STP and RSTP Explained: Spanning Tree for the Network+ Exam

Spanning Tree Protocol exists to solve a problem that redundancy creates. You want more than one path between switches so the network survives a failed link. But Ethernet has no mechanism to stop a frame circulating forever, and more than one path means loops.

STP deliberately blocks redundant links so the topology is loop-free, and unblocks them the moment the primary path fails.

Why a Loop Is So Destructive

Three things go wrong simultaneously, and they compound.

Broadcast storms. An IP packet has a TTL field that kills it after enough hops. An Ethernet frame has nothing of the sort. A broadcast entering a loop is forwarded endlessly, and each switch duplicates it out every port, so traffic multiplies rather than merely circulating. Link utilization reaches 100% within seconds.

MAC address table instability. The same source MAC arrives on different ports repeatedly, so switches rewrite their tables constantly and forwarding becomes unpredictable.

Multiple frame delivery. Hosts receive duplicates, which breaks protocols that assume they will not.

The practical signature is a network that goes from fine to completely unusable in under a minute, with switch CPUs pegged and link lights on every port solid. This is why a loop caused by someone plugging a patch cable into two wall ports is a genuine outage, not an inconvenience.

How STP Builds the Tree

1. Elect a root bridge. Switches exchange BPDUs — bridge protocol data units — advertising a bridge ID made of a priority value and the MAC address. Lowest bridge ID wins. Default priority is 32768, so with defaults the switch with the lowest MAC address becomes root, which is usually the oldest switch in the building and precisely the wrong choice. Set the root bridge deliberately by lowering the priority on a core switch.
2. Each non-root switch picks a root port — the one interface with the lowest cumulative path cost toward the root.
3. Each segment picks a designated port — the port forwarding onto that segment.
4. Everything else is blocked, which is what eliminates the loop.

Path cost is based on link speed: lower cost means faster. Ties are broken by bridge ID, then by port ID.

STP Versus RSTP

This comparison is the most likely exam question on the topic.

	STP (802.1D)	RSTP (802.1w)
Convergence	30–50 seconds	Typically under 6 seconds, often about 1
Port states	Blocking, listening, learning, forwarding, disabled	Discarding, learning, forwarding
Port roles	Root, designated, blocked	Root, designated, alternate, backup
BPDUs	Generated by the root, relayed by others	Every switch generates them as keepalives
Failure detection	Waits for max age timer to expire	Detects missed BPDUs in about 6 seconds

Classic STP's 30 to 50 seconds is the number to remember, and it comes from the timers: 20 seconds of max age plus two 15-second forward delay intervals. RSTP replaced timer-based waiting with an explicit handshake between neighbours, which is where the speed comes from. It also introduced alternate and backup port roles — pre-computed standby paths that can be promoted immediately rather than recalculated.

RSTP is backward compatible with STP, but a segment running both falls back to the slower behaviour. RSTP is the sensible default on any modern switch.

The Protection Features

Network+ expects these by name, and they are what actually keeps production networks stable.

• PortFast — moves an access port straight to forwarding, skipping the listening and learning delay. Used on ports connecting to end devices, never to switches. Without it, a PC can finish booting before its port forwards, which is why DHCP sometimes fails on a cold start.
• BPDU Guard — shuts down a PortFast port that receives a BPDU. This is the control that stops someone plugging an unauthorized switch into a wall port. PortFast and BPDU Guard belong together.
• Root Guard — prevents a port from becoming a root port, protecting your chosen root bridge from being displaced by a switch with a lower priority appearing somewhere unexpected.
• Loop Guard — protects against unidirectional link failures where BPDUs stop arriving and a blocked port would otherwise wrongly begin forwarding.

Variants

PVST+ and Rapid PVST+ are Cisco implementations running a separate spanning tree instance per VLAN, which allows load balancing across redundant links. MSTP (802.1s) maps groups of VLANs onto a small number of instances, which scales far better than one instance per VLAN in large environments.

Network+ (N10-009) Exam Tips

• STP prevents switching loops by blocking redundant paths. That is the one-line answer.
• 802.1D is STP; 802.1w is RSTP; 802.1s is MSTP. Memorize the numbers.
• Know the convergence times: 30–50 seconds for STP, a few seconds for RSTP.
• Lowest bridge ID wins the root election, and bridge ID is priority plus MAC address.
• Know the port states for both, and that RSTP collapsed five states into three.
• PortFast with BPDU Guard on access ports. Expect a scenario about an unauthorized switch or a slow-booting PC.
• Recognize a broadcast storm from its symptoms: sudden total failure, saturated links, high switch CPU.

Security+ and A+ Angles

Security+ (SY0-701) treats it as availability and as an attack surface. An attacker sending crafted BPDUs with a low priority can force a root bridge election and redirect traffic through their device — an STP manipulation attack. BPDU Guard and Root Guard are the defenses.

A+ stays practical: recognize that a loop causes a network outage, and that plugging both ends of a cable into the same switch or two wall ports is a common cause.

Key Takeaways

• STP blocks redundant links to prevent loops, and reactivates them when a path fails.
• Ethernet frames have no TTL, which is why a loop becomes a broadcast storm rather than a slowdown.
• RSTP (802.1w) converges in seconds; classic STP (802.1D) takes 30 to 50.
• Set the root bridge deliberately rather than letting the oldest switch win by default.
• PortFast plus BPDU Guard on access ports is the standard configuration.
• BPDU manipulation is a real attack, and Root Guard is the defense.