What is BPDU Filter?

BPDU Filter prevents a port from sending and/or receiving BPDUs. In practice STP is hidden or disabled on that port.

Which problem does it solve?

BPDU Filter is not made for security but for isolation:

• An ISP does not want to exchange STP with customers
• Specialized L2 handoffs
• Lab/test environments

👉 It solves no loop problems – it can create them.

What happens technically – two behaviours

Global BPDU Filter (fail-safe)

• Only applies to PortFast ports
• Sends BPDUs briefly at link-up
• If a BPDU is received → STP is re-enabled on the port

Per-port BPDU Filter

• Sends no BPDUs
• Ignores all received BPDUs
• STP is effectively disabled on the port

Where is it used?

• ISP links, highly controlled environments

Pitfalls 🚨

• Use on uplinks = loop
• Use in redundant topologies = loop
• The most misused STP feature

One-liner: BPDU Filter hides STP – it protects nothing