How is country information acquired/decoded/resolved in Netflow? What does unknown country mean?
I've been looking for an answer to this question myself. I can only assume that they use a hardcoded DB of public IP addresses pulled down from ICANN or the like. Wish we could edit it though.
