Firewalls: [no subject]

["kathleen butler" <Krbutler @ msn . com>]

In a recent attack by a person at a university, we were able to determine the 
IP address, which was at a university, but could not establish who was 
responsible. (The individual was in a pool of computers that they could log on 
to). Is there a way to determine which student was responsible? Also, if I use 
DHCP internally, is there a way to match an IP address to a user for any 
specific transaction?