Switching IP and DNS evidence sources to ARC