I've got a question about STP/RSTP (it applies to both, but I'll just say STP). If I connect several switches and the STP algorithm eventually creates a loop-free environment, then how can a single new switch cause a loop?
Let's look at an example scenario: Let's say I have 50 switches, and a user buys a cheap switch without STP (or an attacker turns it off), and connects two ports on the cheap switch to each other (creating a loop). If this cheap switch is then connected to a single port on one of my switches (this port is on Switch 1, and it has PortFast but not BPDU Guard enabled), and the cheap switch starts sending broadcast frames, those broadcast frames enter my switched network, which is a loop-free environment. So how can they cause a loop? The frames must eventually terminate on one of my switches (because STP creates a single logical path for frames), so they can't circle around from the last switch that they reach (Switch 50) to the first switch (Switch 1) through which they initially entered my switched environment.
The only answer I could come up with is that they can't cause a loop, but they can take down the network. They do it in 2 ways:
They drown out all traffic, so no other frames can be forwarded, because the rogue, cheap switch's broadcast frames take up all of the available bandwidth.
Because the rogue switch's user frames take up all available bandwidth, both all other user frames and the BPDU frames of my switches as well get drowned out. This includes the BPDU Hellos, so eventually the Max Age timer expires, and the switches must recalculate STP. While the STP calculations are going on, all user frames (including the broadcast frames of the rogue, cheap switch) are filtered. While the STP calculation is going on, they still keep trying to enter my switched environment, and after the STP calculation is done, they can do so a second, third, etc. time, taking down the network again.
Or is it the case that the switches' CPUs get so busy, they don't even have an opportunity to keep track of the Max Age timer's expiry? If that's true, then the only answer is 1).
Can someone please help me understand this? Is there actually a way to create a loop in an STP-enabled environment, or is the harm done in the 2 ways I describe?
Have a nice weekend. Attila