STP Attack Explained: Spanning Tree Protocol Attacks for the CEH Exam & CompTIA Pentest Exam

 STP Attacks: A CompTIA Pentest & 

CEH Exam Prep Guide

What Is an STP Attack?

Every switched network with redundant links relies on the Spanning Tree Protocol (STP) to prevent Layer 2 loops. STP works quietly in the background, electing a root bridge and blocking backup paths so frames can't circle endlessly and melt down the network with a broadcast storm. That quiet trust is exactly what attackers exploit.

An STP attack targets this loop-prevention logic itself. By injecting forged Bridge Protocol Data Units (BPDUs), an attacker can force the switched network to recalculate its topology, seize the root bridge role, or trigger a denial-of-service condition. For the CEH exam, STP attacks sit alongside VLAN hopping, ARP spoofing, and MAC flooding as core Layer 2 network-based attacks you're expected to recognize, execute conceptually, and defend against.

A Quick Refresher on How STP Works

STP (IEEE 802.1D) prevents loops by building a loop-free logical topology over a physically redundant network:

1. Root bridge election — every switch exchanges BPDUs advertising a bridge ID (priority + MAC address). The switch with the lowest bridge ID becomes the root bridge.
2. Port roles — each non-root switch picks a root port (best path to the root) and, per segment, a designated port. Every other port becomes a blocking port.
3. BPDUs keep it alive — the root bridge sends BPDUs every 2 seconds (the hello timer). If a switch stops hearing BPDUs, it assumes the topology changed and recalculates.
4. Topology Change Notifications (TCNs) — sent when a link goes up or down, telling switches to shorten MAC table aging and re-converge.

The entire protocol runs on trust: any switch (or attacker) that speaks BPDUs is assumed to be a legitimate participant.

The Three STP Attacks CEH Covers

Attack	What the attacker does	Primary effect
BPDU flooding	Sends a continuous stream of forged BPDUs from a rogue host	Switch CPUs spend cycles recalculating STP; the network suffers repeated re-convergence and instability (DoS)
Root bridge spoofing/takeover	Advertises a BPDU with a lower bridge priority than the real root	Attacker's system becomes the new root bridge, redirecting traffic through it — a foothold for Man-in-the-Middle (MITM) sniffing
TCN (Topology Change Notification) attack	Repeatedly sends TCN BPDUs to force topology change events	Shortens MAC address table aging network-wide, causing flooding and performance degradation

Of these, root bridge takeover is the most dangerous because it doesn't just disrupt the network — it repositions the attacker as a traffic chokepoint, enabling interception of data that would otherwise never cross their segment.

How the Attack Is Carried Out

A typical root bridge takeover, as CEH material walks through it:

1. Reconnaissance — the attacker connects to a switch port (often an unsecured wall jack or conference-room drop) and sniffs BPDUs to learn the current root bridge's priority value.
2. Craft malicious BPDUs — using a tool like Yersinia (the classic CEH-referenced Layer 2 attack tool, also capable of DHCP, DTP, and HSRP attacks) or macof-style scripts, the attacker builds BPDUs advertising a lower bridge priority than the legitimate root.
3. Flood the network — the forged BPDUs are broadcast continuously, out-competing the real root bridge's advertisements.
4. Re-convergence — switches accept the attacker's system as the new root bridge and recompute port roles, rerouting traffic through the attacker's machine.
5. Exploit the position — with traffic now flowing through them, the attacker sniffs, captures, or manipulates packets — turning a Layer 2 protocol weakness into a full MITM foothold.

Why It Matters: The Business Impact

An STP attack rarely stays theoretical once it lands. Consequences include:

• Denial of service — repeated re-convergence causes intermittent outages, dropped VoIP calls, and application timeouts across the whole switched segment, not just one host.
• Man-in-the-middle exposure — once an attacker's device is the root bridge, unencrypted traffic (legacy protocols, internal APIs, credentials) can be captured or altered in transit.
• Loss of network integrity — unplanned topology changes can reintroduce the very Layer 2 loops STP exists to prevent, especially if the attack collides with a real link failure.
• Difficult attribution — BPDUs don't carry strong authentication by default, so tracing the rogue switch back to a specific attacker or port can be slow without proper logging.

For an exam scenario, expect this attack to be framed as a precursor to sniffing or session hijacking rather than an end goal on its own.

Detection and Mitigation

CEH pairs every Layer 2 attack with its Cisco-style countermeasures. For STP, know these by name:

Feature	What it does
BPDU Guard	Immediately disables (err-disables) an access port the instant it receives a BPDU — assumes end-user ports should never see one
Root Guard	Allows a port to receive BPDUs but blocks it from ever becoming a root port, preventing a rogue switch from becoming root
BPDU Filter	Suppresses BPDU transmission/reception on a port entirely (used carefully — it can also disable legitimate loop protection)
Port Security	Limits/locks MAC addresses per port, making it harder for a rogue device to blend in unnoticed

Best-practice guidance to remember for the exam: enable BPDU Guard on all access/edge ports, enable Root Guard on ports facing other switches that should never become root, and disable STP participation entirely on ports that only ever connect end-user devices.

CEH Exam Tips

• STP attacks fall under Module 10: Denial-of-Service and Module 11/Sniffing content in the CEH v12/v13 blueprint — expect them grouped with MAC flooding, ARP poisoning, and VLAN hopping as "Layer 2 attacks."
• Know Yersinia by name and purpose: a Layer 2 attack framework capable of STP, DTP, DHCP, HSRP, and CDP attacks. It shows up often in tool-recognition questions.
• Memorize the defense pairing: BPDU Guard = stop rogue BPDUs at access ports. Root Guard = stop rogue root bridges at switch-to-switch ports. Exam questions frequently swap these two to test whether you know which port type each protects.
• Remember STP attacks are a switching/Layer 2 issue — don't confuse them with Layer 3 attacks like ARP spoofing, even though both can lead to MITM.
• If a scenario mentions "a rogue switch becomes the root bridge," the expected answer is almost always Root Guard as the fix.

PenTest+ Exam Tips

STP attacks aren't unique to CEH — CompTIA PenTest+ (PT0-002/PT0-003) tests them too, under the Attacks and Exploits domain's network-based attacks objective, grouped with VLAN hopping, MAC flooding, ARP poisoning, and DNS cache poisoning.

The framing shifts, though:

• Engagement scope first — PenTest+ expects you to treat STP manipulation as an in-scope activity you'd only run with explicit authorization, not a standalone attack to recognize.
• Execution over recognition — expect scenario questions asking which network attack to use against a given topology, rather than "identify this attack" questions.
• Reporting and remediation carry more weight — PenTest+ leans heavily on its Reporting and Communication domain, so know how to write up a rogue-root-bridge finding and recommend BPDU Guard/Root Guard remediation in a client-facing deliverable.
• Tool carryover — Yersinia is the same tool referenced on both exams, so that anchor transfers directly.

Bottom line for dual-cert studiers: the technical mechanics (BPDU flooding, root bridge takeover, TCN attacks) are identical across both exams — only the lens changes, from "know and defend" (CEH) to "authorize, execute, and report" (PenTest+)

Key Takeaways

STP attacks exploit the implicit trust baked into a protocol most engineers never think about — which is exactly why CEH tests it. An attacker who forges BPDUs can flood a network into instability or, worse, seize the root bridge role and quietly reroute traffic through their own machine for interception.

For the exam, anchor on three things: the attack types (BPDU flooding, root bridge takeover, TCN attacks), the tool most associated with them (Yersinia), and the two defenses that get tested against each other (BPDU Guard for access ports, Root Guard for switch-facing ports). Get those three anchors solid, and STP-attack questions become one of the more predictable wins on exam day.