STP Design & Topology Choices

STP design is control: who is root and where traffic flows. Choice Why Explicit root bridge predictable flow Secondary root (e.g. 8192) fast, still-predictable failover Per-VLAN roots load balancing in PVST+ MST instance mapping scale with many VLANs Pitfalls: default priority everywhere, no secondary root, inconsistent MST region data.

STP Troubleshooting

Most STP problems reduce to missing BPDUs or bad links. Symptom Likely cause / tool Blocked port unexpectedly forwarding missing BPDUs → Loop Guard should have held it Up/up but one-way traffic unidirectional link → UDLD Duplex mismatch errors fix duplex settings MAC table flapping suspect a loop show spanning-tree show spanning-tree inconsistentports debug spanning-tree […]

UDLD — Unidirectional Link Detection

UDLD detects unidirectional links — classic on fiber where TX works, RX is dead: the interface says up/up but STP breaks and blackholes/loops appear. Devices exchange UDLD hellos; no echo back ⇒ unidirectional. normal logs; aggressive err-disables the port — the production choice. udld aggressive ! global interface Gi1/0/1 udld port aggressive errdisable recovery cause […]

Loop Guard

Loop Guard handles the subtle failure: a blocked port stops receiving BPDUs (upstream STP process hung, CPU overload) — classic STP would age out and forward → loop. With Loop Guard the port goes loop-inconsistent and stays blocked until BPDUs return. Loop Guard UDLD Protects against missing BPDUs (STP logic) unidirectional links (physical) Action loop-inconsistent […]

Root Guard

Root Guard blocks a port from ever becoming the root port: if a superior BPDU arrives, the port enters root-inconsistent (blocks traffic) and recovers automatically when the BPDU stops. Use: downlinks from your root — root → distribution/access. Protects the election, not the topology; not for access ports. One-liner: Root Guard protects the throne — […]

BPDU Filter — the Dangerous One

BPDU Filter hides STP on a port — it solves no loop problem and can create one. Global form: PortFast ports send briefly at link-up and re-enable STP if a BPDU arrives (fail-safe). Per-port form: no sends, ignores receives — STP effectively off on that port. Legit uses: ISP handoffs, controlled labs. On any redundant […]

BPDU Guard

BPDU Guard: receive a BPDU on a (Port)Fast port → error-disable it. “No switches here.” Purpose: stop an access port joining the STP topology. Only makes sense with PortFast; never on uplinks. Fail-safe: dead port over loop.

PortFast

PortFast skips Listening+Learning: the port goes straight to forwarding — for access ports facing end devices only. Solves: 30 s link-up delays and needless TCNs from PCs flapping. STP stays active — faster start, not less STP. Never on uplinks; pair with BPDU Guard.

BPDUs Deep Dive

The BPDU is STP’s control packet: root election, path cost and port roles all flow from it. Sent every 2 s by the root, destination MAC 01:80:C2:00:00:00 — never routed. Configuration BPDU contents Root ID · Root Path Cost · Sender Bridge ID · Sender Port ID · timers (hello/max-age/forward) — compared in that order, […]

STP Flavors Compared (802.1D to MST)

Six flavours, three axes: standard vs Cisco, one instance vs per-VLAN, slow vs rapid. Flavour Standard Instances States Convergence Load balance STP 802.1D 1 (CST) Block/List/Learn/Fwd ~50 s no RSTP 802.1w 1 Discard/Learn/Fwd < 3 s no PVST Cisco, ISL per VLAN legacy ~50 s yes PVST+ Cisco + 802.1Q per VLAN legacy ~50 s […]