What Logs Must Businesses Keep for Guest Wi-Fi?

A business that offers Wi-Fi to guests or employees is considered a mass-use provider under Law No. 5651 and must keep the minimum records that can trace a connection back to a person. In short, four record sets are required: (1) user authentication (who connected to the network), (2) internal IP/DHCP record (which internal IP was assigned to the device, and when), (3) NAT record (which public IP and port this internal IP used to reach the internet) and (4) connection time. These four records must be synchronized to the same time source (NTP) and retained for the legal period with their integrity intact (timestamped). Home/office modem records do not serve this purpose; they rotate quickly, are unsigned and carry no evidential value.

This page is for information only; consult the current legislation and a legal advisor for definitive obligations.

Why are these four records needed?

In a judicial request the goal is to answer: “who produced the traffic leaving via this public IP:port at a given moment?” Every link in the chain is needed: public IP:port → (NAT) → internal IP → (DHCP) → device → (authentication) → person. If one link is missing, the chain breaks and the record is useless. That is why not only the “internet egress” log but also the authentication record binding the user to an identity is essential.

How do you verify a guest’s identity?

Several methods via a captive portal (login page) are common:

SMS verification: A code is sent to the phone number; the number is matched to the session.
Form/sponsor verification: The user enters details, and a sponsor e-mail approves.
Social/session verification: Different methods depending on the setup.

We explain SMS-verified captive portal step by step in How does an SMS-verified captive portal work?

Do you also need to log the staff network?

Usually yes. Logging only the guest network while leaving out the staff network is incomplete compliance in most scenarios; the staff network’s firewall/NAT records may also fall within scope. The correct approach is to collect the records of all internet-facing network segments centrally and in signed form.

Why is time synchronization critical?

If devices are not synchronized to a common clock via NTP, minutes of drift occur between DHCP, NAT and portal records, and they cannot be linked. All devices (firewall, DHCP server, access point, log server) must use the same NTP source.

How does SignLogger handle guest Wi-Fi logging?

SignLogger combines captive-portal user authentication with the central, timestamped collection of firewall/DHCP/NAT records on a single platform: SMS, form, Turkish ID and sponsor verification; syslog collection from all brands; daily automatic signing of logs with the TÜBİTAK Kamu SM timestamp and e-signature; audit-ready search and export. Explore the features or request a free demo. For the general framework, see What is the Law No. 5651 log retention obligation?

Frequently Asked Questions

Is it enough to just capture the phone number via SMS?

Not on its own. SMS verification binds the identity; but internal IP (DHCP), NAT and connection-time records must also be kept and all synchronized to the same clock.

Must I collect guests’ Turkish ID numbers?

Turkish ID is not the only accepted method; verifiable methods such as SMS, form or sponsor can also be used. Personal data collected must be processed in line with data-protection law (KVKK) and limited to the purpose. [TO BE VERIFIED: accepted identification methods and KVKK limits should be confirmed from the current legislation.]

How long must I retain the records?

Common practice for mass-use providers is at least 6 months and at most 2 years; the exact period may vary by role and current regulation.

My access point has a guest portal — do I need anything extra?

Even with portal authentication, records must be signed, stored centrally and matched to NAT/DHCP records. Short-lived on-device records alone are not enough.

I use a cloud-based access point (e.g. Meraki) — how does logging work?

Cloud-based systems also require user verification and signed retention of traffic records; SignLogger supports such setups with an external captive portal (EXCAP).

My firewall already logs NAT — is a portal required?

The NAT log is one link in the chain but does not bind user identity. To reach the person, captive-portal authentication is required.