The other day I found an Avaya phone plugged into the switch twice, so causing a loop in the network. I got some suggestions from people here as to how to go about tracking this offending device down. The advice really helped and saved me a lot of grief.
The key point for me was noticing that when I ran "show spanning-tree detail" I saw a fastethernet port incorrectly receiving bpdu's. However when I reran the command a few minutes later the same port showed no bpdu's received. As far as a I know a normal access port should not receive bpdu's only a trunk connected to another switch. On this occassion I got lucky and I saw the bpdu but I could equally have seen the output when it stated no bpdu's received. My questions are:
1) What other way could I have gone to find the same information? If there is another way. Or is it just a case of keep re-running the "show spann detail" command until I get lucky and see a port receive a bpdu.
2) Why does the counter relating to number of bpdu's received in the "show spann de" command get reset to "0"?
I am guessing that one or both of the ports became errdisabled. Maybe one or both of the ports had bpduguard. In that case, one port will errdisable itself, while the other ... well the other will stay up because it is on the other side of the telephone's internal switch. It may be this errdisabling that clears the counter.
It is possible to configure your switch so that it recovers from the errdsable state after a certain time. Is that the case with your switch?
show errdisable recovery will tell you if there are any errdisabled ports waiting to recover. A show int status will show you generally if you have any ports currently errdisabled.
I would put bpduguard on all ports that could connect to these phones. The phones with internal switches are just asking to be plugged in twice. If the installer does not do it by accident, the user will sooner or later. These phones generally do not run Spanning-Tree, and do not generate BPDUs.
BTW, an access port can still receive BPDUs if it happens to be connected to another switch running Spanning-Tree. It does not necessarily have to be a trunk.