Public DNS Lookup not working properly

Question

Greetings all,

I am doing some traffic monitoring using my beloved NTA module

I have noticed that some public IP addresses in conversations do not resolve properly.

Here is an example:

Click on a Node > Network tab > Interface name

View Top 10 Conversations for that Interface

Observe that some public IP addresses that are resolved to their domain name, e.g. server.theconservativeincomeinvestor.com (198.1.64.17)

but there are several that do not e.g. 64.27.100.131

Click on the conversation between 64.27.100.131 and my private endpoint (192.168.52.65)

Click on the Public IP address - it lists the country

Click lookup

Is there a setting that has to be configured for external DNS lookups?

shawn_b · Answer

Greetings,

choly and michal.hrncirik thank you for your replies

ping-a doesn't resolve the domain name

My DNS setting is set to Persistent

might this be a problem with my internal DNS servers?

michal.hrncirik · Answer

I'm curious it that was caused by your DNS (not able to translate IP) or NTA only. (you may try to use googles 8.8.8.8 DNS for your SolarWinds NTA instance for a while). Also, NTA can be configured for DNS translations (onDemand vs. continuous) more here: http://www.solarwinds.com/documentation/en/flarehelp/netflow/content/orionnetflowag-dnsresolutionoptionsinnta.htm

let us know where did you end.

choly · Answer

Hi Shawn,

Does ping -a 64.27.100.131 return you a hostname? If it doesn't, NTA is not going to be different, as it performs the same action...

But looking at whois, that IP likely belongs to newszoom.com (64.27.100.131 - Datapipe, Inc Whois)