Why layer 2 loops are deadly

Redundancy: a good idea with a dangerous side effect

If two floor switches each connect to the core with only one cable, one cut cable or one dead port cuts off a whole floor. So network designers add redundancy: extra links, so there is always a second path. In a typical campus, each access switch has two uplinks, one to each of two distribution switches.

The problem is that redundant links form loops: a path that leaves a switch and comes back to it through other switches. At layer 3 (routing) loops are annoying but survivable. At layer 2 (switching) a loop can take down the entire network in seconds.

Reason 1: Ethernet frames have no TTL

An IP packet carries a TTL (time to live) field. Each router reduces it by 1, and when it reaches 0 the packet is thrown away. A routing loop therefore dies out on its own. An Ethernet frame header has nothing like this: a switch can forward the same frame forever, and nothing in the frame ever says "stop".

Reason 2: broadcast storms

Take three switches in a triangle: SW1, SW2 and SW3, each connected to the other two. A PC on SW1 sends one ARP broadcast. SW1 floods it out of every port except the one it came in on, so one copy goes to SW2 and one to SW3. SW2 floods its copy to SW3, and SW3 floods its copy to SW2. Those copies go on to SW1, which floods them again... Every switch keeps copying every broadcast out of every port. Within seconds the links are full, switch CPUs hit 100% and nothing else gets through. This is a broadcast storm.

Reason 3: MAC address table instability

A switch learns where a device lives by looking at the source MAC address of each frame. In a loop, copies of the same frame arrive on different ports, one after another. The switch keeps changing its mind: "PC A is on Gi0/1... no, on Gi0/2... no, on Gi0/1". This is called MAC flapping. Cisco switches log messages such as "Host 0050.7966.6800 in vlan 10 is flapping between port Gi0/1 and port Gi0/2", which is a strong hint that a loop exists.

Reason 4: duplicate frames

A frame for an unknown destination is flooded, just like a broadcast. With a loop, the destination can receive two or more copies of the same frame by different paths. Some applications cope with duplicates; many do not.

The fix: the Spanning Tree Protocol

The Spanning Tree Protocol (STP), standardised as IEEE 802.1D and based on an algorithm designed by Radia Perlman in the 1980s, keeps the redundant cables but logically turns some ports off. Switches exchange small messages called BPDUs (Bridge Protocol Data Units). Using them, they pick one switch as the centre of the network, the root bridge, then work out the best path from every switch to the root, and put every other port that would close a loop into a blocking state. A blocked port is still up and still listens to BPDUs, but it does not forward user frames.

The result is a tree: exactly one active path between any two switches, so no loops. If an active link fails, the switches notice that BPDUs stop arriving or the link goes down, recalculate, and move a blocked port to forwarding. You get the safety of redundancy without the storm.

STP is on by default on Cisco switches. You almost never turn it off; you tune it. The next topics show how the root is elected, how ports change state, how faster versions (RSTP) work and how to protect the tree.