In WFilter, two monitoring modes are available: "by ip address" and "by MAC address". In "by ip address" monitoring mode, WFilter identifies a computer based on its ip address, while it identifies a computer based on its MAC address in "by mac address" monitoring mode.
In a multiple-segments network, you can only use "by ip address" monitoring mode, because a computer's mac address can not be retrieved when it's behind a router.
In additional of these two monitoring modes, WFilter also supports monitoring by user accounts. With "account monitoring" enabled, you can set blocking policy based on user accounts, regardless of which computers or ip addresses they are using.
You can enable "account monitoring" feature to monitor/filter by user accounts. If you have an available windows active directory, you also can intergrate WFilter with your domain to set policy to AD users, please check How to do monitoring/filtering based on user accounts?
In a multiple-segments network, you can only use "by ip address" monitoring mode. So if ip addresses are not fixed in such a network, you will have trouble to identify computers to set monitoring/blocking policies. Two solutions are available:
With "by mac address" monitoring mode, WFilter identifies a computer by its MAC address. MAC address is assigned by the manufacturer of a network interface card (NIC) and are stored in its hardware. It won't change unless the NIC hardware is replaced.
When you set a recording policy or blocking policy to one computer in "user-computer table", certain settings will be bound to its mac address. Even its ip address is changed, settings or monitored data of this computer will not be lost.
However, because a computer's mac address can not be retrieved when it's located behind a router, "by MAC address" monitoring mode is only available for single-segment networks.
Therefore, in a single-segment network, "by mac addresses" will be a good choice if your ip addresses are dynamic.