STP (Spanning Tree Protocol) Complete Guide

What is STP (Spanning Tree Protocol)?

STP (Spanning Tree Protocol), defined in IEEE 802.1D, is a Layer 2 network protocol that prevents switching loops in Ethernet networks with redundant paths. Without STP, a broadcast storm would occur — frames would loop endlessly through redundant switch paths, consuming all available bandwidth and bringing the network down within seconds.

STP works by electing a root bridge and then logically blocking redundant paths, keeping exactly one active path between any two network segments. If the active path fails, STP unblocks a previously blocked port to restore connectivity — automatically and without manual intervention.

Why is STP Important?

In enterprise networks, redundant switch connections are deliberately designed for fault tolerance. But redundancy without STP creates three dangerous problems:

Broadcast storms: Broadcast frames loop endlessly, consuming all bandwidth.
MAC address table instability: Switches keep updating MAC tables as frames loop, causing instability.
Multiple frame copies: Devices receive duplicate frames, causing application errors.

How STP Works — Step by Step

Step 1: Root Bridge Election

All switches in a STP domain elect a single Root Bridge — the central reference point for the entire topology. The election process:

Each switch starts by claiming to be the root bridge.
Switches exchange BPDU (Bridge Protocol Data Units) messages.
The switch with the lowest Bridge ID wins the election.
Bridge ID = Priority (default 32768) + MAC address.

To control which switch becomes the root bridge, lower its priority: spanning-tree vlan 1 priority 4096

Step 2: Root Port Selection

Every non-root switch selects one Root Port (RP) — the port with the best path to the root bridge. Path cost is determined by link speed:

Link Speed	STP Cost (802.1D)	RSTP Cost (802.1w)
10 Mbps	100	2,000,000
100 Mbps	19	200,000
1 Gbps	4	20,000
10 Gbps	2	2,000

Step 3: Designated Port Selection

On each network segment, one port is elected as the Designated Port (DP) — the port that forwards traffic on that segment. The root bridge’s ports are always designated ports.

Step 4: Blocking Redundant Ports

Any port that is neither a Root Port nor a Designated Port becomes an Alternate Port and is placed in Blocking state — it does not forward traffic but continues to listen for BPDUs.

STP Port States

State	Duration	Forwards Data?	Learns MACs?	Sends BPDUs?
Blocking	20 sec (Max Age)	No	No	No
Listening	15 sec (Forward Delay)	No	No	Yes
Learning	15 sec (Forward Delay)	No	Yes	Yes
Forwarding	Indefinite	Yes	Yes	Yes
Disabled	N/A	No	No	No

Total STP convergence time = 30–50 seconds (blocking → listening → learning → forwarding). This is why RSTP was developed.

STP Timers

Hello Time (2 sec): How often the root bridge sends BPDUs.
Max Age (20 sec): How long a switch stores BPDU info before discarding it.
Forward Delay (15 sec): Time spent in Listening and Learning states.

RSTP vs STP — Key Differences

RSTP (Rapid Spanning Tree Protocol), defined in IEEE 802.1w, dramatically improves convergence time from 30–50 seconds to 1–2 seconds. RSTP is backward compatible with STP and is the recommended standard today.

Feature	STP (802.1D)	RSTP (802.1w)
Standard	IEEE 802.1D	IEEE 802.1w
Convergence Time	30–50 seconds	1–2 seconds
Port States	5 states	3 states (Discarding, Learning, Forwarding)
Port Roles	Root, Designated, Blocked	Root, Designated, Alternate, Backup
BPDU Handling	Only root bridge generates BPDUs	All switches generate BPDUs
Topology Changes	Slow propagation	Rapid propagation

MSTP — Multiple Spanning Tree Protocol

MSTP (IEEE 802.1s) allows multiple VLANs to be mapped to a single STP instance, reducing the number of spanning tree instances running on a network. This improves load balancing and reduces CPU overhead compared to PVST+ (Per-VLAN Spanning Tree Plus) which runs a separate STP instance per VLAN.

STP Configuration on Cisco Switches

Enable RSTP (Rapid PVST+)

Switch(config)# spanning-tree mode rapid-pvst

Set Root Bridge Priority

Switch(config)# spanning-tree vlan 10 priority 4096
Switch(config)# spanning-tree vlan 10 root primary

Enable PortFast (for Access Ports)

Switch(config-if)# spanning-tree portfast
Switch(config)# spanning-tree portfast default

Enable BPDU Guard

Switch(config-if)# spanning-tree bpduguard enable
Switch(config)# spanning-tree portfast bpduguard default

Verify STP Status

Switch# show spanning-tree
Switch# show spanning-tree vlan 10
Switch# show spanning-tree summary

STP Security Features

BPDU Guard: Disables a PortFast-enabled port if it receives a BPDU — prevents rogue switches from connecting.
Root Guard: Prevents a port from becoming a root port even if it receives superior BPDUs.
Loop Guard: Prevents alternate or root ports from becoming designated ports when BPDUs stop being received.
BPDU Filter: Prevents BPDUs from being sent or received on PortFast ports.

STP Troubleshooting

Common STP Issues and Solutions

Issue	Symptom	Solution
Unintended root bridge	Wrong switch is root, slow performance	Set correct root bridge priority
Slow convergence	30–50 sec network outage on topology change	Migrate to RSTP / enable PortFast on access ports
Broadcast storm	High CPU, network unusable	Check for STP disabled or misconfigured
Topology change loop	Repeated MAC table flushes	Enable BPDU Guard and Root Guard

Frequently Asked Questions

What is the difference between STP and RSTP?

STP (802.1D) takes 30–50 seconds to converge after a topology change. RSTP (802.1w) converges in 1–2 seconds. RSTP also adds new port roles (Alternate, Backup) and all switches generate BPDUs, making it more proactive.

What is a BPDU?

A BPDU (Bridge Protocol Data Unit) is the message switches exchange to elect the root bridge and determine the STP topology. BPDUs contain the Bridge ID, root bridge information, and path cost values.

Should I use PVST+ or Rapid PVST+?

Always use Rapid PVST+ (or MSTP) in modern networks. The original STP (PVST+) is outdated — its 30–50 second convergence time is unacceptable for production networks.

What is PortFast and when should I use it?

PortFast allows a switch port to immediately enter the Forwarding state, bypassing the Listening and Learning states. Use it only on access ports connected to end devices (PCs, printers) — never on trunk ports or ports connected to other switches.

Written by

Gurpreet Singh

Hey! I"m Gurpreet Singh and I Have 7+ Years of experience in the Network & Security Domain as well as the Cloud Infra Domain. I am Certified with Cisco ( CCNA ), CheckPoint ( CCSA ), 1xAWS, 3xAZURE, and 3xNSE. So I love to share my tech knowledge with you.