Understanding Network Infrastructure · Part 2 · How does data reach nearby devices?
Why does only one cable between two switches carry data?
Tracing Layer 2 loop prevention through root election, port roles, and RSTP convergence
Connecting switches with redundant links and no loop control can cause frames to return and be copied again and again. STP and RSTP elect a root bridge and assign each port a role and state, so only loop-free paths forward traffic. We follow the process from BPDU comparison to reconvergence after a link failure, edge-port protection, and investigation of recurring faults.
Redundant links, multiplying frames: how a loop overwhelms switches↑
Broadcast frames are replicated within the same VLAN and sent out multiple ports. With a loop, a copied frame returns through another switch and is copied again. The Ethernet header has no TTL to stop this cycle.
Repeatedly seeing the same source MAC on different uplinks also causes MAC flapping. The switch cannot maintain a stable destination location, and link capacity and CPU time can be consumed by broadcast traffic. The result can be an outage across the VLAN, not just a slow connection for one user.
If one ARP request is copied down both paths of a triangle, each switch receives copies from another uplink—the same frames have come back. The broadcast destination causes further copies on forwarding ports in the same VLAN, excluding the incoming port, while Ethernet has no per-hop limit like a router's TTL decrement. Copies of the original frame quickly consume link bandwidth and switch buffers. Ordinary unicast traffic is dropped from queues too, making the entire VLAN appear to stop.
Copies of a frame carry the same source MAC but arrive alternately on two uplinks, so the switch keeps changing that MAC address's location. This MAC flapping can send unicast traffic to the wrong port. Flooding occurs when the destination MAC has no table entry. These effects explain why a broadcast storm, high CPU use, and MAC moves often occur together. If disconnecting one link immediately stabilizes the network, a loop is likely. A lasting fix still requires identifying the VLAN and physical or logical links forming the cycle.
Without an arrangement such as link aggregation to treat parallel cables as one logical link, each is an independent path that can form a loop. An endpoint's dual-NIC bridge, a virtual switch, or a miswired small switch can cause one too. Symptoms include widespread delay, packet loss, and MAC flapping. Check the topology and loop path before simply blocking the busiest port.
Sources for this section IEEE 802.1Q-2022 · IEEE 802.1Q Working Group
STP gives every switch the same reference: the root bridge↑
STP switches exchange BPDUs and elect the device with the best bridge ID as the root bridge. Bridge IDs combine priority with MAC-based identification. Operators can set priorities to support the intended traffic paths.
If an access switch happens to become the root, traffic may take inefficient paths and failures may have a wider impact. Check the scope of root election for each VLAN or MST instance and for the implementation in use.
Each switch initially announces itself as root, then adopts a superior bridge ID when it receives one in a BPDU. The elected root's BPDUs provide a common reference for identity and distance throughout the tree. Each switch can compare its ports' paths to the root on the same basis. The root is a reference for Layer 2 path calculation, not a master that processes all traffic.
Operators can designate a distribution- or core-layer switch as the primary root and another device as the secondary candidate. Verify the actual root for each VLAN or MST instance. A new switch with a superior default bridge ID can take over as root, changing blocked ports and traffic paths. A root change alters forwarding across the tree, not just one configuration line. Assess the affected paths before maintenance.
Leaving priorities at their defaults can let a MAC-based tie-breaker make an access switch the root, changing the intended traffic paths and convergence behavior. Specify primary and secondary root locations for each VLAN or STP instance, then set their priorities. If the root changes, check not only the new root ID but also which BPDU was judged superior and when.
Sources for this section IEEE 802.1Q-2022 · Cisco Troubleshoot STP Problems and Related Design Considerations
Comparing paths to the root: forwarding and standby ports↑
A non-root switch selects the port with the best path to the root as its root port. On each segment, the port advertising the best path information becomes the designated port. A redundant path can remain on standby in the alternate role.
The comparison uses accumulated path cost and bridge and port identifiers. It does not simply block the slowest link: the complete path-to-root comparison and its tie-breakers determine each role.
| Role | Meaning | Normal forwarding |
|---|---|---|
| Root | Best port toward the root | Forwarding |
| Designated | Selected forwarding port for the segment | Forwarding |
| Alternate | Standby path through another switch | Discarding |
A switch compares received BPDUs in a defined order, using root ID, accumulated path cost, sender bridge ID, port information, and other applicable fields. Its root port is the one receiving the best BPDU for reaching the root. Each non-root switch has one such port per tree, while each segment's designated port is the port advertising the best information on that segment. Other redundant paths take nonforwarding roles such as alternate. Looking only at the cost on one switch can miss the tie-breakers.
If the paths through two uplinks have the same accumulated cost to the root, the upstream switch's bridge ID or port ID can decide the result. Calling the left-hand link “primary” does not establish a preferred path. Set the root, port costs, and priorities, then verify the reported roles. With per-VLAN STP, one physical link can forward for VLAN 10 and block for VLAN 20, so record the instance context too.
A role describes a port's responsibility in the topology; its state describes whether it currently learns and forwards frames. A blocking port is not simply a dead link. Determine which failure would change its role. With per-VLAN STP, the same physical port can have a different role in each instance.
Sources for this section IEEE 802.1Q-2022 · Cisco Troubleshoot STP Problems and Related Design Considerations
What to look for in the diagram The diagram shows three interconnected switches with equal link costs. Compare the bridge ID of each device and the positions of the root, designated, and alternate ports. The blocked marker on Port 2 of C and the dashed line between B and C show where frames are prevented from looping.
↔ Scroll horizontally to explore the diagram.
RSTP works with neighboring switches to agree on port roles and cut wait times↑
RSTP exchanges proposals and agreements over point-to-point links to move new paths into forwarding safely and quickly. An edge port can avoid the initial wait on the assumption that no other switch is connected to it.
Failover time depends on how a link failure is detected, the topology, device processing, and timer settings. Using RSTP alone does not establish a recovery time. Test actual link and device failures, and measure when users can communicate again.
RSTP does not make every port wait for a timer to expire. Instead, point-to-point neighbors use proposal/agreement exchanges to confirm new designated and root roles. The switch verifies that other paths are safely synchronized before moving the new port into forwarding. An alternate port can also quickly become a root-port candidate when the root path fails. Merely changing the protocol to RSTP does not make every link converge at the same speed.
Shared segments, legacy STP neighbors, unidirectional links, and incorrect edge settings can invalidate the rapid-handshake assumptions. After a link goes down, STP roles may change before the associated LACP, gateway, routing, and application sessions stabilize. In failure tests, measure BPDU timing, port state transitions, MAC relearning, and actual packet recovery separately. This keeps protocol switchover time distinct from the user's outage.
Fast convergence does not mean every failure is lossless. Physical down detection, missed BPDUs, MAC address table updates, and other protocols' convergence all contribute. Half-duplex operation, shared segments, incompatible modes, or a unidirectional link can invalidate rapid-handshake assumptions. Review actual topology-change logs and measure the interval of packet loss.
Sources for this section IEEE 802.1Q-2022 · IEEE 802.1Q Working Group
User ports connected to another switch: why BPDU Guard must intervene↑
User and server ports configured as edge can start forwarding quickly, but connecting another switch creates a loop risk. BPDU Guard blocks a protected edge port when it receives a BPDU, helping prevent that port's unexpected connection from changing the STP topology.
Other protections, including Root Guard and Loop Guard, address different failures. Rather than enabling them indiscriminately, identify the trust boundary and the abnormal BPDU or unidirectional link condition each should stop.
An edge port connects a PC, server, or other endpoint that does not participate in spanning tree. The port can enter forwarding quickly, but an incorrectly connected switch can create a loop or topology change. BPDU Guard places a protected port into an error-disabled state on receipt of a BPDU. Once the port is blocked, someone must investigate the wiring; define who does that and the conditions for reopening the port.
Root Guard prevents a device in a restricted direction from becoming root by advertising a superior root BPDU. Loop Guard helps prevent a blocked port from incorrectly entering forwarding when expected BPDUs disappear. Link detection features such as UDLD address unidirectional failures through a different detection mechanism. Despite similar names, these features have different triggers and protection targets. Choose them for the trust conditions of each access connection or uplink, and monitor discarding and inconsistent states.
Root Guard prevents a port from becoming the path toward the root after receiving a superior BPDU. Loop Guard prevents a blocked port from incorrectly forwarding when expected BPDUs stop arriving. The names sound similar, but the protected failure conditions differ. Before applying either feature, define the port role and normal BPDU direction, then prepare alerts and automatic or manual recovery procedures.
Sources for this section IEEE 802.1Q-2022 · Cisco Troubleshoot STP Problems and Related Design Considerations
Recurring faults: correlate the root, port roles, and topology-change times↑
Scenario: After replacing one uplink, VLAN 20 shows intermittent MAC flapping.
- Verify that the VLAN or MST instance's current root bridge matches the design.
- Record the affected switch's root, designated, and alternate ports, along with their path costs.
- Identify the two ports between which the flapping MAC moves, and correlate those moves with topology-change times.
- Check for a missing port channel, a native VLAN mismatch, and a unidirectional link.
- After the fix, test a redundant link failure and verify that the alternate takes the expected path.
Start by collecting the affected VLAN or instance's root ID and root port from every switch, then draw the actual tree. Mark forwarding and alternate roles and path costs on the physical topology. This can reveal unexpected detours even without a loop. Next, correlate topology-change counters, the last-changing port, and MAC move logs by time. Replace the vague label “STP issue” with a record of which role changed and when.
Preserve the original state and limit the fix to the identified cause: root priority, port-channel configuration, the native VLAN, or physical wiring. When the test link is disconnected, verify that the expected alternate becomes the root port and measure when broadcast and unicast traffic recover. After restoring the connection, confirm that the root and roles return to the design. If topology changes keep recurring, look for another trigger, such as a client link flap or an incorrect edge setting.
Rebooting a high-CPU switch may briefly stop a storm, but it returns if the loop remains. Reconstruct the sequence of root and port-role changes to distinguish the link that caused the problem from changes that merely followed it.
Sources for this section IEEE 802.1Q-2022 · Cisco Troubleshoot STP Problems and Related Design Considerations
FAQ↑
Can I use all redundant links at once by disabling STP?
Glossary↑
Sources and verification
- IEEE 802.1Q-2022 — Standards for bridges, VLANs, STP, RSTP, and MSTP
- IEEE 802.1Q Working Group — Standards revisions and project information
- Cisco Troubleshoot STP Problems and Related Design Considerations — A vendor guide to changes in port roles, troubleshooting, and design considerations
The current IEEE 802.1Q standard covers both bridging and spanning tree. Port names, instance models, and protection-feature defaults vary by implementation.