I am very amused that an "internet connection record" in the example table has * the date * the time * an MSISDN (mobile number) * source IP (examples look like a misformatted IPv6 address) * source port * destination IP (examples look like IPv4) * destination port * service/domain (examples given are company names) * a postcode
so it looks like someone's got the idea that an ICR is like a SMS from a mobile device, whose location can be narrowed down to a postcode because of the cell it is in, to a service provider. The ICR is thus very simple, because the device makes a single connection to the service provider and thus you only have one record which includes the IP and port. Has no-one explained to the civil servants that a typical web page is a result of composite of hundreds if not thousands of assets, which may each be fetched over individual internet connections?
