Everything fails

Every component in a network will eventually fail, so designing for failure isn't pessimism; it's arithmetic. A link that's down for a day every few years, a router reboot for a software update, a contractor's digger through a fibre: across a network of any size, something is broken most weeks.

The obvious response is redundancy: two links, two routers, two providers. But a second link only helps if three things are true:

1. Something notices the failure. Automatically, not when a customer calls.
2. Something moves traffic to the other path. At both ends: traffic has to come back as well as go out.
3. It happens fast enough to matter. Five minutes of outage while a backup slowly takes over is still an outage.

The hard part is the first one, because the most common failures are quiet. A link that's cut cleanly takes its interface down, and the router knows at once. But many failures leave the interface up and the path dead: a fault inside a provider's network, a switch or media converter in the middle, a firewall rule, a congested or broken path beyond the first hop. The router's interface light stays green, and traffic disappears.

Redundancy that depends on someone noticing is a hope, not a design. The next section tests that claim with real routers.