What is Bridge ID?

Understanding Bridge ID

A Bridge ID is an 8-byte identifier used by the Spanning Tree Protocol (STP) to uniquely identify each switch and elect the root bridge in a loop-free topology. It combines a configurable Bridge Priority with the switch's MAC address, and the switch advertising the numerically lowest Bridge ID wins the root bridge election.

The Bridge ID is structured as a 2-byte priority field plus a 6-byte MAC address. In modern STP variants like Rapid PVST+ and MSTP, the priority field is split into a 4-bit configurable priority (in steps of 4096) and a 12-bit System ID Extension that carries the VLAN or instance number, enabling a unique Bridge ID per VLAN. Switches exchange Bridge IDs inside Bridge Protocol Data Units (BPDUs); the lowest priority decides the root, with the lowest MAC address breaking ties.

The Bridge ID matters because root bridge placement dictates the entire spanning tree and therefore the forwarding paths of the network. If priorities are left at defaults, an old switch with a low MAC address may become root, forcing traffic onto suboptimal links. An attacker who connects a rogue switch advertising a superior (lower) Bridge ID can hijack the root role, redirecting traffic through their device for interception, which is why features like Root Guard and BPDU Guard protect Bridge ID election.

For example, a network engineer wants the core switch to be root for VLAN 10. They set its priority to 4096 so its Bridge ID (4096 + system ID extension 10 + MAC) is lower than every access switch's default of 32768. The core wins the election, all switches calculate shortest paths toward it, and Root Guard on access ports prevents any downstream device from advertising a lower Bridge ID and stealing the root role.