5 ms·
If you just look at the largest 4 of those, you'd have 100Tbps of traffic to monitor, with an average throughput of roughly half of that. That's ~540PB ((50 Tb
by strictnein 8d ago
If you just look at the largest 4 of those, you'd have 100Tbps of traffic to monitor, with an average throughput of roughly half of that.
That's ~540PB ((50 Tbps / 8 bits) * 86400 seconds/day) of traffic a day with just those four. Add in the rest and you're likely talking ~Exabytes of data each day. And that has to all be processed on site.
If someone wants to argue that the NSA is in these facilities I'd be 100% onboard. But inspecting it all would be nearly impossible, let alone capturing it all and sending it back to some datacenter somewhere, which is a physical impossibility.
- mitxela 8d agoThat's nothing a rack full of fast switches can't handle. A rack full of fast switches already does handle it - where do you think the original copy came from? They will get a copy of the whole feed, but not store all of it - they will have heuristics for selecting interesting traffic.
- strictnein 7d agoSwitches handle data at far faster rate than any hardware can actually inspect it, store it, process it, etc. But yeah, just a rack of "fast switches" is all it takes to route hundreds of petabytes of data each day. You should let the data center operators know. They'd save billions.
- mitxela 7d agoSwitches do inspect it. They also have a feature designed for wiretapping, which copies a percentage of traffic to another port. They may have a feature to copy 100% of traffic matching a certain filter. Managed switch ASICs have this feature even though it's usually not exposed in the CLI.