TechKnowSurge
Cisco CCNA 2.5 Cisco CCNA 1.13
TechKnowSurge Catalog Videos DEMO: Wireshark BPDUs
VideoNetworkFree

DEMO: Wireshark BPDUs

Wireshark is used to capture and analyze Bridge Protocol Data Units (BPDUs) live on a network, revealing how Spanning Tree Protocol fields map to real switch behavior. Captured frame data — including root priority, path cost, VLAN ID, and MAC addresses — is cross-referenced against actual switch configurations to confirm STP topology assumptions.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireshark offers a direct view into the Spanning Tree Protocol traffic flowing across a live network by capturing Bridge Protocol Data Units at the frame level. On an Ethernet interface connected to a test environment, BPDUs arrive approximately every two seconds — one for each active switch port — and each frame contains a structured set of fields that describe the current STP topology. Key fields visible in the capture include the protocol identifier, version, message type, and flag byte, along with the root bridge priority, which defaults to 32768, and a system ID extension that reflects the VLAN assignment, in this case VLAN 10. Beyond the root identifier, the captured BPDU also exposes the root path cost, the sending bridge's MAC address, port number, and STP timers. A root path cost of 19 indicates a 100 Mbps link, which aligns with the cost values defined in standard STP reference tables. The presence of two distinct MAC addresses within a single BPDU — one for the root bridge and one for the sending bridge — makes it possible to determine exactly which switches are involved and what role each one plays in the topology. To validate those observations, the MAC addresses pulled from the Wireshark capture are compared against output from two physical switches using the show version command. The addresses match exactly, confirming that the device acting as the root bridge is Switch 1 and that the demo laptop is directly connected to Switch 2. This kind of packet-level verification reinforces STP concepts by connecting theoretical constructs to observable, real-world data.

What you'll learn

What's covered

Analyzing BPDUs with Wireshark

Aligned to

Cisco CCNA
2.5 Interpret basic operations of Rapid PVST+ Spanning Tree Protocol
1.13 Describe switching concepts

Key terms

Spanning Tree Protocol
STP
A network protocol that prevents loops in Ethernet networks by creating a loop-free logical topology.
Bridge Protocol Data Unit
BPDU
A data message exchanged between switches running Spanning Tree Protocol to detect network loops and elect a root bridge. BPDUs contain the sending switch's BID and path cost information used to build the loop-free spanning tree.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.

Topics

Spanning Tree Protocol Wireshark Bpdu Analysis Root Bridge Election Packet Capture Networking

Transcript

Capturing BPDUs

One thing that I always love doing is going back and taking a look at the actual bits: what actually are we seeing across the switch? So I'm going to use Wireshark to take a look at the frames that we're seeing coming across from a switch to a PC, because these are actually going out every single interface that there is. We'll see on a PC what's coming into it, and from the Wireshark perspective take a look at those bridge protocol data units.

Here I am on my demo laptop. I'm going to bring up Wireshark. I need to choose the interface that I want to look at, and it's going to be this ethernet interface right here — this is the one that's plugged into my test network. So then I can take a look and I can see that there's some STP information that's coming by. Interesting enough, it's coming every two seconds, about. And then we got some other information that's coming in here also, but all I care really about right now is one of these spanning tree ones.

Let's take a look at the spanning tree. I'm just going to click on it here. I can click any one of these; for the most part they're all going to be the same. Then I'm going to look at the spanning tree section of this to take a look at it.

Reading the Fields

Here's where there's that protocol identifier, so we identify the protocol and the version and the type. So we got some information in there. It looks like it's just all set to zero here. We got some flags, which also is set to zero here. Those are the ones I'm not as concerned about, and you'd see some differences depending on what version you're using.

Let's take a look at the root identifier. So I take a look at this root identifier, I see the priority on there, it's set to 32768, our default, so that makes sense. Then we also see the root bridge ID extension, and this says — well, if you remember our network, this demo laptop is on VLAN 10, so perhaps that is why this is actually saying 10 right here, is that we're seeing that it's coming across VLAN 10.

We've got the root bridge system ID, and then this is the 0019 E8 9E 0A 80. So if we were to take a look at our switch 1, or whatever switch this is, then we would see that — actually, that would be a good thing to do. Let's go ahead and take a look at our different switches and see what lines up with this MAC address right here.

Then I look at the bridge identifier — oh, excuse me, here's the root path cost. So it's a root path cost of 19, so we know that that's a 100 bed connection, based off of one of those charts that we took a look at earlier. And then we see the bridge identifier, and we see that the bridge identifier is once again 32768. We got a bridge system ID extension once again, because this is part of VLAN 10, and then we've got a different MAC address.

So what this is telling me is that if this is the BPDU coming into the demo laptop, then it's directly connected to this switch right here. If we're seeing cost of 19, then I'm going to assume that the next switch that it's connected to, which is switch 1, is going to be the root bridge. So we can take a look now and verify all that. And then I also see a port number here, and then a few different timers right here.

Verifying on the Switches

So let's see if my assumptions are correct, where we're connected directly into switch 2, and this is going to be the MAC address of that, and then switch 1, this will be the MAC address of it. So let's go ahead and jump on these. This is switch 1, so I'll do a restart on here. You can type that in wrong — actually, there we go. And look for our MAC address in here, and we see 0019e8 9e 0 a 0. So is that what we saw in here? Sure enough, that is. So switch 1, that is correct.

And then we'll jump on to switch 2. So I'll do a restart of that session right there. We'll get our credentials plugged into here, and show version on here, and 44 E4 d9978380. And then I take a look, and yep, that sure enough is. So everything adds up. We can take a look inside of Wireshark and see that everything's making sense based off of what we've learned so far.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →