This Module reports DNS users by monitoring DNS traffic (dest_port=53). It consolidates NetFlow records over a period of time (Data Collection Interval) which all have the same combination of the following fields:
Source IP address
Destination IP address
Destination port number
Layer 3 protocol
This information is provided per NetFlow exporter.
Data Collection Interval, sec
Module logic execution interval
min = 30 sec, max = 600 sec, default = 60 sec
How many most active DNS requestors do you want to report?
Top N (number of reported hosts)
min = 0, max = 100000, default = 0 (0 indicates all hosts are reported)