Switch Port Protection

Question 1

Loop protection

Answer 1

Loop protection
• Connect two switches to each other
• They’ll send traffic back and forth forever
• There’s no “counting” mechanism at the MAC layer
• Connect two switches to each other
• They’ll send traffic back and forth forever
• There’s no “counting” mechanism at the MAC layer

Question 2

BPDU guard

Answer 2

BPDU guard
• Spanning tree takes time to determine 
if a switch port should forward frames
• Bypass the listening and learning states
• Cisco calls this PortFast

Question 3

Root guard

Answer 3

Root guard
• Spanning tree determines the root bridge
• You can set the root bridge priority to 0, but that
doesn’t always guarantee the root

Question 4

Flood guard

Answer 4

Flood guard
• Configure a maximum number of 
source MAC addresses on an interface
• You decide how many is too many
• You can also configure specific MAC addresses

Question 5

DHCP snooping

Answer 5

DHCP snooping
• IP tracking on a layer 2 device (switch)
• The switch is a DHCP firewall
• Trusted: Routers, switches, DHCP servers
• Untrusted: Other computers, unofficial DHCP servers