STP and Loop Prevention
Ethernet has no TTL. A loop is not slow — it is a broadcast storm that saturates every link in seconds and takes the network down until someone pulls a cable. Spanning Tree is the protocol that prevents it, and the source of most switching outages.
Why loops are fatal
A broadcast frame entering a loop is copied around it forever. Switches also relearn the source MAC from every copy, so the MAC table flaps continuously. CPU goes to 100%, links saturate, and everything in that VLAN dies — including management, which is why the fix is often physical.
PC -- SW1 -- SW2 -- SW1 <- one frame, infinite copies
How STP works
- Elect one root bridge: lowest bridge ID (priority, then MAC, default priority 32768).
- Each non-root switch picks one root port — its cheapest path to the root.
- Each segment picks one designated port — the best port toward the root.
- Everything else goes into blocking (RSTP: discarding). A loop-free tree remains.
| Concept | Meaning |
|---|---|
| Bridge ID | 2-byte priority + 6-byte MAC |
| Path cost | Sum of link costs toward the root (10 Mbps = 100, 100 = 19, 1 G = 4, 10 G = 2) |
| Hello | 2 s (classic and RSTP) |
| Max age | 20 s — how long topology info is trusted |
| Forward delay | 15 s listening + 15 s learning in classic STP |
Classic 802.1D convergence: ~30–50 seconds. RSTP (802.1w) converges in the low seconds by using explicit neighbour handshakes instead of timers. Most modern switches run RSTP (often as Rapid PVST+ or MSTP), so classic timer arithmetic matters mainly for legacy gear and exam questions.
Port roles and states
| State (802.1D) | Forwards data | Learns MACs | Sends BPDUs |
|---|---|---|---|
| Blocking | No | No | Receives only |
| Listening | No | No | Yes |
| Learning | No | Yes | Yes |
| Forwarding | Yes | Yes | Yes |
| Role (RSTP) | Meaning |
|---|---|
| Root | Best path to root bridge |
| Designated | Best port on a segment toward the root |
| Alternate | Backup for the root port, discarding |
| Edge (PortFast) | Access port with a host, goes straight to forwarding |
Guard features that prevent the classic outages
| Feature | Protects against | Where to enable |
|---|---|---|
| PortFast / edge | 30 s delay for a workstation | Every access port to an end device |
| BPDU Guard | A switch plugged into an access port | Same ports as PortFast — err-disables on BPDU |
| Root Guard | An unexpected device becoming root | Ports facing other organisations or access |
| Loop Guard | Unidirectional link causing a loop | Fibre and provider links |
| UDLD | One-way fibre | Fibre pairs |
BPDU Guard without PortFast is half a solution, and PortFast without BPDU Guard is a loop waiting for a user with a spare switch.
Where it goes wrong
- Root bridge elected by accident. Default priorities mean the oldest switch wins. The core should be root, explicitly:
spanning-tree vlan 10 priority 4096. - Unmanaged switch plugged into a wall port. No BPDUs, no protection: this is the most common cause of a real-world broadcast storm. BPDU Guard on access ports is the fix.
- Asymmetric costs. Someone tunes a cost on one side of a link and traffic takes an unexpected path, often through a firewall that then drops it.
- Trunk carrying a VLAN the access layer does not want. A loop in VLAN 99 takes down a network nobody knew was extended.
- RSTP and classic STP mixed carelessly. They interoperate, but the mixed segment falls back to classic behaviour and slower convergence.
- Spanning tree disabled "for performance". It is disabled until the first loop, then the network is down and the person who disabled it is on holiday.
Related Notes
- VLANs Trunking — the VLANs that a loop takes down
- Ethernet ARP And Local Delivery — broadcast behaviour
- Network Design And Topologies — redundancy that needs STP
- Troubleshooting Scenarios — the storm scenario