Spanning Tree Protocol Explained: Root Bridge, BPDUs & Root Takeover (Animated)

Networks use redundant cables so one failure doesn’t take everything down, but redundant links create loops that can melt a network in seconds. Spanning Tree prevents loops by electing a root bridge and blocking extra paths. It trusts every switch that speaks it.

1. Elect the root: lowest bridge id wins

Every switch sends BPDUs announcing who it thinks the root is. The switch with the lowest priority (then lowest MAC) becomes the root bridge.

1. BPDU (Core switch → everyone on the LAN): The core switch has the best priority and becomes root.

Wireshark filter:

stp

2. Block the loop: one redundant port goes quiet

The access switches calculate the cheapest path to the root. The link between A and B would create a loop, so one end of it is put in blocking state.

1. BPDU (Access switch A → Access switch B): Both access switches agree on the root.
2. PORT (Access switch B → Access switch A): The A–B link stays as a standby path.

Wireshark filter:

stp.flags.tc == 1

3. Root takeover: attack: “i’m a better root”

Someone plugs a device into a desk port that sends BPDUs with priority 0. Every switch believes it, the tree is recalculated around the rogue device, traffic between switches can pass through it, and the network briefly drops while it reconverges.

1. BPDU (Rogue switch → everyone on the LAN): A “better” root appears on a desk port.

Wireshark filter:

stp.root.prio == 0

4. Bpdu guard: defence: desk ports must never speak stp

Enable PortFast with BPDU Guard on every access port (any BPDU shuts the port), Root Guard on ports that should never lead to the root, and set the core’s priority deliberately low.

1. BPDU (Rogue switch → Access switch A): The access port shuts itself down immediately.

Switch config (cisco):

spanning-tree portfast default
spanning-tree portfast bpduguard default
spanning-tree vlan 1-4094 root primary   (on the core)

FAQ