Field guide · Networking & wireless
Spanning Tree and Switching Loops
What a switching loop actually does — and why it is instant and total rather than gradual — plus how spanning tree prevents it, how the root bridge gets elected, and the two port settings that turn an all-day outage into one dead port and a log line naming the culprit.
Diagram
Why one patch cord can take a whole floor down in seconds.
A second path between two switches that already had one.
Nothing is wrong yet. Two switches that already had a path to each other now have two, which is a loop — and a loop only becomes a problem when something broadcasts. Something always broadcasts.
This is usually not sabotage. It is a spare cord patched into two wall ports, or a desk switch plugged in at both ends by somebody being helpful.
Questions
Questions people actually ask
- What actually happens in a switching loop?
- A switch floods a broadcast out of every port except the one it arrived on. With a loop, that broadcast comes back, gets flooded again, and multiplies — there is no hop count on a layer-2 frame to stop it. Within seconds the links are saturated and the switches are too busy forwarding copies to process anything else. It is not gradual degradation; the network stops.
- What does spanning tree do about it?
- It builds a loop-free tree over a physically redundant topology by electing a root bridge and then blocking any port that would create a second path to it. The redundant link stays physically connected and logically shut, ready to unblock if the primary path fails. The point is that you get redundancy without a loop.
- How is the root bridge elected?
- Lowest bridge ID wins, and the bridge ID is priority followed by MAC address. Since every switch ships with the same default priority, the election falls through to MAC address — which usually means the oldest switch in the building becomes root, because older hardware tends to have lower addresses. Set the priority explicitly on the switch you want as root rather than letting the accident stand.
- What is the difference between PortFast and BPDU guard?
- PortFast skips the listening and learning states so an access port comes up immediately instead of taking around thirty seconds — without it, a PC can finish booting before its port forwards and fail to get DHCP. BPDU guard shuts the port down if a spanning-tree BPDU ever arrives on it, which is the signature of somebody plugging a switch into a desk port. They belong together on every access port: PortFast makes it fast, BPDU guard makes it safe.
- Should I use rapid spanning tree?
- Yes, on anything modern. Classic STP takes up to fifty seconds to reconverge after a topology change; rapid spanning tree does it in seconds. A switch still running legacy PVST is a finding in a handover review, and the change is usually a single command.
- How do I find the loop when it is already happening?
- Console into a switch rather than trying to reach it over the network, which will not work. Look at interface counters for the ports with impossible broadcast rates, and at the MAC address table for an address flapping between two ports — that flap is the loop's signature. Then shut ports until it stops, starting with anything patched recently.
Other guides
Related guides
- 01
Subnetting, Explained
Where the numbers come from, and the meaning behind them. - 02
The OSI Model, Layer by Layer
Seven layers, what each does, and how they hand off. - 03
Active Directory, Explained
Forests, domains, roles, and how a login really works. - 04
Writing a Switch Configuration
From factory default to a switch you would hand over. - 05
VLANs and Trunking
Access, trunk, tagged, native — and which one is the security hole. - 06
Reading a Traceroute
Which loss is real, and whose network it is in.
Book the work
We do this work
as well as document it
Anyone who has watched a network die the moment somebody patched two ports together, and anyone commissioning a switch that should survive it.
- Free guides
- No sign-up
- Nothing tracked
- Written on the job