Squid/Sarg truthful?

[Lectrician]

I have a captive portal, and log all users who come through it with some code in the index file, which prints to file.

Every users who authenticates is logged, so I can see who has been on during a day.

If I look through the Sarg logs, created from the Squid logs, it shows several IP addresses that do not appear in my captive portal list, and I am pretty sure it is capturing everything.  The timestamp on the Squid log line matches the day.

So.

Can a user circumvent the captive portal somehow (other than via MAC and IP binding in the GUI?).
Does Squid do some odd things?

Any clues?

Thanks.

[Lectrician]

Ignore me  :o

I have a small error in my code (OK major), which is saving my log files a day behind….

All the IP's I see were yesterdays.