Spanning Tree Protocol (STP/RSTP) — Loop Prevention & Root Bridge Election

Redundant links between switches are mandatory for availability — and instantly fatal without help. Switches flood broadcasts out every port, and an Ethernet frame has no TTL: nothing in the header counts hops or expires, so a frame that enters a physical loop circulates and multiplies until the network saturates, in seconds. Spanning Tree Protocol keeps the physical redundancy but computes a loop-free logical tree over it, putting the cycle-forming links into standby. This is the protocol that makes a redundant Layer 2 network possible at all.

Intermediate layer-2 stp rstp spanning-tree loop-prevention root-bridge bpdu broadcast-storm bridge-id portfast bpdu-guard Created 2026-07-12 · Updated 2026-07-12

Key Components

Broadcast storm: The failure mode STP exists to prevent. A broadcast (or unknown-unicast) frame enters a physical loop, gets flooded out every other port at each switch, and — because Ethernet has no TTL to discard it — never dies. Each pass multiplies the copies, so link utilisation goes exponential and the whole Layer 2 domain stops carrying useful traffic. Two companion failures ride along: the same source MAC keeps arriving on different ports, so every switch's MAC-address table flaps and forwarding decisions become nonsense; and hosts receive duplicate copies of frames, confusing upper layers.
BPDU (Bridge Protocol Data Unit): The small multicast control frame switches exchange — by default every 2 seconds — to run the protocol. A BPDU carries essentially "here is who I think the root is, and here is my cost to reach it". Every decision STP makes is derived from comparing received BPDUs; a switch never needs a topology map, only its neighbours' claims.
Bridge ID (BID) and root bridge: The Bridge ID is an 8-byte identifier: a 2-byte priority (default 32768) followed by the switch's 6-byte MAC address. All switches elect the single root bridge — the reference point the whole tree is built around — as the one with the lowest BID. Because priority compares first, it is the intended tuning knob; if every switch keeps the default, the tie falls through to the lowest MAC address.
Path cost: A bandwidth-derived number assigned per link — faster links are cheaper — which sums along a path. The classic 802.1D values are 100 for 10 Mbps, 19 for 100 Mbps, 4 for 1 Gbps and 2 for 10 Gbps. "Distance to the root" always means cumulative path cost, never hop count, so STP naturally prefers a two-hop gigabit path over a one-hop 10 Mbps one.
Port roles: root, designated, blocking: Every port ends up in exactly one role. A non-root switch's single root port is its lowest-cost port toward the root — "my best way home" — and forwards. Each network segment elects one designated port, the port that forwards traffic onto that segment; all ports on the root bridge are designated by definition. Every remaining port is put into blocking: it drops data frames but keeps listening to BPDUs. Blocking exactly the ports that would close a cycle is what turns the graph into a tree.

Concrete Example

Start with the minimal disaster: two switches, two links between them, for redundancy. No protocol running.

        ┌──────── link A ────────┐
   [SW1]                          [SW2]
        └──────── link B ────────┘

A host on SW1 sends one ARP broadcast. SW1 floods it out both link A and link B. SW2 receives the copy from A and floods it out every other port — including B, back toward SW1. It receives the copy from B and floods it out A. SW1 now has two fresh copies to flood again. Nothing in the Ethernet header decrements, so nothing ever discards them: one frame becomes two, four, eight. Three distinct things break at once.

Failure	What actually happens
Broadcast storm	Copies multiply exponentially and saturate every link; the network is unusable within seconds.
MAC table instability	The same source MAC arrives on link A, then B, then A; each switch rewrites its MAC-address table entry every time, so unicast forwarding breaks too.
Duplicate delivery	Hosts receive many copies of a single frame, confusing protocols above Layer 2.

Now the interesting case, and the one worth tracing by hand: three switches wired in a triangle. Two of the links are 1 Gbps (cost 4), the third — between SW2 and SW3 — is 100 Mbps (cost 19). Nobody has configured anything, so all three carry priority 32768 and differ only by MAC address:

SW1   BID = 32768 : aa:aa:aa:aa:aa:aa      ← lowest MAC
SW2   BID = 32768 : bb:bb:bb:bb:bb:bb
SW3   BID = 32768 : cc:cc:cc:cc:cc:cc

SW1 —— 1 Gbps (cost 4) —— SW2
SW1 —— 1 Gbps (cost 4) —— SW3
SW2 —— 100 Mbps (cost 19) —— SW3

The three-step resolution follows mechanically. First, the root election: priorities tie at 32768, so the comparison falls through to the MAC address and SW1 wins on the lowest MAC. Both of SW1's ports become designated. Second, each non-root switch picks its root port by cumulative cost: SW2 can reach the root directly for 4, or via SW3 for 19 + 4 = 23, so the direct port wins; SW3 reasons identically. Third, the SW2–SW3 segment needs exactly one designated port. Both candidates advertise a root cost of 4 — a perfect tie — so the tiebreak drops to Bridge ID, and SW2 (bb) beats SW3 (cc). SW2's port on that segment becomes designated; SW3's port has no role left and blocks. The cycle is broken and the remaining topology is a tree: SW2 — SW1 — SW3.

Note what the outcome costs. Because the election was accidental, the root landed on whichever switch happens to have the oldest MAC — and all inter-switch traffic is now funnelled through it. On real gear you set this deliberately, and you also handle the access ports where end devices live:

Switch(config)# spanning-tree vlan 10 root primary   ! make this switch the root (lowers priority)
Switch(config)# spanning-tree vlan 10 priority 4096  ! ...or set the priority explicitly
Switch(config)# spanning-tree mode rapid-pvst        ! run the rapid variant

Switch(config-if)# spanning-tree portfast            ! access port: skip the convergence wait
Switch(config-if)# spanning-tree bpduguard enable    ! ...and shut the port if a BPDU appears

Switch# show spanning-tree vlan 10                   ! who is root, port roles/states, costs

PortFast and BPDU Guard are a pair, never used alone. PortFast declares "a PC cannot create a loop, so send this port straight to forwarding". BPDU Guard enforces the premise: if a BPDU ever arrives on such a port, something that is not a PC is plugged in — a rogue or misplaced switch — and the port is shut down immediately.

Visual Model

Think of the switches as rooms connected by corridors, and a broadcast as a shout that every room dutifully repeats into every corridor except the one it came from. In a network with no cycles, the shout dies out at the edges. Wire the rooms into a ring and the shout comes back around behind itself — and since nobody is counting how many times it has been repeated, it never gets tired. That missing counter is the whole story: at Layer 3, IP carries a TTL that a router decrements until the packet is dropped, so a routing loop wastes bandwidth but self-terminates per packet. Ethernet has nothing equivalent. A Layer 2 loop is permanent.

STP's answer is not to remove a corridor but to post a guard on it. The switches first agree on one room as the reference point — the root — then each remaining room works out its own cheapest corridor home, and every corridor that would close a ring gets a guard who refuses to pass traffic while still listening for news. Step through the triangle below: the storm first, because that is the motivation, then the election that tames it.

Step 1 of N

Loading…

Deeper — Edge Cases & Gotchas

Port states, and why classic STP is painfully slow

Choosing roles is instant arithmetic; acting on them is not. Classic 802.1D walks a port that is about to forward up through a sequence of timed port states, each a stage in how much of the job the port is allowed to do:

Blocking (20s)  →  Listening (15s)  →  Learning (15s)  →  Forwarding
   drops data       processes BPDUs      also learns         normal
   hears BPDUs      to settle roles      source MACs        operation

                                          total: ~30–50 seconds

The intermediate states exist for a good reason: Listening lets the topology settle before anyone commits to forwarding, and Learning populates the MAC-address table without yet forwarding, so the switch does not start life flooding everything. The price is that every topology change — including a link failure that redundancy was supposed to make invisible — costs roughly 30 to 50 seconds of outage on the affected path. For a file transfer that is annoying; for a voice call or a TCP session it is a hard failure.

RSTP (802.1w) closes the gap

Rapid Spanning Tree converges in milliseconds to a few seconds, and it is the modern default. The concepts above are unchanged — same root bridge, same Bridge IDs, same path costs, same root and designated ports — so nothing already learned is wasted. What changes is the machinery:

The five states collapse to three: Discarding, Learning, Forwarding.
Timers are replaced by an active proposal/agreement handshake between neighbours: instead of waiting a fixed 15 seconds hoping the topology has settled, two switches explicitly negotiate that a link may forward.
Two new roles are precomputed rather than recalculated on failure: an alternate port is a standing backup path to the root, and a backup port is a redundant path onto a segment already served. When the primary dies, the replacement is already chosen and can take over almost immediately.
Edge ports — ports facing end devices — go straight to forwarding, formalising what PortFast bolted on.

Two related variants are worth knowing by name. Cisco's PVST+ / Rapid-PVST+ runs one spanning tree instance per VLAN, which means different VLANs can be given different root bridges and therefore use different links — recovering the bandwidth that a single tree leaves idle. MSTP (802.1s) is the standards-based middle ground: one instance per group of VLANs, so you get the same load-distribution benefit without paying for an instance per VLAN.

Blocked does not mean disconnected

A blocking port is not administratively down and not unplugged. It drops data frames but continues to receive and process BPDUs, which is exactly how it notices when the active path fails. Unplug the SW1–SW3 link in the worked example and SW3 stops hearing the root through its root port; the protocol recomputes and transitions its blocked port toward forwarding — 30 to 50 seconds under classic STP, milliseconds to seconds under RSTP. That transition is the redundancy the second link was installed for. The fair version of the complaint is narrower: under a single spanning tree the blocked link's bandwidth genuinely sits idle, which is precisely the problem Rapid-PVST+ and MSTP solve by giving different VLANs different trees.

Anti-pattern: enabling PortFast on a switch-to-switch link.

! SW1 gi0/2 is a trunk to SW2 — someone treated it like an access port
SW1(config-if)# interface gi0/2
SW1(config-if)# switchport mode trunk
SW1(config-if)# spanning-tree portfast          ! ← catastrophic here

PortFast means "skip the Listening and Learning wait and forward immediately", and it is safe on an access port only because the premise "a PC cannot form a loop" holds there. On a trunk between switches the premise is false: the port starts forwarding before the topology has been resolved, so it can forward into a loop that STP has not yet blocked — reintroducing the storm the protocol was deployed to prevent. The mitigation is to pair PortFast with BPDU Guard everywhere it is used, so a port that starts hearing BPDUs (the unmistakable signal that a switch, not a host, is attached) is shut down rather than allowed to forward.

Anti-pattern: letting the root bridge be elected by accident.

! every switch left at the default
Priority 32768 on the new 10-Gbps core switch
Priority 32768 on a decade-old access switch in a cupboard   ← lower MAC, so it wins

With equal priorities the election falls through to the lowest MAC address, and MAC addresses tend to be lower on older hardware — so the root frequently lands on the oldest, slowest switch in the building. Because every path in the tree is computed relative to the root, this drags inter-switch traffic through the weakest device: a bandwidth bottleneck and a single point of failure chosen by accident. The fix is one line on the switch that should be root — spanning-tree vlan <id> root primary, or an explicit low priority — and it should be part of the standard build, not a remediation.

Two more things to keep straight

STP does not prevent loops instantly. It prevents steady-state loops. During convergence — after a link flaps, before all switches agree — a transient loop is genuinely possible, which is one more reason the RSTP convergence window matters. And STP is not gateway redundancy: it operates entirely at Layer 2 to keep the switched topology acyclic. Making a default gateway redundant is a Layer 3 problem solved by protocols such as HSRP or VRRP. The two are complementary, and confusing them leads to networks that survive a switch failure but not a router failure.

Test Yourself

Why is a Layer 2 loop fatal within seconds, when a Layer 3 routing loop merely wastes bandwidth?

Three switches, all left at factory defaults, no STP configuration. Which one becomes the root bridge?

Why is having the root bridge elected by accident a problem, and what is the fix?

A port has been blocking for months. Someone unplugs the active link. What happens, and what does that reveal about blocking ports?

Someone enables PortFast on a trunk between two switches "to speed up convergence". What breaks, and what single feature would have caught the mistake?