Free Netflow Analyzer

Question

Hi,

My manager would like me to report on top talkers. When viewing the "applications" the ip addresses that come up are well weird. For example, say we have a 192.168.0.0/24 network. For most results of the "top talkers", the ip addresses  appear as "x.x192.168".

Eg: 10.54.192.168, 15.44.192.168 etc.

Has anyone have an explanation for this or experiencing the same issue ?

Thanks

mcbridea · Answer

That is a strange one. If you have eliminated the office practical jokester, then the next step would be to take a packet capture of the flows from the NTA server interface. Examine the IP addresses in the actual flow data. If they are in the X.X.192.168 format theyre is a problem with the device(s). If they all look like 192.168.X.X call SolarWinds support.