What Is Spanning Tree Protocol?
Spanning Tree Protocol (STP) is a network protocol that stops switching loops in a local area network by allowing only one active path between any two switches. Extra backup links stay on standby until the main path fails.
A common example is an office floor where two switches are cabled to each other twice, so a single cut wire doesn't take a department offline. Those two cables form a circle. STP keeps one open and parks the other, so traffic flows in a straight line while the spare stays ready.
The protocol works at Layer 2, the data link layer where switches forward frames (the small units of data carried over Ethernet) based on hardware addresses. Because STP relies on MAC addresses and never reads IP addresses, it is strictly a Layer 2 protocol, while routed Layer 3 links handle loops through routing protocols. Most managed switches in campus, branch and data center networks run it by default.
Why Do Switched Networks Need Spanning Tree Protocol?
Spanning Tree Protocol exists because Ethernet frames carry no expiry counter. A packet at Layer 3 has a time-to-live value that drops at each hop until the packet is discarded, but a frame has nothing similar, so it can circle a loop indefinitely.
Once a loop forms, problems escalate quickly. Broadcast traffic multiplies, and switches keep rewriting their address tables as the same MAC address (a device's unique hardware ID) appears on different ports. Hosts receive duplicate frames, and legitimate traffic starts to suffer packet loss.
STP lets organizations keep redundant cabling for resilience without that instability.
What Is a Broadcast Storm and How Does STP Prevent It?
A broadcast storm is a flood of broadcast frames that loops endlessly between switches until they consume all available capacity. Each switch forwards a broadcast out of every port except the one it arrived on, so every lap through the loop creates more copies.
Switch buffers, the small memory queues that hold frames waiting to leave a port, fill up within moments. After that, the switch starts dropping legitimate traffic, CPU load climbs and users experience what looks like total network congestion.
STP prevents this by making sure no loop exists in the first place. With every redundant path blocked, a broadcast reaches each segment once and stops.
How Does Spanning Tree Protocol Work?
Spanning Tree Protocol works by having switches exchange control messages, called Bridge Protocol Data Units (BPDUs), and agree on a single loop-free layout.
The process runs in three stages:
Root bridge election: Every switch advertises a bridge ID, made up of its MAC address and a priority value set during network configuration. The switch with the lowest bridge ID becomes the root bridge, the reference point for the whole topology.
Root port selection: Each remaining switch picks the one port with the lowest total path cost back to the root. Path cost is a value tied to link speed, so faster links are preferred.
Designated port selection and blocking: On every network segment, one port is chosen to forward traffic toward that segment. Any port left without a role moves to a blocking state.
If a link or switch goes down, BPDUs stop arriving on the affected path. The switches recalculate, and a blocked port can move into forwarding, a process known as convergence.
What Are the STP Port States and Roles?
Spanning Tree Protocol assigns each port a role and moves it through a series of states before it can carry user traffic.
Port state | What happens |
Blocking | Receives BPDUs but forwards no user frames |
Listening | Takes part in the election and discards data frames |
Learning | Builds its MAC address table without forwarding frames |
Forwarding | Sends and receives user traffic normally |
Disabled | Shut down administratively and excluded from STP |
Port roles describe purpose. A root port is a switch's best path to the root bridge. A designated port forwards traffic onto a segment, and an alternate or backup port stays blocked as a standby path.
What Are the Types of Spanning Tree Protocol?
Spanning Tree Protocol has evolved into several versions since Radia Perlman designed the original algorithm at Digital Equipment Corporation in the mid-1980s. Each later version addresses a limitation of the one before it.
Classic STP (IEEE 802.1D): The first standard built on that algorithm, dependable yet slow to converge after a failure.
Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w): Uses a handshake between neighboring switches so ports move to forwarding in seconds.
Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s): Groups VLANs, or logically separated network segments, into a few spanning tree instances so different traffic can use different paths.
Per-VLAN variants: Vendor implementations that run a separate tree for each VLAN, giving fine control at the cost of more switch processing.
Most current environments run RSTP or MSTP.
What Are Common Spanning Tree Protocol Problems?
Spanning Tree Protocol problems usually trace back to design choices left at their defaults. When every switch keeps the factory priority, the root bridge is decided by the lowest MAC address, which is often an old access switch in a closet.
Other frequent issues include:
Frequent topology changes: A flapping link forces repeated recalculations, which flush address tables and cause brief outages.
Mixed STP versions: Switches running different variants fall back to slower behavior at the boundaries.
Unprotected edge ports: A user plugging in an unmanaged switch can trigger an election or create a loop. Features such as BPDU Guard and Root Guard shut down or restrict ports that send unexpected BPDUs.
Each of these can end in network downtime that looks unrelated to spanning tree at first.
How Do You Monitor Spanning Tree Protocol?
Spanning Tree Protocol is monitored by watching the events that signal instability: root bridge changes, topology change notifications and port state transitions. Switches expose this data through the bridge MIB, a standard set of spanning tree data points, over SNMP, and most can send SNMP traps, which are unsolicited alerts pushed the moment a new root is elected or a topology change occurs.
Raw events tell only part of the story. When a blocked port starts forwarding, engineers need to see what changed around it, such as interface errors or a broadcast spike on that link. Correlating STP events with interface health, traffic flows and a live topology map turns root cause analysis into a quick trace back to where the loop began.
Alerts on an unexpected root bridge or repeated topology changes let engineers act before users notice degraded service.
Explore More IT Terms
Browse our comprehensive IT glossary to learn more about technology terminology.