Spanning-tree BPDUguard is one of the features that helps you protect your spanning-tree topology. Let me give you an example:
In my topology above we have a perfectly working spanning tree topology. By default spanning tree will send and receive BPDUs on all interfaces. In our example we have a computer on the fa0/2 interface of SW2. Someone with curious hostile intentions could start a tool that generates BPDUs with a superior bridge ID. What’ll happen is that our switches will believe that the root bridge can now be reached through SW2 and we’ll have a spanning tree re-calculation. Doesn’t sound like a good idea right? Here’s what could go wrong:
You could even do a man in the middle attack without anyone knowing. Imagine I connect my computer to two switches. If I become the root bridge all traffic from SW1 or SW3 towards SW2 will flow through me. I’ll run Wireshark and wait till the magic happens.
We can use BPDUGuard to prevent this from happening as it will block BPDUs:
BPDUguard will ensure that when we receive a BPDU on an interface that the interface will go into err-disable mode.
Let’s take a look how to configure this…