Spanning tree: what it protects you from

Spanning tree has a reputation for being fussy and slow, and engineers disable it more often than they should. It is worth understanding exactly what it prevents, because the failure it prevents is not gradual.

Why a loop is catastrophic

An IP packet has a TTL that decrements at each hop, so a routing loop eventually kills the packet. An Ethernet frame has no such field. A broadcast frame entering a loop is forwarded forever, and every switch in the loop duplicates it out every other port. Within seconds the loop is saturated, MAC address tables are thrashing as the same address appears on different ports, and the segment is unusable. Not slow. Unusable.

What spanning tree does

It finds redundant paths and blocks them, leaving exactly one active path between any two points. When a link fails, a blocked port is unblocked. You keep the physical redundancy without the loop.

The parts that matter operationally

The root bridge is elected by lowest priority, then lowest MAC. Left to itself the election picks the oldest switch in the building, which is rarely where you want your traffic converging. Set the root deliberately.

spanning-tree vlan 1-100 root primary
show spanning-tree root
show spanning-tree blockedports

Use rapid spanning tree, which converges in seconds rather than the classic fifty. Enable portfast on access ports so hosts do not wait through the listening and learning states, and pair it with BPDU guard so that if a switch appears on a port that should have a host, the port shuts rather than rearranging your topology.

The discipline

Know where your root is. Know which ports are blocking. When someone reports that the network “went down for everyone at once and came back”, a loop is the first thing to check, and the switch logs will have recorded the topology change that caused it.