 if the terminal server failed, all the Sun servers halted. The parallel discovery was that having all the servers offline was not good for business. Sun's newer servers do not halt on a break signal, but, if you're using older Sun systems, beware of using Cisco routers as remote console devices. See Cisco field notice #15521, titled "Terminal Server Break Character on Cisco Access Servers," for more information on this problem. Chapter 36: Failures Sometimes, multiple devices fail for reasons known only to them. In one installation, I saw a dual-supervisor 6509 have a compound failure where the primary supervisor failed, but the primary MFSC stayed active. Because the MSFC is tied physically to the supervisor to get connectivity to the networks in the switch, the entire location went down, even though the secondary supervisor was up and had failed over prop- erly. The MSFC that was still active on the failed supervisor had no networks to route. Problems like this don't normally happen when using newer versions of IOS, but then, I would have told you at the time that what we were seeing was not possible, either. Disaster Chains Modern commercial aircraft are some of the most amazingly redundant systems on Earth. When one device fails, another device takes over. When two systems fail, a third can take over with a reduced capacity, and SO on. Commercial airplanes even have multiple pilots! Still, these testaments to fail-safe engineering can and do crash. When they do, the crash is usually discovered to have been caused by a series of events. These events, all relatively innocuous in and of themselves, spell disaster when strung together. Such a chain of events is called an accident chain. Massively redundant networks can suffer from accident chains, too. Considering the impact such compound networking failures can have on a business (not to mention one's paycheck), I like to use the term disaster chains to describe them. Imagine a network with two Cisco 6509 switches in the core. An outage is planned to upgrade on