Spanning Tree Protocol (STP) and RSTP Fundamentals

Key Takeaways

• STP exists to prevent Layer 2 loops on networks with redundant physical links — without it, a loop causes broadcast storms, MAC table instability, and duplicate frames that can take a switched network down in seconds.
• STP does this by electing a root bridge and then blocking just enough ports on every other switch so that only one active path exists between any two points in the network.
• Classic 802.1D STP converges in tens of seconds after a topology change. RSTP (802.1w), which Cisco runs by default as Rapid PVST+, converges in under a second using an active proposal/agreement handshake instead of passive timers.
• Every port has both a role (root, designated, alternate, backup) and a state (discarding, learning, forwarding) — these are two different, related things, and mixing them up is the most common source of confusion when reading show spanning-tree output.
• Ports facing end hosts (not other switches) should be configured as edge ports (PortFast) so they skip STP's transition delay entirely and forward immediately.

Prerequisites

Basic switch operation — MAC address learning, flooding of unknown-destination frames, and why redundant physical links between switches create a loop at Layer 2.

Why STP Exists

Switches forward unknown-destination and broadcast frames out every port except the one they arrived on. If two switches are connected by two physical links, a broadcast frame sent out both links arrives back at the original switch from a second direction — and gets flooded again, forever. Each pass also causes MAC addresses to be learned and re-learned on the wrong ports as the frame arrives from multiple directions, causing MAC table instability that breaks unicast forwarding too.

STP solves this by building a loop-free logical tree on top of the physical topology: it elects one switch as the root bridge, calculates the shortest path from every other switch to the root, and blocks any port that isn't part of that shortest-path tree. The physical redundancy is still there — if an active link fails, a previously blocked port transitions to forwarding to restore connectivity.

Root Bridge Election

Every switch advertises a Bridge ID: a 2-byte priority field (default 32768, configurable in increments of 4096) combined with the switch's MAC address as a tiebreaker. The switch with the numerically lowest Bridge ID becomes the root bridge for that VLAN. Because MAC address is the tiebreaker, an unconfigured network's root bridge is whichever switch happens to have the lowest MAC — which is rarely the switch you'd actually want at the top of the tree, so setting priority explicitly on your intended core/distribution switches is standard practice.

Port Roles

Port States

Legacy 802.1D used five states (Disabled, Blocking, Listening, Learning, Forwarding). RSTP collapses this to three:

A port's state can change independently of its role during a transition — a designated port can briefly sit in the discarding state while RSTP's handshake confirms it's safe to forward.

Why RSTP Converges Fast: Proposal/Agreement

Classic STP relies on passive timers (forward delay, max age) to safely assume a topology change has propagated — this is what produces the infamous ~30-50 second convergence. RSTP instead uses an active handshake:

1. A switch with a port ready to become designated sends a BPDU with the proposal bit set.
2. The switch on the other end, if it agrees this port should be the new upstream path, first puts all of its other non-edge ports into discarding (a "sync") to guarantee no loop can form.
3. It then replies with an agreement BPDU, and both ends move directly to forwarding — no timer wait.

This only works at full speed on point-to-point links (inferred from full-duplex operation) and has no effect on edge ports, which skip the whole negotiation and forward immediately since they can't form a loop.

Configuration (Cisco IOS)

Enable Rapid PVST+ (Cisco's default in modern IOS, but worth setting explicitly) and set root bridge priority:

spanning-tree mode rapid-pvst
spanning-tree vlan 10 priority 4096

Or let IOS calculate a safe priority relative to the current root automatically:

spanning-tree vlan 10 root primary

Configure host-facing ports as edge ports, and add BPDU Guard so the port is automatically error-disabled if it ever receives a BPDU (protects against someone plugging a switch into what should be an end-host port):

interface GigabitEthernet0/5
 spanning-tree portfast
 spanning-tree bpduguard enable

Verification

show spanning-tree vlan 10

Confirms the root bridge, this switch's Bridge ID and priority, and the role/state of every port in that VLAN.

show spanning-tree vlan 10 detail

Adds per-port timers and the number of topology changes seen — a high or climbing topology-change count on a stable network is usually the first sign something is flapping.

Troubleshooting

• Unexpected root bridge: usually means priority was never set explicitly, and whichever switch has the lowest MAC address won the election by default. Set priority intentionally on the switches you want at the top of the tree.
• Frequent topology changes: check for a port flapping (bad cable/transceiver) or an end-host port that isn't configured as an edge port, causing unnecessary re-convergence every time that device links up/down.
• A port stuck in a non-forwarding state longer than expected: confirm the link is genuinely full-duplex/point-to-point — RSTP's fast handshake doesn't apply on links STP considers shared/half-duplex.

Related Articles

EtherChannel on Cisco IOS Catalyst Switches — bundling redundant physical links into one logical EtherChannel is the other major way (besides accepting STP's blocking) to actually use the bandwidth of a redundant link, since STP treats the bundle as a single logical port rather than a loop.