Skip to content

Spanning Tree Protocol (STP) Fundamentals

Why STP Exists

Redundant links between switches are good for resilience but deadly for Layer 2 without something managing them: a frame with no TTL (unlike IP packets) can loop forever between two switches with more than one path between them, and broadcasts get duplicated and amplified every time they cross a redundant link — a broadcast storm that can take down a network in seconds.

STP (802.1D) solves this by detecting the redundant paths and logically blocking them, leaving exactly one active path to any destination — while keeping the blocked links ready to activate automatically if the active path fails.

Root Bridge Election

Every STP domain elects one switch as the root bridge — the reference point every other switch calculates its best path toward.

  • Every switch has a Bridge ID: priority (default 32768) + MAC address
  • The switch with the lowest Bridge ID becomes root — lower priority wins first; MAC address is only the tiebreaker if priorities match
  • To deliberately control which switch becomes root (recommended — don't leave it to chance/MAC address), lower its priority:
spanning-tree vlan 10 root primary        ! Automatically sets a low-enough priority to win root
spanning-tree vlan 10 root secondary      ! Backup root, in case the primary fails

! Or set explicitly:
spanning-tree vlan 10 priority 4096

Port Roles

Role Meaning
Root port The one port on each non-root switch with the best (lowest-cost) path back to the root bridge
Designated port The port on each network segment responsible for forwarding traffic toward the root — usually the root bridge's own ports, or the least-cost path on a shared segment
Non-designated (blocking) port Any other port on a redundant path — logically blocked to prevent a loop, but still receiving BPDUs so it can react if the topology changes

Port States (802.1D Classic STP)

State What's happening
Blocking Not forwarding frames; still listening for BPDUs
Listening Preparing to forward; no MAC learning yet
Learning Building the MAC address table; still not forwarding
Forwarding Normal operation — forwarding frames and learning MACs

Classic 802.1D can take 30–50 seconds to move a port from blocking to forwarding after a topology change — painfully slow for modern networks, which is why Rapid STP (802.1w, RSTP) is the practical default today: it collapses the states to Discarding / Learning / Forwarding and converges in a few seconds using direct handshakes between switches instead of timers. Cisco switches typically run Rapid PVST+ (per-VLAN RSTP) by default on modern IOS.

BPDUs (Bridge Protocol Data Units)

Switches exchange BPDUs to elect the root, calculate path costs, and detect topology changes. This is exactly what BPDU Guard protects against — an access port is supposed to connect to an end device that has no business sending BPDUs, so if one shows up (a rogue or misconfigured switch plugged into an access port), BPDU Guard immediately disables the port rather than letting it participate in the spanning tree.

Useful Commands

show spanning-tree                  ! Overview: root bridge, port roles/states, per-VLAN
show spanning-tree vlan 10          ! Detail for a specific VLAN
show spanning-tree summary          ! Quick per-VLAN root/mode summary