Identifying VPN Use with Advanced Search

Whether it’s to play games, stream music during class, or use social media, a small subset of your users may try to circumvent your filtering rules. There are hundreds of these anonymising services on the market. The most common are VPNs, TOR browsers, and remote access tools.

School Manager provides you with powerful tools to stop your users from accessing these services. The Advanced Search lets you search for potentially hidden or anonymised traffic. By discovering unusual traffic, you can modify your filtering policies. You can also identify the users who are trying to access these types of services. Share the results with your wellbeing and teaching staff to help them provide guidance to these users.

Searching for Hidden Traffic

1. Go to Reports > Advanced Search.
2. Set a From Date.
• Click on the start date. Click on the end date. We recommend 5 days for your first search to keep the amount of records you are investigating manageable. You may need to use a smaller date range for larger schools.
• You are limited to selecting a maximum of three months of data at a time. (If the Advanced Search displays an error message, select a shorter date range.)
3. Select Update (clockwise circular arrow).
   
4. Click twice on the column header, Download (Bytes) and look for large file transfers.
5. Look for recurring patterns in the results to identify a user. Note the Date and Time and Usernames.
6. Click on the Date and Time column header.
   The dates are sorted ∧ oldest to newest. Click again to ∨ reverse the sort order.
7. Identify a day with a high frequency of the same Username or Website.
   Click on the column title, Username.
8. Go up and down the list to view trends in the time of day and websites.
   
9. (Optional) You can download your Search Results or schedule your Search Results to be sent by email or saved.