A method for protecting a network configuration set up by a spanning tree protocol, STP, by selecting one of a plurality of bridges (2 to 11) of a computer network (1) as a root bridge (2) and by selecting one of a plurality of bridge ports (2a to 11a, 3b, 4b, 6b, 7b, 9b, 10b) of each of the plurality of bridges (2 to 11) as a root port (2a to 11a), the method comprising the steps of: setting a sub-state of at least one bridge port (2a to 11a, 3b, 4b, 6b, 7b, 9b, 10b) of at least one of the bridges (2 to 11) to an active sub-state in case that bidirectional traffic passes through the bridge port (2a to 11a, 3b, 4b, 6b, 7b, 9b, 10b), receiving an STP message, in particular a Bridge Protocol Data Unit, BPDU, in one of the bridge ports (2a to 11a, 3b, 4b, 6b, 7b, 9b, 10b) being in the active sub-state, and protecting the network configuration by discarding the STP message and / or by sending an alarm message to a network management unit (27) in case that the STP message indicates a change of the root bridge (2) of the network configuration.