What is your DNS Resolution set to under NTA settings?
It is set to persistent
1 of 1 people found this helpful
Set it to On Demand and check your results. It should perform DNS lookups for IP hosts as needed and will display names where resolvable.
Now, NTA won't show you a simple hostname like 'www.google.com', since the Netflow table refers to the resolution of the specific IP to which the client is connecting. You'll likely see lots of CDN providers (akamai and the like).
If the IP resolves to a nice, simple name then you're good.
For example, here's a quick scrape of some talkers:
can we simply pt to our ad/dns
The lookup piece just uses whatever DNS information your Orion box is using, I believe - so if you have your local DNS configured on the front-end server, then you're already doing that.
On-demand vs. persistent is, if I understand it correctly, more about *when* the DNS lookup is performed. Persistent means that it caches lookups for whatever period you specify in the NTA settings. On-demand means that live lookups are performed when NTA graphs are loaded and populated. If someone out there has a better idea of the mechanics of this and needs to correct me, please sing out - but these are the results I see when changing these settings.
Well, glad I checked - I had the persistent piece wrong.
Here's the relevant excerpt from NTA help -
By default for new installations, NTA resolves the domain names of all endpoints referenced in monitored Flows on demand. For most users, on demand DNS resolution optimizes overall performance. To meet your specific network monitoring needs, NTA provides the following options for configuring DNS resolution:•
Persistent DNS resolution continuously resolves domain names for all devices involved in monitored Flows. For typically‑sized networks, NTA views may load more quickly as resolved domain names are retained, but database query times may increase as your Orion database is continuously queried.
Note: Top Domains resources and Orion reports that include DNS names require persistent domain name resolution.•
On Demand DNS resolution is the default option for new installations, and it is intended to assist users with larger networks. With this option, an endpoint domain name is only resolved when information about it is actually requested from the Orion database. Database query times may be improved with this option as queries are limited, but the load time for some endpoint‑related resources may increase as NTA waits for domain name resolution.
Warning: Top Domains resources and Orion reports that include DNS names require persistent domain name resolution, so they will not display DNS names if On Demand DNS resolution is enabled.•
Selecting Disabled turns DNS resolution off for the endpoints of flows monitored in NTA. This is not generally recommended unless NetBIOS resolution already is enabled. For more information about enabling NetBIOS resolution, see Enabling NetBIOS Resolution.
Warning: If DNS resolution is disabled, all DNS information will be deleted from the database to improve database performance,
NTA also allows you to configure the interval between DNS lookups. NTA performs regular DNS lookups on all monitored devices. By default, if the domain of a monitored device resolves successfully, NTA will not attempt another DNS lookup on the same device for 7 days. If the domain name of a monitored device does not resolve successfully, by default, Orion will attempt to resolve the same device again in 2 days.