CompTIA Network+ Preparation · lesson 14 of 30 · 25 min
Why STP Exists
Redundant switch links are essential for high availability — but they create switching loops. Without loop prevention, broadcast frames would circulate forever (broadcast storm), MAC address tables would constantly flip (MAC flapping), and the network would become unusable.
STP (Spanning Tree Protocol — IEEE 802.1D) prevents loops by logically blocking redundant paths while keeping them available as backups. If the active path fails, STP unblocks the backup path.
STP Operation
Root Bridge election: The switch with the lowest Bridge ID becomes the Root Bridge. Bridge ID = Priority (default 32768) + MAC address. All ports on the Root Bridge are Designated Ports (forwarding).
Port roles:
Root Port (RP) — best path toward the Root Bridge. One per non-root switch. Always forwarding.
Designated Port (DP) — best port on each network segment toward the Root Bridge. Always forwarding.
Blocked Port (BP) — redundant port that is blocked to prevent loops. Still receives BPDUs.
BPDU (Bridge Protocol Data Unit) — STP control messages exchanged between switches. Contains Bridge ID, path cost, and port information. Root Bridge sends BPDUs every 2 seconds (Hello timer).
STP port states: Blocking → Listening (15s) → Learning (15s) → Forwarding. Total convergence time: ~30–50 seconds.
RSTP and Improvements
RSTP (Rapid Spanning Tree Protocol — IEEE 802.1w) — improved version of STP. Convergence in seconds (vs 30–50s for STP). New port roles: Alternate Port (backup Root Port), Backup Port (backup Designated Port). Backward compatible with STP.
PortFast — Cisco feature that immediately moves an access port to forwarding state, bypassing Listening and Learning. Only use on ports connected to end devices (never to other switches — would cause loops).
BPDU Guard — shuts down a PortFast-enabled port if it receives a BPDU. Prevents rogue switches from being connected to access ports.
PVST+ (Per-VLAN Spanning Tree Plus) — Cisco enhancement running a separate STP instance per VLAN. Allows load balancing by making different switches the Root Bridge for different VLANs.
Exam Tip
Root Bridge = lowest Bridge ID (priority + MAC). Root Port = best path to Root Bridge. Blocked ports prevent loops. PortFast skips STP states for end devices. BPDU Guard protects PortFast ports from rogue switches.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Network+ — Spanning Tree Protocol
STP prevents which network problem?
- IP address conflicts
- Switching loops and broadcast storms
- Routing loops
- VLAN mismatches
Answer: Switching loops and broadcast storms
Without STP, redundant switch links cause frames to loop forever — broadcast storms crash the network. STP blocks redundant paths.
The Root Bridge is elected based on:
- Highest MAC address
- Lowest Bridge ID (priority + MAC)
- Highest port count
- Lowest IP address
- Answer: Lowest Bridge ID (priority + MAC)
Bridge ID = Priority (default 32768) + MAC address. Lowest Bridge ID wins the Root Bridge election. A Root Port is:
- A port on the Root Bridge
- The best path toward the Root Bridge on a non-root switch
- A blocked port
- A PortFast-enabled port
- Answer: The best path toward the Root Bridge on a non-root switch
Each non-root switch has exactly one Root Port — the port with the lowest cost path to the Root Bridge. Classic STP (802.1D) convergence takes approximately:
- 1–2 seconds
- 5–10 seconds
- 30–50 seconds
- 5 minutes
- Answer: 30–50 seconds
STP convergence: Listening (15s) + Learning (15s) = 30s minimum. RSTP improves this to seconds. PortFast should only be configured on ports connected to:
- Other switches
- Routers only
- End devices (PCs, printers)
- Trunk links
- Answer: End devices (PCs, printers)
PortFast bypasses STP states — safe for end devices that cannot create loops. Never use on switch-to-switch links. BPDU Guard protects against:
- Broadcast storms
- Rogue switches connected to PortFast ports
- Root Bridge failures
- VLAN hopping
- Answer: Rogue switches connected to PortFast ports
BPDU Guard shuts down a PortFast port if it receives a BPDU — prevents unauthorized switches from disrupting STP. RSTP (802.1w) improves on STP by:
- Eliminating the need for a Root Bridge
- Converging in seconds instead of 30–50 seconds
- Supporting more VLANs
- Using a different election process
- Answer: Converging in seconds instead of 30–50 seconds
RSTP uses a negotiation mechanism instead of timers — convergence happens in 1–2 seconds vs 30–50s for classic STP.
In which STP port state does a port learn MAC addresses but not forward data?
- Blocking
- Listening
- Learning
- Forwarding
Answer: Learning
Learning state: port populates the MAC address table but does not forward user data. Prevents flooding when transitioning to forwarding.
PVST+ runs a separate STP instance per:
- Switch
- VLAN
- Port
- Router
- Answer: VLAN
Per-VLAN Spanning Tree Plus (PVST+) runs one STP instance per VLAN — allows different Root Bridges per VLAN for load balancing.
BPDUs are sent every _____ seconds by the Root Bridge (Hello timer).
Answer: 2
The STP Hello timer is 2 seconds — the Root Bridge sends BPDUs every 2 seconds to maintain the topology.
Previous lesson: Routing protocols: RIP, OSPF, EIGRP, BGP — purpose and characteristics
Back to CompTIA Network+ Preparation
Next lesson: WAN technologies: MPLS, SD-WAN, broadband, leased lines, cellular, satellite