SLAC logo

Impact of World Trade Center & Pentagon attacks on Internet performance Network logo

Les Cottrell. Page created: September 11, 2001, last update September 18, 2001.

Central Computer Access | Computer Networking | Network Group | ICFA-NTF Monitoring
SLAC Welcome
Highlighted Home
Detailed Home
Search
Phonebook

Introduction

On the morning of September 11th 2 commercial airliners crashed into the World Trace Center towers in new York destroying them, and another commercial airline crashed into the Pentagon. Several people including journalists asked whether any impact in Internet delays could be seen as a result of these events, e.g. due to network congestion caused by increased use to search for new stories etc.

Analysis

RTT percentiles by time of day We gathered the data from the IEPM/PingER project for September 11th and imported into Excel. We used Excel to plot various aggregate statistics including the 25 percentile, median, 75 percentile 90 percentile and 95 prercentiles of the Round Trip Tiime (RTT) measurements for each hour of the day. The results are seen to the right, and it is observed taht there is no sudden change in behavior following the event. We also plotted the RTT as a function of remote host pinged from SLAC (not all hosts are labelled in the plot below), versus time of day (GMT) to see if there was any unusual change in behavior following the crashes. The data includes over 200 hosts in over 70 countries. For more on the deployment of PingER see PingER Deployment. Each host is pinged each half hour 11 times with 100 Byte pings and then 10 times with 1000 Byte pings. The first ping in each case is thrown away. Most of the hosts are on academic and research networks (such as internet 2, ESnet in the US or JANet in the UK etc.) though it also includes several root servers and about 10 .com hosts. The results for the RTT are shown below. The hosts are ordered by the RTT for the 1st hour of the day. It can be seen that there are no obvious sudden sustained increases in the RTTs. The deep valleys starting at about 14:00 GMT are due the loss of links to sites on the Italian research and education network (INFN). The last successful ping to infnge.ge.infn.it (in Genova) was about 6:33am PDT, and the next attempt at 7:03am failed. According to CNN the first plane crashed into the WTC tower just before 9am EDT or 6am PDT. It turns out that the links from INFN to ESnet were located close to the World Trade Center. For example 60 Hudson Street a mjor peering point is about 0.6 mile away from the WTC site. Connectivity to Italy was restored between 9:00am and 9:30am September 12 '01, but the RTT had increased from 175 msec to about 350 msec. The new route was through AlterNet. The route before the event was direct from ESnet to DANTE and GARR (the INFN ISP).
RTT vs time of day 7 host
The raw data is available at: http://www-iepm.slac.stanford.edu/cgi-wrap/pingtable.pl?&file=average_rtt&dataset=hep&by=by-site&size=100&tick=hourly&from=SLAC&to=WORLD&ex=none&beacon=off&column=2 See Attacks Lead To Internet Slowdowns for more on the impact on the Internet at large.

Postscript

Email from Mike Wilde [wilde@mcs.anl.gov], 9/12/01:
Les, it's sadly ironic that one of the people that made such robustness 
possible was Daniel Lewin of Akamai, a victim of this tragedy.

Mike
For more on the impact of the WTC event on DANTE and European links, see: Special update on the transatlantic situation after Tuesday's events.

Email from Klaus Moeller Friday September 14, 2001.

First, let me express our heartfelt sorrows for the victims and their
relatives of the attack on the WTC, the Pentagon and the crashed
planes.

Now to the reason of my posting. This might be of interest as an
example, how the terrorist attack may also harm internet operations.
In second, it may help to explain, why some connectivity to Europe and
Germany may be bad.

The DFN was connected via two 622 Mbit/s links to the US part of the
internet. These links (and a link from TEN-155, the european backbone)
terminate at a Building in downtown Manhatten (60 Hudson St.). (They
start in Hannover and Frankfurt.)

The DFN point-of-presence (i.e. the point where DFN interlinks with
the US providers) is at the Telehouse in downtown Manhattan. Telehouse
and 60 Hudson St. are connected with a 10 Gbit/s fiber optic ring.
One half of the ring ran below WTC tower 1, the other half below WTC
tower 2. The Telehouse also host the DANTE POP. DANTE operates the
trans-european NREN backbone.

When the WTC collapsed, the 10 GB ring was severed in two places,
instantly cutting connectivity 60 Hudson street to and from the
Telehouse. Furthermore, the power was cut from Telehouse. Two days
later, the cooling unit of the emergency power generators gave out.

The DFN has a third, experimental 622 Mbit, link to a commercial US
provider. This link terminates somewhere else. All connectivity from
the DFN to the US is (sine tuesday) via this link. However, for all
european networks that can use only the DANTE transatlantic link,
connectivity to the US internet is lost due to the Telehouse power
outage. This will most likely hit the smaller (or poorer) european
countries.

Currently, work is underway to restore connectivity back to 2 * 622
Mbit, although it will, for obvious reasons, not be by repair of the
fiber optic link. Work is also underway to restore power to
Telehouse. About the plans of DANTE, I have no knowledge.

Regards,
		Klaus Moeller, DFN-CERT

Page owner: Les Cottrell