PROTECTION AGAINST RSTP ATTACKS USING ROOT GUARD ON L2+ DEVICES

The article examines an educational scenario involving a change of the root bridge in a switched network and the use of Root Guard to restrict that change. The aim is to interpret the available laboratory observations and describe a verifiable configuration procedure rather than compare equipment performance. The test setup includes workstations, Cisco 2960 SI and Eltex MES1428 switches, and a MikroTik device. Yersinia is used to generate control traffic. The paper preserves connection diagrams, address components of root identifiers before and after the reported intervention, individual ping responses, and console fragments. These materials describe particular node states, but do not establish a synchronized sequence for all events. A second table reports unchanged root addresses when protection was enabled. This is treated as a limited observation because the available evidence does not include complete configuration logs or protected port state transitions. Documented Root Guard behavior is distinguished from experimental observations. Cisco IOS and RouterOS configuration examples are accompanied by explicit applicability conditions and are not presented as commands executed in the reported trial. Recovery time, processor utilization, interruption duration, and packet loss during protective blocking were not measured. The practical contribution is a structured distinction between the baseline state, intervention, root identifier check, and protected port state check. The conclusions apply to the educational case and do not establish universal protection against Layer 2 attacks.