randomguy

You could always create a custom property such as DeviceVendor and then place the identification of them in there . i.e windows / linux / cisco ect Then you can change the display quite easily to show these instead - thus eliminating the unknowns

darkshooter Did you ever get this in place?

Thank you Georgiy!

how did you get on with this?

I had a feeling that would be the answer - thank you for the response unfortunately we know what switch it is occuring on so I think my next move is to run the engineers toolset switch port mapper and start checking to see if duplicate macs etc exist

Nobody able to throw some light on this??

Further to this, when I drill into the other ports that we haven't set netflow on we don't see any data....