Hi, I'm still trying to understand and debug how this works. Here is something I found in my data that I can't understand: Here is a log of the data for one specific client. The ipv4_id and ipv6_id are NULL if the client didnt connect, and have something if it did connect. seen_time os manufacturer ipv4_id ipv6_id 2019-02-20 13:53:24.000000 iOS Apple 11122 NULL 2019-02-20 13:53:37.000000 iOS Apple NULL NULL 2019-02-20 13:54:24.000000 iOS Apple NULL NULL 2019-02-20 13:54:25.000000 iOS Apple NULL NULL 2019-02-20 13:54:29.000000 iOS Apple 11122 NULL 2019-02-20 13:54:36.000000 iOS Apple 11122 NULL 2019-02-21 06:35:25.000000 NULL Apple NULL NULL 2019-02-21 06:36:18.000000 NULL Apple NULL NULL 2019-02-21 06:36:18.000000 NULL Apple NULL NULL 2019-02-21 06:36:19.000000 NULL Apple NULL NULL 2019-02-21 06:36:19.000000 NULL Apple NULL NULL 2019-02-21 06:36:19.000000 NULL Apple 11122 NULL 2019-02-21 06:36:19.000000 NULL Apple NULL NULL 2019-02-21 06:37:19.000000 NULL Apple NULL NULL 2019-02-21 06:37:28.000000 NULL Apple NULL NULL 2019-02-21 06:37:50.000000 NULL Apple 11122 NULL 2019-02-21 06:38:49.000000 NULL Apple 11122 NULL Everything is fine until 2019-02-20 end of day, where the device left the building at 13:54 UTC. Until then, all observations have a valid OS, independently if the device connected or not. Next day, however, the device never didnt had OS for the next events, even if it sometimes connected to the network! How is this possible? Do we manually need to keep track of client's OS entries? Edit: here is a graph for that client of OS over time (os=4 means for us iOS) Edit: For another windows device, the data looks like this:
... View more
