In this guide
Why Layer 2 loops hurt
Ethernet frames do not carry a Layer 2 TTL. A broadcast, multicast or unknown-unicast frame caught in a physical loop can circulate repeatedly. MAC tables can also oscillate between ports, causing instability, excessive flooding and high CPU or interface utilisation.
Root election and port roles
STP uses BPDUs to exchange bridge information. The switch with the lowest Bridge ID becomes the root bridge. Explicitly choosing the intended root is preferable to relying on MAC-address tie breaking.
RSTP defines Root, Designated, Alternate and Backup port roles. Root and Designated ports normally forward; Alternate and Backup provide standby paths.
Classic STP uses Blocking, Listening, Learning and Forwarding states. RSTP simplifies these to Discarding, Learning and Forwarding.
STP variants
| Variant | Use |
|---|---|
| 802.1D STP | Classic spanning tree |
| 802.1w RSTP | Rapid convergence and modern port roles |
| PVST+ | Per-VLAN spanning tree, associated with Cisco environments |
| Rapid PVST+ | Rapid per-VLAN spanning tree |
| MSTP | Maps VLANs to a smaller number of spanning-tree instances |
RSTP convergence
RSTP improves convergence by using explicit port roles and handshake mechanisms between compatible switches. Point-to-point full-duplex links can transition rapidly when the necessary conditions are met.
RSTP is not a guarantee of instant recovery. Shared links, inconsistent implementations, physical failures and interoperability with legacy STP can change convergence behaviour. Measure the actual failure and recovery time in the deployed topology.
Edge-port protection
Ports connected only to end hosts can use an edge/PortFast function so the host does not wait for normal spanning-tree transition behaviour. Edge ports should normally have BPDU Guard enabled: receiving a BPDU from an unexpected switch is treated as a protection event.
BPDU Filter is different. It suppresses BPDUs and can hide a loop from STP. It should not be used casually as a substitute for BPDU Guard.
Root Guard, Loop Guard and UDLD
- Root Guard: prevents an unexpected downstream device from becoming a superior STP root on a protected port.
- Loop Guard: helps prevent a non-designated port from incorrectly transitioning to forwarding when expected BPDUs disappear.
- UDLD: detects certain unidirectional link failures, particularly useful on fibre links where one direction can remain operational.
These controls solve different failure modes and should be deployed according to topology rather than enabled blindly everywhere.
Topology changes
Topology changes can cause MAC-table relearning and additional control-plane activity. Monitor topology-change notifications, root changes and repeated forwarding/discarding transitions. A flapping link can create repeated STP changes even when the underlying topology has not intentionally changed.
Troubleshooting
- Identify the current root bridge and confirm it matches the design.
- Check the root and designated path for the affected VLAN or instance.
- Look for unexpected BPDUs, MAC moves and topology-change events.
- Check fibre/copper errors, link flaps and UDLD events.
- Inspect edge ports for unexpected switches or incorrectly applied protection.
- Check for native/untagged VLAN mismatches and inconsistent STP modes between vendors.
- Do not disable STP merely because a redundant link is blocking; determine why it was selected as the alternate path.
Standards and references
- IEEE 802.1D — legacy Spanning Tree Protocol.
- IEEE 802.1w — Rapid Spanning Tree Protocol.
- IEEE 802.1s — Multiple Spanning Tree Protocol; incorporated into later 802.1Q revisions.
- Vendor documentation for BPDU Guard, Root Guard and UDLD.
Key takeaways
Use STP deliberately: select deterministic roots, understand port roles, protect edge ports and monitor topology changes. RSTP is the normal modern baseline, while MSTP can reduce instance scale in larger VLAN environments.