0 Replies Latest reply on Feb 24, 2009 8:43 AM by bthornto

    Netflow and DNS (can we use Orion for forensics)

      I'm wondering how Orion behaves when a users IP address changes- either due to DHCP, moving to a conference room or creating a VPN connection.

      Does Orion resolve Netflow data to a machine name at the time the data is resolved and write that to a history table or is the resolution done when I query or report?

      As an example- If I trade IP addresses with a colleque and query for each machine name will I see multiple entries?  One for my previous address and one for my new?  Or will Netflow just keep assuming the IP Address / hostname coorelation is static? 

      Also-  I saw some posts last fall about DNS caching not updating properly every 2 hours and listed as a bug.  Has this been resolved and in what version of NTA?

      As Always, thanks-  Brad