3 ms·
No, it wouldn't make any sense, and an IP address is a very bad measurement as well. Think of airports, public hotspots, etc - even if you do keep the data, not
by pmlnr 8y ago
No, it wouldn't make any sense, and an IP address is a very bad measurement as well. Think of airports, public hotspots, etc - even if you do keep the data, nothing else will be kept that log (or at lease I believe at this point in time), so what would storing the IP get you? An approximate location of a now potentially already recycled device and nothing else, really.
- tatersolid 8y agoIf you have a log time stamp, IP and source port of a compromise, you at least have a chance at attribution by working with the source network operator who can potentially correlate to a MAC or subscriber. The police can even pull video of a coffee shop to see who was there during an attack. Without the time stamp and IP information you have zero chance at attribution during a security event. PCI and a bunch of other regs require log retention for 1 year or even more for this reason.