In which configuration mode is show spanning-tree used?

The show spanning-tree command is entered in Privileged EXEC mode on Cisco IOS devices.

Spanning TreePrivileged EXEC

show spanning-tree

Displays the Spanning Tree Protocol (STP) state and configuration for all VLANs or a specific VLAN, used to verify root bridge, port roles, and STP topology.

Definition: show spanning-tree is a Cisco IOS privileged exec command. Displays the Spanning Tree Protocol (STP) state and configuration for all VLANs or a specific VLAN, used to verify root bridge, port roles, and STP topology.

Overview

The 'show spanning-tree' command is a fundamental diagnostic tool in Cisco IOS that displays the current state and configuration of the Spanning Tree Protocol (STP) for all VLANs or a specified VLAN. STP is a Layer 2 network protocol that ensures a loop-free topology in Ethernet networks by dynamically blocking redundant paths. This command is critical for network engineers to verify the root bridge selection, port roles (root, designated, alternate, backup), port states (forwarding, blocking, listening, learning), and overall STP topology.

It is typically used during initial switch deployment, after topology changes, or when troubleshooting connectivity issues caused by loops or suboptimal STP convergence. Unlike 'show spanning-tree vlan X' which filters to a single VLAN, the base command provides a comprehensive view across all VLANs, which is essential for understanding the global STP health. In a troubleshooting workflow, this command is often the first step after noticing network instability, high CPU utilization due to STP recalculations, or unexpected port blocking.

It is also used to verify that the intended root bridge is elected and that redundant links are properly blocking. The output is buffered and may be lengthy in large networks with many VLANs; it can be piped to 'include' or 'section' for filtering. Privilege level 1 (user EXEC) is sufficient to execute this command, but some parameters like 'detail' may require privileged EXEC (level 15).

The command does not modify the running configuration, but it reflects the current operational state derived from the running config and dynamic STP calculations. Understanding the output fields—such as Bridge ID (priority + MAC), Root ID, port cost, and designated bridge—is essential for CCNA and CCNP candidates to master STP concepts and pass certification exams. This command also supports Rapid PVST+ and MSTP, with slight output variations.

In modern networks, it remains relevant despite the advent of protocols like TRILL or SPB, as STP is still widely deployed in access and distribution layers. The command's output can be correlated with 'show spanning-tree interface' for per-port details, 'show spanning-tree vlan X root' for root bridge info, and 'debug spanning-tree events' for real-time changes. Mastery of this command is a cornerstone of Layer 2 troubleshooting and design.

Syntax·Privileged EXEC

show spanning-tree

When to Use This Command

Verify which switch is the root bridge in a VLAN after a network change.
Troubleshoot a loop by checking if a port is in blocking or forwarding state.
Confirm STP port roles (root, designated, alternate) after adding a new switch.
Check for STP convergence issues when a link flaps.

Parameters

Parameter	Syntax	Required	Description
vlan	<1-4094>	Optional	Specifies a single VLAN ID to display STP information for that VLAN only. If omitted, the command shows STP for all active VLANs. Common mistake: using a VLAN that does not exist or is not configured, which results in no output.
detail	detail	Optional	Provides detailed STP information including timers, port costs, and designated bridge details for each port. Useful for in-depth analysis but can produce extensive output. Must be used with the 'vlan' parameter or alone to show all VLANs.
interface	interface-id	Optional	Displays STP information for a specific interface, such as GigabitEthernet0/1. Shows port role, state, cost, and designated bridge for that interface. Common mistake: using an interface that is not in the STP topology (e.g., routed port).
bridge	bridge	Optional	Displays the bridge ID and root ID for all VLANs or a specified VLAN. Provides a concise view of the STP root and local bridge priorities. Often used to quickly verify root bridge election.
root	root	Optional	Displays only the root bridge information for all VLANs or a specified VLAN. Useful for quickly identifying the root bridge without the full topology output.
backbonefast	backbonefast	Optional	Displays the status of BackboneFast feature, which accelerates STP convergence after a root port failure. Shows whether BackboneFast is enabled and its operational state.
uplinkfast	uplinkfast	Optional	Displays the status of UplinkFast feature, which provides fast convergence after a direct link failure on access switches. Shows whether UplinkFast is enabled and its parameters.
portfast	portfast	Optional	Displays the status of PortFast feature on all interfaces or a specified interface. PortFast allows ports to transition directly to forwarding state, bypassing listening and learning, typically used on access ports.
mst	mst	Optional	Displays STP information for Multiple Spanning Tree (MST) instances. Used in MSTP configurations. Requires MST to be configured; otherwise, output is empty.

Command Examples

Basic show spanning-tree for VLAN 1

show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     0011.2233.4455
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/0            Desg FWD 4         128.1    P2p
Gi0/1            Desg FWD 4         128.2    P2p

VLAN0001: The VLAN being displayed. Root ID: Shows root bridge priority (32769 = 32768 + VLAN 1) and MAC address. 'This bridge is the root' indicates this switch is root. Bridge ID: Local switch's bridge ID. Interface table: Role (Desg=Designated, Root, Altn=Alternate), Sts (FWD=Forwarding, BLK=Blocking), Cost (path cost to root), Prio.Nbr (port priority.number), Type (P2p=point-to-point).

Show spanning-tree with a non-root switch

show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4466
             Cost        4
             Port        1 (GigabitEthernet0/0)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4477
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/0            Root FWD 4         128.1    P2p
Gi0/1            Desg FWD 4         128.2    P2p
Gi0/2            Altn BLK 4         128.3    P2p

Root ID includes Cost (path cost to root) and Port (local port reaching root). Bridge ID is local. Interface table: Gi0/0 is Root port (forwarding), Gi0/1 is Designated (forwarding), Gi0/2 is Alternate (blocking) – this is a redundant link providing backup.

Understanding the Output

The output shows STP details per VLAN. The Root ID section identifies the root bridge: priority (default 32768 + VLAN ID), MAC address, and optionally cost and port if this switch is not root. 'This bridge is the root' indicates the local switch is root.

The Bridge ID section shows the local switch's bridge priority and MAC. The Interface table lists each port with Role (Root, Designated, Alternate, Backup), Status (FWD=Forwarding, BLK=Blocking, LRN=Learning, LIS=Listening), Cost (path cost to root), and Type (P2p, Shr). Good values: Root and Designated ports should be FWD; Alternate/Backup should be BLK.

Watch for unexpected blocking or forwarding that could indicate a loop or misconfiguration.

Configuration Scenarios

Verify Root Bridge Election in a Small Network

A network administrator has configured two switches (SW1 and SW2) with redundant links and wants to ensure that SW1 is the root bridge for VLAN 10. The 'show spanning-tree' command is used to verify the root bridge ID and port roles.

Topology

SW1(Gi0/1)---Gi0/1(SW2)
SW1(Gi0/2)---Gi0/2(SW2)
VLAN 10 configured on both switches

Steps

1.Step 1: Access SW1 in privileged EXEC mode: SW1> enable
2.Step 2: Display STP information for VLAN 10: SW1# show spanning-tree vlan 10
3.Step 3: Examine the output to confirm that SW1 is the root bridge (Root ID matches Bridge ID).
4.Step 4: On SW2, run the same command to verify that its root port is pointing to SW1.

Configuration

! SW1 configuration (root bridge)
SW1(config)# spanning-tree vlan 10 priority 4096
SW1(config)# interface range GigabitEthernet0/1-2
SW1(config-if-range)# switchport mode trunk

! SW2 configuration
SW2(config)# spanning-tree vlan 10 priority 8192
SW2(config)# interface range GigabitEthernet0/1-2
SW2(config-if-range)# switchport mode trunk

Verify: On SW1: 'show spanning-tree vlan 10' should show 'Root ID Priority 4096, Address xxxx.xxxx.xxxx' and 'Bridge ID Priority 4096, Address xxxx.xxxx.xxxx' (same). On SW2: Root ID should show SW1's MAC and priority 4096, and one of the interfaces should be in 'Root' role (root port).

Watch out: If the root bridge is not the intended one, check that the priority is set correctly and that no other switch has a lower priority (including default 32768). Also ensure VLAN 10 is active on all trunks.

Troubleshoot a Blocked Port Causing Connectivity Loss

A user reports that devices in VLAN 20 cannot reach the server. The network has three switches in a triangle topology. The engineer suspects a port is incorrectly blocking due to STP. The 'show spanning-tree' command is used to identify the blocking port and its reason.

Topology

SW1(Gi0/1)---Gi0/1(SW2)
SW1(Gi0/2)---Gi0/2(SW3)
SW2(Gi0/2)---Gi0/3(SW3)
VLAN 20 on all switches

Steps

1.Step 1: Access SW1 and check STP for VLAN 20: SW1# show spanning-tree vlan 20
2.Step 2: Identify which ports are in blocking state (role: Altn or Back, state: BLK).
3.Step 3: Check the designated bridge for the blocking port to see if it is expected.
4.Step 4: On the switch with the blocking port, verify the root bridge and path cost.
5.Step 5: If the blocking port is unexpected, check for configuration errors (e.g., port cost misconfiguration, BPDU filter).

Configuration

! All switches have default STP settings
! SW1 configuration (root bridge for VLAN 20)
SW1(config)# spanning-tree vlan 20 priority 4096

! SW2 and SW3 use default priority 32768

Verify: Run 'show spanning-tree vlan 20' on each switch. Expected: SW1 shows all ports designated/forwarding. SW2 and SW3 should each have one root port (forwarding) and one alternate port (blocking). If a port is blocking incorrectly, check the root path cost and ensure the link is not a loop.

Watch out: A common mistake is forgetting that STP recalculates after topology changes. If a link goes down and comes back, STP may take 30-50 seconds to converge. Also, ensure that all switches are running the same STP version (PVST+ or Rapid PVST+).

Troubleshooting with This Command

When troubleshooting STP issues, the 'show spanning-tree' command is indispensable. A healthy output shows a single root bridge with all ports in appropriate roles: root ports (forwarding) on non-root switches, designated ports (forwarding) on root and segment, and alternate/backup ports (blocking) on redundant links. Problem indicators include multiple root bridges (indicates a BPDU filter or a Layer 2 loop), ports stuck in listening/learning (slow convergence), or unexpected blocking ports (causing connectivity loss).

Key fields to focus on are the Root ID (should be consistent across all switches in the VLAN), Bridge ID (local switch priority and MAC), port role (Root, Desg, Altn, Back), and port state (FWD, BLK, LIS, LRN). Common symptoms this command helps diagnose include: 1) 'No root bridge' – if the output shows 'This bridge is root' on multiple switches, there is a BPDU filter or a loop; 2) 'Port in blocking state' – if a port that should be forwarding is blocking, check for root path cost issues or a better path; 3) 'High CPU due to STP' – frequent TCNs (Topology Change Notifications) can be seen in the output with 'Topology change flag' set. A step-by-step diagnostic flow: First, run 'show spanning-tree vlan X' on the suspected root bridge to confirm it is the root.

If not, check the root ID and trace the path. Second, on each switch, identify the root port and ensure it is forwarding. If a switch has no root port, it may be isolated.

Third, look for alternate ports that are blocking; if a port that should be blocking is forwarding, a loop may occur. Fourth, check the 'Designated Bridge' field for each port to ensure the designated switch is the one with the best path. Correlate with 'show spanning-tree interface' for per-port details, 'show spanning-tree vlan X root' for quick root info, and 'debug spanning-tree events' for real-time changes.

If the output shows 'PortFast' enabled on trunk ports, it can cause loops; verify with 'show spanning-tree interface GiX/Y portfast'. Also, use 'show spanning-tree vlan X detail' to see timers and port costs. In large networks, pipe the output to 'include' to filter specific ports or VLANs.

Remember that STP is VLAN-aware; always specify the VLAN when troubleshooting per-VLAN issues. If the problem is intermittent, consider logging STP events with 'logging event spanning-tree'.

CCNA Exam Tips

CCNA exam tip: Remember that the root bridge has all ports as Designated (except the root port which doesn't exist on root).

CCNA exam tip: The priority shown includes the VLAN ID (sys-id-ext). Default priority is 32768 + VLAN ID.

CCNA exam tip: A port in 'BLK' (blocking) is normal for redundant links; a port stuck in 'LRN' or 'LIS' may indicate convergence issues.

CCNA exam tip: The 'Cost' field is the port's path cost to the root bridge; lower is better.

Common Mistakes

Mistake 1: Assuming all ports should be forwarding – blocking ports are normal for redundancy.

Mistake 2: Confusing the root bridge's MAC with the local bridge's MAC – check 'This bridge is the root'.

Mistake 3: Forgetting that STP runs per VLAN; a switch can be root for one VLAN and non-root for another.

show spanning-tree vs show spanning-tree vlan [vlan-id]

Both commands display Spanning Tree Protocol information but differ in VLAN scope. They are commonly confused because ‘show spanning-tree’ without a VLAN argument shows data for all VLANs, while adding ‘vlan [vlan-id]’ filters to a single VLAN. Understanding the scope difference is crucial for efficient troubleshooting.

Aspect	show spanning-tree	show spanning-tree vlan [vlan-id]
Scope	All VLANs (or default if none configured)	Specific VLAN only
Output Detail	Summarized; compact per-VLAN output for all VLANs	Detailed; expanded output for the selected VLAN
Performance Impact	Higher CPU/memory usage on large networks	Lightweight; only processes one VLAN
Typical Use	Quick overview of entire STP topology	Deep dive into a single VLAN’s STP state
VLAN Filtering	Cannot filter; shows all or default VLAN	Explicitly targets one VLAN
Root Bridge Info	Lists root for each VLAN separately	Shows root for that VLAN only

Use show spanning-tree when you need a broad view of STP across all VLANs to quickly identify anomalies.

Use show spanning-tree vlan [vlan-id] when you suspect a problem in a specific VLAN and need detailed port roles and states.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 series), the 'show spanning-tree' command syntax and output are largely identical to classic IOS, but there are minor differences in output formatting (e.g., 'VLAN' vs 'Vlan', and additional fields like 'OperEdge' for operational edge port status). The command is available in all privilege levels, but some parameters like 'detail' may require privileged EXEC. In NX-OS (e.g., Nexus switches), the equivalent command is 'show spanning-tree' with similar parameters, but the output is more concise and uses different terminology (e.g., 'port type' instead of 'role').

NX-OS also supports 'show spanning-tree vlan X' and 'show spanning-tree interface'. For ASA firewalls, STP is not typically used on routed ports, but if the ASA is in transparent firewall mode, the command 'show spanning-tree' is available in later versions (9.x+), though it is rarely used. In IOS-XR (e.g., ASR 9000), STP is not supported; instead, Ethernet networks use protocols like LACP or BFD for loop prevention.

Between IOS versions, the output has remained consistent from 12.x to 16.x, but newer versions (15.x and later) include additional fields for Rapid PVST+ and MSTP. For example, 'show spanning-tree vlan X' in 15.x shows 'OperEdge' and 'Role' more clearly. When upgrading from 12.x to 15.x, the command behavior is unchanged, but the output may include extra lines for features like PortFast and UplinkFast.

Always check the specific platform documentation for any deprecated parameters.

Related Commands

show spanning-tree detail

Displays detailed Spanning Tree Protocol (STP) information for all VLANs or a specific VLAN, including port roles, states, timers, and bridge IDs, used for troubleshooting STP convergence and topology changes.

show spanning-tree vlan [vlan-id]

Displays Spanning Tree Protocol (STP) information for a specific VLAN, including root bridge, port roles, and port states, used to verify STP topology and troubleshoot loops.

spanning-tree vlan [id] root primary

This command configures a switch as the root bridge for a specific VLAN by setting its bridge priority to 24576 (or lower if another switch has a lower priority), ensuring it becomes the root bridge in the Spanning Tree Protocol (STP) topology.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions