What is Root Port?

Understanding Root Port

A root port is the one port on a non-root switch that provides the lowest-cost path toward the root bridge in a Spanning Tree Protocol (STP) topology. Every switch except the root bridge elects exactly one root port, and STP keeps that port in the forwarding state so the switch always has a loop-free route to the root.

The root port is chosen by comparing the accumulated path cost in the Bridge Protocol Data Units (BPDUs) a switch receives on each port. Costs are based on link speed (for example, 4 for 1 Gbps and 2 for 10 Gbps under the long-cost scheme defined in IEEE 802.1D-2004). The port advertising the lowest total cost to the root wins. If two ports tie, STP breaks the tie using the lowest sender bridge ID, then the lowest sender port ID. All other non-designated ports that could create loops are placed in a blocking state.

This matters for security and stability because a loop-free Layer 2 topology prevents broadcast storms and MAC table instability that can crash a network. Attackers can also abuse STP: by sending crafted BPDUs claiming a superior bridge ID, a rogue device can force itself to become root and reroute traffic for interception. Protections such as Root Guard, BPDU Guard, and BPDU Filter defend the legitimate root and edge ports against this manipulation.

For example, a distribution switch has two uplinks: a 10 Gbps link to the core (cost 2) and a 1 Gbps backup link to another switch (cost 4). STP selects the 10 Gbps port as the root port and keeps it forwarding, while the 1 Gbps port is blocked to prevent a loop. If the 10 Gbps link fails, STP recalculates and promotes the backup port to root port, restoring connectivity to the root bridge. Understanding root port election is core CCNA and switching exam material.