Network Forensics Series · Part 3 of N
A browser-based STP/RSTP/PVST+ analyzer for network engineers. Drop a PCAP file — get a structured event timeline, FSM reconstruction, root cause analysis with causal chains, bridge topology, and zero data leaving your machine.
Built in Rust compiled to WebAssembly. No server, no backend, no Node.js.
Live demo: https://stp.postmortem.casablanque.com
Wireshark shows you BPDUs. It doesn't tell you why the network went down for 30 seconds.
A rogue root bridge looks like normal BPDU traffic — until you notice the priority is wrong and all traffic paths changed. A TC storm looks like a busy network — until you correlate 40 topology changes per second with MAC table flushes causing broadcast floods. Root bridge flapping between two switches looks like standard reconvergence — until you see it happening every 4 seconds for 3 minutes.
None of these are obvious from raw packet rows.
This tool reconstructs what actually happened: which bridge held the root role, when it changed, how many times, what triggered the TC flood, and what to do about it.
| Anomaly | Severity | Description |
|---|---|---|
| Root Bridge Flapping | Critical | Two bridges alternately claiming root — misconfiguration or loop |
| TC Storm | Critical | Excessive Topology Change flags — MAC table flushes, flooding |
| Rogue Root Bridge | Critical | Unexpected root takeover by low-priority bridge |
| Loop Suspected | Critical | Inferior BPDUs co-occurring with TC storm |
| Root Bridge Change | Warning | Single root change — maintenance or misconfiguration |
Each detection includes a confidence score, causal chain, impact assessment, and remediation steps.
| Protocol | Coverage |
|---|---|
| STP (802.1D) | Config BPDU, TCN BPDU |
| RSTP (802.1w) | RST BPDU, port roles, rapid convergence flags |
| PVST+ / Rapid-PVST+ | Per-VLAN detection, 802.1Q tag parsing |
RSTP port states (802.1w):
Discarding → Learning → Forwarding
Port roles: Root · Designated · Alternate · Backup
PCAP / PCAPng file (drag & drop)
│
▼
ArrayBuffer (JS)
│
▼
WASM module (Rust)
├── pcap.rs — legacy PCAP parser (nom), little/big endian
├── pcapng.rs — PCAPng parser (SHB/IDB/EPB/SPB/OPB blocks)
├── net.rs — Ethernet 802.3 + LLC, 802.1Q VLAN tag, dst MAC filter
├── stp.rs — 802.1D/RSTP/PVST+ BPDU parser, Bridge ID, port roles
├── analyzer.rs — per-VLAN FSM, root tracking, TC/flap detectors
└── root_cause.rs — correlation engine, confidence, causal chains
│
▼
JSON report → JS frontend → timeline + root cause + bridge topology
Everything runs in the browser's WASM sandbox. The file never leaves your machine.
cargo install wasm-pack
make build # release WASM
make dev # dev build (no wasm-opt)
make check # cargo check only
make dataset # generate test pcaps (requires scapy)wrangler deploystp-postmortem/
├── crates/parser/
│ ├── Cargo.toml
│ └── src/
│ ├── lib.rs # WASM entry point, format autodetect
│ ├── pcap.rs # legacy PCAP parser
│ ├── pcapng.rs # PCAPng parser (all block types)
│ ├── net.rs # Ethernet 802.3 + LLC + 802.1Q
│ ├── stp.rs # BPDU parser (STP/RSTP/PVST+)
│ ├── analyzer.rs # per-VLAN FSM + anomaly detection
│ └── root_cause.rs # correlation + confidence + remediation
├── web/
│ ├── index.html # frontend (single file, no framework)
│ └── pkg/ # generated by wasm-pack
├── dataset/ # 6 synthetic pcap scenarios
├── generate-dataset.py # dataset generator (scapy)
└── Makefile
| # | Scenario | Anomaly |
|---|---|---|
| 01 | Clean RSTP convergence | None — baseline |
| 02 | Root bridge change | Single root change with TC |
| 03 | TC storm | 30 TC flags from flapping access port |
| 04 | Root flapping | Two bridges fighting for root every 4s |
| 05 | PVST+ per-VLAN | Different root per VLAN (clean) |
| 06 | Rogue root bridge | Priority-0 bridge takes over at t=10s |
| STP Post-Mortem | Wireshark | |
|---|---|---|
| Interface | Browser, drag & drop | Desktop app |
| Root cause + causal chain | ✓ | ✗ |
| Per-VLAN tracking (PVST+) | ✓ | Manual |
| TC storm detection | ✓ | ✗ |
| Root flap detection | ✓ | ✗ |
| Data leaves machine | ✗ Never | ✗ Never |
| Requires install | ✗ | ✓ |
- Ethernet link type only
- FSM reconstruction inferred from BPDU evidence
- MSTP (802.1s) not yet supported
- Large captures (>100MB) may be slow
- ospf-postmortem — OSPF FSM reconstruction · Part 1
- dhcp-postmortem — DORA FSM + anomaly detection · Part 2
- stp-postmortem — RSTP/PVST+ root cause analysis · Part 3 ← you are here
MIT