If the source is a SPAN port, this might be your problem too. The way I understand the decode, 1 lost packet in an ongoing conversation will cause the name to session mapping to loose the thread and once it picks up the conversation again, it will not be able to connect it back to the name and will therefor map it against the IP - which is always present as opposed to the name which is only seen initially.
Having a SPAN port, the likelyhood for a dropped packet is much higher, even more if you have multiple source ports going out a single SPAN destination port.
The small cost of a TAP is well worth the Money as you will also be able to see malformed packets and any kind of packet that the SPAN is not able to handle.
Old but good http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html .