Bro Tap/Span Networking by Bob Bregant
Channel: Zeek
Date: 04/09/2014

Through the use of Arista’s “DANZ” software (really just tap aggregation on one end and then mirroring symmetric hashing and load balancing on the other), you can fix split-routing issues, bring up Bro without having to cut out your other tools (or vice-versa), filter out traffic that you aren’t interested in, and even set up a test cluster that gets some/all of your production data to test on. I’ll show you how the University of Illinois is utilizing this system to keep the security and networking teams happy and how you can do the same without having to shake down your users for their lunch money.