RSTP, MST, Root Guard & BPDU Guard Quick Reference

RSTP (802.1w) converges in seconds instead of 802.1D's 30-50 seconds, mainly through edge ports (host-facing ports that skip the listening/learning delay) and a proposal/agreement handshake between switches that lets a new root or designated port move to forwarding almost immediately once both sides agree.

MST (802.1s) maps many VLANs onto a small number of spanning-tree instances, so a switch with hundreds of VLANs doesn't need to compute hundreds of separate trees. Switches must match exactly on three region-identity elements — name, revision number, and VLAN-to-instance mapping — or they're treated as separate regions. A mismatch in even one of these (a single VLAN mapped differently, or just the revision number left at a stale value) is enough to break region agreement, even if everything else matches.

Root Guard: applied on a port where you never expect a superior BPDU (typically distribution-facing-access). Triggers on a superior BPDU only. Blocks the port (root-inconsistent state) and self-clears automatically once the superior BPDUs stop.

BPDU Guard: applied on a port that should never see any BPDU at all (typically an access port with PortFast). Triggers on any BPDU. Err-disables the port — a hard shutdown requiring manual 'shutdown'/'no shutdown' or configured auto-recovery, not a self-clearing response.