Backup links without loops: STP and EtherChannel
Lesson 1 of 4
1Backup links without loops: STP and EtherChannel
The big pictureIn the junior stage you built a network that works. In this stage you build one that does not stop. The first step is a backup link between switches. But a layer 2 frame has no time-to-live like a packet, so if it finds a circle it goes round forever and multiplies until it chokes the network. That is why the spanning tree protocol was born.
What the picture shows: Switches swap BPDU messages, agree on one root, then each works out its shortest road to it and blocks the rest. If the main road fails, the blocked one opens.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Picture three cities joined by roads in a triangle. If every city sends every message down every road, messages circle the triangle forever. The fix: the cities agree on a capital, each picks its shortest road to it, and the extra road gets a barrier that lifts only if another road collapses. That is STP. EtherChannel turns four lanes side by side into one wide road instead of closing three of them.
STP (IEEE 802.1D) elects the root bridge by the lowest Bridge ID (priority 32768 by default + VLAN number + MAC address). Each non-root switch picks one root port with the lowest cost to the root (1G = 4 and 10G = 2 in the short table), each segment has one designated port, and the rest block. Classic timers: hello every 2 s, max age 20, forward delay 15, so convergence can take 30 to 50 s. RSTP (802.1w) converges in under two seconds on point-to-point links with proposal and agreement, with roles Root, Designated, Alternate and Backup. EtherChannel bundles up to 8 active links with LACP (IEEE 802.1AX) in active or passive mode, and spreads load per flow with a hash, so one flow never beats one cable's speed.
Before You Start
🔀Switching and VLANs
You know how a switch learns addresses and what a trunk is.
🏢The office network project
You built a small network in Packet Tracer.
The Core Idea
1Why does a loop kill the network?
A switch floods any broadcast frame out of every port. In a triangle the broadcast arrives from both sides and is sent on again, doubling every fraction of a second. Within seconds there is a broadcast storm eating the bandwidth, MAC tables flapping between ports, and everything stops. The cause is that the Ethernet header has no TTL to kill a frame after a number of hops, unlike IP.
2Electing the root and the port roles
Three steps in order: (1) the root is the lowest Bridge ID. (2) Every other switch picks its root port: the lowest total cost to the root. (3) On each link one designated port is chosen to send towards whoever is further from the root. Any port left without a role blocks. Do not leave the election to chance: make your strongest core switch the root with priority 4096, and the backup 8192.
Change CORE1's priority to 32768 and run: who becomes root now? That is exactly what happens when you forget to set the priority.
import heapq
# switch -> (priority, MAC); links are (a, b, cost): 1G = 4, 10G = 2
bridges = {"CORE1": (4096, "00aa"), "DIST1": (32768, "00b1"), "DIST2": (32768, "00b2"),
"ACC1": (32768, "00c1"), "ACC2": (32768, "00c2")}
links = [("CORE1", "DIST1", 2), ("CORE1", "DIST2", 2), ("DIST1", "DIST2", 2),
("DIST1", "ACC1", 4), ("DIST1", "ACC2", 4), ("DIST2", "ACC2", 4)]
root = min(bridges, key=lambda s: bridges[s]) # lowest priority, then lowest MAC
cost = {root: 0}
via = {}
queue = [(0, root)]
while queue:
c, here = heapq.heappop(queue)
for a, b, w in links:
if here in (a, b):
there = b if here == a else a
if c + w < cost.get(there, 99):
cost[there], via[there] = c + w, here
heapq.heappush(queue, (c + w, there))
print("root bridge:", root)
for sw in bridges:
if sw != root:
print(f"{sw:<6} root port towards {via[sw]:<6} cost {cost[sw]}")
used = {frozenset((sw, up)) for sw, up in via.items()}
for a, b, _ in links:
if frozenset((a, b)) not in used:
print("blocked link:", a, "-", b)3RSTP and guarding device ports
Classic STP waits up to 50 seconds before opening the backup road, an age for a voice call. RSTP knows the alternate port in advance and switches to it at once when the root port drops. On end-device ports (PCs and printers) turn on PortFast so the port forwards immediately, and BPDU Guard to shut it down if a BPDU arrives, meaning someone plugged a switch in where a PC should be.
! on the core switch that must be root for VLANs 10 and 20 spanning-tree mode rapid-pvst spanning-tree vlan 10,20 priority 4096 ! on every access port facing a PC interface range gi1/0/1 - 44 spanning-tree portfast spanning-tree bpduguard enable
4EtherChannel: four cables acting as one
If you join two switches with two cables, STP blocks one. EtherChannel makes both cables one logical link, so STP sees no loop, both carry traffic, and if one fails the other carries on without a recalculation. The standard negotiation protocol is LACP: at least one side active. The condition: every cable has the same speed, duplex and VLANs.
interface range te1/1/1 - 2 channel-group 1 mode active ! LACP interface port-channel 1 switchport mode trunk switchport trunk allowed vlan 10,20,99 ! check: show etherchannel summary -> flags (SU) and (P) on each member
Worked example
The task: a morning complaint: "the network is crawling on the third floor and the switch lights are flashing like mad". What do you suspect first, and what do you check?
The answer: every port flashing at once plus slowness everywhere points to a loop and a broadcast storm. Check show spanning-tree to see who is root and whether it changed, show interfaces counters for the swollen broadcasts, and the switch log for "MAC flapping". The quick fix: unplug the suspect port. The lasting one: BPDU Guard on every office port and a root fixed by priority.
Myth vs Reality
| Myth | Reality |
|---|---|
| STP slows the network, so it is better turned off. | STP does not slow normal traffic. Turning it off means the first wrong cable takes the whole network down. |
| EtherChannel doubles every connection's speed. | It doubles total capacity, but each flow stays on one cable. |
| The newest switch becomes root automatically. | Often the opposite: with equal priority the lowest MAC wins, which may be the oldest switch in the storeroom. |
Where you meet it at work
🏢Campus network
Two links from every access switch to the distribution pair, with RSTP guarding against loops.
🖥️Server room
A server connects to two switches over LACP so it keeps going if one fails.
🚨Help desk
The first question when everything is slow: did the root change?
Test your understanding
Which switch becomes the root bridge?
Bridge ID = priority then MAC, and the lowest wins.
Why do frames circle a loop forever?
An IP packet dies when its TTL hits zero; a frame has nothing like that.
A port connects to a staff PC. What is the right setting?
PortFast brings it up at once, and BPDU Guard protects you if a switch is plugged in instead.
An LACP channel of four 1G cables. What is the top speed for copying one big file?
A single flow is hashed onto one cable.
What is RSTP's key advantage over classic STP?
The alternate port is worked out in advance, so it takes over at once.
Quick review cards
Check Your Understanding
Why make the core switch the root instead of letting the election happen by itself?
Because the root is the centre of every road; if a weak access switch became root, the whole network's traffic would pass through it.
Two cables between two switches without EtherChannel: what does STP do? And with it?
Without a channel STP blocks one. With one it sees a single link and both carry traffic.
An office port shut itself down as err-disabled. What is the likely story?
BPDU Guard saw a BPDU: someone plugged in a small switch or made a loop. Remove the cause, then bring the port back up.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.