What can DHCP, router and Wi-Fi records show about a local device?¶
A public IP address may lead to a shared home, workplace, hotel or other network. Local records can sometimes narrow that shared connection to a local address, device or place on the network. They do not automatically identify the person using the device.
The simple model¶
Think of the records as a relay:
public connection → router or firewall → private address → device or Wi-Fi association
Each record answers a different part of that chain. The times, identifiers and limits must still line up.
DHCP¶
DHCP assigns a private IP address to a device for a period of time. Its records may contain the private address, MAC address, device name, lease start and end, and client identifier.
The useful question is: which device was using 192.168.1.24 at the relevant time? A current device list is not a substitute for the lease covering the event.
Router and firewall records¶
These may connect local activity to a public connection and contain private and public addresses, ports, protocol, destination, precise timestamps and translation or session identifiers.
A managed firewall may retain detail. A domestic router may retain very little or overwrite it quickly.
Wi-Fi records¶
A managed access point may record when a device joined or left, the access point used, an authenticated account and movement between access points. That can place a device on the network, but does not by itself prove who was operating it.
Joining the records¶
- An online service records a public IP address and time.
- Provider records identify the customer connection.
- Router records connect public activity to a private address.
- DHCP records show which device held that address.
- Wi-Fi records show when and where it joined.
The links need compatible time zones, precision and identifiers. Do not join records merely because numbers look similar.
A useful analogy
DHCP is like a temporary locker allocation, not a permanent name tag. It tells you which device held a local address during a period; it does not tell you who was using it.
Preserve quickly¶
Local network records are often short-lived. Ask the network owner what exists and preserve the relevant period before spending too long interpreting it. See what should be preserved before relevant records disappear.
The point to remember
These records can narrow a shared public connection towards a local device, but only when their times, fields and identifiers join cleanly.
Practise with a simulated router¶
The Domestic Network is a browser-only practical exercise. It lets you explore a simulated home router, interpret its addresses, devices and settings, and optionally practise one forwarding-rule change in a browser-local working copy.
