If include: will also list events based on further correlation of IP address and client ID. If exclude: will list DHCP lease ...