...
- IP of logged in user that is operating in a malicious manner.
IP is linked to MAC address \ [DHCP or ARP sniffing\].Wiki Markup Authentication session of this MAC is checked in logs \ [auth logs\].Wiki Markup - timestamp of authentication and realm is extracted.
...