Realtime Connections Guide

This article is for reporting and classroom administrators.

About Realtime Connections

School Manager’s Realtime section provides information about the current status of the network by supplying data about traffic, user connections, filtering, and key events that help IT administrators understand what is happening within the School Manager network. 

Realtime is accessible via STATISTICS > REALTIME.

Users and Hosts shows all active connections in the school network. The interface is divided into two sections, connection details and operations.

These columns present information about the user’s connection. 

Column Description
IP Address The current IP address of the user
Hardware The MAC ID of the user
User The user’s username
Quarantined Indicates if the user is currently quarantined
Login Time The period that the user is logged on
Login Method The user’s authentication method
  • Yes

The user’s device has been authenticated permanently, therefore the user does not need to re-authenticate each time they connect to the network.  IP/MAC addresses of saved devices also appear on the CONFIGURATION > USERS AND GROUPSASSOCIATIONS page.

  • No
The user’s device has to be authenticated. Click (save) to save the user’s device.

The number of concurrent connections between the user’s device and a website or application. These concurrent connections suggest the device is loading resources other than the web page or application that the user has intended to view or that more connections are happening in the background.

For example:

  • When the user reads an online article, the page may also serve advertising from a third-party provider. 
  • When a user views embedded content on a blog, the device will also connect to the platform that serves that content, such as YouTube or a social network.
  • When browser plugins create simultaneous connections in the background.


The Operations column provides School Manager administrators with the tools to help them manage active connections. These are:  

Column Description
Details Shows the Host Details of the active connection, including IP address, MAC address, Active Connections, and Device Type (if available or authenticated on the School Manager device).
Remove Session Removes or forces the user to log out from the School Manager network.
Trace Host Traces the user's IP address.

Clicking this operation opens the Connections page for the user which displays their IP address. If the user’s device is authenticated, the School Manager administrator can trace their connections in real-time.
Create Session Allows the user temporary access to the network by creating a temporary session. Temporary sessions are created when active users connect their unauthenticated devices.
Trace User Traces an authenticated user’s live connections.  Clicking this operation live-traces the user across all devices where they are authenticated. Note that this is different from Trace Host which only tracks the user’s IP, that is, on one device.

The Realtime Users and Host report can be sorted by column heading (default view is IP Address).  If you sort the report by your preferred column heading before clicking EXPORT, the exported file will match the sorting on the screen. 

TIP: You can open a student’s real-time connections from the student dashboard

You can view a student’s real-time connections and authenticated devices from the Info panel of the Student Dashboard.

  1. Locate the student in Statistics > Users.
  2. Click the student’s username. The student dashboard will display.
  3. On the upper right corner, the Info panel displays the number of authenticated devices and active connections. 

The Connections screen collects data on all active connections in real time.  The Realtime Connections report includes:

Column Description
Time Indicates how long the user has been connected or when they started their connection to the school network
Verdict Denotes the safety of the current connection. Safe connections have green bars. 
Source The user’s IP address
Protocol The type of connection used by the user 
User The user’s username
Application The category of the site or application 
State The TCP/IP state.

The most common states are ESTABLISHED, TIME_WAIT, FIN_WAIT, RESET, and LAST_ACK.  Refer to this document for more information about TCP/IP state transition.
Operations Click Details to show more information about the current connection.

In case a problem occurs within the network (no internet connection, slow connectivity, virus attack, etc.), network administrators can check these details to troubleshoot the issue.


  1. Use the Search bar to quickly locate information.
  2. Click the Start Live Trace button to remove all connections from the screen and start a live trace of traffic that flows through School Manager.
  3. Click EXPORT to export a .csv file of the report.

The Realtime Alerts and Events page shows the events within the network and the corresponding alerts that have been triggered by these events. 

Different types of alerts are sent to different types of users, depending on the alert configuration. For example, events related to the school network or the School Manager appliance are sent to IT administrators, while events related to cyber safety (unsafe search, access to blocked sites) are received by users with Pastoral Care permissions.   

The Alerts and Events page includes:

Column Description
Time The date and time when the alert was triggered.
Event Type The type of event that triggered the alert, including:
  • changes in the appliance status (restarting, 
  • authentications (successful and failed)
  • filtering hits that appear when filtering violations trigger alerts (see: Creating Content Filtering Rules)
  • network events (ex: renewing DHCP lease)
  • alarms (ex: the School Manager appliance restarts)
Details brief descriptions of events, such as connections that triggered reports or successful authentications


Locating specific alerts and events

Keeping a record of alerts and events that occurred within the school network helps IT administrators diagnose and troubleshoot issues. You can find issues quickly by using the search bar or sort the report by clicking on the relevant column heading. 

Using the search bar 

The search bar at the top of the page is a convenient feature especially when you need to troubleshoot issues or look for specific events that caused problems within the network.

Enter a keyword in the search bar to filter or locate information:

  • Use the exact date or time format shown on the Time column.
  • Enter keywords in part or in full in the Search bar.
  • Prioritize searching for Event Type.
  • Press CTRL+F on your keyboard if you know the information that you are looking for.

Sorting by column heading

The Alerts and Events page sorts the report by Time in reverse chronological order (newest to oldest). However, you can still sort the report from oldest to newest, or by Event Type or Details in A-Z or Z-A order.


Does Realtime track my connections outside the school network? 

No. Realtime only tracks connections within the school network.

Does it show when a student has multiple connections?

Yes. Realtime records all active and simultaneous connections. For example, it tracks if a user has opened a webpage on their device, and at the same time has another application actively running in the background, such as maps or email apps. 

Does the Events and Alerts page record when alert emails are sent to Pastoral Care users?

No. However, it records when certain events that trigger alerts to be emailed to Pastoral Care users occur. For example, when a student attempts to open a blocked website, this event is captured in the page.    

Is there a work-around if I can’t find the detail I’m looking for using the search bar?

You can try using the Find function of your browser: CTRL + F (Windows) or Command  + F (macOS). Using the Search bar is still more reliable, however.

Does School Manager capture real-time connections for other equipment, such as routers or printers?  

School Manager also tracks live connection data from all networked equipment, such as printers, routers, and switches, to name a few examples. These equipment do not have to authenticate on School Manager in order to work, therefore certain details about their connections, such as usernames, login times and methods, and quarantine statuses are blank. 

Does School Manager capture real-time connections for user devices that are not authenticated to School Manager?

Yes. Unauthenticated user devices that connect to the school network are also recorded. But because these devices are not authenticated, data on their real-time connections are incomplete or left blank in some columns.

Was this article helpful?
0 out of 0 found this helpful



Please sign in to leave a comment.