related

• STP

  Keeps a switched network free of loops by disabling just enough ports to leave one active path between any two bridges.

• MSTP

  Maps many VLANs onto a handful of spanning trees, and decides who shares a topology by hashing the mapping rather than by trusting the configuration to match.

• PVST+

  One spanning-tree instance per VLAN — Cisco’s way to load-share uplinks where IEEE STP/RSTP would keep a single tree.