FAA outage: a router can cause denial of service without a cyberattack

What happened on 13 November

On 13 November 2026, the US Federal Aviation Administration, or FAA, stopped departures across the United States for several hours after intermittent telecommunications failures affected multiple air traffic control centres. Communications with aircraft and some radar feeds became unstable enough to trigger a nationwide precaution. Aircraft already airborne continued toward controlled landings under established safety procedures.

The FAA’s first statement said only that communications problems were under investigation. The following day, the US transportation secretary gave a more specific but still preliminary explanation. A contractor was replacing a copper line with fibre at a remote site and installing a router. That device allegedly began flooding other routers in the air traffic control network. Officials reported more than one thousand connection attempts every four to five seconds. They are still determining whether installation error, misconfiguration or defective equipment caused the behaviour.

This timeline is the current US government account and should be tested against the complete technical report when one becomes available. The FAA and Department of Transportation say they have found no indication of a cyberattack, foreign intervention or an artificial-intelligence system. The new SMART airspace-management tool was disconnected from the affected infrastructure, according to the department.

A flood is not automatically a DDoS attack

The high connection rate and the word “flooding” prompted speculation about a distributed denial-of-service attack, or DDoS. The comparison is understandable. In both situations, equipment receives more traffic or requests than it can process, resources are exhausted and services become unstable. The effects on availability may look similar.

Classification depends on source and intent. A DDoS attack normally involves multiple controlled or compromised sources deliberately sending traffic to make a target unavailable. A network loop, continuously resetting session, unstable routing protocol or misconfigured new device can create an internal flood without an attacker. Public evidence currently places the FAA event in this second category.

The word “ping” can also be misleading. A connection attempt is not necessarily an ICMP packet generated by the ping command. It may be repeated session establishment, control messaging, reconnection or another network exchange. Without packet captures, router logs and a configuration timeline, it is not defensible to say that someone was pinging routers or that a botnet attacked them.

Why this remains a cybersecurity incident

The absence of an attacker does not remove the event from cybersecurity. Availability is one of the fundamental properties that security must protect. A critical network unable to contain a local error, rate-limit control traffic or fail over cleanly has a resilience weakness that could later be triggered deliberately.

The scenario raises architectural questions. Why could equipment installed at a remote site affect several control centres? Did legacy routers have control-plane protection and rate limits? Was the new circuit introduced progressively? Was the configuration validated outside production and under load? Did redundancy share the same dependencies or error?

US officials said newer equipment did not fail in the same way while older routers and switches became overloaded. That does not prove every modern device is resilient. A safe migration must verify interaction between generations, backup-path capacity and system behaviour when the new component becomes abnormal.

The lesson for African airspace

The incident comes as Africa accelerates air traffic management modernisation. In early November, continental stakeholders adopted an ATM Master Plan and Vision 2045 in Livingstone to improve the exchange of flight-planning and monitoring information. The International Civil Aviation Organization is also continuing the audit and modernisation of AFISNET, the Africa-Indian Ocean satellite network, including newer messaging and inter-facility data exchange systems.

These changes are necessary. They also increase interconnection among air navigation providers, airports, airlines, satellite networks, terrestrial circuits and technology suppliers. One local change can have regional impact if boundaries, segmentation and fallback mechanisms have not been tested together. This does not mean AFISNET or an African control centre has the US fault; no reviewed evidence supports such a claim.

The African challenge is also economic. Backup links can be expensive, fibre is not available everywhere and some countries depend on a small number of centres or specialist providers. Migration cannot therefore mean replacing copper with IP and declaring completion. Authorities need to fund testing, observability, spares, technical staff and procedures for safely reducing traffic.

Controls required before every migration

A change to a critical aviation network should begin with a map of dependencies and failure domains. Teams need to identify which centres, radars, radios, messaging systems and backup paths can receive traffic from the new device. The plan should define stop thresholds, decision ownership and a rollback that can be completed within minutes.

Change must be limited to the smallest possible scope. A staged deployment, observed by separate network and operational teams, allows sessions, errors, queues and processor load to be assessed before expansion. Routers should protect their control planes, rate-limit reconnections and prevent one neighbour from consuming all resources. Alerts should cover session-creation rates and route changes, not total bandwidth alone.

Redundancy must then be tested under real fault conditions. Two links are not resilient if they traverse the same site, depend on the same supplier, carry the same bad configuration or fail over to equipment unable to absorb the load. An exercise should simulate loss of the primary circuit, a flapping router, an internal flood and unavailable monitoring.

Investigation must preserve before-and-after configurations, logs, interface counters, routing tables and packet captures where feasible. That evidence distinguishes error, hardware failure and malicious action. Declaring a cyberattack too early can misdirect the investigation; excluding one without adequate telemetry is equally weak.

The right question is not only “who attacked?”

The nationwide US ground stop demonstrates that an event without an identified adversary can produce the operational effects of denial of service. African aviation networks need architecture that limits the impact of a failed component as effectively as it limits an attacker.

Cyber resilience means being able to observe traffic, isolate one site, preserve essential communications and restore service progressively without compromising flight safety. The US investigation may refine the cause. Available facts do not currently justify calling this a DDoS attack; they already justify close examination of how Africa’s critical aviation networks are migrated and tested.

— ◆ —