Seems from this article to have been a pretty standard operation, despite the unusually large scale.
The biggest thing I picked up on was their practice that they mentioned of sampling traffic and analyzing it asynchronously, to avoid latency penalties.
The biggest thing I picked up on was their practice that they mentioned of sampling traffic and analyzing it asynchronously, to avoid latency penalties.