[Bro] arista & cpacket experience

Juan Caballero juan.caballero at imdea.org
Mon Oct 20 03:31:15 PDT 2014


Hi everyone,
We would like to deploy a Bro Cluster at a 10 Gbps at about 35% peak usage.
We already have a splitter in place and are discussing options for a
front-end that can merge both traffic directions and load balance sessions
to Bro workers based on session hash and MAC rewriting. Ideally we would
like some equipment that supports multi-port mirroring so that we can add
other monitoring tools in addition to the Bro Cluster (e.g., Snort,
TimeMachine or other Storage).
Robin mentioned to me that people are using Arista and CPacket switches for
this kind of setup. After looking at their webpages the Arista 7150 seems
like a possibility for us (I see on the web page the San Diego SDSC and
Cornell use the larger 7500 series) and CPacket's cVu240NG may be another
(although there is less  information about CPacket products online). 

Does anyone have experience with these products? Do those models make sense
for the description above?
Any recommendations or things to consider for people without prior
experience in such setups?

Thanks!

Juan Caballero
Assistant Research Professor
IMDEA Software Institute
Madrid, Spain






More information about the Bro mailing list