It would be great to get this by IP in the report, especially since the DHCP screen shows IP by machine name. Not much value in knowing there is a protocol being used if you have no additional info to start exploring with. DHCP typically gives out same IP to machine based on MAC so it would be useful.

Any plans to add the IP (or string of IPs when more than one)?

Installing ntop after the issue is found is only forward looking, no way to match up anything historically.

Installed Ntop
Thank you very much.

The short answer is you can't...how is ClearOS supposed to differentiate what the "user" is? by IP?

Consider using the web proxy if you want to log web traffic, or use a traffic aggregation tool like Ntop to log traffic by IP / Port / Mac etc for your network