In a Layer 2 network, redundant designs can mitigate the possibility of a single point of failure, which causes a loss of function for the entire switched or bridged network. However, redundant designs can cause unwanted problems, such as broadcast storms, multiple frame transmissions, and MAC database instability. For that reason, the STP must be used in the Layer 2 networks. It provides redundancy, but at the same time protects against the unwanted problems that might be caused by poor design implementations.
在第 2 層網路中，備援設計可以降低單點故障的可能性，因為單點故障會導致整個交換式或橋接式網路失去功能。然而，備援設計也可能造成不必要的問題，例如廣播風暴、多重框架傳輸，以及 MAC 資料庫不穩定。因此，第 2 層網路必須使用 STP。STP 提供備援，同時也防範不良設計實作可能造成的問題。
The STP can be targeted by an attacker. Besides BPDU Guard that is used to protect the access layer, there are also other security features that can be implemented to mitigate STP attacks. In addition, suboptimal paths can be used in the networks after the implementation of STP without appropriate protection against various STP attacks. This can lead to man-in-the-middle attacks, as well as to creating loops even with the STP running on the switches.
STP 可能成為攻擊者的目標。除了用來保護存取層的 BPDU Guard 之外，還有其他安全功能可以用來緩解 STP 攻擊。此外，若在部署 STP 後未搭配適當的保護措施來防範各種 STP 攻擊，網路中可能會出現次佳路徑。這可能導致中間人攻擊，甚至在交換器上執行 STP 的情況下仍產生迴圈。
The figure illustrates how a network attacker can use STP to change the topology of a network so that the network attacker appears to be a root bridge with a lower priority. The attacker sends out Bridge Protocol Data Units (BPDUs) with a better bridge ID and thus becomes the root bridge. As a result, traffic between the two switches in the figure passes through the new root bridge, which is actually the attacker system.
此圖說明網路攻擊者如何利用 STP，藉由宣稱擁有較低優先權而看似根橋接器，來改變網路拓樸。攻擊者發送具有較佳橋接器 ID 的橋接協定資料單元（BPDU），因而成為根橋接器。結果，圖中兩台交換器之間的流量會經過新的根橋接器，而它其實就是攻擊系統。
The root guard feature of Cisco switches prevents a switch from becoming a root bridge on configured ports. The root guard feature is designed to provide a way to enforce the placement of root bridges in the network. Root guard limits the switch ports from which the root bridge can be negotiated. If a port where root guard is enabled receives BPDUs that are superior to BDPUs which the current root bridge is sending, then the port transitions to a root-inconsistent state, which is effectively equal to an STP listening state, and no data traffic is forwarded across that port.
Cisco 交換器的根防護（root guard）功能可防止交換器在已設定的連接埠上成為根橋接器。根防護功能旨在提供一種強制規範網路中根橋接器位置的方式。根防護會限制可協商出根橋接器的交換器連接埠。若啟用根防護的連接埠收到比目前根橋接器所發送之 BPDU 更優的 BPDU，該連接埠就會轉換為根不一致（root-inconsistent）狀態，其效果等同於 STP 的 listening 狀態，且不會有任何資料流量經由該連接埠轉送。
Root guard is best deployed toward ports that connect to switches that should not be the root bridge. Root guard is enabled using the spanning-tree guard root command in interface configuration mode.
根防護最適合部署在連接到不應成為根橋接器之交換器的連接埠上。可在介面設定模式下使用 spanning-tree guard root 命令啟用根防護。
The figure illustrates how the attacker sends out spoofed BPDUs to become the root bridge. Upon receipt of a BPDU, the switch with the root guard feature configured on that port ignores the BPDU and puts the port in a root-inconsistent state. The port will recover when the offending BPDUs stop.
此圖說明攻擊者如何發送偽造的 BPDU 以成為根橋接器。當該連接埠上設定了根防護功能的交換器收到 BPDU 時，會忽略該 BPDU 並將連接埠設為根不一致狀態。當有問題的 BPDU 停止後，該連接埠就會恢復。
Besides Root Guard, another STP security feature exists called Loop Guard. Loop Guard is implemented on inter-switch links to avoid loops in case the STP fails.
除了根防護之外，還有另一項稱為迴圈防護（Loop Guard）的 STP 安全功能。迴圈防護會部署在交換器間的連結上，用以在 STP 失效時避免產生迴圈。