Arista DANZ Monitoring Fabric

Arista DANZ Monitoring Fabric (DMF) is a network packet broker (NPB) platform that uses an SDN-controlled fabric of merchant-silicon switches (from Arista, Dell, and Accton) to replicate, filter, aggregate, and distribute network traffic to security monitoring tools, intrusion detection systems, and network analytics platforms without tapping the production network directly. The SDN control plane is provided by a high-availability pair of DMF controllers, which manage the full switch fabric through a centralised policy model: operators define what traffic to capture (by VLAN, IP prefix, protocol, or port), where to send it (which monitoring tool ports), and how to transform it (stripping headers, de-duplicating packets), and the controllers push those policies to the underlying merchant-silicon switches as flow table entries. The NPB function runs in the switching silicon at line rate, with no packet processing overhead on the controller and no additional latency introduced to the production network being monitored.

The controller can be deployed as a virtual machine on KVM or VMware ESXi hypervisors (minimum 8 vCPU, 32 GB RAM, 400 GB storage), or as a dedicated 1U hardware appliance (DCA-DM-C660) with an Intel Xeon Silver dual-socket 12-core processor, 64 GB RAM, 8 TB SATA storage, and 2×10 GbE connectivity, rated to 115,000 hours MTBCF. A separate Service Node appliance (DCA-DM-SNR660) handles packet processing for analytics functions (deduplication, header stripping, load balancing to tool clusters) with a 24-core single-socket Xeon processor, 128 GB RDIMM, 960 GB SSD, and 4×25 GbE + 2×1 GbE network interfaces. Multi-tenancy support allows separate IT teams (security operations, network operations, application monitoring) to access their own filtered view of the monitoring fabric through a single physical infrastructure, rather than requiring separate NPB deployments per team.