Spanning Tree Protocol (STP) is a switch protocol that prevents loops in a Layer 2 network. When you connect switches with extra cables for backup, you create loops. Without STP, a loop can crash the whole network in seconds.

In this guide, you will learn why loops are dangerous, how STP works step by step, and how to check and configure it on Cisco switches.

Spanning Tree Protocol: root bridge SW1 with root ports, designated ports, and one blocked alternate port


STP in One Minute

  • Problem: Extra links between switches create loops, and loops cause broadcast storms.
  • Solution: STP blocks some links so there is only one active path between any two switches.
  • Backup: If an active link fails, STP unblocks a blocked link.
  • Standard: IEEE 802.1D. Modern versions are faster.

Switches work at Layer 2. If you want to see where that fits, read our guide on the OSI Model vs. TCP/IP Model.

Why Do We Need STP?

Networks often have redundant links. If one cable or switch fails, another path keeps the network working. That is good, but at Layer 2 it creates a serious problem.

An Ethernet frame has no TTL (time to live), unlike an IP packet. So when a frame enters a loop, it can travel around forever.

Loops cause three main problems:

  • Broadcast storm: Broadcast frames circle endlessly and fill the links, until the network stops working.
  • MAC table instability: The switch keeps seeing the same MAC address on different ports and keeps changing its table.
  • Duplicate frames: Devices may receive several copies of the same frame.

STP solves this by keeping the redundant links but blocking them until they are needed.

How STP Works Step by Step

STP builds a loop-free "tree" of the network. The switches talk to each other using small messages called BPDUs (Bridge Protocol Data Units).

  1. Elect the root bridge: All switches choose one switch as the center of the tree.
  2. Choose a root port on each non-root switch: This is the port with the best path to the root bridge.
  3. Choose a designated port on each link: This is the port that forwards traffic toward the root on that link.
  4. Block the rest: Any port that is not a root port or a designated port is blocked.

Step 1: Root Bridge Election

Every switch has a Bridge ID. It is made of:

  • Priority: The default is 32768.
  • MAC address: The switch's own MAC address.

The switch with the lowest Bridge ID becomes the root bridge. If the priorities are equal, the lowest MAC address wins.

By default, all switches have the same priority, so the switch with the oldest or lowest MAC address wins. This can be a poor choice, such as an old access switch. That is why engineers set the root bridge manually.

Step 2: Path Cost and Root Ports

Each link has a cost based on its speed. A faster link has a lower cost.

Link speed

Cost

10 Mbps

100

100 Mbps

19

1 Gbps

4

10 Gbps

2

Each non-root switch adds up the costs on the way to the root bridge. The port with the lowest total cost becomes the root port.

STP Port Roles

Role

Meaning

Root port

Best path to the root bridge

Designated port

Forwards traffic on a link

Alternate (blocked)

Backup path, not forwarding

Only root ports and designated ports forward traffic. A blocked port is not an error. It is the reason there is no loop.

STP Port States

In classic STP, a port goes through several states before it forwards traffic:

State

What it does

Blocking

Listens to BPDUs only

Listening

Prepares to forward, no MAC learning

Learning

Learns MAC addresses, no forwarding

Forwarding

Sends and receives data

This process can take 30 to 50 seconds, which is slow. That is why newer versions were created.

Types of Spanning Tree

Type

Standard

Speed

STP

802.1D

Slow (30–50 s)

PVST+

Cisco

Slow

RSTP

802.1w

Fast

Rapid PVST+

Cisco

Fast

  • PVST+ runs a separate spanning tree for each VLAN. It is the default on Cisco switches.
  • RSTP (Rapid STP) reaches a forwarding state in seconds. It uses three states: discarding, learning, and forwarding.
  • Rapid PVST+ is the Cisco version of RSTP, with one tree per VLAN. It is the version most engineers use today.

How to Check STP on a Cisco Switch

Use these commands:

show spanning-tree
show spanning-tree vlan 1
show spanning-tree summary

Example output:

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    4097
             Address     0060.7B12.3A01
             This bridge is the root

Interface   Role Sts Cost  Prio.Nbr Type
Gi0/1       Desg FWD 4     128.1    P2p
Gi0/2       Desg FWD 4     128.2    P2p

Look for these details:

  • Root ID: Shows which switch is the root bridge.
  • Role: Root, Desg (designated), or Altn (alternate).
  • Sts (status): FWD (forwarding) or BLK (blocking).

Basic STP Configuration

Change the mode to Rapid PVST+

SW1(config)# spanning-tree mode rapid-pvst

Choose the root bridge

Set a lower priority on the switch you want as the root. The priority must be a multiple of 4096.

SW1(config)# spanning-tree vlan 1 priority 4096

Or let the switch choose a priority that is lower than the current root:

SW1(config)# spanning-tree vlan 1 root primary

It is also good practice to set a backup root bridge:

SW2(config)# spanning-tree vlan 1 root secondary

PortFast and BPDU Guard

When you connect a PC to a switch, the port waits to go through the STP states. This can delay the connection.

PortFast makes an access port go to the forwarding state right away. Use it only on ports that connect to end devices, such as PCs and printers, and never on links between switches.

SW1(config)# interface g0/5
SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard enable

BPDU Guard shuts the port down if it receives a BPDU. This protects the network if someone connects a switch to a port that should only have a PC.

Common STP Problems

  • Wrong root bridge: An old access switch becomes the root. Set the root manually.
  • Loop from a wrong cable: Connecting two ports on the same switch, or two switches in a loop with STP disabled.
  • PortFast on a switch link: It can cause a temporary loop.
  • Slow network recovery: You are using classic STP. Change to Rapid PVST+.
  • Thinking a blocked port is a fault: A blocked port in STP is normal.

Frequently Asked Questions

What does STP do?

It prevents loops in a Layer 2 network by blocking redundant links.

Why are some switch ports blocked?

Those ports are backup paths. STP blocks them to stop loops, and unblocks them if the active path fails.

Which switch becomes the root bridge?

The switch with the lowest Bridge ID, which means the lowest priority and then the lowest MAC address.

What is a BPDU?

A BPDU is the message that switches send to each other to share STP information. Switches send them every 2 seconds by default.

What is the difference between STP and RSTP?

RSTP is much faster. It recovers in seconds, while classic STP can take 30 to 50 seconds.

Should I disable STP?

No. Disabling STP in a network with redundant links can cause loops. Leave it on.

Is STP used with VLANs?

Yes. On Cisco switches, PVST+ and Rapid PVST+ run one spanning tree for each VLAN.

Conclusion

STP keeps your network safe from Layer 2 loops while allowing backup links. Remember the main steps: elect a root bridge, choose root ports and designated ports, and block the rest. For most Cisco networks, use Rapid PVST+, set the root bridge manually, and protect access ports with PortFast and BPDU Guard.

To practice, build three switches in a triangle in Cisco Packet Tracer and run show spanning-tree to see which port is blocked.

Next on BayteNet: EtherChannel Configuration on Cisco Switches.

Leave a comment if you have any questions!