Chapter 14: Spanning Tree Protocol
Introduces STP as Cisco switches’ default solution to Layer 2 loops and explains why the original protocol comes before Rapid STP.
After this chapter you will be able to
- STP and Layer 2 loops. Explain what network problem STP solves and where it runs by default.
- Layer 2 loop risk. Explain why frames can loop indefinitely between switches, unlike IP packets caught in a routing loop, and why STP is needed.
- Redundancy and flooded traffic. Explain how redundant paths both preserve connectivity after a failure and create Layer 2 loops when switches flood BUM traffic.
- Blocking redundant connections. Explain how STP prevents Layer 2 loops by blocking redundant connections, and describe what blocked and forwarding ports do.
- Root bridge election process. Explain why STP elects one root bridge and how switches use BPDUs to agree on it.
- Bridge identifier composition. Describe the parts of a BID and explain why PVST+ adds the VLAN ID to its bridge priority.
- Lowest BID comparison. Apply the BID comparison rule to identify the root bridge, including how MAC addresses break equal-priority ties.
- Configured root bridge priority. Explain how an explicit per-VLAN priority can change the root election and why configured values must be multiples of 4096.
- Root port and path cost. Explain that each non-root switch selects one root port as its best path to the root bridge, using the lowest total root cost first. Trace how BPDU root costs increase as switches forward them away from the root.
- Neighbor bridge ID tiebreaker. Describe how a switch breaks a tie between ports with equal root costs by comparing the BIDs of the neighbors connected to those ports.
- Neighbor port ID tiebreaker. Explain how a switch makes the final root-port choice when cost and neighbor BID are tied, including which switch’s port IDs it compares.
- Designated and non-designated port roles. Explain how designated ports point away from the root bridge and why each segment has exactly one designated port. Describe how non-designated ports block to prevent loops.
- Designated port selection order. Apply the selection order to a remaining segment: compare the switches’ root costs first, then their bridge IDs if costs tie. Identify which port becomes designated and which becomes non-designated.
- STP Roles and Port States. Distinguish STP port roles from port states, and explain how forwarding and blocking states relate to the roles in a stable LAN.
- STP Port State Behaviors. Distinguish blocking, listening, learning, and forwarding by whether a port handles BPDUs, learns MAC addresses, or forwards regular traffic; explain why disabled is usually excluded.
- Role-Driven State Transitions. Trace a newly enabled port from listening to blocking if it becomes non-designated, or through learning to forwarding if it becomes a root or designated port. State the 15-second listening and learning intervals described here.
- Root bridge timer settings. Explain what the hello timer controls and whose timer settings switches use throughout the LAN.
- Forward delay and loop prevention. Describe how the forward delay timer affects a port entering forwarding and why STP waits.
- Max age and recovery delay. Trace how max age and forward delay affect recovery when BPDUs stop arriving, and distinguish that case from a port going down completely.
- STP delay on device ports. Explain why a PC connected to a switch port can face a delay before accessing the network, even though that port presents no risk of a Layer 2 loop.
- PortFast forwarding and safe use. Explain that PortFast moves a switch port immediately to the forwarding state by bypassing listening and learning, so a connected end host can access the network immediately. Explain why it should be enabled only on ports intended for end hosts.
- BPDU Guard on PortFast Ports. Explain why BPDU Guard should be enabled on PortFast ports and what it does when a BPDU arrives.
What it builds on
- The TTL field (chapter 7) · Introduces the IPv4 TTL field.
- Frame flooding and forwarding (chapter 6) · Introduces frame flooding by switches.
- MAC address learning (chapter 6) · Introduces MAC address learning.
- Layer 2 segmentation with VLANs (chapter 12) · VLANs provide separate Layer 2 segments.
- Global configuration mode (chapter 5) · The distinction between interface and global configuration modes.
Section by section
Introduction
Introduces STP as Cisco switches’ default solution to Layer 2 loops and explains why the original protocol comes before Rapid STP.
- STP and Layer 2 loops: Explain what network problem STP solves and where it runs by default.
Why it matters: This gives you the reason STP is needed before you study how it works.
Key terms: Spanning Tree Protocol (STP), Layer 2 loops
14.1 The need for STP
This section explains why redundant switched LANs need STP: flooded frames can loop indefinitely, causing broadcast storms and MAC address flapping.
- Layer 2 loop risk: Explain why frames can loop indefinitely between switches, unlike IP packets caught in a routing loop, and why STP is needed.
Why it matters: The lack of a frame lifetime explains why a switched LAN needs loop prevention. - Redundancy and flooded traffic: Explain how redundant paths both preserve connectivity after a failure and create Layer 2 loops when switches flood BUM traffic.
Why it matters: Redundant links are valuable, but flooding makes them unsafe without loop prevention. - Broadcast storm consequences: Describe how accumulating looping frames produce a broadcast storm and affect switches, links, and end hosts.
Why it matters: A loop can rapidly disrupt the whole LAN, not just the links between switches. - MAC address flapping: Trace how a loop makes a switch relearn one host’s MAC address on different ports and disrupt delivery to that host.
Why it matters: Loops can break frame delivery even apart from the resources consumed by a storm.
Key terms: Time-to-Live (TTL), Layer 2 loop, Layer 3 loop, STP, redundancy, BUM traffic, broadcast, unknown unicast, multicast, single point of failure
14.2 How STP works
This section explains how STP turns a physically redundant switched LAN into a loop-free logical topology while keeping blocked links available as backups.
- Blocking redundant connections: Explain how STP prevents Layer 2 loops by blocking redundant connections, and describe what blocked and forwarding ports do.
Why it matters: It explains how a LAN can retain backup connections without letting frames loop. - Physical and logical topologies: Distinguish the physical connections among switches from the logical STP topology, and explain why the result is called a spanning tree.
Why it matters: The distinction shows how a physically meshed LAN can operate as a loop-free network.
Key terms: STP, Layer 2 loops, blocking state, forwarding state, physical topology, STP topology, logical topology, spanning tree, mesh
14.3 The STP algorithm
Introduces the STP algorithm as the process that creates a loop-free topology and previews its three steps.
14.3.1 Root bridge election
This section explains how switches elect an STP root bridge by comparing bridge identifiers and how bridge priority can be configured to influence the election.
- Root bridge election process: Explain why STP elects one root bridge and how switches use BPDUs to agree on it.
Why it matters: The root bridge gives the other switches a common reference for the spanning tree. - Bridge identifier composition: Describe the parts of a BID and explain why PVST+ adds the VLAN ID to its bridge priority.
Why it matters: The BID’s structure explains both root-election comparisons and why a switch has different BIDs in different VLANs. - Lowest BID comparison: Apply the BID comparison rule to identify the root bridge, including how MAC addresses break equal-priority ties.
Why it matters: This rule lets you predict the elected root rather than guessing from the network diagram. - Configured root bridge priority: Explain how an explicit per-VLAN priority can change the root election and why configured values must be multiples of 4096.
Why it matters: Explicit priorities let an administrator place the spanning-tree reference point near a useful path and choose the likely replacement if it fails. - Root command limitations: Distinguish the primary and secondary root shortcuts from an explicit priority setting and explain their limits.
Why it matters: The shortcut names sound definitive, but their resulting priorities—not their names—determine the election.
Key terms: root bridge, BPDU, bridge identifier (BID), BID, bridge priority, MAC address, Extended System ID, PVST+, superior BPDU, lowest BID
14.3.2 Root port selection
This section explains how each non-root switch selects its root port by comparing path cost, then the neighbor’s bridge ID, then the neighbor’s port ID.
- Root port and path cost: Explain that each non-root switch selects one root port as its best path to the root bridge, using the lowest total root cost first. Trace how BPDU root costs increase as switches forward them away from the root.
Why it matters: Path cost is the first comparison a switch makes when choosing its route to the root bridge. - Neighbor bridge ID tiebreaker: Describe how a switch breaks a tie between ports with equal root costs by comparing the BIDs of the neighbors connected to those ports.
Why it matters: A cost tie does not leave the choice arbitrary: the neighbor’s identity supplies the next comparison. - Neighbor port ID tiebreaker: Explain how a switch makes the final root-port choice when cost and neighbor BID are tied, including which switch’s port IDs it compares.
Why it matters: Looking at the local port number instead of the neighbor’s can produce the wrong root-port choice.
Key terms: root port, root bridge, root cost, BPDUs, neighbor BID, neighbor port ID, port ID
14.3.3 Designated port selection
Explains how STP selects one designated port per segment, blocks non-designated ports, and sends BPDUs through designated ports.
- Designated and non-designated port roles: Explain how designated ports point away from the root bridge and why each segment has exactly one designated port. Describe how non-designated ports block to prevent loops.
Why it matters: These roles explain how STP keeps a path available without allowing a switching loop. - Designated port selection order: Apply the selection order to a remaining segment: compare the switches’ root costs first, then their bridge IDs if costs tie. Identify which port becomes designated and which becomes non-designated.
Why it matters: The comparison order lets you determine port roles on links that remain after root ports are chosen. - Segment meaning in STP: Distinguish the segment used for designated-port selection from the section’s Layer 2 and Layer 3 uses of the word.
Why it matters: It clarifies what receives exactly one designated port in the examples. - BPDU transmission by designated ports: Describe which ports send BPDUs after roles are decided and why a newly booted switch initially sends them on all ports.
Why it matters: BPDU behavior shows why the ports a switch sends from can change as STP assigns roles.
Key terms: designated port, non-designated port, segment, forwarding state, blocking state, root cost, BID, Layer 1 segment, Layer 2 segment, Layer 3 segment
14.4 STP port states and timers
Distinguishes STP port roles from port states and explains which ports forward or block frames in a stable LAN.
- STP Roles and Port States: Distinguish STP port roles from port states, and explain how forwarding and blocking states relate to the roles in a stable LAN.
Why it matters: Separating a port’s role from its state helps you describe which links carry frames in a stable STP network.
Key terms: STP port roles, port states, forwarding state, blocking state, root ports, designated ports
14.4.1 STP port states
Explains what STP ports do in each state, how port roles determine state transitions, and when the network has converged.
- STP Port State Behaviors: Distinguish blocking, listening, learning, and forwarding by whether a port handles BPDUs, learns MAC addresses, or forwards regular traffic; explain why disabled is usually excluded.
Why it matters: A port can be operational without yet forwarding data, so its STP state matters when interpreting its behavior. - Role-Driven State Transitions: Trace a newly enabled port from listening to blocking if it becomes non-designated, or through learning to forwarding if it becomes a root or designated port. State the 15-second listening and learning intervals described here.
Why it matters: The port’s role determines whether it blocks traffic or progresses toward forwarding. - STP Convergence and Reconvergence: Explain when STP has converged and what happens when a network change requires a new stable topology.
Why it matters: Convergence describes the stable outcome of the port-state transitions and what must be restored after a network change.
Key terms: blocking, listening, learning, forwarding, disabled, BPDUs, listening state, learning state, blocking state, forwarding state
14.4.2 STP timers
Explains STP’s three timers, why they delay forwarding, and how those delays affect recovery after a failure.
- Root bridge timer settings: Explain what the hello timer controls and whose timer settings switches use throughout the LAN.
Why it matters: The root bridge’s settings explain why the same timer values apply across the LAN. - Forward delay and loop prevention: Describe how the forward delay timer affects a port entering forwarding and why STP waits.
Why it matters: The 30-second wait is a safeguard against loops, not simply an unexplained delay. - Max age and recovery delay: Trace how max age and forward delay affect recovery when BPDUs stop arriving, and distinguish that case from a port going down completely.
Why it matters: This explains why a failed path can leave traffic interrupted even when a redundant link exists.
Key terms: hello timer, BPDUs, root bridge, designated ports, forward delay timer, listening, learning, forwarding state, Layer 2 loop, max age timer
14.5 PortFast and BPDU Guard
This section explains why ordinary STP operation can delay network access on ports connected to devices such as PCs, setting up the discussion of optional STP features.
- STP delay on device ports: Explain why a PC connected to a switch port can face a delay before accessing the network, even though that port presents no risk of a Layer 2 loop.
Why it matters: It explains why users can experience a connection delay on a port that cannot create a Layer 2 loop.
Key terms: STP, designated ports, Layer 2 loop, forwarding state
14.5.1 PortFast
Explains how PortFast gives end hosts immediate network access, how to enable it, and why it must be limited to end-host ports.
- PortFast forwarding and safe use: Explain that PortFast moves a switch port immediately to the forwarding state by bypassing listening and learning, so a connected end host can access the network immediately. Explain why it should be enabled only on ports intended for end hosts.
Why it matters: PortFast can give end hosts immediate access without creating the loop risk associated with using it on a switch-to-switch connection. - PortFast configuration scope: Describe the two commands for enabling PortFast and distinguish the ports each applies to.
Why it matters: The command choice determines whether PortFast applies to one port or to all access ports.
Key terms: PortFast, forwarding state, listening, learning, Layer 2 loops, spanning-tree portfast, spanning-tree portfast default, interface config mode, global config mode, access ports
14.5.2 BPDU Guard
This section explains why BPDU Guard belongs on PortFast ports, how to enable it, and what happens when it disables a port.
- BPDU Guard on PortFast Ports: Explain why BPDU Guard should be enabled on PortFast ports and what it does when a BPDU arrives.
Why it matters: It protects the spanning-tree topology when a switch is connected where only an end host should be. - BPDU Guard Configuration Options: Describe the interface-level and global commands for enabling BPDU Guard, including which ports the global command affects.
Why it matters: The global option helps apply the recommended protection consistently across PortFast ports. - Error Disabled Port Recovery: Describe the port state after BPDU Guard receives a BPDU and how to restore the port safely.
Why it matters: Resetting the port without first removing the unexpected switch would leave the underlying problem unresolved.
Key terms: BPDU Guard, PortFast, BPDU, STP topology, spanning-tree bpduguard enable, spanning-tree portfast bpduguard default, interface config mode, global config mode, error-disabled state, down/down
14.6 Summary
Where this is used later
- STP and RSTP comparison (chapter 15) · Compares the original protocol with Rapid STP.
- (chapter intro) (chapter 15) · The need to prevent Layer 2 loops.
- BPDU Filter (chapter 15) · Why Layer 2 loops require spanning tree.
- Spanning Tree Protocol versions (chapter 15) · Assumes the purpose of a spanning tree and its active and disabled links.
- Root Guard (chapter 15) · Root bridge election and the significance of bridge IDs
- Port costs (chapter 15) · STP’s use of path costs in root port selection
- Port roles (chapter 15) · Root port selection in STP
- Port states (chapter 15) · Provides the standard STP states to compare with RSTP port states.
Concepts explained in this chapter
- spanning tree protocolThe spanning tree algorithm is the procedure for electing a root bridge and selecting root and designated ports to create a loop-free spanning-tree topology.
- bridge protocol data unitA bridge protocol data unit is a control message exchanged by spanning-tree-enabled switches to communicate topology information and determine port roles.
- root bridgeA root bridge is the spanning-tree switch selected as the reference point for calculating paths in a Layer 2 topology.
- bridge identifierA bridge identifier, or bridge ID, is a 64-bit value that identifies a switch within a spanning-tree instance and is advertised in bridge protocol data units.
- forwarding stateThe forwarding state is an STP port state in which a switch can learn MAC addresses and forward ordinary frames.
- bridge priorityBridge priority is the 16-bit priority component of a spanning-tree bridge identifier, combining a configurable value with the VLAN identifier.
- extended system idThe Extended System ID is the portion of a spanning-tree bridge priority that identifies the VLAN associated with the spanning-tree instance.
- blocking stateThe blocking state, called the discarding state in RSTP, is a spanning-tree port state in which normal data frames are not forwarded or learned while control messages may still be processed.
- root portRoot port selection is the spanning-tree procedure for choosing the port on a non-root bridge that provides its best path toward the root bridge.
- designated portA designated port is an STP port in the forwarding state that provides the preferred path away from the root bridge for a network segment.
- port idA port ID is a unique STP identifier for a switch port, consisting of a port priority and a sequential port number.
- root costRoot cost is the cumulative spanning-tree path cost from a switch through a port to the root bridge.
- network loopA Layer 2 loop is a cyclic forwarding path at the data-link layer that can cause frames to circulate repeatedly through switches.
- learning stateThe learning state is an STP port state in which a port listens for BPDUs and learns MAC addresses but does not yet forward traffic.
- listening stateThe listening state is an STP transitional port state in which a switch port prepares for forwarding without learning MAC addresses or forwarding data frames.
- root bridge electionRoot bridge election is the spanning-tree procedure for selecting the bridge that serves as the reference point for the spanning-tree topology.
- PVST+PVST+ is Cisco's spanning-tree implementation that maintains a separate spanning-tree instance for each VLAN and supports ISL and 802.1Q trunk encapsulation.
- spanning-tree instanceA spanning-tree instance is an independently running spanning-tree protocol instance associated with one VLAN or a group of VLANs.
- non-designated portAn alternate port is an RSTP port that provides an alternate path toward the root bridge and can transition to forwarding if the root port fails.
- broadcast stormA broadcast storm is an excessive volume of broadcast or similar replicated traffic that consumes network resources and can make a network unusable.
- BUM trafficBUM traffic is broadcast, unknown-unicast, and multicast frame traffic that switches may replicate across multiple ports.
- OSPF hello timerAn OSPF hello timer is the interval between successive OSPF hello messages sent by an interface.
- forward delay timerA forward delay timer is an STP timing parameter that determines how long a port remains in the listening and learning states before forwarding frames.
- max age timerA max age timer is an STP timing parameter that specifies how long a switch waits without receiving BPDUs before recalculating the spanning-tree topology.
- BPDU GuardBPDU Guard is a switch-port protection feature that places a port into an error-disabled state when the port receives a Bridge Protocol Data Unit.
- error-disabled stateAn error-disabled state is a Cisco switch-port state in which the port is administratively and operationally disabled because of a detected error or protection violation.
- PortFastThe spanning-tree portfast command is a Cisco IOS interface-configuration command that enables PortFast on a switch port.
- designated port selectionDesignated port selection is the spanning-tree procedure for choosing the forwarding port for each network segment.
- stp port stateAn STP port state is an operational condition that determines whether a switch port participates in control messaging, learns MAC addresses, and forwards data frames.
- stp port roleAn STP port role is a spanning-tree assignment that determines how a switch port participates in the loop-free topology.
← Chapter 13: Dynamic Trunking Protocol and VLAN Trunking Protocol
Chapter 15: Rapid Spanning Tree Protocol →
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.