Elect a root and choose a path
Switches exchange Bridge Protocol Data Units (BPDUs) to agree on the topology. The switch with the lowest bridge ID becomes the root bridge. Each other switch selects a root port toward it, starting with the lowest total path cost. Each LAN segment also selects a designated port to forward traffic toward and away from the root.
A redundant port that would create a loop stays blocked for user traffic. Classic STP uses listening and learning before a selected port starts forwarding. During listening the port participates in STP. During learning it can learn source MAC addresses before forwarding frames.
BPDU and loop protections
BPDU Guard shuts down a guarded port that receives a BPDU. It is useful where a host is expected and a switch should not join the topology. BPDU Filter suppresses BPDU exchange. On Cisco switches, an explicit interface filter can prevent both sending and receiving BPDUs. A global PortFast filter behaves differently and can stop filtering when a BPDU arrives.
Root Guard blocks a protected port if it receives a superior BPDU that would make that port a path toward the root. Loop Guard protects a different case. If a root or alternate port stops receiving expected BPDUs while the physical link stays up, it holds the port out of forwarding instead of letting it become designated.
Try it in a lab
- In a three-switch triangle, configure one switch with the lowest bridge priority. Verify that it is the root and that one end of the redundant path is blocked for the chosen VLAN.
- Disconnect a forwarding link. Watch the redundant path take over after convergence, then compare the new port roles with the baseline.
- On a separate host-facing test port with BPDU Guard enabled, connect a switch that sends BPDUs. Check for the guard action on that port and compare it with the ordinary STP block in the triangle.