STP config question

[torroba72]

Morning all,

I'm fairly new to STP and have a few questions.  Right now I have two 6509's connected via an etherchannel running PVST, core1 is the root and core2 has the designated root port list it should.  When I do packet captuers on my production internet vlan I see my workstation generating a ton of STP packets.  First should I be seeing this and second when I do a show spanning-tree vlan xx I see desktop ports listed here is this correct?  Should I not just see the ports that are connecting the switches, i.e. the forwarding port, root port and blocked ports?

Thanks,

Tim

[Edwin Summers]

Your workstation is generating STP packets?  Do you have interfaces on your workstation bridged?

Ports facing your devices should still be in the forwarding state, and are likely "designated" ports for those segments.  If you see a root port facing your workstations, you know you have something fun going on. 

Ed

[torroba72]

Well what I'm seeing when I run wireshark is the normal web traffic and when I see the STP packets the source is my switchport ID(not my laptop MAC) Cisco_aa:xx:xx and the dest is Spanning-Tree-(for-bridges)_00, the INFO is RST Root=8192/51 which is the root core1 switch with its ID listed with a cost of 0.  Should I bee seeing this in my packet captures?

[Edwin Summers]

Yes, you'll see this on your captures as the port is participating in spanning tree.  Unless you explicitly disable it (such as by turning on bpdufilter), the switch will still send bpdus.

[torroba72]

Thanks!  Is it ok to leave it like it is or turn on the bpdufilter?  I have most of my ports seutp with portfast and bpduguard enable right now.

Thanks again!

Tim

[Edwin Summers]

Portfast and bpduguard on the port would be fine.  That offers the fast transition to forwarding state and protection for when someone (intentionally or not) plugs another switch into your network.  I wouldn't enable bpdufilter unless there is a specific need for it (just because of potential switching loops that can occur when someone does something they're not supposed to....).

Good luck!

Ed

[Jan Hrnko]

Hi Tim,

 First should I be seeing this

first of all - you shouldn't see an end device like PC generating STP messages at all. You should configure the port as access port by using command:

switchport mode access

on the port where end stations are connected.

when I do a show spanning-tree vlan xx I see desktop ports listed here  is this correct?  Should I not just see the ports that are connecting  the switches, i.e. the forwarding port, root port and blocked ports?

Well you will see that every end device will be listed as Designated (Desg) and they will have forwarding status (FWD).

Best regards,

Jan