Loop Prevention

Updated

September 4, 2026

Loop Prevention

Redundant L2 links are good for resilience and catastrophic without loop control. Broadcasts and unknown unicasts circulate forever; MAC tables flap; the LAN melts. This chapter covers the spanning tree family as a model (not a vendor certification deep dive) and how to see loops in the lab.

Learning goals

By the end of this chapter you can:

  • Explain why Ethernet needs loop prevention
  • Describe root bridge election and port roles at a conceptual level
  • Predict a blocked port in a simple triangle of switches
  • Build a loop, observe the blast, then enable prevention
  • Prefer design alternatives when L2 redundancy is the wrong tool

Why loops kill L2

Ethernet has no TTL on frames. In a loop:

  1. Broadcast / unknown unicast is flooded
  2. Copies multiply around the cycle
  3. CPUs and links saturate
  4. Learning oscillates (MAC seen on alternating ports)

IP routers do not save you inside a pure L2 domain.

Spanning tree behavior

Classic STP/RSTP/MSTP ideas:

Idea Meaning
Root bridge Reference switch (lowest priority/BID wins)
Root port Each non-root switch’s best path toward root
Designated port Best port on a segment toward downstream
Blocked / alternate Redundant path held in reserve
BPDU Control frames that build the tree

Modern networks often use RSTP or vendor rapid variants; data centers may avoid large L2 domains entirely (L3 fabric). Still, you must recognize STP language on campus gear and many NOS features.

Priority and ties

Lower bridge priority wins. Ties break by MAC. In labs, set priorities explicitly so root placement is intentional:

sw1 priority better (numerically lower) → root
sw2/sw3 farther

Port states (classic story)

Blocking → Listening → Learning → Forwarding (RSTP simplifies roles/states). During convergence, expect transient blackholes—measure them in drills.

Design alternatives (model maturity)

Approach Loop story
STP/RSTP on bridged triangle Protocol blocks one link
L3 access / routed triangle No L2 loop; ECMP at L3
MC-LAG / bundling Multi-chassis tricks (complex)
Single homing No redundancy, no loop

For many greenfield labs after this chapter, prefer L3 redundancy. Learn STP so you can operate brownfield and understand failure domains.

Lab: three switches, intentional loop

    sw1
   /   \
 sw2———sw3

Hosts on sw2 and sw3.

Topology YAML (Linux bridges)

name: l2-loop

topology:
  nodes:
    sw1:
      kind: linux
      image: alpine:3.20
      binds: ["./config/sw-loop.sh:/startup.sh"]
      cmd: /bin/sh /startup.sh
    sw2:
      kind: linux
      image: alpine:3.20
      binds: ["./config/sw-loop.sh:/startup.sh"]
      cmd: /bin/sh /startup.sh
    sw3:
      kind: linux
      image: alpine:3.20
      binds: ["./config/sw-loop.sh:/startup.sh"]
      cmd: /bin/sh /startup.sh
    h2:
      kind: linux
      image: alpine:3.20
      exec:
        - apk add --no-cache iproute2 iputils
        - ip addr add 10.10.0.2/24 dev eth1 && ip link set eth1 up
    h3:
      kind: linux
      image: alpine:3.20
      exec:
        - apk add --no-cache iproute2 iputils
        - ip addr add 10.10.0.3/24 dev eth1 && ip link set eth1 up

  links:
    - endpoints: ["sw1:eth1", "sw2:eth1"]
    - endpoints: ["sw1:eth2", "sw3:eth1"]
    - endpoints: ["sw2:eth2", "sw3:eth2"]
    - endpoints: ["h2:eth1", "sw2:eth3"]
    - endpoints: ["h3:eth1", "sw3:eth3"]

Dangerous mode: dumb bridges without STP

#!/bin/sh
# config/sw-loop.sh — NO STP (for short controlled drill only!)
set -e
apk add --no-cache iproute2 bridge >/dev/null
ip link add br0 type bridge
ip link set br0 up
for i in 1 2 3; do
  ip link set eth$i up 2>/dev/null || true
  ip link set eth$i master br0 2>/dev/null || true
done
sleep infinity

Warning: Run the loop experiment briefly on an isolated lab host. Broadcast storms can stress CPU.

Observe storm (careful)

# terminal 1
docker exec clab-l2-loop-h2 ping -f 10.10.0.3 &
# or send broadcasts
docker exec clab-l2-loop-sw1 ip -s link
# counters explode

Destroy promptly:

sudo containerlab destroy -t l2-loop.clab.yml --cleanup

Safer mode: enable STP on the bridge

Linux bridge STP:

ip link add br0 type bridge
ip link set br0 type bridge stp_state 1
ip link set br0 up
# attach ports...
# inspect
docker exec clab-l2-loop-sw1 cat /sys/class/net/br0/bridge/stp_state
# port states under /sys/class/net/br0/brif/*/state

Predict: One of the triangle links is blocked; ping between h2 and h3 still works via remaining tree; storm does not persist.

Observe:

docker exec clab-l2-loop-h2 ping -c 5 10.10.0.3
# check which port is blocking on each sw
for s in sw1 sw2 sw3; do
  echo "== $s =="
  docker exec clab-l2-loop-$s sh -c 'for p in /sys/class/net/br0/brif/*/state; do echo $p $(cat $p); done'
done

Root placement drill

Influence root by bridge priority (when using STP implementations that expose it):

# example sysfs / tools depend on stack; concept: make sw1 root
ip link set br0 type bridge priority 0x1000

On NOS images (SR Linux, etc.), use vendor STP priority knobs—same election idea.

Predict: With sw1 root, blocked port is likely on the sw2–sw3 link (common triangle outcome with symmetric costs).

Verify: Diagram the tree; mark root ports and blocked port.

BPDUs and protection concepts (awareness)

Feature idea Intent
BPDU guard Err-disable access port if BPDU seen
Root guard Prevent downstream from becoming root
Loop guard Protect against unidirectional link issues

You may not implement all in Alpine labs; know the jobs so production configs make sense.

When not to extend L2

Smell Prefer
L2 stretched across sites L3 + overlay if needed
Huge broadcast domain Segment VLANs + route
STP diameter anxiety Routed access / leaf-spine

Spanning tree is a safety net, not an excuse for continent-sized broadcast domains.

Predict worksheet

Triangle swA–swB–swC, all costs equal, swA root.

  1. Which link is most likely blocked?
  2. Host on swB to host on swC: path?
  3. If swA dies, what must happen?

Answers: (1) often B–C; (2) B–A–C; (3) re-election, former blocked may forward, connectivity among survivors if links remain.

Verification checklist for STP labs

  • Never leave an intentional storm lab running unattended
  • Record before/after port states
  • Compare L2 redundancy recovery to L3 ECMP recovery later—feel the difference

Summary

  • L2 loops multiply floods; no frame TTL
  • Spanning tree elects a root and blocks redundant ports
  • Practice triangle labs with STP on; only briefly demo storms
  • Root placement is a design choice
  • Mature designs often push redundancy to L3

Next: link aggregation—bundling links for bandwidth and failover without creating an independent loop story (when configured correctly).