[Bro] Arista Traffic Shunting

[Logan Miller]

Hello everyone,

We have a bro cluster setup and running but we are getting a lot of packet loss from elephant flows. We've seen that a lot of people use an Arista switch to block these flows but we haven't seen how to interface with Arista from bro. How do people do traffic shunting using Arista?

These are the sources where we've seen people shunting traffic with Arista:
http://www.cspi.com/wp-content/uploads/2016/09/Berkeley-100GIntrusionDetection.pdf
http://mailman.icsi.berkeley.edu/pipermail/bro/2015-January/008038.html
http://www.ucop.edu/information-technology-services/initiatives/sautter-award-program/sautter-2015/berkeley_lab-sautterawardnomination2015.pdf

Thanks,

Logan Miller
Network Security Engineer
Brigham Young University
Office of IT
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170731/1cda2fd6/attachment.html