200-301 · Network Access · Updated August 3, 2026
STP Root Bridge Election: Bridge ID, Priority, and Tiebreakers
The switch with the numerically lowest bridge ID becomes the root bridge for a VLAN. The bridge ID is built from a configurable priority, an extended system ID that equals the VLAN number, and the switch’s own MAC address, compared in that order. Because every Catalyst switch ships with the same priority of 32768, an untouched network elects whichever switch happens to own the oldest and therefore lowest MAC address, which is almost never the switch you would have chosen.
What the bridge ID contains
The bridge ID is 8 bytes, split into three fields:
- Bridge priority, 4 bits of significance in a 16-bit field. Only the top four bits are writable, so the configurable values are multiples of 4096 from 0 to 61440. The default is 32768.
- Extended system ID, the remaining 12 bits of that same 16-bit field. It carries the VLAN number, which is how one physical switch advertises a different bridge ID in every VLAN instance.
- MAC address, 6 bytes taken from the switch’s backplane address pool.
The consequence shows up in every show output: the priority IOS displays is the configured priority plus the VLAN number. For a default switch in VLAN 30 the displayed value is 32768 + 30 = 32798, and IOS annotates it so you can decompose it:
Bridge ID Priority 32798 (priority 32768 sys-id-ext 30)Read the annotation rather than doing arithmetic in your head where you can. When only the total is given, subtract the VLAN number to recover the configured priority.
Setting the priority
Two commands write a priority, both in global configuration because bridge priority is a property of the whole switch within one VLAN instance.
The explicit form takes a multiple of 4096 and refuses everything else:
SW1(config)# spanning-tree vlan 50 priority 2048020480 is 5 × 4096 and passes validation. A value like 20000 or 100 is rejected with an error naming the allowed increment, and no priority change takes place, so the switch keeps whatever it had.
The macro form calculates a value for you:
SW1(config)# spanning-tree vlan 10 root primary
SW1(config)# spanning-tree vlan 20 root secondary| Method | Priority written | Result |
|---|---|---|
| Untouched default | 32768 | Root only if this switch has the lowest MAC address in the VLAN |
root primary (current root at default) | 24576 | Wins against every default switch |
root primary (current root already at or below 24576) | 4096 below the current root | Takes the root role from the existing root |
root secondary | 28672 | Backup root: beats defaults, loses to the primary |
spanning-tree vlan N priority value | Exactly what you type | Full control; must be a multiple of 4096 |
The macro is a one-time calculation, not a running process. It inspects the topology at the moment you type it, writes a fixed number into the running configuration, and then does nothing further. A switch introduced later with a lower priority takes the root role, and the macro will not push back. The macro also never writes 0; a priority of 0 has to be typed deliberately.
Reading the election result
show spanning-tree vlan 10 answers the question directly, because it prints the root’s identity and the local switch’s identity in separate blocks:
SW2# show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 24586
Address 6c41.0e88.1a00
Cost 4
Port 25 (GigabitEthernet1/0/25)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32778 (priority 32768 sys-id-ext 10)
Address a0e0.af3b.7c80
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/1 Desg FWD 4 128.1 P2p Edge
Gi1/0/25 Root FWD 4 128.25 P2p
Gi1/0/26 Altn BLK 4 128.26 P2pFour things fall out of that output:
- The two Address lines differ, so this switch is not the root. When a switch is the root, IOS repeats the same address in both blocks and adds the line
This bridge is the root. - The Cost and Port lines under Root ID exist only on a non-root switch. They name the accumulated cost to the root and the local root port.
- The root’s displayed priority of 24586 minus the extended system ID of 10 gives 24576, the fingerprint of
root primary. - The local displayed priority of 32778 minus 10 gives 32768, so nobody configured a priority on this switch.
The P2p Edge type on Gi1/0/1 marks an access port running PortFast, which is why it reaches forwarding without the usual delay.
Cost does not measure hops. A cost of 4 is one gigabit link, and a path across four gigabit links would show 16 while a single 100 Mbps link would show 19.
Path costs and the root-port tiebreaker chain
Each switch adds the cost of the receiving interface to the root path cost carried in the incoming BPDU (bridge protocol data unit). The default short-method costs are:
10 Mbps costs 100, 100 Mbps costs 19, 1 Gbps costs 4, and 10 Gbps costs 2. Those are the values the exam uses. A long-cost method exists for links faster than 10 Gbps and is enabled with spanning-tree pathcost method long, but it is not the default.
When two ports tie on accumulated cost, the switch works down a fixed chain, and every step after the first compares a value the neighbor advertised, not a local one:
- Lowest cumulative root path cost.
- Lowest sender bridge ID, meaning the bridge ID of the neighbor switch on the far end.
- Lowest sender port priority (default 128, configurable in increments of 16 with
spanning-tree vlan 10 port-priority). - Lowest sender port number.
That is why Prio.Nbr reads 128.25 for GigabitEthernet1/0/25: port priority 128, port number 25. To influence a neighbor’s root-port choice you change the port priority or cost on your side, because the neighbor is reading your values. Designated port selection on a segment uses the same logic: lowest root path cost first, then lowest bridge ID.
Per-VLAN load sharing
Because Rapid PVST+ runs an independent instance per VLAN, two distribution switches can hold opposite ranks in different instances. Making DSW1 primary for VLANs 10 and 20 and secondary for 30 and 40, and giving DSW2 the mirror image, sends half the VLANs up each set of uplinks and guarantees an automatic takeover if either switch fails:
DSW1(config)# spanning-tree vlan 10,20 root primary
DSW1(config)# spanning-tree vlan 30,40 root secondary
DSW2(config)# spanning-tree vlan 30,40 root primary
DSW2(config)# spanning-tree vlan 10,20 root secondaryNothing on the access switches changes. The other way to use redundant uplinks at once is bundling them into an EtherChannel, which spanning tree treats as a single logical port and therefore never blocks a member of. Tuning access-layer port costs would steer traffic too, but it scales badly across many wiring closets and it touches configuration you may not be allowed to touch. Giving both distribution switches the same priority produces a tie broken by MAC address, and one switch silently becomes root for everything.
How the 200-301 exam tests this
- Decomposing a displayed priority. A question shows a Bridge ID line, or states a VLAN and a default switch, and asks for the number in the Priority field. Add the VLAN number to 32768, and watch for distractors that add the wrong digit or subtract instead.
- Rejecting invalid priorities. Several answer choices are syntactically plausible priority commands, and only the multiples of 4096 are accepted. A number like 100 is often placed there because it looks like an FHRP (first hop redundancy protocol) priority, which is a different field with a different range.
- Interpreting a show block. A scenario prints Root ID and Bridge ID blocks and asks which conclusions hold. Different addresses plus the presence of Cost and Port lines means the switch is not the root, and cost never implies hop count.
- Multiple ways to become root. A “choose two” item mixes the macro, an explicit low priority, an invalid priority,
root secondary, and a port-priority command. Only values below every other switch’s advertised bridge ID win, and port priority has no effect on root election.
The arithmetic is small but easy to fumble at speed — drill it with practice questions until adding the VLAN number is automatic.
Quick reference
- Bridge ID = priority (multiple of 4096, default 32768) + extended system ID (the VLAN number) + switch MAC address.
- Displayed priority = configured priority + VLAN number; IOS annotates it as
priority 32768 sys-id-ext 10. root primarywrites 24576 against a default topology;root secondarywrites 28672; neither ever writes 0, and both run once.- Explicit priorities must be multiples of 4096 between 0 and 61440, set in global configuration per VLAN.
- Default short path costs: 10 Mbps 100, 100 Mbps 19, 1 Gbps 4, 10 Gbps 2.
- Root-port tiebreakers in order: lowest cost, lowest sender bridge ID, lowest sender port priority, lowest sender port number.
- On the root bridge, IOS prints
This bridge is the rootand omits the Cost and Port lines from the Root ID block. - Port roles, port states, and how the topology actually converges are covered in Rapid PVST+ explained.