In which configuration mode is show spanning-tree vlan [vlan-id] used?

The show spanning-tree vlan [vlan-id] command is entered in Privileged EXEC mode on Cisco IOS devices.

Spanning TreePrivileged EXEC

show spanning-tree vlan [vlan-id]

Displays Spanning Tree Protocol (STP) information for a specific VLAN, including root bridge, port roles, and port states, used to verify STP topology and troubleshoot loops.

Definition: show spanning-tree vlan [vlan-id] is a Cisco IOS privileged exec command. Displays Spanning Tree Protocol (STP) information for a specific VLAN, including root bridge, port roles, and port states, used to verify STP topology and troubleshoot loops.

Overview

The `show spanning-tree vlan [vlan-id]` command is a fundamental tool for any network engineer working with Spanning Tree Protocol (STP) in Cisco IOS environments. STP is a Layer 2 protocol that prevents loops in Ethernet networks by creating a loop-free logical topology. It does this by electing a root bridge and placing redundant ports in blocking or forwarding states.

This command displays the STP status for a specific VLAN, including the root bridge ID, local bridge ID, port roles (root, designated, alternate, backup), and port states (forwarding, learning, blocking, listening, disabled). It is essential for verifying STP topology, troubleshooting connectivity issues caused by loops, and ensuring that the expected root bridge is elected. You would use this command when you suspect a bridging loop (e.g., high CPU on switches, broadcast storms, intermittent connectivity) or when you need to confirm that STP is converging correctly after a topology change.

Alternatives include `show spanning-tree` (displays all VLANs), `show spanning-tree detail` (more verbose), and `show spanning-tree interface` (port-specific). This command fits into the broader workflow of initial switch configuration, network changes (adding links), and ongoing monitoring. In terms of IOS behavior, the output can be lengthy for large VLANs; you can use the `| include` or `| section` filters to narrow results.

The command requires privileged EXEC mode (enable) and does not affect the running configuration. It is available in all IOS versions, including IOS-XE, but output formatting may vary slightly. Understanding this command is critical for CCNA and CCNP candidates, as STP is a core topic in both certifications.

Syntax·Privileged EXEC

show spanning-tree vlan [vlan-id]

When to Use This Command

Verify which switch is the root bridge for a VLAN after a network change.
Check if a specific port is in blocking or forwarding state to troubleshoot connectivity issues.
Identify alternate or backup ports for redundancy planning.
Confirm STP convergence after adding or removing VLANs.

Parameters

Parameter	Syntax	Required	Description
vlan-id	<1-4094>	Required	Specifies the VLAN for which to display STP information. Valid values are from 1 to 4094, but only VLANs that exist on the switch will show data. Common mistakes include using a VLAN that is not created or forgetting that VLAN 1 is the default. Ensure the VLAN is active on the switch.

Command Examples

Show spanning tree for VLAN 10

show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    24586
             Address     0011.2233.4455
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    24586  (priority 24576 sys-id-ext 10)
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Root FWD 4         128.2    P2p
Gi0/3               Altn BLK 4         128.3    P2p

VLAN0010: VLAN identifier. Spanning tree enabled protocol ieee: STP mode is 802.1D. Root ID: priority 24586 (24576 base + 10 sys-id-ext), MAC 0011.2233.4455, 'This bridge is the root' indicates this switch is root. Bridge ID: local bridge priority (same as root). Interface: port name. Role: Desg (Designated), Root, Altn (Alternate). Sts: FWD (Forwarding), BLK (Blocking). Cost: path cost to root. Prio.Nbr: port priority and number. Type: P2p (point-to-point link).

Show spanning tree for VLAN 20 on a non-root switch

show spanning-tree vlan 20

VLAN0020
  Spanning tree enabled protocol ieee
  Root ID    Priority    24596
             Address     0011.2233.4466
             Cost        4
             Port        2 (GigabitEthernet0/2)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4477
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Root FWD 4         128.2    P2p
Gi0/3               Altn BLK 4         128.3    P2p

Root ID shows priority 24596 (24576+20), MAC 0011.2233.4466, cost 4 to root via port Gi0/2. Bridge ID priority 32778 (32768+10) indicates this is not root. Port roles: Gi0/1 is Designated (forwarding), Gi0/2 is Root (forwarding), Gi0/3 is Alternate (blocking).

Understanding the Output

The output first shows the VLAN number and STP protocol (ieee for 802.1D, pvst for PVST+, rapid-pvst for RSTP). The Root ID section displays the root bridge's priority (including VLAN sys-id-ext), MAC address, and if this switch is the root. For non-root switches, it shows cost and port to reach root.

The Bridge ID section shows the local switch's priority and MAC. The interface table lists each port with Role (Root, Designated, Alternate, Backup), Status (FWD, BLK, LRN, LIS), Cost (path cost to root), and Type (P2p, Shr). In a healthy network, all ports should be either FWD or BLK; LRN is transient.

A root port should be FWD, designated ports FWD, alternate/backup ports BLK. Unexpected BLK on a root or designated port indicates a problem. High cost values may cause suboptimal path selection.

Configuration Scenarios

Verify Root Bridge Election in a Small Network

A network engineer has configured three switches (SW1, SW2, SW3) with redundant links. They want to verify that SW1 is the root bridge for VLAN 10 as intended.

Topology

SW1(Gi0/1)---Gi0/1(SW2)---Gi0/2(SW3)
SW1(Gi0/2)---Gi0/1(SW3)

Steps

1.Step 1: Enter privileged EXEC mode on SW1: SW1> enable
2.Step 2: Display STP information for VLAN 10: SW1# show spanning-tree vlan 10
3.Step 3: Examine the output. Look for 'This bridge is the root' in the first line to confirm SW1 is root.
4.Step 4: Check the root bridge ID (priority + MAC) and local bridge ID. They should match if this switch is root.
5.Step 5: Verify port roles: root ports (on non-root switches) should be forwarding, designated ports should be forwarding, and alternate ports should be blocking.

Configuration

! No configuration needed for this verification scenario.
! However, to ensure SW1 becomes root, you might set priority:
SW1(config)# spanning-tree vlan 10 priority 4096

Verify: SW1# show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 4096 Address 0011.2233.4455 This bridge is the root Bridge ID Priority 4096 Address 0011.2233.4455 ...

Watch out: If the root bridge ID shows a different MAC address, another switch with lower priority or MAC is root. Check all switches' STP configurations.

Troubleshoot a Bridging Loop in VLAN 20

Users in VLAN 20 report slow network and intermittent connectivity. The engineer suspects a bridging loop due to a misconfiguration or redundant link not blocked by STP.

Topology

SW-A(Gi0/1)---Gi0/1(SW-B)---Gi0/2(SW-C)
SW-A(Gi0/2)---Gi0/2(SW-C)

Steps

1.Step 1: Enter privileged EXEC mode on SW-A: SW-A> enable
2.Step 2: Check STP status for VLAN 20: SW-A# show spanning-tree vlan 20
3.Step 3: Look for ports in 'blocking' or 'listening' state. If all ports are forwarding, a loop may exist.
4.Step 4: Check the root bridge ID. If it is unexpected (e.g., a low-end switch), it may cause suboptimal topology.
5.Step 5: Verify port roles: ensure one redundant link is in alternate (blocking) state. If both are designated/root, a loop is present.
6.Step 6: Use 'show spanning-tree vlan 20 detail' to see timers and topology changes.

Configuration

! To fix a loop, ensure STP is enabled and port costs are set appropriately.
! Example: change port cost on a redundant link to force blocking:
SW-A(config)# interface gigabitethernet 0/2
SW-A(config-if)# spanning-tree cost 100

Verify: After configuration, verify with: SW-A# show spanning-tree vlan 20 VLAN0020 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 0050.7966.6800 This bridge is the root Bridge ID Priority 32768 Address 0050.7966.6800 Interface Role Sts Cost Prio.Nbr Type Gi0/1 Desg FWD 19 128.1 P2p Gi0/2 Desg FWD 100 128.2 P2p If both are forwarding, loop exists. After cost change, one should be BLK.

Watch out: If STP is disabled globally or per VLAN, the command will show 'No spanning tree instance exists'. Ensure STP is enabled with 'spanning-tree vlan vlan-id'.

Troubleshooting with This Command

When using `show spanning-tree vlan [vlan-id]` for troubleshooting, the first thing to check is whether the switch considers itself the root bridge. The line 'This bridge is the root' indicates that the local switch is the root for that VLAN. If not, the root bridge ID (priority and MAC) is displayed.

A healthy STP topology will have a single root bridge, and all other switches will have a root port (the best path to the root) in forwarding state. Port roles are critical: root ports (RP) and designated ports (DP) should be forwarding; alternate ports (ALT) and backup ports (BKUP) should be blocking. If you see a port in 'listening' or 'learning' state for an extended period, STP is converging.

Common symptoms this command helps diagnose include: (1) All ports forwarding on a switch with redundant links – this indicates a loop, often due to STP disabled or misconfiguration. (2) Unexpected root bridge – a switch with lower priority or MAC address may become root, causing suboptimal paths. (3) Ports stuck in blocking or listening – may indicate a BPDU filter or guard issue. (4) High 'Topology Changes' count – indicates instability, possibly due to flapping links. A step-by-step diagnostic flow: 1. Identify the VLAN experiencing issues. 2.

Run `show spanning-tree vlan [vlan-id]` on each switch in the path. 3. Compare root bridge IDs – they should all agree on the same root. 4. On each switch, verify that the root port is pointing to the correct neighbor. 5.

Check for any ports in blocking state that should be forwarding (or vice versa). 6. If loops persist, check for BPDU filter/guard configurations, or use `debug spanning-tree events` (with caution) to see BPDU exchanges. Correlate with `show interfaces` to check for errors or flapping.

Also, `show spanning-tree vlan [vlan-id] detail` provides additional info like timers and port costs. Remember that STP operates per VLAN, so a problem in one VLAN may not affect others. Always verify that STP is enabled globally and per VLAN; use `show spanning-tree` to see all VLANs.

In modern networks, Rapid PVST+ is common, but the command output is similar. If you see 'Spanning tree enabled protocol ieee' it's classic STP; 'rstp' indicates Rapid PVST+. The command is safe to run in production and does not impact performance significantly.

CCNA Exam Tips

Remember that the root bridge is identified by lowest bridge ID (priority + MAC). The priority is a multiple of 4096 (or 0-61440 in increments of 4096) plus VLAN ID for PVST+.

On CCNA exam, you may be asked to determine which port is root port based on lowest path cost to root bridge.

Be able to identify STP port states: Blocking (20 sec), Listening (15 sec), Learning (15 sec), Forwarding. Only forwarding ports send/receive data.

Know that 'show spanning-tree vlan' is used to verify STP convergence; if a port stays in blocking unexpectedly, check for configuration errors or loops.

Common Mistakes

Assuming the switch with the lowest MAC is always root; priority is compared first.

Forgetting that VLAN 1 is default and STP runs per VLAN; changes in one VLAN don't affect others.

Misinterpreting 'Altn' as 'Alternate' (RSTP) vs 'Backup' (classic STP); alternate provides alternate path to root, backup provides backup to designated port.

show spanning-tree vlan [vlan-id] vs show spanning-tree

Both commands display STP information, but they are commonly confused because 'show spanning-tree' without options also supports a VLAN argument. The explicit 'vlan' keyword version is more targeted for a single VLAN.

Aspect	show spanning-tree vlan [vlan-id]	show spanning-tree
Scope	Single VLAN	All VLANs (or optionally specific VLAN)
Output detail	Same detail per VLAN, only one	Same detail per VLAN, aggregated for all
Performance impact	Minimal	Potentially high in large networks
Primary use	Focused troubleshooting on one VLAN	Broad overview of STP health

Use show spanning-tree vlan [vlan-id] when you need to inspect the STP state for a specific VLAN without the clutter of other VLANs.

Use show spanning-tree when you want a quick overview of all VLANs' STP topology or when you are not sure which VLAN to investigate.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 series), the `show spanning-tree vlan [vlan-id]` command syntax and output are very similar to classic IOS. However, IOS-XE may include additional fields like 'Operational' status for MST instances. For NX-OS (e.g., Nexus switches), the equivalent command is `show spanning-tree vlan [vlan-id]` as well, but the output format differs: it uses a more compact table and includes 'VLAN' header.

NX-OS also supports MST and Rapid PVST+. For ASA firewalls, STP is not typically used; instead, ASA uses transparent bridging with no STP, so this command does not exist. In IOS-XR (e.g., ASR 9000), STP is not supported in the same way; instead, it uses Ethernet OAM and other loop prevention mechanisms.

The command is not available in IOS-XR. Between IOS versions, there are minor differences: in 12.x, the output shows 'Port 1 (GigabitEthernet0/1)' while in 15.x and 16.x, it shows 'Interface' column. Also, newer versions support 'show spanning-tree vlan [vlan-id] | begin Interface' to jump to port details.

Always check the specific platform documentation for exact syntax. For CCNA/CCNP, focus on classic IOS and IOS-XE, as NX-OS is covered in DC track.

Related Commands

show spanning-tree

Displays the Spanning Tree Protocol (STP) state and configuration for all VLANs or a specific VLAN, used to verify root bridge, port roles, and STP topology.

show spanning-tree detail

Displays detailed Spanning Tree Protocol (STP) information for all VLANs or a specific VLAN, including port roles, states, timers, and bridge IDs, used for troubleshooting STP convergence and topology changes.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions