Spanning Tree Protocol (STP) should be enabled and functional on all networks where multiple switches and redundant network links are present.
As enterprise networks scale up, more Layer 2 network switches start to be added. These switches are often deployed across multiple floors and departments. For redundancy, many networks have redundant links between these switches, keeping connectivity functioning.
Redundant links introduce a security vulnerability called Broadcast Storms or Broadcast Loops. To understand this issue, we first need to review what switches do. When data frames arrive at a switch, it checks the destination MAC address in the frame and compares it to its MAC address table to see if there is a matching destination entry. If none is found, the switch forwards the frame out of each of its interfaces except the one the frame arrived on. These frames are called Unknown Unicast frames. The switch will eventually identify the destination to add to its MAC address table, since the recipient is bound to receive the frame if it is forwarded out of each interface. Once the proper destination is identified, it is known as Known Unicast.
Switches also send out special types of frames called Broadcast and Multicast. A broadcast frame is a frame sent from one single source to every other destination in the LAN. This is done by sending the frame to destination broadcast address FF-FF-FF-FF-FF-FF. A multicast frame is one sent from a single device to a specific group of destination devices. This is done by sending the frame to a special multicast address that begins with the bits 1110.
In redundant looped networks, a Broadcast Storm can occur when such frames loop around the redundant links indefinitely. This will eventually result in an overloading of switch resources, and can cause the entire network to crash, resulting in a loss of availability. To compensate for the necessary use of broadcast, unknown unicast, and multicast frames while preserving a redundant topology, a protocol called Spanning Tree Protocol (STP) was introduced.
STP is defined by the IEEE 802.1D standard and comes enabled by default is practically all modern switches. STP works by identifying redundant links between switches and temporarily disabling them to limit the active paths that frames can traverse. This way, the frames don’t see any redundant looped links and thus don’t create broadcast storms.
There have been several different versions of STP over the years. The original STP created a single loop free topology for the entire network regardless of VLAN structure. In complex networks, it ran into performance issues. Rapid Spanning Tree Protocol (RSTP) offered improved performance but also maintained a single STP instance for the entire network. Multiple Spanning Tree Protocol (MSTP) changed the game by allowing multiple different STP instances to be created for multiple groups of VLANs.
Cisco networking hardware is the gold standard for enterprise networking, and Cisco has introduced several proprietary versions of STP that are the most encountered versions. Per VLAN Spanning Tree Plus (PVST+) is the first proprietary version, which runs a separate STP instance for each VLAN. This is optimal for most networks, as it selects the best paths for each individual network segment rather than confining all VLANs to one version of STP. However, PVST+ can still encounter issues with slow performance. Rapid Per VLAN Spanning Tree Plus (Rapid PVST+) is Cisco’s proprietary version of the original RSTP. It combines the best of both worlds, enabling separate STP instances for each VLAN with fast performance. Rapid PVST+ is the version admins will most commonly encounter in Cisco based networks.
Any business network that uses multiple switches should ensure that STP is functioning. The more switches and redundant links employed, the more attention should be given to STP functionality. STP can be a very complex networking concept for those not well versed in the field. It is a technology that is best handled by an in-house network administrator, or a third-party contractor providing Network Operations Center (NoC) services.