The “The Spanning Tree Algorithm” lesson covered step 1: choosing the root. This lesson covers the next three steps: root ports, designated ports, and blocking the ports that are left.
| Role | Short | Rule | Forwards? |
|---|---|---|---|
| Root port | RP | On every switch except the root, the port with the best path to the root | Yes |
| Designated port | DP | On each link, the end with the best path to the root | Yes |
| Non-designated / alternate | BLK / ALT | Any other port | No |
| Disabled | — | Turned off with the shutdown command | No |
Step 2: each switch picks one root port
Every switch except the root asks: which of my ports is the cheapest way to reach the root? It looks at the BPDUs that arrive on each port. It takes the cost written in the BPDU and adds the cost of its own port.
- 1. SW2, option 1: the BPDU from SW1 says cost 0. SW2 adds its port cost (4). So the direct link costs 4.
- 2. SW2, option 2: SW3's BPDU says cost 4. Adding SW2's port cost makes 8. 4 is less than 8, so the direct port is SW2's root port.
- 3. SW3 does the same: 4 directly, or 8 through SW2. So its direct link is its root port too.
SW2#show spanning-tree root Root Hello Max Fwd Vlan Root ID Cost Time Age Dly Root Port ---------------- -------------------- --------- ----- --- --- ------------ VLAN0001 24577 0200.0000.0001 4 2 20 15 Gi1/0/1
When two paths cost the same
The switch goes down this list until it finds a difference:
- Lowest root path cost.
- Lowest sender bridge ID: the BPDU from the better neighbour switch wins.
- Lowest sender port priority (default 128). This only matters when there are several links to the same neighbour.
- Lowest sender port number.
Notice the word sender in rules 2–4. The switch looks at the neighbour's port at the other end of the cable, not at its own port numbers.
Step 3: one designated port per segment
After step 2, every switch has a root port that leads to the root. The root sends BPDUs. Each switch receives them on its root port and passes them on out of its other ports. At first, a switch treats every other port as designated. It can't tell whether a PC or another switch is at the other end.
The clue: the root's BPDUs should only arrive on a root port. If a switch hears them on a port it thought was designated, that port leads to another switch over a spare link. That means there is a loop. The two ends of that link compare, and only one can stay designated.
- 1. Both hear BPDUs on their non-root port. SW2 and SW3 each send the root's BPDUs out of their port on the SW2–SW3 link. Each one receives the other's BPDUs. So that link is a spare path.
- 2. Compare root path cost. Both are 4 away from the root. It's a tie.
- 3. Compare sender bridge ID. The priority is the same, and SW2's MAC is lower. So SW2's port wins and stays designated. SW3's port becomes alternate and blocks.
The designated port is chosen in the same way:
- Lowest root path cost of the switch on each end.
- Lowest bridge ID of the switch on each end.
- Lowest port priority, then port number, of the port on each end.
SW3#show spanning-tree vlan 1 Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root FWD 4 128.1 P2p Gi1/0/2 Altn BLK 4 128.2 P2p Gi1/0/10 Desg FWD 4 128.10 P2p
Step 4: block the rest
- 1. Loop-free: the cables still form a triangle, but traffic between SW2 and SW3 goes through SW1. The SW2–SW3 link waits as a backup.
An alternate port is a second path to the root. It is not used because another path is better. It stays blocked. If the root port fails, the alternate port takes over.
What "segment" means
STP says "one designated port per segment", not per link. This is because STP was designed when several devices could share one segment through a hub. Today almost every segment is a single cable between two devices. So a link can only have three role combinations:
| One end | Other end | Typical example |
|---|---|---|
| Designated | Root port | Every link that's part of the tree |
| Designated | Blocked (alternate) | A redundant link |
| Designated | An end device (it doesn't run STP) | Ports to PCs, printers, servers |
There is always exactly one designated port on each segment. On an old hub segment, the other switches could each have a root port or a blocked port there. But there was still only one designated port.
Worked example: four switches in a square
All four switches have priority 32768. Every link is 1 Gbps (cost 4). The MAC addresses are: A …0A, B …0B, C …0C, D …0D.
- 1. Root and its ports. A has the lowest bridge ID (…0A), so it's the root. All its ports are designated.
- 2. Root ports for B and C: each one reaches A directly, at cost 4.
- 3. D has a tie: cost 8 through B, and cost 8 through C. The lower sender bridge ID wins, which is B (…0B). So D's root port faces B.
- 4. The C–D link: C is 4 from the root and D is 8. So C's end is designated and D's end blocks. The blocked port ends up on the switch furthest from the root.
Rules of thumb
- The root has no root port. All its ports are designated.
- Every other switch has exactly one root port.
- Every link has exactly one designated port.
- A designated port sends the root's BPDUs. A root port receives them.
- Blocked ports end up as far from the root as possible. That's why the root is usually a core or distribution switch.
Check yourself
How many root ports does the root bridge have?
A switch receives the root's configuration BPDUs on a port it believed was designated. What does that tell it?
In the square, B's priority is changed to 61440. Which port does D block?