Spanning Tree Protocol Explained — Root Bridge, Port Roles, RSTP and Config

Redundant links are good design: if one cable or switch fails, another path keeps the network up. At Layer 2 they are also dangerous, because Ethernet has no hop count to stop a frame from circulating forever. Spanning tree protocol is the mechanism that lets you have redundant links without the loops. It is one of the most tested switching topics on the Cisco CCNA 200-301, and it is the topic where candidates lose points by memorizing terms instead of understanding the elections. This guide walks through the logic with a worked example you can reproduce, then covers the versions, the protection features and the configuration.

Why do switched networks need spanning tree?

A switch forwards a broadcast, a multicast and any unknown unicast frame out of every port except the one it arrived on. Connect three switches in a triangle and a single broadcast leaves switch A in two directions, is flooded onward by B and C, and arrives back at A from the other side, again and again. Three problems follow:

• Broadcast storm. Looping frames multiply until links and CPUs are saturated. The network can become unusable within seconds.
• MAC table instability. The same source MAC address appears on different ports as copies arrive from several directions, so the switch keeps re-learning it.
• Multiple frame copies. Hosts receive duplicate frames, which can break some applications.

Layer 3 does not suffer this: an IP packet has a TTL that is decremented at each router, so a looping packet eventually dies (see our OSI model guide for the layer context). Ethernet frames have no such field, so STP logically removes the loop instead. It does this without removing the cables: redundant ports are simply blocked until needed.

What are BPDUs and the bridge ID?

Switches speak STP using Bridge Protocol Data Units (BPDUs), sent to the multicast MAC address 0180.C200.0000. Every 2 seconds (the hello time) the root bridge sends a configuration BPDU and other switches relay it. A BPDU carries the root bridge ID, the sending bridge ID, the cost to the root and the sending port ID, which is all a switch needs to compare candidates.

The bridge ID is eight bytes: a 16-bit bridge priority field followed by the 48-bit switch MAC address. On Cisco switches running per-VLAN spanning tree, the priority field is split into a 4-bit priority and a 12-bit extended system ID that holds the VLAN number. That is why the configured priority is always a multiple of 4096 and why the value you see is 32768 plus the VLAN (32769 for VLAN 1, 32778 for VLAN 10).

How is the root bridge elected?

Every switch begins by assuming it is the root and advertising its own bridge ID. When a switch receives a BPDU with a lower root bridge ID, it stops claiming the role and relays the better one. After a few BPDU exchanges the whole network agrees: the switch with the lowest bridge ID is the root bridge. Compare priority first, then MAC address.

This has a practical consequence. With all switches on default priority, the root is whichever has the lowest MAC address, which tends to be the oldest switch, perhaps a forgotten access switch at the far edge. Traffic then takes a poor path through it. The professional habit is to choose the root deliberately, typically a distribution or core switch, by lowering its priority, and to set a second switch as the backup root.

How are root ports and designated ports elected?

After the root bridge exists, each remaining switch decides what role every port plays. There are three main roles in classic STP:

• Root port (RP): on every non-root switch, the one port with the best path toward the root bridge. The root bridge has none.
• Designated port (DP): on every network segment, the one port that forwards traffic toward the segment on behalf of that segment. Every port on the root bridge is a designated port.
• Blocking (non-designated) port: every other port. It does not forward user traffic.

Root port election compares, in order: (1) lowest root path cost; (2) lowest sender bridge ID; (3) lowest sender port priority (default 128); (4) lowest sender port ID. The designated port election on each segment uses the same logic: the port on the switch advertising the lowest root path cost wins; a tie goes to the lower bridge ID of the switch on that segment.

Root path cost is the sum of the port costs along the path, counted as the BPDU is received (each switch adds the cost of the port it received it on). Default costs for the short method:

Cisco switches use the short method by default in PVST+ and the long method is optional (spanning-tree pathcost method long). All switches in a domain should agree, or paths can be chosen unexpectedly.

Worked example: electing roles in a three-switch triangle

Three switches are connected in a triangle, all links Gigabit Ethernet (cost 4), all in VLAN 1 with default priorities. The MAC addresses decide the root:

Links: SW1 Gi0/1 to SW2 Gi0/1, SW1 Gi0/2 to SW3 Gi0/1, and SW2 Gi0/2 to SW3 Gi0/2.

1. Root bridge. All priorities tie, so the lowest MAC wins: SW1. All SW1 ports become designated ports.
2. Root ports. SW2 can reach SW1 directly through Gi0/1 (cost 4) or through SW3 (4 + 4 = 8). Gi0/1 wins, so it is SW2's root port. SW3 likewise picks its Gi0/1.
3. Designated port on the SW2 to SW3 segment. Both ends advertise a root path cost of 4. Tie. The lower bridge ID wins, which is SW2, so SW2 Gi0/2 is designated (forwarding).
4. Blocked port. SW3 Gi0/2 is neither root nor designated, so it blocks.

The loop is broken at exactly one point, SW3 Gi0/2. If the SW1 to SW3 link fails, SW3 unblocks Gi0/2 and reaches the root through SW2. A good exam habit is to draw a topology like this and mark root path costs on every port before answering; most STP questions are this procedure with different numbers.

What are the STP port states?

In classic 802.1D, a port moves through states with timers controlling progress:

The timers and their defaults are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. When a blocked port stops hearing BPDUs for max age, it starts to transition; add the two forward-delay periods and you get the classic figure of 30 to 50 seconds of outage. That delay is the main reason RSTP was created.

STP vs RSTP vs PVST+ vs Rapid PVST+: what is the difference?

Key RSTP differences to remember. First, the Blocking, Listening and Disabled states collapse into Discarding. Second, RSTP adds two roles: Alternate (a backup path to the root through another switch, ready to replace the root port instantly) and Backup (a redundant port on the same segment as a designated port). Third, RSTP uses a proposal and agreement handshake on point-to-point links and treats edge ports (PortFast) as immediately forwarding. Fourth, every switch generates BPDUs, not just relays them, and a neighbor is declared lost after missing three hellos (6 seconds) instead of waiting for max age.

Cisco labs and the CCNA tend to focus on Rapid PVST+. A frequent exam pattern is to give a set of outputs and ask which port is the root port or which port is alternate, using exactly the rules above. If you are unsure of the version behavior, note that the Cisco documentation for your specific platform is the final word on defaults.

What are PortFast, BPDU guard and root guard?

These features harden spanning tree against the most common real-world failures:

The classic exam pairing is PortFast plus BPDU guard on access ports, and root guard on ports toward devices you do not control. They are different: BPDU guard shuts a port down on any BPDU, root guard only reacts to a superior BPDU.

How do I configure spanning tree on Cisco switches?

A sensible baseline: Rapid PVST+, a deliberate root, PortFast and BPDU guard on access ports.

! On every switch
SW1(config)# spanning-tree mode rapid-pvst

! On the intended root (distribution/core) for VLANs 10 and 20
SW1(config)# spanning-tree vlan 10,20 root primary

! On the intended backup root
SW2(config)# spanning-tree vlan 10,20 root secondary

! Or set the priority explicitly instead of root primary
SW1(config)# spanning-tree vlan 10 priority 4096

! On an access port facing a PC
SW3(config)# interface GigabitEthernet0/5
SW3(config-if)# switchport mode access
SW3(config-if)# switchport access vlan 10
SW3(config-if)# spanning-tree portfast
SW3(config-if)# spanning-tree bpduguard enable

! Or enable globally on all PortFast ports
SW3(config)# spanning-tree portfast default
SW3(config)# spanning-tree portfast bpduguard default

! On a port facing a switch that must not become root
SW1(config)# interface GigabitEthernet0/24
SW1(config-if)# spanning-tree guard root

! Influence which port becomes root port (lower cost = preferred)
SW2(config)# interface GigabitEthernet0/1
SW2(config-if)# spanning-tree vlan 10 cost 2

root primary lowers the priority only far enough to win at the moment you enter it (normally to 24576, or 4096 below the current root), whereas an explicit priority value stays fixed. Both are valid answers on an exam; know the difference. Pair this layer with a gateway redundancy design: the root bridge for a VLAN should normally be the same device as the Active gateway in HSRP, so frames do not take a detour.

How do I read show spanning-tree output?

SW2# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    4106
             Address     0000.0000.0001
             Cost        4
             Port        1 (GigabitEthernet0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0000.0000.0002
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------
Gi0/1               Root FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p

Read the top block as the root and the second block as this switch. If the two addresses match, the message "This bridge is the root" appears and you are looking at the root. Here the root has priority 4106 (4096 + VLAN 10), this switch is 32778, so it is not the root; its root port is Gi0/1 with cost 4. The table lists each port's role (Root, Desg, Altn, Back), status (FWD, BLK, LRN or DIS in classic STP; FWD, LRN or BLK shown for RSTP discarding) and link type (P2p or Shr). Other quick commands: show spanning-tree summary, show spanning-tree root, show spanning-tree interface gigabitethernet0/1 detail and show spanning-tree inconsistentports. The values in this block are illustrative and come from a different VLAN 10 topology than the worked example above, where the root was deliberately set to priority 4096.

How does EtherChannel interact with spanning tree?

EtherChannel (port channel) bundles up to eight active physical links into one logical interface. Spanning tree then sees the bundle as one port, so it does not block individual members, and the combined bandwidth gives a lower STP cost than a single link. The main points to remember:

• STP runs on the port-channel interface, not on each member; member ports only forward user traffic when the bundle is up.
• Two parallel links without EtherChannel are a loop, and STP will block one of them. With EtherChannel, both carry traffic and STP sees one link.
• Configuration mismatches (speed, duplex, trunk mode or allowed VLANs) can suspend a member port and surprise you.
• If EtherChannel negotiation fails and one side bundles while the other does not, you can create a temporary loop; STP and the EtherChannel misconfiguration guard exist to limit the damage.

How do I troubleshoot spanning tree problems?

1. Unexpected root bridge. Run show spanning-tree root on a few switches. If the root is an access switch, lower the priority on the intended root. Use root guard on edge-facing ports to prevent a rogue switch from taking over.
2. Suboptimal path. Compare root path costs and consider changing port cost (spanning-tree vlan N cost X) or the root per VLAN for load balancing.
3. Ports err-disabled. Check show interfaces status err-disabled; a BPDU guard trigger means a switch or hub was connected to an access port.
4. Mismatched modes. Rapid PVST+ and PVST+ interoperate by falling back to the slower behavior on the shared link, so convergence is slow where they meet. Standardize on one mode.
5. Broadcast storm symptoms. Very high interface utilization, flapping MAC table entries, and a switch CPU at near 100 percent. Find the loop by disconnecting links or looking for a recently changed STP configuration, a unidirectional link, or BPDU filter misuse.
6. Frequent topology changes. show spanning-tree detail shows topology change counts and the port that caused them. A flapping host port without PortFast is a common cause.

What are the exam traps for CCNA and Network+?

The CCNA exam guide explains the blueprint. Exact objective wording changes between exam versions, so check the official Cisco and CompTIA pages linked in the sources. In practice, expect port role, port state and root election questions on the CCNA, and a simpler "what does STP do, and which feature protects an access port" style on CompTIA Network+ N10-009. The decision of which to take first is in Network+ vs CCNA.

• Lowest wins, everywhere. Lowest bridge ID, lowest cost, lowest port ID. Candidates sometimes pick the highest MAC by mistake.
• Priority before MAC. A switch with a better priority beats one with a lower MAC.
• The VLAN is added to the priority. Default 32768 is displayed as 32769 for VLAN 1 in PVST+.
• Priority steps of 4096. A value like 5000 is rejected.
• Root ports and designated ports forward. Only the leftover ports block, and a port on the root bridge is never blocked.
• Cost accumulates. The root path cost is the sum along the path, not the cost of a single link.
• PortFast is for edge ports only. It is not a convergence fix for trunks.
• BPDU guard versus root guard. BPDU guard disables the port; root guard only blocks it while superior BPDUs arrive.
• STP versus RSTP states. RSTP has no Blocking or Listening; it uses Discarding.

Keep the key numbers on a single sheet: our CCNA cheat sheet collects them, and the subnetting guide covers the other big calculation topic. For routing-protocol context, see OSPF and EIGRP; spanning tree is the Layer 2 equivalent of choosing a best path.

Check yourself: three quick STP questions

Spanning tree protocol practice questions with answers

For more, see CCNA practice questions or the CCNA practice exam.

Frequently asked questions

How we wrote and checked this

CertSharp is a practice-exam provider, and we sell the CCNA and Network+ practice questions linked in this guide. We wrote this article from Cisco's Rapid Spanning Tree documentation and the IEEE 802.1 standards, linked in Sources. Bridge IDs, path costs, the three-switch election and the timers were worked through by hand and re-checked, and the show spanning-tree output is illustrative, not captured from production equipment. Last reviewed October 2026. Defaults vary by platform and release, so confirm on your own switch.

Sources and further reading

• Cisco: Understand Rapid Spanning Tree Protocol (802.1w)
• Cisco Learning Network: CCNA 200-301 exam topics
• CompTIA Network+ certification page
• IEEE 802.1 Working Group: home of IEEE 802.1D (STP), 802.1w (RSTP) and 802.1Q

Spanning tree is defined by the IEEE 802.1D and 802.1Q standards; PVST+ and Rapid PVST+ are Cisco implementations, and defaults vary by switch platform and software release, so confirm with show spanning-tree on your device.