RSTP

What is RSTP?

RSTP (Rapid Spanning Tree Protocol) is a layer 2 network protocol from the IEEE 802.1 family that automatically selects a single loop-free tree in an Ethernet network with redundant links and, when a failure occurs, activates a backup path within milliseconds to seconds. It was introduced in 2001 as IEEE 802.1w, the faster successor to the classic Spanning Tree Protocol (STP), and was incorporated into IEEE 802.1D-2004, which made the old STP obsolete. In OT networks, RSTP is the topology-independent baseline for network redundancy between switches.

Without RSTP or another redundancy protocol, every duplicate link between switches causes a broadcast storm: a single broadcast frame circulates endlessly and brings the entire network down.

🧠 Why does a redundant network need RSTP?

A switch forwards frames with an unknown destination address, and all broadcasts, out of every port. If switches form a loop, such a frame returns from the other side and is forwarded again. Ethernet frames have no hop limit, so the traffic grows exponentially until all bandwidth is consumed and MAC address tables keep flapping. For PLCs, HMIs and SCADA servers this means timeouts, lost I/O connections and, in the worst case, a process interruption.

Yet process plants want redundant paths precisely so that one broken cable or failed switch does not interrupt communication. RSTP resolves this conflict: the physical loop stays in place, but logically one port per loop is blocked. When an active path fails, RSTP releases the blocked port. RSTP also protects against an accidental loop created by a misplaced patch cable during maintenance.

🔧 How does RSTP work?

RSTP builds a spanning tree using BPDUs (Bridge Protocol Data Units), small management frames that every switch sends to its neighbours each hello time (2 seconds by default).

1. Elect the root bridge - the switch with the lowest Bridge ID becomes the root of the tree. The Bridge ID consists of a configurable priority (32768 by default, in steps of 4096) plus the MAC address.
2. Calculate path costs - each switch determines its cheapest path to the root. The recommended costs are 2,000,000 for 10 Mbit/s, 200,000 for 100 Mbit/s, 20,000 for 1 Gbit/s and 2,000 for 10 Gbit/s.
3. Assign port roles - each port receives a role (see the table below). Ports that would close a loop go to the discarding state.
4. Switch over quickly - on point-to-point links (full duplex), RSTP uses a proposal/agreement handshake: neighbours actively confirm that a port can safely forward, without waiting for timers.
5. Signal a topology change - when a non-edge port moves to forwarding, the switch sends BPDUs with a TC (topology change) flag. Switches receiving that notice flush the learned MAC addresses on their other ports, so traffic follows the new path immediately.

STP had five port states (disabled, blocking, listening, learning, forwarding). RSTP has just three: discarding, learning and forwarding. An alternate port is therefore not “off”: it still receives BPDUs and can take over the root port role immediately when a failure occurs. An edge port goes straight to forwarding, but loses that status as soon as a BPDU arrives on it.

RSTP operates at layer 2 of the OSI model and is therefore transparent to higher-layer protocols such as Modbus TCP, OPC UA and IP.

⏱️ How quickly does RSTP recover from a failure?

RSTP recovery time is not a single fixed number; it depends on three factors:

• Link failure detection time - if the switch physically detects that a link has gone down, RSTP acts at once. If it only notices that BPDUs have stopped, detection takes three hello intervals, 6 seconds by default.
• Number of switches in the path - in a ring, the new information has to be passed on and confirmed switch by switch. Each proposal/agreement pair takes a few milliseconds.
• Legacy equipment - if an RSTP port hears classic STP BPDUs, that port falls back to 802.1D behaviour and the speed advantage is lost.

In 2007 Siemens RUGGEDCOM published a worst-case calculation for a ring of N switches with a single link failure: detection time plus (N − 3) times the handshake time for an even number of switches. With that vendor’s values (5 ms per handshake, around 5 ms detection on 100BASE-TX), a ring of 20 switches comes to roughly 90 ms. According to the same source, however, link detection on copper 1000BASE-T takes around 700 ms, pushing total recovery towards one second. Failure of the root bridge itself takes almost twice as long in the worst case; adjusting RSTP parameters can bring it back to the link-failure time. Much older literature quotes recovery times of several seconds. That figure belongs to the original 802.1w version; the revised RSTP in IEEE 802.1D-2004 is considerably faster. IEC 62439-1 contains a standardised method for calculating and measuring the maximum RSTP recovery time in a ring.

Max Age (20 by default, 40 at most) effectively limits the number of switches the root information can cross in RSTP. Large rings of dozens of switches run into this limit, which is why vendors offer their own extensions, such as eRSTP from Siemens RUGGEDCOM, which according to the vendor supports a network diameter four times as large.

🔄 What is the difference between RSTP, STP, MRP and PRP?

DLR (Device Level Ring) is the ring protocol of IP and recovers within about 3 ms. Never run RSTP and a ring protocol such as MRP on the same ring ports at the same time: two mechanisms that both block ports work against each other. A common design is a fast ring with MRP or DLR in the cell zone and RSTP in the distribution network above it.

🏭 Where is RSTP used in industry?

• Distribution and backbone networks - between industrial switches in plant industrial Ethernet networks where the topology is not a pure ring
• IT/OT coupling - RSTP is an open IEEE standard that office switches also speak, which is useful at the boundary with the supervisory network
• Energy and infrastructure - substations, wind farms and tunnels often use RSTP in rings of fibre-optic switches; for IEC 61850 process buses with strict requirements, PRP or HSR is preferred
• Mixed vendors - where switches from different brands must work together, RSTP is often the only common redundancy protocol
• Protection against cabling errors - even in networks without deliberate redundancy, RSTP prevents a single misplaced patch cable from causing a broadcast storm

🔐 How do you secure RSTP?

BPDUs are not authenticated. Any device that sends BPDUs with a lower priority can put itself forward as the new root bridge. An attacker, or a misconfigured laptop switch, can thereby redirect traffic (spoofing and man-in-the-middle) or use a stream of topology changes to keep flushing MAC tables, flooding the network. The following measures are switch vendor features, not part of the IEEE standard itself:

• BPDU Guard - disables an edge port as soon as a BPDU arrives; enable it on all ports facing end devices
• Root Guard - prevents a new root bridge from being accepted via a port towards another switch; on a superior BPDU the switch blocks that port until those BPDUs stop
• Fixed root priority - deliberately give the intended root bridge and a backup the lowest priority, rather than letting the lowest MAC address decide
• Disable unused ports - and combine with port security, ACLs and VLANs
• Monitoring - report topology changes and root changes via SNMP or Syslog to a SIEM or network monitoring; a TAP enables passive analysis

Network redundancy and this hardening fit into the zones and conduits approach of IEC 62443 and into network segmentation following the Purdue Model.

🛠️ How do you set up RSTP in an OT network?

1. Draw the topology - determine which loops are intentional and where ring protocols such as MRP or DLR are already running.
2. Choose the root bridge - usually a central core or distribution switch; set priority 4096, and 8192 for the backup.
3. Configure edge ports - set all ports to PLCs, HMIs and drives as edge ports, with BPDU Guard.
4. Keep all switches on RSTP - replace or isolate devices that only speak classic STP.
5. Calculate and test recovery time - pull cables during a FAT or SAT and measure whether I/O connection timeouts are exceeded.
6. Record the configuration - under change management, so a replacement switch does not become root with its default priority.

❓ Frequently asked questions

Is RSTP the same as STP?

No, RSTP is the faster successor to STP. Where STP needs 30 to 50 seconds after a failure, RSTP usually recovers within a second thanks to an active handshake between switches. RSTP is backward compatible, but falls back per port to slow STP behaviour when an old STP switch is connected.

How fast is RSTP?

RSTP recovery time ranges from a few tens of milliseconds to several seconds. It depends on how quickly a link failure is detected, the number of switches in the ring and the configuration of the root bridge. Unlike MRP, RSTP does not offer a guaranteed maximum recovery time.

Can I use RSTP and MRP in the same network?

Yes, RSTP and MRP can coexist in the same network, but not on the same ring ports. A common design uses MRP for a fast PROFINET ring and RSTP for the network above it. Two redundancy protocols managing the same loop block each other’s ports and cause outages.

What is the difference between RSTP and MSTP?

MSTP (Multiple Spanning Tree Protocol, originally IEEE 802.1s) builds on RSTP and can calculate a separate spanning tree per group of VLANs. RSTP uses a single tree for all VLANs. In OT networks RSTP is usually sufficient; MSTP is mostly found in large IT campus networks.

What is a root bridge in RSTP?

The root bridge is the switch with the lowest Bridge ID, acting as the root of the spanning tree. All other switches calculate their cheapest path to this root. Set the root bridge priority deliberately, so that an old or poorly placed switch does not take that role by chance.

Is RSTP secure?

RSTP itself has no authentication: any device can send BPDUs and thereby influence the topology. Switch features such as BPDU Guard and Root Guard limit that risk on ports facing end devices and untrusted switches. Combine this with monitoring of topology changes for proper security.

📌 In summary

• Purpose - RSTP enables redundant Ethernet paths without broadcast storms
• Standard - IEEE 802.1w (2001), incorporated into IEEE 802.1D-2004
• Operation - root bridge, port roles and a proposal/agreement handshake
• Recovery time - milliseconds to seconds, depending on link detection and network size, not guaranteed
• Security - BPDU Guard, Root Guard, fixed root priority and monitoring

RSTP is the open, topology-independent redundancy protocol for Ethernet that prevents loops and usually activates a backup path within a second when a failure occurs. For guaranteed recovery times in rings choose MRP or DLR; for seamless redundancy choose PRP or HSR.