4 ms·

I don't quite understand this sort of thing happening. Wasn't the whole point of the internet to be a self-healing network where we route around severed cables,

by atonse 11d ago

I don't quite understand this sort of thing happening. Wasn't the whole point of the internet to be a self-healing network where we route around severed cables, etc? Or is it that these ATC networks are their own air-gapped network with less redundancy? That just doesn't add up. Or maybe there was only one line going to the ATC, with no multiple "ISPs" like a datacenter would have?

bri3d 11d ago
* Yes, TRACON have their own dedicated links. You can look into ASTERIX and STARS to learn some of the cursed ways the data processing and dataflow work. * There is supposed to be a primary and a secondary link, in this case the primary failed and the fail-over also failed. It's unclear from the reporting if they were damaged in the same incident or if the failover was not tested or monitored adequately. The Philadelphia TRACON site has been notoriously unreliable and was supposedly improved in 2025, it's also unclear if these issue actually could stem from that implementation.
- wrs 11d ago
  I’ve had enough double-redundant links fail - and I mean pretty thoroughly double-redundant, different provider, different media, different physical path - that I’m quite surprised something like the air traffic control system only has two links.
  - pixl97 11d ago
    One thing that needs to be reviewed is if they are dual links or redundant links. In any system where both sides of redundancy always carry traffic then loss of one link can cause congestion failure if any link fails. This is a very common means of failure in electrical networks that requires load shedding. Well, you can't load shed air traffic. A more complex system that I like, but comes with it's own set of constraints and implementation issues is a system where both lines carry all the traffic at all times. This way the default state of the system is always working and your first failure isn't invisibly critical. But this is very hard as we see in TCP when things get out of order and high latency creeps in. You have to manage a lot more state at the data level.
readthenotes1 11d ago
Do you want air traffic control to be on the general internet? That seems like an extremely foolhardy thing to do.
- ssl-3 11d ago
  As a tertiary backup: Yeah, maybe I do want that. It seems like it would present a less-chaotic solution than that provided by having no data communications at all.
- kqgnkqgn 11d ago
  You certainly don’t need to run this over public Internet to get resiliency over multiple paths.

by atonse 11d ago

bri3d 11d ago

* Yes, TRACON have their own dedicated links. You can look into ASTERIX and STARS to learn some of the cursed ways the data processing and dataflow work. * There is supposed to be a primary and a secondary link, in this case the primary failed and the fail-over also failed. It's unclear from the reporting if they were damaged in the same incident or if the failover was not tested or monitored adequately. The Philadelphia TRACON site has been notoriously unreliable and was supposedly improved in 2025, it's also unclear if these issue actually could stem from that implementation.

wrs 11d ago
I’ve had enough double-redundant links fail - and I mean pretty thoroughly double-redundant, different provider, different media, different physical path - that I’m quite surprised something like the air traffic control system only has two links.
- pixl97 11d ago
  One thing that needs to be reviewed is if they are dual links or redundant links. In any system where both sides of redundancy always carry traffic then loss of one link can cause congestion failure if any link fails. This is a very common means of failure in electrical networks that requires load shedding. Well, you can't load shed air traffic. A more complex system that I like, but comes with it's own set of constraints and implementation issues is a system where both lines carry all the traffic at all times. This way the default state of the system is always working and your first failure isn't invisibly critical. But this is very hard as we see in TCP when things get out of order and high latency creeps in. You have to manage a lot more state at the data level.

readthenotes1 11d ago

Do you want air traffic control to be on the general internet? That seems like an extremely foolhardy thing to do.

ssl-3 11d ago
As a tertiary backup: Yeah, maybe I do want that. It seems like it would present a less-chaotic solution than that provided by having no data communications at all.
kqgnkqgn 11d ago
You certainly don’t need to run this over public Internet to get resiliency over multiple paths.