Simple definition
BPDU Guard is an STP protection feature intended to stop an unexpected switch from being connected to an access or edge port.
Technical definition
When enabled on an edge/PortFast port, receiving a BPDU is treated as abnormal and the switch typically blocks or disables the port according to vendor behavior.
What is it used for?
Protect the STP topology from loops and switching devices connected to ports intended for end hosts.
Practical example
An unauthorized small switch connected to a user outlet sends a BPDU, causing the protected port to be taken out of service.
Common issues
- BPDU Guard is enabled on a link that is expected to receive BPDUs
- A disabled port is recovered without identifying the unexpected switch
- BPDU Guard is confused with Root Guard or Loop Guard
How it works / role
The port operates normally while it remains an edge port and receives no BPDUs. As soon as a BPDU arrives, the feature treats the expected topology as violated and places the port in a blocked or error state. Recovery then follows the procedure supported by the switch.
Related terms
STP · RootGilard · Switch.
Key takeaway: Exact behavior can vary by version, product, and architecture; always validate on the environment actually deployed.