Skip to content

STP — Spanning Tree Protocol (IEEE 802.1d)

Purpose

Detect and avoid loops in networks with redundant paths. Works via special probe frames (BPDUs) sent out every 2 seconds.

Terminology

"Bridge" in the STP context = switch. Bridges made decisions in hardware, switches in software — same function.

The 4-Step STP Process

Step 1 — Determine the Root Bridge

  • The switch with the lowest Bridge ID (BID) becomes the Root Bridge
  • BID = Priority + System ID (VLAN) + MAC address
  • Default priority: 32768 — configurable in multiples of 4096 (0–61440)
  • Equal priority → lowest MAC wins

Pitfall

An older switch = lower MAC address → wins automatically. Steering this manually via priority is best practice.

Step 2 — Determine the Root Port (1 per non-root switch)

  • The port with the lowest path cost toward the Root Bridge
  • Cost depends on bandwidth: 1 Gbps = cost 4, 100 Mbps = cost 19
  • Tiebreak: lowest neighbor BID → lowest port priority → lowest port ID

Ports in the forwarding state:

  • All ports on the Root Bridge are designated
  • All ports toward end devices are designated
  • On inter-switch links: the port of the switch with the lowest path cost to the RB wins

Step 4 — Determine Alternate Ports

  • Anything that is neither a root port nor a designated port → alternate port
  • Blocked in software (blocking state)
  • On link failure: recalculation → the blocked port becomes active

Port States

State BPDU MAC table Data forwarding
Blocking Receive only No update No
Listening Send & receive No update No
Learning Send & receive Update No
Forwarding Send & receive Update Yes
Disabled None No update No

Types of STP

Type Standard Load Convergence Scope
STP 802.1D Low Slow All VLANs
PVST+ Cisco High Slow Per VLAN
RSTP 802.1w Medium Fast All VLANs
Rapid PVST+ Cisco Very high Fast Per VLAN

PVST+

Its own STP process per VLAN — a port can be blocked for VLAN 10 but active for VLAN 20.

PortFast & BPDU Guard

PortFast

The port skips the STP process and becomes active immediately.

Warning

Only use on access/edge ports (end devices, never on switches). Without PortFast, STP takes at least 30 seconds → possible DHCP timeout.

BPDU Guard

Always configure together with PortFast.

  • If a PortFast port receives a BPDU anyway → the port goes into an error state
  • Only the admin can clear the error

Things to Watch Out For

Watch out

  • All switches must support STP and be configured correctly — 1 switch without STP = problems
  • Not all implementations automatically activate blocked ports after recovery → sometimes manual work is needed
  • Loop protection also helps against accidental loops (a loose patch cable, an experimenting student, ...)
  • Extra network load from periodic BPDUs — a bad configuration means lost performance
  • No 100% guarantee: an unmanaged L2 switch that someone brings in falls outside the control of STP