Upon completion of this tutorial, you should be able to:
In a switched network, redundancy is essential for reliability and fault tolerance. However, redundant links create loops that can devastate a network through broadcast storms, MAC table instability, and duplicate frames. The Spanning Tree Protocol (STP) solves this problem by dynamically identifying and blocking redundant paths, ensuring a loop-free topology while maintaining redundancy. This tutorial covers STP in depth, including its operation, port roles, states, timers, and convergence. We also explore Rapid Spanning Tree Protocol (RSTP), Multiple Spanning Tree Protocol (MSTP), and various STP enhancements and security features.
Redundant links are essential for network reliability, but they can create Layer 2 loops. Consider two switches connected by two links. Without a loop-prevention protocol:
STP prevents these problems by blocking redundant ports, leaving a single active path between any two switches.
STP (IEEE 802.1D) is a Layer 2 protocol that ensures a loop-free logical topology in a network with physical redundancy. It achieves this by:
STP uses Bridge Protocol Data Units (BPDUs) to exchange information between switches.
The Bridge ID uniquely identifies each switch in the STP domain. It consists of:
The BID format: Priority (4 bits) + System ID Extension (12 bits) + MAC Address (6 bytes).
Path cost is the cumulative cost from a switch to the root bridge. Costs are based on link speed:
| Link Speed | STP Cost (802.1D-1998) | RSTP Cost (802.1w) |
|---|---|---|
| 10 Mbps | 100 | 2,000,000 |
| 100 Mbps | 19 | 200,000 |
| 1 Gbps | 4 | 20,000 |
| 10 Gbps | 2 | 2,000 |
| 40 Gbps | 1 | 500 |
| 100 Gbps | 1 | 200 |
Lower cost indicates a better (faster) path.
BPDUs are exchanged between switches to communicate STP information. Types:
BPDU fields include: Root Bridge ID, Root Path Cost, Sender Bridge ID, Sender Port ID, and Timers (Hello, Max Age, Forward Delay).
The root bridge is elected by the lowest Bridge ID (priority then MAC address). The process:
Best practice: Manually set the root bridge priority (e.g., 4096 or 8192) on a core switch to ensure deterministic election.
To determine the root port on a switch:
For designated port election on a segment:
STP ports transition through states during convergence:
| State | Forward Frames? | Learn MACs? | Active Topology? | Description |
|---|---|---|---|---|
| Blocking | No | No | No | Initial state; receives BPDUs but does not forward data. |
| Listening | No | No | No | Transient; actively listens for BPDUs to determine role. |
| Learning | No | Yes | No | Transient; learns MAC addresses but does not forward frames. |
| Forwarding | Yes | Yes | Yes | Normal operation; forwards frames and learns MACs. |
| Disabled | No | No | No | Administratively down or failed. |
The convergence process for a port moving to forwarding:
Total convergence time ≈ 30–50 seconds (20 + 15 + 15 = 50 seconds worst-case). This is why STP is considered slow.
These timers can be tuned, but must be consistent across the network to avoid issues.
When a link fails or a new link is added, STP reconverges. The process:
Convergence time is affected by the timers (Max Age + 2×Forward Delay ≈ 50 seconds).
RSTP (802.1w) significantly improves convergence time to sub-second (typically 1–6 seconds). It is backward compatible with STP (802.1D). Key improvements:
RSTP uses version 2 BPDUs and has a "Proposal/Agreement" mechanism for fast convergence on point-to-point links.
MSTP (802.1s) extends RSTP to allow multiple spanning trees for different VLANs. This is useful for load balancing and efficient use of redundant links.
MSTP reduces CPU overhead compared to Per-VLAN STP (PVST+) and allows for better traffic engineering.
show spanning-tree,
show spanning-tree summary, show spanning-tree interface. Look for root bridge
inconsistency, blocked ports, and BPDU counts.Question 1: What is the primary purpose of the Spanning Tree Protocol (STP)?
(b) To prevent loops in a redundant switched network. STP ensures a loop-free logical topology.
Question 2: What is a broadcast storm?
(b) A loop where broadcast frames circulate indefinitely, consuming bandwidth. Broadcast storms are a consequence of Layer 2 loops.
Question 3: What is the default bridge priority in STP?
(b) 32768. This is the default priority for all switches.
Question 4: Which of the following is a valid STP port state?
(b) Listening. The STP states are: Blocking, Listening, Learning, Forwarding, Disabled.
Question 5: What is the role of the root bridge in STP?
(b) It is the logical center of the STP topology. All paths are determined relative to the root bridge.
Question 6: How often does the root bridge send configuration BPDUs by default?
(b) Every 2 seconds. The default Hello Time is 2 seconds.
Question 7: What is the default Max Age timer value in STP?
(c) 20 seconds. Max Age is 20 seconds by default.
Question 8: In STP, what is a root port?
(b) The port on a non-root switch that provides the best path to the root bridge. Each non-root switch has one root port.
Question 9: What is a designated port?
(b) The port on a segment that provides the best path to the root. Each network segment has one designated port.
Question 10: What is the STP path cost for a 1 Gbps link in 802.1D (classic STP)?
(c) 4. In classic STP (802.1D-1998), 1 Gbps has cost 4.
Question 11: Which of the following is NOT an STP port state?
(d) Negotiating. This is not a standard STP port state.
Question 12: What is the purpose of the Forward Delay timer in STP?
(b) To control how long a port stays in listening and learning states. Default is 15 seconds each.
Question 13: What is the IEEE standard for Rapid Spanning Tree Protocol?
(b) 802.1w. RSTP is defined in IEEE 802.1w.
Question 14: What is the typical convergence time of RSTP?
(c) 1–6 seconds. RSTP converges in sub-second to a few seconds.
Question 15: What is PortFast used for?
(b) To allow access ports to transition directly to forwarding without STP delays. PortFast is for end-host connections.
Question 16: What is the function of BPDU Guard?
(b) It shuts down a port if a BPDU is received on an access port. This prevents rogue switch connections.
Question 17: Which protocol extends STP to support multiple spanning trees for different VLANs?
(b) MSTP (802.1s). Multiple Spanning Tree Protocol supports multiple instances for VLAN groups.
Question 18: What happens when a switch receives a superior BPDU on a port configured with Root Guard?
(b) The port is placed in a root-inconsistent (blocked) state. This prevents a rogue switch from becoming the root bridge.
Question 19: In a switched network with redundant links, what problem does STP solve?
(b) Layer 2 loops. STP eliminates loops by blocking redundant paths.
Question 20: What does TCN stand for in STP?
(a) Topology Change Notification. TCN BPDUs indicate a topology change.
Question 21: In RSTP, which port states are combined into a single state?
(a) Blocking and Listening. RSTP uses Discarding state for both.
Question 22: What is the effect of setting a switch's bridge priority to 4096?
(b) It makes the switch more likely to become the root bridge. Lower priority = higher likelihood of being root.
Question 23: What does an alternate port do in STP?
(b) It provides a backup path if the root port fails. Alternate ports are blocked but can take over.
Question 24: What is the default Hello Time in STP?
(b) 2 seconds. The default Hello Time is 2 seconds.
Question 25: In RSTP, what is an edge port?
(b) A port that connects to an end device (like PortFast). Edge ports transition directly to forwarding.
Question 26: What is the purpose of Loop Guard in STP?
(b) To prevent a port from becoming designated when BPDUs are lost. Loop Guard prevents loops in the event of BPDU failure.
Question 27: Which of the following is a Cisco proprietary STP enhancement?
(c) PVST+. Per-VLAN Spanning Tree Plus is Cisco proprietary.
Question 28: How does STP prevent broadcast storms?
(a) By blocking redundant ports, eliminating loops. A loop-free topology prevents broadcast storms.
Question 29: What is the maximum number of VLANs supported by MSTP in a single instance?
(c) 4096. MSTP can map up to 4096 VLANs to instances, but typically fewer.
Question 30: In STP, what determines the root bridge when priorities are equal?
(a) The lowest MAC address. When priorities are equal, the lowest MAC address wins.
Question 31: What is the Forward Delay timer used for in STP?
(c) To control the listening and learning state durations. Forward Delay is 15 seconds by default.
Question 32: What happens when a switch receives a BPDU on a port with BPDU Guard enabled?
(a) The port is shut down. BPDU Guard disables the port to prevent rogue switch connections.
Question 33: In RSTP, the Proposal/Agreement handshake is used for:
(b) Rapid convergence on point-to-point links. It allows immediate transition to forwarding.
Question 34: What is the effect of UplinkFast on convergence?
(a) It speeds up convergence when the root port fails. UplinkFast allows a switch to quickly use an alternate root port.
Question 35: What is the IEEE standard for MSTP?
(c) 802.1s. Multiple Spanning Tree Protocol is defined in 802.1s.
Question 36: In a stable STP topology, which ports are in Forwarding state?
(a) Root ports and designated ports. These are the active ports; alternate/backup ports are blocked.
Question 37: What is the purpose of the Max Age timer in STP?
(a) To set the maximum age of a BPDU before it is discarded. Default is 20 seconds; if a switch doesn't receive a BPDU within Max Age, it assumes the root has failed.
Question 38: What is the purpose of TCN (Topology Change Notification) BPDUs?
(b) To indicate a topology change to the root bridge. TCN BPDUs trigger network-wide reconvergence.
Question 39: Which port role exists only in RSTP and not in classic STP?
(c) Alternate port. While backup existed in classic STP, alternate was explicitly defined in RSTP.
Question 40: What is the convergence time of classic STP (802.1D) worst-case?
(c) 50 seconds. Max Age (20) + 2×Forward Delay (15+15) = 50 seconds.
Exercise 1: Root Bridge Election
Three switches have the following bridge priorities and MAC addresses: Switch A: priority 32768, MAC 00:11:22:33:44:55; Switch B: priority 4096, MAC 00:11:22:33:44:56; Switch C: priority 32768, MAC 00:11:22:33:44:54. Which switch becomes the root bridge and why?
Switch B becomes the root bridge because it has the lowest bridge priority (4096). Priorities take precedence over MAC addresses. Switch C has a lower MAC than A but the same priority, but B is chosen first because of lower priority.
Exercise 2: Path Cost Calculation
Switch S is connected to the root bridge through three possible paths: Path 1: 1 Gbps link with cost 4; Path 2: 100 Mbps link with cost 19; Path 3: 10 Mbps link with cost 100. Which path will be chosen as the root port? What is the root path cost?
The path with the lowest cost is chosen: Path 1 with cost 4. The root path cost is 4.
Exercise 3: Root Port Selection
Switch X has two ports connected to the root bridge: Port A on a 1 Gbps link (cost 4) with sender bridge ID 32768:00:11:22:33:44:55 and sender port ID 1; Port B on a 1 Gbps link (cost 4) with sender bridge ID 32768:00:11:22:33:44:66 and sender port ID 1. Which port becomes the root port?
Both have the same cost (4). The tie is broken by lowest sender bridge ID. Port A has sender bridge ID 32768:00:11:22:33:44:55, which is lower than Port B's sender bridge ID (since 55 < 66). So Port A becomes the root port.
Exercise 4: Designated Port Election
Two switches, A and B, are connected to the same segment. Switch A has a bridge ID of 32768:00:11:22:33:44:55 and a root path cost of 10. Switch B has a bridge ID of 4096:00:11:22:33:44:66 and a root path cost of 12. Which switch has the designated port on this segment?
The switch with the lower root path cost has the designated port. Switch A has cost 10, Switch B has cost 12. Therefore, Switch A's port is the designated port on the segment.
Exercise 5: Port States
A switch port is initially in Blocking state. It has been 15 seconds since a superior BPDU was received on that port. What is the next state it will transition to? What triggers this transition?
It will transition from Blocking to Listening after the Max Age timer expires (20 seconds). Actually, if it has been 15 seconds, it is still in Blocking. The transition to Listening occurs after Max Age (20 seconds) if no superior BPDU is received. If it receives a superior BPDU, it remains in Blocking.
Exercise 6: RSTP Edge Port
You have a host connected to a switch port. You configure the port as an edge port (PortFast) in RSTP. What state does the port transition to immediately?
The port transitions directly to Forwarding. Edge ports bypass listening and learning states.
Exercise 7: STP Timer Calculation
In a classic STP network, the root bridge has Hello Time set to 2 seconds. How often will non-root switches send BPDUs? What is the Max Age?
Non-root switches receive BPDUs from the root and forward them. They send BPDUs when they receive them (on designated ports) or when they originate TCNs. Max Age defaults to 20 seconds (10 × Hello Time).
Exercise 8: BPDU Guard Scenario
An access port is configured with PortFast and BPDU Guard. An unauthorized switch is connected to this port and starts sending BPDUs. What happens to the port?
BPDU Guard shuts down the port (errdisable) to prevent a potential loop or rogue switch. The port must be manually re-enabled or configured for automatic recovery.
Exercise 9: Root Guard Scenario
You have configured Root Guard on a port connecting to a downstream switch. The downstream switch sends a BPDU with a lower bridge ID than the current root bridge. What happens?
The port is placed in a root-inconsistent state (blocked). This prevents the downstream switch from becoming the root bridge.
Exercise 10: MSTP Configuration
In MSTP, you need to map VLANs 10, 20, 30 to MSTI 1. What is the first step in configuration?
Enter MST configuration mode, set the region name and revision number, then map VLANs:
instance 1 vlan 10,20,30. Then exit and apply.
Exercise 11: Convergence Comparison
Compare the convergence time of classic STP and RSTP. What are the key factors that allow RSTP to converge faster?
Classic STP converges in 30–50 seconds. RSTP converges in 1–6 seconds. Key factors: RSTP reduces port states (Discarding replaces Blocking/Listening), uses a proposal/agreement handshake, edge ports bypass delays, and TCN handling is faster.
Exercise 12: Loop Guard Scenario
A switch port is an alternate port and Loop Guard is enabled. BPDUs from the designated switch stop arriving. What happens to the port?
The port is placed in a loop-inconsistent state (blocked). This prevents it from transitioning to designated and creating a loop.
Exercise 13: STP Topology Change
A link in the network fails. Which switch detects the failure and what does it do?
The switch directly connected to the failed link detects the loss of signal. It sends a TCN BPDU toward the root bridge. The root bridge responds with a BPDU with the Topology Change flag set, and all switches age out their MAC tables.
Exercise 14: Bridge ID Composition
What fields make up the Bridge ID in STP? If a switch has priority 8192 and MAC address 00:1A:2B:3C:4D:5E, what is its Bridge ID?
Bridge ID = Priority + System ID Extension + MAC Address. The format is 8192:00:1A:2B:3C:4D:5E (in Cisco display, priority is followed by MAC).
Exercise 15: STP Blocking Port
Why is a port blocked in STP? What is the purpose of the blocked port?
A port is blocked to prevent loops. The blocked port provides redundancy; if the active path fails, the blocked port can transition to forwarding (after convergence) to restore connectivity.
Exercise 16: RSTP Port Roles
List and describe the port roles in RSTP.
Exercise 17: STP Path Cost with Multiple Links
A switch has three links to the root bridge: two 100 Mbps links (cost 19 each) and one 1 Gbps link (cost 4). Which path is chosen for the root port? What is the total root path cost if the 1 Gbps link is used?
The 1 Gbps link has the lowest cost (4) and is chosen. The root path cost is 4.
Exercise 18: MSTP vs. PVST+
What is the advantage of MSTP over PVST+ (Per-VLAN STP) in a network with many VLANs?
PVST+ runs a separate STP instance for each VLAN, consuming CPU and memory. MSTP runs multiple instances but can map many VLANs to a single instance, reducing resource usage while still allowing load balancing.
Exercise 19: Troubleshooting STP Issues
Users are experiencing intermittent connectivity. You notice high BPDU counts on an access port. What could be the cause?
An unauthorized switch or device may be connected to the access port, sending BPDUs. BPDU Guard should be enabled to shut down the port. The switch may also have Spanning Tree enabled on that port inadvertently.
Exercise 20: STP Timer Tuning
You want to reduce STP convergence time in a classic STP network. What timers can you adjust and what are the risks?
You can reduce Hello Time (but not below 1 second), Max Age (must be ≥ 2×(Hello+1)), and Forward Delay (must be ≥ (Max Age/2)+1). Risks: if set too low, the network may become unstable, causing loops or flapping.
Exercise 21: Root Bridge Placement
In a campus network, where should the root bridge be placed and why?
The root bridge should be placed at the core of the network (the distribution or core layer). This ensures optimal path selection and reduces convergence impact on end devices.
Exercise 22: BPDU Filter
What is the difference between BPDU Guard and BPDU Filter?
BPDU Guard shuts down the port if a BPDU is received. BPDU Filter suppresses BPDU transmission and reception on a port (preventing BPDUs from being sent or received). BPDU Filter is less secure and can cause loops.
Exercise 23: STP and VLANs
In a network with VLANs, how does STP operate? Does it run per VLAN or globally?
In classic STP (802.1D), STP runs globally for all VLANs. In PVST+ (Cisco), it runs per VLAN. In MSTP, it runs per instance (which can include multiple VLANs).
Exercise 24: Root Port Failure
If a switch's root port fails, how does the switch reconverge? Which port becomes the new root port?
The switch will use its alternate port (if available). The alternate port is the next best path to the root. It transitions to forwarding after convergence (which is faster in RSTP).
Exercise 25: STP Security Summary
List three STP security features and describe what each protects against.
Homework 1: Explain the concept of a Layer 2 loop and the problems it creates (broadcast storm, MAC table instability, duplicate frames). Describe how STP solves these problems.
A Layer 2 loop occurs when there are multiple redundant paths between switches. Broadcast frames are flooded indefinitely, causing a broadcast storm that consumes bandwidth. MAC tables become unstable as switches learn MAC addresses on multiple ports (MAC flapping). Duplicate frames can reach the destination. STP solves this by electing a root bridge and blocking redundant ports, creating a loop-free logical topology while maintaining physical redundancy.
Homework 2: Describe the STP root bridge election process in detail. Include the roles of bridge priority, system ID extension, and MAC address. Provide an example with three switches.
The root bridge is elected by the lowest Bridge ID. Bridge ID = Priority (4 bits) + System ID Extension (12 bits) + MAC Address. Example: Switch A: priority 32768, MAC 00:11:22:33:44:55; Switch B: priority 4096, MAC 00:11:22:33:44:56; Switch C: priority 32768, MAC 00:11:22:33:44:54. Switch B wins (lowest priority). If priorities are equal, the lowest MAC address wins.
Homework 3: Explain the five STP port states (Blocking, Listening, Learning, Forwarding, Disabled). What activities occur in each state and what are the transition criteria?
Blocking: Receives BPDUs but does not forward frames. Listening: Listens for BPDUs to determine role; no forwarding. Learning: Learns MAC addresses but does not forward frames. Forwarding: Normal operation. Disabled: Administratively down. Transitions: Blocking → Listening (after Max Age), Listening → Learning (after Forward Delay), Learning → Forwarding (after Forward Delay).
Homework 4: Compare and contrast STP (802.1D) and RSTP (802.1w). Include convergence time, port states, port roles, and the proposal/agreement mechanism.
STP converges in 30–50 seconds. RSTP converges in 1–6 seconds. STP has 5 states; RSTP has 3 (Discarding, Learning, Forwarding). RSTP adds alternate and backup port roles explicitly. RSTP uses a proposal/agreement handshake on point-to-point links for rapid transition to forwarding. RSTP is backward compatible with STP.
Homework 5: Explain the purpose of MSTP (802.1s) and how it differs from PVST+. Discuss the benefits of MSTP in a large network with many VLANs.
MSTP allows multiple VLANs to be mapped to a single spanning tree instance (MSTI), reducing the number of STP instances compared to PVST+ (which runs one per VLAN). This saves CPU and memory resources. MSTP also allows load balancing by mapping different VLANs to different instances. It is more scalable for large networks.
Homework 6: Describe the following STP enhancements: PortFast, UplinkFast, and BackboneFast. Explain the scenario each is designed for and how it improves convergence.
PortFast: For access ports, bypasses listening/learning to transition directly to forwarding, reducing host boot time. UplinkFast: Allows a switch to quickly switch to an alternate root port when the root port fails. BackboneFast: Detects indirect link failures and accelerates convergence by allowing switches to propose a new root. These are Cisco proprietary but largely superseded by RSTP.
Homework 7: Explain the operation of BPDU Guard, Root Guard, and Loop Guard. Describe a deployment scenario for each.
BPDU Guard: Shuts down a port if a BPDU is received (used on access ports to prevent rogue switches). Root Guard: Blocks a port if a superior BPDU is received (used to protect the root bridge placement). Loop Guard: Prevents a blocked port from becoming designated if BPDUs are lost (used on alternate ports to prevent loops).
Homework 8: Explain the role of BPDUs in STP. What information is contained in a configuration BPDU? What is the purpose of a TCN BPDU?
Configuration BPDUs are sent by the root bridge every Hello Time. They contain Root Bridge ID, Root Path Cost, Sender Bridge ID, Sender Port ID, and Timers. They maintain the topology. TCN BPDUs are sent by switches that detect a topology change; they propagate to the root, which then sends BPDUs with the Topology Change flag to age out MAC tables.
Homework 9: In a switched network, the root bridge is located at the core. A link between two distribution switches fails. Describe the STP convergence process, including the role of TCN BPDUs, root bridge response, and MAC table aging.
The switch adjacent to the failed link detects the failure and sends a TCN BPDU toward the root. The root bridge receives it and sends a BPDU with the Topology Change flag set. All switches then set their MAC table aging to Forward Delay (15 seconds). The topology is recalculated, and the blocked alternate ports transition to forwarding after convergence.
Homework 10: Calculate the STP convergence time for a network with default timers (Hello 2s, Max Age 20s, Forward Delay 15s) if a link fails. What is the worst-case delay before the blocked port starts forwarding?
Worst-case convergence time = Max Age (20s) + 2 × Forward Delay (15s × 2) = 50 seconds. The blocked port must wait for Max Age to expire (assuming the root port failed), then go through Listening (15s) and Learning (15s) before Forwarding.
Homework 11: What is the purpose of the System ID Extension in the Bridge ID? How does it relate to VLANs in PVST+?
The System ID Extension is used in PVST+ to identify which VLAN a STP instance belongs to. It allows the bridge priority to be adjusted per VLAN, enabling different root bridges for different VLANs. The priority is set in multiples of 4096, and the VLAN ID is placed in the extension field.
Homework 12: Explain the concept of "root path cost" and how it is used to determine the root port on a switch. Provide an example with multiple links.
Root path cost is the cumulative cost from the switch to the root bridge. It is the sum of the costs of each link along the path. The switch selects the port with the lowest root path cost as its root port. Example: If a switch has two links to the root, one 1 Gbps (cost 4) and one 100 Mbps (cost 19), the 1 Gbps port becomes the root port.
Homework 13: What is the difference between an alternate port and a backup port in RSTP? Provide an example of where each would be found.
An alternate port is a blocked port that provides an alternate path to the root (on a different switch). A backup port is a blocked port that provides a backup to a designated port on the same switch (rare; occurs in shared media loops). Example: Alternate port is on Switch B connecting to Switch C; Backup port is on the same switch as the designated port but on a different port of the same switch.
Homework 14: Describe the process of STP root path cost calculation and how it is propagated through the network via BPDUs.
The root bridge sends BPDUs with a root path cost of 0. Each downstream switch receives the BPDU, adds the cost of the receiving link, and propagates the new cost in its own BPDUs. The switch selects the port with the lowest root path cost as its root port and uses that cost for its BPDU transmissions on designated ports.
Homework 15: In a network with four switches, draw a topology that creates a loop. Then show the STP-computed logical topology after convergence, indicating the root bridge, root ports, designated ports, and blocked ports.
Topology: Switches A (core), B, C, D in a ring. Root: A. B's root port is to A. C's root port is to B (cost 8). D's root port is to C (cost 12). Designated ports: A's ports to B and D; B's port to C; C's port to D. Blocked ports: D's port to A (alternate) and possibly others. The logical topology is a tree rooted at A.
This tutorial covered the Spanning Tree Protocol (STP) and LAN redundancy:
In the next tutorial, we will explore Enterprise and Data-Center LAN Architectures.