On this page
Why a loop kills a switched network802.1D: root bridge election and path costPort roles and statesRSTP and MSTPRoot guard, BPDU guard and edge portsFoundry heritage: STP, RSTP, MSTP and the alternativesQuestions01 /Why a loop kills a switched network
Ethernet frames have no time-to-live. A broadcast entering a loop is forwarded by every switch out every port except the one it arrived on, comes back around, and is forwarded again, forever. Within seconds the loop saturates every link with copies of the same ARP request: a broadcast storm. At the same time each switch sees the same source MAC arriving on different ports and rewrites its forwarding table on every frame, called MAC flapping, so unicast traffic is misdirected as well. CPUs pin, management sessions die, and the cure is pulling cables.
Redundant links are still desirable; a single uplink per closet means a single failure isolates the closet. Spanning tree exists so that redundancy and loop-freedom can coexist: physical loops are allowed, logical loops are not.
02 /802.1D: root bridge election and path cost
Every switch sends Bridge Protocol Data Units (BPDUs) carrying its bridge ID, a 2-byte priority (default 32768) followed by its MAC address. The lowest bridge ID becomes the root bridge. Every other switch computes its cheapest path to the root using per-link costs (higher speed, lower cost) and keeps exactly one root port toward it. On each segment one side is the designated port that forwards toward the root; any other port that would close a loop is blocked.
With default priorities the root is whichever switch has the lowest MAC address, which is often the oldest or cheapest switch in the building. Traffic then flows through the wrong place and uplinks from the real core end up blocked.
Set your root deliberately. Give the core or distribution switch priority 4096 and its partner 8192. Leave every access switch at default. Repeat for every instance if you run per-VLAN or MSTP instances.
03 /Port roles and states
| Role (RSTP) | Meaning | State |
|---|---|---|
| Root | Best path toward the root bridge | Forwarding |
| Designated | Forwards toward the root on its segment | Forwarding |
| Alternate | Backup path to the root, held in reserve | Discarding |
| Backup | Redundant port on the same segment | Discarding |
| Edge | Host-facing, skips negotiation | Forwarding immediately |
04 /RSTP and MSTP
RSTP (802.1w) replaces timer-based convergence with an explicit proposal and agreement handshake between neighbours on point-to-point links. When a root port fails, a pre-computed alternate port takes over immediately. Convergence falls to about a second on well-designed topologies. RSTP also defines edge ports for hosts, which forward immediately and do not generate topology changes when a PC powers on.
MSTP (802.1s) maps VLANs to a small number of spanning-tree instances, so two instances can carry different VLAN groups over different uplinks and use both. It runs RSTP mechanics per instance inside an MST region. The proprietary per-VLAN variants (PVST and PVST+) that predate it run one full instance per VLAN, which costs CPU as VLAN counts grow and interoperates with standards-based switches only through the common instance.
05 /Root guard, BPDU guard and edge ports
- BPDU guard on host ports: if a BPDU arrives, shut the port. Stops a rogue switch or a bridged laptop from joining the tree.
- Root guard on ports facing downstream switches: if a superior BPDU arrives, block the port. Stops a new switch with a low bridge ID from taking over as root.
- Loop guard or unidirectional link detection: if BPDUs stop arriving on a blocked port, keep it blocked rather than assuming the neighbour is gone.
- Edge ports on every host port, never on switch-to-switch links or aggregated uplinks.
06 /Foundry heritage: STP, RSTP, MSTP and the alternatives
IronWare on FastIron and BigIron switches supported 802.1D per VLAN, later 802.1w and 802.1s, and fast-uplink and fast-port options that approximated RSTP behaviour before it was standardised. Foundry also sold two proprietary protocols to avoid spanning tree convergence in the topologies where it hurt most. VSRP (Virtual Switch Redundancy Protocol) gave a pair of aggregation switches sub-second failover for the access switches below them, described on the VRRP and VSRP page. MRP (Metro Ring Protocol) protected ring topologies with a single master node and one blocked ring port, converging far faster than STP on rings of many nodes.
! enable RSTP on a VLAN and make this switch the root vlan 10 spanning-tree 802-1w spanning-tree 802-1w priority 4096 ! ! host-facing ports as edge ports interface ethernet 1/1 to 1/12 spanning-tree 802-1w admin-edge-port ! show 802-1w show span
07 /Questions
Do I still need spanning tree?
Yes, on any Layer 2 domain with more than one switch. Even a design with no intentional loops needs it as protection against an accidental one. Modern designs shrink the Layer 2 domain and route between closets so the tree is small, but they still run RSTP with BPDU guard.
What is the difference between STP and RSTP?
STP (802.1D) converges through fixed timers and takes 30 to 50 seconds after a failure. RSTP (802.1w) uses a handshake between neighbours and pre-computed alternate ports, converging in about a second. RSTP is backward compatible and should be the default.
How do I pick the root bridge?
Lower the bridge priority on the switch that should be root, in steps of 4096. Choose the switch at the centre of traffic, usually the core or distribution layer, and give its redundant partner the next lowest priority so failover is predictable.
What does BPDU guard do?
It disables a port the moment a BPDU is received. Applied to host-facing edge ports, it prevents an unmanaged switch, a bridging virtual machine host or a looped patch cable from participating in the tree. The port usually needs a manual or timed re-enable.
Why did Foundry offer VSRP and MRP?
Because STP convergence in the early 2000s was too slow for voice and for large rings. VSRP gave sub-second failover between redundant aggregation switches, and MRP protected metro Ethernet rings, both without waiting for spanning tree timers.
Sources
- IEEE Std 802.1D-1990 and 802.1D-2004, MAC Bridges (RSTP originally IEEE 802.1w-2001)
- IEEE Std 802.1Q-2005 and later, Virtual Bridged LANs (MSTP originally IEEE 802.1s-2002)
- R. Perlman, An Algorithm for Distributed Computation of a Spanning Tree in an Extended LAN, ACM SIGCOMM, 1985
- Foundry Networks, FastIron and BigIron configuration guides, spanning tree and VSRP chapters (original Foundry documentation, historical, around 2003 to 2007)