How STP (802.1D) operates

Spanning-Tree Protocol

In the previous chapter, you learned what can happen when you add redundant connections between switches: the network can suffer Layer 2 loops, hosts can receive duplicate copies of the same frame, and the network can eventually experience broadcast storms. Fortunately, most business- or enterprise-grade switches run the Spanning-Tree Protocol (STP) by default.

STP is an IEEE industry-standard protocol designed to prevent Layer 2 loops when redundant links exist between switches. This is also the 3^rd function of a switch: loop avoidance (provided by STP).

STP prevents Layer 2 loops by:

• Detecting whether a loop is possible (typically when redundant links carry the same VLANs)
• Blocking one or more redundant ports to break the loop

In a stable topology, only one of the redundant paths is allowed to forward traffic.

(Image 053)

Image Title - STP blocking a port to prevent Layer 2 Loops

802.1D

It’s not enough to know that STP prevents Layer 2 loops. As a network administrator and CCNA, you’ll also want to understand the process STP uses to do that.

The first STP standard was IEEE 802.1D. Newer STP versions build on 802.1D and improve its shortcomings, but the core ideas start here.

• With STP, there is a concept called the “Root Bridge”. The Root Bridge is the switch that acts as the central reference point for the spanning-tree topology. It dictates key STP parameters and helps ensure the network stays loop-free.

You can also call it a “Root Switch”, but you may still see the term Root Bridge today because, when STP was invented, switches were commonly referred to as “bridges”.

Root bridge selection process

• Before a switch is connected to any other switch, it assumes it is the “Root Bridge” because it isn’t aware of any other switches. As soon as you connect switches together, they begin a “Root Bridge Election” (only one switch can be the Root Bridge).

• Switches running STP send frames out of all enabled switchports containing STP information called “Bridge Protocol Data Units” ( BPDUs ). A BPDU contains many fields, but two are especially important here:

  • “Bridge Priority”
  • “Bridge ID (BID)”, which includes the switch’s “System MAC Address”

  Switches also have MAC addresses. For STP, we typically call this the “System MAC Address” (also referred to as the “Base MAC Address”).

(Image 054)

Image Title - BPDU Diagram

• The Root Bridge Election is decided by the lowest value. In practice:

  • The switch with the lowest Bridge Priority wins.
  • If there’s a tie in Bridge Priority, the switch with the lowest Base MAC Address wins.

  This matters because you don’t want an unintended switch becoming the Root Bridge. That’s why Bridge Priority exists: it’s a configurable value that lets you influence which switch becomes the Root Bridge.

It is important to note that the Bridge Priority takes precedence over the Base MAC Address. By default, the Bridge Priority on all switches is 32768. If two switches have the same Bridge Priority, they then compare Base MAC Addresses, and the switch with the lowest Base MAC Address becomes the Root Bridge.

(Image 055)

Image Title - Switch 1 winning the Root Bridge Election over Switch 2

• Notice in the image above: Switch 1 wins the Root Bridge Election and becomes the Root Bridge. Because both switches have the default Bridge Priority (32768), the Base MAC Addresses are compared. Switch 1’s Base MAC Address has a lower hexadecimal value than Switch 2’s, so Switch 1 becomes the Root Bridge.

• By default, all (active) switchports on the Root Bridge are in the STP “Forwarding” state. That means they can send and receive data frames and STP BPDUs. On the Root Bridge, these ports also have the STP port role “Designated Port”.

• The key STP behavior shows up when you add a redundant (2^nd) connection between Switch 1 and Switch 2.

• Both Switch 1 and Switch 2 detect that a Layer 2 loop is possible because they receive duplicate copies of BPDUs from each one of the links that they are using to connect with each other.

• The Root Bridge doesn’t need to block any ports, since all the active ports (Designated Ports) must forward traffic. The “Non-Root Bridge” (Switch 2) must decide which redundant port to block.

  • Switch 2 must keep one port forwarding so it can still send and receive frames.
  • The other redundant port must be blocked to prevent the loop.

  The blocked port is called the “Non-Designated Port”. It:

  • Does not forward data frames
  • Discards any received data frames
  • Still listens for and processes BPDUs so it can detect an alternate path to the Root Bridge if the primary path (Root Port) fails

• The port on Switch 2 that leads toward the Root Bridge and remains in the Forwarding state is called the “Root Port”. This is the port that provides the best path (closest path) to the Root Bridge.

(Image 056)

Image Title - Redundant connection between SW1 and SW2 and Root Port selection

• Non-Root Bridges select the Root Port primarily by choosing the port with the lowest “Root Path Cost”. Root Path Cost represents the “distance” to the Root Bridge and is based on link speed:

  • Faster links have a lower (better) cost.
  • Slower links have a higher (worse) cost.

  Below are some default Root Path Cost values.

Port Speed	STP Cost
10 Mbps	100
100 Mbps	19
1 Gbps	4
10 Gbps	2

• Let’s assume the top link between Switch 1 and Switch 2 is 1Gbps (GigabitEthernet 0/23) and the bottom link is 100Mbps (FastEthernet 0/24).

(Image 057)

Image Title - Redundant connection between SW1 and SW2 with varying Port Speeds

• Which port on Switch 2 would become the Root Port and why?

  (spoiler)

  GigabitEthernet 0/23 will become the Root Port on Switch 2 because it has a lower (better) Root Path Cost (4) than the FastEthernet 0/24 port (19).

• Root Path Cost is also cumulative.

  • The Root Bridge advertises a Root Path Cost of “0” to its neighbors.
  • Each downstream switch adds the cost of the port where it received the BPDU.
  • That updated total is then advertised further downstream.

(Image 058)

Image Title - Four Switches adding up and passing on the Root Path Cost

• Now consider a scenario where a Non-Root Bridge (Switch 4) connects to two other Non-Root Bridges (Switches 2 and 3). Switch 2 and Switch 3 are directly connected to the Root Bridge (Switch 1).

(Image 059)

Image Title - Three Switches connecting to the Root Bridge and their Root Path Costs

• Switch 4 may see the same Root Path Cost through Switch 2 and through Switch 3. When the Root Path Cost ties, Switch 4 uses the neighbor switch’s identity to break the tie (Bridge Priority, then Base MAC Address).

  In this scenario, Switch 4 chooses the port connected to Switch 2 as its Root Port because Switch 2 has a lower Base MAC Address than Switch 3. The port connected to Switch 3 becomes Switch 4’s “Non-Designated Port”.

  Meanwhile:

  • The ports on SW2 and SW3 that connect to SW4 are their “Designated Ports” because they are designated to forward frames toward SW4.
  • It is always the switch that is the farthest from the Root Bridge that must choose a redundant port to block.

(Image 060)

Image Title - SW4 choosing the port connected to SW2 as its Root Port

• In order to better understand the STP Port Roles and Port States and their behavior, please refer to the table below:

The following table is simply to understand the 802.1D STP Port Roles, States and their behavior, but they are not required for the CCNA 200-301 v1.1 exam

STP Port Role	STP Port State	Behavior
Designated Port	Forwarding	Sending/processing Data Frames and BPDUs
Root Port	Forwarding	Single port that is closest to the Root Bridge sending/processing Data Frames and BPDUs
Non-Designated Port	Blocking	Not sending Data Frames and discarding received Data Frames, but still listening and processing BPDUs

STP convergence during link failures

It’s important to understand how STP converges (brings a previously blocking link into service) when the forwarding link fails.

As a reminder, how does STP prevent Layer 2 Loops within a Broadcast Domain? How does STP operate?

One of the main reasons for redundant links between switches is to avoid a total outage and support business continuity if a link fails. But as we discussed, redundant links in Ethernet can create Layer 2 loops. STP solves this by blocking redundant ports on a Non-Root Bridge, leaving one active forwarding path (the Root Port).

So what happens if the Root Port fails?

(Image 061)

Image Title - SW 1 and SW2 redundantly connected and the Root Port on SW2 fails

If the Root Port fails, the Non-Designated Port (the link in the “Blocking” state) must be brought into the “Forwarding” state so traffic can continue flowing between SW1 and SW2. That’s the point of redundancy.

This failover is not instantaneous in 802.1D. In order to ensure a loop free alternative path, the port transitions through several states before it can forward traffic:

• Once SW2 detects that the original Root Port (GigabitEthernet 0/23) has gone down, STP must determine whether an alternate path to the Root Bridge is available that can become the new Root Port. In this case, FastEthernet 0/24 (which was Blocking) has been receiving BPDUs from the Root Bridge (SW1), so it is a valid candidate.

• SW2 then transitions FastEthernet 0/24 from Blocking to Forwarding. Before it can forward, STP triggers a recalculation across the topology. SW2 sends a Topology Change Notification (TCN) BPDU to the Root Bridge, and the Root Bridge floods this information to the other switches. The switches recalculate their topology (if needed) and also verify whether the Root Bridge has changed. SW2 also forces the switch to “flush” (clear out) its MAC Address Table to remove stale MAC addresses learned on the failed port (GigabitEthernet0/23).

• After flushing the MAC table, SW2 moves FastEthernet0/24 from Blocking into the Listening state. In Listening, the port receives and processes BPDUs to confirm it’s safe to move forward (and to detect whether it should revert to Blocking). The port still discards incoming data frames. It remains in this state for 15 seconds.

• After 15 seconds in Listening, FastEthernet0/24 transitions into the Learning state. In Learning, the port begins learning and storing MAC addresses in the MAC table, preparing to forward frames. It still does not forward data frames yet. It remains in this state for another 15 seconds.

• The Listening and Learning states together make up the Forward Delay Timer. This is configurable, but by default it is 30 seconds total (15 seconds Listening + 15 seconds Learning).

• Finally, after the Forward Delay Timer expires (and assuming no further topology changes), FastEthernet 0/24 transitions into the Forwarding state and becomes the new Root Port for SW2.

(Image 062)

Image Title - FastEthernet0/24 on SW2 as the new Root Port

That’s how 802.1D STP converges after a link failure. Below is a complete table of STP port states and their behavior:

The following table is simply to understand the 802.1D STP Port States and their behavior, but they are not required for the CCNA 200-301 v1.1 exam

STP Port State	Behavior
Disabled	The switchport is not enabled
Blocking	Not sending Data Frames and discarding received Data Frames, but still listening for and processing BPDUs
Listening	Processing BPDUs and still discarding Data Frames
Learning	Learning and storing MAC Addresses and BPDUs, but still discarding Data Frames
Forwarding	Sending and processing Data Frames and BPDUs