PVST+ IEEE and SSTP BPDU Packet Capture

Lesson Contents

This packet capture contains two spanning tree BPDUs from the same Cisco switch, port and VLAN, sent within milliseconds of each other. That isn’t a duplicate: for VLAN 1, PVST+ sends a standard IEEE BPDU and a Cisco SSTP BPDU (Shared Spanning Tree Protocol). The IEEE version lets PVST+ talk to standard switches, the SSTP version carries the VLAN number.

Same root, same cost, same port. Only the destination MAC, the SNAP header and one extra TLV differ. The PVST lesson explains per-VLAN spanning tree, and MST and PVST interoperability shows where these frames matter. For the MST format, see the MST BPDU Packet Capture. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	pvst-plus-ieee-bpdu-and-sstp-bpdu.pcapng
Packets	2
Protocol	PVST+ (Cisco), 802.1D configuration BPDUs
Encapsulation	IEEE 802.3 with LLC (packet 1) and LLC/SNAP (packet 2)
Devices	Cisco IOS switch aa:bb:cc:00:69:00, VLAN 1
Wireshark filter	`stp`

Packets in this capture

No.  Time      Source             Destination              Protocol  Info
1    0.000000  aa:bb:cc:00:69:00  Nearest-Customer-Bridge  STP       Conf. Root = 32768/1/aa:bb:cc:00:69:00 Cost = 0 Port = 0x8001
2    0.000070  aa:bb:cc:00:69:00  PVST+                    STP       Conf. Root = 32768/1/aa:bb:cc:00:69:00 Cost = 0 Port = 0x8001

Packet walkthrough

IEEE BPDU (packet 1)

IEEE 802.3 Ethernet
    Destination: Nearest-Customer-Bridge (01:80:c2:00:00:00)
    Source: aa:bb:cc:00:69:00 (aa:bb:cc:00:69:00)
    Length: 38
Logical-Link Control
    Control field: U, func=UI (0x03)
Spanning Tree Protocol
    Protocol Identifier: Spanning Tree Protocol (0x0000)
    Protocol Version Identifier: Spanning Tree (0)
    BPDU Type: Configuration (0x00)
    BPDU flags: 0x00
    Root Identifier: 32768 / 1 / aa:bb:cc:00:69:00
        Root Bridge Priority: 32768
        Root Bridge System ID Extension: 1
        Root Bridge System ID: aa:bb:cc:00:69:00 (aa:bb:cc:00:69:00)
    Root Path Cost: 0
    Bridge Identifier: 32768 / 1 / aa:bb:cc:00:69:00
        Bridge Priority: 32768
        Bridge System ID Extension: 1
        Bridge System ID: aa:bb:cc:00:69:00 (aa:bb:cc:00:69:00)
    Port identifier: 0x8001
    Message Age: 0
    Max Age: 20
    Hello Time: 2
    Forward Delay: 15

There are a few things worth pointing out:

Destination 01:80:c2:00:00:00: the standard IEEE spanning tree address. Every 802.1D switch understands this frame.
Version 0, configuration BPDU: classic 802.1D. This switch runs PVST+, not Rapid PVST+, so the BPDUs are version 0.
System ID Extension 1: the extended system ID is the VLAN number, so this is the spanning tree for VLAN 1. The full bridge priority is 32768 + 1 = 32769.
No VLAN information otherwise: a standard BPDU has no field for a VLAN. That’s exactly why Cisco also sends the second one.

SSTP BPDU (packet 2)

I removed the root and bridge ID details, which are identical to packet 1.

IEEE 802.3 Ethernet
    Destination: PVST+ (01:00:0c:cc:cc:cd)
    Source: aa:bb:cc:00:69:00 (aa:bb:cc:00:69:00)
    Length: 50
Logical-Link Control
    Control field: U, func=UI (0x03)
    Organization Code: 00:00:0c (Cisco Systems, Inc)
    PID: PVSTP+ (0x010b)
Spanning Tree Protocol
    Protocol Identifier: Spanning Tree Protocol (0x0000)
    Protocol Version Identifier: Spanning Tree (0)
    BPDU Type: Configuration (0x00)
    BPDU flags: 0x00
    Root Identifier: 32768 / 1 / aa:bb:cc:00:69:00
    Root Path Cost: 0
    Bridge Identifier: 32768 / 1 / aa:bb:cc:00:69:00
    Port identifier: 0x8001
    Message Age: 0
    Max Age: 20
    Hello Time: 2
    Forward Delay: 15
    Originating VLAN (PVID): 1
        Type: Originating VLAN (0x0000)
        Length: 2
        Originating VLAN: 1

This is what the fields in red mean:

Destination 01:00:0c:cc:cc:cd: Cisco’s PVST+ multicast address. A non-Cisco switch doesn’t treat this as a BPDU and simply floods it.
SNAP with OUI 00:00:0c and PID 0x010b: identifies the frame as PVST+.
The same BPDU fields: root 32768/1/aa:bb:cc:00:69:00, cost 0, port 0x8001, the same timers.
Originating VLAN TLV: 1: the extra field at the end. A Cisco switch checks it against the VLAN the frame arrived on, and blocks the port with a PVID inconsistency if they don’t match, for example on a native VLAN mismatch.
For VLANs other than 1, a PVST+ switch only sends SSTP BPDUs, tagged with the VLAN on the trunk. Neither frame in this capture has an 802.1Q tag.