BPDU Format and STP Timers

BPDU Breakdown

Switches exchange STP information using a special frame type called Bridge Protocol Data Unit, or BPDU. A BPDU contains several fields which are compared in STP calculation. A switch uses its base MAC address as the source address for BPDU frames, and forwards them to the well-known STP multicast address 0180.C200.0000 (802.1D) or 0100.0CCC.CCCD (Cisco proprietary STP).

 Let's break down the BPDU frame format.

The BPDU frame format varies slightly depending on the type of protocol used. We'll focus on Cisco's implementation (represented in Figure A-13). For the purposes of this discussion, we'll ignore the Frame control, Routing Information field, Logical link control fields, which have specific preset values (no need to memorize them). As mentioned, the Destination address and Source address contain the STP multicast address and the base MAC address of the switch, respectively.

Now, the IEEE BPDU section encompasses the heart of STP.

When computing a loop-free Layer 2 topology, a switch simply examines the contents of the BPDU fields, as represented in Figure A-14. Let's view each field more specifically. The Protocol identifier, and Version fields are always set to 0 (for PVST+), so we'll just skip them.

Message Type (1 byte): denotes whether the frame is a Configuration or TCN BPDU (described later)

Flags (1 byte): signals the TC and TCA bits (described later)

Root ID (8 bytes): contains the root BID (2-byte priority + 6-byte MAC address)

Root Path Cost (4 bytes): indicates the sender's cost to the root switch

Bridge ID (8 bytes): represents the BID of the sender (2-byte priority +  6-byte MAC address)

Port ID (2 bytes): includes the sender's port priority + port number from which the BPDU was sent

Message Age (2 bytes): indicates the amount of time since the root sent the BPDU

Max Age (2 bytes): indicates when the current BPDU should be deleted

Hello Time (2 bytes): indicates how often BPDUs are sent

Forward Delay (2 bytes): indicates the time a switch should wait before transitioning to a new state after a topology change

There are, in fact, two types of BPDUs:
  • Configuration BPDU: "normal" BPDU, used for STP computation
  • Topology Change Notification (TCN) BPDU: used to announce changes in the topology

These two BPDUs are differentiated by the TC (Topology Change) and TCA (Topology Change Notification Acknowledgement) bits, which are marked in the Flags field. A TCN BPDU has either the TC or TCA bit set.

The Configuration BPDUs are originated by the root switch only. Non-root switches merely relay the BPDU information downstream out their designated ports. On the contrary, non-root switches can generate TCN BPDUs to signify topology changes. In short, when a topology change occurs, a non-root switch sets the TC bit in the Flags field, and forwards the TCN BPDU upstream (out the Root Port) towards the root switch. The upstream switch then acknowledges the receipt of the TCN BPDU by sending back a BPDU with the TCA bit set (the process will be described in detail in a future post).
See: Spanning Tree Protocol packet capture

STP Timers

STP uses three configurable timers to ensure that a network converges properly without creating switching loops.

Hello Timer: The time interval between sending BPDUs. The value is dictated by the root switch, because only the root switch originates Configuration BPDUs. The default is 2 seconds (range 1-10 seconds). However, all switches have a local Hello interval which is used to time the (re)transmission of TCN BPDUs.

Forward Delay: The time interval that a port spends in the Listening and Learning states. The default value is 15 seconds (range 4-30 seconds).

Max Age: The time interval that a switch stores a BPDU before discarding it. Each port keeps a copy of the "best" BPDU it has learned. If the port no longer receives the BPDUs after the Max Age time has elapsed, the switch assumes that a topology change must have occurred, and the BPDU is aged out. The default Max Age value is 20 seconds (range 6-40 seconds).

The timers should never be changed from their default values without careful consideration. The default STP timer values are derived from a reference model of a network having a diameter of seven switches. It is recommended that the diameter is adjusted to accurately reflect the actual network size, instead of modifying each timer individually. When the diameter is changed, the switch automatically calculates new values for all three timers.

Message Age: There is another time-related parameter: Message Age. Unlike the three timers, Message Age is not a fixed value. The Message Age field contains the time that has passed since the root switch initially originated the BPDU. The root switch sends all its BPDUs with a Message Age of 0, and all subsequent switches add 1 to the value. Effectively, the Message Age tells the switch how far he is from the root switch. The remaining lifetime of a BPDU after being received by a switch is MaxAge-MessageAge.


CCNP Exam Prep: Traditional Spanning Tree Protocol
Frame Formats
Understanding and Tuning Spanning Tree Protocol Timers