STP and Loops - Spanning Tree, RSTP and LACP
- An Ethernet frame has no TTL, and switches flood broadcasts, so a physical loop makes frames circulate and multiply until the links are full. Redundant links need a protocol that keeps them from forming an active loop.
- STP (IEEE 802.1D) turns the mesh into a tree. Switches exchange BPDUs, elect the root bridge (lowest bridge ID, which is priority plus MAC), give each other switch one root port, give each segment one designated port, and block every other port.
- Classic STP is slow: a port walks blocking, listening (15 s), learning (15 s), forwarding, so a recovery takes 30 s, or 50 s if it first has to wait out the 20 s max age. RSTP (802.1w) replaces the timers with a handshake and converges in a few seconds or less.
- STP buys safety by blocking redundant links. LACP (802.1AX) bundles parallel links into one logical link, and data centres avoid L2 loops altogether by routing to the top-of-rack switch.
- The classic outage is a rogue or misconfigured switch that wins the root election, or a link that goes one-way. Defences are vendor features: edge ports, BPDU guard, root guard, loop guard.
Mental model
A town has a ring road of one-way streets, and a delivery van that enters it never finds an exit sign, so it circles. Worse, every time a van passes a junction with a depot, the depot sends out another copy of the van. Soon the ring is solid with vans. The traffic police fix it by closing one street so the roads form a branching tree with exactly one route between any two places. The closed street is not demolished: if another street is blocked by roadworks, the police reopen it.
Where it breaks: a real closed street is closed for ever and everyone knows. In STP the choice of which road closes is renegotiated by the junctions themselves every time something changes, and a mistake in that conversation (a new junction claiming to be the town centre) can reroute the whole town. Also, the closed street carries no traffic at all, so half the road capacity may sit idle.
STP computes a spanning tree of a graph. The switches are vertices and the links are edges, and the algorithm keeps a connected subgraph with no cycle. It is like a BFS (or shortest-path) tree grown from the root, with edge weights from link speed, run distributed: no switch sees the whole graph, each only compares messages from neighbours. The contrast with IP is the TTL: a routed packet that loops is killed by its hop limit (IP packet, routing overview), while a layer 2 frame has no such field, so the topology itself must contain no cycle.
Where it breaks: a minimum spanning tree minimises total weight, but STP minimises each switch's path cost to the root, which is a shortest-path tree. It also keeps no memory of load: the tree is chosen by link speed and ID, not by traffic, so some links carry everything and others nothing.
How it works
Switches and MAC learning owns how a switch learns, floods and forwards, and shows the broadcast storm in a triangle. The short version: flooding plus a cycle plus no TTL equals frames that never die, and the same source MAC arriving on two ports in turn makes the MAC table flap. This page owns the cure.
Step 1: everyone claims to be root
Each switch has a bridge ID of 8 bytes: a 2-byte priority field (default 32768, 0x8000) and the switch's 6-byte MAC address. The lowest bridge ID wins, so a lower priority beats a higher one, and on equal priority the lower MAC wins. Switches send BPDUs (Bridge Protocol Data Units) to the reserved multicast address 01:80:C2:00:00:00, which a standard bridge never forwards, so each BPDU travels exactly one hop (IEEE 802.1D-2004).
The worked example is the triangle below. All three switches use default priority, and the MACs are invented for the example. All three links are 1 Gbit/s.
| Switch | Priority | MAC | Bridge ID (priority.MAC) |
|---|---|---|---|
| S1 | 32768 | 00:11:22:00:00:10 | 8000.00:11:22:00:00:10 |
| S2 | 32768 | 00:11:22:00:00:20 | 8000.00:11:22:00:00:20 |
| S3 | 32768 | 00:11:22:00:00:30 | 8000.00:11:22:00:00:30 |
At power-up every switch assumes it is the root and sends a BPDU saying so, with a root path cost of 0.
Step 2: the lowest bridge ID becomes root
S2 receives S1's BPDU claiming root 8000.00:11:22:00:00:10. Priorities are equal, and ...:10 is lower than its own ...:20, so S2 abandons its claim, adopts S1 as root, and relays the news. S3 does the same. The BPDUs agree within a round or two, and S1 is the root bridge. The root keeps sending a BPDU every hello time (2 s), and every other switch relays it.
Step 3: each non-root switch picks one root port
A BPDU carries the sender's cost to the root. A switch adds the cost of the port it arrived on and keeps the port with the lowest total as its root port. At 1 Gbit/s the cost is 4 (802.1D-1998 recommended value, table below).
For S2:
| Port | Hears from | BPDU root cost | + own port cost | Total |
|---|---|---|---|---|
| p1 | S1 directly | 0 | 4 | 4 |
| p2 | S3 (while S3 is still sending on that link, it advertises its own cost 4) | 4 | 4 | 8 |
S2's root port is p1. S3 is the mirror image and its root port is its port to S1. If two ports tie on cost, the lower sender bridge ID wins, then the lower sender port ID.
Step 4: each segment gets one designated port
Every link (a segment) needs exactly one port that forwards toward the root and away from it: the designated port, which is the one with the lowest root path cost on that segment.
- S1 is the root, so its cost is 0 on both its links, and both its ports are designated.
- On the S2-S3 segment, S2 offers cost 4 (the cost via its root port) and so does S3. It is a tie. The tie-break is the lower bridge ID of the sender, and
...:20beats...:30. S2's port is designated.
Step 5: everything else blocks
S3's port toward S2 is neither a root port nor a designated port, so it blocks (STP state blocking; RSTP calls the role alternate). It still listens for BPDUs, but it receives no data and sends none. The cycle S1-S2-S3 is broken at exactly one point.
Step 6: reading the result
Every host can still reach every other host, along exactly one path through the tree. Traffic between S2 and S3's hosts goes S2 to S1 to S3, not along the direct S2-S3 link, even though that link is physically there. If S1-S2 fails, the blocked port is the spare that gets promoted.
The port roles are summarised here. Roles are decisions; states (how a port treats frames) come next.
| Role | Meaning | Forwards data? |
|---|---|---|
| Root port | The port with the best path to the root. One on every non-root switch. | Yes |
| Designated port | The port with the best path to the root on its segment. One per segment (every port of the root). | Yes |
| Blocked (STP) / alternate (RSTP) | Not root or designated. Alternate: a backup path to the root through another switch. | No |
| Backup (RSTP only) | A second port of the same switch on a segment where it already has a designated port. | No |
| Disabled | Administratively down. | No |
BPDU format
The fields add up: 2 (protocol ID) + 1 (version) + 1 (type) + 1 (flags) + 8 (root ID) + 4 (root path cost) + 8 (bridge ID) + 2 (port ID) + 2 + 2 + 2 + 2 (message age, max age, hello time, forward delay) = 35 bytes. A topology change notification BPDU is only 4 bytes (protocol ID, version, type). The 802.1w BPDU is version 2 and adds a version 1 length byte, making it 36 bytes. Source for the layout: IEEE 802.1D-1998 and 802.1D-2004.
Deep dive
Path costs, and why there are two tables
A port's cost depends on its link speed, and the standard changed the table when links outgrew it. The 1998 edition recommends values that cannot tell 10 Gbit/s from anything faster, so the 2004 edition (building on 802.1t-2001) uses a 32-bit scale that derives cost from 20 Tbit/s divided by link speed.
| Link speed | Short (802.1D-1998 recommended) | Long (802.1D-2004, 20 Tbit/s / speed) |
|---|---|---|
| 10 Mbit/s | 100 | 2,000,000 |
| 100 Mbit/s | 19 | 200,000 |
| 1 Gbit/s | 4 | 20,000 |
| 10 Gbit/s | 2 | 2,000 |
| 100 Gbit/s | not in the table | 200 |
Mixing the two modes on one network makes costs incomparable, so every switch in a tree must use the same one. Whether a vendor defaults to short or long is vendor-specific.
Root election details
Four comparisons decide every choice, in this order: lowest root bridge ID, lowest root path cost, lowest sender bridge ID, lowest sender port ID. The root election is the first one. Two practical rules follow.
- Lower wins. Setting a priority of 4096 on the switch you want makes it root. Priority is configured in steps of 4096 on modern implementations because 802.1t carved the top 4 bits of the 16-bit priority field for the priority and used the low 12 bits as the system ID extension, which per-VLAN STP fills with the VLAN ID. 32768 is 8 x 4096.
- Default ties go to the oldest hardware. With all priorities at 32768 the lowest MAC wins, and manufacturers usually number MACs upward, so an old closet switch often becomes root of a modern network. Set the root and a secondary root deliberately.
Port states and timers
In classic STP a port does not jump to forwarding, because the new topology may not have settled and forwarding early can create a temporary loop. It walks through four states (IEEE 802.1D-1998).
| State | Receives BPDUs | Learns MACs | Forwards data | Duration |
|---|---|---|---|---|
| Blocking | Yes | No | No | Up to max age (20 s) when old BPDU information has to age out |
| Listening | Yes, and sends them | No | No | Forward delay, 15 s |
| Learning | Yes | Yes | No | Forward delay, 15 s |
| Forwarding | Yes | Yes | Yes | Until the topology changes |
Learning before forwarding lets the MAC table fill in so the port does not flood everything the moment it opens.
Convergence arithmetic
The 802.1D-1998 defaults are hello 2 s, max age 20 s, forward delay 15 s. Two failure types follow.
- Direct failure (the switch sees its own link go down): the standby port goes listening 15 s, then learning 15 s, so 15 + 15 = 30 s.
- Indirect failure (something in the middle silently stops passing BPDUs): the switch cannot know until the stored BPDU ages out. It waits max age, then runs both delays, so 20 + 15 + 15 = 50 s.
That is the "30 to 50 seconds" figure. Applied to the worked example, if the S1-S2 link goes down and S2 notices, S2's hosts reach nothing past S2 until S3's blocked port has walked to forwarding, about 30 s.
Topology changes and MAC tables
When a port moves in or out of forwarding, the MAC tables hold entries that may point down a path that no longer exists. In 802.1D the switch that sees the change sends a TCN BPDU toward the root. The root then sets the topology change flag in its BPDUs for max age + forward delay = 20 + 15 = 35 s, and every switch ages its MAC entries out at the short forward delay (15 s) instead of the usual default (300 s) while the flag is set. Until the entries expire or are relearned, frames to a moved host are flooded.
This is why a flapping port hurts: each flap restarts that cycle and keeps flushing tables, so the network spends its time flooding. The cost is the one described in switches and switching.
RSTP: IEEE 802.1w
Rapid STP (802.1w-2001, folded into 802.1D-2004) keeps the same election and BPDUs but replaces the timer walk:
- Port states shrink to discarding, learning, forwarding. Roles are root, designated, alternate and backup. An alternate port is a pre-computed replacement root port, so on failure it can take over at once.
- Proposal and agreement: a designated port that wants to forward sends a BPDU with the proposal flag. The neighbour blocks its other non-edge ports (a sync), then answers with agreement, and the proposer forwards immediately. The handshake runs hop by hop down the tree, so it costs a round trip per hop, not 30 s.
- BPDU timeout is three missed hellos (6 s at the default hello of 2 s) rather than waiting for max age, and each switch sends its own BPDUs instead of only relaying the root's.
- Edge ports (a host port, see below) go straight to forwarding.
- A topology change is declared only when a non-edge port goes to forwarding, so a laptop plugged in does not flush the network.
The handshake needs point-to-point links (full-duplex). On a shared segment RSTP falls back to timers. Convergence is therefore bounded by the topology, and the standard does not promise a number: on real networks a link failure typically recovers in well under a few seconds, against 30 to 50 s for classic STP.
STP, RSTP, MSTP and per-VLAN trees
| Standard | Convergence | Per-VLAN? | Notes |
|---|---|---|---|
| STP, 802.1D-1998 | 30 to 50 s | No, one tree for all VLANs (the Common Spanning Tree) | Removed from 802.1D in the 2004 edition |
| RSTP, 802.1w-2001 | Seconds or less, handshake-based | No, one tree | Folded into 802.1D-2004; interoperates with STP by falling back |
| MSTP, 802.1s-2002 | As RSTP | Groups of VLANs map to a small number of instances | Now part of 802.1Q |
| PVST+ and Rapid PVST+ | STP-speed / RSTP-speed | One tree per VLAN | Cisco proprietary; not an IEEE standard |
One tree for every VLAN blocks the same links for all of them. Per-VLAN trees (or MSTP instances) let different VLANs block different links, so both uplinks of a switch carry something. See VLANs: spanning tree per VLAN for how that interacts with trunks. Putting thousands of VLANs in their own trees costs CPU, which is why MSTP groups them.
Protecting the tree: edge ports and guards
An access port toward a PC should not wait 30 s to forward, since there is no loop behind a host. Vendors let you mark it as an edge port: Cisco calls it PortFast, and 802.1D-2004 calls it an edge port. The risk is someone plugging a switch into it. The guards below are vendor features, and names, defaults and exact behaviour differ by vendor; check your vendor's documentation.
| Feature (Cisco name) | What it does | Typical placement |
|---|---|---|
| PortFast / edge port | Skips listening and learning on host ports | Access ports |
| BPDU Guard | Shuts the port down if a BPDU arrives | Edge ports (a host should never send BPDUs) |
| Root Guard | Refuses to accept a superior BPDU from a port, and puts the port in an inconsistent state instead of letting a new root win | Ports facing switches that must never become root |
| Loop Guard | Stops a port from going to forwarding when BPDUs simply cease, which is what a one-way link looks like | Root and alternate ports |
| UDLD | Detects unidirectional fibre links with its own protocol | Fibre inter-switch links |
| Storm control | Caps broadcast, multicast or unknown unicast rate per port | Any port, as a backstop |
Linux has equivalents on bridge ports: bridge link set dev X guard on is BPDU guard and root_block on is root guard (see man bridge).
Root takeover is a real attack. An attacker who can send BPDUs with priority 0 wins the election, becomes root, and the tree reshapes so traffic flows through the attacker's port, ready to be copied. The cure is BPDU guard on edge ports and root guard on ports toward untrusted switches. The wider catalogue of layer 2 and layer 3 attacks is in network attacks.
Link aggregation: LACP
STP blocks parallel links, which wastes them. Link aggregation bundles several physical links between the same two devices into one logical link (a LAG or port-channel), so STP sees one link, all of the members forward, and the bundle survives a member failure. The standard is IEEE 802.1AX (earlier published as 802.3ad), and its control protocol LACP exchanges LACPDUs so both ends agree which ports are in the bundle and notice a misconfigured or failed member.
The hard limit is that a LAG does not spread each frame across links. The switch hashes each flow (some combination of source and destination MAC, IP and L4 ports, depending on configuration) and sends all frames of that flow over one member, so a conversation is never reordered. A single flow therefore never exceeds one member's speed, and a handful of large flows ("elephants") can all hash onto the same link while others sit idle.
MLAG (Cisco vPC, Juniper MC-LAG, Arista MLAG) goes further and lets the two ends of a bundle land on two different switches that present themselves as one. A server then has redundancy across two switches and no blocked link. These are vendor implementations without a single standard, and they are the vendor answer to "STP blocks half my links".
Why data centres avoid L2 loops entirely
A large fabric cannot afford a blocked link, a 30 s outage, or a broadcast domain the size of the building. The common design is a leaf-spine (Clos) network: every leaf connects to every spine, each link is a routed point-to-point link, and traffic is spread by ECMP (equal-cost multipath routing) across all of them, using every link (RFC 7938 describes BGP as the routing protocol of such a fabric). Routing handles loops with the TTL and a control plane, the way routing overview describes. Layer 2 reachability across racks, where wanted, is provided as an overlay: VXLAN (RFC 7348) carries Ethernet frames over IP, and EVPN (RFC 7432) distributes MAC addresses in BGP. In a cloud VPC there is no switch loop to prevent at all, because the network is virtual (cloud network model).
Textbook vs real world
| The textbook says | Production does | Why |
|---|---|---|
| STP gives you redundancy | It gives you a standby path: the redundant link is blocked and idle, and the failover takes 30 to 50 s on classic STP | Preventing a loop means taking some links out of service, and recovery needs timers (or a handshake in RSTP) |
| The best switch becomes root | With default priorities the lowest MAC wins, which is often the oldest switch. Operators set the root and a backup root on purpose | The election only compares bridge IDs, and it knows nothing about capacity or position |
| Use STP everywhere | Data centres run routed leaf-spine fabrics and keep STP only at the edge, as a safety net | A tree wastes links and a loop takes everything down; routing uses all links and has a TTL |
| L2 can stretch across sites | Stretched VLANs make a broadcast storm or a topology change a multi-site outage, so they are avoided or carried over EVPN-VXLAN | A broadcast domain is also a failure domain |
| LACP load-balances packets across the links | LACP picks a link per flow by hash, and one flow never exceeds one link | Per-packet spraying would reorder frames inside a conversation |
In production
- Campus access layers commonly keep spanning tree on as a safety net: edge ports with PortFast and BPDU guard, root set deliberately in the distribution layer, and storm control. The exact commands are vendor-specific, so follow your vendor's design guide.
- Data-centre fabrics use routed leaf-spine with ECMP. RFC 7938 documents a large-scale design built on BGP with no spanning tree between switches, and VXLAN with EVPN (RFC 7348, RFC 7432) provides layer 2 on top where an application insists on it.
- Failure in the same family. AWS's published post-event summary of the April 2011 US-East disruption describes a network change that moved traffic onto a lower-capacity network, after which a flood of re-mirroring activity overloaded the control plane (AWS: summary of the EC2 and RDS disruption). It was not a spanning tree bug, but it shows the same pattern: a topology change plus retries that multiply load.
- Alternatives to STP inside L2 networks exist: TRILL (RFC 6325) and Shortest Path Bridging (IEEE 802.1aq) route frames with a link-state protocol, so all links are used. They saw limited adoption compared with routed fabrics and overlays.
History and evolution
- 1985 Radia Perlman, working at Digital Equipment Corporation, publishes the spanning tree algorithm in "An Algorithm for Distributed Computation of a Spanning Tree in an Extended LAN" (ACM SIGCOMM). Bridged LANs were growing into loops, and frames had no TTL (Perlman).
- 1990 IEEE 802.1D, the first bridging standard, standardises the protocol. A revision in 1998 is the source of the 2 s, 20 s and 15 s defaults and the short cost table.
- 1998 to 2001 30 to 50 s of recovery is too slow for growing networks, and the short cost table runs out of room as links get faster. IEEE 802.1w (2001) adds Rapid STP, and 802.1t (2001) updates the cost values.
- 2002 to 2004 802.1s (MSTP, 2002) lets many VLANs share a few trees. 802.1D-2004 folds in RSTP and removes classic STP, and MSTP later moves into 802.1Q.
- 2011 TRILL (RFC 6325) and 802.1aq (SPB, 2012) try to route inside L2. Data-centre operators instead move to IP fabrics.
- Now Routed leaf-spine fabrics (RFC 7938) with EVPN-VXLAN overlays in data centres. Campuses still run RSTP or MSTP, often with an L3 access layer to shrink the broadcast domain.
- Next Spanning tree shrinks toward the edge, as a guard against a human plugging a cable into the wrong port.
Hands-on
A Linux bridge runs classic 802.1D in the kernel, which lets you build the triangle on one machine. Run as root on Linux with iproute2 and bridge-utils (macOS has no Linux bridge, so use a VM or a container host, or capture BPDUs from a real switch with Wireshark).
After about 30 s (forward delay, twice) read the election from sysfs:
The output above is abbreviated and the IDs are illustrative; yours will differ. Look for two things: root_id is the same on every bridge, and exactly one port in the triangle says state blocking. Veth links report 10 Gbit/s to the kernel, so the cost shown is 2 (the 10 Gbit/s short value from the table above). brctl showstp s2 (from bridge-utils, deprecated on newer distros) prints the same data plus timers: max age 20.00, hello time 2.00, forward delay 15.00.
To see the BPDUs themselves:
The destination is the reserved BPDU multicast, length 35 is the byte count derived above, and a new one arrives every hello time (2 s). To test a failure, run ip link set s1-s2 down and watch bridge link show: the blocked port moves through listening and learning before forwarding. A broader list of failure experiments is in the failure lab, and capture tips are in tcpdump and Wireshark.
Gotchas
Interview questions
Show answer
An Ethernet frame has no TTL, and a switch floods broadcasts and unknown unicasts out every other port. In a loop each copy is forwarded again and again, and every pass floods to more ports, so the links fill and the network stops. The MAC table also flaps because the same source address keeps arriving on different ports. IP avoids it with the TTL field, which each router decrements until the packet is dropped.
Follow-ups:
- Does a loop need a broadcast? Unknown unicast floods the same way, so it also loops. A known unicast does not, because the switch sends it out one port.
- What limits the damage if a loop gets through? Storm control caps broadcast rate per port, and CPU protection on the switch.
Show answer
Every switch starts by claiming to be root and sends BPDUs carrying its bridge ID, which is a 16-bit priority (default 32768) followed by the MAC. A switch that hears a BPDU with a lower root ID stops claiming and relays that one. The lowest bridge ID wins, so the lowest priority wins and the lowest MAC breaks ties.
Follow-ups:
- How do you force a switch to be root? Lower its priority (for example 4096), and set a second switch to 8192 as backup. Many vendors have a macro that sets the priority below the current root.
- Why is the default root often the oldest switch? On a priority tie the lowest MAC wins, and older hardware tends to have lower MACs.
Show answer
Each non-root switch picks one root port, the port with the lowest total cost to the root. Each segment gets one designated port, the one with the best path to the root, and all ports of the root bridge are designated. Every other port is blocked, so there is no cycle. Cost is the sum of the port costs along the path, set by link speed.
Follow-ups:
- How is cost computed? Short values: 100 for 10 Mbit/s, 19 for 100 Mbit/s, 4 for 1 Gbit/s, 2 for 10 Gbit/s (802.1D-1998). Long values: 20 Tbit/s divided by the link speed (802.1D-2004).
- What breaks ties between equal costs? Lowest sender bridge ID, then lowest sender port ID.
Show answer
Classic STP moves a port through blocking, listening (15 s) and learning (15 s), so a recovery takes 30 s, or 50 s when a 20 s max age has to expire first. RSTP uses a proposal and agreement handshake between neighbours, so a port can move to forwarding without waiting for timers, and an alternate port is already a prepared replacement. Convergence drops to a few seconds or less on point-to-point links.
Follow-ups:
- What is PortFast and why pair it with BPDU guard? PortFast (an edge port) skips the delay on host ports, and BPDU guard shuts the port if a BPDU arrives, so a switch plugged into it cannot create a loop.
- When does RSTP fall back to timers? On shared (half-duplex) segments and when talking to an STP-only neighbour.
Show answer
Avoid depending on STP to choose the topology. Bundle parallel links with LACP so STP sees one link, use MLAG so a device can attach to two switches with no blocked port, or better, route to the access layer so every link is a routed link and ECMP uses them all. For large fabrics use a leaf-spine design, with an EVPN-VXLAN overlay if a layer 2 segment must span racks. Keep STP as a guard rail on the edge.
Follow-ups:
- What are the trade-offs of stretching L2? Bigger failure and broadcast domain, MAC table pressure, and a harder-to-debug failure mode, in exchange for mobility of IPs.
- Why is MLAG a mixed blessing? It is vendor-specific and the two switches share fate through their peer link and control plane.
Show answer
Two likely causes. The new switch created a physical loop that was not blocked (it ran no STP, or an edge port was set to forward instantly), so a broadcast storm saturated links and CPUs. Or it carried a lower bridge ID, won the root election, and the tree re-formed around it with a flood of topology changes. Mitigations are BPDU guard and PortFast only on edge ports, root guard toward untrusted switches, and storm control as a backstop.
Follow-ups:
- How do you diagnose it? Look for MAC addresses flapping between ports in the switch log, high CPU and port utilisation, the root bridge ID changing, and topology-change counters incrementing.
- How do you recover? Find the port with the storm, shut it, remove the extra link or switch, and then let STP reconverge.
Show answer
The switch computes a hash from header fields, such as source and destination MAC, IP address and L4 ports depending on configuration, and maps that to one member link. All frames of a flow follow the same link, which preserves order. The limit is that one flow can use only one member's bandwidth, and unlucky hashing can unbalance the links.
Follow-ups:
- What about elephant flows? They can fill one member while others idle. The fixes are including more header fields in the hash, splitting transfers into more flows, or faster member links.
- What does LACP itself add over a static bundle? The two ends negotiate membership and detect a mismatch or failed member, rather than trusting configuration.
Fun facts
- Perlman wrote the algorithm up in a poem, the Algorhyme, which she placed in her paper: "I think that I shall never see / A graph more lovely than a tree. / A tree whose crucial property / Is loop-free connectivity. / A tree that must be sure to span / So packets can reach every LAN. / First the Root must be selected. / By ID it is elected. / Least cost paths from Root are traced. / In the tree these paths are placed. / A mesh is made by folks like me, / Then bridges find a spanning tree."
- The IP header has a TTL (RFC 791) because IP networks are routed meshes with no spanning tree to remove their loops. The Ethernet header has no such field, so Ethernet needs STP.
- BPDU timer fields count in units of 1/256 of a second, so the default 2 s hello is encoded as 512 (0x0200) in the BPDU.
- BPDUs go to the reserved address
01:80:C2:00:00:00, which standard bridges do not forward, so a BPDU is never carried more than one hop as a frame. Switches relay the information by sending fresh BPDUs.
Cheat sheet
- 32768 - default bridge priority (0x8000); lowest ID wins; steps of 4096
- 2 s / 20 s / 15 s - hello / max age / forward delay (802.1D-1998 defaults)
- 30 s - direct failure, listening 15 + learning 15
- 50 s - indirect failure, 20 + 15 + 15
- 35 bytes - configuration BPDU; 4 bytes - TCN BPDU
- 4 / 2 / 19 / 100 - path cost for 1 G / 10 G / 100 M / 10 M (802.1D-1998)
- 20 Tbit/s / speed - long path cost (802.1D-2004)
- 01:80:C2:00:00:00 - BPDU destination