STP

Why it exists

An Ethernet frame carries no hop count. Nothing in it decays, and a bridge that does not know where a destination lives floods the frame everywhere except the port it arrived on. Put those two facts together on a network with a redundant path and a single broadcast circulates indefinitely, multiplying at every junction until the switches stop forwarding anything at all.

The obvious fix — do not cable loops — is the wrong fix, because the loop is the redundancy. Spanning tree keeps the physical loop and disables just enough ports to leave exactly one active path between any two bridges, then re-enables them when something fails. IEEE 802.1D-2004 §17.1

A broadcast storm is not a slow network. Forwarding collapses within seconds and the switches usually become unmanageable, because the CPU is drowning in the same flood.

Electing a root and blocking the loop

Three switches with default settings converge on a loop-free topology in about thirty seconds. Both tiebreaks run.

How it works

Every bridge has an identifier: a 16-bit priority followed by its MAC address. The bridge with the numerically lowest identifier becomes the root, and every other bridge measures itself by its cost back to that root. IEEE 802.1D-2004 §9.2.5

Bridges exchange that view in configuration BPDUs, and compare what they hear in a fixed order: root identifier, then root path cost, then the sending bridge’s identifier, then the sending port’s identifier. The first field that differs settles the comparison; the rest are never consulted. IEEE 802.1D-2004 §17.6

Roles follow from those comparisons. Each non-root bridge picks one root port — its best path to the root. Each segment picks one designated port — the end advertising the superior vector. Any port that is neither blocks, and blocking exactly those ports is what removes the loops. IEEE 802.1D-2004 §17.7

Nothing forwards immediately. A port that will forward first spends 15 seconds listening, then 15 seconds learning, because a bridge that forwarded on the strength of information the rest of the network had not yet received could create the loop it was trying to prevent. IEEE 802.1D-2004 §17.14

Try it

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. Traffic between two distribution switches takes an odd path through an access switch, and throughput is far below the link speed.

   Narrow it down

   1. Run `show spanning-tree vlan <id>` on a distribution switch and read the root ID.
   2. Compare it to the local bridge ID. If the root is a switch you did not choose, the election fell through to MAC address.
   3. Trace the root port on each switch to see the path traffic is actually taking.

   Cause

   Every switch is at the default priority of 32768, so the lowest MAC address won. That is usually the oldest switch, which is usually at the edge.

   Fix

   Set the intended root to a lower priority (24576 or 4096) and the intended backup one step above it. Never rely on the address.

   IEEE 802.1D-2004 §9.2.5

2. A host plugged into an access port cannot reach anything for about thirty seconds after link-up, and DHCP fails on boot.

   Narrow it down

   1. Watch the port state with `show spanning-tree interface <port> detail` immediately after link-up.
   2. Confirm it passes through listening and learning before forwarding.
   3. Check whether PortFast (edge port) is configured.

   Cause

   The port is running the full state machine. Two forward delays elapse before it forwards, and the DHCP client gives up first.

   Fix

   Configure the port as an edge port (`spanning-tree portfast`, `edge-port`, or the platform equivalent) so it forwards immediately, and pair it with BPDU Guard so a switch plugged in there is shut down rather than trusted.

   IEEE 802.1D-2004 §17.14

3. A link failure takes the better part of a minute to recover, even though the interface went down instantly.

   Narrow it down

   1. Establish which port was blocking before the failure.
   2. Confirm that port had to wait for Max Age before it could act.
   3. Add the two forward delays that follow.

   Cause

   A blocked port holds recorded information until Max Age expires. Twenty seconds of ageing plus fifteen listening plus fifteen learning is fifty seconds.

   Fix

   Run RSTP. An alternate port already knows it is the backup and takes over through a proposal and agreement handshake rather than a timer.

   IEEE 802.1D-2004 §17.14

4. A loop appears on a fibre link that both sides report as up, and the network floods without any obvious topology change.

   Narrow it down

   1. Look for a port that has moved from blocking to forwarding with no corresponding topology change.
   2. Check both ends: one side is receiving BPDUs and the other is not.
   3. Inspect the optics and patching for a broken transmit strand.

   Cause

   The link passes traffic one way only. The end that hears nothing ages out its information, decides it should be designated, and starts forwarding — into a loop the other end still believes is blocked.

   Fix

   Enable Loop Guard on the blocking side, or UDLD, so a port that stops receiving BPDUs enters an inconsistent state instead of assuming it may forward.

   IEEE 802.1D-2004 §17.7

5. The root changes unexpectedly and the whole network reconverges, traced to a desk port.

   Narrow it down

   1. Check the topology change counters with `show spanning-tree vlan <id> detail`.
   2. Identify the port that reported the last topology change.
   3. Look at what is plugged into it.

   Cause

   Someone attached a small unmanaged or cheap managed switch that sent a BPDU with a low bridge ID, and the network believed it.

   Fix

   Enable BPDU Guard on every edge port so a BPDU shuts the port down, and Root Guard on ports facing other switches that must never become root.

6. Every topology change is followed by a burst of unicast flooding for around fifteen seconds.

   Narrow it down

   1. Correlate the flooding with topology change notifications.
   2. Confirm the Topology Change flag is set in the BPDUs during the burst.
   3. Check the filtering database ageing time in use.

   Cause

   This is by design, not a fault. While the Topology Change flag is set, bridges age the filtering database using the forward delay rather than the normal 300 seconds, so learned addresses disappear and traffic to them is flooded until it is relearned.

   Fix

   Reduce how often topology changes happen: make edge ports edge ports, so a laptop unplugging does not generate one.

   IEEE 802.1D-2004 §17.19

Design notes

Set the root deliberately. Left alone, every switch keeps the default priority of 32768 and the election falls through to the MAC address, which reliably elects the oldest switch in the building — often an access switch at the edge, which then carries traffic it was never sized for.

The default timers assume a network diameter of seven bridges. Message Age increments at each hop and the BPDU is discarded at Max Age, so a network deeper than that loses information before it propagates. Tune diameter rather than the individual timers; vendors expose a diameter knob that derives a consistent set. IEEE 802.1D-2004 §17.14

Classic 802.1D is worth understanding and is not worth deploying. RSTP replaces the timer wait with an explicit handshake and recovers in well under a second; every platform here runs a rapid variant by default. Learn 802.1D because RSTP is defined as a modification of it, and because the failure modes are identical.

Misconceptions

“The switch with the lowest MAC address becomes root.”

Only when priorities are equal. The bridge identifier is compared as a whole, priority first. The MAC decides so often simply because nobody changed the priority from 32768. IEEE 802.1D-2004 §9.2.5

“A blocked port is disabled.”

A blocked port still receives and processes BPDUs. That is the entire point: it is listening for the moment it needs to take over. A disabled port hears nothing and can never take over. IEEE 802.1D-2004 §17.7

“Setting hello and forward delay on a switch changes how that switch behaves.”

Non-root bridges use the timer values carried in the root’s BPDUs, not their own. Configuring timers on a switch that is not root has no effect until it becomes root — which makes the setting look like it worked right up until it matters. IEEE 802.1D-2004 §17.14

“A port configured with priority 128 carries 128 in the BPDU.”

The 802.1D-2004 port identifier gives priority only four bits and holds it in steps of 16, so 128 encodes as 8. The CLI shows the configured value and the wire shows the encoded one; both are correct. IEEE 802.1D-2004 §9.2.7

“Path cost is derived from bandwidth, so it is the same everywhere.”

There are two recommended tables. The 16-bit values from 802.1D-1998 make 100 Mb/s cost 19; the 32-bit values from 802.1D-2004 make it 200,000. Many platforms still default to the short table, so two vendors can compute different costs for the same link until one is told otherwise. IEEE 802.1D-2004 §17.14

More walkthroughs

Terms

Bridge identifier

Eight octets identifying a bridge: a settable 16-bit priority followed by the 48-bit bridge address. Compared as a single number, priority first.

Root bridge

The bridge with the lowest bridge identifier. Every path in the active topology is measured as a cost back to it, and all of its ports are designated.

Root port

The single port on a non-root bridge with the lowest-cost path to the root. Every non-root bridge has exactly one.

Designated port

The one port on each segment that forwards toward the root on that segment’s behalf. Every segment has exactly one.

Path cost

The cost of reaching the root, accumulated on receiving ports. Two recommended tables exist: 16-bit values from 802.1D-1998 and 32-bit values from 802.1D-2004.

BPDU

Bridge protocol data unit. The 35-octet message bridges exchange to agree on the active topology, sent to the Bridge Group Address 01:80:C2:00:00:00.

Check yourself

• Three switches all have bridge priority 32768. SW1 is 00:1a:2b:00:00:01, SW2 is …:02, SW3 is …:03. Which becomes root?

  • SW1
  • SW2
  • SW3
  • The one that booted first
• What does a blocked (alternate) port do with a BPDU it receives?

  • Discards it without processing, since the port is blocked
  • Processes it, so it can take over if the active path fails
  • Forwards it out its other ports
  • Returns it to the sender as an acknowledgment
• You set forward delay to 4 seconds on an access switch that is not the root. What changes?

  • That switch transitions ports in 8 seconds instead of 30
  • The whole network transitions faster
  • Nothing, until that switch becomes root
  • The switch rejects the configuration
• A blocked port must take over after a link failure elsewhere. With default timers, how long before it forwards?

  • 15 seconds
  • 30 seconds
  • 50 seconds
  • Under a second
• A port is configured with priority 128. What value appears in the BPDU?

  • 128
  • 8
  • 0x80
  • 32768
• Traffic between two distribution switches is crossing two access switches, even though a direct 10 Gb/s link exists and is up. What is the most likely cause?

  • The 10 Gb/s link has a duplex mismatch
  • An access switch won the root election, so the direct link has no role and blocks
  • The distribution switches are in different VLANs
  • Path cost is misconfigured on the 10 Gb/s link
• What does a Topology Change Notification BPDU tell the root?

  • Which port changed state
  • The new active topology
  • Only that something changed
  • The MAC addresses that need to be relearned
• Two switches from different vendors compute different costs for the same 100 Mb/s link. Why?

  • One of them is faulty
  • One uses the 16-bit cost table and the other the 32-bit table
  • Path cost depends on the negotiated duplex
  • Cost is randomised to break ties

Related

• VLANs

  Splits one physical switched network into several independent broadcast domains, and carries them over a shared link with a four-octet tag.