Spanning Tree Protocol: roles, states, root

What spanning tree does, and the order it decides in

Spanning Tree Protocol (STP, IEEE 802.1D, with the rapid version 802.1w) keeps a switched network with redundant links free of Layer 2 loops by electing one root bridge and blocking every port that would create a second path to it. Switches exchange BPDUs (bridge protocol data units) to do this, and the result is always decided in the same order: root bridge first, then one root port per non-root switch, then one designated port per segment, and everything left over blocks. The decision rule for any exam question: lowest bridge ID wins the root, lowest path cost to the root wins the root port, and ties are broken by lowest sender bridge ID, then lowest sender port ID.

Without it, a broadcast frame circles a looped topology forever, because Ethernet frames carry no hop count. The switches flood it out of every port, the copies multiply, and the network collapses into a broadcast storm.

The election, step by step

1. Root bridge. Each switch has a bridge ID made of a priority and its MAC address. The lowest bridge ID wins; priority is compared first and the MAC only breaks a tie. The default priority is 32768, set in steps of 4096. On Cisco switches running per-VLAN spanning tree, the VLAN number is added to the priority (the 12-bit extended system ID), so VLAN 10 with default priority has 32778.
2. Root port on every non-root switch: the port with the lowest total path cost to the root. Ties go to the lower neighbour bridge ID, then the lower neighbour port ID.
3. Designated port on every segment: the port that offers the lowest root path cost onto that segment. All ports on the root bridge are designated.
4. Alternate (or backup) ports are the rest. They stay in the discarding state.

Cost is per link, and the commonly used short values are 100 for 10 Mb/s, 19 for 100 Mb/s, 4 for 1 Gb/s and 2 for 10 Gb/s. Cisco platforms can also use a long method with much larger numbers, so on a real question read which one is configured before adding. A Catalyst 9300 guide on Cisco’s site also notes that Rapid PVST+ is that platform’s default mode.

A worked election on three switches

Three switches in a triangle, all links 1 Gb/s (cost 4), VLAN 1, so each has priority 32769. MAC addresses: SW1 0050.0000.0001, SW2 0050.0000.0002, SW3 0050.0000.0003.

• Root: priorities tie, MAC decides. SW1 is root.
• Root ports: SW2 reaches the root directly at cost 4 (via SW3 it would be 8). SW3 likewise. Both root ports face SW1.
• Designated ports: both SW1 ports are designated. On the SW2-SW3 link both switches advertise root cost 4, so the lower bridge ID wins: SW2’s port is designated.
• Blocked: SW3’s port on the SW2-SW3 link is the alternate port and goes to discarding.

If the exam asks what happens when the SW1-SW3 link fails, the alternate port becomes the new root port and moves to forwarding. With rapid STP that takes about a second or less, not the roughly 30 to 50 seconds of 802.1D. Set SW3’s priority to 4096 instead (a lower number, so a better bridge ID) and SW3 becomes root, and every role above is recomputed.

Port roles and states, classic versus rapid

Cisco’s own STP documentation states the merge: discarding in rapid STP replaces disabled, blocking and listening. The new alternate role is the standby path to the root through another switch; backup is a redundant path to the same segment, which you meet mostly on hubs or shared media. Cisco’s term PVST+ runs one tree per VLAN on 802.1D rules, Rapid PVST+ does the same with 802.1w rules, which is the version the CCNA outline names. Because each VLAN has its own tree, you can make different switches root for different VLANs and balance traffic over both uplinks.

PortFast and BPDU guard

Ports that connect to hosts and servers do not need to wait through STP states. PortFast (the rapid STP edge port) puts the port in forwarding immediately when the link comes up, and a link change on it does not trigger a topology change. Cisco’s guidance is to enable it only on edge ports, never on a port that can receive BPDUs or create a loop.

BPDU guard protects that assumption: if a PortFast port receives a BPDU, the switch disables it (it goes err-disabled, and you recover it by shutting and re-enabling the interface or with an err-disable recovery timer). A typical configuration:

interface g0/5
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable

Related protections the CCNA outline lists: root guard (refuses to let a port become root-facing, so a rogue switch cannot take over as root), loop guard, and, in v1.1 only, BPDU filter (stops sending and processing BPDUs, which is dangerous on ports that could loop). Related reading: VLANs and trunking covers the trunks that BPDUs travel across.

Which exams test this

How spanning tree questions are built

Most questions hand over bridge IDs and ask who is root, or draw a triangle and ask which port blocks. The traps: comparing MAC before priority, forgetting the VLAN number added to the priority, and counting cost from the wrong end (cost is added as BPDUs enter a port, so use the path from the root). Constraint words that decide the answer: “lowest priority” (the lower number wins), “per VLAN” (separate trees), “host-facing” or “end-user port” (PortFast plus BPDU guard), “rogue switch” (root guard or BPDU guard), and “convergence in seconds” (rapid, not classic). For practice drawing, use the CCNA study plan.

Practice questions

Go deeper

• Cisco: Understanding Rapid Spanning Tree Protocol (802.1w)
• Cisco: Troubleshoot STP problems and related design considerations
• Cisco: Catalyst 9300 configuring spanning tree
• Related on this site: VLANs and trunking, OSI vs TCP/IP and the CCNA cheat sheet.