cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1382
Views
5
Helpful
1
Replies

Spanning Tree header value

Hi all,

I am sniffing packets and I am trying to identify Spanning Tree Packets.

Do you know if there a field identifier to the STP packets/header?

Thank you,

Vasilis

1 Reply 1

Giuseppe Larosa
Hall of Fame
Hall of Fame

Hello Vasilis,

first of all, we have to note that encapsulation of PVST+ is totally different then standard IEEE 802.1D STP.

You can find very useful information about STP encapsulation and those of other protocols like CDP, DTP, VTP and so on in a document present in CCO named "best practices for IOS based switches"

see

http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00801b49a4.shtml

IEEE 802.1D encapsulation has the LLC header with SSAP= DSAP = 42 with a well known L2 MAC multicast destination of

01-80-c2-00-00-00

Cisco PVST+  uses LLC SNAP encapsulation with LLC= 0x AAAA03 + 3bytes Cisco OUI= 0x00000C+ 0x010b as HDLC 2 byte protocol type with a multicast MAC destination of

01-00-0c-cc-cc-cd

To be noted on an access port a Cisco switch should use the IEEE version of the BPDU and the proprietary version is used over trunk ports

Hope to help

Giuseppe

Edit:

I have attached the pdf version of the document

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card