This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

DNS host name

Can NTA when moniitoring WWW traffic show the host name instead of the ip address. If so is it a config change that has to be done with the software?

  • What is your DNS Resolution set to under NTA settings?

  • Set it to On Demand and check your results. It should perform DNS lookups for IP hosts as needed and will display names where resolvable.

    Now, NTA won't show you a simple hostname like 'www.google.com', since the Netflow table refers to the resolution of the specific IP to which the client is connecting. You'll likely see lots of CDN providers (akamai and the like).

    If the IP resolves to a nice, simple name then you're good.

    For example, here's a quick scrape of some talkers:

    webnames.JPG

  • Well, glad I checked - I had the persistent piece wrong.

    Here's the relevant excerpt from NTA help -

    Configuring DNS Resolution

    By default for new installations, NTA resolves the domain names of all endpoints referenced in monitored Flows on demand. For most users, on demand DNS resolution optimizes overall performance. To meet your specific network monitoring needs, NTA provides the following options for configuring DNS resolution:

    Persistent DNS resolution continuously resolves domain names for all devices involved in monitored Flows. For typically‑sized networks, NTA views may load more quickly as resolved domain names are retained, but database query times may increase as your Orion database is continuously queried.

    Note: Top Domains resources and Orion reports that include DNS names require persistent domain name resolution.

    On Demand DNS resolution is the default option for new installations, and it is intended to assist users with larger networks. With this option, an endpoint domain name is only resolved when information about it is actually requested from the Orion database. Database query times may be improved with this option as queries are limited, but the load time for some endpoint‑related resources may increase as NTA waits for domain name resolution.

    Warning: Top Domains resources and Orion reports that include DNS names require persistent domain name resolution, so they will not display DNS names if On Demand DNS resolution is enabled.

    Selecting Disabled turns DNS resolution off for the endpoints of flows monitored in NTA. This is not generally recommended unless NetBIOS resolution already is enabled. For more information about enabling NetBIOS resolution, see Enabling NetBIOS Resolution.

    Warning: If DNS resolution is disabled, all DNS information will be deleted from the database to improve database performance,

    NTA also allows you to configure the interval between DNS lookups. NTA performs regular DNS lookups on all monitored devices. By default, if the domain of a monitored device resolves successfully, NTA will not attempt another DNS lookup on the same device for 7 days. If the domain name of a monitored device does not resolve successfully, by default, Orion will attempt to resolve the same device again in 2 days.