Spanning Tree root bridge election — the mental model

If you understand the root bridge election, you understand Spanning Tree Protocol. Everything else — port roles, path costs, the blocked port, PortFast, BPDU Guard — falls out of that one decision.

The most common mistake I see in early CCNA students is treating the root election as random (“whichever switch boots first” or “the one in the middle”). It’s neither. It’s deterministic, and once you know the tiebreaker order, the entire STP topology is predictable.

What the root actually is

Spanning Tree runs on every switch. When switches come up, they compare notes with their neighbors using BPDUs (Bridge Protocol Data Units) sent every 2 seconds. The purpose of that comparison is to elect one switch — the root bridge — that will act as the reference point for the whole L2 topology.

Once the root is chosen:

• Every non-root switch calculates the shortest cost path back to the root.
• The interface on the shortest path becomes that switch’s root port.
• On every segment, one switch owns the designated port (the one that will forward traffic on that segment) — typically the one closer to root.
• Every other port that could form a loop is blocked.

So the whole loop-prevention story hinges on that first question: which switch is the root?

The tiebreaker order — bridge ID

Each switch has a bridge ID (BID) that’s used to compare. The BID is 8 bytes:

2 bytes	2 bytes (embedded in above)	6 bytes
Bridge priority (0–65535)	System ID extension (VLAN ID)	Base MAC address

The switch with the lowest BID wins the root election. Comparison happens field-by-field:

1. Lowest bridge priority wins. Default priority is 32768. Ties go to step 2.
2. Lowest MAC address wins the tiebreaker.

That’s it. Two steps. If nobody has changed priorities, the switch with the oldest MAC address (which usually means the oldest switch you own) becomes the root — often a legacy access switch you forgot about, sitting in a closet, hairpinning traffic the long way. That’s the classic “root elected in the wrong place” bug.

Why lowering priority is the right move

You can force the root election by lowering priority on the switch you want to be root:

S1(config)# spanning-tree vlan 1 priority 4096

Priorities in Cisco IOS come in increments of 4096 (0, 4096, 8192, … 61440). Setting a switch to 4096 basically guarantees it’s the root unless another switch is set to 0.

The macro spanning-tree vlan 1 root primary is a shortcut — IOS looks around, checks the current root’s priority, and sets this switch’s priority just low enough to beat it.

Don’t manipulate MAC addresses. People occasionally suggest changing the MAC to affect root election. Bad idea. MACs are a tiebreaker of last resort — they don’t survive maintenance and the intent isn’t visible in the config. Priority is explicit.

Per-VLAN root — Rapid-PVST+

On modern Catalyst switches, Rapid-PVST+ runs one STP instance per VLAN. That means each VLAN has its own root election. The trick most enterprise designs use:

• Distribution switch A = root for odd VLANs
• Distribution switch B = root for even VLANs

This gives you traffic load-sharing across the uplinks. Half the VLANs flow through DIST-A, the other half through DIST-B. Neither uplink sits idle.

DIST-A(config)# spanning-tree vlan 1,3,5,7,9 root primary
DIST-A(config)# spanning-tree vlan 2,4,6,8,10 root secondary

DIST-B(config)# spanning-tree vlan 2,4,6,8,10 root primary
DIST-B(config)# spanning-tree vlan 1,3,5,7,9 root secondary

root secondary sets a priority just above the primary so if the primary fails, this switch takes over immediately.

How to verify — the three commands you’ll live in

show spanning-tree summary
show spanning-tree vlan <n>
show spanning-tree root

show spanning-tree vlan 10 on a non-root switch is the money command. It tells you:

• Who the root is (Root ID)
• Where the root port faces (Root port)
• What port role each interface has (Root, Designated, Alternate, Blocked)
• Cost to reach root

On the root switch, that same command shows This bridge is the root and every interface is designated.

The lab that actually teaches it

Three switches in a triangle. Default config on all three. Boot them and watch:

1. show spanning-tree vlan 1 on each — one is the root, one blocked port somewhere.
2. Force S2 to be the root: spanning-tree vlan 1 priority 4096. Watch the tree reconverge.
3. Break the S2-to-S3 link. Watch the previously-blocked port unblock and traffic reroute.
4. Bring the link back. Watch the port become blocked again.

That drill is the difference between “I read about STP” and “I ran STP.”

Common mistakes

1. Doing nothing. The default is “whoever has the lowest MAC wins,” which usually elects an old access switch. Explicitly setting the distribution switch as root should be a standing item on every deployment checklist.

2. Setting priority to a non-multiple of 4096. IOS will reject priority 3000. Use root primary or a multiple of 4096.

3. Forgetting Rapid-PVST+ is per-VLAN. Setting root only for VLAN 1 doesn’t affect VLAN 20’s root. Set explicitly for every VLAN you care about, or use a range command.

4. Turning STP off. Yes, some people still do it “for performance.” Don’t. Modern switches converge in sub-second on RSTP; turning STP off gains you nothing and risks a loop that will melt your network.

5. Not using PortFast on edge ports. Access ports for hosts (PCs, phones) should be PortFast + BPDU Guard. Without PortFast, every host boot waits 30 seconds for the port to go through STP states. With BPDU Guard, if anyone plugs a switch into that port, it err-disables — protecting your root election from a rogue switch.

Cheat strip

Concept	One-line meaning
Root bridge	Switch with lowest BID. Reference point for the whole topology
BID	8 bytes = priority (2) + MAC (6). Lower wins
Priority default	32768. Increments of 4096
root primary macro	Sets priority low enough to beat current root
root secondary macro	Sets priority just above primary — hot standby
Root port	The port on the shortest path to root — one per non-root switch
Designated port	The port that forwards on each segment — one per segment
Blocked port	The one that would create a loop — one per loop
BPDU	The message switches exchange to compute the tree — every 2 s
RSTP	Rapid STP (802.1w). Sub-second convergence. Default on modern Catalyst
Rapid-PVST+	One RSTP instance per VLAN — Cisco default

What to try tonight

Log into a lab (Packet Tracer works). Build the three-switch triangle. Force each switch to be the root in turn. Watch which ports change role. Fail a link. Watch reconvergence. Then read show spanning-tree vlan 1 on each switch and predict, before you look, what it will say. That’s the exercise that makes STP click.

Once it clicks, port security, VLANs, and inter-VLAN routing all get easier — because you finally have a mental model for how the Layer 2 topology is shaped.