Spanning Tree Protocol (STP)

Spanning Tree Protocol (STP) is a layer 2 protocol that prevents loops in a network with redundant paths. Loops can cause broadcast storms and waste bandwidth, as well as create inconsistent forwarding tables and MAC address flapping. STP identifies and blocks redundant paths using Bridge Protocol Data Units (BPDUs), which are special frames that contain information about the network topology and the state of each switch port.

In this blog post, I will explain the basic concepts and features of STP, such as bridge ID, root bridge, port roles, port states, and port costs. I will also discuss some of the advanced topics and variations of STP, such as Rapid Spanning Tree Protocol (RSTP), Multiple Spanning Tree Protocol (MSTP), Per-VLAN Spanning Tree Protocol (PVST+), and PortFast.

What is STP and why do we need it?

STP is a protocol that runs on Layer 2 devices, such as switches, bridges, and hubs. STP operates by exchanging Bridge Protocol Data Units (BPDUs) between neighboring switches to exchange information about the network topology and elect a root bridge.

The root bridge is the switch that has the lowest bridge ID, which is a combination of a priority value and a MAC address. The root bridge is the reference point for the STP topology and determines the best path for data transmission.

STP is a set of rules that layer 2 switches follow to avoid loops in a network with redundant paths. Redundant paths are useful for providing fault tolerance and load balancing, but they can also create loops if not managed properly.

A loop occurs when there are multiple paths between two switches, and the switches forward frames endlessly along those paths. This can cause several problems, such as:

Broadcast storms: Broadcast frames are sent to all ports on a switch, except the one they came from. If there is a loop in the network, broadcast frames will be forwarded indefinitely, consuming bandwidth and CPU resources on the switches and hosts.
Inconsistent forwarding tables: Switches learn MAC addresses by looking at the source MAC address of incoming frames and associating them with the port they came from. If there is a loop in the network, switches may receive frames from the same MAC address on different ports, causing them to update their forwarding tables constantly and incorrectly.
MAC address flapping: MAC address flapping is a symptom of inconsistent forwarding tables, where a switch reports that a MAC address is moving between different ports rapidly. This can trigger security alarms and affect the performance of the switch.

To prevent these problems, STP identifies and blocks redundant paths using BPDUs. BPDUs are special frames that contain information about the network topology and the state of each switch port. BPDUs are exchanged between switches every 2 seconds by default, and they are used to determine the following:

Root port: The port that has the lowest cost to reach the root bridge. There is only one root port per switch, except for the root bridge, which has no root ports.
Designated port: The port that has the lowest cost to reach a specific segment of the network. There is only one designated port per segment, and it is always on the switch that is closest to the root bridge.
Alternate port: The port that has an alternative path to reach the root bridge, but is not the root port. Alternate ports are in a blocking state, meaning they do not forward or receive data frames, but they still listen to BPDUs.
Backup port: The port that has an alternative path to reach a specific segment of the network, but is not the designated port. Backup ports are also in a blocking state, and they are only possible in a network that has a physical loop.
Disabled port: The port that is manually shut down by the administrator or by an error condition. Disabled ports do not participate in STP at all.

By using BPDUs, STP ensures that there is only one active path between any two switches in the network, and that path is the shortest and least costly one. This way, STP eliminates loops and maintains a loop-free topology.

The Election of the Root Bridge

The root bridge is the switch with the lowest bridge ID, which consists of priority, VLAN number, and MAC address. The root bridge is the reference point for all other switches in the network, and it determines the shape of the spanning tree.

The election of the root bridge is done by comparing the bridge IDs of all the switches in the network. The bridge ID is a 64-bit value that is composed of two parts:

Priority: The priority is a 16-bit value that can be set manually or automatically. The default priority is 32768, and it can be changed in increments of 4096. The lower the priority, the higher the chance of becoming the root bridge.
Extended system ID: The extended system ID is a 48-bit value that consists of the VLAN number and the MAC address of the switch. The VLAN number is a 12-bit value that identifies the VLAN that the switch belongs to. The MAC address is a 48-bit value that uniquely identifies the switch.

The bridge ID is written as priority.extended system ID, for example, 32768.1.00:0c:29:aa:bb:cc. The switch with the lowest bridge ID becomes the root bridge for that VLAN. If there is a tie in the priority, the switch with the lowest MAC address wins. If there is a tie in the MAC address, the switch with the lowest VLAN number wins.

The election of the root bridge is done by exchanging BPDUs between switches. BPDUs contain the following fields:

Root bridge ID: The bridge ID of the current root bridge, as seen by the sender of the BPDU.
Root path cost: The cumulative cost of the path from the sender of the BPDU to the root bridge.
Sender bridge ID: The bridge ID of the sender of the BPDU.
Sender port ID: The port ID of the sender of the BPDU. The port ID is a 16-bit value that consists of the port priority and the port number. The default port priority is 128, and it can be changed in increments of 16. The lower the port priority, the higher the chance of becoming the designated port.
Message age: The time elapsed since the BPDU was generated by the root bridge. The message age is incremented by 1 second for every hop in the path. The default maximum message age is 20 seconds, and it determines how long a switch will wait for a BPDU before declaring itself as the root bridge.
Max age: The maximum time that a switch will wait for a BPDU before declaring itself as the root bridge. The default max age is 20 seconds, and it should be the same as the message age of the BPDU generated by the root bridge.
Hello time: The time interval between BPDUs sent by the root bridge. The default hello time is 2 seconds, and it determines how often the root bridge updates the network topology.
Forward delay: The time that a port spends in the listening and learning states before transitioning to the forwarding or blocking state. The default forward delay is 15 seconds, and it determines how long it takes for the network to converge after a topology change.

The election of the root bridge is done as follows:

Initially, each switch assumes that it is the root bridge and sends BPDUs with its own bridge ID as the root bridge ID and a root path cost of zero.
When a switch receives a BPDU, it compares the root bridge ID in the BPDU with its own bridge ID. If the root bridge ID in the BPDU is lower than its own bridge ID, it updates its root bridge ID and root path cost accordingly and forwards the BPDU to its other ports. If the root bridge ID in the BPDU is higher than its own bridge ID, it discards the BPDU and continues to send its own BPDUs.
This process repeats until all the switches agree on the lowest bridge ID as the root bridge ID and the shortest path to the root bridge as the root path cost. The switch with the lowest bridge ID becomes the root bridge and sends BPDUs with its own bridge ID as the root bridge ID and a root path cost of zero. All the other switches become non-root bridges and send BPDUs with the root bridge ID and root path cost that they learned from the root bridge.

In this example, there are four switches (A, B, C, and D) connected in a loop. Each switch has a default priority of 32768 and a different MAC address. The bridge IDs of the switches are as follows:

A: 32768.1.00:0c:29:aa:bb:cc
B: 32768.1.00:0c:29:dd:ee:ff
C: 32768.1.00:0c:29:11:22:33
D: 32768.1.00:0c:29:44:55:66

Initially, each switch assumes that it is the root bridge and sends BPDUs with its own bridge ID as the root bridge ID and a root path cost of zero. For example, switch A sends BPDUs with the following fields:

Root bridge ID: 32768.1.00:0c:29:aa:bb:cc
Root path cost: 0
Sender bridge ID: 32768.1.00:0c:29:aa:bb:cc
Sender port ID: 128.1 (for port 1) and 128.2 (for port 2)
Message age: 0
Max age: 20
Hello time: 2
Forward delay: 15

When switch B receives a BPDU.

STP also assigns different states to the ports of the switches based on their role and activity. The port states are:

Blocking: The port is in a standby mode and does not forward or receive data frames, but it still listens to BPDUs. This state is used to prevent loops and to provide redundancy.
Listening: The port is preparing to participate in data forwarding and is listening to BPDUs to determine the network topology and the root bridge. This state is transitional and lasts for 15 seconds by default.
Learning: The port is learning the MAC addresses of the devices connected to the network and populating the MAC address table. This state is also transitional and lasts for 15 seconds by default.
Forwarding: The port is actively forwarding and receiving data frames and BPDUs. This is the normal operation state for root ports and designated ports.
Disabled: The port is not functioning and does not participate in STP at all.

STP uses a cost value to determine the best path to the root bridge and to the network segments. The cost value is based on the bandwidth of the link, and the lower the cost, the better the path. The default cost values for some common link speeds are:

10 Mbps: 100
100 Mbps: 19
1 Gbps: 4
10 Gbps: 2

The cost of a path is the sum of the costs of the individual links along the path. For example, if a switch has two paths to the root bridge, one with a 10 Mbps link and another with a 100 Mbps link, the cost of the first path is 100 + 100 = 200, and the cost of the second path is 19 + 19 = 38. Therefore, the second path is preferred and the port connected to it becomes the root port.

What are the advantages and disadvantages of STP?

STP has several advantages and disadvantages that network administrators should be aware of. Some of the advantages are:

STP prevents loops in a switched network, which can cause broadcast storms, MAC address table instability, and multiple frame copies.
STP provides redundancy and resilience in a network, as it can automatically switch to an alternative path in case of a link failure or a switch outage.
STP is compatible with most Layer 2 devices and vendors, as it is based on the IEEE 802.1D standard.

Some of the disadvantages are:

STP can cause delays in data transmission, as it takes time for the switches to exchange BPDUs and converge to a stable topology. The default convergence time for STP is 30 to 50 seconds, which can be unacceptable for some applications and services.
STP can waste bandwidth and resources, as it blocks some ports and links that could otherwise be used for load balancing and traffic distribution.
STP can be complex and difficult to configure and troubleshoot, as it involves many parameters and variables that can affect the network performance and behavior.

What are the variations and enhancements of STP?

STP has been improved and modified over the years to address some of its limitations and to adapt to the changing network requirements and technologies. Some of the variations and enhancements of STP are:

Rapid Spanning Tree Protocol (RSTP): RSTP is an evolution of STP that provides faster convergence and more efficient operation. RSTP reduces the number of port states from five to three (discarding, learning, and forwarding) and introduces new port roles (edge port and root port). RSTP also uses a handshake mechanism called synchronization to speed up the transition of ports to the forwarding state. RSTP is defined in the IEEE 802.1w standard and is backward compatible with STP.
Multiple Spanning Tree Protocol (MSTP): MSTP is an extension of RSTP that allows the creation of multiple spanning tree instances, each with a different root bridge and a different set of active and blocked ports. MSTP can map different VLANs to different spanning tree instances, which can improve the network utilization and flexibility. MSTP is defined in the IEEE 802.1s standard and is backward compatible with RSTP and STP.
Per-VLAN Spanning Tree Protocol (PVST+): PVST+ is a Cisco proprietary variation of STP that also allows the creation of multiple spanning tree instances, one for each VLAN. PVST+ can optimize the network performance and load balancing for each VLAN, but it requires more CPU and memory resources on the switches. PVST+ is compatible with STP, but not with RSTP or MSTP.
PortFast: PortFast is a Cisco feature that enables a port to bypass the listening and learning states and go directly to the forwarding state when it is connected to a single end device, such as a PC or a server. PortFast can reduce the convergence time and avoid connectivity issues for the end devices. PortFast should not be enabled on ports that are connected to other switches, as it can cause loops and instability.

Conclusion

STP is a vital protocol for ensuring the reliability and efficiency of switched networks. STP prevents loops, provides redundancy, and is compatible with most Layer 2 devices. However, STP also has some drawbacks, such as slow convergence, wasted bandwidth, and complexity. Therefore, network administrators should understand the concepts and features of STP, as well as its variations and enhancements, to design and maintain optimal network topologies.

I hope you enjoyed this blog post and learned something new about STP. If you have any questions or feedback, please leave a comment below. Thank you for reading! 😊