Troubleshooting Spanning Tree

Spanning Tree ensure loop free situations in parallel bridge topologies. Proper functioning of Spanning Tree is vital to making certain the network is providing optimal performance and reliability. By default designated bridges send out Bridge Protocol Data Units (BPDU) every two seconds to ensure loop free topologies. During many of our troubleshooting experiences we often encountered entire subnet workstations freezing for periods of 30 seconds or more. The user screen hourglasses and the calls come in.

When such symptoms appear our first course of action is to plug into an open switch or hub port with an analyzer to examine multicast and broadcast traffic. Many times high LAN broadcast storms cause similar hourglass symptoms. If this is not the case then we set the capture filter to the BPDU multicast address of 0180c2000000 on Ethernet. We look to ensure the BPDU traffic is received in regular intervals of the default setting of 2 seconds or the configured timer.

What does BPDU traffic have to do with workstation hangs? If the analyzer is reporting sporadic delta times between BPDU hello messages then it is safe to assume that a bridging problem is occurring.  If the lower priority bridge does not see the designated bridge’s BPDU within the 2 seconds the backup bridge now goes into a learning mode and eventually begins to forward packets. Here is where the delays start to occur. Each BPDU packets contains a maximum age time plus a forward delay time. The default for each is 20 and 15 seconds respectively, or 35 seconds before packets are begin to forward. (Hmm… 30s second or more hourglass) Either the designated bridge became inoperable or some other network anomaly occurred interrupting the BPDU exchange between the primary and secondary bridge. h

So you see that for 35 seconds packet forwarding ceases until the bridge topology rectifies itself. In order to determine if a topology change occurred did deeper into the BPDU packet to see if the configuration flag is set.

In summary: 

  1. Plug into the network to determine excessive multicast / broadcast traffic
  2. Filter on BPDU multicast 0180c2000000 Ethernet (800143000000 TR)
  3. Check BPDU topology change notifications

Leave a Reply

%d bloggers like this: