The “Spanning Tree port roles” lesson covered the roles a port can have: root, designated, alternate or disabled. But a port doesn't start its role straight away. First it goes through a few states. It only starts forwarding when STP is sure it is safe.
Why ports can't forward straight away
Reason 1: building the tree takes time. Choosing a root, comparing costs and choosing roles all happen through BPDUs. This takes several seconds. If ports forwarded during that time, a broadcast could loop before STP had chosen which ports to block:
- 1. The switches are still agreeing on a root… No port is blocked yet.
- 2. …when PC A sends a broadcast. If every port were already forwarding…
- 3. …it would loop. Even a few seconds of looping can overload the switches and upset the network. Port states stop this from happening.
Reason 2: news travels slowly. BPDUs need time to reach every switch. After a change, some switches still have old information for a while. So STP waits until the newest BPDUs have reached every switch before a port forwards. These waiting times were chosen in the 1980s, for much slower networks. That's why they are so long.
The states
| State | Type | Forwards frames | Learns MACs | BPDUs | Duration |
|---|---|---|---|---|---|
| Blocking | Stable | No | No | Receives only | up to 20 s |
| Listening | Transitional | No | No | Sends & receives | 15 s |
| Learning | Transitional | No | Yes | Sends & receives | 15 s |
| Forwarding | Stable | Yes | Yes | Sends & receives | — |
| Disabled | Stable | No | No | None | Until no shutdown |
- Disabled: turned off with the shutdown command. It takes no part in STP.
- Blocking: forwards nothing. It only listens to BPDUs. A port that STP has decided to block (alternate) stays in this state.
- Listening: the port has been chosen to become a root or designated port. It sends and receives BPDUs to check the tree. It still forwards nothing and learns nothing.
- Learning: still forwards nothing, but starts filling the MAC table. Then, when it starts forwarding, it doesn't have to flood every frame.
- Forwarding: normal work: it forwards frames, sends BPDUs and learns MAC addresses.
💡 Moving a port to blocking happens at once, because stopping traffic can never create a loop. Only the move toward forwarding is slow.
Watch a switch boot through the states
Situation: SW3 in the triangle is restarted. As soon as it's up, you check its ports (classic STP). The outputs below were written to show the order of events:
SW3#show spanning-tree vlan 1 ! about 1 second after boot VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 24577 Address 0200.0000.0001 Cost 4 Port 1 (GigabitEthernet1/0/1) ... Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root LIS 4 128.1 P2p Gi1/0/2 Altn BLK 4 128.2 P2p Gi1/0/10 Desg LIS 4 128.10 P2p
SW3#show spanning-tree vlan 1 ! 15 seconds later Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root LRN 4 128.1 P2p Gi1/0/2 Altn BLK 4 128.2 P2p Gi1/0/10 Desg LRN 4 128.10 P2p
SW3#show mac address-table Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 1 0200.0000.0001 DYNAMIC Gi1/0/1 1 0200.0000.00a1 DYNAMIC Gi1/0/1 1 0200.0000.00b1 DYNAMIC Gi1/0/10
SW3#show spanning-tree vlan 1 ! 30 seconds after boot Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root FWD 4 128.1 P2p Gi1/0/2 Altn BLK 4 128.2 P2p Gi1/0/10 Desg FWD 4 128.10 P2p
The three timers
| Timer | Default | What it controls |
|---|---|---|
| Hello | 2 s | How often the root sends BPDUs. Other switches pass them on out of their designated ports. |
| Max age | 20 s (10 hellos) | How long a switch keeps the last good BPDU from a port if no new one arrives. After that, it throws it away. |
| Forward delay | 15 s | Time spent in listening, and again in learning |
Missing one or two hellos is fine. The switch keeps using what it knows. But when max age passes with no new BPDU, it throws away that information and works everything out again: who the root is, which port is its root port, and which ports are designated.
Only the root bridge's timers matter. They are sent in its BPDUs, and every switch uses them. The default values suit a network up to 7 switches across. Only change them on the root, and keep them in step with each other. The spanning-tree vlan 1 root primary diameter option works out matching values for you.
Convergence times
| Situation | Waits for | Total |
|---|---|---|
| A new port, or a direct failure (the switch's own root port goes down) | Listening 15 + learning 15 | ~30 s |
| Indirect failure (a link somewhere else fails, and BPDUs just stop arriving) | Max age 20 + listening 15 + learning 15 | ~50 s |
The next lesson shows an indirect failure step by step. PortFast (the “PortFast” lesson) removes the wait for end devices. RSTP (the Rapid Spanning Tree lessons) replaces the timers with a quick handshake between switches.
Check yourself
In which state does a port learn MAC addresses but still not forward frames?
Right after a reload, show spanning-tree shows one port as 'Altn BLK'. Did it pass through listening and learning?
A switch stops receiving BPDUs on its root port because a link two hops away failed. Roughly how long until an alternative port forwards (classic STP)?