Spanning Tree Protocol (STP) is a Layer 2 control protocol that prevents forwarding loops in Ethernet networks with redundant links. It lets switches agree on a single loop-free tree of active links and places every redundant link in a blocking state, ready to take over automatically if an active link fails. In networking, and specifically in Ethernet switching, STP is the safety mechanism that makes redundant cabling between switches possible at all.
The protocol was originally specified in IEEE 802.1D and later evolved into Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) and Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s), both now incorporated in IEEE 802.1Q. In everyday use, the name spanning tree covers this whole family.
Why Ethernet needs loop prevention
Ethernet frames carry no hop limit or time-to-live field, unlike IP packets. If switches are connected in a loop, a broadcast frame is flooded out of every port, comes back through the loop and is flooded again, multiplying without end. Within seconds such a broadcast storm saturates links and switch CPUs and can make the whole broadcast domain unusable.
Loops also corrupt the MAC address table. A switch sees the same source address arriving on different ports as copies circulate, and keeps relearning it, so unicast frames are sent the wrong way. STP removes both problems by ensuring that, at any moment, there is exactly one active path between any two points in the Layer 2 network.
How Spanning Tree Protocol builds the tree
Switches exchange Bridge Protocol Data Units (BPDUs), small multicast frames sent every 2 seconds by default, and use them to run a distributed election. The outcome is a tree rooted at one switch, with every other switch reaching the root by its lowest-cost path.
- Elect the root bridge: the switch with the lowest bridge ID wins; the ID combines a configurable priority, default 32768, with the switch MAC address.
- Choose a root port on every other switch: the port with the lowest total path cost to the root.
- Choose a designated port on every link segment: the port that offers that segment the best path to the root.
- Block all remaining ports: they keep listening to BPDUs but forward no user traffic.
Path cost reflects link speed: faster links have lower costs. Two cost schemes are in use, and mixing them across switches is a classic cause of unexpected paths.
| Link speed | Short (legacy) cost | Long cost |
|---|---|---|
| 100 Mb/s | 19 | 200,000 |
| 1 Gb/s | 4 | 20,000 |
| 10 Gb/s | 2 | 2,000 |
| 100 Gb/s | 1 or vendor-specific | 200 |
Port states, timers and convergence
Classic 802.1D moves a port through listening and learning states before forwarding, so that every switch has time to hear about topology changes and loops cannot form during the transition. The timers that control this are the reason original STP is slow.
| Timer | Default value | Purpose |
|---|---|---|
| Hello time | 2 seconds | Interval between BPDUs from the root |
| Max age | 20 seconds | How long stored BPDU information remains valid |
| Forward delay | 15 seconds | Time spent in each of listening and learning |
| Typical convergence | 30-50 seconds | Max age plus two forward delays after an indirect failure |
A 30-50 second outage after a link failure is unacceptable for voice, storage or most business applications. RSTP replaces timer-driven waiting with an explicit proposal and agreement handshake between neighbors and introduces alternate and backup port roles that are precomputed. As a result, RSTP usually converges in well under a second to a few seconds.
STP, RSTP and MSTP compared
The three standard variants differ mainly in convergence speed and in how they handle VLANs. Vendors also offer per-VLAN variants, such as PVST+ and Rapid PVST+, which run a separate tree for each VLAN.
| Variant | Standard | Convergence | VLAN handling |
|---|---|---|---|
| STP | IEEE 802.1D | 30-50 seconds | One tree for all VLANs |
| RSTP | IEEE 802.1w | Typically sub-second to a few seconds | One tree for all VLANs |
| MSTP | IEEE 802.1s | Rapid, like RSTP | Several instances, each serving a group of VLANs |
| Rapid PVST+ | Vendor protocol | Rapid, like RSTP | One tree per VLAN |
MSTP is the usual choice in multi-vendor networks with many VLANs, because it allows load sharing across links by mapping VLAN groups to instances with different root bridges, while keeping the number of instances small. RSTP alone is common in smaller networks, and it remains backward compatible with legacy STP neighbors.
Configuring spanning tree safely
Most STP incidents come from leaving the defaults in place. Since every switch has the same default priority, the root bridge is decided by the lowest MAC address, which often belongs to the oldest or least capable switch in the network.
- Set the root deliberately: give the core switch a low priority, such as 4096, and a second core switch the next value as backup.
- Mark edge ports (PortFast or edge port): ports to end devices start forwarding at once instead of waiting.
- Enable BPDU guard on edge ports, so a port shuts down if someone connects a switch to it.
- Use root guard on ports facing access switches, so they can never take over the root role.
- Enable loop guard or unidirectional link detection to catch fiber links that fail in one direction only.
- Keep the same STP variant and cost scheme on all switches.
STP should also be seen as a safety net rather than a design tool. Many networks reduce dependence on it with link aggregation, which bundles parallel links into one logical link, or with routed Layer 3 designs and fabrics such as EVPN with VXLAN, where loops are prevented by routing instead of blocked ports.
Understanding it simply
Imagine a town where some streets form circles. If a delivery van had no map and simply followed every street, it could drive in circles forever. Spanning Tree Protocol puts temporary barriers on some streets so that there is only one route between any two places.
The barriers are not removed permanently. If an open street is blocked by an accident, a barrier on a different street is lifted, and traffic finds its way again. The network gets backup routes without the chaos of endless loops.
Applied in practice
A manufacturing plant has twelve access switches on the production floor, each connected by two uplinks to a pair of distribution switches. After an electrician reconnected a cable incorrectly, the network suffered a broadcast storm, and investigation showed that an old access switch had become the root bridge because nobody had set priorities.
The network team moves all switches to MSTP, sets the first distribution switch to priority 4096 and the second to 8192, and maps production VLANs and office VLANs to two instances with opposite root bridges so both uplinks carry traffic. Edge ports receive PortFast and BPDU guard. In the next test, unplugging an active uplink shifted traffic to the alternate path in about one second, and a laptop with a cheap switch plugged into a machine port was shut down automatically instead of creating a loop.