The loop problem
Three switches are cabled in a triangle. That gives a spare path: if one cable breaks, traffic can go round the other way. But the links also form a loop, a circle that frames can travel round and round.
Host A sends a broadcast, a frame for every device (ff:ff:ff:ff:ff:ff). Switch SW2 floods it: a copy out of every port except the one it came in on. One copy goes to SW1, one to SW3.
Each switch floods every copy onward, so two copies race round the triangle in opposite directions. Ethernet frames have no TTL, the hop counter that IP packets carry, so nothing stops them. Each new broadcast adds two more: a broadcast storm.
Switches learn from the source MAC of every frame. SW1 sees A's frames arrive from SW2, then from SW3, then from SW2 again. Its table entry for A keeps jumping between port 1 and port 2. This is MAC flapping.
Electing a tree
Spanning Tree Protocol (STP, IEEE 802.1D) fixes loops by blocking just enough ports. Each switch has a bridge ID: a priority, 32768 by default, followed by its MAC address. Switches share IDs in small messages called BPDUs.
The switch with the lowest bridge ID becomes the root bridge, the centre of the tree. Every priority here is 32768, so the lowest MAC address decides: SW1, ending in :01, wins.
Every other switch picks its root port: the port with the cheapest path to the root. A 1 Gb/s link costs 20 000. SW2 and SW3 reach SW1 directly for 20 000; going via the other switch would cost 40 000.
Each link gets one designated port, the end nearest the root, which forwards frames onto it. The root's ports are always designated. On the SW2 to SW3 link both ends are 20 000 away, so the lower bridge ID wins: SW2.
SW3's port on that link is neither root nor designated, so it blocks: it drops data frames but still listens to BPDUs. The loop is cut. The links now form a tree: exactly one path between any two switches.
One path
A sends its broadcast again. It travels SW2 to SW1 to SW3, then on to B. The copy SW2 sends straight to SW3 hits the blocked port and is dropped. Every device gets one copy, and the MAC tables stay put.
Failure and recovery
Now the cable between SW1 and SW3 breaks. SW3 loses its root port, its only working path to the root. Without spanning tree acting again, B would be cut off from the rest of the network.
SW3's blocked port is now its cheapest path to the root (40 000, via SW2), so it becomes the root port and forwards. Rapid STP (RSTP, IEEE 802.1w) does this almost at once; classic 802.1D took 30 to 50 seconds.
Inside the switches
;; step 1/12 · loop ;; about: links, s1, s2, s3 SW1 port 1 ── SW2 port 1 SW1 port 2 ── SW3 port 1 SW2 port 2 ── SW3 port 2 Host A on SW2 port 3 · Host B on SW3 port 3 every link 1 Gb/s · one VLAN · no spanning tree yet
Many switches set the priority in steps of 4096 and add the VLAN number to it (IEEE 802.1t), so the default shows as 32769 on VLAN 1. The comparison works the same way. Path costs are the IEEE 802.1D-2004 recommended values (1 Gb/s = 20 000, 100 Mb/s = 200 000). The older 802.1D-1998 table used 4 and 19.