Loop Guard
Loop Guard is an STP security mechanism that protects against Layer 2 loops that can occur even with STP enabled. It is applied on non-designated / blocked ports in redundant topologies. Which problem does it solve? 🔴 A port should stay blocked, but stops receiving BPDUs. If a switch stops receiving BPDUs on a port, […]
Root Guard
What is Root Guard? Root Guard prevents a port from becoming a Root Port. Which problem does it solve? Protects against: A wrongly placed Root Bridge An access/distribution switch winning the root election What happens technically? The port receives a BPDU that is “better” than the current root The port is put into root-inconsistent No […]
BPDU Filter — the Dangerous One
What is BPDU Filter? BPDU Filter prevents a port from sending and/or receiving BPDUs. In practice STP is hidden or disabled on that port. Which problem does it solve? BPDU Filter is not made for security but for isolation: An ISP does not want to exchange STP with customers Specialized L2 handoffs Lab/test environments 👉 […]
BPDU Guard
What is BPDU Guard? BPDU Guard shuts a port down when a BPDU is received. Which problem does it solve? Prevents that: A switch gets connected to an access port An access port becomes part of the STP topology What happens technically? The port is typically PortFast A BPDU is received The port is put […]
IGMP Snooping & the Querier Trap
IGMP snooping is a Layer 2 switch feature that listens to IGMP messages so that multicast is only sent to ports with interested hosts – instead of being flooded like broadcast. Facts / key topics Standard: not an IETF protocol – a switch feature · depends on IGMP (IPv4) · OSI: Layer 2 Default behaviour […]
Layer 2 Multicast
Layer 2 multicast is about how switches forward multicast frames based on MAC addresses, and how flooding is limited with IGMP snooping. Facts / key topics Standard: IEEE 802.3 (Ethernet) · OSI: Layer 2 (Data Link) MAC range (IPv4 multicast): 0100.5E00.0000 – 0100.5E7F.FFFF MAC range (IPv6 multicast): 33:33:xx:xx:xx:xx Default switch behaviour: flooding (like broadcast) · […]
VLANs & the VLAN 1 Problem
A VLAN creates separate Layer 2 broadcast domains on the same physical switch. Devices in the same VLAN communicate directly at Layer 2; communication between VLANs requires routing. VLANs improve security, performance and network structure. Key points (CCNA) Point Explanation Purpose Segment the network Layer Layer 2 Broadcast One broadcast domain per VLAN VLAN ID […]
BPDUs Deep Dive
BPDU (Bridge Protocol Data Unit) is STP’s control packet, used to elect the root bridge, calculate path cost and manage port roles/states in a Layer 2 network. Facts / key topics Standard: IEEE 802.1D / 802.1w / 802.1s · Layer: OSI Layer 2 Destination MAC: 01:80:C2:00:00:00 (switch-local multicast, not routable) Default hello: 2 seconds Types: […]
STP Flavors Compared (802.1D to MST)
Different STP flavors solve the same problem – loop prevention – with different trade-offs in convergence, VLAN support, vendor independence and scalability. Overview table STP type Standard What it does Where used Why used PVST Cisco proprietary One STP instance per VLAN Legacy Cisco Load balancing between VLANs PVST+ Cisco One instance per VLAN + […]
Spanning Tree — Root Election & Config
Spanning Tree Protocol prevents Layer 2 loops by electing one active path and blocking redundant links. The Root Bridge is elected based on the lowest Bridge ID (priority first, then MAC). The Root Port is the port with the lowest path cost toward the Root Bridge. Facts Topic Explanation Problem Broadcast storms, MAC flapping Solution […]