Solved: Spanning-tree wireshark question

Jason Fraioli · ‎08-04-2008

I am seeing the following lines in Wireshark, but the priority I am seeing is that of the root bridge. Does it matter that I am seeing these wireshark captures on my access switches?

27 8.367618 Cisco_0a:ff:96 Cisco_0a:ff:96 LOOP Reply

28 10.000372 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

29 12.000442 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

30 14.000520 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

31 16.000604 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

32 18.000688 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

33 18.367969 Cisco_0a:ff:96 Cisco_0a:ff:96 LOOP Reply

Francois Tallet · ‎08-04-2008

No, just because STP is running on the access ports;-) Looks perfectly normal.

Regards,

Francois

View solution in original post

massimiliano.serafino · ‎08-04-2008

Hi,

This is because spanning-tree is enabled on access port too.

In hope this helps.

Best regards.

Massimiliano.

Jason Fraioli · ‎08-04-2008

Would these captures be the result of Portfast/BPDUguard running?

Francois Tallet · ‎08-04-2008

No, just because STP is running on the access ports;-) Looks perfectly normal.

Regards,

Francois

bmbreer · ‎08-04-2008

It's normal. STP is sent via a multicast MAC address so all hosts on the network will see the STP messages assuming it's not disabled for that broadcast domain.