Root guard
A Spanning Tree feature that prevents a switch in the "wrong" place in the network from becoming the root bridge. If a port receives a "superior" BPDU (one that would make another switch the root), the port is put in a blocked state until the threat disappears.
Problem: the root bridge should be a central, powerful switch in the core. But STP automatically elects the one with the lowest bridge ID — if someone plugs in an old switch (or an attacker) with a low priority value in the access layer, it can take over as root and force all traffic through an unsuitable path (a performance disaster or eavesdropping). Root guard is applied to ports facing "downward"/outward (where the root should never be): if such a port receives a superior BPDU it's marked "root-inconsistent" and blocked, but automatically restored when the superior BPDUs cease. Distinct from BPDU guard (which shuts the port entirely on any BPDU). Together they keep the STP topology stable and predictable. Related to BPDU guard and BPDU.