- 1 STP BID and Root Bridge
- 2 Superior BPDU
- 3 Port States
- 4 BID vs RID
- 5 Spanning Tree Root Path Cost and Path Cost
- 6 Spanning Tree Q&A
- 7 Spanning Tree Protocol in Wireshark
Please read here for a brief introduction on Spanning Tree Protocol
STP BID and Root Bridge
Each BPDU contains the Bridge ID (or BID for short). The Bridge ID is composed of:
- the bridge priority
- the bridge MAC address
The default bridge priority value is 32768. When there ‘s a tie in the priority, the bridge with the lowest MAC address wins the elections and becomes the Root Bridge.
Once the Root Bridge is elected, all BPDUs are emitted only from the Root Bridge; the non-Root Bridges simply forward copies of the Root Bridge’s BPDUs.
The BPDU sent by the Root Bridge is called Superior BPDU.
A spanning tree port is in one of the following states:
- Disabled: Spanning tree protocol is disabled
When the port in the Listening or Blocking state, the switch can not learn new MAC addresses from Ethernet frames received on this port.
BID vs RID
The Root ID is the Bridge ID of the root bridge. The Bridge ID is the ID of the switch that generated the BPDU. If, in a BPDU the Root ID is equal to the Bridge ID, then the current switch is the root of the spanning tree. Otherwise, the root bridge is another switch.
Spanning Tree Root Path Cost and Path Cost
The Spanning tree Root Path Cost RPC is the cost from the root of the spanning tree to the current switch. Its value is 0 at the root bridge. It increases as Ethernet BPDU frames go down the path to the non-root bridges.
When a non-root bridge receives the superior BPDU over its Root Port, it increases the Root Path Cost by the Path Cost (aka Port Cost) value.
The table below summarizes the standard Port Cost values:
Port path cost and root path cost
– Port Path Cost = STP cost of the interface = port cost
– Root Path Cost = cumulative STP costs of interfaces along the way = Sum(port costs)
Spanning Tree Q&A
Why do we use the term “bridge” and not “switch”?
Spanning tree has been there a long time ago, even before the appearance of switches. And the terms have not evolved since then. Some people may use the “switch” term in the Spanning Tree jargon. However, most network engineers still use the old “bridge” term.
What’s the difference between a BPDU frame and a BPDU message?
None. It’s really an Ethernet frame with BPDU information in it. We simply call it a BPDU frame or a BPDU message for simplicity.
What is the purpose of a Designated Port between non-root bridges?
A Designated Port (DP) can be found on root bridges and on non-root bridges.
On root bridges, Designated Ports forwards all frames. On non-root bridges, Designated Ports allow frames to egress the interface towards the next switch, whose port will block and discard the frame, since it’s in the Blocking state.
Spanning Tree Protocol in Wireshark
Wireshark example number 1
Let’s look at a topology that involves three looped switches. In GNS3, I am using vIOS-L2 devices, which are virtual layer 2 IOS images. All switches have the default bridge priority. So it’s the bridge MAC address that will break the tie.
We’ll start all switches and see what happens in the Spanning Tree Root Bridge election. Here is the topology:
Here are the MAC addresses of the switches:
- vIOS-L2-1 (switch 1): 0000.ab6f.1700
- vIOS-L2-2 (switch 2): 0000.ab64.1700
- vIOS-L2-3 (switch 3): 0000.abbd.ce00
According to the spanning tree algorithm, each one of the switches is considered a potential root bridge. We should have at the end the switch vIOS-L2-2 as the root bridge, since it has the lowest MAC address.
In Wireshark, RID is referred to as Root Identifier and BID is referred to as Bridge Identifier.
At bootup, only Switch 1 STP frames are seen on the wire. All switches set Switch 1 as their spanning tree Root Bridge.
Switch 2 and Switch 3 receive the Ethernet BPDU frame where Switch 1 is the Root Bridge:
Switch 2 too advertises its STP frames. Its Ethernet BPDU frame reaches the other switches. They realize that Switch 2 has sent a superior BPDU. Thus, Switch 2 becomes the root bridge:
Sometimes you get a Wireshark trace where the root bridge “seems” to flap:
In reality, there is a tiny field that makes the difference: the VLAN ID field. Spanning Tree runs for each VLAN and a separate Root Bridge election occurs on each VLAN. So one switch can be the Root Bridge for VLAN 1 and another switch will be the Root Bridge for VLAN 100.