I have a captive portal, and log all users who come through it with some code in the index file, which prints to file.
Every users who authenticates is logged, so I can see who has been on during a day.
If I look through the Sarg logs, created from the Squid logs, it shows several IP addresses that do not appear in my captive portal list, and I am pretty sure it is capturing everything. The timestamp on the Squid log line matches the day.
Can a user circumvent the captive portal somehow (other than via MAC and IP binding in the GUI?).
Does Squid do some odd things?
Ignore me :o
I have a small error in my code (OK major), which is saving my log files a day behind….
All the IP's I see were yesterdays.