Spanning Tree Cost Calculator
Calculate spanning tree port costs under the legacy and long path cost methods, work out which bridge wins the root election, and see why the default cost table breaks above 10 Gbit/s.
Last reviewed by the Radiatus Cloud team
Root bridge election
Need this monitored 24/7?
Radiatus delivers managed cloud & network operations.
The short path cost table ran out at 10 Gbit/s
The original 802.1D cost values are a 16 bit table where 10 Mbit/s costs 100, gigabit costs 4 and 10 gigabit costs 2. Above that the table has nowhere to go: 40 and 100 gigabit links both cost 1, and so does anything faster. The 802.1t long path cost method uses 32 bit values where gigabit costs 20,000 and 10 gigabit costs 2,000, leaving room for faster links. Every switch in the topology must use the same method, because a mixture produces inconsistent path selection.
The root bridge is elected on priority, then MAC address
The lowest bridge ID wins, and the bridge ID is the priority followed by the MAC address. Priority defaults to 32768 on every switch, so with default configuration the election is decided by whichever switch has the lowest MAC address, which is usually the oldest one, frequently in a wiring closet, and never the one you would choose. Setting the priority explicitly on the intended root and its backup is the single most valuable spanning tree configuration change.
Priority must be a multiple of 4096
The priority field is four bits of a sixteen bit value, with the remaining twelve carrying the VLAN identifier in the extended system ID scheme. That means only multiples of 4096 are valid, and a switch rejects anything else. Values of 4096 for the primary root and 8192 for the secondary are conventional, leaving room below for a deliberate change later.
Related tools
- Port Scanner — Check which common ports respond on a host and understand what each exposed service means. Scan only systems you are authorised to test.
- DNS Misconfiguration — Analyze DNS records (TXT, SPF) for security gaps.
- TLS Compat Tester — Check client-server compatibility for TLS versions.
- Firewall Rule Risk — Evaluate firewall rules for over-permissive exposure.
Frequently Asked Questions
What is the difference between short and long path cost?
Short is the original 16 bit 802.1D table, where 10 Gbit/s costs 2 and everything faster also collapses toward 1. Long is the 802.1t 32 bit method with much larger values that distinguishes speeds above 10 Gbit/s. Every switch in the topology must use the same method.
How is the root bridge chosen?
The lowest bridge ID wins, which is priority followed by MAC address. Priority defaults to 32768 everywhere, so the election falls to the lowest MAC address, which is typically the oldest switch and rarely the right one. Set priority explicitly on the intended root.
Why must priority be a multiple of 4096?
Because the extended system ID uses the lower twelve bits of the priority field for the VLAN identifier, leaving four bits for priority itself. Only multiples of 4096 are therefore valid and a switch rejects anything else.
Should I use RSTP or classic STP?
RSTP, or its multiple instance variant. Classic 802.1D takes 30 to 50 seconds to converge after a topology change; RSTP typically converges in a few seconds. There is no reason to run classic STP on equipment that supports RSTP.
What does portfast do and when is it dangerous?
It moves an access port straight to forwarding, skipping the listening and learning states, so a host does not wait 30 seconds for a link. It is correct on ports connecting hosts and dangerous on ports connecting switches, because it can create a loop before STP detects it. Pair it with BPDU guard, which shuts the port down if a BPDU arrives.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Enter link speeds and bridge priorities to see port costs and the root bridge election result.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
Port Scanner
NetworkCheck which common ports respond on a host and understand what each exposed service means. Scan only systems you are authorised to test.
DNS Misconfiguration
NetworkAnalyze DNS records (TXT, SPF) for security gaps.
TLS Compat Tester
NetworkCheck client-server compatibility for TLS versions.