What should be preserved from DHCP or connection tables?¶
Preserve addresses, device identifiers, lease times, ports and table scope as time-bound technical relationships, not proof of a person.
Capture the whole association¶
Record system, page, time, filters, hostname, MAC, IP, lease start and expiry, interface, network, state and client or vendor ID.
For active connections or translations include source, destination, ports, protocol, interface, state and timeout. Capture before sort, refresh or selection.
Interpret changing network identity¶
Record whether current, cached, historic or incomplete. DHCP reuse, NAT, randomised MACs, virtual machines and shared devices complicate attribution.
Do not clear or restart the table; seek specialist capture if it changes rapidly and corroborate it with endpoint and provider records.
Key takeaway
Preserve complete table context and timing so addresses can be linked to devices without overstating identity.
