Spanning-Tree Protocol Attack.

A Layer-2 attack that injects forged BPDU frames to manipulate the Spanning-Tree topology, often electing the attacker's host as the root bridge to enable MITM or DoS. It belongs to the Attacks & Threats category of cybersecurity.

A Layer-2 attack that injects forged BPDU frames to manipulate the Spanning-Tree topology, often electing the attacker's host as the root bridge to enable MITM or DoS.

STP attacks abuse the trust 802.1D/802.1w Spanning-Tree gives to BPDU (Bridge Protocol Data Unit) frames. By emitting BPDUs with a very low bridge priority, an attacker can be elected as the new root bridge, causing the switch network to reconverge and route a large share of traffic through the attacker's port - ideal for MITM. Continuous BPDU flooding can also force constant reconvergence and effectively DoS the segment. Tools like Yersinia, ettercap and scapy implement these techniques. Defenses: enable BPDU Guard on access ports (shuts the port on BPDU receipt), Root Guard on designated ports, BPDU Filter where appropriate, and use storm control plus 802.1X to restrict who can reach the switch fabric.

Defences for Spanning-Tree Protocol Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: BPDU attack, Root bridge spoofing, STP root takeover.