Spanning Tree Protocol Explained: Root Bridge and Port States

Spanning Tree Protocol (STP) prevents switching loops when an Ethernet network has redundant links. It creates a loop-free logical topology by selecting one switch as the root bridge and placing unnecessary paths into a non-forwarding state.

This guide explains classic IEEE 802.1D STP, Rapid Spanning Tree Protocol (RSTP), Cisco Rapid PVST+, root bridge election, port roles, port states and practical verification commands. Understanding these concepts is essential before configuring larger switched networks or studying advanced enterprise switching.

Why Is Spanning Tree Protocol Needed?

STP is needed because Ethernet frames do not have a Time to Live field like IP packets. If redundant switch links form a Layer 2 loop, broadcast and unknown unicast frames can circulate indefinitely.

Redundant links are still valuable because they provide backup connectivity. STP allows physical redundancy while logically blocking selected paths until they are required.

Consider three switches connected in a triangle:

             SW1
            /   \
           /     \
         SW2-----SW3

Without STP, a broadcast received by SW1 could be forwarded to both SW2 and SW3. Those switches could forward copies across the remaining links, causing the frame to circulate and multiply.

The main effects of a Layer 2 loop are:

• Broadcast storms that consume link bandwidth and switch CPU resources
• Duplicate frames arriving at end devices
• MAC address table instability, also called MAC flapping
• Severe packet loss and network outages

STP keeps one logical path active and places another path in a blocking or discarding state. If the active path fails, STP recalculates the topology and can activate the backup path.

STP operates independently for different VLAN instances in Cisco PVST+ and Rapid PVST+. To understand how VLAN traffic crosses access and trunk links, read VLANs explained with access ports, trunks and inter-VLAN routing.

How Does Spanning Tree Protocol Work?

STP exchanges Bridge Protocol Data Units, or BPDUs, between switches. Information in these BPDUs allows the switches to elect a root bridge, calculate the best paths to that root and identify redundant links.

The basic STP process is:

1. Elect one root bridge for the spanning-tree instance.
2. Select one root port on every non-root switch.
3. Select one designated port for every network segment.
4. Place redundant ports into a non-forwarding role or state.
5. Recalculate the topology when a relevant change occurs.

The resulting topology resembles a tree rooted at the root bridge. There is one active logical path from each switch toward the root, even when the physical network contains several redundant paths.

How Is the STP Root Bridge Elected?

The switch with the lowest Bridge ID becomes the root bridge. The Bridge ID is compared using bridge priority first and MAC address second, so a lower priority always wins before the MAC address is considered.

A Bridge ID contains:

• Bridge priority
• Extended system ID, normally representing the VLAN ID
• Switch MAC address

On Cisco switches using the extended system ID, STP priorities are configured in increments of 4096. The default configured bridge priority is 32768.

Suppose three switches advertise these values for VLAN 10:

SW1 wins because its priority is lower. Its MAC address does not need to be compared with the other switches.

If all switches use the default priority, the switch with the lowest MAC address becomes root. This result may be technically valid but operationally undesirable. The oldest access switch could become root simply because it has a lower MAC address.

Network administrators should therefore configure the intended central or distribution switch with a lower priority.

SW1(config)# spanning-tree vlan 10 priority 24576

Cisco also provides root primary and root secondary commands:

SW1(config)# spanning-tree vlan 10 root primary
SW2(config)# spanning-tree vlan 10 root secondary

The root primary command adjusts the priority so that the switch is likely to become root based on the current topology. It is a configuration macro, not a permanent role that prevents another switch with a lower Bridge ID from winning later.

How Are STP Port Roles Selected?

After electing the root bridge, STP assigns port roles by comparing the total path cost to the root. Root ports and designated ports forward normal traffic, while redundant paths are placed into a non-forwarding role.

Root port

Every non-root switch selects one root port. It is the port with the lowest total path cost toward the root bridge.

The root bridge does not have a root port because it is already the reference point for the topology.

Designated port

Each Ethernet segment selects one designated port. This is the port that advertises the best path from that segment toward the root bridge.

All active ports on the root bridge are designated ports. On a link between two non-root switches, one side becomes designated and the other may become non-designated or alternate.

Alternate and backup ports

RSTP uses the alternate role for a port that provides another path to the root. A backup port is a redundant path to the same shared segment, although this role is uncommon in modern switched Ethernet networks.

Tie-breakers

When two paths have the same cost, STP continues comparing information instead of choosing randomly. The main comparisons are:

1. Lowest root Bridge ID
2. Lowest total root path cost
3. Lowest sender Bridge ID
4. Lowest sender port ID

These comparisons make the result deterministic.

Worked Root Bridge and Port Role Example

In a triangle of three switches, assume SW1 is the root and all links are Gigabit Ethernet with equal STP cost. SW2 has a lower Bridge ID than SW3.

                  SW1 (Root)
          Gi0/1 DP         DP Gi0/2
                /           \
               /             \
      RP Gi0/1 SW2----------SW3 Gi0/1 RP
               Gi0/2      Gi0/2
                 DP          Alternate
                              Discarding

The decisions are:

• SW1 is root, so its active ports are designated ports.
• SW2 selects its direct link to SW1 as its root port.
• SW3 selects its direct link to SW1 as its root port.
• The SW2-to-SW3 segment still needs one designated port.
• Because the root path costs are equal, SW2 wins that segment due to its lower Bridge ID.
• SW3's port toward SW2 becomes alternate and discarding under RSTP.

If the SW3-to-SW1 link fails, the alternate port toward SW2 can transition to forwarding. SW3 then reaches the root through SW2.

What Are the Classic STP Port States?

IEEE 802.1D STP uses blocking, listening, learning and forwarding states for active STP ports, plus disabled for an administratively unavailable port. These states prevent a switch from forwarding user traffic before STP has confirmed that the path is loop-free.

A classic STP port normally moves through this sequence:

Blocking -> Listening -> Learning -> Forwarding

In the listening state, the port participates in STP but does not learn source MAC addresses. In the learning state, it builds the MAC address table but still does not forward user frames. It forwards normal traffic only after entering the forwarding state.

Classic STP commonly uses these default timers:

Convergence can therefore be slow compared with modern RSTP implementations.

How Are RSTP Port States Different?

RSTP, defined by IEEE 802.1w and incorporated into IEEE 802.1D, simplifies the port states to discarding, learning and forwarding. It also uses explicit alternate paths and a proposal-agreement process to achieve faster convergence on suitable point-to-point links.

Cisco Rapid PVST+ runs a rapid spanning-tree instance for each VLAN. This allows different VLANs to use different root bridges, although the design must remain manageable and match the physical uplink capacity.

How Do You Configure and Verify STP on Cisco IOS?

Configure the intended STP mode, control root bridge placement and verify every important VLAN. Avoid changing timers unless a validated network design specifically requires it.

Enable Rapid PVST+ globally:

Switch(config)# spanning-tree mode rapid-pvst

Configure SW1 as root primary and SW2 as root secondary for VLANs 10 and 20:

SW1(config)# spanning-tree vlan 10,20 root primary
SW2(config)# spanning-tree vlan 10,20 root secondary

Verify VLAN 10:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     0011.1111.1111
             This bridge is the root

  Bridge ID  Priority    24586  (priority 24576 sys-id-ext 10)
             Address     0011.1111.1111

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1            Desg FWD 4         128.1    P2p
Gi0/2            Desg FWD 4         128.2    P2p

The displayed priority is 24586 because Cisco adds VLAN ID 10 as the extended system ID to the configured priority of 24576. This bridge is the root confirms that the local switch is root for VLAN 10.

On a non-root switch, inspect the root port and alternate port:

SW3# show spanning-tree vlan 10

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1            Root FWD 4         128.1    P2p
Gi0/2            Altn DSC 4         128.2    P2p

Here, Root FWD is the forwarding path to the root. Altn DSC is an RSTP alternate path in the discarding state; this is expected redundancy, not automatically a fault.

Useful verification commands include:

show spanning-tree
show spanning-tree vlan 10
show spanning-tree root
show spanning-tree summary
show spanning-tree interface gigabitEthernet 0/1 detail
show interfaces trunk
show mac address-table dynamic

These command-reading and configuration skills are covered through guided switch labs in the CCNA course. More advanced Layer 2 design and enterprise redundancy are developed further in the CCNP Enterprise course.

How Should PortFast and BPDU Guard Be Used?

PortFast allows an edge port to enter forwarding without waiting through normal STP transition delays. It should normally be used only on ports connected to end devices, not on links between switches.

Configure an access port for a user device:

Switch(config)# interface gigabitEthernet 0/10
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable

PortFast does not disable STP. The port can still process BPDUs. With BPDU Guard enabled, an unexpected BPDU causes the port to enter an error-disabled condition, helping protect the topology from an unauthorised switch.

Do not configure PortFast on an inter-switch link unless the specific feature, topology and platform behaviour have been carefully validated.

STP Troubleshooting Checklist

Start by identifying the root bridge and blocked path for the affected VLAN. STP problems are often caused by an unexpected root, inconsistent VLAN availability, accidental loops or edge ports connected to switches.

1. Confirm the correct root bridge

show spanning-tree root
show spanning-tree vlan 10

Check the root MAC address and priority. If an access switch became root, configure lower priorities on the intended primary and secondary switches.

2. Check the port role before treating blocking as a fault

An alternate discarding port is normally evidence that STP is preventing a loop. Map the physical topology and confirm whether another forwarding path exists.

3. Verify VLANs on trunk links

show interfaces trunk
show vlan brief

A VLAN may use a different STP topology from another VLAN. Confirm that the VLAN exists and is allowed on every required trunk.

4. Investigate BPDU Guard error-disabled ports

show interfaces status err-disabled
show errdisable recovery
show logging

Remove the unexpected switch or loop before recovering the interface. After fixing the cause, recovery can be performed according to the site's operational policy, for example with shutdown followed by no shutdown.

5. Look for topology changes and MAC flapping

show spanning-tree detail
show mac address-table dynamic
show logging

Frequent topology changes can indicate unstable links, device reboots or incorrect edge-port configuration. A MAC address repeatedly moving between ports may indicate a Layer 2 loop.

6. Check for unidirectional or mismatched links

Inspect interface counters, speed, duplex and physical errors:

show interfaces gigabitEthernet 0/1
show interfaces counters errors

STP depends on reliable BPDU exchange. Features such as Loop Guard and UDLD may provide additional protection in suitable enterprise designs, but they should be configured only after understanding their purpose and platform support.

Summary

Spanning Tree Protocol prevents Ethernet loops while preserving redundant links. It elects the lowest Bridge ID as root, selects root and designated ports using path cost and tie-breakers, and places redundant paths into non-forwarding roles.

Classic STP uses blocking, listening, learning and forwarding states. RSTP uses discarding, learning and forwarding, with alternate port roles and faster convergence. In production networks, define primary and secondary roots, protect edge ports with PortFast and BPDU Guard, and verify the topology per VLAN.

To practise root bridge election, Rapid PVST+, trunking and switch troubleshooting in guided labs, enquire about CCNA course batch details.

Reviewed by Network Rhinos networking trainers.

Related reading: CCNA Interview Questions and Answers for Freshers