Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Spanning Tree header value

Unanswered Question
May 17th, 2012
User Badges:
  • Silver, 250 points or more

Hi all,

I am sniffing packets and I am trying to identify Spanning Tree Packets.

Do you know if there a field identifier to the STP packets/header?

Thank you,


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Giuseppe Larosa Thu, 05/17/2012 - 03:57
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Vasilis,

first of all, we have to note that encapsulation of PVST+ is totally different then standard IEEE 802.1D STP.

You can find very useful information about STP encapsulation and those of other protocols like CDP, DTP, VTP and so on in a document present in CCO named "best practices for IOS based switches"



IEEE 802.1D encapsulation has the LLC header with SSAP= DSAP = 42 with a well known L2 MAC multicast destination of


Cisco PVST+  uses LLC SNAP encapsulation with LLC= 0x AAAA03 + 3bytes Cisco OUI= 0x00000C+ 0x010b as HDLC 2 byte protocol type with a multicast MAC destination of


To be noted on an access port a Cisco switch should use the IEEE version of the BPDU and the proprietary version is used over trunk ports

Hope to help



I have attached the pdf version of the document


This Discussion

Related Content