What can DHCP, router and Wi-Fi records show about a local device?¶
title: "What can DHCP, router and Wi-Fi records show about a local device?" card_id: "IP-019" status: "complete" source_document: "https://docs.google.com/document/d/1s1oPQdQV6tfvL8tw-KT_b00JCw0BA5x67jtMDOAUpiI/edit?usp=drivesdk"
What can DHCP, router and Wi-Fi records show about a local device?¶
What can DHCP, router and Wi-Fi records show about a local device?¶
A public IP address may lead you to a home, workplace, hotel or another shared network.
It normally won’t tell you which device inside that network was involved.
DHCP, router and Wi-Fi records may help bridge that gap.
DHCP is the service that assigns local IP addresses to devices joining a network.
Its records may show that a particular MAC address or device identifier was assigned a private IP address at a particular time. They may also contain a device name and the start and end of the address lease.
That can help answer a question such as: which local device was using 192.168.1.24 when the activity occurred?
Router records can provide the next part of the picture.
Depending on the equipment and its configuration, they may record connections between a local device and an external service. That could include the private IP address, translated public connection details, ports, destination addresses, protocol, timestamps and amounts of traffic.
The word “router records” covers a wide range of material, though.
A business network may have detailed firewall and address-translation logs. A domestic router may record very little, overwrite its records quickly or only display the devices that are connected now.
A current connected-device list isn’t automatically evidence of what was connected at an earlier time.
Wi-Fi records deal with a device’s connection to the wireless network.
An access point or wireless controller may record when a device associated with or disconnected from a particular Wi-Fi network. In a managed network, the records might also show the access point used, an authenticated account or an approximate area within the premises.
Association with Wi-Fi doesn’t, by itself, prove that the device accessed the internet or carried out the activity being investigated.
These records are most useful when they can be correlated.
For example, an online service records a public IP address and an exact time. The public connection is linked to a particular premises or organisation. Local router records then identify a private IP address, DHCP records associate that address with a device identifier, and Wi-Fi records place that device on a particular access point.
That chain depends on the relevant records existing, being retained and using sufficiently accurate timestamps and time zones.
The identifiers also have limitations.
Device names can be changed. MAC addresses can be randomised or spoofed. Addresses can be reassigned. Devices may be shared, and an authenticated network account may have been used by somebody else.
Most importantly, a device isn’t a person.
DHCP, router and Wi-Fi records may narrow activity from a shared connection to a particular device or network identifier. Further evidence is still needed to establish who controlled that device and who was responsible for the activity.