A computer-implemented method for monitoring a life cycle of a connection of a network client device to a computer network, comprising executing on a processor the steps of: monitoring time synchronization traffic between the network client device and a time server, the time synchronization traffic including time synchronization protocol messages associated with the computer network; parsing the time synchronization protocol messages and extracting information relating to the network client device, including a domain identifier that uniquely identifies the domain of the network client device and a relative identifier that uniquely identifies the network client device in the domain; identifying one of the time synchronization protocol messages as an initial request associated with an initial connection event of the network client device and determining that the network client device is connected to the computer network; determining a true identity of the network client device connecting to the computer network based on the identified time synchronization protocol message and associating the true identity of the network client device with an internet protocol, IP, address, wherein the true identity of the network client device is a permanent identity of the network client device and comprises the domain identifier and the relative identifier of the network client device; determining (430, 435) when the network client disconnects from the computer network based on the time synchronization traffic between the client device and the time server, wherein determining when the network client device disconnects from the computer network comprises: monitoring subsequent time synchronization protocol messages sent from the network client device to the time server according to a defined polling interval; determining whether a subsequent time synchronization protocol message has not been sent from the network client device within the defined polling interval; and in response to making a positive determination, determining that the network client device is disconnected from the computer network; and generating a report identifying the life cycle of the network client device associated with the IP address based on connection and disconnection data associated with the network client device. monitoring time synchronization traffic between the network client device and a time server, the time synchronization traffic including time synchronization protocol messages associated with the computer network; parsing the time synchronization protocol messages and extracting information relating to the network client device, including a domain identifier that uniquely identifies the domain of the network client device and a relative identifier that uniquely identifies the network client device in the domain; identifying one of the time synchronization protocol messages as an initial request associated with an initial connection event of the network client device and determining that the network client device is connected to the computer network; determining a true identity of the network client device connecting to the computer network based on the identified time synchronization protocol message and associating the true identity of the network client device with an internet protocol, IP, address, wherein the true identity of the network client device is a permanent identity of the network client device and comprises the domain identifier and the relative identifier of the network client device; determining (430, 435) when the network client disconnects from the computer network based on the time synchronization traffic between the client device and the time server, wherein determining when the network client device disconnects from the computer network comprises: monitoring subsequent time synchronization protocol messages sent from the network client device to the time server according to a defined polling interval; determining whether a subsequent time synchronization protocol message has not been sent from the network client device within the defined polling interval; and in response to making a positive determination, determining that the network client device is disconnected from the computer network; and monitoring subsequent time synchronization protocol messages sent from the network client device to the time server according to a defined polling interval; determining whether a subsequent time synchronization protocol message has not been sent from the network client device within the defined polling interval; and in response to making a positive determination, determining that the network client device is disconnected from the computer network; and generating a report identifying the life cycle of the network client device associated with the IP address based on connection and disconnection data associated with the network client device.