BPDU (Bridge Protocol Data Unit) is STP’s control packet, used to elect the root bridge, calculate path cost and manage port roles/states in a Layer 2 network.

Facts / key topics

• Standard: IEEE 802.1D / 802.1w / 802.1s · Layer: OSI Layer 2
• Destination MAC: 01:80:C2:00:00:00 (switch-local multicast, not routable)
• Default hello: 2 seconds
• Types: Configuration BPDU / TCN BPDU (802.1D); RSTP uses a single BPDU type with flags

What does a BPDU contain?

A classic Configuration BPDU contains:

Field	Explanation
Protocol ID	Always 0
Version	0 = STP, 2 = RSTP
BPDU type	Config / TCN
Flags	TC, TCA bits (RSTP has more)
Root ID	Root bridge ID
Root path cost	Total cost to root
Bridge ID	Sender’s ID
Port ID	Sender’s port
Timers	Hello, max age, forward delay

Bridge ID (exam important)

Bridge ID = Priority (4 bits + VLAN ID) + MAC address

Default priority = 32768. Lowest Bridge ID = Root Bridge.

BPDU types

• Configuration BPDU (802.1D): sent every 2 seconds by the root, propagated through the network, contains root info
• TCN BPDU: sent when a port goes up/down or the topology changes – triggers MAC table flush
• RSTP BPDU: only one type but with more flags

Flag	Function
TC	Topology change
Proposal	Proposes forwarding
Agreement	Confirms forwarding
Learning	Port in learning
Forwarding	Port in forwarding

👉 The fast convergence comes from these handshake flags.

How BPDUs determine roles

Comparison order: Root ID → root path cost → sender Bridge ID → sender port ID. This is the rule: “Superior BPDU wins” – if a port receives a better BPDU it readjusts its role.

BPDU flow

1. Root sends BPDU
2. Neighbor adds its cost
3. Forwards on
4. The whole network learns the root

BPDU Guard (CCNP important)

If an access port receives a BPDU → shutdown. Used together with PortFast:

interface fa0/1
 spanning-tree bpduguard enable

Root Guard

Prevents a downstream switch from becoming root:

interface gi0/1
 spanning-tree guard root

BPDU Filter

Stops BPDU transmission (dangerous!).

Topology change process (802.1D)

1. Port goes down
2. Switch sends TCN
3. Root sets the TC flag
4. MAC tables flushed
5. Temporary flooding

RSTP TC: no separate TCN – the TC flag is set directly in the BPDU, and only impacted ports are flushed → faster.

Exam tips ⚠️

• Destination MAC always starts with 01:80:C2
• Lowest Bridge ID = root
• Superior BPDU replaces inferior
• RSTP uses proposal/agreement
• BPDU Guard = access security

Troubleshooting

show spanning-tree
show spanning-tree detail
debug spanning-tree events

Problem	Cause
Wrong root	Lower priority on an access switch
Loop	BPDU filtered
Port err-disabled	BPDU guard triggered
Slow convergence	Classic STP

Level	Focus
CCNA	BPDU fields + root election
CCNP	TC analysis, guard features, RSTP handshake

30-second summary

• BPDU = STP control packet · root sends every 2 s · lowest Bridge ID wins · RSTP = handshake flags · guard features protect against loops