What should be preserved from DHCP or connection tables?¶

DHCP and connection tables can help show which technical identifiers were associated at a particular time.

Avoid this assumption: An IP address in a table permanently identifies one device or one person. DHCP assignments can change, leases can expire and network address translation can place several devices behind one address.

Record the device or system displaying the table, the page, account, date, time, time zone and visible filters.

Capture hostnames, MAC addresses, assigned IP addresses, lease start, lease expiry, interface, network name and connection status.

Preserve any client identifier, vendor label, reservation, first-seen or last-seen information.

For active connection or translation tables, record source and destination addresses, ports, protocol, state, interface and timeout where visible.

Capture the entire table before sorting, filtering, refreshing or selecting an entry.

Record whether the information is current, cached, historic, incomplete or limited to one device or network segment.

Do not assume a hostname is accurate or user-supplied information is reliable.

Be aware that randomised MAC addresses, virtual machines, shared systems and repeated address use may complicate interpretation.

Do not restart the appliance or clear the table.

Where the table is changing quickly, seek network-specialist support for proportionate preservation.

Compare network records with device, provider and other evidence before making attribution claims.

Record any export option without selecting it automatically, and preserve the visible record first.

Operational takeaway¶

Preserve addresses, identifiers, lease times, ports and table scope exactly as shown, while treating them as time-bound technical associations rather than personal identification.