Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Flood of DNS requests

justinh

Whenever I enable Netflow, it floods the network with DNS requests, constantly. Is this normal?

Find more posts tagged with

Accepted answers

All comments

derhally

This is occuring to resolve the hostname of the ip addresses that are part of the netflow data.

rgarrison

Is there a way to disable reverse DNS lookups, particularly on external IP's?

derhally

Unfortunately, not at this time.

dopod

Same problem, floods the router with DNS requests !!! 8(

rgarrison

We tracked our problem back to having Netflow enabled on our border routers. After removing Netflow from these routers, we had to delete all of the rows from the FlowCorrelation and NetFlowAddressToResolve tables. It appears NetFlow uses these tables to cache reverse DNS information and will refresh this data regularly. We had over 16 million rows combined in both tables, most of them for external IP's. I don't recommend manually removing the rows without talking to support first.

A future release needs to have the capability to disable reverse DNS, especially for external IP's. There's some good Netflow information on our border routers, but not at the high cost of crushing our internal DNS.