On a busy workday morning, the whole network suddenly goes down: no internet, no accounting software, no phones. The switch lights blink nonstop. After an hour of searching, it turns out a coworker plugged a spare cable lying on their desk into the second network jack at the same desk. That is a network loop, and it is one of the fastest ways to knock out an unprotected network.
Why Is a Loop So Dangerous?
Unlike IP packets, Ethernet frames have no time-to-live (TTL) counter. When a closed path forms between switches, broadcast frames, which a switch must forward to every port, circulate endlessly around the loop and multiply on every pass. A few seconds later you get:
- Broadcast storm: Port bandwidth fills up.
- MAC table instability: The switch keeps seeing the same device’s address on different ports and no longer knows where to send traffic.
- Switch CPUs: They get overwhelmed by the traffic, and sometimes even the management interface stops responding.
Where Do Loops Usually Come From?
- Plugging both ends of one cable into two network jacks that lead to the same switch.
- A small unmanaged switch under a desk connected to the network with two cables.
- A dual-port IP phone with both ports plugged into wall jacks.
- An extra cable between two switches for “redundancy” without the required configuration.
What Is STP and How Does It Work?
Spanning Tree Protocol, running on managed switches, finds redundant paths and keeps them blocked so that only one active path exists between any two points. If the main path fails, the blocked path takes over. The switches first elect a root switch (Root Bridge), and all other paths are calculated relative to it.
- Classic STP (802.1D): Old and slow; recovery after a change can take tens of seconds.
- RSTP (802.1w): The faster version, the default on many current switches, which usually converges within a few seconds.
- MSTP (802.1s): For networks with many VLANs that want separate trees for groups of VLANs.
The Right Settings for Protection
- Keep STP or RSTP enabled on all managed switches and use compatible versions across the network.
- Choose the root switch yourself: Set the core switch’s priority lower than the default, for example
4096, so an old switch in the corner of the office does not become root by accident. - Set user ports to Edge or PortFast so computers connect to the network without delay.
- Enable BPDU Guard on user ports: If an STP message, a sign that a switch has been connected, appears on one of these ports, the port shuts down automatically.
- Storm Control: Set a limit for broadcast traffic on each port.
- Use LACP for parallel links between switches so both links stay active instead of STP blocking one.
The names and details of these features vary slightly between vendors, and some switches also have their own loop detection feature. Check your switch documentation before making changes.
If a Loop Happens
- Find the last change: which cable or device was just connected?
- Check the switch log; repeated messages about a MAC address moving between ports are a clear sign of a loop.
- If you have no clues, disconnect the uplinks of the access switches one at a time until the network calms down and the loop location becomes clear.
Checklist
- STP or RSTP is enabled on all managed switches.
- The root switch has been set manually.
- User ports are protected with BPDU Guard.
- Storm Control is configured.
- Unmanaged switches under desks have been removed or identified.
ITPlus724 engineers can review the STP settings and port protection on your network so that one wrong cable cannot bring your whole company to a halt.