Seems from this article to have been a pretty standard operation, despite the unusually large scale.

The biggest thing I picked up on was their practice that they mentioned of sampling traffic and analyzing it asynchronously, to avoid latency penalties.