Two cables between two closets is redundancy. It is also, without Spanning Tree, an outage waiting for someone to plug in the second cable. Ethernet frames have no TTL, so a loop does not slow down — it multiplies until the network stops.
Spanning Tree solves this by turning a mesh into a tree. One switch becomes the root, every other switch finds its shortest path to it, and the ports that would create a loop are blocked. The protocol is old, the concepts are simple, and most outages attributed to it are really outages caused by configuration that let the wrong switch win.
The election nobody watches
Every switch has a bridge ID: a priority (default 32768, in multiples of 4096) followed by its MAC address. The switch with the lowest bridge ID becomes the root. That is the entire election.
Because the priority is the same on every switch by default, the tie is broken by the lowest MAC address — which means the root is effectively random, and usually ends up on whichever access switch was manufactured first. Traffic then flows through that closet on its way across campus.
The fix is not a protocol change; it is a decision. Set the core switch to priority 4096, the distribution layer to 8192, and leave access at 32768. Now the root is where the bandwidth is, and it stays there after a replacement.
Priorities are relative, not absolute
4096 beats 8192 beats 32768. What matters is the ordering across your switches, not the numbers themselves. Pick a scheme, document it, and apply it everywhere — a single access switch left at 4096 will quietly become the root of the campus.
Path cost and port roles
Each link has a cost derived from its speed. The switch adds costs along the path to the root and keeps the cheapest. In RSTP the defaults are:
| Link speed | Cost (RSTP long) |
|---|---|
| 10 Mbps | 2,000,000 |
| 100 Mbps | 200,000 |
| 1 Gbps | 20,000 |
| 10 Gbps | 2,000 |
| 25 Gbps | 800 |
Ports then fall into roles:
- Root port — the one port on each non-root switch that points toward the root, lowest cost.
- Designated port — the forwarding port on each segment, the one closest to the root.
- Alternate / blocking — a port with a valid path that would create a loop. It listens, does not forward, and takes over if the root port fails.
That is the whole topology: one root, one best path up from each switch, and everything else blocked but ready.
Convergence, and why edge ports need protecting
Classic STP takes 30 to 50 seconds to converge: blocking, listening, learning, forwarding. RSTP (802.1w) cuts that to a few seconds by negotiating with neighbors instead of waiting on timers.
The dangerous part is what happens when a port that should be an edge port receives a BPDU. A workstation never sends one, but a cheap switch, a wireless bridge, or a looped cable does. If that port is participating in Spanning Tree, it can become part of the topology and move the root.
Two settings prevent it:
- Edge / PortFast — skip listening and learning, go straight to forwarding, because nothing beyond a workstation should be a bridge.
- BPDU guard — if a BPDU arrives on an edge port, err-disable it. The port goes down, an alarm fires, and the rest of the network keeps running.
The unidirectional fiber loop
A broken strand in a fiber pair can leave one side transmitting and the other not. The link stays up at layer 1, BPDUs travel one way only, and both ends believe they are designated. The result is a loop that Spanning Tree cannot see. Loop protection and UDLD exist for this, and so does the habit of checking both directions of a link after any fiber work.
Worked example
Three switches in a triangle, all 1 Gbps:
| Switch | Priority | Path cost to root |
|---|---|---|
| Core | 4096 | 0 (root) |
| IDF-A | 32768 | 20,000 via Core |
| IDF-B | 32768 | 20,000 via Core, 40,000 via IDF-A |
IDF-A's link to Core is its root port. IDF-B's direct link to Core is its root port too, so its link to IDF-A is an alternate and blocks. If the Core–IDF-B link fails, that blocked port transitions to forwarding in a few seconds under RSTP.
Note what did not happen: traffic between A and B now goes A → Core → B rather than A → B directly. That is the tree, and it is the price of loop freedom. If you want both links active, you need link aggregation or a routed design, not Spanning Tree.
What breaks in production
- The root moves. A new switch with default priority and a lower MAC becomes root, and half the campus starts crossing it. Set priorities explicitly, and monitor for root changes.
- A loop on an edge port. No BPDU guard, a wall port looped to another wall port, and the campus melts. This is the single most common cause of a total outage in a school.
- Topology change notifications. Every time a port flaps, switches flush their MAC tables and flood until they relearn. On a flapping link this becomes a permanent performance problem.
- Mixed STP dialects. PVST+ and RSTP on the same segment can interoperate badly, usually by falling back to slow convergence. Pick one, on every switch.
- Blocked port mistaken for a dead link. A port in alternate role carries no traffic by design. Monitoring that alerts on "port down" without checking STP state will page you for a healthy network.
Checklist
- Root bridge is explicitly set to the core, with a documented priority scheme.
- Every edge port has PortFast/edge and BPDU guard.
- RSTP is enabled consistently across all switches.
- Root changes are alerted on, not discovered during an outage.
- Fiber links are checked in both directions after any physical work.
- You can name the blocked port on every segment, and why.
Next
Spanning Tree gives you a loop-free tree, which means half your redundant links do nothing. Continue with Link Aggregation, Redundancy, and Why One Uplink Is a Bet.