Section 25: STP - Spanning Tree Protocol

Are all ports on the Root Bridge always Designated ports?

Yes

How is a switch's Root Port selected?

The interface on the lowest-cost path to the Root Bridge.

What is the default STP Forward Delay timer?

15 seconds

For a port on shared media (e.g. a hub), what's the timing from Discarding to Forwarding?

Discarding→Learning is nearly instant; Learning→Forwarding takes one Forward Delay timer (15s default).

In a Bridge Priority tie, how is the Root Bridge chosen?

Lowest MAC address wins.

What is PVST+?

Cisco's enhancement to 802.1D STP; the default STP mode on Cisco switches.

What makes up a switch's Bridge ID?

MAC address + administrator-defined Bridge Priority.

What is RPVST+?

Cisco's enhancement to 802.1w RSTP; significantly improves convergence over PVST+.

What does Root Guard prevent?

An unintended switch from becoming the Root Bridge.

What's distinctive about 802.1D regarding VLANs?

One single spanning tree instance for all VLANs (vs. per-VLAN in PVST+/RPVST+).

What is the default Bridge Priority?

32768

What port role sits on the neighboring switch directly opposite a Root Port?

Designated Port

What is MSTP (802.1s) used for?

Grouping/mapping VLANs into different spanning tree instances for load balancing

What state is a port in immediately when it comes online?

Blocking (802.1D) / Discarding (RPVST+)

What protects against loops on Portfast-enabled ports?

BPDU Guard

What does Switch(config-if)# spanning-tree bpdufilter enable do, and why is it risky?

Disables BPDU processing on that interface entirely — effectively disables STP loop protection there.

Which STP port state is eliminated in RPVST+ compared to 802.1D?

Listening

Which STP versions rely on timer-based convergence?

PVST+ and 802.1D (not RPVST+ or RSTP).

Is standard RSTP (802.1w) itself supported on Cisco switches?

No — Cisco implements RPVST+ instead.

What is a broadcast storm, and why is it so damaging?

Uncontrolled looping of broadcast traffic across redundant Layer 2 links — it multiplies rapidly and can overwhelm switch CPU and bandwidth, effectively crashing the network.

What's the tradeoff of using STP to prevent loops?

STP blocks physically cabled, working links to prevent loops — this reduces available uplink bandwidth (e.g. from 2Gb to 1Gb if one of two uplinks is blocked) and has relatively slow convergence (up to 50 seconds with legacy 802.1D).

Why can't a Layer 2 loop resolve itself the way a Layer 3 routing loop can?

The Ethernet Layer 2 header has no TTL field (unlike the IP header at Layer 3), so looping broadcast traffic will loop forever unless something (like STP) actively prevents it.

What's the difference between Short-Mode and Long-Mode STP path cost, and which is the default?

Short-Mode (16-bit, default) maxes out at a cost of 1 for any interface ≥20 Gbps, making faster interfaces indistinguishable. Long-Mode (32-bit) is more granular, distinguishing costs up to 20 Tbps — must be enabled consistently on all switches if used.

Does STP load balance across multiple equal-cost paths to the Root Bridge?

No — STP always selects a single best path. Ties are broken by the lowest neighbor Bridge ID, then (if still tied) the lowest Port ID.

How does a switch know when to transition a Blocked/Alternate port back to forwarding after a topology change?

The Designated Port continues sending BPDUs across a blocked link. If the blocked side stops receiving those (better) BPDUs — e.g. because the upstream link failed — it unblocks and becomes the new Designated/Root Port.

What's the key structural difference between MSTP (802.1s) and Cisco's PVST+/RPVST+ regarding VLANs and instances?

MSTP allows multiple VLANs to be grouped into a single spanning tree instance. PVST+ and RPVST+ always run one separate instance per individual VLAN — more load on the switch, even though both support VLAN-based load balancing

What happens to existing Spanning Tree configuration when migrating a switch from PVST+ to Rapid-PVST+?

It carries over unchanged — same configuration and verification commands work for both; only convergence speed improves.

In Cisco's show spanning-tree output, what protocol name is shown even when the switch is running Cisco's proprietary PVST+?

IEEE — this is a quirk of Cisco's naming; it doesn't mean the switch is running a standard IEEE version like RSTP or MSTP.

In show spanning-tree output, what's the difference between the Root Path Cost (in the Root ID section) and the interface cost shown per-port?

Root Path Cost is the total cumulative cost across every link back to the Root Bridge. The per-interface cost is just that individual link's own cost — you add up the interface costs along the path to get the cumulative Root Path Cost.

Why might traffic in a switched network take a longer physical path than necessary, even with full connectivity available?

Because STP forces all traffic onto a single tree topology (not a routing protocol calculating shortest paths) — traffic follows whatever path the Spanning Tree has built, which isn't guaranteed to be the most direct route between two specific hosts.

What Bridge Priority values do root primary and root secondary commands set?

root primary sets 24576; root secondary sets 28672 (both better than the default 32768).

Why is it safe to enable Portfast on a port connecting to a normal end host, but not on a port connecting to another switch?

An end host doesn't forward frames it receives back into the network (it's not a bridge), so it can never create a loop. A switch port can form a loop, so Portfast should never be enabled there.

Why is automatic errdisable recovery for BPDU Guard generally not recommended?

If the root cause (e.g. an unauthorized switch) isn't fixed, the port will keep flapping — coming back up, immediately receiving another BPDU, and going back down again on a repeating cycle.

How does BPDU Filter differ from BPDU Guard in how it handles a received BPDU?

BPDU Guard error-disables (shuts down) the port entirely. BPDU Filter does not shut the port down — its behavior instead depends on where it's configured (global vs. interface level).

What's the difference between enabling BPDU Filter globally vs. at the interface level?

Globally, it only applies to Portfast-enabled ports — it stops sending BPDUs, but if one is received, Portfast/filtering is removed and the port reverts to normal STP behavior. At the interface level, it fully disables STP on that port (no BPDUs sent or processed).

What does Loop Guard protect against?

Unidirectional link failures — it prevents a Root or Blocking port from transitioning to Designated/forwarding just because it stopped receiving expected BPDUs (which would otherwise create a one-way loop).

Which port roles does Loop Guard actually operate on?

Root ports and Blocking (non-designated) ports only — not Designated ports, since BPDUs aren't expected there anyway.

What state does Loop Guard place a port into when it detects a problem, and does it recover automatically?

Loop-inconsistent (blocking) state — it recovers automatically once BPDUs are received again.

Can Loop Guard and Root Guard be enabled on the same port?

No — they're mutually exclusive, since they do opposite things (Root Guard stops a Designated port from becoming non-designated; Loop Guard stops a non-designated port from becoming Designated). Enabling one disables the other on that port.

What's the alternative, non-STP mechanism for detecting unidirectional links, and how does it work?

UDLD (Unidirectional Link Detection) — a separate Layer 2 protocol that sends keepalives in both directions to detect the failure.

What is the default STP Max Age Timer, and when does it come into play?

20 seconds — applies during reconvergence after a failure, before a previously blocking port begins transitioning toward forwarding.

What convergence mechanism do RSTP/RPVST+/MSTP use instead of the old timer-based approach?

A proactive Proposal/Agreement (sync) mechanism — switches directly negotiate whether a port can safely go forwarding, rather than waiting out fixed timers.

Do RPVST+/RSTP/MSTP require Uplinkfast and Backbonefast to be manually configured for fast convergence?

No — equivalent fast convergence is built in automatically, unlike PVST+/802.1D where those Cisco proprietary features must be manually enabled.

In a network with mixed STP versions, how does a switch running a newer version behave toward a neighbor running an older version?

It falls back to the older version on that specific port only (detected via BPDU version/type fields) — fast convergence is only available on ports where both sides run the newer version.

What's the difference between an Alternate port and a Backup port in RSTP/RPVST+?

Alternate is a standby for a Root Port (an alternate path to the Root Bridge). Backup is a standby for a Designated Port on a shared segment (e.g. a redundant link into a hub) — not seen on normal switch-to-switch links.

Why does connecting a hub prevent rapid convergence on that RPVST+ port?

RPVST+ only supports rapid convergence on full-duplex, point-to-point links. A hub forces half-duplex, so RPVST+ classifies that port as "shared" and falls back to the old timer-based convergence.