Spanning Tree

802.1D Overview

Spanning Tree Protocol (STP) provides network link redundancy so that a Layer 2 switched network can recover from failures without intervention in a timely manner.

Transparent Bridge - A network device that isolates two physical LANs but forwards ethernet frames between them. Frames forwarded across the bridge cannot be modified by the bridge itself. Therefore, the bridging process is effectively transparent.

Spanning Tree Communication: Bridge Protocol Data Units

Configuration BPDU, used for spanning-tree computation.
Topology Change Notification (TCN) BPDU, used to announce changes in the network topology.

BPDU Message Content

Protocol ID                                  2
Version                                        1
Message Type (Config / TCN) 1
Flags                                            1
Root Bridge ID                          8
Root Path Cost                             4
Sender Bridge ID                       8
Port ID                                         2
Message Age                                2
Maximum Age                              2
Hello Time                                    2
Forward Delay                              2


Electing a Root Bridge

Bridge ID is an 8-Byte value with the following fields:

Bridge Priority (2 bytes) Values: 0 - 65,535, and defaults to 32,768.

MAC Address (6 bytes) Hard coded unique value.

1.) Root bridge is elected.

Every switch begins by sending out BPDUs with a root bridge and sender bridge equal to its own bridge ID.
After the root bridge is elected, configuration BPDUs are sent out only by the Root Bridge. All other bridges must forward or relay the BPDUs, adding their own sender bridge IDs to the message.

Best bridge ID has the lowest value.

Root bridge election is an ongoing process, triggered by root bridge ID changes in the BPDUs every 2 seconds.

2.) Electing Root Ports

Each non-root switch must figure out where it is in relation to the root bridge. This is done by selecting only one non-root port for each non root switch. The root port always points to the current root bridge.

 Calculate the root path cost to select the root port. This is the cumulative value of all links leading to the root bridge.

Only the root path cost is carried in the BPDU. As the root path cost travels along, other switches can modify it's value to make it cumulative. The path cost is local to the switch and not carried in the BPDU.


4 Mbps       250
10 Mbps     100
100 Mbps    19
1Gbps          4
10 Gbps       2

The root path cost is incremented by the ingress port path cost as the BPDU is received at each switch down the line.

3.) Electing Designated Ports

The final step in the election process. Elects one designated port on each network segment.

For each determination process, if two or more links have equal root path costs, other factors need to be considered to break up the tie.

1.) Lowest root bridge ID
2.) Lowest root path cost to root bridge
3.) Lowest sender bridge ID
4.) Lowest sender port ID

STP State           The Port Can...                     The Port cannot...             Duration

Disabled             N/A                                       Send or receive data         N/A

Blocking             Receive BPDUs                   Send or receive data or   Indefinite as long as loop
                                                                          learn MAC addresses     has not been detected.

Listening            Send and receive BPDUs     Send or receive data or   Fwd delay timer 15 secs
                                                                          learn MAC addresses

Learning             Send and receive BPDUs     Send and receive data  Fwd delay timer 15 secs
                            and learn MAC addresses   

Forwarding         Send and receive BPDUs,
                            Learn MAC addresses,                                               Indefinite as long as port is 
                            and send and receive data.                                          up and loop is not detected.

STP Portfast feature on a port with a single attached PC. TCNs are not sent when the port changes state, the port is brought into the Forwarding state when the link comes up.

In 802.1Q. All CST BPDUs are transmitted over trunk links using the native VLAN with untagged frames.  

PVST - Cisco Proprietary - Requires ISL.

PVST+ - Provides interoperability between CST and PVST - Both 802.1Q and ISL.   

Root Port: The one port on a switch that is closest to the root bridge.

Designated Port: The port on a LAN segment that is closest to the root. Relays, or transmits, BPDUs down the tree.

Blocking Port: Neither root or designated.

Alternate Port:  Candidates for root ports. Close to the root bridge and in blocking state.

Forwarding Ports: No other STP activity is detected or expected. Normal end user connections.

Root Guard

Means to  control where candidate root bridges can be connected and found on a network. If it receives a superior BPDU, the port will be moved and kept in the root-inconsistent state until the superior BPDUs cease.

The switch can only forward or relay BPDUs; the port cannot be used to receive BPDUs.

When superior BPDUs are no longer received, the port is cycled through the normal STP states to return to normal use.

BPDU Guard   

Developed to further protect the integrity of switch ports that have PortFast enabled. If any BPDU is received on a port, that port is immediately put into the errdisable state.

When the BPDUs no longer are received, the port still remains in the errdisable state.

Use BPDU Guard on all switch ports where STP PortFast is enabled.


If the absence of BPDUs is actually a mistake and BPDUs are not being received even though there is no topology change, bridging loops can form.

Loop Guard - When BPDUs go missing, Loop Guard moves the port into the loop-inconsistent state.

When BPDUs are received again, Loop Guard allows the port to move through the normal STP states and become active.

Blocks on a per-Vlan basis, so the the entire port is not blocked.

Loop Guard can be enabled on all switch ports.

UDLD - 

A unidirectional link poses a potential danger to STP topologies because BPDUs will not be received on one end of the link. If that end of the link would normally be in the blocking state, it will not be that way for long.

Use the Cisco proprietary UDLD STP feature to prevent this.

Uses an echo process to determine if both sides are up or not. Both sides need to be configured.

UDLD can detect a unidirectional link after about three times the UDLD message interval (45 seconds total) using default. Needs to detect the link failure before STP moves it into forwarding state.

Can be enabled per port or globally for fiber optic switch ports.

Enabling UDLD globally does not affect copper media because it does not suffer from the conditions that allow a unidirectional link to form.

Once UDLD aggressive mode has put a switch port into errdisable state, you must use the following command to reenable it.

Switch# udld reset

Rapid Spanning Tree Protocol 

By default, a switch operates in Per-VLAN Spanning Tree Plus (PVST+) mode using traditional 802.1D STP.

Root Port:  The one root port that has the best root path cost. Identical to 802.1D

Designated Port: Best root path cost to the root.

Alternate Port: Alternate path to the root, different from the path the root port takes.

Backup Port: Redundant but less desirable connection to a segment where another switch port already connects.

Defines states only according to what the port does with incoming frames.

Discarding - Incoming frames are simply dropped. No MAC addresses learned. Combines 802.1D Disabled, Blocking, and Listening. (The Listening state is not needed because RSTP quickly can negotiate a state change without listening for BPDUs first).

Learning - Incoming frames are dropped, MAC addresses are learned.

Forwarding - Incoming frames are forwarded according according to their corresponding MAC addresses.


Edge Port - Port at the "edge of the network where only one host connects. Switch# spanning-tree portfast

Root Port -  Port that has the best cost to the root of the STP instance. Only one root port, although alternative paths can exist on other ports.

Point-to-point port -  Any port that connects to another switch and becomes a designated port. BPDUs are exchanged back and forth in the form of a proposal and agreement.