The tables involved:
an IP address table, tblIP, where basic IP address information is stored: IP, WHOIS, reverse DNS name, etc.
an event IP table, tblIPEvent, where event specific data is stored: IP, event number, port, protocol, direction, etc.
a third report table, tblReport, where I track the source IP, destination IP, event number, and and additional information provided by analysts.
The relationships established (so far!):
There is a one-to-many relationship between tblIP and tblIPEvent, since a single IP address could be involved in many events.
The Desired outcome:
I'd like to create separate (one-to-one) relationships between tblReport.(EventNum,SrcIP)<=>tblIPEvent.(EventNum, Address) and tblReport.(EventNum,DstIP)<=>tblIPEvent.(EventNum, Address).
The Questions:
- In the Relationships Manager window, should I define both these relationships in the one "tblIPEvent" table; or keep only one relationship per table and create another table, "tblIPEvent_1"?
- If "tblIPEvent_1" needs to be created, do I also need to (re-)create a one-to-many relationship between the original tblIP and the new "tblIPEvent_1" or create a new "tblIP_1" for that one-to-many relationship?
Please let me know if this question is not clear, or how I can better describe my situation to assist the experts. Also, corrections to my methods or table layout also accepted!
Best Regards.