Coggle requires JavaScript to display documents.
system-viewinterface GigabitEthernet 0/0/1undo negotiation auto > doing things manuallyduplex fullspeed 100
display interface GigabitEthernet 0/0/1
swtching loops allow for broadcast storms to occur and duplication of frames to be recvied for example seding a broadcast to a SWs triangle from SWB for example will cause it to forward that broadcasr on all its interfaces to SWA and SWC which themselfs will forward thoses broadcast to themselfs and to rest of Netreapeating again and again >> causing Broadcast Storms that will not stop until all links bandwidth got used up
for example seding a broadcast to a SWs triangle from SWB for example will cause it to forward that broadcasr on all its interfaces to SWA and SWC which themselfs will forward thoses broadcast to themselfs and to rest of Netreapeating again and again >> causing Broadcast Storms that will not stop until all links bandwidth got used up
Recving previously forwaded frames generates false MAC entries and intability within the MAC address table for example seding a broadcast to a SWs triangle from SWB for example which will learn the MAC address of that host through its interface > the broacast will make its way through the other SWs all the way back to SWB from another another interface >> casing the SWB to see that prev item MAC address with the 1st interface is wrong soo its deleted and new item is created to the mac address table with last interface and keeps happening on either one of the interfaces each time > keeping the SWB busy deleting and adding
for example seding a broadcast to a SWs triangle from SWB for example which will learn the MAC address of that host through its interface > the broacast will make its way through the other SWs all the way back to SWB from another another interface >> casing the SWB to see that prev item MAC address with the 1st interface is wrong soo its deleted and new item is created to the mac address table with last interface and keeps happening on either one of the interfaces each time > keeping the SWB busy deleting and adding
MAX AGE is 20 (20secs) > means if the BPDU being forwarded among 20 switches > gets deleted (bigger Sw Nets are not recommanded (7 Net diamter is recommanded ))Eg > 2 hops(MAS Age) + 18 secs >> BPDU packet deleted > means it should be recalculatedMAX Age rep the aging timer if a BPDUBPDU are discarded when Message Age Exceeds Max Afe
as we know the BPDU negotiate with the switches in a BPDU interval of 2 seconds which can be changedmwssage Age means > it takes time for each switch to recv the BPDU packet and process amd send it out >> cannot be accurately calculated soo we assign one Second >> for one Hop of the Switch (when the 1st switch send it out(root switch) > MSG AGE is 0 gets increased by 1sec for each switch we pass in the level)
the BPDU sent out and in 2 seconds switches should negotiateFor example if the root bridge sends out a message > in worst conditions itl take the longest path means the lowest child of the tree > lets say its secong hop after root which means 2sec * 2 = 4secsMeaning the calculations of the best path needs time >> the IEEE assigns a value of 15 secs for the best path to be calculatedSwitch should wait 15 secs to forward data >> this Timer we call it forwarding Delay
where the root path cost is equal , > a port identifier is used to determine the active alternate paths to the root
BID are used by the STP to identify who you are (each switch) Bridge identifiers are used to elect the root bridgebridge priority can be manipulated to force root selection
step value of priority is 4k - not all values can be usedmax used is 61440 | min is 0lowset 12bits of 2B cannot be used > always put to 0By Default each SW have the Same Pvalue > 32768 (32k) Smaller P wins (will be the Root Bridge)
Smaller P wins (will be the Root Bridge)
All STP SWs advertise BPDU to peers with self as root
Root Path cost is carried in the BPDU and used to determine the shortest path to the rootpath costs depends on the link types (cost of GigabitEthernet is smaller than FastEthernet smallesr than 10Mbips Ethernet)
RPC root path cost is the path cost from switch itself towards the root(sumary of all the links)the path cost is the ccost of one link
10Mbps>99>1999999>1999100Mbps>18>199999>1991 Gbps>4>20000>2010 Gbps>2>2000>2
between SWA and SWB we have 2 links > if the 2 links are in forwarding state > then theres a loop > one link must be bloacketSWA root > both its interfaces are Designated > one of the 2 should be Bloacked (link are parallel and to the same SWB > soo they have the same root path cost ) >we cannot decide in this case we use the Port ID (diffrent ports) > interface 1 wins on interface 2
in this case we use the Port ID (diffrent ports) > interface 1 wins on interface 2
all STP switches advertise BPDU to peers with self as root
the Bridge ID and root Path Cost are used to elect port roles
Disabled / Blocking / Listening / Learning / Forwarding
topology chanfe notification informs root of the topology changeRoot Fllushes enteries using BPDU with TC bit set
Non Root bridges wait for MAX age before assuming loss of rootRe-Convergene is then initiated, beginning with root election
SW B begins root election but BPDU is ignored by switch CRoot BPDU os propagated to SW B after MAX agre Expires
Switch B detects failiure and switches alternate port to root portSTP converges after 2x forward delay (30 secs by default)
change in the STP topology may invalidate MAC table enteriesMAC table enteries expire only after 300 secs by default
idea of STP is to find a tree > spanning tree in the topology (Sws topology)most important thing in the tree is the root > choose a root (switch as a root of the tree) all the others calculate the best path to the root >> if this path is not the really the best from switch to the root and there is a path better then the path will be blocked
if the root bridge is down > SWB and SWC will wait for the BPDU (it will not be sent to other switches) but just wiat for the MAx Age Byy default > 20 secsAfter 20 secs BPDU timed out then the BPDU is deleted > then SWB and SWC know that the Bridge root is down >> begin to Calculate new STPReConvergence is then initiated, beginning with Root Electionin the finite state machine the new STP calculation needs 2 ForwardingDelay 2*15secs > 30 secs [Learning State(15) + ListeningState(15)] the Total covergence MaxAge(20) + 2*15 >> 50secs
the Total covergence MaxAge(20) + 2*15 >> 50secs
if the root link on SWB is down then SWB will loses the root port > SWB will imediately recalculate the STP / SWB does not know there is another path to the Root Bridge cuz SWC link is bloacked >> SWB will elect itself as the RootBridge > and it sends BPDU packets to the SWC which accept cuz even in bloacked link BPDU packet can be recved but still SWC drop it cuz its not better than the SWA BPDU (lower priority) > SWC wil not respond , but at that time SWB is still waiting for the respond (MAXAGE>20secs) then the SWB will elect the port btw SWC and SWB as the root port (This Convergence need 50 secs)
(SWB detectes failiure and switches alternate port to root port + STP Converges failiure after 2x forward delay (30 secs by default))
the data btw hostA and hostB should now go the way SWBC link but what it seeems that MAC table still point to SWA soo the frame still goes passed SWA soo SWA cannot forward (SWAC link down ) >> frame dropped >> Changes in the STP topology may invalidate MAC table entriesMAC address table Expiraiton time is 300secs > long time for communication between hostA and hostB to be disruped Solution > the idea is to delete the MAC address items immediately after the topology is changed
Solution > the idea is to delete the MAC address items immediately after the topology is changed
Root Flushes MAC entries using BPDU with TC bit set (inform all SWs MAC address table should be timed out) > items wil be deleted immediately
[SW]>stp mode ?mstp | rstp | stpby default the Huawei Switch is running the mstp[SW]>stp mode stpall switchs should configure this command to be compatible
[SW]>stp priority 4096 (4k is the smallest value after 0)Roo can be set manually or by defining the switch as primarywe can decide whos the root by changing the priority ourselfs
[SW]>stp pathcost-standard ?[SW]>interface GigabitEthernet 0/0/1[SW-GigabitEthernet0/0/1]>stp cost 2000
if attacker wanna desturn our Network > he can just connect another switch (eg: from SWC) and set its priority as 0 higher p than 4K(RTA) after inserted and sending BPDU > it will be elected as the root bridge > topology changes >> SWC does not accept better BPDU > if there better BPDU sent from the attacker interface > SW detect is and put the interface into error stateRoot protection prevents changes to the topology as a result of bridge transition caused by receiving higher priority BPDU[SWA]>interface GigabitEthernet 0/0/1[SWA-GigabitEthernet0/0/1]>stp root-protectionCHECK[SW]>display stpBID / BTime / RootBridge / list all ports that are runnning stps
SWC does not accept better BPDU > if there better BPDU sent from the attacker interface > SW detect is and put the interface into error stateRoot protection prevents changes to the topology as a result of bridge transition caused by receiving higher priority BPDU[SWA]>interface GigabitEthernet 0/0/1[SWA-GigabitEthernet0/0/1]>stp root-protectionCHECK[SW]>display stpBID / BTime / RootBridge / list all ports that are runnning stps
more rapid and network convergence is morequickly
Backup > a backup path to doownstream nodes, where links exist on the same LAN segment as the designated portAlternate > an Alternate path to the root bridge that differs from the path provided by the root port of the switch
Disabled / Alternate / Backup / Root / Designated