Realtime Connections

This article is for reporting and classroom administrators.

About Realtime Connections

School Manager’s Realtime section provides information about the current status of the network by supplying data about traffic, user connections, filtering, and key events that help IT administrators understand what is happening within the School Manager network. 

Realtime is accessible via StatisticsRealtime.

Users and Hosts

Users and Hosts show all active connections in the school network. The interface has two sections: connection details and operations.

Connection details 

These columns present information about the user’s connection. 

Column Description
IP Address The current IP address of the user
Hardware The MAC ID of the user
User The user’s username
Quarantined Indicates if the user is currently quarantined
Login Time The period that the user is logged on
Login Method The user’s authentication method
Save Enabling the Save checkbox establishes a permanent association for the device's MAC address. You can confirm this by going to Configuration > Users and Groups > Associations.


This functionality only applies to devices that have logged in using an appliance authentication method such as Google, Azure, RADIUS and WMI.


The number of concurrent connections between the user’s device and a website or application. These concurrent connections suggest the device is loading resources other than the web page or application the user intended to view or that more connections are happening in the background.
For example:

  • The page may also serve advertising from a third-party provider when the user reads an online article.
  • When a user views embedded content on a blog, the device will also connect to the platform that serves that content, such as YouTube or a social network.
  • When browser plugins create simultaneous connections in the background.


The Operations column provides School Manager administrators with the tools to help them manage active connections. These are:

Column Description
Details Shows the Host Details of the active connection, including IP address, MAC address, Active Connections, and Device Type (if available or authenticated on the Linewize appliance).
Remove Session Removes or forces the user to log out from the School Manager network.
Trace Host

Traces the user's IP address.

Selecting this operation opens the Connections page for the user, which displays their IP address. If the user’s device is authenticated, the School Manager administrator can trace their connections in real time.

Create Session Allows the user temporary access to the network by creating a temporary session. Temporary sessions are created when active users connect their unauthenticated devices.
Trace User Traces an authenticated user’s live connections. Selecting this operation live-traces the user across all devices where they are authenticated. Note that this is different from Trace Host, which only tracks the user’s IP, that is, on one device.

The Realtime Users and Host report can be sorted by column heading (default view is IP Address).  If you sort the report by your preferred column heading before selecting Export, the exported file will match the sorting on the screen. 


You can open a student’s real-time connections from the student dashboard

You can view a student’s real-time connections and authenticated devices from the Info panel of the Student Dashboard.

  1. Locate the student in Statistics > Users.
  2. Select the student’s username. The student dashboard will display.
  3. The Info panel displays the number of authenticated devices and active connections in the upper right corner.


The Connections screen collects data on all active connections in real-time.  The Realtime Connections report includes:

Column Description
Time Indicates how long the user has been connected or when they started their connection to the school network
Verdict Denotes the safety of the current connection. Safe connections have green bars.
Source The user’s IP address
Protocol The type of connection used by the user
User The user’s username
Application The category of the site or application

The TCP/IP state.

The most common states are ESTABLISHED, TIME_WAIT, FIN_WAIT, RESET, and LAST_ACK. Refer to the TCP/IP State Transition Diagram document for more information.


Select Details to show more information about the current connection.

Network administrators can check these details to troubleshoot the issue if a problem occurs within the network (no internet connection, slow connectivity, virus attack, etc).

  1. Use the Search bar to locate information quickly.
  2. Select Start Live Trace to remove all connections from the screen and start a live trace of traffic that flows through School Manager.
  3. Select Export to create a .csv file of the report.

Alerts and Events 

The Realtime Alerts and Events page shows the events within the network and the corresponding alerts triggered by these events. 

Different alerts are sent to users depending on the alert configuration. For example, events related to the school network or the Linewize appliance are sent to IT administrators, while events related to cyber safety (unsafe search, access to blocked sites) are received by users with Pastoral Care permissions.   

The Alerts and Events page includes:

Column Description
Time The date and time when the alert was triggered
Event Type

The type of event that triggered the alert, including:

  • Changes in the appliance status (restarting,
  • Authentications (successful and failed)
  • Filtering hits that appear when filtering violations trigger alerts (see: Creating Content Filtering Rules)
  • Network events (ex: renewing DHCP lease)
  • Alarms (ex: the Linewize appliance restarts
Details Brief descriptions of events, such as connections that triggered reports or successful authentications

Locating specific alerts and events

Keeping a record of alerts and events within the school network helps IT administrators diagnose and troubleshoot issues. You can find issues quickly using the search bar or sort the report by selecting the relevant column heading.

Using the search bar

The search bar at the top of the page is a convenient feature, especially when you need to troubleshoot issues or look for specific events that caused problems within the network.
Enter a keyword in the search bar to filter or locate information:

  • Use the exact date or time format shown in the Time column.
  • Enter keywords in part or in full in the Search bar.
  • Prioritize searching for Event Type.
  • Press CTRL+F on your keyboard if you know the information you seek.

Sorting by column heading

The Alerts and Events page sorts the report by Time in reverse chronological order (newest to oldest). However, you can still sort the report from oldest to newest or by Event Type or Details in A-Z or Z-A order.


Does Realtime track my connections outside the school network? 

No. Realtime only tracks connections within the school network.

Does it show when a student has multiple connections?

Yes. Realtime records all active and simultaneous connections. For example, it tracks if a user has opened a webpage on their device and at the same time has another application actively running in the background, such as maps or email apps. 

Does the Events and Alerts page record when alert emails are sent to Pastoral Care users?

No. However, it records when certain events that trigger alerts to be emailed to Pastoral Care users occur. For example, when a student attempts to open a blocked website, this event is captured on the page.    

Is there a work-around if I can’t find the detail I’m looking for using the search bar?

Use your browser's Find function: CTRL + F (Windows) or Command + F (macOS). Using the Search bar is still more reliable, however.

Does School Manager capture real-time connections for other equipment, such as routers or printers?  

School Manager also tracks live connection data from all networked equipment, such as printers, routers, and switches, to name a few examples. These equipment do not have to be authenticated by School Manager to work. Therefore, specific details about their connections, such as usernames, login times and methods, and quarantine statuses, are blank. 

Does School Manager capture real-time connections for user devices not authenticated to School Manager?

Yes. Unauthenticated user devices that connect to the school network are also recorded. However, because these devices are not authenticated, data on their real-time connections need to be completed or left blank in some columns.


Was this article helpful?
0 out of 0 found this helpful



Please sign in to leave a comment.