Spanning Tree header value

[Vasileios Bouloukos MSc, ITIL, CCIE]

Hi all,

I am sniffing packets and I am trying to identify Spanning Tree Packets.

Do you know if there a field identifier to the STP packets/header?

Thank you,

Vasilis

[Giuseppe Larosa]

Hello Vasilis,

first of all, we have to note that encapsulation of PVST+ is totally different then standard IEEE 802.1D STP.

You can find very useful information about STP encapsulation and those of other protocols like CDP, DTP, VTP and so on in a document present in CCO named "best practices for IOS based switches"

see

http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00801b49a4.shtml

IEEE 802.1D encapsulation has the LLC header with SSAP= DSAP = 42 with a well known L2 MAC multicast destination of

01-80-c2-00-00-00

Cisco PVST+  uses LLC SNAP encapsulation with LLC= 0x AAAA03 + 3bytes Cisco OUI= 0x00000C+ 0x010b as HDLC 2 byte protocol type with a multicast MAC destination of

01-00-0c-cc-cc-cd

To be noted on an access port a Cisco switch should use the IEEE version of the BPDU and the proprietary version is used over trunk ports

Hope to help

Giuseppe

Edit:

I have attached the pdf version of the document