~learn.

Rogers deleted one routing filter and Canada lost a whole carrier, 911 included.

Five upgrade phases went fine, so phase six was rated low risk. Two minutes after that change, Rogers' IP core began to fail.

Rogers Communications · 2022 · 2 min read · a true story, sources below

On 8 July 2022, Rogers, one of Canada's biggest carriers, went dark: mobile, internet, business lines and, for its customers, 911.

For weeks Rogers had been upgrading its IP core network in a seven-phase process. That morning was phase six. In its response to the regulator, the CRTC, as quoted by The Register, Rogers wrote: "At 4:43AM EDT, a specific coding was introduced in our distribution routers which triggered the failure of the Rogers IP core network starting at 4:45AM." According to that response, the change deleted a routing filter and let all possible routes to the Internet through. The routers began pushing "abnormally high volumes of routes" into the core, the core equipment exceeded its capacity and stopped routing, and wireless and wireline lost the Internet together, because they shared one core.

A review for the CRTC by Xona Partners, reported by The Canadian Press, found why the change got through. The first five phases had gone fine, so a risk algorithm rated phase six low risk, which let it skip extra scrutiny and approvals. The review said overload protection limiting how much routing information flows into the core could have prevented the failure.

Recovery was slow. According to the review, with the core down, remote staff couldn't reach Rogers' systems, so people went to sites to reach routers in person. Critical error logs showing the root cause couldn't be accessed until 14 hours in. Rogers said service came back from the afternoon into the evening.

The next day, CEO Tony Staffieri pointed to "a maintenance update in our core network". Two weeks later he promised C$10 billion over three years on reliability, and to separate wireless and internet.

The numbers
  • 2 minutes: from the change at 4:43 a.m. to the core starting to fail at 4:45 a.m. EDT
  • Phase 6 of a 7-phase upgrade
  • About 12 million people cut off
  • 14 hours before the root-cause logs could be read
  • C$10 billion over three years promised for reliability

Why it matters: Past success doesn't make the next change low risk. Cap what one router can push into the core, and keep a way into your systems that doesn't run through them.

Sources

the idea behind it · W10 · DAY 03Deployment Strategiesread the lesson →