The ExtraHop appliance does a great job of learning names for devices based on what it sees on the wire, such as netbios name and DNS responses.
What is the device name ‘priority’ when it sees these? I have a server with a bunch of CNAMEs and it seems to change its name in the device list some times. Does the ExtraHop appliance prefer what it sees in PTR responses over A records, for example? Is Netbios higher in the list? Does it inspect HTTP Host: headers?
Yes, I know I can – and probably should – hard-code the names by clicking the edit icon next to “Name” on the device’s page, but I’m curious the way things work if I don’t nonetheless.