Troubleshooting spanning tree, its limitations and the alternatives (including FlexLinks)

Symptoms of a spanning tree problem

• A loop: link lights flashing constantly, interfaces at 100 percent with broadcasts and multicasts, switch CPU very high, log messages about MAC addresses flapping between ports, and the whole VLAN slow or unreachable.
• A bad root: everything works, but traffic crosses an access switch or a slow link because the wrong switch is root.
• Frequent topology changes: short slowdowns and extra flooding, often caused by host ports without PortFast or a flapping link.
• Ports in inconsistent states: some VLANs work and others do not on a link, caused by a guard feature or a native VLAN mismatch.

A step-by-step method

1. Stop the damage. In a live storm, shut one of the redundant links or disconnect the suspect device. You may need the console because management access will be slow.
2. Find the root. show spanning-tree root on several switches; they should all name the same bridge ID for each VLAN, and it should be the switch you intended.
3. Trace the tree. show spanning-tree vlan 10 on each switch, following root ports towards the root. Compare roles, states and costs with your design drawing.
4. Look for flapping and changes. show spanning-tree detail | include ieee|occurr|from|is exec shows topology change counts and the port the last change came from. Logs show MAC flapping and err-disabled ports.
5. Check the guards. show spanning-tree inconsistentports lists ports blocked by Root Guard, Loop Guard or type inconsistencies, and show interfaces status err-disabled lists BPDU Guard and UDLD shutdowns.
6. Fix the cause, such as a unidirectional fibre, a duplex mismatch causing lost BPDUs, BPDU Filter on the wrong port, or an unmanaged switch looping two ports.

Avoid debug spanning-tree on a busy production switch except for short, targeted checks.

The built-in limitations of spanning tree

• Wasted links: redundant links are blocked, so you pay for bandwidth you cannot use (PVST+ and MST help only by sharing per VLAN).
• Convergence: classic STP takes 30 to 50 seconds; RSTP is much faster but still not instant in every case.
• Fail-open behaviour: when BPDUs are lost, ports tend to start forwarding. A software fault, overloaded CPU or one-way link can therefore create a loop.
• No TTL in Ethernet: unlike IP packets, looping frames never expire, so a loop can take down a whole Layer 2 domain within seconds.
• Scale: large Layer 2 domains with many VLANs mean many instances and wide failure areas.

Alternatives and FlexLinks

Most modern designs keep spanning tree running as a safety net but avoid relying on it:

• EtherChannel and multichassis EtherChannel, with stacks, StackWise Virtual or vPC, so redundant links are bundled rather than blocked (see switch virtualisation).
• Routed access: routing (OSPF or EIGRP) between access and distribution switches, keeping each VLAN within one access switch, so there are no Layer 2 loops to block.
• Fabrics such as EVPN-VXLAN in data centres and campus fabrics, which carry Layer 2 over a routed underlay.

FlexLinks was a Cisco feature for access switches with two uplinks. One interface was configured as the backup of another; spanning tree was disabled on the pair and the backup took over in a fraction of a second if the primary failed.

! legacy example
interface GigabitEthernet0/1
 switchport backup interface GigabitEthernet0/2

FlexLinks is legacy and is not supported on many current switch families. Because it turns spanning tree off on the uplinks, a cabling mistake could cause a loop. Use EtherChannel to a virtual switch pair or RSTP instead.

Real-world example: at a busy veterinary practice, all phones and PCs froze after a cleaner reconnected a loose cable. The external engineer found MAC flapping messages on the main switch, disconnected a small unmanaged switch under the reception desk, and service returned. Both ends of a patch lead had been plugged into the unmanaged switch, forming a loop that the main switch could not see because its port had BPDU Filter configured on the interface. Replacing BPDU Filter with BPDU Guard means the same mistake now shuts only that port.