BPDU guard and filter

Unanswered Question
Sep 26th, 2007
User Badges:



BPDUguard (does prevent access switches to receive bpdu packets from other foreign switches because the port will go to be error-disable)

So far so good...


I was sniffing a switch port with the following config:

config-if>spanning-tree portfast

config-if>spanning-tree bpduguard enable

I still receive stp traffic from the switch port on my sniffer???

additional config:

config-if>spanning-tree bpdufilter enable

Than I can't sniff any stp traffic on the sniffed port.


How does it make sense that an access port just with portfast and bpduguard enabled, does send out any stp traffic if otherwise the port goes down when it receive stp (bpdu) traffic???

For me this scenario does not really make sense?

Any help are appreciated

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Pari Thiagasundaram Wed, 09/26/2007 - 13:02
User Badges:
  • Silver, 250 points or more

As you have configured bpduguard, it wouldnt receive any BPDU's.

PortFast immediately transitions the port into STP forwarding mode upon linkup. The port still participates in STP.

twarner28 Fri, 05/22/2009 - 21:51
User Badges:

Hi BPDU Guard function only prevents a port from performing STP negotiations on receipt of BPDU Packets. Portfast will just go into forwarding state upon linkup. So given the first 2 config commands it will not prevent the switch from sending BPDUs out the switch - hence sniffer getting packets.

BPDUFilter - when this is enabled. It PREVENTS bpdu's from being sent. That's why you *don't* see any frames in your sniffer.


This Discussion