Spanning tree under the hood: BPDUs, timers, topology changes and reconvergence
In short: Classic spanning tree relies on BPDUs and three timers: hello (2 s), max age (20 s) and forward delay (15 s). When a port changes state, a TCN BPDU travels to the root, which then makes every switch age MAC entries quickly. A direct link failure takes about 30 seconds to recover, an indirect one about 50. UplinkFast and BackboneFast shortened this before RSTP built the same ideas in.
What a BPDU carries
Switches running spanning tree exchange bridge protocol data units (BPDUs). A configuration BPDU holds the root bridge ID the sender believes in, its cost to reach that root, its own bridge ID and port ID, a flags field and three timers. Comparing these values lets every switch elect the root, choose its root port and decide which ports are designated, as described in Spanning tree in practice.
| Timer | Default | Meaning |
|---|---|---|
| Hello | 2 seconds | How often the root sends configuration BPDUs. |
| Max age | 20 seconds | How long a switch keeps stored BPDU information without hearing it refreshed. |
| Forward delay | 15 seconds | Time spent in each of the listening and learning states. |
In classic IEEE 802.1D spanning tree only the root creates configuration BPDUs. Other switches receive them on their root port and send updated copies out of their designated ports. The timers are always taken from the root, so change them only on the root bridge, if at all.
Topology Change Notification
When the tree changes, MAC address tables can point the wrong way. Normal aging takes five minutes, which is far too long. Spanning tree therefore has a topology change process.
- A switch notices a port moving to forwarding, or a forwarding port going down.
- It sends a TCN BPDU out of its root port, repeating every hello time until the upstream switch replies with the TCA (acknowledgement) flag.
- Each upstream switch relays the TCN towards the root in the same way.
- The root sets the TC flag in its configuration BPDUs for max age plus forward delay (35 seconds by default).
- Every switch that sees the TC flag shortens its MAC aging time to the forward delay (15 seconds), so stale entries disappear quickly.
Ports configured with PortFast do not trigger topology changes when they go up or down. Without PortFast, every PC switched on or off in the morning would cause network-wide MAC flushing and extra flooding. show spanning-tree detail shows how many topology changes have happened and from which port the last one came.
Reconvergence: direct and indirect failures
How long recovery takes depends on whether the failed link is directly connected:
- Direct failure: a switch's own root port goes down. It immediately chooses its best alternative port, which must still pass through listening and learning: 15 + 15 = about 30 seconds.
- Indirect failure: a link further upstream fails. The switch does not see the link go down; it just stops receiving BPDUs, or receives worse ones, on its root port. It must wait for the stored information to age out (max age, 20 seconds) before it can choose another port, then listen and learn: about 50 seconds.
Users notice outages this long, which is why classic spanning tree has been replaced by Rapid Spanning Tree on almost every modern network.
UplinkFast and BackboneFast (legacy)
Before RSTP, Cisco added two features to shorten these times. Both are now legacy, because RSTP includes equivalent behaviour automatically, but you may still meet them on older networks.
- UplinkFast, for access switches: if the root port fails, a blocked uplink moves straight to forwarding in a few seconds. The switch then sends dummy frames with the MAC addresses of its hosts, so upstream switches update their tables. Enabling it also raises the switch priority and port costs so it does not become a transit or root switch.
- BackboneFast, for all switches: when a switch receives an inferior BPDU (a sign of an indirect failure), it sends a root link query to check whether the root is still reachable. If it can confirm quickly, it skips the 20-second max age wait, cutting recovery to about 30 seconds.
! legacy 802.1D networks only
spanning-tree uplinkfast
spanning-tree backbonefastReal-world example: the morning flood
A call centre's network slowed briefly many times every morning. show spanning-tree detail on the core showed hundreds of topology changes, the last one from an access switch port. None of the 200 desk ports had PortFast, so every agent's PC starting up caused a topology change and network-wide flushing of MAC tables. The team enabled PortFast and BPDU Guard on all desk ports and moved to Rapid PVST+. Topology changes dropped to a handful a week, and the morning slowdowns stopped.
Practice
What are the default hello, max age and forward delay values?
Why does an indirect failure take about 50 seconds to recover in classic STP?
Why should edge ports use PortFast in terms of topology changes?
Key takeaways
- BPDUs carry root ID, root path cost, sender bridge ID, port ID, flags and timers.
- The root originates BPDUs in 802.1D; timers always come from the root.
- TCN BPDUs travel to the root, which sets the TC flag so switches age MAC entries in 15 seconds.
- Direct failures take about 30 seconds and indirect failures about 50 seconds in classic STP.
- UplinkFast and BackboneFast are legacy fixes now built into RSTP.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.