Measuring Hurricane Isaias through Internet reachability

As Hurricane Isaias approached the Gulf coast, I wanted to watch Internet reachability change before, during, and after landfall. A statewide average is useful context, but the more interesting questions are local: which places stopped answering, how completely, and how quickly they came back.

I ran two complementary measurements from two independent measurement points. A broad ICMP scan across routed US IPv4 space supplied the state and city views. Separately, I probed a fixed panel of 100,000 addresses once per minute to compare the same population across networks over time. The 100,000 addresses were the fixed panel, not the extent of the broad scan.

The clearest result is how much geography matters. Florida’s worst statewide hour was only 2.3% below its reference reply rate, yet in its western panhandle the losses reached about 94.8% in Gulf Breeze, 94.1% in Destin, and 79.8% in Pensacola (Figure 1). Alabama, with more of its address space near the storm, showed the strongest statewide signal at 12.2%.

These are changes in replies per probe, not the fraction of households without service. I come back to what they can and can’t tell us at the end.

NHC reported landfall near Destin at 01:30 UTC on October 10, or 21:30 EDT on October 9. The dotted landfall line in each figure is the common reference point.

Each measurement point has its own baseline: October 9, 14:00–20:00 EDT. I calculate a reply rate from observed replies divided by probes, normalize it to that reference, and then give the two measurement points equal weight. The faster scanner therefore contributes more observations without dominating the combined index.

The statewide signal was strongest in Alabama (Figure 2). By the final six-hour comparison, its measured loss had narrowed substantially. Florida also improved at the state level, while Georgia and Tennessee were much closer to their reference rates.

These aggregates describe sampled address reachability. They are weighted by the addresses probed, not by population, subscribers, or traffic volume. Most of Florida’s address space sits on the peninsula, hundreds of miles from where Isaias came ashore, so even a near-total loss across the panhandle barely moves the statewide number.

Choose Through time in Figure 3, then press Play to animate the coastal measurements. Pause or drag the timeline to inspect a moment; the clock and city readouts follow the map. Playback interpolates between measured fifteen-minute city bins and across gaps for display only.

The city view (Figure 3) makes that dilution visible. Gulf Breeze and Destin each lost more than nine tenths of their baseline reply rate during their worst complete hour. Pensacola, one of the best-sampled cities in the set with more than 16 million probe observations in the reference window alone, lost nearly four fifths.

Recovery split sharply. In the six hours ending October 11 at 09:30 EDT, Destin was about 33.8% below reference and Fort Walton Beach 36.0% below: still badly impaired, but clearly coming back. Pensacola remained 68.7% below, and Gulf Breeze was still 90.7% below, almost as dark as at its worst.

The map uses approximate MaxMind city locations and Census boundaries. It should be read as a spatial view of measured IP addresses. A point does not locate a specific customer, and a municipal boundary does not define the coverage of an access network. The candidate-city screen favors locations with substantial observed changes; it is exploratory, rather than a ranking of every city in the country.

Broad scanning is valuable for geographic coverage, but a rotating target set can alter an operator’s apparent reply rate simply by moving between its regions. For network comparisons (Figure 4), I use the same frozen addresses throughout the event. An address remains in the denominator when it stops replying.

The largest panel decline belonged to Charter’s AS11955, at 57.8 percentage points, though from only 153 fixed addresses. Among larger panels, Troy Cablevision (AS13825, 426 addresses) fell 43.2 points at its worst hour and Mediacom (AS30036, 1,339 addresses) fell 23.8 points. These describe the measured panels and their geographic mix, not either operator’s total customer outages. Cox, the incumbent cable operator around Pensacola, shows only a 12.3-point peak in the panel because most of its 1,756 sampled addresses are nowhere near the Gulf coast: the same dilution as the statewide view, one level down.

The units matter. A reply rate falling from 80% to 60% loses 20 percentage points, or 25% relative to its original rate. The state and city graphics use relative percentages. The operator graphic uses percentage points.

Archived IODA active-probing observations show roughly a 6.2% peak decline in reachable /24 blocks in Alabama and 2.0% in Florida, relative to the same reference period (Figure 5). Changes in BGP visibility were much smaller.

IODA’s numbers should be smaller than mine. It counts a /24 as reachable if any address in it answers, so a block stays “up” until nearly every host behind it goes quiet; my index counts each address’s replies. The direction and timing agree, which is what matters for corroboration.

That combination is consistent with local access or power disruption while routes remain announced. It does not identify a physical cause. A route can remain visible while devices behind it stop answering, and ICMP measurements cannot distinguish a power failure from damaged access equipment or other sources of lost replies. IODA’s signal definitions explain the separate reachability and routing measurements.

The two measurement points were bare-metal machines on Gcore’s network in Atlanta and Miami. Both locations are densely interconnected with regional eyeball operators—the access networks that connect end users—and provide geographic redundancy across the two measurement points.

The broad scan covered approximately 1.232 billion routed US IPv4 addresses. I directed 80% of its scanning intensity toward 13 priority states in the storm’s path. Aggregate scan traffic was steady at just under one million packets per second, using ICMP echo probes only.

The fixed panel was a separate measurement: the same 100,000 addresses on relevant networks, probed once per minute at each measurement point. Holding the addresses fixed makes the network comparisons easier to interpret. An address remains in the panel when it stops replying.

The collection inventory contains approximately 101.2 billion probe transmissions and 13.8 billion reply observations, including repeated observations and commissioning runs. These are totals for the collection as a whole, not the workload of the 100,000-address panel alone and not counts of unique addresses. The published analysis uses the final stable ICMP cohorts.

Probe cadence and chart resolution

A chart interval is not the interval between probes to an address. The fixed panel was probed once per minute; Figure 4 groups those observations into fifteen-minute bins. The broad scan produces the separate geographic views: five-minute bins for states and fifteen-minute bins for cities.

The public charts end at October 11, 09:30 EDT, the last shared complete broad window. The reference window is October 9, 14:00–20:00 EDT. The collection inventory above includes commissioning runs and should not be interpreted as the probe count for this chart window alone.

State and city worst-hour summaries require a full hour of synchronized bins. Operator summaries require at least 90% minute coverage at both points. Six-hour comparisons use available matched observations within the stated window. For visual continuity, faint chart segments and the map timeline linearly interpolate gaps between measured values. All summary numbers use measured data.

The experiment was inspired by WatchtheNet. The scanner uses Andree Toonk’s packetio and go-afxdp libraries, with native AF_XDP zero-copy on one measurement point and AF_PACKET on the other. Both analytical datasets use ICMP echo probes.

Fast packet I/O gets the probes out, but the harder problem during an event is not losing what comes back. I kept evidence storage separate from exploration: reply observations went into compressed Parquet through independent storage workers, while a DuckDB index served the aggregates behind the dashboards. A slow query or stalled collector could not cost me measurements.

The most important caveat is the reference window. I didn’t start collecting early enough to get a clean pre-storm baseline, and the six hours I used were not quiet. Near the coast, reply rates were already falling inside the window itself: Pensacola’s rate in the early afternoon was roughly 23% above the window average, and it had dropped well below that average before 20:00. Normalizing against a window that contains part of the decline understates losses. The coastal numbers here are therefore conservative, and a value below zero later in the event, such as Mobile’s, mostly reflects a depressed reference rather than better-than-normal reachability.

Beyond that, address churn, filtering, ICMP rate limits, daily activity cycles, and geographic sampling all influence replies. Agreement between independent measurement points and corroboration from IODA strengthen the regional finding, but they do not make this a representative survey of subscribers or prove that every change was caused by Isaias.

For me, the useful result is the recovery pattern at local scale. A state average can drift back toward normal while particular coastal towns remain almost entirely dark. Measuring both scales shows what recovered quickly and what didn’t.

Collection inventory snapshot: October 11, approximately 10:14 EDT. Analysis cutoff: October 11, 09:30 EDT. All chart times are EDT.