FUNDAMENTALS · MECHANISM WALKTHROUGH

A Loop Forms
How Switches Actually Detect and Stop It

redundant cabling creates a physical loop on purpose, for resilience. this is the mechanism that keeps it from becoming a broadcast storm — root election, path cost, and exactly one blocked port.

REDUNDANT LINK ADDED→ BPDU EXCHANGE→ ROOT BRIDGE ELECTED→ ROOT PORTS CHOSEN→ DESIGNATED PORTS CHOSEN→ LOSING PORT BLOCKED→ LOGICAL TREE, NO LOOP

01 The Full Sequence — Worked Example

The Setup — Three Switches, Deliberately Redundant

SW1, SW2, and SW3 are already cabled SW1–SW2 and SW2–SW3, converged and forwarding. An engineer adds a third cable, SW3–SW1, for resilience — this closes a physical triangle. Without any loop-prevention mechanism, this would let a single frame (e.g. a broadcast) circulate the triangle endlessly, being duplicated at every hop — a broadcast storm. STP exists specifically to make sure that never happens.

Setup

BPDUs Start Flowing on the New Link

The instant SW3–SW1 comes up, both ends send BPDUs (Bridge Protocol Data Units) out that port, each announcing what it currently believes about the network: who the Root Bridge is, and the sender's own Bridge ID (priority + MAC address).

BPDU

Root Bridge Election

Every switch compares every Bridge ID it has ever heard, on every port. The single lowest Bridge ID network-wide wins outright — say SW1 was pre-configured with priority 4096 (lower than the default 32768), so SW1 becomes the Root Bridge. This isn't negotiated per-link; it's a single network-wide outcome every switch converges on independently using the same comparison.

Root Election

Each Non-Root Switch Picks Its Root Port

SW2 and SW3 each calculate their cumulative Root Path Cost to SW1 via every port they have, and designate the cheapest one as their Root Port — the single port each non-root switch uses to talk upstream. SW3 has two paths to root: directly via the new SW3–SW1 link, or indirectly via SW3–SW2–SW1. Assume the direct link wins on cost — SW3's Root Port becomes the direct SW1 link.

Root Port

Each Segment Elects One Designated Port

For every link (segment) in the topology, exactly one end is elected the Designated Port — the port responsible for forwarding onto that segment. Root Bridge ports are always Designated by definition. On the SW2–SW3 segment, whichever side is closer to root wins that role.

Designated Port

Checkpoint — Physical Loop, Logical Tree

Every port in the triangle now has exactly one role: Root Port, Designated Port, or — on precisely one port, wherever the topology has a redundant path left over — Blocking. The cable is still fully connected end to end; the switch simply never forwards a data frame out that one port. The wiring is a loop. The path traffic actually uses is a tree. That single sentence is the entire point of Spanning Tree.

Checkpoint

The Losing Port Goes to Blocking

On SW2's port toward SW3 (or wherever the redundant path lands, depending on costs), the port loses the Designated-Port election because SW3 already reaches root more cheaply direct via SW1. That port becomes Blocking: it still receives and evaluates BPDUs to keep monitoring the topology, but it forwards zero data frames and learns zero MACs — permanently, as long as the topology doesn't change.

Blocking

Steady State — Continuous Monitoring

Every switch keeps sending Hello BPDUs (every 2 seconds by default) out every port, including the blocked one. This isn't a one-time calculation — it's a live, continuously-verified agreement. If nothing changes, nothing changes: the blocked port simply keeps blocking, forever.

Steady

Failure — SW1–SW2 Link Goes Down

SW2 stops receiving BPDUs on its former Root Port. On classic 802.1D it waits up to Max Age (20s) before acting; Rapid PVST+ reacts to the link-down almost immediately. Either way, SW2 recalculates: its only remaining path to root is via SW3.

Failure

The Previously Blocked Port Takes Over

The port that was sitting in Blocking transitions toward Forwarding — through Listening/Learning again on classic STP, or via a fast proposal/agreement handshake on Rapid PVST+ — and becomes the new active path. Connectivity is restored automatically, without anyone touching a cable. This is the entire reason the redundant link was installed in the first place.

Reconverge

02 How to Explain This in an Interview

Open with "physical loop, logical tree." It's the single sentence that proves you understand what STP is actually for, before you get into any mechanism detail.
Name the three port roles precisely: Root Port (one per non-root switch, toward root), Designated Port (one per segment, forwards onto it), and the leftover port that gets Blocked. Interviewers listen for whether you know these are roles, not arbitrary states.
Explain Bridge ID = priority + MAC, and that lower always wins. Then immediately mention that priority is usually set intentionally on the intended core/root switch — leaving root election to chance (lowest MAC by default) is a real, common design mistake worth flagging unprompted.
Bring the story full circle with the failure scenario. Describing only the steady state misses the point — redundancy exists for the failover, so walk through what happens when a link actually breaks.
If time allows, mention this generalizes beyond three switches. Real branch/campus topologies often have many more redundant paths; the same election-and-block logic applies uniformly no matter how large the loop.

03 Follow-Up / Gotcha Questions

Q What breaks a tie if two switches have identical priority?

A The MAC address portion of the Bridge ID — lowest MAC wins. Since every switch has a globally unique MAC, this guarantees a deterministic, unique winner even if every switch is left at the default priority of 32768.

Q How do you force a specific switch to become the root bridge instead of leaving it to chance?

A Lower its bridge priority below every other switch's — commonly with spanning-tree vlan <id> root primary on Cisco, which sets it low enough to win, with a secondary root configured on another switch as backup. Leaving this to default priority means whichever switch happens to have the lowest MAC wins, which is rarely the switch you'd actually want at the center of the tree.

Q What's the practical difference between a Root Port and a Designated Port?

A Root Port is chosen from the perspective of a single non-root switch — "which of my ports gets me to root cheapest" — exactly one per non-root switch. Designated Port is chosen from the perspective of a segment — "which switch's port forwards onto this link" — exactly one per segment, and could be many per switch if that switch borders several segments.

Q What happens if an access switch's priority is accidentally lower than the intended core switch's?

A That access switch wins the root election unintentionally — a real and surprisingly common misconfiguration. Every other switch's path calculations now route toward that access switch instead of the core, often creating suboptimal, congested paths through hardware never meant to carry that volume of inter-switch traffic. Root Guard on the intended core-facing ports is the standard defense against this.

Q Why do blocked ports keep sending and receiving BPDUs instead of just being shut down?

A The blocking decision isn't permanent by design — it's continuously re-verified. If the port were fully shut down, the switch would have no way to detect that the primary path failed and this port should now take over. Listening for BPDUs on a blocked port is exactly what makes automatic failover possible.

Q Can a single switch accidentally create a loop entirely on its own, without a redundant link between two different switches?

A Yes — plugging both ends of one cable into two ports on the same switch creates a loop just as real as the multi-switch case. The switch will see its own BPDU return on another port and, with Loop Guard or BPDU Guard enabled on access ports, will typically error-disable the offending port rather than let the loop stand.

04 Quick-Fire Glossary

Term	Meaning
Bridge ID	Priority (default 32768) + MAC address — the value compared network-wide to elect the root bridge
Root Bridge	The single switch with the lowest Bridge ID; the reference point every path-cost calculation is relative to
Root Port	The one port per non-root switch with the lowest-cost path to the root bridge
Designated Port	The one port per network segment responsible for forwarding traffic onto that segment
Blocking Port	The remaining port on a redundant path — receives/sends BPDUs but forwards no data frames
Root Path Cost	The cumulative cost of all links from a switch back to the root bridge, used to choose the Root Port
Hello Timer	How often BPDUs are sent to continuously verify the topology — 2 seconds by default
Max Age	How long a switch waits without hearing BPDUs before assuming a path has failed — 20s on classic 802.1D
Root Guard	A port feature that refuses to let a downstream switch become root, protecting the intended topology
Loop Guard	A port feature that blocks a port rather than letting it default to forwarding if BPDUs simply stop arriving