About Realtime Connections
Linewize Filter’s Realtime section provides information about the current status of the network by supplying data about traffic, user connections, filtering, and key events that help IT administrators understand what is happening within the Linewize Filter network.
Realtime is accessible via Statistics> Realtime.
Users and Hosts
Users and Hosts show all active connections in the school network. The interface has two sections: connection details and operations.
Connection details
These columns present information about the user’s connection.
| Column | Description |
|---|---|
| IP Address | The current IP address of the user |
| Hardware | The MAC ID of the user |
| User | The user’s username |
| Quarantined | Indicates if the user is currently quarantined |
| Login Time | The period that the user is logged on |
| Login Method | The user’s authentication method |
| Save | Enabling the Save checkbox establishes a permanent association for the device's MAC address. You can confirm this by going to Configuration > Users and Groups > Associations. Note This functionality only applies to devices that have logged in using an appliance authentication method such as Google, Microsoft Entra ID, RADIUS and WMI. |
| Connections |
The number of concurrent connections between the user’s device and a website or application. These concurrent connections suggest the device is loading resources other than the web page or application the user intended to view or that more connections are happening in the background.
|
Operations
The Operations column provides Linewize Filter administrators with the tools to help them manage active connections. These are:
| Column | Description |
|---|---|
| Details | Shows the Host Details of the active connection, including IP address, MAC address, Active Connections, and Device Type (if available or authenticated on the Linewize appliance). |
| Remove Session | Removes or forces the user to log out from the Linewize Filter network. |
| Trace Host |
Traces the user's IP address. Selecting this operation opens the Connections page for the user, which displays their IP address. If the user’s device is authenticated, the Linewize Filter administrator can trace their connections in real time. |
| Create Session | Allows the user temporary access to the network by creating a temporary session. Temporary sessions are created when active users connect their unauthenticated devices. |
| Trace User | Traces an authenticated user’s live connections. Selecting this operation live-traces the user across all devices where they are authenticated. Note that this is different from Trace Host, which only tracks the user’s IP, that is, on one device. |
The Realtime Users and Host report can be sorted by column heading (default view is IP Address). If you sort the report by your preferred column heading before selecting Export, the exported file will match the sorting on the screen.
Tip
You can open a student’s real-time connections from the student dashboard
You can view a student’s real-time connections and authenticated devices from the Info panel of the Student Dashboard.
- Locate the student in Statistics > Users.
- Select the student’s username. The student dashboard will display.
- The Info panel displays the number of authenticated devices and active connections in the upper right corner.
Connections
The Connections screen collects data on all active connections in real-time. The Realtime Connections report includes:
| Column | Description |
|---|---|
| Time | Indicates how long the user has been connected or when they started their connection to the school network |
| Verdict | Denotes the safety of the current connection. Safe connections have green bars. |
| Source | The user’s IP address |
| Protocol | The type of connection used by the user |
| User | The user’s username |
| Application | The category of the site or application |
| State |
The TCP/IP state. The most common states are ESTABLISHED, TIME_WAIT, FIN_WAIT, RESET, and LAST_ACK. Refer to the TCP/IP State Transition Diagram document for more information. |
| Operations |
Select Details to show more information about the current connection. Network administrators can check these details to troubleshoot the issue if a problem occurs within the network (no internet connection, slow connectivity, virus attack, etc). |
- Use the Search bar to locate information quickly.
- Select Start Live Trace to remove all connections from the screen and start a live trace of traffic that flows through Linewize Filter.
- Select Export to create a .csv file of the report.
Alerts and Events
The Realtime Alerts and Events page shows the events within the network and the corresponding alerts triggered by these events.
Different alerts are sent to users depending on the alert configuration. For example, events related to the school network or the Linewize appliance are sent to IT administrators, while events related to cyber safety (unsafe search, access to blocked sites) are received by users with Pastoral Care permissions.
The Alerts and Events page includes:
| Column | Description |
|---|---|
| Time | The date and time when the alert was triggered |
| Event Type |
The type of event that triggered the alert, including:
|
| Details | Brief descriptions of events, such as connections that triggered reports or successful authentications |
Locating specific alerts and events
Keeping a record of alerts and events within the school network helps IT administrators diagnose and troubleshoot issues. You can find issues quickly using the search bar or sort the report by selecting the relevant column heading.
Using the search bar
The search bar at the top of the page is a convenient feature, especially when you need to troubleshoot issues or look for specific events that caused problems within the network.
Enter a keyword in the search bar to filter or locate information:
- Use the exact date or time format shown in the Time column.
- Enter keywords in part or in full in the Search bar.
- Prioritize searching for Event Type.
- Press CTRL+F on your keyboard if you know the information you seek.
Sorting by column heading
The Alerts and Events page sorts the report by Time in reverse chronological order (newest to oldest). However, you can still sort the report from oldest to newest or by Event Type or Details in A-Z or Z-A order.
FAQs
Does Realtime track my connections outside the school network?
No. Realtime only tracks connections within the school network.
Does it show when a student has multiple connections?
Yes. Realtime records all active and simultaneous connections. For example, it tracks if a user has opened a webpage on their device and at the same time has another application actively running in the background, such as maps or email apps.
Does the Events and Alerts page record when alert emails are sent to Pastoral Care users?
No. However, it records when certain events that trigger alerts to be emailed to Pastoral Care users occur. For example, when a student attempts to open a blocked website, this event is captured on the page.
Is there a work-around if I can’t find the detail I’m looking for using the search bar?
Use your browser's Find function: CTRL + F (Windows) or Command + F (macOS). Using the Search bar is still more reliable, however.
Does Linewize Filter capture real-time connections for other equipment, such as routers or printers?
Linewize Filter also tracks live connection data from all networked equipment, such as printers, routers, and switches, to name a few examples. These equipment do not have to be authenticated by Linewize Filter to work. Therefore, specific details about their connections, such as usernames, login times and methods, and quarantine statuses, are blank.
Does Linewize Filter capture real-time connections for user devices not authenticated to Linewize Filter?
Yes. Unauthenticated user devices that connect to the school network are also recorded. However, because these devices are not authenticated, data on their real-time connections need to be completed or left blank in some columns.