Spanning-tree wireshark question

[Jason Fraioli]

I am seeing the following lines in Wireshark, but the priority I am seeing is that of the root bridge. Does it matter that I am seeing these wireshark captures on my access switches?

27 8.367618 Cisco_0a:ff:96 Cisco_0a:ff:96 LOOP Reply

28 10.000372 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

29 12.000442 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

30 14.000520 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

31 16.000604 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

32 18.000688 Cisco_0a:ff:96 Spanning-tree-(for-bridges)_00 STP RST. Root = 8192/00:d0:02:d5:74:15 Cost = 23 Port = 0x8016

33 18.367969 Cisco_0a:ff:96 Cisco_0a:ff:96 LOOP Reply

[massimiliano.serafino]

Hi,

This is because spanning-tree is enabled on access port too.

In hope this helps.

Best regards.

Massimiliano.

[Jason Fraioli]

Would these captures be the result of Portfast/BPDUguard running?

[Francois Tallet · Accepted solution]

No, just because STP is running on the access ports;-) Looks perfectly normal.

Regards,

Francois

[bmbreer]

It's normal. STP is sent via a multicast MAC address so all hosts on the network will see the STP messages assuming it's not disabled for that broadcast domain.