Denial-of-Service (DoS) conditions in enterprise networks are commonly attributed to malicious actors. However, availability can also be compromised by benign non-malicious insider behavior. This paper presents an empirical study of a production enterprise LAN that demonstrates how routine docking and undocking of user endpoints repeatedly trigger rapid recalculations of the control plane of the Rapid Spanning Tree Protocol (RSTP) [1]. Although protocol-compliant and nonmalicious, these events introduce transient forwarding disruptions of approximately 2-4 seconds duration that degrade realtime streaming (voice and video) services while remaining largely undetected by conventional security monitoring. We map this phenomenon to the NIST and MITRE insider threat frameworks, characterizing it as an unintentional insider-driven availability breach, and demonstrate that explicit edge-port configuration effectively mitigates the condition without compromising loop prevention

翻译：企业网络中的拒绝服务（DoS）状况通常归因于恶意行为者。然而，可用性也可能因良性的非恶意内部行为而受损。本文对某生产型企业局域网进行了一项实证研究，结果表明用户终端设备的常规对接与断开操作会反复触发快速生成树协议（RSTP）[1]控制平面的快速重计算。尽管这些事件符合协议规范且非恶意，但其引发的约2-4秒瞬时转发中断会降低实时流媒体（语音与视频）服务质量，而传统安全监控系统大多未能检测到此类异常。我们将该现象映射至NIST与MITRE内部威胁框架，将其定性为无意识内部行为驱动的可用性破坏，并证明显式边缘端口配置可在不影响环路预防功能的前提下有效缓解此状况。