CCNA 200-301 · 7 of 16

Spanning tree: the protocol that saves the network from itself

Why a single redundant cable can take down a whole switched network in seconds, how switches elect a root and block their way back to a loop-free tree, what RSTP changed, and the edge-port protections every access switch should have.

Updated 2026-09-09

On this page

Plug a cable between two ports on the same switch and, without spanning tree, the network stops working in about two seconds. Not slows down — stops. The reason is a single design decision made in the 1970s: an Ethernet frame has no time-to-live field, so nothing ever makes a looping frame expire. Spanning tree is the protocol that finds every redundant path and switches it off, keeping it in reserve, and it has been quietly holding switched networks together ever since.

The map

Read this first when short on time. Every branch is a section below.

Figure 1. The whole article on one page. Every branch is a section below; fold what you know, open what you do not.

The problem: a frame that never dies

Redundancy is good. Two switches joined by two cables should survive one cable failing. At layer 3 this is uncontroversial, because an IP packet carries a TTL that decrements at every hop and eventually reaches zero. An Ethernet frame has no such field. Nothing in the frame counts hops, so nothing ever tells a switch to stop forwarding it.

Now recall the rule from the switching article: an unknown unicast or a broadcast is flooded out every port except the one it arrived on. Put two switches together with two links and follow one broadcast:

PC-A sends a broadcast. Switch 1 floods it out both links to Switch 2.
Switch 2 receives two copies. It floods each one out every other port — including the other inter-switch link.
Switch 1 now receives both copies back and floods them again.
The number of copies doubles every cycle, at wire speed, forever.

Within a couple of seconds the links are saturated and both switches are spending all their CPU on flooding. Three distinct symptoms appear together, and recognising the combination is what identifies a loop:

Symptom	What you see
Broadcast storm	Link utilisation pinned at 100 percent, switch CPU at 100 percent, console unresponsive
MAC table instability	The same MAC address learned on one port, then another, then back — logged as a "host flapping" message
Duplicate delivery	Hosts receive multiple copies of every frame, which breaks protocols that assume one

Figure 2. A layer 2 loop. The absence of a TTL is the whole problem: nothing in the frame or the switch counts how many times it has been around.

Spanning Tree Protocol, standardised as IEEE 802.1D, solves it by computing a tree — a topology with exactly one path between any two points — and putting every link that is not part of that tree into a blocking state. The redundancy still exists physically; it is simply held in reserve until the tree changes.

Electing a root

Building a tree requires agreeing where the top is. Switches do this by exchanging BPDUs — bridge protocol data units — small frames sent every two seconds to a reserved multicast address that switches consume rather than forward.

Each switch has a bridge ID, and the lowest bridge ID wins. The ID has three parts:

Part	Size	Note
Priority	4 bits	Configurable in steps of 4096; default 32768
Extended system ID	12 bits	The VLAN number, so each VLAN's tree differs
MAC address	48 bits	The switch's own base address; the tie-breaker

The election is almost aggressively simple. Every switch boots believing it is the root and says so in its BPDUs. When it receives a BPDU claiming a better (lower) root ID than its own, it stops claiming and starts forwarding that better claim instead. Within a few seconds every switch agrees on one root.

Watch out

Priority defaults to 32768 everywhere, so the tie-breaker decides — and the tie-breaker is the lowest MAC address, which usually belongs to the oldest switch. Left alone, the root of your network tends to become the slowest, most obsolete box in the building, sitting in an access closet, with every path bending towards it. Always set the root explicitly.

! make this the root for VLANs 10 and 20, and the backup for 30
Switch(config)# spanning-tree vlan 10,20 root primary
Switch(config)# spanning-tree vlan 30 root secondary

! what those macros actually do
Switch(config)# spanning-tree vlan 10 priority 24576

Priority must be a multiple of 4096, because the lower 12 bits of that field hold the VLAN ID. This is also why show spanning-tree displays a priority like 32778 — that is 32768 plus VLAN 10.

Roles: who forwards and who waits

With a root agreed, every port takes exactly one role, decided by cost.

Role	How many	Behaviour
Root port	One per non-root switch	The port with the best path towards the root. Forwards.
Designated port	One per link segment	The end of the link nearer the root. Forwards. All root-bridge ports are designated.
Blocking (or alternate)	Everything left over	Listens to BPDUs, forwards no data.

"Best path" means lowest cumulative path cost to the root, where each link contributes a cost based on its speed:

Link speed	Cost (short, default)	Cost (long)
10 Mbps	100	2,000,000
100 Mbps	19	200,000
1 Gbps	4	20,000
10 Gbps	2	2,000

Costs add along the path, and lower wins. When two paths tie, the tie-breakers apply in order: lowest sender bridge ID, then lowest sender port ID, then lowest receiving port ID. That sequence is worth remembering because it is how questions about symmetric topologies are answered.

flowchart TD
  R["Root bridge<br/>priority 24576"] ---|"cost 4"| A["Switch A<br/>root port faces root"]
  R ---|"cost 4"| B["Switch B<br/>root port faces root"]
  A ---|"cost 4, blocked on B"| B

Figure 3. The classic triangle. Both A and B reach the root at cost 4, so the link between them is redundant; one end blocks, and the tie is broken by the lower bridge ID keeping its port designated.

Switch# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     0023.5e12.3400
             Cost        4
             Port        24 (GigabitEthernet1/0/24)

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     001b.d4aa.bb00

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- ----------------
Gi1/0/23         Altn BLK 4         128.23   P2p
Gi1/0/24         Root FWD 4         128.24   P2p

Reading that output: this switch is not the root (its bridge ID differs from the root ID), it reaches the root at cost 4 through Gi1/0/24, and Gi1/0/23 is an alternate port sitting in blocking. If the root ID and the bridge ID were identical, this switch would be the root.

States, timers, and the thirty seconds nobody wanted

The original 802.1D could not simply switch a port on. A port that starts forwarding before the topology has settled can create the very loop the protocol exists to prevent, so ports move through states on timers.

stateDiagram-v2
  [*] --> Blocking
  Blocking --> Listening: this port is needed
  Listening --> Learning: 15 s forward delay
  Learning --> Forwarding: 15 s forward delay
  Forwarding --> Blocking: better BPDU heard
  Listening --> Blocking: better BPDU heard

Figure 4. Classic 802.1D port states. Listening participates in the election without learning addresses; learning builds the MAC table without forwarding; only then does traffic flow.

State	Receives BPDUs	Learns MACs	Forwards data
Blocking	yes	no	no
Listening	yes	no	no
Learning	yes	yes	no
Forwarding	yes	yes	yes
Disabled	no	no	no

The timers are hello 2 seconds, forward delay 15 seconds, max age 20 seconds. Add them up for a link failure: 20 seconds to decide the old BPDU has expired, then 15 in listening, then 15 in learning. Fifty seconds of outage after a cable is pulled — an eternity for anything interactive, and the reason RSTP exists.

It also produced a symptom that generations of desktop support have met: a PC boots, its switch port begins the 30-second walk to forwarding, the DHCP request is sent into a port that is not forwarding yet, and the machine ends up with a 169.254 address. The fix is PortFast, below.

Rapid spanning tree

802.1w, Rapid Spanning Tree Protocol, keeps the same election and the same idea of a tree, and replaces timer-based caution with explicit handshaking. Convergence drops from around fifty seconds to well under one on point-to-point links.

Three changes do the work:

Every switch originates BPDUs every hello interval, rather than only relaying the root's. A neighbour going quiet for three hellos — six seconds — is treated as a failure immediately, instead of waiting for max age.
Proposal and agreement. When a new link comes up between two switches, they negotiate directly: one proposes to become designated, the other blocks its own non-edge ports, agrees, and the link goes to forwarding at once. The handshake propagates outward switch by switch.
Link types matter. A full-duplex link is point-to-point and can use the handshake. A half-duplex link is treated as shared and falls back to timers, which is one more reason a duplex mismatch is worse than it looks.

802.1D role or state	802.1w equivalent
Blocking, listening	Discarding
Learning	Learning
Forwarding	Forwarding
Blocking port with an unused path to root	Alternate port — an immediate replacement for a failed root port
Blocking port on a shared segment	Backup port — a spare designated port on the same segment

The alternate role is where the speed comes from. Classic STP had to recompute after a failure; RSTP has already identified the next-best path and can promote it in milliseconds.

Tip

RSTP is backwards compatible — it falls back to 802.1D behaviour on a port where it hears legacy BPDUs. That is helpful for migration and unhelpful for performance, because one old switch drags its whole segment back to timer-based convergence.

Protecting the edge

Access ports face desks, and a desk is not supposed to be a switch. Four features encode that assumption.

PortFast

Takes an access port straight from blocking to forwarding, skipping listening and learning entirely. Safe on a port that connects to one host, and dangerous anywhere else, because a port that starts forwarding immediately is exactly how a loop begins.

PortFast also stops the port from generating topology change notifications. Without it, every laptop that powers on or off triggers a topology change, which shortens MAC ageing across the switched network and causes a burst of flooding. On a floor of a hundred desks, that alone is worth configuring.

BPDU guard

The natural partner. If a BPDU ever arrives on a PortFast port, something that is not a host is plugged in, and the port is put into err-disabled immediately. It is a blunt response, and correct: better one dead port than a network-wide storm.

! per interface
Switch(config)# interface range GigabitEthernet1/0/1 - 20
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# spanning-tree bpduguard enable

! or globally, applying to every access port at once
Switch(config)# spanning-tree portfast default
Switch(config)# spanning-tree portfast bpduguard default

Root guard

Applied to a port where a superior BPDU should never arrive — typically facing downstream switches. If one does, the port goes into root-inconsistent state and stops forwarding until the superior BPDUs stop. This keeps the root where you designed it, so a contractor's switch with priority 0 cannot pull the entire topology towards a closet.

Loop guard and UDLD

Both address the same nasty case: a link that is physically up but has stopped delivering BPDUs in one direction — a broken fibre strand, or a media converter failing quietly. Without protection, the blocking port stops hearing BPDUs, assumes the path is gone, and starts forwarding, creating a loop.

Loop guard puts a port that unexpectedly stops receiving BPDUs into loop-inconsistent rather than promoting it to forwarding.
UDLD — unidirectional link detection — sends its own probes and shuts down a link whose neighbour cannot echo them. It is a Cisco feature and is standard practice on fibre links.

In the wild

Every serious campus standard includes PortFast and BPDU guard on all access ports, root guard on downstream-facing distribution ports, and UDLD on every fibre link. It is close to universal because the failure it prevents is total.
Meeting-room network sockets are the classic BPDU guard trigger: somebody brings a small switch to get more ports, and the switch shuts the socket down within seconds.
Data centre fabrics avoid the whole subject by routing rather than bridging between racks, using equal-cost multipath so every link is active — the opposite of blocking half of them.

One tree or several

802.1D specified one tree for the whole switch, which means one set of blocked links regardless of how many VLANs exist. That wastes capacity: if two uplinks both carry ten VLANs, one uplink sits idle for all of them.

Flavour	Trees	Notes
PVST+	One per VLAN	Cisco. Load sharing possible; CPU cost grows with VLAN count.
Rapid PVST+	One per VLAN, RSTP	Cisco default on modern switches, and the sensible choice.
MST (802.1s)	A few, each covering many VLANs	Standard. Scales to hundreds of VLANs; more configuration to get right.

Per-VLAN trees allow a genuinely useful trick: make switch A the root for the odd VLANs and switch B the root for the even ones. Both uplinks then carry traffic, each blocking only for the VLANs it is not root for, and a failure of either leaves everything working at reduced capacity.

! on distribution switch A
SwitchA(config)# spanning-tree vlan 10,30,50 root primary
SwitchA(config)# spanning-tree vlan 20,40,60 root secondary

! on distribution switch B — the mirror image
SwitchB(config)# spanning-tree vlan 20,40,60 root primary
SwitchB(config)# spanning-tree vlan 10,30,50 root secondary

It is also worth saying plainly where the industry went: the best spanning tree is a small one. Modern designs shrink layer 2 domains, push routing down to the access or distribution layer, and use EtherChannel to make several physical links look like one logical link that spanning tree never needs to block. Spanning tree remains as a safety net rather than a load-bearing part of the design.

BPDU: Bridge protocol data unit: the frame switches exchange to build and maintain the tree, sent every 2 seconds to a reserved multicast address.
Bridge ID: Priority plus VLAN plus MAC address. Lowest wins the root election.
Root port: The single port on a non-root switch with the lowest cumulative cost to the root.
Designated port: The port on a segment that is closest to the root; the one permitted to forward onto that segment.
Alternate port: An RSTP role: a blocked port holding a ready alternative path to the root, promoted immediately if the root port fails.

Recap

Ethernet frames have no TTL, so a layer 2 loop multiplies frames until the network collapses.
A loop shows three symptoms together: a broadcast storm, a flapping MAC table, and duplicate frames.
Spanning tree computes a loop-free tree and blocks every link that is not part of it, keeping redundancy in reserve.
The root is the switch with the lowest bridge ID: priority, then VLAN, then MAC address.
Left at defaults the oldest switch usually wins, so always set the root explicitly.
Each non-root switch has one root port; each segment has one designated port; everything else blocks.
Path cost is cumulative and speed-based — 4 for a gigabit link, 2 for ten gigabit — and lower wins.
Classic 802.1D states are blocking, listening, learning and forwarding, giving about 50 seconds of outage after a failure.
RSTP replaces timers with proposal and agreement, adds alternate and backup roles, and converges in under a second on point-to-point links.
PortFast skips the wait on access ports and stops every laptop reboot from triggering a topology change.
BPDU guard err-disables a PortFast port that receives a BPDU; root guard stops a rogue switch becoming root; loop guard and UDLD catch links that go quiet in one direction.
Rapid PVST+ runs one tree per VLAN and allows load sharing by alternating roots; modern designs shrink layer 2 so the tree matters less.

Questions

Say the answer out loud before opening it.

Why does a layer 2 loop destroy a network when a layer 3 routing loop does not?

Because an Ethernet frame has no time-to-live field, so nothing ever causes a looping frame to expire.

An IP packet's TTL decrements at each hop and the packet is discarded at zero.
A flooded frame is duplicated at each switch, so the count doubles every cycle at wire speed.
Links saturate and switch CPUs reach 100 percent within a couple of seconds.

A routing loop wastes bandwidth and causes packet loss but is self-limiting; a bridging loop is unbounded, which is why the protection has to be built into the switching layer itself.

What are the three symptoms of a switching loop?

A broadcast storm, MAC address table instability, and duplicate frame delivery.

The storm shows as saturated links and pegged CPU, often with an unresponsive console.
Table instability appears in the log as the same MAC address moving repeatedly between ports.
Hosts receiving multiple copies break protocols that assume one delivery.

The MAC flapping message is the most useful of the three for diagnosis, because it names the two ports involved and therefore points directly at the loop.

How is the root bridge elected?

The switch with the numerically lowest bridge ID wins, where the bridge ID is priority, then the VLAN's extended system ID, then the MAC address.

Every switch starts by claiming to be root in its own BPDUs.
On hearing a better claim, it stops claiming and relays the better one.
Priority defaults to 32768 everywhere, so the MAC address usually decides.

That default means the oldest switch tends to win, since MAC addresses were allocated roughly in order — so the root ends up on the least capable box unless you set it deliberately.

Why must spanning tree priority be a multiple of 4096?

Because the 16-bit priority field was split: the top four bits are the configurable priority and the lower twelve carry the VLAN ID.

Four bits give sixteen possible values, each 4096 apart.
A displayed priority of 32778 is 32768 plus VLAN 10.
This extension is what allows one tree per VLAN without a separate bridge ID per VLAN.

The root primary macro hides the arithmetic by setting priority to 24576, or lower if an existing root already has a better value.

What are the port roles and how many of each exist?

One root port per non-root switch, one designated port per segment, and every remaining port blocking — called alternate or backup under RSTP.

The root port is the lowest-cost path towards the root.
The designated port is the end of a link closer to the root; all root bridge ports are designated.
Alternate ports hold a spare path to the root; backup ports are a spare on the same segment.

The root bridge itself has no root port, which is the fastest way to confirm from output which switch is the root.

Two paths to the root have equal cost. How is the tie broken?

Lowest sender bridge ID, then lowest sender port ID, then lowest receiving port ID.

The sender bridge ID usually resolves it when the two paths run through different neighbours.
Port ID is priority plus port number, so a port priority change can steer the outcome deliberately.
Only when both paths lead to the same neighbour does the receiving port ID come into play.

Adjusting port priority or path cost on a specific interface is the standard way to force a chosen link to be preferred without changing the root.

What are the classic 802.1D port states and how long does convergence take?

Blocking, listening, learning, forwarding, plus disabled — and recovery from a failure takes about 50 seconds.

Max age of 20 seconds must expire before the old information is discarded.
Then 15 seconds in listening and 15 in learning, from the forward delay timer.
Listening participates in the election without learning addresses; learning builds the table without forwarding.

Those timers were chosen for a network with slow links and large diameters, and the pessimism is exactly what RSTP's handshaking replaces.

What does RSTP change to converge so much faster?

Every switch originates its own BPDUs so failures are detected in six seconds, new links use a proposal and agreement handshake instead of timers, and alternate ports are precomputed replacements.

Three missed hellos, rather than max age, declares a neighbour down.
The handshake blocks non-edge ports downstream before agreeing, so no loop can form during the transition.
An alternate port can be promoted to root port immediately.

The handshake requires a point-to-point link, which in practice means full duplex — so a duplex mismatch quietly drops that segment back to timer-based convergence.

What does PortFast do, and what would happen if you enabled it on a trunk to another switch?

It moves an access port straight to forwarding without the listening and learning delay; enabling it towards another switch risks creating a loop for the seconds before spanning tree catches up.

It also stops the port generating topology change notifications, which otherwise flush MAC tables network-wide every time a PC reboots.
PortFast should always be paired with BPDU guard so that a switch appearing on that port shuts it down.
There is a trunk variant for hypervisor uplinks where the far end genuinely is not a switch.

The topology-change benefit is underrated: on a floor of a hundred desks, PortFast alone removes a constant background of flooding.

What is BPDU guard and why is err-disabling the port the right response?

It shuts down a PortFast port that receives a BPDU, because receiving one proves a switch is connected where a host was expected.

A PortFast port forwards immediately, so a switch on it could form a loop before the topology adjusts.
Disabling the port removes the risk entirely rather than trying to reason about it.
The port can be recovered manually or with an errdisable recovery timer.

The alternative — letting the port participate normally — would allow an unauthorised switch to influence the topology, which is the same exposure root guard addresses on trunk ports.

What is root guard for?

It stops a port from accepting superior BPDUs, so no device on that port can become the root bridge.

Applied on ports facing downstream switches, where a better root should never appear.
A superior BPDU puts the port into root-inconsistent state, which stops forwarding until they cease.
It protects the designed topology from a switch someone plugs in with a low priority.

Unlike BPDU guard it does not disable the port, so recovery is automatic once the offending device stops sending superior BPDUs.

What problem do loop guard and UDLD solve?

A link that is physically up but has stopped carrying BPDUs in one direction, which makes a blocking port believe the redundant path is gone and start forwarding.

Typical causes are a broken fibre strand or a failing media converter.
Loop guard puts the port into loop-inconsistent state instead of promoting it to forwarding.
UDLD sends its own probes and disables a link whose neighbour cannot echo them.

Both are standard on fibre links because that is where unidirectional failure is physically possible; a copper link generally fails in both directions at once.

How does per-VLAN spanning tree allow load sharing?

By running a separate tree per VLAN, so different VLANs can block different links and both uplinks carry traffic.

Make one distribution switch the root for odd VLANs and the other the root for even VLANs.
Each uplink then forwards for half the VLANs and blocks for the other half.
Losing either switch leaves everything working at reduced capacity.

The cost is CPU and memory proportional to the number of VLANs, which is exactly the problem MST solves by mapping many VLANs onto a handful of trees.

How would you tell from "show spanning-tree" whether a switch is the root?

The Root ID and the Bridge ID sections show the same priority and address, and the switch has no root port.

On a non-root switch the root cost is non-zero and one port is listed with role Root.
On the root, every port is designated and forwarding.
The output also names the port through which the root is reached, which is the start of any path tracing.

Checking this per VLAN matters under PVST+, because a switch can be root for some VLANs and not others by design.

Why do modern data centre designs avoid spanning tree?

Because blocking links to prevent loops wastes half the available bandwidth, and routing between racks removes the need for a loop-free bridged topology.

Spine-leaf fabrics route at layer 3 and use equal-cost multipath, so every link is active.
Overlays such as VXLAN carry layer 2 segments across that routed fabric where they are genuinely needed.
Convergence is then a routing protocol's job, which is measured in milliseconds rather than seconds.

Spanning tree does not disappear from those networks; it stays enabled as a safety net for accidental loops, but nothing in the design depends on it.