This article applies to:

• WebTrends Firewall Suite 4.1+

Symptoms:

• IP addresses are listed under Top Sites in Core Categories.
• 'Do not categorize IPs' is checked in the Advanced URL Categorization options.

Procedure:

There are several factors that can influence what information is reported.  Checking or unchecking this option, as well as if the profile uses either "quick mode" or "resolve mode" for DNS resolution, can influence results. 

• If 'Do Not Categorize IPs' is not checked (default setting) then the following will occur.

  IP address in firewall log file	DNS look-up resolves to host name	Host name used by SurfControl to categorize site
  IP address in firewall log file	DNS look-up resolves to host name	The original IP is used by SurfControl to categorize site, but the resolved name is displayed in the report
  IP address in firewall log file	No DNS look-up (quickmode) or IP is unresolvable	IP address used by SurfControl to categorize site

• If 'Do Not Categorize IPs' is checked, then the following will occur.

  IP address in firewall log file	DNS look-up resolves to host name	Host name used by SurfControl to categorize site
  IP address in firewall log file	DNS look-up resolves to a host name not contained in the SurfControl database	No categorization occurs
  IP address in firewall log file	No DNS look-up (quick mode) or IP is unresolvable	IP address used by SurfControl to categorize site

This article was previously published as:

NETIQKB9452