Ethernet frames have no TTL. Connect two switches with two cables without STP and a single broadcast will circulate — and be re-flooded — forever, doubling at every switch until the network dies. This is a broadcast storm, and with it comes MAC table instability, as the same source MAC flaps between ports. Redundant links are essential for resilience, so a protocol must exist to keep the redundancy while logically breaking the loop. That protocol is Spanning Tree.
The election: one root bridge, one tree
Every switch has a bridge ID: a 2-byte priority (default 32768, plus the VLAN number in Cisco's per-VLAN version) followed by its MAC address. Switches exchange Bridge Protocol Data Units (BPDUs) every 2 seconds, and the switch with the lowest bridge ID becomes the root bridge. Because a lower MAC wins any priority tie, an unconfigured network elects its oldest switch — which is why you always set the priority manually on your intended root.
Switch(config)# spanning-tree vlan 10 root primary! or explicitly:Switch(config)# spanning-tree vlan 10 priority 4096
Port roles: how the tree is pruned
Each non-root switch computes its cheapest path to the root using cumulative port costs (lower is better; cost scales inversely with bandwidth). From that computation come the port roles:
- Root port — the one port on each non-root switch with the lowest cost to the root bridge. Ties break on neighbour bridge ID, then neighbour port ID.
- Designated port — on every segment, the port belonging to the switch with the lowest cost to the root; it forwards traffic for that segment. All ports on the root bridge are designated.
- Blocked (alternate) port — every remaining port. It still receives BPDUs but sends nothing and forwards nothing; this is the port that breaks the loop.
802.1D states and why convergence took 50 seconds
Classic STP moves a port through blocking (20s max-age wait after losing BPDUs), listening (15s forward delay, participating in the election), and learning (15s, populating the MAC table) before finally forwarding. That deliberate slowness — up to 50 seconds — existed to guarantee the old topology information had died out before a new path opened. On a 1998 network it was tolerable; on a modern one it is an outage.
Rapid STP (802.1w): the modern default
RSTP keeps the same election logic but makes convergence event-driven. Ports are discarding, learning or forwarding; edge ports (Cisco PortFast) jump straight to forwarding because no switch lives behind them; and point-to-point links converge through an explicit proposal/agreement handshake between switches instead of timers. A properly designed RSTP network reconverges in well under a second after a link failure. Cisco's default is Rapid-PVST+, running one RSTP instance per VLAN, which also lets you balance load by giving different VLANs different roots.
Two guard rails belong on every access port: PortFast, so hosts do not wait through convergence, and BPDU Guard, which err-disables the port if a switch ever appears on it — closing the door on accidental loops through desk switches.
Switch(config)# spanning-tree mode rapid-pvstSwitch(config)# interface range gi1/0/1 - 40Switch(config-if-range)# spanning-tree portfastSwitch(config-if-range)# spanning-tree bpduguard enable
Verify with show spanning-tree vlan 10: confirm the root bridge is the switch you chose, root ports face the root, and exactly the links you expect are blocking. If the root is wrong, everything downstream of that election — port roles, traffic paths, failover behaviour — is wrong with it.