Understand Spanning Tree Protocol (STP)

So, imagine you've got lots of switches connected together in a network. At some point, you want to make everything more reliable, so you create backup links between them. You say "if one cable fails, another one takes over." That's great in theory... except that in reality, as soon as you form a loop in the network, everything cracks up. Packets go round and round, the load explodes, and in the end, your network falls to the ground. Welcome to the problem of network loops. And so, Spanning Tree Protocol (STP) was born. The goal? Intelligently disable some ports to break loops, while leaving everyone connected in the end. Originally, STP was a proprietary protocol developed by Cisco, but it later became standardized under IEEE 802.1D. Spanning-tree-free topology problems : Without spanning tree, a network can crash fast: Broadcast storm: packets get duplicated exponentially every time they pass a switch. Double frame: the same frame is received multiple times by the destination, causing network card saturation. MAC table instability: the same host appears under different MAC addresses, often detected as an attack. How does STP solve the problem? STP begins by choosing a boss, a point of reference for the entire network: the Root Bridge. Electing the Root Bridge Each switch balances messages called BPDUs (Bridge Protocol Data Units) to say : "Hey! That's my ID." Each switch has a Bridge ID, which is just a mix between a priority and its MAC address. Priority: this is a number (32768 by default) (2 bytes). MAC address: this... is the MAC address. (6 bytes). Whoever has the smallest ID wins and becomes Root Bridge. (If everyone has the same priority, the smallest MAC wins). Switch Priority MAC Address Result SW0 32768 AA:AA:AA:AA:AA:10 SW0 32768 AA:AA:AA:AA:AA:09 SW1 28672 AA:AA:AA:AA:AA:08 win (lowest priority) SW1 32768 AA:AA:AA:AA:AA:07 SW2 32768 AA:AA:AA:AA:AA:06 SW2 32768 AA:AA:AA:AA:AA:05 Lowest MAC Finding the fastest way to the Root Once the boss is elected, all the other switches ask themselves: "Which way do I go to get to the Root the fastest?" Each link has a cost depending on its speed: Bandwidth Cost 10 Mbps 100 100 Mbps 19 1 Gbps 4 >= 10Gbps 2 The faster, the cheaper. Each switch chooses the path with the lowest cost. Choosing which ports to shut down Once everyone knows where to go, STP will classify the ports: Port Role Root Port (RP) The one that leads to the Root Bridge Designated Port (DP) The one who stays active on a link to serve others Blocked Port (BP) The one that is deactivated to avoid the loop On each link between two switches: Only one switch has its port active (Designated). The other blocks its port to avoid a loop. But, Spanning-tree is slow Each time a port needs to change state, STP goes through several phases: Blocking → "I'm not doing anything, I'm listening." Listening → "Okay, I'm starting to look at the BPDUs." Learning → "I'm starting to learn who's who (MAC addresses)." Forwarding → "Come on, I'm forwarding traffic." Each transition takes 15 seconds (forward delay). So, all in all, a minimum of 30 seconds for a link to become active. That's a long time. Very long. RSTP's arrival Faced with this unbearable slowness, the guys thought: "What if we made it converge in a few seconds instead of waiting two hours?" Rapid Spanning Tree Protocol (RSTP) arrives and does it all better: No more lazy “Listening” and “Learning” steps. A switch can immediately negotiate with its neighbor to switch to Forwarding. Each switch actively sends BPDUs, not just the Root Bridge. Everything converges in a few seconds instead of 30-50. Spanning Tree is really the basis for understanding how a network prevents itself from self-destructing in a loop. Made by h0ag for hwiki.

Apr 26, 2025 - 23:42

So,
imagine you've got lots of switches connected together in a network.
At some point, you want to make everything more reliable, so you create backup links between them. You say "if one cable fails, another one takes over."
That's great in theory... except that in reality, as soon as you form a loop in the network, everything cracks up. Packets go round and round, the load explodes, and in the end, your network falls to the ground.

Welcome to the problem of network loops.

And so, Spanning Tree Protocol (STP) was born.
The goal?
Intelligently disable some ports to break loops, while leaving everyone connected in the end.
Originally, STP was a proprietary protocol developed by Cisco, but it later became standardized under IEEE 802.1D.

Spanning-tree-free topology problems :

Without spanning tree, a network can crash fast:

Broadcast storm: packets get duplicated exponentially every time they pass a switch.
Double frame: the same frame is received multiple times by the destination, causing network card saturation.
MAC table instability: the same host appears under different MAC addresses, often detected as an attack.

How does STP solve the problem?

STP begins by choosing a boss, a point of reference for the entire network:
the Root Bridge.

Electing the Root Bridge

Each switch balances messages called BPDUs (Bridge Protocol Data Units) to say :

"Hey! That's my ID."

Each switch has a Bridge ID, which is just a mix between a priority and its MAC address.

Priority: this is a number (32768 by default) (2 bytes).
MAC address: this... is the MAC address. (6 bytes).

Whoever has the smallest ID wins and becomes Root Bridge.
(If everyone has the same priority, the smallest MAC wins).

Switch	Priority	MAC Address	Result
SW0	32768	AA:AA:AA:AA:AA:10
SW0	32768	AA:AA:AA:AA:AA:09
SW1	28672	AA:AA:AA:AA:AA:08	win (lowest priority)
SW1	32768	AA:AA:AA:AA:AA:07
SW2	32768	AA:AA:AA:AA:AA:06
SW2	32768	AA:AA:AA:AA:AA:05	Lowest MAC

Finding the fastest way to the Root

Once the boss is elected, all the other switches ask themselves:
"Which way do I go to get to the Root the fastest?"

Each link has a cost depending on its speed:

Bandwidth	Cost
10 Mbps	100
100 Mbps	19
1 Gbps	4
>= 10Gbps	2

The faster, the cheaper.

Each switch chooses the path with the lowest cost.

Choosing which ports to shut down

Once everyone knows where to go, STP will classify the ports:

Port	Role
Root Port (RP)	The one that leads to the Root Bridge
Designated Port (DP)	The one who stays active on a link to serve others
Blocked Port (BP)	The one that is deactivated to avoid the loop