topic Re: Unknown Users Detected In User-IP Mapping in General Topics

Unknown Users Detected In User-IP Mapping

NAble — Fri, 11 Apr 2014 06:48:32 GMT

Hi All,

I was checking the User-IP mapping in one of the boxes and noticed something which is a mystery to me. I have attached the picture in this discussion. Some of the entries in the output show as Unknown. Any of you know why and how this happens ?

The white boxes that have been cut out are the usernames which i had to remove due to privacy concerns.

Re: Unknown Users Detected In User-IP Mapping

dpalani — Fri, 11 Apr 2014 17:56:43 GMT

Are these actual users ? Can you look into the traffic logs to see the traffic that is sourced from these ips.

Re: Unknown Users Detected In User-IP Mapping

Retired Member — Mon, 14 Apr 2014 03:44:42 GMT

Unknown User for User-ID IP-User Mapping Cache Timers

Unknown IP Rate Limit Mitigation for User-ID Mappings

Re: Unknown Users Detected In User-IP Mapping

NAble — Fri, 18 Apr 2014 07:09:45 GMT

Hi,

Thank you all for the reply. I did everything but have no resolution yet. Let me try some other things and see, If it still won't work I will open up a case with Support. Anyway I will keep this thread updated as to what the steps taken to resolve this issue.

Thanks.

Re: Unknown Users Detected In User-IP Mapping

dpalani — Fri, 18 Apr 2014 14:21:02 GMT

Hello,

If the firewall/agent is receiving traffic form an ip it does not have user mapping info for, it will probe that ip to get that info. We need to check if the host responds to wmi probes by probing the ip address manually from another host or a host with domain admin login

Following is the command you can run on a cmd, wmic /Node:192.168.128.16 ComptuerSystem Get UserName

HTH

Deepak

Re: Unknown Users Detected In User-IP Mapping

Arjang999 — Fri, 23 Oct 2020 23:52:30 GMT

hey

just wondering if you found a solution to this,

Im having some of those unknown, and that messes up with the rules that has user ID in it.

very sporadic, impossible to troubleshoot.

thanks

Re: Unknown Users Detected In User-IP Mapping

Thamsanqa — Mon, 06 Sep 2021 09:22:13 GMT

Hi,

Was there a solution for this?

Thanks.