Spanning Tree Protocol Explained: How STP Stops Switching Loops

Plug two cables between the same pair of switches and you can take down an entire office in about four seconds. No attack, no misconfiguration, no malware. Just one extra cable.

That’s the problem the spanning tree protocol solves. Spanning tree protocol (STP) is a Layer 2 protocol that finds every redundant path between your switches and blocks all but one, so frames can’t circle forever. Keep the backup cables. Lose the loop.

You’ve probably already met it without knowing. That orange link light that sits there for 30 seconds before turning green? That’s spanning tree deciding whether your port is safe to use.

This article walks through what breaks without STP, how the root bridge election actually works, what a BPDU carries, the difference between STP, RSTP and MSTP, the Cisco commands to configure and verify it, and a three-switch lab you can build tonight. It’s written for the CCNA candidate who has read the definition five times and still can’t picture it.

What Is the Spanning Tree Protocol?

Spanning tree protocol is a network protocol that builds a loop-free logical topology out of a physically looped network. It runs on switches, it runs at Layer 2, and on most managed switches it’s already running whether you asked for it or not.

Radia Perlman invented it in 1985 while at Digital Equipment Corporation. Her paper, “An Algorithm for Distributed Computation of a Spanning Tree in an Extended LAN,” became IEEE 802.1D in 1990. She also wrote a poem about it, which is more than most protocols can claim.

Here’s the short version of the mechanism. Switches introduce themselves to each other. They agree on one switch to be the reference point. Every other switch works out its shortest path back to that reference point. Any port that isn’t on a shortest path gets shut down logically, not physically. The cable stays plugged in, ready.

Quick note on the standard, because almost every article gets this wrong. The standalone IEEE 802.1D document was withdrawn at the end of 2021. Its contents were folded into IEEE 802.1Q, and RSTP and MSTP now live there too. So when a page tells you “STP is defined in 802.1D,” that was true, and it isn’t any more. The behaviour didn’t change. The paperwork did.

Studying for the CCNA? Reading about root bridge election and configuring one are two different skills, and only one of them gets tested. See what’s inside the CCNA Lab Workbook →

What Happens Without Spanning Tree Protocol?

This is the part every explanation skips, and it’s the part that makes the rest make sense.

An Ethernet frame has no TTL. IP packets have one, a counter that drops by one at every router hop until the packet dies. Layer 2 frames have nothing like it. A frame that starts circling between two switches circles until somebody unplugs something.

Now add a broadcast. A single ARP request, one frame, arrives at SW1. SW1 floods it out every port except the one it came in on. SW2 receives it on two links, floods it out of both, and sends copies straight back to SW1. SW1 floods them again. Each pass doubles the frame count.

One extra cable, and the same frame comes back forever. Nothing here has a TTL to stop it.

Three things break at once:

• Broadcast storm. Link utilisation hits 100% in seconds. Switch CPUs pin. The console stops responding to your keystrokes.
• MAC address table instability. The same source MAC keeps arriving on different ports, so the switch rewrites its table thousands of times a second. Legitimate unicast traffic gets flooded because the switch no longer trusts any entry.
• Duplicate frame delivery. Hosts receive multiple copies of the same frame, which upper-layer protocols handle badly.

Ask anyone who has worked a service desk and they’ll have the story. Ours goes like this. A co-op student named Priya was tidying a wiring closet at a client site in Mississauga, found a patch cable hanging loose, and did the tidy thing: she plugged the free end back into the nearest free port on the same switch. Both ends, one switch.

Within about five seconds the branch’s phones dropped, the till system froze, and the switch stopped answering SSH. The fix took eleven seconds once someone walked to the closet. Finding out which of 47 cables it was took forty minutes.

Spanning tree would have caught that instantly, and on that switch it had been turned off two years earlier by someone chasing a latency problem. That’s the whole argument for leaving it on.

How Does Spanning Tree Protocol Work, Step by Step?

Four steps. Every switch runs the same algorithm on the same information and reaches the same answer, with no central controller.

Step 1: Elect the root bridge

Every switch starts by assuming it’s the root. It announces itself using a Bridge ID, which is two numbers glued together:

Bridge ID = Bridge Priority (2 bytes) + MAC address (6 bytes)

Lowest Bridge ID wins. Default priority is 32768 on basically everything, so with default settings the election comes down to the lowest MAC address.

That’s a trap. MAC addresses roughly track manufacturing age, so the oldest switch in the building usually has the lowest one. Left alone, spanning tree will happily elect the dusty 100 Mbps switch in the storage room as the centre of your network, and every path calculation in the building will be measured against it.

Set your root bridge on purpose. Always.

Lowest Bridge ID takes the crown. Leave it at 32768 everywhere and the oldest MAC address decides your topology.

Step 2: Every non-root switch picks a root port

Each remaining switch works out its cheapest path back to the root and marks that port as its root port. Cheapest means lowest cumulative path cost, not fewest hops. Faster links cost less.

Link speed	Cost (802.1D-1998, “short”)	Cost (802.1t, “long”)
10 Mbps	100	2,000,000
100 Mbps	19	200,000
1 Gbps	4	20,000
10 Gbps	2	2,000

Cisco switches still default to the short values, which is why 10 Gbps and 40 Gbps links can end up looking suspiciously similar in cost. spanning-tree pathcost method long fixes it if you care.

If two paths tie on cost, the tiebreakers run in order: lowest sender Bridge ID, then lowest sender port priority, then lowest sender port number.

Step 3: Pick one designated port per segment

Every link segment needs exactly one port responsible for forwarding traffic onto it. That’s the designated port, and it goes to whichever end has the lower cost to the root. All ports on the root bridge are designated by definition, which is a useful thing to remember on exam day.

Step 4: Block everything left over

Any port that isn’t a root port and isn’t a designated port gets blocked. It still listens for BPDUs. It just refuses to forward user data. Break a live link and that blocked port wakes up, which is the entire reason you ran the second cable.

Two links forward, one blocks. The blocked cable stays plugged in, waiting for the day it’s needed.

What Is a BPDU?

A BPDU (Bridge Protocol Data Unit) is the message switches use to run the election. It’s sent to the multicast MAC address 01:80:C2:00:00:00, every two seconds by default, and it carries the sender’s Bridge ID, the root Bridge ID it currently believes in, and the cost to reach that root.

Three timers control the legacy protocol:

Timer	Default	What it does
Hello	2 seconds	How often BPDUs go out
Forward Delay	15 seconds	Time spent in listening, then again in learning
Max Age	20 seconds	How long to keep believing a root you’ve stopped hearing from

Add those up on a link failure and you get 30 to 50 seconds of downtime. In 1990 that was fine. On a VoIP handset it’s a dropped call, and it’s exactly why RSTP exists.

One more field worth knowing: Cisco’s extended system ID. Cisco runs a separate spanning tree instance per VLAN, so it splits the 2-byte priority into a 4-bit priority field plus a 12-bit VLAN ID. That’s why priority only moves in steps of 4096, and why show spanning-tree reports priority 32769 for VLAN 1 instead of 32768. It’s 32768 + 1. Nothing is broken.

Per-VLAN trees only make sense if you already understand VLANs and 802.1Q trunking. If tagging is still fuzzy, read that one first and come back.

STP Port States and Port Roles

People mix these up constantly. A role is the job a port has been given. A state is what it’s allowed to do right now.

Legacy 802.1D defines five states, which is what the “5 stages of spanning tree” question is really asking about:

State	Forwards data?	Learns MACs?	Processes BPDUs?
Disabled	No	No	No
Blocking	No	No	Yes
Listening	No	No	Yes
Learning	No	Yes	Yes
Forwarding	Yes	Yes	Yes

RSTP collapsed the first three into one. Cleaner, and faster to reason about:

Legacy STP state	RSTP equivalent
Disabled, Blocking, Listening	Discarding
Learning	Learning
Forwarding	Forwarding

And the roles:

• Root port. Best path to the root bridge. One per non-root switch.
• Designated port. Forwarding port for a given segment. One per segment.
• Alternate port. A backup path to the root, learned from another switch. Blocked. RSTP can promote it almost instantly.
• Backup port. A backup to a designated port on the same shared segment. Rare outside hub-based networks.

STP vs RSTP vs MSTP: Which One Are You Running?

Three flavours matter, and the differences are practical rather than academic.

	STP (802.1D)	RSTP (802.1w)	MSTP (802.1s)
Introduced	1990	2001	2002
Convergence	30 to 50 seconds	Under 6 seconds, often under 1	Same as RSTP
Port states	5	3	3
Trees	One for the whole network	One	One per VLAN group
CPU cost with many VLANs	Low	High under PVST+	Low
Current standing	Superseded	Standard	Standard

Why is RSTP better than STP? Because it stops waiting and starts asking. Legacy STP is timer-driven: it assumes a topology change and sits out the forward delay to be safe. RSTP is handshake-driven. Two switches on a point-to-point link negotiate directly, agree the link is safe, and move it to forwarding. It also treats an alternate port as a pre-computed backup, so failover is a promotion, not a recalculation.

Where MSTP earns its keep is scale. Cisco’s Rapid PVST+ runs a separate instance per VLAN. That’s flexible, and at 300 VLANs it’s 300 instances of BPDU processing on every switch. MSTP maps many VLANs into a handful of instances, typically two or three, and gets you load sharing without the overhead. If you’re weighing that up, our note on VLAN vs subnet covers where the VLAN count usually comes from in the first place.

Which one is on your switch right now? Don’t guess. Older Catalyst platforms shipped with PVST+ as the default, current IOS-XE Catalyst gear generally ships with Rapid PVST+, and plenty of production networks are running whatever somebody set in 2016. One command settles it:

Switch# show spanning-tree summary
Switch is in rapid-pvst mode
Root bridge for: VLAN0010, VLAN0020

How to Configure Spanning Tree Protocol on a Cisco Switch

Short version: it’s already on. Your job is to make its decisions deliberate instead of accidental.

Set the mode.

Switch(config)# spanning-tree mode rapid-pvst

Nail down the root bridge. Do this on your distribution or core switch, not on whatever won the MAC address lottery.

Switch(config)# spanning-tree vlan 10,20 root primary
Switch(config)# spanning-tree vlan 10,20 root secondary

root primary sets priority to 24576, or lower if something already beat it. root secondary sets 28672 so a second switch takes over cleanly if the primary dies. You can set the value by hand if you prefer explicit config:

Switch(config)# spanning-tree vlan 10 priority 4096

Speed up access ports. PortFast skips listening and learning on ports that connect to a single host, so a laptop gets a usable link immediately instead of after 30 seconds.

Switch(config)# interface range gi1/0/1 - 24
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# spanning-tree bpduguard enable

Those two lines belong together. Always. PortFast on its own says “trust this port to skip the safety check.” BPDU guard is the safety net: if a BPDU ever shows up on that port, meaning somebody plugged a switch into a desk jack, the port shuts down immediately. PortFast without BPDU guard is how a meeting room ends up bringing down a floor.

PortFast opens the gate for a laptop. BPDU guard slams it on anything that sends a BPDU.

Protect the topology.

Switch(config-if)# spanning-tree guard root
Switch(config-if)# spanning-tree guard loop

Root guard on downstream-facing ports stops a rogue switch with a low priority from stealing the root role. Loop guard covers the nastier case: a port stops receiving BPDUs because of a one-way link failure, assumes the coast is clear, and starts forwarding into a loop.

Verify. Three commands, in this order:

Switch# show spanning-tree vlan 10
Switch# show spanning-tree root
Switch# show spanning-tree interface gi1/0/1 detail

Read the top block of show spanning-tree vlan 10. If it says “This bridge is the root,” you’re on the root. If it doesn’t, the Root ID section tells you which switch is, and the Cost and Port fields tell you how you’re reaching it.

Build the Spanning Tree Protocol Lab Yourself

Reading this twice will not make it stick. Building it once will.

Minimum viable lab: three switches, wired in a triangle so there’s exactly one loop. Give them recognisable MAC or priority values so you can predict the winner before you look.

1. Bring up all three links and run show spanning-tree. Find the blocked port. Work out why it’s that one and not another.
2. Change the priority on a different switch to 4096 and watch the root move. Everything recalculates.
3. Shut the root port on a non-root switch. Time the recovery, then switch from pvst to rapid-pvst and time it again. The difference is the entire argument for RSTP, and seeing it beats reading it.
4. Turn on PortFast without BPDU guard, connect a fourth switch to that port, and watch what happens. Then add BPDU guard and do it again.

Packet Tracer handles all four, and if you’re early in your studies Packet Tracer will do fine. For output that matches real IOS, use EVE-NG. Install EVE-NG first if you haven’t, then work through the other free CCNA labs you can build in EVE-NG, where the spanning tree root bridge lab sits alongside VLANs, EtherChannel and inter-VLAN routing.

Want the topology files instead of building from scratch? The CCNA Lab Workbook ships with the EVE-NG ISO, Packet Tracer scenarios, and verified solutions for every lab, so you spend your evening on the protocol instead of on QEMU naming conventions.

Troubleshooting Spanning Tree Protocol: Five Failures and Their Fixes

Symptom	Likely cause	Fix
Slow, wrong paths across the network	Root bridge is an old access switch	spanning-tree vlan X root primary on the correct switch
Whole VLAN drops for 30 seconds after any change	Running legacy PVST+	spanning-tree mode rapid-pvst everywhere in the domain
One VLAN loops while others are fine	Native VLAN mismatch, or VLAN pruned off a trunk	Match native VLAN on both trunk ends, check show interfaces trunk
Port keeps going err-disabled	BPDU guard firing on a PortFast port	Something is plugged in that shouldn’t be. Find it before you re-enable
Constant topology change notifications	A flapping access port without PortFast	Enable PortFast on host-facing ports, then chase the flapping cable

Two commands find most of it. show spanning-tree detail | include ieee|occurr|from gives you the topology change counters and where they came from. show spanning-tree inconsistentports lists everything a guard feature has stepped on.

The downside nobody mentions: spanning tree wastes bandwidth by design. Every blocked port is a link you paid for and can’t use. That’s the trade you’re making, and it’s why EtherChannel exists. Bundle two links into one logical link and spanning tree sees a single port, so both cables carry traffic.

Is Spanning Tree Protocol Still Used in 2026?

Yes, and the honest answer has two halves.

In the data centre, it’s on the way out. Modern spine-leaf fabrics run VXLAN with EVPN, which moves loop prevention up to Layer 3 and lets every link forward at once. Nobody designing a new fabric in 2026 is planning around blocked ports. Spanning tree usually survives there as a safety net at the edge, not as the design.

In the campus and the branch, it’s everywhere. Every access switch in every office, school and hospital still runs it, because the failure it prevents is still exactly as easy to cause. Priya’s patch cable doesn’t care what year it is.

Left: one link blocked, by design. Right: every link forwarding, because Layer 3 handles the loops.

So the useful framing isn’t “is it dead.” It’s: STP is now infrastructure you inherit rather than infrastructure you design. You’ll spend far more of your career troubleshooting somebody else’s spanning tree than architecting your own. Which is a good reason to know the show commands cold.

Spanning Tree Protocol on the CCNA Exam

STP is a guaranteed appearance, and it’s one of the safest things you can study right now.

On the current CCNA 200-301 v1.1 blueprint, it’s topic 2.5 under Network Access: interpret Rapid PVST+, covering root bridge and port roles, port states, PortFast, root guard, loop guard, BPDU filter and BPDU guard. Note the verb. Interpret. Cisco wants you reading show spanning-tree output, not reciting a definition.

CCNA v2.0 goes live on 2027-02-03, with 2027-02-02 as the last day for v1.1. Switching and Network Access grows to 25% of the blueprint in the new version, and spanning tree coverage expands rather than shrinks. Our breakdown of what changed in the CCNA v2.0 blueprint has the full domain weights.

Study it now. It counts on both versions.

Here’s the failure mode we see most. A candidate named Marcus messaged us last spring, three weeks out from his exam, saying he had spanning tree “done.” He could recite the five port states in order. He’d watched the videos twice.

Then a practice question showed him a show spanning-tree block and asked which port would forward, and he had no idea, because he’d never once looked at the real output. He rebuilt the triangle lab that weekend, spent two evenings breaking links on purpose, and the topic stopped being a problem. Same material. Different verb.

Spanning Tree Protocol FAQ

Bottom Line

Five things worth keeping:

1. Spanning tree protocol blocks redundant paths so Ethernet frames, which have no TTL, can’t loop forever.
2. Lowest Bridge ID wins the root election, and the default priority of 32768 means the oldest switch usually wins by accident. Set it yourself.
3. Legacy STP takes 30 to 50 seconds to converge. RSTP takes seconds. Run rapid-pvst unless you have a reason not to.
4. PortFast and BPDU guard belong together on every host-facing port, with no exceptions.
5. The exam asks you to interpret show spanning-tree output, not define STP. Build the triangle.

Start with the three-switch lab. Break a link, time the recovery, change the priority, watch the topology move. Twenty minutes of that teaches more than a chapter.

Ready to make the labs count? The CCNA Lab Workbook gives you 75 hands-on labs with the EVE-NG ISO, Packet Tracer files and verified solutions, mapped to the 200-301 blueprint. Prefer a live instructor and a fixed schedule? Our sister site runs a live CCNA course at SMEnode Academy where you build these topologies alongside a room of other candidates.

---

Sources: Cisco: Spanning Tree Protocol · IEEE 802.1D withdrawal liaison, IEEE 802.1 Working Group · Spanning Tree Protocol, Wikipedia