Anyone know how to track which internal IP is accessing an external IP. We have netflow setup and we can see the one internet IP that's sucking up our bandwidth. Is there anyway to track down internally who's going to that IP ?
You need to gather Netflow data from a router that's internal to your network to recieve that kind of data. If all you're getting is your gateway's IP address at the other end of the conversation (e.g. internal hosts are NATed), then that gateway's IP address is the only data that the Netflow product is receiving. Floyd May Software Developer SolarWinds.Net
