Ping Labz

STP Port Roles Explained: Root, Designated, Blocked, and Alternate

STP port roles determine which ports forward traffic and which block. Understanding root, designated, blocked, and alternate ports is essential to predicting network behavior and troubleshooting convergence issues.

STP Port Roles Explained: Root, Designated, Blocked, and Alternate - PingLabz STP article title card

The Four Port Roles

In a spanning tree, every port on every switch has one of four roles:

(This article is part of the PingLabz STP series - the full spanning-tree guide maps the whole cluster in reading order.)

  • Root Port (RP): The single port on non-root switches with the best (lowest cost) path back to the root bridge
  • Designated Port (DP): The port on each network segment closest to the root (lowest cost to root among ports on that segment)
  • Alternate Port (AP): A port that could become root port if the current root port fails; currently blocked
  • Backup Port (BP): A port on the same segment as the designated port; blocked (rare in modern topologies)

(The terms "blocked" and "alternate" are often used interchangeably; the distinction matters mostly in Rapid STP.)

Root Port Selection

The root port is the single best path from a switch back to the root bridge. Selection criteria (in order):

  1. Lowest root path cost (sum of link costs from this switch to the root)
  2. Lowest upstream bridge ID (tie-breaker: which neighbor advertises the lower BID?)
  3. Lowest upstream port ID (tie-breaker: which port on that neighbor?)
  4. Lowest local port ID (tie-breaker: which of this switch's ports is lowest-numbered?)

Example: Selecting Root Port

Lab topology, built in my home lab on four Cisco IOL-L2 switches (IOS XE 17.18.2) running rapid PVST+ with the short path-cost method. IOL ports run at 10 Mbps, so I set the port costs by hand: 4 (the 1 Gbps value) on most links and 19 (the 100 Mbps value) on Link F. SW1 has priority 4096 and is the root. These are the SW1–SW2 links:

[SW1] ← Root (BID: 4097.aabb.cc00.0100, priority 4096 + VLAN 1)
  |
  ├─ Link A (cost 4):  SW1 Et0/1 to SW2 Et0/1
  │
  ├─ Link E (cost 4):  SW1 Et0/3 to SW2 Et0/3 (direct, parallel link)
  │
  └─ Link F (cost 19): SW1 Et1/0 to SW2 Et1/0
STP lab diagram: SW1 (4097.aabb.cc00.0100) is the root with every port designated. SW2 and SW3 take root ports Et0/1 at cost 4, and SW4 takes Et0/1 toward SW2 at cost 8. The SW2 ends of parallel Links E (Et0/3) and F (Et1/0, cost 19) and SW4 Et0/2 on Link D are alternate ports, blocking.

SW2 has three ports facing SW1. All three hear the same root (SW1), a designated path cost of 0 and a different sender port ID:

SW2# show spanning-tree vlan 1 detail | include Port [0-9]|Port path cost|Designated root|Designated bridge|Designated port id|BPDU
 Port 2 (Ethernet0/1) of VLAN0001 is root forwarding
   Port path cost 4, Port priority 128, Port Identifier 128.2.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 4097, address aabb.cc00.0100
   Designated port id is 128.2, designated path cost 0
   BPDU: sent 9, received 52
 Port 4 (Ethernet0/3) of VLAN0001 is alternate blocking
   Port path cost 4, Port priority 128, Port Identifier 128.4.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 4097, address aabb.cc00.0100
   Designated port id is 128.4, designated path cost 0
   BPDU: sent 4, received 52
 Port 5 (Ethernet1/0) of VLAN0001 is alternate blocking
   Port path cost 19, Port priority 128, Port Identifier 128.5.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 4097, address aabb.cc00.0100
   Designated port id is 128.5, designated path cost 0
   BPDU: sent 4, received 52

The root path cost through each port is 0 plus the local port cost: 4, 4 and 19. Tie-breaking:

  1. Et1/0 is out on cost: 19 against 4 for the other two
  2. Et0/1 and Et0/3 come from the same upstream BID (SW1's), so upstream BID is tied
  3. Compare upstream port IDs: 128.2 < 128.4 → Et0/1 wins
SW2# show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    4097
             Address     aabb.cc00.0100
             Cost        4
             Port        2 (Ethernet0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0200
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/1               Root FWD 4         128.2    P2p
Et0/2               Desg FWD 4         128.3    P2p
Et0/3               Altn BLK 4         128.4    P2p
Et1/0               Altn BLK 19        128.5    P2p

Real-World Scenario: Two Root Paths

              [SW1]  Root, BID 4097.aabb.cc00.0100
             /     \
        Link A     Link B
           /         \
       [SW2]         [SW3]
           \         /
        Link C     Link D
             \     /
              [SW4]

Link A: SW1 Et0/1 - SW2 Et0/1  (cost 4)
Link B: SW1 Et0/2 - SW3 Et0/1  (cost 4)
Link C: SW2 Et0/2 - SW4 Et0/1  (cost 4)
Link D: SW3 Et0/2 - SW4 Et0/2  (cost 4)

SW2 32769.aabb.cc00.0200, SW3 32769.aabb.cc00.0300, SW4 32769.aabb.cc00.0400
(SW1 and SW2 are also joined by Links E and F from the previous example.)

SW4 sees BPDUs from both directions:

Via SW2 (Link C):

Root cost = 4 (SW1 to SW2, Link A) + 4 (SW2 to SW4, Link C) = 8
Upstream bridge: SW2 (32769.aabb.cc00.0200)
Upstream port: 128.3 (SW2 Et0/2)

Via SW3 (Link D):

Root cost = 4 (SW1 to SW3, Link B) + 4 (SW3 to SW4, Link D) = 8
Upstream bridge: SW3 (32769.aabb.cc00.0300)
Upstream port: 128.3 (SW3 Et0/2)

Root path costs are equal. Tie-breaker: lowest upstream bridge ID:

SW2 BID: 32769.aabb.cc00.0200
SW3 BID: 32769.aabb.cc00.0300

SW2 < SW3 (lower MAC), so SW4 selects Et0/1, the port facing SW2, as its root port
SW4# show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    4097
             Address     aabb.cc00.0100
             Cost        8
             Port        2 (Ethernet0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0400
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/1               Root FWD 4         128.2    P2p
Et0/2               Altn BLK 4         128.3    P2p

SW4# show spanning-tree vlan 1 detail | include Port [0-9]|Port path cost|Designated root|Designated bridge|Designated port id|BPDU
 Port 2 (Ethernet0/1) of VLAN0001 is root forwarding
   Port path cost 4, Port priority 128, Port Identifier 128.2.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 32769, address aabb.cc00.0200
   Designated port id is 128.3, designated path cost 4
   BPDU: sent 13, received 55
 Port 3 (Ethernet0/2) of VLAN0001 is alternate blocking
   Port path cost 4, Port priority 128, Port Identifier 128.3.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 32769, address aabb.cc00.0300
   Designated port id is 128.3, designated path cost 4
   BPDU: sent 8, received 55

Designated Port Selection

A designated port is the forwarding port on a segment (link) closest to the root. Only one port per segment can be designated.

Selection criteria (in order):

  1. Lowest root path cost among all ports on that segment
  2. Lowest bridge ID of the switch behind that port (if root path costs tie)
  3. Lowest port ID on that switch (if bridge IDs tie)

Link D, between SW3 and SW4 in the earlier topology:

SW3 Et0/2: root path cost 4 (SW3's root port is Et0/1, Link B)
SW4 Et0/2: root path cost 8 (SW4's root port is Et0/1, via SW2)

SW3's port has the lower root path cost (4 < 8), so SW3 Et0/2 is the designated port on Link D and forwards. SW4's root port is Et0/1 (towards SW2), so SW4 Et0/2 is neither root nor designated: it becomes an alternate port and blocks. The lab output confirms it:

SW3# show spanning-tree vlan 1
...
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/1               Root FWD 4         128.2    P2p
Et0/2               Desg FWD 4         128.3    P2p

SW4# show spanning-tree vlan 1
...
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/1               Root FWD 4         128.2    P2p
Et0/2               Altn BLK 4         128.3    P2p

When two switches are connected by multiple parallel links (not yet bundled into an EtherChannel), the root-side ports are all designated, but the other switch uses only one of them as its root port. The rest block as alternates:

[SW1] Et0/1 ──── Link A ──── Et0/1 [SW2]
      Et0/3 ──── Link E ──── Et0/3

Both links have a cost of 4:

  • Link A: SW1 Et0/1 (port ID 128.2) to SW2 Et0/1
  • Link E: SW1 Et0/3 (port ID 128.4) to SW2 Et0/3

SW1 is root:

Link A:
  SW1 Et0/1: root bridge port, port ID 128.2 → Designated
  SW2 Et0/1: root cost 4, receives upstream port ID 128.2 → Root port

Link E:
  SW1 Et0/3: root bridge port, port ID 128.4 → Designated
  SW2 Et0/3: root cost 4, receives upstream port ID 128.4 → Alternate (blocking)

Both of SW2's ports have the same cost (4) to root and the same upstream bridge (SW1), so the tie falls through to the upstream port ID (128.2 vs 128.4). The port receiving the BPDU from the lower upstream port ID (128.2) becomes the root port. Link F (cost 19) loses on cost before any tie-break. On SW1, the root, every port is designated:

SW1# show spanning-tree vlan 1
...
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/1               Desg FWD 4         128.2    P2p
Et0/2               Desg FWD 4         128.3    P2p
Et0/3               Desg FWD 4         128.4    P2p
Et1/0               Desg FWD 19        128.5    P2p

SW2# show spanning-tree vlan 1
...
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/1               Root FWD 4         128.2    P2p
Et0/2               Desg FWD 4         128.3    P2p
Et0/3               Altn BLK 4         128.4    P2p
Et1/0               Altn BLK 19        128.5    P2p

This is why Cisco recommends bundling parallel links into EtherChannel. Without it, you're wasting bandwidth.

Alternate and Backup Ports

Alternate Port

An alternate port is a blocked port that has a better path to the root than the designated port on its segment. It's essentially a "secondary root port candidate."

[SW1] ── Link B ── [SW3]
  |                   |
Link A             Link D
  |                   |
[SW2] ── Link C ── [SW4]

SW4 Et0/1 (Link C, via SW2) = root port
SW4 Et0/2 (Link D, via SW3) = alternate port

SW4 has two paths to the root at the same cost of 8. Et0/1 via SW2 is the root port, and Et0/2 via SW3 is the alternate, blocked so the square doesn't loop. When I shut SW4 Et0/1, Et0/2 took over as root port at the same cost, and the root port moved back to Et0/1 when the link came back:

SW4# configure terminal
SW4(config)# interface Ethernet0/1
SW4(config-if)# shutdown
SW4(config-if)# end
SW4# show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    4097
             Address     aabb.cc00.0100
             Cost        8
             Port        3 (Ethernet0/2)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0400
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/2               Root FWD 4         128.3    P2p
SW4# show spanning-tree vlan 1 root

                                        Root    Hello Max Fwd
Vlan                   Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
VLAN0001          4097 aabb.cc00.0100         8    2   20  15  Et0/2
SW4# configure terminal
SW4(config)# interface Ethernet0/1
SW4(config-if)# no shutdown
SW4(config-if)# end
SW4# show spanning-tree vlan 1 root

                                        Root    Hello Max Fwd
Vlan                   Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
VLAN0001          4097 aabb.cc00.0100         8    2   20  15  Et0/1

Backup Port

A backup port is less common - it's a blocked port on the same segment as the designated port, but behind a different switch interface. In point-to-point links (most modern networks), backup ports don't occur. They appear mainly in shared-media segments or misconfigured parallel links.

Understanding Port Roles in Practice

Show Command Output

SW2# show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    4097
             Address     aabb.cc00.0100
             Cost        4
             Port        2 (Ethernet0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0200
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/1               Root FWD 4         128.2    P2p
Et0/2               Desg FWD 4         128.3    P2p
Et0/3               Altn BLK 4         128.4    P2p
Et1/0               Altn BLK 19        128.5    P2p

Breakdown:

  • Et0/1: Root port (Link A to SW1), forwarding, cost 4
  • Et0/2: Designated port (Link C to SW4), forwarding
  • Et0/3: Alternate port (Link E, parallel to Link A), blocking; it takes over if Et0/1 fails
  • Et1/0: Alternate port (Link F, cost 19), blocking

IOS doesn't print a role summary in this output. Counting the Role column gives 1 root, 1 designated, 2 alternate and 0 backup ports.

Manual Inspection of a Segment

To verify port roles on a specific segment, check the designated bridge and designated port each port is hearing:

SW2# show spanning-tree vlan 1 detail | include Port [0-9]|Port path cost|Designated root|Designated bridge|Designated port id|BPDU
 Port 2 (Ethernet0/1) of VLAN0001 is root forwarding
   Port path cost 4, Port priority 128, Port Identifier 128.2.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 4097, address aabb.cc00.0100
   Designated port id is 128.2, designated path cost 0
   BPDU: sent 9, received 52
 Port 3 (Ethernet0/2) of VLAN0001 is designated forwarding
   Port path cost 4, Port priority 128, Port Identifier 128.3.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 32769, address aabb.cc00.0200
   Designated port id is 128.3, designated path cost 4
   BPDU: sent 54, received 13
 Port 4 (Ethernet0/3) of VLAN0001 is alternate blocking
   Port path cost 4, Port priority 128, Port Identifier 128.4.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 4097, address aabb.cc00.0100
   Designated port id is 128.4, designated path cost 0
   BPDU: sent 4, received 52
 Port 5 (Ethernet1/0) of VLAN0001 is alternate blocking
   Port path cost 19, Port priority 128, Port Identifier 128.5.
   Designated root has priority 4097, address aabb.cc00.0100
   Designated bridge has priority 4097, address aabb.cc00.0100
   Designated port id is 128.5, designated path cost 0
   BPDU: sent 4, received 52

On Et0/1, the designated bridge is SW1 (4097, aabb.cc00.0100), designated port 128.2, with a designated path cost of 0. The designated port for this link is on the root, and this port is SW2's root port.

On Et0/2, the designated bridge is SW2 itself (32769, aabb.cc00.0200) with a path cost of 4, so this port is the designated port on Link C. Et0/3 and Et1/0 also list SW1 as the designated bridge (ports 128.4 and 128.5) but lost the tie-break, so they are alternates.

How Port Roles Change During Convergence

When a link fails:

  1. The switch detects the failure (immediately when the link goes down, or after missed BPDUs if the failure is indirect)
  2. All port roles are recalculated based on the new topology
  3. Alternate ports may become new root ports
  4. Designated ports on new paths are activated
  5. Ports transition to forwarding. In classic 802.1D that is blocking → listening → learning → forwarding; in RSTP an alternate port promoted to root port can forward almost immediately

Example from the lab: I shut Link A on SW2 (Et0/1). Et0/3, the alternate port on parallel Link E, became the root port at the same cost of 4, and Et1/0 stayed alternate:

SW2# configure terminal
SW2(config)# interface Ethernet0/1
SW2(config-if)# shutdown
SW2(config-if)# end
SW2# show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    4097
             Address     aabb.cc00.0100
             Cost        4
             Port        4 (Ethernet0/3)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0200
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/2               Desg FWD 4         128.3    P2p
Et0/3               Root FWD 4         128.4    P2p
Et1/0               Altn BLK 19        128.5    P2p
SW2# show spanning-tree vlan 1 root

                                        Root    Hello Max Fwd
Vlan                   Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
VLAN0001          4097 aabb.cc00.0100         4    2   20  15  Et0/3

Rapid STP (RSTP) accelerates these transitions from 30-50 seconds to a few seconds using proposals and agreements. In the lab, running rapid PVST+, Et0/3 was already the forwarding root port at the first check, 10 seconds after the shutdown.

Troubleshooting Port Roles

Problem: Wrong Root Port Selected

If a switch has chosen a suboptimal root port, check its root cost. Here SW2 had already lost Link A, and then I shut Link E (Et0/3) as well:

SW2# configure terminal
SW2(config)# interface Ethernet0/3
SW2(config-if)# shutdown
SW2(config-if)# end
SW2# show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    4097
             Address     aabb.cc00.0100
             Cost        12
             Port        3 (Ethernet0/2)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0200
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/2               Root FWD 4         128.3    P2p
Et1/0               Altn BLK 19        128.5    P2p
SW2# show spanning-tree vlan 1 root

                                        Root    Hello Max Fwd
Vlan                   Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
VLAN0001          4097 aabb.cc00.0100        12    2   20  15  Et0/2

Root cost is 12, not the 4 you would expect for a direct link to the root, and the root port is Et0/2, the link to SW4. SW2 is reaching the root through SW4 and SW3 (4 + 4 + 4 = 12) because that still beats its remaining direct link, Et1/0 (cost 19). When you see a cost like this, check if:

  1. A direct link to the root is down or err-disabled
  2. The direct link is slower than expected (cost 19 at 100 Mbps)
  3. The port cost was manually set to an unexpected value

Bringing Et0/1 and Et0/3 back up moved the root port back to Et0/1 at cost 4:

SW2# configure terminal
SW2(config)# interface range Ethernet0/1 , Ethernet0/3
SW2(config-if-range)# no shutdown
SW2(config-if-range)# end
SW2# show spanning-tree vlan 1 root

                                        Root    Hello Max Fwd
Vlan                   Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
VLAN0001          4097 aabb.cc00.0100         4    2   20  15  Et0/1
Three STP failure tests: shutting SW4 Et0/1 makes Et0/2 the root port at the same cost of 8. Shutting SW2 Et0/1 moves SW2's root port to Et0/3 on Link E at cost 4. Shutting Et0/3 as well moves it to Et0/2 at cost 12 through SW4 and SW3, which still beats Link F at 19.

Problem: Unexpected Blocked Port

If a port that should be designated is instead blocked, verify:

  1. Other switches on the same segment have lower root path cost
  2. Bridge IDs are as expected
  3. Port priorities aren't manually overridden

What's Next

Read Article 4: STP Port States - Blocking, Listening, Learning, Forwarding, and Disabled to understand the five state transitions a port goes through and why the 50-second convergence time matters.

💡
Trace root/designated/alternate for real in a browser STP lab, and keep the CCNA lab book nearby for the worked examples. Browse labs. Quiz yourself too: the free CCNA practice sample opens on switching and network access questions with no account needed, and Pro adds 500 questions, two timed mock exams and 200 flashcards.
Share Share Share Share Share Email

Read next