nocat, masquerading and identp?

Hi,

I haven't followed the development of nocat and it's useage for a while 
(I am ex-admin since one and a half year now), so I am not really sure 
if this is a FAQ. If it is, feel free to flame to my private mail... 
;-)

We (my collegues, not really me) are planning to use Nocat to allow 
internet access from private machines (mostly laptops, wireless and 
tp-wired) in my university. We use masquerading, as we don't want to 
use too many official ip addresses, and not all the machines that 
should be allowed to use the network will be online at once. So nocat 
might be a nice solution, forcing the user to login over a secured http 
connection to get his machine added to a let-through-rule on the 
routers packet filter. This router will also do the masquerading.

Now, there is still something left... if one of our users (we hope they 
won't try) starts to do stupid things using this masqueraded internet 
access, the target of his activities will only see the ip of our 
(masquerading) router.

The common way to solve such problems in classical 
multiuser-environments (where multiple users share one ip not because 
of masquerading, but because they are logged into one shared machine) 
was to use identp, so that the targeted machine could request a 
(hashed) id of the user, and, if there were complaints, the admin of 
the multiuser-machine could find out the responsible by resolving the 
id.

Is the same mechanism available on nocat routers? The authenticating 
gateway is the only point where the connection between user (as logged 
in) and ip connection to remote hosts could be resolved. And I don't 
see any alternatives to identp at the moment. Of course one could log 
all outgoing connections, and the logins to the nocat auth host as 
well, and by combining these, find out a lot. However, this is not 
allowed (here) for good reasons of privacy, logging all connections of 
a user even if there is no sign of misuse is simply illegal here afaik. 
So we need a way to reply to identification requests like identp 
provides.

TIA, CU, Lars / Darmstadt / Germany / Europe.