Dual-Homing¶
Connectivity pattern — instantiates Path Redundancy Provisioning
Connects a node to two upstream paths or providers so the node is not isolated by a single upstream failure.
Some failures do not sever a route through a network — they cut off a single node at its root, where it attaches to everything upstream. Dual-Homing is the topology fix for that: it gives one node two upstream attachments at once, provisioned to sit in genuinely separate failure domains, so losing either attachment leaves the node still connected. Its defining property is that it is a standing property of the node itself — the node is, at all times, reachable by two independent ways in — rather than a route or a plan for switching between distant points. The whole discipline lives in the word independent: two upstream links that enter through the same conduit, ride the same transit provider, or draw the same power are not two homes, they are one home wearing two labels. Dual-homing's job is to make the two attachments real by making them decorrelated.
Example¶
A hospital's data center buys internet connectivity from two carriers and considers itself dual-homed — until a review traces the physical routes and finds that both "diverse" circuits leave the building through the same basement conduit, cross the same river on the same bridge, and hand off to the same regional transit provider three hops up. A single backhoe at the bridge would take both. The team re-provisions the second attachment to enter the building through a different physical entrance on the opposite side, run to a different central office, and use an upstream transit provider with no overlap in its path to the first. Now the node has two homes that share no conduit, no bridge, and no upstream — and a fiber cut on one entrance leaves the hospital fully reachable on the other. The independence check, not the second contract, is what turned nominal redundancy into real dual-homing.[n1]
How it works¶
The pattern is deceptively simple to draw and easy to fake; the substance is the independence verification:
- Attach twice, standing. The node maintains two live upstream attachments, not a spare that must be discovered — both exist before any failure.
- Define what "different" means. Diversity is specified on the axes that carry the threat: physical entrance, conduit, geographic route, provider, and upstream transit.
- Trace for shared fate. Each pair of attachments is walked end to end to find hidden convergence — a shared bridge, a common transit AS, a single power feed — because that convergence is what silently collapses two homes into one.
- Keep the two decorrelated as things change. Provider re-routes and construction can re-merge paths that were once separate, so independence is a property to re-verify, not to establish once.
Tuning parameters¶
- Attachment count — dual versus multi-homed (three or more upstreams). More attachments survive more concurrent losses but raise cost and coordination.
- Diversity depth — different circuit only, versus different entrance, conduit, provider, and geographic route. Deeper diversity survives broader shocks but is harder and pricier to source.
- Homing symmetry — whether both attachments carry equal load or one is the working home and the other a warm attachment. Symmetric homing uses both but complicates traffic behavior.
- Upstream-overlap tolerance — how many shared upstream hops are acceptable before the second home is judged not independent. Tighter tolerance is safer but narrows the provider choices.
- Re-verification cadence — how often the independence is re-traced. Frequent tracing catches re-merged paths at the cost of ongoing effort.
When it helps, and when it misleads¶
Its strength is that it removes the single most brittle point for a critical node — its one way in — and does so as a standing property that needs no cleverness on the day: the node is simply always reachable two ways.
Its central failure mode is false diversity: two homes that share a hidden failure domain, so the shared conduit cut, the common transit outage, or the single power event drops both at once and the "dual" homing protected nothing. This is precisely the shared-risk problem — two links that a diagram treats as independent but that a physical trace reveals to converge. The classic misuse is buying a second provider and declaring victory without ever walking the paths, then discovering the overlap during the outage. The guarding discipline is to specify diversity criteria explicitly and to trace both attachments for shared fate end to end — and to re-trace after any provider or facility change, since independence decays quietly as networks re-route.
How it implements the components¶
Dual-Homing fills the node-level independent-attachment side of the archetype — the standing topology, not the live switching:
alternate_path— the second upstream attachment itself; the node's additional way in.path_diversity_criteria— the explicit definition of what makes the two homes different: entrance, conduit, provider, transit.failure_domain_separation— the verification that the two attachments do not share a conduit, bridge, upstream, or power feed that would drop them together.
It does not detect a dead upstream and cut over to the survivor (path_health_signal, activation_or_selection_policy) — that live detection and selection is Out-of-Band Channel; nor does it size an attachment for load (capacity_reserve), which is Alternate Supplier Route.
Related¶
- Instantiates: Path Redundancy Provisioning — this pattern makes a single node reachable by two independent upstream paths so no single upstream loss isolates it.
- Sibling mechanisms: Alternate Supplier Route · Backup Route Plan · Out-of-Band Channel · Path Readiness Drill · Multi-Channel Communication · Parallel Service Path · Redundant Escalation Path · Redundant Network Link · Standby Transport Corridor
Editorial Notes¶
Form Classification¶
Form family: Structure, Architecture & Configuration
Rationale: Dual-Homing operates as a persistent arrangement of components, resources, interfaces, or technical topology because it connects a node to two upstream paths or providers so the node is not isolated by a single upstream failure.
Independent corroboration: The frozen evidence defines Dual-Homing as 'Connects a node to two upstream paths or providers so the node is not isolated by a single upstream failure', so its operative form is Structure, Architecture & Configuration.
Nearest alternative: Control, Automation & Runtime — Two standing independent upstream attachments form the enduring connectivity topology; failover behavior uses that structure.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Single lineage
Present-day reach: Specialized
Rationale: Network engineering cohered dual-homing as connecting a node through two genuinely independent upstream paths, with shared-risk groups exposed.
Related originating lineages:
- Engineering & Design — Reliability engineering supplied redundant-feed and common-cause-failure principles.
Review resolution: Computer networking is primary because dual upstream attachment established the named topology; reliability engineering supplies failure-independence analysis without a separate primary origin.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] A Shared Risk Link Group (SRLG) is the networking concept for a set of links that share a common physical resource — the same conduit, fiber bundle, or piece of equipment — and therefore can fail together. Genuine dual-homing requires that the two attachments belong to different SRLGs; two links in the same SRLG are one home, not two. ↩