more bpdu analysis/monitoring...

i set up a monitoring session between a 3550 and a 2960 to capture dot1d activity using wireshark... the interface of the pc is connected to g0/1 of the 2960 and set as the destination for monitoring from the g0/21 port on the 2960...the 3550 and 2960 are connected through fiber between g0/21 (2960) and g0/11 (3550)


sw2960#sh run int g0/21
Building configuration...

Current configuration : 60 bytes
!
interface GigabitEthernet0/21
switchport mode trunk
end


sw3550#sh run int g0/11
Building configuration...

Current configuration : 98 bytes
!
interface GigabitEthernet0/11
switchport trunk encapsulation dot1q
switchport mode trunk
end

nothing special there on the trunk... monitoring is set up on the 2960 as such:

sw2960#sh run
begin monitor
monitor session 1 source interface Gi0/21
monitor session 1 destination interface Gi0/1 encapsulation replicate
end

sw2960(config)#monitor session 1 source int g0/21 both

notice i used the "both" command in the argument for int g0/21... both is the default...

do sh int g0/1 to ensure that it monitors:

sw2960#sh int g0/1
GigabitEthernet0/1 is up, line protocol is down (monitoring)
Hardware is Gigabit Ethernet, address is 001e.79cd.9281 (bia 001e.79cd.9281)

then i changed the root to be vlan 1 on the 2960... let's prove it through wireshark...
 

in flags a topology change is noted...
the root identifier is now that of the 2960...
the extension id is 1 indicating vlan 1
the port identifier is is 0x8015 15hex = 21 decimal or port 21
 
sw2960#sh spann


VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 20481
Address 001e.79cd.9280
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 20481 (priority 20480 sys-id-ext 1)
Address 001e.79cd.9280
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 15

Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/21 Desg FWD 4 128.21 P2p

if you need a hex refresher go here:
http://insearchofthecert.blogspot.com/search/label/hexadecimal

switch diameter...

the ieee 802.1d standard recommends a diameter for the tree of 7 switches.  this means that any two switches should not be more than 7 hops apart...

the default hello time for the tree is 2 seconds... in other words, if the default hello time was set to 1 second (it can be from 1 to 10 seconds) the bpdu traffic for the tree would double...

knowing that bpdu's at two seconds is already a heavy load for any switch:

als2#debug spann bpdu                                                          
als2#                                                                          
Apr 17 05:47:11: STP: VLAN0001 rx BPDU: config protocol = ieee, packet from Fas
Apr 17 05:47:11: STP: enc 01 80 C2 00 00 00 00 0B 5F C9 00 07 00 26 42 42 03   
Apr 17 05:47:11: STP: Data     00000000006001000B5FC90000000000006001000B5FC9000
Apr 17 05:47:11: STP: VLAN0001 Fa0/7:0000 00 00 00 6001000B5FC90000 00000000 600
Apr 17 05:47:11: STP(1) port Fa0/7 supersedes 0                                
Apr 17 05:47:1                                                                 
als2#1: STP: VLAN0001 Fa0/17 tx BPDU: config protocol=ieee                     
    Data : 0000 00 00 00 6001000B5FC90000 00000013 80010009B752D780 8011 0100 10

setting for 1 second would be unwise...  remember to un all before the debug, then up arrow twice to recall the command and enter,  as a good practice before running debugs... setting hellos for longer will make the bpdu output to the terminal more palatable..

as always, running debugs on a production network is at your risk... you'll need an understanding boss...

changing timers is most effective at the root switch as the timers will then be propagated throughout the diameter...

also changing stp timers is a tricky proposition at best, and not recommended... leave that shit alone...

for stp enhancements, see...

 http://insearchofthecert.blogspot.com/2012/02/guest-post-warren-sullivan.html

bpdu anatomy...

 

i like this diagram, from your friendly neighborhood...spiderman

 
 hulk is only neighborhood thing here...

what i like most about it is that you have to count the bytes in the field...

protocol identifier-  2 bytes, always 0
protocol version identifier- 1 byte, always 0
bpdu type- 1 byte, 0 if configuration bpdu
flags- 1 byte, for topology changes
root identifier- 8 bytes, used for bid of current root switch
root path cost- 4 bytes, path cost to root switch
sender bid- 8 bytes, bid of of current switch (sender)
port id- 2 bytes, id of of port that sent this bpdu
message age- 2 bytes,time since the root created the bpdu
max age- 2 bytes, default 20 secs(max save time for bpdu)
hello time- 2 bytes, default 2 secs(time between bpdu launches)
forward delay- 2 bytes, default 15 secs(time in listening and learning)

configuration bpdu...

the configuration bpdu originates on the root switch and sent out the designated port

the configuration bpdu is received by a non-root switch on its root port

the configuration bpdu is sent by a non-root switch out its designated port

on a segment a designated switch has only one designated port

switch 04...

Root Guard - will guard the root from being unintentionally supplanted as the root by a superior bpdu

superior BPDU - is a bpdu advertising a lower cost path to the root than the one currently acting as root port, which can threaten the spann topology in place

BPDU Guard - ports that shouldn't receive bpdu's are prevented from accidentally receiving them, think access ports

Loop Guard - this will put the port into a port inconsistent state after missing bpdu's so that it is not mistakenly put into a designated role thus preventing a potential loop

UDLD - unidirectional link detection, what it says... (fiber) helps maintain the bidirectional performance of uplinks when a unidirectional condition is detected on the link (broken strand)

BPDU filtering - avoids transmitting bpdu's on access ports; those ports in portfast state that are meant for use with end devices

switch 03...

transparent bridge
a transparent bridge is the idea of a layer 2 device which segments a network and passes frames between    
these segments to nodes by learning  information about the nodes addresses, and without the nodes
knowledge of their existence (hence, the bridges are seemingly transparent to the nodes)

bridging loop
a bridging loop is a condition which can occur if more than one layer 2 path exists in a network between
two endpoints.  layer 2 is helpless to stop such occurrences for lack of a mechanism such as ttl

Spanning Tree Protocol
spanning tree is such a mechanism, designed solely to shut down a redundant path that might cause a
loop

BPDU
the unit of communication between switches to establish the rules for the effective topology of the tree, sent
every 2 seconds

root bridge
a root bridge is determined after a topology election in the tree; this is effectively the hub of the layer 2    
network. the ports of the root bridge are always designated

root port
every switch in the network determines a root port; the port with the least cost path to the root switch

root path cost
the cost determined by bandwidth to the root switch.  this cost is often cumulative

designated port
a non-root port on the switch that is the least cost path to the root connecting to another segment

Hello Time
the time between each transmission of a bpdu; default 2 seconds

Forward Delay
the cumulative time for a port to transition to the forwarding state

Max Age time
the time for the prior information learned from a bpdu to expire because a new bpdu has not been received

TCN
a topology change notification bpdu will be initiated by a switch upon port transitioning

Common Spanning Tree
a single instance (common) tree for the network

PVST
a tree instance for every vlan

PVST+
the same as pvst but ieee open standard (without isl)

bpdu-kie

this is your brain on bpdu... not sure what it all means but it seems pretty important...

protocol id:   0000 IEEE 802.1d
version id:    00  v
bpdu type:     00 config bpdu, 80 tcn bpdu t
bit field:     1 byte
  1 : topology change flag
  2 : unused    0
  3 : unused    0
  4 : unused    0
  5 : unused    0
  6 : unused    0
  7 : unused    0
  8 : topology change ack
root priority    2 bytes rp
root id:         6 bytes root id
root path cost:  4 bytes
bridge priority: 2 bytes bp
bridge id:       6 bytes
port id:         2 bytes
message age:     2 bytes in 1/256 secs
max age:         2 bytes in 1/256 secs
hello time:      2 bytes in 1/256 secs
forward delay:   2 bytes in 1/256 secs

and here is bpdu output from debug...


06:05:42: STP: VLAN0010 Fa0/19 tx BPDU: config protocol=ieee
    Data : 0000 00 00 00 800A0009B73FCE80 00000000 800A0009B73FCE80 8013 0000 1

              ieee   v    t   f     rp         root id     path cost    bp        bridge id       pid/age/time/delay
                                                                      0=root

sw2950_02#sh spann vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0009.b73f.ce80
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0009.b73f.ce80
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.1    P2p
Fa0/2            Desg FWD 19        128.2    P2p
Fa0/17           Desg FWD 19        128.17   P2p
Fa0/18           Desg FWD 19        128.18   P2p
Fa0/19           Desg FWD 19        128.19   P2p

sw2950_02#

spanning tree very pretty...

STP summary

1.  all bridge (switch ports) stabilize at forwarding or blocking.  Forwarding ports are considered part of the spanning tree.

2.  one switch is elected root, and its ports will all move to forwarding state.

3.  each switch receives hellos from the root, directly or through another switch. The port that receives the least cost BPDU is placed in forwarding and becomes that switch’s root port

4.  for each segment one switch forwards the BPDU with the lowest cost.  That switch becomes that segment’s designated bridge.

5.  the other interfaces are placed in blocking

6.  the root sends BPDU’s every 2 seconds. This time interval can be modified and will be noted in the BPDU.

7.  if max-age elapses (20 seconds, default) and no BPDU, panic ensues and the spanning tree changes.

8.  forward delay (default 15 seconds) is the time it takes for a port to transition through the dumbass states to forwarding. (listening, 15 seconds, learning 15 seconds)

9.  when a switch goes into listening, it sends a TCN BPDU (topology change notification) through the new path to the root. Other switches will refresh their tables with the new entry.

10. spanning tree creates these delays to prevent transitional loops because…

spanning tree, very pretty and the bpdu’s are sweet,

but the root of the poor spanning, is impossible to eat…

spanning-tree song...

spanning-tree very pretty and the bpdu's are sweet,
but the root of the poor spanning, is impossible to eat,

Michael the network cat likes that song... reow
 

STP elects a root bridge (switch) and puts all root bridge interfaces into forwarding state

Each non root bridge (switch) determines which of its ports has the least administrative cost (best) to the root bridge and STP makes that port that switch’s root port.

The switch with the lowest (best) cost  to the root is put in forwarding state.

The lowest cost switch on each segment is the designated bridge (switch) and the interface on that switch is called the designated port.

            The root bridge’s (switch) ports are always in forwarding state and the root switch (bridge) is always the designated bridge on all connected segments.

            The non root bridge root port is always forwarding. This port receives the lowest cost BPDU from the root.

            Each LAN’s designated port is always forwarding and the bridge forwarding the lowest cost BPDU is the segment’s designated bridge (switch)

             All other ports are blocking. No forwarding frames, no receiving frames.

         At first each switch claims to be root by sending BPDU’s that contain:

                 The root bridge ID- a combination switch priority and MAC address, lower number, higher priority

             The cost to reach the root- again the lower, the better

             And it’s own bridge ID

can't we just call a root bridge a root switch instead...

Stinky Toilet Paper...

this is gonna hurt you more than me...
spanning-tree port states... arrrrrrrrrrrrrrgh

after initializing, a switchport always enters the blocking state

blocking:
the port dumps the frames received
dumps frames switched for forwarding from another switch
doesn't learn shit
receives bpdu's

listening:

the port dumps the frames received
dumps frames switched for forwarding from another switch
doesn't learn shit
receives bpdu's

learning:
the port dumps the frames received
dumps frames switched for forwarding from another switch
finally gets off its dead ass and learns addresses
receives bpdu's

forwarding:
receives and forwards frames
forwards frames switched from another port
learns addresses
receives bpdu's

disabled:
doesn't do shit