This document provides an overview of utilizing the Spanning Tree Protocol (STP) within the LiveAction application to monitor various STP types, including PVST+, Rapid PVST+, and MSTP. It emphasizes the configuration of STP support, visualization of STP instances, and alerts for topology changes, aiding network administrators in identifying issues like rogue switches. The document includes step-by-step guidance for setting up LiveAction to enhance situational awareness and troubleshoot network performance effectively.

1. LiveAction Application Note
Spanning Tree Protocol (STP)
Using LiveAction to monitor PVST+, Rapid PVST+, and MSTP
January 2013
http://www.actionpacked.com

2. Table of Contents
1. Introduction .......................................................................................................................... 1
2. Understanding STP ........................................................................................................... 2
3. Configuring Spanning Tree Support for LiveAction ........................................................ 3
4. Spanning Tree Topology View ......................................................................................... 4
5. Spanning Tree Alerts ........................................................................................................ 6
6. Spanning Tree State Report ............................................................................................. 8
7. Spanning Tree Use Case Scenario: Identifying Rogue Switches .................................... 9

3. 1. Introduction
Spanning Tree Protocol (STP) is a mechanism which provides loop-free paths within a pure layer 2 topology. STP allows for
link redundancy by temporarily blocking ports in order to have a single path. Upon the detection of a link, or port failure,
STP will re-converge to leverage the other unused port. This prevents broadcast storms and the duplication of packets from
floating around in the network endlessly. There are multiple flavors of STP, each with their own features and nuances,
which includes: Per VLAN Spanning Tree Protocol Plus (PVST+), Rapid Per VLAN Spanning Tree Protocol Plus (Rapid
PVST+), and Multiple Spanning Tree Protocol (MSTP).
With LiveAction 2.6 and greater, users have higher levels of situational awareness and visibility on their switched network
infrastructure by providing a topological representation of each Spanning Tree instance, as well as providing alerts on the
transitioning port state events. This helps network administrators to act quickly and identify the insertion of rogue and/or
misconfigured switches promptly. Similarly, the STP path representation can be used to identify suboptimal layer 2 paths in
a switched network. This application note provides instructions on enabling the STP functionality within LiveAction and will
cover the aforementioned use case.
http://www.actionpacked.com 1

4. 2. Understanding STP
STP uses the terminology of “bridges” to represent layer 2 devices in the topology. With Cisco’s implementation of PVST+
and Rapid PVST+, each VLAN in the network represents one STP instance. This allows the user to select the layer 2 path
based on the VLAN ID, and is generally used for load-balancing. The open standard MSTP version (IEEE 802.1s) uses a
similar technique but requires the user to define MSTP instances and assign multiple VLANs to each instance.
Since layer 2 frames do not have a loop prevention mechanism – like TTL values for layer 3 packets – it is important to
ensure that only one path exists within the STP instance. The STP algorithm achieves this by designating a single switch as
the Root Bridge. The Root Bridge is the switch with the lowest STP priority value in the switch topology, and determines
the overall path within the network. Each switch port then assumes a specific role – which dictates whether or not it will
be forwarding or blocking – in the STP instance. The common port roles are: Root Port (RP), Designated Port (DP), and
Non-Designated Port (NDP). RPs and DPs are always forwarding, while NDPs are considered to be blocking. The following
diagrams show two different layer 2 STP instances, and how the Root Bridge position affects traffic flow between the
switches:
http://www.actionpacked.com 2

5. 3. Configuring Spanning Tree Support for LiveAction
In order to provide detailed information regarding all of the available spanning tree instances in LiveAction, the following
IOS configurations must be enabled. This only applies to devices which use SNMPv3. SNMPv2 works with no
configurations required.
Given the following SNMPv3 configurations (please note the “show run” command suppresses the SNMP user
configuration):
L2c2960SCOPE-AS-153#show run | in snmp
snmp-server group READONLY v3 priv
L2c2960SCOPE-AS-153#show snmp user user
User name: user
Engine ID: 8000000903002C36F8843F81
storage-type: nonvolatile active
Authentication Protocol: SHA
Privacy Protocol: AES128
Group-name: READONLY
We simply add the line:
snmp-server group READONLY v3 priv context vlan- match prefix
No other changes are required. We are only adding the ability to read VLAN context on the configured SNMPv3 group. The
resulting SNMPv3 configuration would be as follows:
L2c2960SCOPE-AS-153#show run | in snmp
snmp-server group READONLY v3 priv
snmp-server group READONLY v3 priv context vlan- match prefix
It is important to note that no changes were made to the existing user account; however, in order to view the STP data,
LiveAction must use a user within the contextually aware SNMPv3 group to manage the switches.
http://www.actionpacked.com 3

6. 4. Spanning Tree Topology View
The main benefit of using LiveAction, within the context of a layer 2 focused infrastructure, is that each STP instance can be
easily visualized. This greatly aids in troubleshooting performance and connectivity issues within the local area network.
With VLAN 10, we can clearly see L2c3560SCOPE-DS-150 as our root bridge. Hovering over any of the switches displays
more information, similar to what we would find in the IOS CLI.
http://www.actionpacked.com 4

7. By changing the LAN tab selector to the desired VLAN, it is possible to see various STP instance configurations.
Hovering over a non-root bridge device shows us which ports are blocked, reducing the need to hop into each switch in
order to run the “show spanning-tree vlan x” command. The current configuration is placed in front of you in an easy to
read format.
As an added benefit, LiveAction is able to properly identify MSTP configurations and has the exact same workflow as the
other STP variations. Utilizing the drop down selector for the VLANs in the same MSTP instance will yield the exact same
data. There are no extra configurations required to make MSTP work.
http://www.actionpacked.com 5

8. 5. Spanning Tree Alerts
A stable STP instance is one where the port states remain fairly static. Changes to port states indicate some form of
network change and can cause STP to reconverge. Depending on the implemented protocol, the convergence time can take
upwards of 45 seconds, causing temporary outages and data loss for critical network services. As part of LiveAction’s high
visibility features, an alerting system has been implemented to notify users of any changes in the STP topology. To access
this functionality, select Tools > Configure Alerts, and access the LAN Triggers tab.
The result, upon changing the priority of the root bridge, shows a fairly verbose output of the LiveAction’s alerting system
during a topology change. For PVST+, it is also possible to see the LEARNING and LISTENING transition states in the
topology, indicated by a yellow arrow. For all intents and purposes these transition states are still considered to be
BLOCKING, but can give the administrator a visual cue on STP convergence in the network. In order to simplify the alerts,
only FORWARD and BLOCK states will be noted.
http://www.actionpacked.com 6

9. Since the real-time alert system will only display the last 100 alerts, we can leverage the “Historical search” feature to sift
through these events for further analysis. The Historical Alerts is accessible through the In-Application Alerts window.
http://www.actionpacked.com 7

10. 6. Spanning Tree State Report
LiveAction’s Spanning Tree State Report allows the user the ability to see the STP configuration at any point in time. This is
particularly useful when troubleshooting the addition and modification of switches in the network. Another potential use
case for this report is also for the planning phase of a network design process, as it focuses on key STP information, as well
as the connected device and interface. To access the report, select Reporting > LAN > Reports, and use the Spanning
Tree State Report. Here we see the VLAN 10 and VLAN 20 settings for the device, L2c3560SCOPE-DS-150:
Another option is to view all of the devices in the topology, to get a holistic view of the selected VLAN. This benefits
greatly from a configuration management perspective and is comparable to running a combination of “show spanning-tree
vlan 20” and “show cdp neighbors” command on ALL of your switches.
http://www.actionpacked.com 8

11. 7. Spanning Tree Use Case Scenario: Identifying Rogue Switches
One of the ways we can spot the inclusion of rogue switches into the network is through the LAN Topology View. By
selecting the “Show Spanning Tree” option, we clearly see another connection hanging off of L2c2960SCOPE-AS-152.
Because the interface connected to this new switch is not in our topology, as an added interface, we see a stray arrow
pointing out to the middle of nowhere.
Hovering over the Bridge ID icon shows a tooltip with the same information. It looks like the added switch is also
assuming the role as the root bridge, because of its low bridge priority value (10). The converged topology now seems to
be using a suboptimal layer 2 path. For example, in order for a workstation connected to L2c2960SCOPE-AS-153 to reach a
server on L2c3560SCOPE-DS-151, the traversed path would be:
L2c2960SCOPE-AS-153  L2c3560SCOPE-DS-150  L2c2960SCOPE-AS-152  L2c3560SCOPE-DS-151
http://www.actionpacked.com 9

12. In order to further investigate this device, the Spanning Tree State Report is executed for VLAN10. We see that none of the
switches in the topology are currently configured as the Root Bridge and a stray entry has been added, which points to the
rogue switch. It seems like it is connected to Fa0/8 on L2c2960SCOPE-AS-152. LiveAction will not display the connected
device’s name under the Spanning Tree State Report unless it is a configured device. To view the actual device name, we
can double-click the device in question in order to enter the LAN Device View.
It looks like the culprit is another Cisco switch with the name “sc-switch”! It might be possible that the device was just
misconfigured with the wrong priority, but having LiveAction enables us to quickly visualize the error and conduct the
necessary remediation steps. Similarly, identifying rogue devices helps us initiate incident response at a much faster rate.
Copyright © 2013 ActionPacked! Networks. All rights reserved. ActionPacked!, the ActionPacked! logo and LiveAction are
trademarks of ActionPacked! Networks. Other company and product names are the trademarks of their respective
companies.
ActionPacked! Networks
155 Kapalulu Place, Suite 222
Honolulu, HI 96819
http://www.actionpacked.com 10