There's nothing written about it on the internet. Nothing about if it's currently possible to carry out, or how to counter it. Just this definition copy pasta everywhere:

STP (Spanning-Tree Protocol) mangling refers to the technique used for the attacker host to be elected as the new root bridge of the spanning tree. The attacker may start either by forging BPDUs (Bridge Protocol Data Units) with high priority assuming to be the new root, or by broadcasting STP Configuration/Topology Change Acknowledgement BPDUs to get his host elected as the new root bridge. By taking over the root bridge, the attacker will be able to intercept most of the traffic.

Also another question, what's a Configuration/Topology Change Acknowledgement BPDU?

1 Answer 1


Switches send out BPDUs (Bridge Protocol Data Units) to elect a root bridge. Initially, every switch assumes it is the root bridge,until it receives a superior BPDU. This is an ongoing process. Also, when a switch notices a change in the topology (link up/down), it will send TCN (Topology Change Notification) BPDUs.

If you haven't correctly configured, or your switches don't support, the available STP security/stability measures (e.g. root guard), an attacker could send out BPDUs in order to take over from the root bridge. STP creates a loop-free environment by having the switches send traffic toward the root bridge. An attacker could have traffic sent toward it.

  • So all switches have root guard by default?
    – User104163
    Apr 18, 2016 at 18:12
  • No, not at all. Cisco has root guard, and other STP security/stability protocols, but not all vendors have anything likes this, although most enterprise-grade vendors have these types of things.
    – Ron Maupin
    Apr 18, 2016 at 18:21
  • Oh. Do 3com 4400 and 4900 switches have them?
    – User104163
    Apr 18, 2016 at 18:31
  • I don't specifically know about those switches.
    – Ron Maupin
    Apr 18, 2016 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.