An attacker can exploit STP to attack a network. One of the hacking techniques is to implement a rogue switch at trunk ports, and manipulate the spanning tree priority by configuring this rogue switch and giving it the lowest ID to become a root bridge. As a consequence, all the traffic will be transferred through this switch and then it will sniff all the traffic or redirect the traffic.
To defend against STP attacks, you need to enable the root guard on all switch ports that you don't designate as root ports:
Switch1(config)# interface gigabitethernet 0/1Switch1(config-if)# spanning-tree guard root
