Networking Fundamentals — Module 11

Spanning Tree Protocol

STP is the protocol that keeps Ethernet networks alive by breaking loops in redundant topologies. From 802.1D's 50-second convergence to RSTP's sub-second failover — a deep dive into network resilience.

22–30 min May 2026

// CHAPTER 01

The Broadcast Storm That Killed the Network

// REAL-WORLD SCENARIOIt is 1990. A corporate campus has just deployed a second switch for redundancy. Now there are two paths between floors. The network administrator is pleased — redundancy means resilience. Then someone plugs in a misconfigured cable that creates a physical loop between the two switches. Within seconds, a single broadcast frame multiplies into thousands. Each switch receives the frame on one port and forwards it out all other ports — including back toward the source. The frame bounces forever. In under a minute, the network is saturated with billions of duplicate frames. Every device freezes. The network is dead. It takes hours to track down the cable and unplug it. Radia Perlman had already solved this problem in 1985 — with the Spanning Tree Algorithm.

Ethernet switches have a fundamental design rule: when a switch receives a frame destined for an unknown MAC address, it floods the frame out all ports except the incoming port. This is essential for network discovery. But in a topology with redundant links (loops), flooding creates an infinite storm.

Consider three switches: SW-A, SW-B, SW-C, each connected to each of the others, forming a triangle. A broadcast frame enters SW-A. SW-A floods it to SW-B and SW-C. SW-B floods it back to SW-A and to SW-C. SW-C floods it back to SW-A and SW-B. Each switch immediately floods again. The frame count doubles every microsecond. In milliseconds, all bandwidth is consumed. This is a broadcast storm.

The catastrophic consequence: switches also have limited memory for MAC address tables. As the storm generates billions of frames with randomized or duplicated source MAC addresses, the CAM table thrashes — constantly being overwritten. Legitimate MAC learning becomes impossible, further amplifying flooding.

Radia Perlman's Solution

In 1985, Radia Perlman (working at Digital Equipment Corporation) invented the Spanning Tree Algorithm. The insight: to eliminate loops in a graph, turn the graph into a tree — a loop-free topology. A tree can be constructed by identifying a root node and then finding the shortest path from every other node to the root, discarding all links that are not on any shortest path.

Perlman's algorithm works by having switches exchange special frames called BPDUs (Bridge Protocol Data Units) to collectively elect a root bridge and block the redundant links that would create loops. The result: a loop-free active topology overlaid on the redundant physical topology.

🌳Radia Perlman's 'Algorhyme' — and Her Regrets

Radia Perlman wrote a now-famous poem, "Algorhyme," to explain Spanning Tree: "I think that I shall never see / A graph more lovely than a tree. / A tree whose crucial property / Is loop-free connectivity..." She has since said she considers STP one of her least favorite inventions — it is "one of those things that is probably worse than the disease it was meant to solve" in modern data centers. RSTP and MSTP are significantly better, but STP's legacy persists.

// CHAPTER 02

How STP Works: BPDUs, Root Election, and Port Roles

// REAL-WORLD SCENARIOImagine a democratic election where every switch starts by claiming to be the leader (Root Bridge). They all shout their candidate ID. When a switch hears a "better" candidate — one with a lower priority, or the same priority but a lower MAC address — it stops voting for itself and starts voting for the better candidate. Eventually, one switch wins unanimously: the Root Bridge. Every other switch then calculates its shortest path to the Root and blocks any ports that would create a redundant path.

Step 1: Root Bridge Election

Every switch has a Bridge ID (BID) — a combination of a 2-byte priority (configurable, default 32768) and the switch's 6-byte MAC address. The switch with the lowest BID becomes the Root Bridge. Since priorities are configurable, network administrators can deterministically elect any switch as root by setting it to the lowest priority (e.g., 4096).

BPDUs are sent every 2 seconds (Hello interval). Each switch initially claims to be the Root, but will defer to a lower BID when it receives a superior BPDU. The election converges when all switches agree on the same Root Bridge.

# Cisco IOS — verify root bridge
show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    4096
             Address     aabb.cc00.0101
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    4096   (priority 4096 sys-id-ext 10)
             Address     aabb.cc00.0101
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ----
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p

Step 2: Root Port Selection

On every non-root switch, each port is assigned a port cost based on link speed. The port that provides the lowest cumulative cost path to the Root Bridge is elected the Root Port. There is exactly one Root Port per non-root switch, and it is always in Forwarding state.

Standard STP port costs: 10 Mbps = 100, 100 Mbps = 19, 1 Gbps = 4, 10 Gbps = 2, 100 Gbps = 1. (These are the IEEE 802.1D-2004 short-mode values — long mode uses larger values for very high-speed links.)

Step 3: Designated Port Selection

For every LAN segment (link between two switches), one port is elected the Designated Port — the single port on that segment that will forward traffic toward the Root Bridge. The Root Bridge's ports are always Designated. For other segments, the switch with the lower path cost to the Root wins Designated status; tiebreaker is lower BID.

Step 4: Alternate and Backup Ports

Any port that is neither a Root Port nor a Designated Port becomes an Alternate Port (in RSTP) — it is blocked to prevent loops. In classic STP, this was called a "Non-Designated Port" and entered the Blocking state. The key insight: Alternate Ports are pre-calculated backup paths. In RSTP, when the Root Port fails, the Alternate Port can immediately transition to Root Port without waiting for timers to expire.

Interactive — STP Topology Viewer

Click a switch to inspect its port roles and states.

SW-AROOT

Priority: 4096

MAC: AA:AA:AA:AA:AA:01

SW-B

Priority: 32768

MAC: BB:BB:BB:BB:BB:01

SW-C

Priority: 32768

MAC: CC:CC:CC:CC:CC:01

Topology: SW-A ↔ SW-B ↔ SW-C ↔ SW-A (triangle = physical loop)

STP blocks SW-C Gi0/2 (Alternate port) to break the loop. Active paths: SW-A→SW-B and SW-A→SW-C. SW-B→SW-C direct path is blocked.

// CHAPTER 03

STP Port States and Timers

Classic STP Port States (802.1D)

In original STP, ports transition through five states when coming online or recovering from a failure. This deliberate slow progression prevents transient loops during topology changes.

Blocking — the initial state. Port receives BPDUs but does not forward any frames (except BPDUs). Duration: Max Age (default 20 seconds) to decide if the port should be active.

Listening — the port is participating in STP and is listening to BPDUs to determine the active topology. No user data frames are forwarded. Duration: Forward Delay (default 15 seconds).

Learning — the port still doesn't forward user data, but it is learning MAC addresses from frames it sees. This pre-populates the CAM table before forwarding starts, preventing a brief flood when forwarding begins. Duration: Forward Delay (15 seconds).

Forwarding — the port is active and fully operational: forwarding frames, learning MAC addresses, and sending/receiving BPDUs.

Disabled — administratively shut down.

Total time from Blocking to Forwarding: Max Age (20s) + Listening (15s) + Learning (15s) = 50 seconds minimum. This is why classic STP convergence is so slow — every topology change means 50 seconds of network unavailability on affected ports.

The STP Timers

Hello Timer (2 seconds): how often the Root Bridge sends BPDUs. If a switch misses 10 consecutive BPDUs (10 × Hello = 20s = Max Age), it declares the Root path lost and re-initiates topology change.

Max Age (20 seconds): how long a switch stores a BPDU before discarding it. When a port misses BPDUs for Max Age duration, it assumes a topology change and begins transitioning.

Forward Delay (15 seconds): time spent in each of the Listening and Learning states.

⚠ Modifying STP timersThe STP timers are mathematically related — modifying them without understanding the relationships can cause STP instability. The default values (Hello=2, MaxAge=20, ForwardDelay=15) were calculated for a maximum network diameter of 7 switches. For larger topologies, increase Max Age and Forward Delay first. Never set Hello Timer below 1 second.

// CHAPTER 04

Rapid STP (RSTP) — 802.1w

// REAL-WORLD SCENARIOThe year is 2001. Modern networks have grown dramatically more complex. A 50-second convergence time means 50 seconds of voice calls dropping, video freezing, and transactions failing every time a switch is rebooted or a link flaps. The industry demands something faster. IEEE 802.1w — Rapid Spanning Tree Protocol — was published, reducing convergence from 50 seconds to under 6 seconds in most cases, and often under 1 second for directly connected switches.

What Changed in RSTP

RSTP keeps the same fundamental algorithm — elect a Root Bridge, select Root Ports and Designated Ports, block alternate paths — but dramatically accelerates convergence with several key changes:

Reduced port states: RSTP collapses five states into three: Discarding (combines Blocking + Listening + Disabled), Learning, and Forwarding. This eliminates the Listening state entirely.

Proposal/Agreement mechanism: When a port wants to become Designated and forward, it sends a BPDU with the Proposal bit set. The downstream switch responds with an Agreement (if it agrees the upstream is the Designated port for the segment). Upon receiving Agreement, the port transitions to Forwarding immediately — no timers needed. This handshake replaces the 30-second wait in classic STP.

Topology Change Notification: In classic STP, Topology Change Notifications (TCN) are sent to the Root, which then floods a TC flag, causing all switches to shorten their MAC address table aging time to Forward Delay (15s) — causing unnecessary MAC flushes. In RSTP, each switch directly flushes its MAC table for ports that receive a TC-flagged BPDU and notifies its neighbors, converging faster without involving the Root.

Edge Ports (PortFast equivalent): RSTP designates ports connected to end devices as "edge ports" — they immediately transition to Forwarding without going through Discarding/Learning. This is functionally identical to Cisco's PortFast feature.

RSTP Port Roles

RSTP defines the same roles (Root, Designated, Alternate) plus one new role: Backup Port — a port that is a backup for a Designated Port on the same switch and same segment (requires a switch with two ports connected to the same hub/segment — rare in modern networks). Alternate and Backup ports are in the Discarding state.

Interactive — RSTP Convergence Simulator

Step through BPDU exchange, port role assignments, and a link failure recovery scenario.

0/12 events

Click "Next Step" to begin the simulation...

RSTP Link Types

RSTP uses link type to determine whether Proposal/Agreement can be used. Point-to-point links (full-duplex between two switches) support Proposal/Agreement and achieve rapid convergence. Shared links (half-duplex, connected to a hub with multiple switches) cannot use Proposal/Agreement — they fall back to classic STP timer-based convergence. In modern networks with only full-duplex switches, all links are point-to-point.

// CHAPTER 05

PVST+, RPVST+, and MSTP

Per-VLAN Spanning Tree (PVST+)

Standard 802.1D and 802.1w run a single spanning tree instance for the entire switched domain. This means all VLANs use the same active topology — the same links are blocked regardless of which VLAN is being considered. This wastes bandwidth on blocked links.

Cisco's proprietary PVST+ (Per-VLAN Spanning Tree Plus) runs a separate STP instance per VLAN. This enables load balancing: SW-A can be root for VLANs 10–20 (directing traffic through one path), while SW-B is root for VLANs 30–40 (directing traffic through another path). Both paths carry traffic simultaneously for different VLANs — doubling effective bandwidth utilization of redundant links.

Multiple Spanning Tree Protocol (MSTP)

PVST+ runs one STP instance per VLAN. With 200 VLANs, you run 200 independent STP processes, each exchanging BPDUs every 2 seconds. On a large campus with 500 switches and 200 VLANs, that's 500 × 200 = 100,000 BPDU packets every 2 seconds — significant CPU and bandwidth overhead.

IEEE 802.1s MSTP solves this by mapping multiple VLANs to a single MST Instance (MSTI). You might have MSTI 1 covering VLANs 10–50, MSTI 2 covering VLANs 51–100, and MSTI 0 (IST, Internal Spanning Tree) covering all remaining VLANs. You get load balancing with only a handful of STP instances regardless of VLAN count.

Interactive — STP Version Comparator

Click a protocol to compare features.

ProtocolStandardConvergencePer-VLAN

STP802.1D-199830–50 sNo

PVST+Cisco (prop)30–50 sYes

RSTP802.1w1–6 sNo

RPVST+Cisco (prop)1–6 sYes

MSTP802.1s1–6 sNo

// CHAPTER 06

STP Optimizations: PortFast, BPDU Guard, Root Guard

// REAL-WORLD SCENARIOA helpdesk technician plugs a cheap unmanaged switch into an office port to extend connectivity for a few desks. The switch starts sending BPDUs. Suddenly the network thinks there's a new switch in the topology. STP detects the change and starts recalculating. Thirty seconds of intermittent connectivity for half the floor. This is why STP hardening features exist — to protect the production topology from unintended changes.

PortFast

End-host ports (connecting to PCs, phones, printers) will never receive BPDUs — only switches and bridges generate them. Making these ports wait 30–50 seconds to transition to Forwarding is wasteful and causes problems (DHCP requests time out before the port comes up, causing boot failures on diskless workstations).

PortFast bypasses the Listening and Learning states, immediately transitioning to Forwarding when the link comes up. This should only be used on access ports connected to end hosts — if a switch is plugged into a PortFast port, loops can form before STP can react.

BPDU Guard

BPDU Guard is the enforcement mechanism for PortFast ports. If a BPDU is received on a PortFast port, it means something other than an end host is connected — likely a rogue switch. BPDU Guard immediately error-disables the port (shuts it down) and logs an alert. The port requires manual recovery (shutdown → no shutdown) or can be configured to auto-recover after a timeout.

! Apply PortFast and BPDU Guard to all access ports globally
spanning-tree portfast default
spanning-tree portfast bpduguard default

! Or per-interface
interface GigabitEthernet0/1
 spanning-tree portfast
 spanning-tree bpduguard enable

! Verify error-disabled ports
show interfaces status err-disabled

! Auto-recovery after 300 seconds
errdisable recovery cause bpduguard
errdisable recovery interval 300

Root Guard

Root Guard protects against an unauthorized switch becoming the Root Bridge. When Root Guard is enabled on a port, if a superior BPDU is received (one that would cause a new Root election), the port is immediately placed in the root-inconsistent state (no traffic, no MAC learning) until the superior BPDUs stop. This prevents an attacker or misconfigured switch from hijacking the Root Bridge role.

Root Guard should be configured on all ports where you know the Root Bridge should never be located — typically all downlink ports from the distribution layer. The Root Bridge candidates should be the core/distribution switches, never access-layer switches or customer-connected ports.

BPDU Filter

BPDU Filter prevents BPDUs from being sent or processed on a port — essentially hiding the port from STP. This is appropriate for ports connecting to non-STP-capable devices. Use with extreme caution: if a loop is created on a BPDU-filtered port, STP cannot detect and block it, resulting in a broadcast storm.

Loop Guard

Loop Guard protects against a specific failure mode: a unidirectional link failure where a switch stops receiving BPDUs on a Blocking/Alternate port (because the upstream switch can't transmit) but the physical link remains up. Normally, the switch would "age out" the BPDU info and transition the blocked port to Forwarding — creating a loop. Loop Guard detects the absence of BPDUs on a port that should be receiving them and places the port in "loop-inconsistent" state instead of allowing it to transition forward.

// CHAPTER 07

STP and Network Design

Root Bridge Placement Strategy

The Root Bridge should be placed at the network's center of gravity — the switch that provides the shortest average path to all other switches. In a three-tier enterprise network (Access → Distribution → Core), the Root Bridge should be one of the Core switches, not a Distribution or Access switch.

Configure primary and secondary root bridges explicitly. The primary root uses priority 4096; the secondary uses 8192. This ensures deterministic election even after a switch replacement (a replacement switch with default priority 32768 will never outbid 4096).

! Set SW-CORE-01 as primary root for all VLANs
spanning-tree vlan 1-4094 root primary   ! sets priority to 24576 or lower

! Or manually
spanning-tree vlan 10 priority 4096

! Set SW-CORE-02 as secondary root
spanning-tree vlan 10 priority 8192

! Verify
show spanning-tree vlan 10 detail

Diameter and Timer Considerations

The STP default timers assume a maximum network diameter of 7 hops (switches) between any two end points. For each additional hop beyond 7, the Max Age timer may need to be increased. If a BPDU travels 9 hops but Max Age is 20 seconds with 2-second hello intervals, a valid BPDU might expire before reaching the far end, triggering unnecessary topology changes.

With RSTP and MSTP, this is less critical — RSTP uses per-port BPDU aging rather than a global timer, and BPDUs are generated by every switch (not just the Root), so BPDUs never travel the full topology diameter.

// CHAPTER 08

STP Attacks and Security

Root Bridge Spoofing

An attacker connected to an access port can send crafted BPDUs claiming a very low priority (BID priority = 0, MAC = 00:00:00:00:00:01). If Root Guard is not configured, the switch will elect the attacker's device as the Root Bridge. The attacker becomes a chokepoint for traffic flows, enabling traffic interception, manipulation, and man-in-the-middle attacks.

Even without MITM intent, this disrupts the network: topology reconvergence causes 1–50 seconds of outage (depending on STP version), affects all VLANs (unless PVST+ is used), and may establish suboptimal traffic paths that permanently degrade performance.

Mitigation: spanning-tree portfast bpduguard enable on all access ports, spanning-tree guard root on all designated downlinks, and 802.1X authentication to prevent unauthorized devices from connecting.

TCN (Topology Change Notification) Flooding

In classic STP, when a topology change occurs, all switches reduce their MAC address aging time to Forward Delay (15 seconds) for the duration of the TC flag. An attacker can flood the network with continuous TC BPDUs, causing every switch to continuously flush its MAC table. This forces switches into hub-like behavior (flooding unknown MACs) and creates significant CPU and traffic overhead.

STP and VLAN Hopping

Some VLAN hopping attacks require an active trunk port. By injecting BPDUs that trigger topology changes, an attacker can try to manipulate which ports are Designated vs. Alternate — potentially causing a previously blocked trunk to become active, exposing VLANs. This is why BPDU Guard and proper port security must work together.

// CHAPTER 09

STP Monitoring and Troubleshooting

Key Diagnostic Commands

# Full STP topology for a VLAN
show spanning-tree vlan 10

# See all port roles/states across all VLANs
show spanning-tree summary

# Detailed STP info including timers and BID
show spanning-tree vlan 10 detail

# Which ports are designated on this switch
show spanning-tree vlan 10 | include Desg

# Watch for topology changes in real time
debug spanning-tree events

# STP statistics — topology change count
show spanning-tree vlan 10 | include topology

# Port-level STP state
show spanning-tree interface GigabitEthernet0/1 detail

The Five Most Common STP Issues

1. Unexpected Root Bridge. A new switch with default priority (32768) is added to the network but has a lower MAC than the current Root, winning the election. Symptom: topology changes across the network. Fix: explicitly configure priorities on core switches to prevent any access-layer switch from winning.

2. PortFast on trunk ports. A trunk port configured with PortFast immediately forwards frames before STP has determined the topology — creating a loop risk. Symptom: broadcast storms after configuration changes. Fix: PortFast should only be used on access ports. Use spanning-tree portfast trunk only when intentionally needed on trunk ports, and understand the risk.

3. Unidirectional link. A fiber link can transmit in one direction but not the other (TX works, RX fails). The switch on the dead-receive end stops getting BPDUs and transitions its Blocking port to Forwarding — creating a loop. Fix: enable Loop Guard and UDLD (Unidirectional Link Detection) on all inter-switch fiber links.

4. Native VLAN mismatch causing STP issues. STP BPDUs for the native VLAN are sent untagged. If native VLAN doesn't match between switches, STP BPDUs for VLAN 1 will be delivered to the wrong VLAN, causing STP to see phantom topology changes. Fix: ensure native VLAN is consistent across all trunk links.

5. Excessive topology changes. A flapping link (going up/down repeatedly) triggers a TC event every time, causing MAC table flushes and brief forwarding degradation. Identify the flapping port with show interfaces counters errors, then investigate the physical layer (cable, SFP, interface settings).

// CHAPTER 10

STP in Modern Data Centers

// REAL-WORLD SCENARIOA hyperscaler operates 100,000 servers across 500 racks. STP cannot scale to this environment — a single topology change on a 100,000-switch domain would require all switches to participate in re-convergence, causing minutes of disruption. Modern data centers have largely eliminated STP by moving to routed leaf-spine topologies where every link is an L3 routed connection (IP-connected), not a bridged L2 connection. When everything is routed, there are no L2 loops, and STP is simply not needed.

RSTP in Enterprise vs. Elimination in Data Centers

In enterprise campus networks, RSTP (typically RPVST+ for Cisco) remains standard. The hierarchical Access-Distribution-Core topology naturally limits the STP domain size. BPDU Guard and Root Guard protect the topology from misconfiguration. PortFast ensures end hosts connect instantly.

In modern data centers, the move to VXLAN-based leaf-spine fabric eliminates L2 loops at the physical layer. Each leaf-to-spine connection is a routed (L3) link. VMs communicate via VXLAN overlay, which encapsulates L2 frames in UDP/IP. The underlay is fully routed — STP is irrelevant at the physical layer. STP may still run within hypervisor virtual switches, but limited to the per-host vSwitch domain.

SPB (Shortest Path Bridging) — IEEE 802.1aq

Shortest Path Bridging uses IS-IS routing protocol to provide loop-free L2 topology without STP. Unlike STP which blocks redundant paths, SPB allows all paths to be active simultaneously, using MAC-in-MAC encapsulation to route frames via the shortest path. SPB provides better bandwidth utilization than STP while maintaining L2 semantics. It has seen adoption in carrier networks and some large enterprise deployments.

// CHAPTER 11

STP Configuration Reference

! === Cisco IOS — Production RSTP Configuration ===

! Enable RSTP globally (default on newer IOS)
spanning-tree mode rapid-pvst

! Set primary and secondary root bridges
spanning-tree vlan 10,20 priority 4096      ! Primary root
spanning-tree vlan 30,40 priority 8192      ! Secondary root

! PortFast + BPDU Guard on all access ports (global)
spanning-tree portfast default
spanning-tree portfast bpduguard default

! Root Guard on distribution downlinks
interface range GigabitEthernet0/1-12
 spanning-tree guard root

! Loop Guard on inter-switch links
interface GigabitEthernet0/24
 spanning-tree guard loop

! UDLD on fiber links
udld enable aggressive

! Verify complete STP state
show spanning-tree summary totals
show spanning-tree inconsistentports

! === MSTP Configuration (scaling to many VLANs) ===

spanning-tree mode mst

spanning-tree mst configuration
 name CAMPUS_MST
 revision 1
 instance 1 vlan 10-50        ! Instance 1 covers VLANs 10-50
 instance 2 vlan 51-100       ! Instance 2 covers VLANs 51-100
 instance 3 vlan 101-200      ! Instance 3 covers VLANs 101-200

! Set root per MSTI (load balance between core switches)
spanning-tree mst 1 priority 4096
spanning-tree mst 2 priority 8192
spanning-tree mst 3 priority 4096

// CHAPTER 12

Real-World STP Incidents

The Facebook Outage Analogy

While Facebook's 2021 outage was BGP-related, the cascading failure pattern is analogous to STP storms. In STP: one misconfigured link causes a topology change → all switches flush MACs → all switches flood unknown frames → CPU spikes across all switches → switches can't process BPDUs → topology changes cascade → entire domain oscillates.

The defense is always defense-in-depth: Root Guard prevents unauthorized Root elections; BPDU Guard prevents rogue switches; Loop Guard prevents unidirectional link failures from creating loops; UDLD detects fiber failures before STP timer expiration. No single protection is sufficient.

The "Rogue Switch" Incident

A common real-world incident: an employee brings a home router/switch combination and plugs two of its ports into different wall jacks on the office network (perhaps trying to extend connectivity). The device creates a physical loop. If the office switch ports have PortFast but no BPDU Guard, and the home device sends BPDUs, STP must reconverge. If the home device doesn't send BPDUs (it's not STP-aware), a loop forms and a broadcast storm ensues. BPDU Guard would err-disable the ports immediately. Without it, the network operator scrambles to find which port is looped.

// CHAPTER 13

Common Misconceptions

✗ Common Mistake — STP prevents all loops permanentlySTP prevents Layer 2 loops under normal operation, but it can be fooled. Unidirectional link failures (fiber with dead receive direction) can cause a switch to incorrectly believe it has lost its BPDU source and transition a blocked port to forwarding, creating a loop. BPDU spoofing attacks can manipulate port states. Physical cabling errors during maintenance can create transient loops before STP detects and reacts. STP provides loop prevention under the assumption of bidirectional links and honest BPDU sources. Use Loop Guard and UDLD to address the fiber failure case.

✗ Common Mistake — PortFast is safe on any portPortFast is safe only on ports that will never connect to another switch or bridge. If a switch is plugged into a PortFast port, the port immediately starts forwarding before STP topology has been calculated — if a loop exists, STP won't have time to block it before the broadcast storm starts. Always pair PortFast with BPDU Guard, which will err-disable the port if it ever receives a BPDU (indicating a switch was plugged in).

✗ Common Mistake — Lowering STP timers improves reliabilityLowering STP timers (especially Hello interval) seems like it would speed convergence. But Hello interval and Max Age are mathematically related: Max Age = 2 × (Hello × max_hops). If Hello is too low, BPDUs may age out on large networks before reaching all switches, causing false topology changes and instability. RSTP is the correct solution for faster convergence — it doesn't rely on timers for rapid convergence; it uses Proposal/Agreement handshakes.

✗ Common Mistake — PVST+ runs one STP for the whole networkPVST+ (Per-VLAN STP+) runs a completely separate STP instance for each VLAN. With 200 VLANs, there are 200 independent root elections, 200 sets of port roles, and 200 sets of BPDUs being sent every 2 seconds. This is why MSTP was developed — to reduce this overhead by mapping many VLANs to a small number of MST instances.

✗ Common Mistake — Root Guard and BPDU Guard do the same thingThey protect different scenarios. BPDU Guard is for access ports (connected to end hosts): if any BPDU arrives, err-disable immediately — no switch should be here. Root Guard is for designated downlink ports (connected to downstream switches): the downstream switch is allowed to send BPDUs and participate in STP, but it must never send a BPDU superior enough to become Root — if it does, block it.

// CHAPTER 14

Interview Questions

Beginner

What problem does Spanning Tree Protocol solve?

STP solves the broadcast storm problem in redundant Ethernet networks. Ethernet switches flood unknown-destination and broadcast frames to all ports. In a topology with physical loops (redundant links between switches), a flooded frame cycles forever — each switch floods it, creating exponentially multiplying copies. STP prevents this by logically breaking loops: it selects a root bridge, calculates the shortest path from every switch to the root, and blocks any port that would create a redundant loop path. The result: a loop-free logical tree (hence "spanning tree") is overlaid on the redundant physical topology.

Beginner

Explain the STP root bridge election process.

Every switch has a Bridge ID (BID) consisting of a 2-byte configurable priority (default 32768) and the switch's 6-byte MAC address. All switches start by claiming to be the Root Bridge and sending BPDUs with themselves as root. When a switch receives a BPDU with a lower BID than its own, it stops claiming to be Root and starts advertising the received BID as root. This propagates until all switches agree on the single lowest-BID switch as the Root Bridge. Since priorities are configurable (in increments of 4096), network administrators explicitly control which switch becomes Root by setting it to the lowest priority (e.g., 4096).

Intermediate

What are the differences between STP port roles: Root, Designated, Alternate, and Backup?

Root Port: one per non-root switch; the port with the lowest cumulative cost path to the Root Bridge. Always in Forwarding state. Designated Port: one per LAN segment; the port on that segment that provides the best path to the Root. On the Root Bridge, all ports are Designated. Always in Forwarding state. Alternate Port (RSTP): a port with an alternative path to the Root Bridge — blocked to prevent loops, but immediately available as a backup if the Root Port fails (no timer wait in RSTP). Backup Port (RSTP): a backup for a Designated Port on the same segment — used when a switch has two ports on the same shared segment. In the Discarding state. The key insight: Alternate Ports are why RSTP can converge so quickly after a link failure — the backup path is already known and pre-approved, it just needs to be activated.

Intermediate

How does RSTP achieve faster convergence than classic STP?

RSTP uses three mechanisms: (1) Proposal/Agreement handshake — when a Designated port wants to forward, it sends a Proposal BPDU. The downstream switch responds with Agreement, allowing immediate transition to Forwarding without any timer wait. (2) Edge ports (PortFast equivalent) — ports connected to end hosts skip Discarding and Learning entirely, transitioning directly to Forwarding when a link comes up. (3) Per-port BPDU aging — each port independently ages BPDUs rather than waiting for a global Max Age timer. These changes reduce convergence from the classic STP worst case of 30–50 seconds to typically 1–6 seconds, often under 1 second for directly connected links.

Senior

A network engineer reports intermittent connectivity issues with occasional broadcast storms. How would you diagnose and fix an STP problem?

Systematic approach: (1) Identify scope: which VLANs, which switches. Use 'show spanning-tree summary' to find topology change counts — high TC count indicates instability. (2) Find the root cause: 'show spanning-tree vlan X detail' | grep 'topology changes' shows which port is generating TCs. (3) Check port states: look for ports oscillating between Blocking and Forwarding using 'debug spanning-tree events'. (4) Check for unauthorized Root Bridges: compare 'show spanning-tree' root BID against expected core switches. (5) Identify unidirectional links: 'show interfaces counters errors' for high error counts on fiber links — enable UDLD to detect. (6) Remediation: add BPDU Guard to all access ports, add Root Guard on distribution downlinks, verify PortFast is not misconfigured on trunk ports, check for physical loop (two cables between same pair of switches without port-channel). For immediate relief during a storm: disconnect suspect links, clear MAC tables, verify STP reconverges cleanly, then reconnect and validate.

PhD

Explain why modern hyperscale data centers have largely eliminated STP, and what replaced it.

STP has fundamental scaling limitations for hyperscale: (1) A single topology change triggers MAC table flushes across the entire L2 domain — at 100,000 servers, this causes massive traffic bursts as every switch simultaneously floods unknown destinations. (2) BPDU processing scales poorly: with PVST+ and 200 VLANs across 500 switches, you have 500 × 200 = 100,000 BPDU processes every 2 seconds. (3) STP's loop-avoidance by blocking links wastes 50% of redundant path capacity, which is economically unacceptable in hyperscale CAPEX models. Modern hyperscale solutions: (a) Routed leaf-spine fabric: every inter-switch link is an L3 routed (IP) link using ECMP (Equal-Cost Multi-Path). All paths are active simultaneously — no blocking, full bandwidth utilization, no STP needed. L3 routing convergence via OSPF/BGP replaces STP. (b) VXLAN overlay: L2 semantics are preserved for VM-to-VM communication by encapsulating Ethernet frames in VXLAN UDP tunnels between VTEP endpoints. The underlay is purely L3 (no L2 loops), so STP is irrelevant. (c) BGP EVPN as control plane: distributes MAC/IP bindings, replaces L2 flooding for ARP, provides consistent multi-site fabric extension. The result: zero dependency on STP in the physical underlay. L2 loops are architecturally impossible in a fully routed underlay. STP may run within individual hypervisor virtual switches but is contained to the hypervisor and never escapes to the physical fabric.

🎯 Key Takeaways

✓STP prevents broadcast storms in redundant Ethernet topologies by blocking ports that would create loops — creating a logical tree over a physical mesh.
✓Root Bridge election uses Bridge ID (priority + MAC); the lowest BID wins. Explicitly set priority on core switches to control which switch becomes Root.
✓Port roles: Root Port (best path to Root, one per non-root switch), Designated Port (best port per segment), Alternate (blocked backup path), Backup (blocked duplicate Designated).
✓Classic STP convergence is 30–50 seconds due to Listening + Learning timers. RSTP (802.1w) achieves 1–6 seconds using Proposal/Agreement handshake instead of timers.
✓PVST+ runs one STP instance per VLAN (enabling load balancing). MSTP maps multiple VLANs to MST instances, reducing BPDU overhead dramatically.
✓PortFast bypasses Listening/Learning for access ports — pair it always with BPDU Guard, which err-disables the port if a BPDU is received (indicating a rogue switch).
✓Root Guard prevents unauthorized switches from becoming Root Bridge. Loop Guard prevents unidirectional link failures from causing loops. Both are critical hardening measures.
✓Modern data center leaf-spine topologies are fully routed (L3), making STP irrelevant at the underlay. VXLAN provides L2 overlay semantics without requiring STP.
✓STP attacks include Root Bridge spoofing (injecting low-priority BPDUs) and TCN flooding (forcing continuous MAC table flushes). BPDU Guard and Root Guard mitigate both.
✓RSTP port states are Discarding, Learning, and Forwarding — simpler than classic STP's five states. Edge ports (PortFast) skip directly to Forwarding for end-host connections.

Discussion

Have a better approach? Found something outdated? Share it — your knowledge helps everyone learning here.

Continue with GitHub