Netflix uses eBPF to capture TCP flow logs at scale for enhanced network insights, but accurately attributing flow IP addresses to workload identities was a significant challenge. The initial attribution approach relied on Sonar, an internal IP address tracking service, but it led to misattribution due to delays and failures in distributed systems. Misattribution rendered the flow data unreliable for decision-making, and a workaround of holding received flows for 15 minutes before attribution did not eliminate the issue. To solve this problem, Netflix developed a new attribution method that attributes local IP addresses by determining the local workload identity from its environment. For container workloads, Netflix leveraged IPMan, a container IP address assignment service, to attribute local IP addresses. Once local IP addresses are attributed, remote IP addresses can be attributed by learning the time ranges during which each workload owns a given IP address. FlowCollector maintains an in-memory hashmap to represent this knowledge and shares learned time ranges with other nodes using Kafka. The new method achieves accurate attribution and handles transient issues gracefully, and it is also cost-effective due to its simplicity and in-memory lookups. The method is extended to attribute cross-regional IP addresses by forwarding flows to nodes in the corresponding region. Finally, the method is further extended to attribute non-workload IP addresses, such as those belonging to Netflix's content delivery network.