In this article, we will discuss the Spanning Tree Protocol in detail, along with the important terms associated with it. STP stands for “Spanning Tree Protocol“. STP is a Layer 2 network protocol, originally defined in IEEE 802.1D, that is used to prevent loops in a switched network. A loop occurs when there is more than one active Layer 2 path between the same source and destination. Because Ethernet frames have no TTL (Time to Live) field, a looped frame keeps circulating, which causes broadcast storms, MAC address table instability, and duplicate frames. STP prevents this by logically blocking the redundant paths while keeping them available as backups.
How Does STP Work?
In simple words, STP monitors all the network links, identifies the redundant connections, and places selected ports in a blocking state so that only one active path exists between any two devices. It builds this loop-free topology in three steps:
- Elect the root bridge – The switch with the lowest Bridge ID (bridge priority + MAC address) becomes the root bridge.
- Select a root port on every non-root switch – The port with the lowest path cost to the root bridge becomes the root port.
- Select a designated port on every segment – The port with the lowest path cost to the root on each segment becomes the designated port. All remaining ports are blocked.
If an active link fails, STP recalculates the topology and unblocks a redundant port to restore connectivity.
States of STP Ports
When STP (IEEE 802.1D) is enabled on a switch, each port of that switch is placed in one of the states mentioned below. A port normally moves from Blocking to Listening to Learning and finally to Forwarding.
| Port State | Description |
| Blocking | The port does not forward frames or learn MAC addresses, but it still receives and processes BPDUs. Ports that would cause a loop stay in this state. A blocked port moves to Listening if STP selects it as a root or designated port. |
| Listening | The port does not forward frames or populate the MAC table, but it sends and receives BPDUs to take part in the root bridge and port role election. It stays in this state for the forward delay (15 seconds by default). |
| Learning | The port still does not forward frames, but it learns source MAC addresses from received frames and adds them to the MAC table. It continues to process BPDUs and stays in this state for the forward delay (15 seconds by default). |
| Forwarding | The port receives and forwards frames normally and keeps learning MAC addresses. It continues to monitor incoming BPDUs, which may indicate that it must return to the blocking state. |
| Disabled | The port is administratively shut down or STP is disabled on it. It does not participate in frame forwarding or STP operations. |
With default timers, a port can take 30 to 50 seconds to reach the forwarding state. RSTP (802.1w) simplifies these into three states: Discarding (which replaces Disabled, Blocking, and Listening), Learning, and Forwarding.
Modes of STP
Below are the different modes of STP. The first three are IEEE open-standard STP modes, whereas the last two are Cisco-proprietary STP modes.
IEEE open-standard STP modes
| Mode | Standard | Description |
| Classic STP [Spanning Tree Protocol] | IEEE 802.1D | The original STP. It runs a single spanning-tree instance for the entire LAN, shared by all VLANs. |
| RSTP [Rapid Spanning Tree Protocol] | IEEE 802.1w (now part of 802.1D-2004) | An improved version of Classic STP with much faster network convergence, but it still runs only a single instance for the LAN. |
| MSTP [Multiple Spanning Tree Protocol] | IEEE 802.1s (now part of IEEE 802.1Q) | Based on RSTP, it allows you to create multiple STP instances and map groups of VLANs to each instance. |
Cisco-proprietary STP modes
| Mode | Description |
| PVST+ [Per-VLAN Spanning Tree Plus] | An enhancement of Classic STP and the default STP mode on many Cisco Catalyst switches. It creates one spanning-tree instance per VLAN, which allows traffic of different VLANs to be load-balanced across redundant links. |
| Rapid PVST+ [Rapid Per-VLAN Spanning Tree Plus] | The per-VLAN version of RSTP. It creates one spanning-tree instance per VLAN and provides much faster network convergence than PVST+. |
Port Roles
Below are the different port roles in the spanning-tree topology.
| Port Role | Description |
| Root Port | On every non-root switch, the port with the lowest path cost to the root bridge. It is in the forwarding state. Each non-root switch has exactly one root port, and the root bridge has none. |
| Designated Port | On every LAN segment, the port that offers the best path to the root bridge. It forwards traffic for that segment. All active ports on the root bridge are designated ports. |
| Alternate Port | A blocked port that provides an alternate path to the root bridge through a different switch. It takes over if the root port fails. (RSTP/MSTP role) |
| Backup Port | A blocked port that provides a redundant path to a segment where another port on the same switch is already the designated port, for example two ports connected to the same shared segment or hub. (RSTP/MSTP role) |
Root & Designated Switch
There are mainly two switch roles in an STP topology. Both are mentioned below.
| Switch Role | Description |
| Root Switch (Root Bridge) | The switch with the lowest Bridge ID in the network. All of its active ports are designated ports, and every other switch calculates its path cost towards it. |
| Designated Switch (Designated Bridge) | For each LAN segment, the switch that provides the lowest-cost path from that segment to the root bridge, i.e. the switch that owns the segment’s designated port. The root bridge is the designated switch for all of its directly connected segments. |
Other Important Terms of STP
The Spanning Tree Protocol is a vast topic, and it is difficult to cover everything in a single article. Below are a few important and commonly used STP terms that are worth understanding.
PortFast
PortFast moves an access port directly to the forwarding state as soon as the link comes up, bypassing the listening and learning states. Its purpose is to minimize the time an interface must wait for spanning tree to converge, so end devices such as PCs, printers, and servers get connectivity immediately. PortFast should be enabled only on ports connected to a single end host. Enabling it on a port connected to another switch or hub risks creating a loop. (For trunk ports connected to servers or hypervisors, Cisco uses the spanning-tree portfast trunk command.)
UplinkFast
UplinkFast is a Cisco feature used on access-layer switches that have redundant uplinks. When the root port fails, UplinkFast immediately moves the blocked alternate uplink to the forwarding state, bypassing the listening and learning states. This reduces recovery time from 30 to 50 seconds to just a few seconds. UplinkFast is not required with RSTP or Rapid PVST+, because this fast failover is built in.
BPDU – Bridge Protocol Data Unit
Switches send and receive spanning-tree frames called BPDUs, every 2 seconds (hello time) by default. A BPDU contains information about the sending switch and its ports, including the root bridge ID, the sending bridge ID (bridge priority and MAC address), the port ID (port priority and port number), the root path cost, and timer values. STP uses this information to elect the root switch, select the root port on each non-root switch, and select the designated port for each switched segment.
BPDU Guard
BPDU Guard protects the STP topology from unauthorized or misconnected switches on ports that should only connect to end devices. When a BPDU is received on a BPDU Guard-enabled port, the port is shut down and placed in the err-disabled (Error-Disabled) state. When BPDU Guard is enabled globally on the switch, it applies to all PortFast-enabled interfaces. It can also be enabled on individual interfaces.
BPDU Filter
BPDU Filter stops a port from sending BPDUs to end systems. Its behaviour depends on how it is enabled. When enabled globally, it applies to PortFast-enabled ports. These ports stop sending BPDUs shortly after the link comes up, and if a BPDU is received, the port loses its PortFast and BPDU Filter status and returns to normal STP operation. When enabled on an individual interface, the port neither sends nor processes BPDUs. This effectively disables STP on that port and can create loops, so it should be used with caution.
Disclaimer: This article is for educational purposes only and is not professional financial, medical, or legal advice. It may contain affiliate links, which earn us a small commission at no extra cost to you. See our Disclaimer and Affiliate Disclosure.
Article ID: EA00133