dination Center from several sources) shows changes to the BGP routing table. Events are reflected in reachability measures as well: Matrix NetSystems recorded a brief 8 percent decrease in the ability to reach (ping) a select number of sites on the Internet in the minutes following the collapse of the first tower (see Figure 2.2).³ A loss of this magnitude for an extended period of time would generally be considered a serious problem, but its occurrence for a brief period of minutes is less so—and certainly not unprecedented. Data from a full month show other dips in reachability, but of a smaller magnitude (see Figure 2.3).

Internet routing and reachability measurements returned nearly to normal within 15 minutes of the collapse of the South Tower. However, Matrix NetSystems and Telstra BGP data show that on September 11, about 1 to 2 percent of the approximately 105,000 routes did not return to normal for almost 24 hours. Some of these routes were for businesses located in the World Trade Center complex. Interestingly, others were associated with ISPs in other countries—Italy, Germany, Romania, and South Africa, for example. The collapse of the North Tower appears to have caused some transatlantic circuits to fail, and these ISPs obviously depended on their New York City links for more than just connectivity to the United States (see Box 2.1).

An analysis of the BGP message activity measured during and after September 11 shows that some global routing “events” (spikes in the volume of BGP messages) did take place because of outages caused by the attacks. However, the magnitude of these events was quite modest.

Overall, the rate of BGP routing advertisements and withdrawals suggests that the Internet was actually more stable than normal on September 11. One possible reason for this overall stability is that network operators understandably tend to avoid optional maintenance and hardware or software changes during emergencies. Anecdotal information from network operators also suggests that many operators were watching the news instead of making normal changes to their routers. The most significant traffic and routing events occurred several hours after the attacks; they resulted from damage to the Verizon central office at 140 West Street and power failures at the Telehouse 25 Broadway Internet co-location facility. Several of these events are visible in Figure 2.1.