6 Replies Latest reply on May 17, 2013 10:11 AM by rharland2012

    DNS host name

    gamereck1

      Can NTA when moniitoring WWW traffic show the host name instead of the ip address. If so is it a config change that has to be done with the software?

        • Re: DNS host name
          rharland2012

          What is your DNS Resolution set to under NTA settings?

            • Re: DNS host name
              gamereck1

              It is set to persistent

                • Re: DNS host name
                  rharland2012

                  Set it to On Demand and check your results. It should perform DNS lookups for IP hosts as needed and will display names where resolvable.

                  Now, NTA won't show you a simple hostname like 'www.google.com', since the Netflow table refers to the resolution of the specific IP to which the client is connecting. You'll likely see lots of CDN providers (akamai and the like).

                  If the IP resolves to a nice, simple name then you're good.

                  For example, here's a quick scrape of some talkers:

                   

                  webnames.JPG

                  1 of 1 people found this helpful
              • Re: DNS host name
                wanine39

                can we simply pt to our ad/dns

                  • Re: DNS host name
                    rharland2012

                    The lookup piece just uses whatever DNS information your Orion box is using, I believe - so if you have your local DNS configured on the front-end server, then you're already doing that.

                    On-demand vs. persistent is, if I understand it correctly, more about *when* the DNS lookup is performed. Persistent means that it caches lookups for whatever period you specify in the NTA settings. On-demand means that live lookups are performed when NTA graphs are loaded and populated. If someone out there has a better idea of the mechanics of this and needs to correct me, please sing out - but these are the results I see when changing these settings.

                  • Re: DNS host name
                    rharland2012

                    Well, glad I checked - I had the persistent piece wrong.

                     

                    Here's the relevant excerpt from NTA help -

                     

                    Configuring DNS Resolution

                    By default for new installations, NTA resolves the domain names of all endpoints referenced in monitored Flows on demand. For most users, on demand DNS resolution optimizes overall performance. To meet your specific network monitoring needs, NTA provides the following options for configuring DNS resolution:

                     

                     

                    Persistent DNS resolution continuously resolves domain names for all devices involved in monitored Flows. For typically‑sized networks, NTA views may load more quickly as resolved domain names are retained, but database query times may increase as your Orion database is continuously queried.

                    Note: Top Domains resources and Orion reports that include DNS names require persistent domain name resolution.

                     

                     

                    On Demand DNS resolution is the default option for new installations, and it is intended to assist users with larger networks. With this option, an endpoint domain name is only resolved when information about it is actually requested from the Orion database. Database query times may be improved with this option as queries are limited, but the load time for some endpoint‑related resources may increase as NTA waits for domain name resolution.

                    Warning: Top Domains resources and Orion reports that include DNS names require persistent domain name resolution, so they will not display DNS names if On Demand DNS resolution is enabled.

                     

                     

                    Selecting Disabled turns DNS resolution off for the endpoints of flows monitored in NTA. This is not generally recommended unless NetBIOS resolution already is enabled. For more information about enabling NetBIOS resolution, see Enabling NetBIOS Resolution.

                    Warning: If DNS resolution is disabled, all DNS information will be deleted from the database to improve database performance,

                    NTA also allows you to configure the interval between DNS lookups. NTA performs regular DNS lookups on all monitored devices. By default, if the domain of a monitored device resolves successfully, NTA will not attempt another DNS lookup on the same device for 7 days. If the domain name of a monitored device does not resolve successfully, by default, Orion will attempt to resolve the same device again in 2 days.