The Federal Aviation Administration has restored full operations after a network failure halted departures across the United States for nearly five hours on Friday, November 13. The disruption began during a contractor-led upgrade from copper wiring to fiber-optic service at a remote FAA facility, where a newly installed router began flooding other routers with connection requests.
Transportation Secretary Sean Duffy said the equipment generated more than 1,000 connection attempts every four to five seconds. That activity destabilized communications and radar feeds used by multiple air traffic control centers, prompting the FAA to stop takeoffs nationwide at 3:36 p.m. Eastern time. The stop was lifted at about 8:20 p.m., but airline schedules remained badly disrupted through Saturday.
Government officials have not yet determined whether the immediate cause was faulty hardware, a configuration mistake or another contractor error. L3Harris Technologies, the contractor carrying out the upgrade, said it was supporting the investigation. Officials have reported no evidence that a cyberattack caused the failure, and they have not linked it to the FAA’s recently expanded AI traffic-management tools.
What happened during the FAA network upgrade
The work was part of a broader effort to replace aging telecommunications equipment across the national airspace system. According to the Transportation Department’s November 14 briefing, the contractor was moving a site from discontinued copper infrastructure to fiber and replacing a router when abnormal traffic began spreading through the air traffic control network.
The FAA initially detected instability in communications and radar systems serving its centers and terminal radar approach control facilities, known as TRACONs. Those systems allow controllers to speak with pilots, track aircraft and hand flights from one region to another. The agency’s first public statement described communication problems affecting multiple Air Route Traffic Control Centers.
The phrase “more than 1,000 connection attempts every four to five seconds” describes connection activity, not the total volume of data moving through the network. A modern commercial router may forward far more traffic under ordinary conditions. What matters in a failure like this is where the requests landed, which control processes they triggered and whether repeated session setup, route changes or error recovery consumed resources on older equipment.
The FAA has not disclosed the protocol involved, the router model, the network topology or whether the traffic caused processor, memory, session-table or link-capacity exhaustion. It has also not explained how activity from a remote site crossed enough shared infrastructure to affect centers nationwide. Any technical account that assigns a more specific mechanism remains speculation until the agency releases its investigation.
Why the FAA stopped departures nationwide
Controllers did not lose every way to communicate with every aircraft. Planes already in the air continued to their destinations and landed using established contingency procedures. The danger was instability: intermittent gaps in radio communications or radar data make it harder for controllers to maintain safe separation and coordinate handoffs as aircraft cross regional boundaries.
A ground stop prevents the system from adding more aircraft while controllers manage those already airborne. It also reduces the number of handoffs between towers, TRACONs and the FAA’s 22 regional control centers. That is why a telecommunications problem at one part of the system can affect airports thousands of miles away even when their local towers remain operational.
Friday’s order was the first nationwide FAA ground stop since a damaged pilot-notice database halted departures for about 90 minutes in January 2023. This shutdown lasted roughly four hours and 44 minutes. Reuters reported that the failure and its recovery disrupted more than 20,000 flights, while airlines continued cancelling and delaying services on Saturday as aircraft and crews remained out of position.
The fiber upgrade was not itself the problem
Replacing copper circuits with fiber is a necessary modernization step. Fiber offers higher capacity, is less susceptible to electrical interference and can be easier to monitor and reroute. The failure occurred during the change, but officials have not said that fiber technology caused it.
The more consequential issue is how a routine network change acquired a national blast radius. Critical networks are normally designed so a failed device or a bad configuration can be isolated, rolled back or bypassed. Redundant equipment offers limited protection when both paths depend on the same control plane, configuration, management service or downstream bottleneck.
The investigation therefore needs to answer several operational questions:
- Was the replacement router tested with the exact legacy equipment and production configuration it would encounter?
- Did engineers have a validated rollback procedure, and how long did isolation or rollback take?
- Why did connection activity from one location propagate beyond its expected segment?
- Were rate limits, circuit breakers or route filters available to contain the traffic?
- Did primary and backup communications paths share a common failure domain?
- What alarms appeared first, and could operators identify the originating device quickly?
- Was the work performed inside an approved maintenance window with national traffic consequences understood in advance?
Those answers matter beyond aviation. Hospitals, utilities, payment networks and cloud services face the same risk when new equipment meets legacy infrastructure. A change can be technically correct in isolation and still fail because production dependencies, failover behavior or traffic patterns were not represented in testing.
A modernization program now has a live resilience test
Congress approved $12.5 billion last year for air traffic control modernization. The FAA has since replaced thousands of copper connections and upgraded hundreds of radio systems, according to reporting from The Associated Press. The agency is also expanding controller-pilot data link communications, which lets controllers and pilots exchange routine instructions through digital messages rather than voice alone.
Friday’s failure does not argue for preserving obsolete copper networks. It shows that migration engineering must receive the same attention as the destination technology. Staging, segmented rollout, automated health checks, traffic guards, rehearsed rollback and independent validation are especially important when old and new systems must coexist for years.
The immediate service crisis has eased. Duffy said FAA systems were back at full operation on Saturday, and Administrator Bryan Bedford expected airline schedules to normalize by the end of Sunday. Travelers should still check directly with their airline before leaving for the airport because crew and aircraft repositioning can produce delays after the underlying network is restored.
What remains unconfirmed
The router flood is the government’s preliminary explanation, not a final root-cause report. The FAA has not published device logs, a sequence of configuration changes, a failure-domain diagram or a timeline showing how each backup system behaved. L3Harris has not publicly identified the equipment involved or accepted responsibility for a specific error.
Until those details are released, the strongest conclusion is narrow: routine modernization work at a remote facility introduced abnormal router activity into a shared air traffic control network, communications and radar became unstable, and the FAA chose to stop departures rather than operate with uncertain safety margins. The investigation now has to show why existing containment and redundancy did not keep a local change local.
Image: FAA air route traffic controllers at the Washington ARTCC. Public-domain FAA image via Wikimedia Commons.
