Spanning tree

Switches exchange BPDUs (to 01:80:c2:00:00:00, every hello time) and elect as root the one with the lowest bridge ID: a priority (default 32768), then its MAC address. Each other switch keeps its root port, the one with the cheapest total path cost to the root; each cable gets one designated port, the end nearer the root; every other port blocks. A blocked port still hears BPDUs, and takes over when a cable fails, after the max age and two forward delays (30 to 50 seconds with standard timers). Rapid spanning tree (802.1w) does it in about a second. Choose the root with its priority, or the tree will be built around whichever switch has the lowest MAC.

How spanning tree works, step by step

Ethernet frames have no hop limit. Cable three switches in a triangle and a single broadcast is flooded round the loop for ever, copied again at every switch: a broadcast storm. Spanning tree (IEEE 802.1D) keeps the spare cables but uses none of them, by building a tree in four steps.

1. Elect a root. Every switch has a bridge ID: a 2-byte priority (default 32768, set in steps of 4096) and its MAC address. Each starts out claiming to be root, sending BPDUs to the multicast MAC 01:80:c2:00:00:00. A switch that hears a lower bridge ID stops claiming and passes that one on. The lowest wins: priority first, the MAC only breaks a tie.
2. Pick a root port on every other switch. It is the port with the lowest total path cost to the root. Each link adds its port's cost; the 802.1D-1998 values are 100 for 10 Mb/s, 19 for 100 Mb/s, 4 for 1 Gb/s and 2 for 10 Gb/s. Ties go to the lower sender bridge ID, then the lower sender port ID.
3. Pick one designated port per cable: the end nearer the root, which forwards onto that cable. Ties go to the lower bridge ID. Every port on the root is designated.
4. Block everything else. A blocked port drops data frames and learns no MAC addresses, but keeps listening to BPDUs.

The root sends a BPDU every hello time (2 seconds). Each one carries the root ID, the sender's cost to the root, the sender's own ID and port, and the timers. When a blocked port stops hearing the BPDUs that justified blocking it, for the max age (20 seconds), it moves through listening and learning, each lasting the forward delay (15 seconds), and then forwards. So classic STP takes 30 to 50 seconds to recover. Rapid spanning tree (802.1w) replaces the waiting with a proposal and agreement between neighbours, and an alternate port already chosen in advance: about a second.

What it looks like on a Linux machine

A Linux bridge runs 802.1D spanning tree. In the spanning tree lab three bridges form a triangle, with coreSwitch at priority 4096. Each port is named after the switch at its other end:

$ bridge link show
3: coreSwitch@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br0 state forwarding priority 32 cost 100
5: floorA@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br0 state blocking priority 32 cost 100

That is floorB: its cable to floorA is on nobody's cheapest path, and floorB, the higher bridge ID, blocks its end. ip -d link show br0 prints the election from each switch's point of view, as designated_root 1000.… (priority 4096 in hex, then the MAC), root_port and root_path_cost 100. A capture shows the BPDUs:

$ tcpdump -vnni eth0 ether dst 01:80:c2:00:00:00
STP 802.1d, Config, Flags [none], bridge-id 8000.d2:65:0f:8e:21:b3.8002, length 35
	message-age 1.00s, max-age 20.00s, hello-time 2.00s, forwarding-delay 15.00s
	root-id 1000.9e:3b:52:c1:07:4a, root-pathcost 100

The lab shortens the timers so you can watch a cable fail: floorB's port stays blocking until the max age runs out, then goes listening, learning and forwarding, while pings stop and start again.

What goes wrong, and how you see it

No spanning tree on a looped network. One ARP request becomes hundreds of frames a second, MAC tables flap as the same address arrives on different ports, and CPUs and links fill up. The lab switches STP off to show it. A storm does not stop by itself; pulling a cable does.

The wrong root. Left at default priorities, the oldest switch, with the lowest MAC, often becomes root, and traffic crosses a closet switch instead of the core. Set the root's priority on purpose, and a backup root just above it.

A host port that waits. A PC plugged into a classic STP port waits 30 seconds before forwarding, long enough for DHCP to give up. Edge ports (PortFast) skip listening and learning; BPDU guard shuts one that hears a BPDU.

A slow failover. Recovery that takes 30 to 50 seconds means classic STP is running. RSTP, or its per-VLAN variants, cut it to about a second, as the rapid spanning tree lab shows.

Questions people ask

Why not just remove the extra cables? Because they are the backup. Spanning tree leaves them connected and unused until a working link fails.

What is the difference between STP and RSTP? Same election, faster recovery. RSTP has three port states (discarding, learning, forwarding) instead of five, alternate ports that take over at once, and handshakes instead of timers.

Does link aggregation need spanning tree? No. A bond of several cables counts as one link, so STP sees no loop in it and blocks none of its members.

See it on real machines