Recognize loops and spanning-tree protections

What you should be able to do

Recognize a possible Layer 2 loop, interpret a protected redundant topology, and give the network administrator useful evidence without defeating the protection.

Foundation

A Layer 2 forwarding loop provides a circular path for Ethernet traffic. Repeated copies of flooded traffic can consume link and switch resources, disrupting camera, controller and other application traffic. Rapidly changing MAC-learning locations and excessive broadcast traffic can be clues, but neither symptom alone proves the cause. Legitimate mobility, configuration errors and other faults must be distinguished by the responsible administrator.

Spanning tree establishes a loop-free forwarding topology while allowing physical redundancy. In RSTP, a port's role and state are separate: an alternate role can be in the discarding state. It does not forward ordinary user data in that state, even though the physical connection is present. Spanning-tree control traffic has a separate purpose; do not interpret discarding as a cut cable.

Original Diagram

The diagram assumes a stable tree carrying VLAN 110:

• SW1 is the selected root.
• SW2 reaches the root directly through SW1.
• SW3 also reaches the root directly through SW1.
• SW2 and SW3 have an additional physical link.
• On that extra link, SW2's end is designated and SW3's end is alternate/discarding.

Those roles are supplied assumptions, not results derived from the drawing's geometry. Actual election depends on the network's bridge identifiers, priorities, path costs and tie-breakers. The drawing does not give enough information to calculate that election.

The cyan links provide the active inter-switch path. The dashed yellow link remains physically connected, but SW3's alternate port prevents it from completing a user-data forwarding loop for the illustrated tree. The circle at the SW3 end marks the nonforwarding port, not a disconnected patch cord. A different VLAN or spanning-tree instance can use different roles; always record which tree the observation belongs to.

Why A Blocked Path May Be Healthy

A trainee sees the SW2-to-SW3 link up but not forwarding the illustrated data and proposes replacing the cable. The diagram gives a different explanation: spanning tree is intentionally excluding that port from the active forwarding path. Confirm the operational role and state before identifying a physical fault.

An alternate path is useful redundancy only within a working design. If the SW3-to-SW1 link fails, the protocol can select another valid path and converge. This is not a guarantee of uninterrupted video or controller service. Detection, compatibility, topology and application recovery all matter. An acceptance test needs the owner's permitted outage window and measured results.

Portfast And Bpdu Guard

PortFast accelerates forwarding on designated endpoint-facing connections in a suitable design. It does not mean spanning tree is universally disabled. BPDU guard can place a protected port into an error-disabled condition when it receives a BPDU. The administrator must investigate why bridge-control traffic appeared where it was not expected.

An edge-port feature is not a universal setting for every camera-network port. Switch uplinks, bridging devices and specialized arrangements need the platform-specific design. A guard event is also different from an ordinary alternate port discarding state. Do not erase that distinction by calling both a bad cable.

Original Incident Exercise

At 09:10 an installer reports that several cameras intermittently disappear. At 09:08 a small switch was added near a workbench. A second patch cord may have joined that device back to the same network. These are fictional observations, not proof of a loop.

Record the affected camera names, first observed time, recent physical changes and known switch ports. Preserve logs and a topology sketch. Ask the administrator to correlate MAC moves, broadcast rates and spanning-tree changes. Do not start repeatedly rebooting equipment or pulling unidentified cables. Follow the site's incident procedure and authorized isolation direction.

If an authorized investigation establishes an unintended circular path, removing the approved identified connection is different from disabling spanning tree. Correct the cause and retain the designed protection. A production network is not a place to demonstrate loops for training.

Worked through

For each relevant switch port record: Switch and port identity; neighbor; VLAN or instance; physical link state; spanning-tree role; forwarding state; guard status; observation time; evidence source.

Fill two example rows: SW3 toward SW2 / VLAN 110 / link up / alternate / discarding / no guard event reported. SW3 toward SW1 / VLAN 110 / link up / root port / forwarding / no guard event reported.

These rows describe the fictional stable topology. Do not copy them into a real commissioning record as measured results. A screenshot or administrator-provided output should retain its device identity and timestamp.

Test Planning

A controlled redundancy test should identify the exact link, affected systems, expected alternate path, recovery criteria and rollback owner. Record application evidence before and after the approved interruption. A recorder reconnecting does not alone establish that no footage was lost. An access-control server reconnecting does not alone establish every door function. Do not conduct a failure test on life-safety or critical systems under this generic lesson.

Knowledge Check

Answers

Where beginners go wrong

Sources

Scope Limits

National networking fundamentals; specialized system and jurisdictional requirements remain separate.