and when you sniff right at the customers dropline, its hard to expect someone to believe its not the subscriber, its some imposter forging packets and spoofing your IP.

i really isnt good press to, lets say, accuse subscribers of Criminal involvment based on IP spoofs or hash collisions, so its a good idea to chase it all the way down to the drop line, and any pwnd boxes