# STP and Loop Prevention

Ethernet has no TTL. A loop is not slow — it is a broadcast storm that saturates every link in seconds and takes the network down until someone pulls a cable. Spanning Tree is the protocol that prevents it, and the source of most switching outages.

## Why loops are fatal

A broadcast frame entering a loop is copied around it forever. Switches also relearn the source MAC from every copy, so the MAC table flaps continuously. CPU goes to 100%, links saturate, and everything in that VLAN dies — including management, which is why the fix is often physical.

```
PC -- SW1 -- SW2 -- SW1     <- one frame, infinite copies
```

## How STP works

1. Elect one **root bridge**: lowest bridge ID (priority, then MAC, default priority 32768).
2. Each non-root switch picks **one root port** — its cheapest path to the root.
3. Each segment picks **one designated port** — the best port toward the root.
4. Everything else goes into **blocking** (RSTP: *discarding*). A loop-free tree remains.

| Concept | Meaning |
|---|---|
| **Bridge ID** | 2-byte priority + 6-byte MAC |
| **Path cost** | Sum of link costs toward the root (10 Mbps = 100, 100 = 19, 1 G = 4, 10 G = 2) |
| **Hello** | 2 s (classic and RSTP) |
| **Max age** | 20 s — how long topology info is trusted |
| **Forward delay** | 15 s listening + 15 s learning in classic STP |

Classic 802.1D convergence: ~30–50 seconds. RSTP (802.1w) converges in the low seconds by using explicit neighbour handshakes instead of timers. Most modern switches run RSTP (often as Rapid PVST+ or MSTP), so classic timer arithmetic matters mainly for legacy gear and exam questions.

## Port roles and states

| State (802.1D) | Forwards data | Learns MACs | Sends BPDUs |
|---|---|---|---|
| Blocking | No | No | Receives only |
| Listening | No | No | Yes |
| Learning | No | Yes | Yes |
| Forwarding | Yes | Yes | Yes |

| Role (RSTP) | Meaning |
|---|---|
| Root | Best path to root bridge |
| Designated | Best port on a segment toward the root |
| Alternate | Backup for the root port, discarding |
| Edge (PortFast) | Access port with a host, goes straight to forwarding |

## Guard features that prevent the classic outages

| Feature | Protects against | Where to enable |
|---|---|---|
| **PortFast / edge** | 30 s delay for a workstation | Every access port to an end device |
| **BPDU Guard** | A switch plugged into an access port | Same ports as PortFast — err-disables on BPDU |
| **Root Guard** | An unexpected device becoming root | Ports facing other organisations or access |
| **Loop Guard** | Unidirectional link causing a loop | Fibre and provider links |
| **UDLD** | One-way fibre | Fibre pairs |

BPDU Guard without PortFast is half a solution, and PortFast without BPDU Guard is a loop waiting for a user with a spare switch.

## Where it goes wrong

- **Root bridge elected by accident.** Default priorities mean the oldest switch wins. The core should be root, explicitly: `spanning-tree vlan 10 priority 4096`.
- **Unmanaged switch plugged into a wall port.** No BPDUs, no protection: this is the most common cause of a real-world broadcast storm. BPDU Guard on access ports is the fix.
- **Asymmetric costs.** Someone tunes a cost on one side of a link and traffic takes an unexpected path, often through a firewall that then drops it.
- **Trunk carrying a VLAN the access layer does not want.** A loop in VLAN 99 takes down a network nobody knew was extended.
- **RSTP and classic STP mixed carelessly.** They interoperate, but the mixed segment falls back to classic behaviour and slower convergence.
- **Spanning tree disabled "for performance".** It is disabled until the first loop, then the network is down and the person who disabled it is on holiday.

## Teaching hook

**The ring-road analogy.** Everyone may drive to the roundabout, but only one entrance is allowed to feed the junction at a time; the others wait with the engine running (blocking) and take over the instant the chosen one closes.

Demo that lands: in a lab with three switches, form a triangle and watch `show spanning-tree` pick a root; then set a wrong priority and watch the tree reshape. Then plug an unmanaged switch into a PortFast port without BPDU Guard and cause a storm on purpose — in a lab, once, with the port already identified.

## Related Notes

- [[Switching-LAN/VLANs-Trunking.md]] — the VLANs that a loop takes down
- [[Foundations/Ethernet-ARP-And-Local-Delivery.md]] — broadcast behaviour
- [[Foundations/Network-Design-And-Topologies.md]] — redundancy that needs STP
- [[Labs/Troubleshooting-Scenarios.md]] — the storm scenario