The IP belongs to a hotel, café or public Wi-Fi service - what changes?¶
The address will usually identify a shared connection, venue or Wi‑Fi operator. The useful next question is whether local records can narrow the event to a device, booking, account or smaller area.
Identify who ran the network¶
The venue, internet provider and managed Wi‑Fi company may be different organisations. Establish who controlled:
- the public internet connection;
- user registration or the captive portal;
- access points and local address allocation; and
- log storage and retention.
Records that may help¶
A public network may hold:
- connection and access-point times;
- the private address given to a device;
- a device’s MAC address;
- captive-portal details such as email, phone, room or voucher;
- Wi‑Fi account or authentication records; and
- venue records such as bookings, payments or CCTV.
The available records vary widely. An open café network may hold very little; a managed hotel network may have several useful systems.
Time and place¶
Many people can use the same public IP address, and local addresses are reused. Preserve the precise event time and time zone so the network operator can find the right connection window.
An access-point record may help place a device within part of a building. Check the access point’s real location and coverage before using it that way.
What to do next¶
Move quickly to identify the operator and preserve any short-lived network records. Then compare them with bookings, accounts, payments, CCTV or device evidence that covers the same time.
