Spanning Tree-- on average, how often should a change occur?

[jonathan.maxwell]

Hello.

I understand that this question is highly dependent on various factors such as network size and routing protocol.

Nevertheless, please submit your best estimation to this ambiguous situation:

In an average mid sized network, what would you say is an average amount of spanning tree changes on a single switch that should occur in a healthy LAN over a month? 

Thank you.

[Elliot Dierksen]

IMHO there are too many variables to make a meaningful estimation. You do want to avoid topology change notification being caused by edge ports because that can cause performance problems. The short version of that is that every edge port (a single device or an IP phone + a single device) should have "spanning-tree portfast" enabled. The most obvious feature of portfast is that is allows frames to be forwarded during the listening and learning phases of spanning tree. DHCP (and IPX) will not work correctly if this isn't enabled. The other less recognized thing that it is does is that a port going up/down will not generate a topology change notification when portfast is enabled. I have seen cases where an edge port without portfast crippled a large hospital network. The problem was traced back to a faulty print server which was generating port flaps. That meant that there was always a TCN active, so frames to known MAC addresses were flooding the network. If only switch to switch and possibly switch to router links generate TCN's, I wouldn't expect to see a lot. Those links don't (or shouldn't) go up/down with any kind of frequency. When they do, a TCN is proper.

[David Ruess]

In addition to the good info @Elliot Dierksen provided you can tune trunks to routers/Multi VLAN servers with the 'spanning-tree portfast trunk' command to reduce it even further (make sure you understand this command and where it applies before implementing). I would also manually assign the root bridge and secondary as that would reduce changes if just a random switch that elected itself as root went down. That being said the TCN is sent to the root who then propagates it through the network. So your root should be close to the center of your devices (i.e. same hop distance away, or close to it), but most people make it the core of your network which is fine too.

You can also use the command to see if anything is causing a lot of events in your network:

debug spanning-tree events

-David

[MHM Cisco World]

It must be one when you do config STP and then it happen normally when any new SW add to this domain.
but there is issue if TCN appear and usually come from 
1-Link failed  
2-CPU utilize