Create a loop, watch it hurt, then let STP fix it

applied · 50 min · Objective 2.2

Task

Deliberately build a layer 2 loop with spanning tree disabled, observe a broadcast storm, then enable STP and watch a port move to blocking. The loop is the most destructive fault in domain 5 and the one nobody forgets after seeing it once.

Steps

  1. Create two bridges to act as two switches, with STP explicitly off: sudo ip link add br1 type bridge stp_state 0 and the same for br2.
  2. Connect them twice with two veth pairs. Two links between two switches with no spanning tree is a loop by construction.
  3. Attach a host namespace to br1 and give it an address. Watch the CPU with top in another terminal.
  4. Generate a single broadcast: sudo ip netns exec h1 ping -c 1 -b 10.10.0.255. One frame is enough. Watch what happens to the interface counters — ip -s link show veth1 — and to the CPU.
  5. Now enable spanning tree on both bridges: sudo ip link set br1 type bridge stp_state 1 and the same for br2. Wait about 30 seconds, then look at the port states. One of the two links is now blocking, and the storm stops.

Verify

bridge link show | grep -E "state|br[12]"
ip -s link show veth1 | tail -4
sudo ip link set br1 type bridge stp_state 1; sudo ip link set br2 type bridge stp_state 1
sleep 35; bridge link show

Before STP, the packet counters on the looped interfaces climb continuously from one ping. After STP converges, bridge link show must report one port in blocking or disabled state, and the counters must stop climbing.

Notes

The detail that makes a loop so violent is that an Ethernet frame has no TTL. An IP packet in a routing loop dies after 64 hops; a broadcast frame in a switching loop circulates forever, and every switch duplicates it onto every other port, so the traffic grows rather than merely persisting.

The field symptoms are worth memorising: every link light flashing in unison, switch CPU pinned, the whole segment unusable rather than one host, MAC addresses flapping between ports in the logs, and — the cruel part — losing management access to the switches you need to fix it.

Prevention is STP plus BPDU Guard on access ports, so that the unmanaged switch a user plugs in under their desk shuts the port instead of joining the topology.