Scanning the Spanish grid outage

Motivation

On Tuesday, April 16 2025, the Spanish national grid achieved a veritable milestone. For the first time in history, for nine full daytime hours on a weekday, 100% of Spain's electricity demand was met by wind, solar and hydro power. This achievement wasn't particularly well celebrated; like most of us, I didn't even hear about it at the time.

The events of a dozen days later certainly did make the news. Mid-morning on the 28th, the real electricity demand across mainland Portugal and Spain plummeted as a widespread system failure caused loss of power across the Iberian Peninsula. While the causes of the outage are still being understood, we thought it might be fun to see the effects of the outage on what is of course the most interesting device to be powered by electricity, namely the humble internet-connected computer.

A candid portrait of the internet scanner in their natural habitat.

Measurement

At Driftnet, we operate one of the most capable internet scanners, covering thousands of responsive ports across IPv4 and IPv6 space. One of the characteristics of our scan is that when we discover and get a positive response from a service, we note that down in our big database of all the IPs and ports which are responsive on the public internet¹, and we revisit that service every three days hence. Like a dung beetle going back and forth across the Spanish desert, if you can forgive a scatological turn of phrase.

This means that in normal circumstances we tend to collect a pretty constant, approximately-random sample from systems across the public internet. And so, we thought, if a geographical region of the internet were to disappear, we ought to see that. It was time to fire up BigQuery and take a look.

The first thing we did was to isolate the Spanish and Portuguese data in our overall scan. We create our own server-focused IP geo feed using LLMs, and we stamp geo on all of our events, so this was easy: just a case of selecting rows with type geo-country and value ES or PT. From there it was simple to count the number of unique active IPs in each hourly time window and plot the same data alongside the real hourly demand taken from Red Eléctrica's dashboard.

Electricity demand roughly correlates to the number of responsive IP addresses seen per hour.

The correlation here is pretty striking: between 0900-1000 UTC (1200-1300 local), we see a drop-off of almost 50% in the number of responsive IP addresses. This almost exactly matches the 50% drop in load reported by Red Eléctrica. Interestingly, we don't see the load return quite so quickly: there is a lag of a few hours. We can only speculate as to why this is, but the most likely possibility seems to be that switching machines back on required some level of manual intervention.

By early the next morning, the grid had returned to normal. At this point we actually started seeing more unique IPs per hour than we did before the system tripped out, but this isn't a real phenomenon. Rather, it is due to a characteristic of our scan system — we expect systems to be unreachable occasionally, so we employ an exponentially backed-off retry on failure. This means that as the systems which were down during the outage come back, we reconnect to them sooner than usual in order to fill gaps in our data.

Geography

Reporting at the time suggested that power recovery had been uneven, with Morocco and France mentioned as having helped in recovering the north and south regions of Spain. We wondered whether we could use our regional geo to generate a more detailed plot of the outage, and perhaps see this behaviour in real-time. We could, but as is often the case, real data isn't quite as clean as one might hope.

If you squint a bit then you can see the power drop off and return, especially in the more rural regions, but the signal isn't strong. Also, the number of machines marked as active in the capital regions of Madrid and Lisbon seems pretty constant throughout the period. IP geo is known to disproportionately associate companies with their headquarters, and those headquarters tend to be in capital regions, so we suspected this was part of the problem. We also wondered if some providers in those regions perhaps weren't affected so much by the outage?

Entities

To test this hypothesis, we first measured the top 10 ASNs (by unique IP count) in the ES/PT data during the 0900-1000 window. We then tracked the behaviour of these ASNs throughout the outage.

Autonomous systems responded to the outage differently.

Clearly, the event didn't hit everyone equally. More access-focused providers, like Telefónica, Xtra Telecom and Orange, appear to have dropped off significantly during the outage — although of course it isn't possible to say whether that was because the networks themselves went down, or it was the customer equipment which lost power. Other organisations, like OVH and IONOS, appear not to have been impacted at all. An interesting case is loading.es, which stayed up for at least eight hours after the outage began and then lost connectivity for a few hours before recovering.

Devices

We wondered if that observed disparity between access- and hosting-focused providers would translate into a difference in the types of devices that went up and down during the period. Driftnet does port-independent protocol detection, so we have a good handle on Remote Desktop Protocol, including those machines which have RDP moved to an alternate port². We also tag up the type of devices we recognise (product-tag in our data type language), so extracting observations of common home router brands was easy. And yes, we do see a difference in behaviour; more home routers disappeared, proportionally, than RDP servers.

Home routers were more affected by the outage than Remote Desktop servers.

Finally, as is traditional for internet scanners, we couldn't resist checking the effect of the outage on internet-connected Industrial Control Systems. Here, we see a pretty clear effect; three-quarters of IPs exhibiting known ICS protocols dropped out.

Industrial control systems were strongly impacted by the outage.

This is a bigger effect than expected, and it might indicate that this shows that the majority of industrial/commercial businesses actually went down during the outage. Alternatively, of course, it could be networking outages. Either way, it is instructive about the nature of the internet; it's not a homogenous place, and power losses don't affect it uniformly.

— Driftnet Data Science