Contact UsContact Us

Realtime Connections Overview

This article is for reporting users and IT support.

About Realtime Connections

School Manager’s Realtime section provides information about the current status of the network by supplying data about traffic, user connections, filtering, and key events that help IT administrators understand what is happening within the School Manager network. 

Realtime is accessible via Statistics > Realtime.

Users and Hosts

Users and Hosts shows all active connections in the school network. The interface is divided into two sections, connection details and operations.

Connection details

These columns present information about the user’s connection. 

IP AddressThe current IP address of the user
HardwareThe MAC ID of the user
UserThe user’s username
QuarantinedIndicates if the user is currently quarantined
Login TimeThe period that the user is logged on
Login MethodThe user’s authentication method
YesThe user’s device has been authenticated permanently, therefore the user does not need to re-authenticate each time they connect to the network.  IP/MAC addresses of saved devices also appear on the Configuration > Users and Groups > Associations page.
NoThe user’s device has to be authenticated. Click (save) to save the user’s device.
ConnectionsThe number of concurrent connections between the user’s device and a website or application. These concurrent connections suggest the device is loading resources other than the web page or application that the user has intended to view or that more connections are happening in the background.

For example:

  • When the user reads an online article, the page may also serve advertising from a third-party provider. 
  • When a user views an embedded content on a blog, the device will also connect to the platform that serves that content, such as YouTube or a social network.
  • When browser plugins create simultaneous connections in the background.


The Operations column provides School Manager administrators with the tools to help them  manage active connections. These are:  

DetailsShows the Host Details of the active connection, including IP address, MAC address, Active Connections, and Device Type (if available or authenticated on the School Manager device).
Remove SessionRemoves or forces the user to log out from the School Manager network.
Trace HostTraces the user's IP address.

Clicking this operation opens the Connections page for the user which displays their IP address. If the user’s device is authenticated, the School Manager administrator can trace their connections in real-time. 
Create SessionAllows the user temporary access to the network by creating a temporary session. Temporary sessions are created when active users connect their unauthenticated devices.
Trace UserTraces an authenticated user’s live connections.  Clicking this operation live-traces the user across all devices where they are authenticated. Note that this is different from Trace Host which only tracks the user’s IP, that is, on one device.

The Realtime Users and Host report can be sorted by column heading (default view is IP Address).  If you sort the report by your preferred column heading before clicking EXPORT, the exported file will match the sorting on the screen. 


Open a student’s real-time connections from the student dashboard.

You can view a student’s real-time connections and authenticated devices from the Info panel of the Student Dashboard.

  1. Locate the student in Statistics > Users.
  2. Click the student’s username. The student dashboard will display.
  3. On the upper right corner, the Info panel displays the number of authenticated devices and active connections.


The Connections screen collects data on all active connections in real-time.  The Realtime Connections report includes:

TimeIndicates how long the user has been connected or when they started their connection to the school network
VerdictDenotes the safety of the current connection. Safe connections have green bars. See: Red Flags and Alerts Guide
SourceThe user’s IP address
ProtocolThe type of connection used by the user 
UserThe user’s username
ApplicationThe category of the site or application 
StateThe TCP/IP state.

The most common states are ESTABLISHED, TIME_WAIT, FIN_WAIT, RESET, and LAST_ACK.  Refer to this document for more information about TCP/IP state transition.
OperationsClick Details to show more information about the current connection.

In case a problem occurs within the network (no internet connection, slow connectivity, virus attack, etc.), network administrators can check these details to troubleshoot the issue.

  1. Use the Search bar to quickly locate information.
  2. Click the Start Live Trace button to remove all connections from the screen and start a live trace of traffic that flows through School Manager.
  3. Click EXPORT to export a .csv file of the report.


Alerts and Events

The Realtime Alerts and Events page shows the events within the network and the corresponding alerts that have been triggered by these events. 

Different types of alerts are sent to different types of users, depending on the alert configuration. For example, events related to the school network or the School Manager appliance are sent to IT administrators, while events related to cyber safety (red flags, unsafe search, access to blocked sites) are received by users with Pastoral Care permissions.   

The Alerts and Events page includes:

TimeThe date and time when the alert was triggered.
Event TypeThe type of event that triggered the alert, including:
  • changes in the appliance status (restarting)
  • authentications (successful and failed)
  • Red Flags and risk indicators
  • filtering hits that appear when filtering violations trigger alerts (see Creating Content Filtering Rules)
  • network events (ex: renewing DHCP lease)
  • alarms (ex: the School Manager appliance restarts)
Detailsbrief descriptions of events, such as connections that triggered red flags or successful authentications

Locating specific alerts and events

Keeping a record of alerts and events that occurred within the school network helps IT administrators diagnose and troubleshoot issues. You can find issues quickly by using the search bar or sort the report by clicking on the relevant column heading. 

Using the search bar 

The search bar at the top of the page is a convenient feature especially when you need to troubleshoot issues or look for specific events that caused other problems within the network.

Enter a keyword in the search bar to filter or locate information:


Using the search bar

  • Use the exact date or time format shown on the Time column.
  • Enter keywords in part or in full in the Search bar.
  • Prioritize searching for Event Type.
  • Press CTRL+F on your keyboard if you know the information that you are looking for.

Sorting by column heading

The Alerts and Events page sorts the report by Time in reverse chronological order (newest to oldest). However, you can still sort the report from oldest to newest, or by Event Type or Details in A-Z or Z-A order.


Does Realtime track my connections outside the school network? 

No. Realtime only tracks connections within the school network.

Does it show when a student has multiple connections?

Yes. Realtime records all active and simultaneous connections. For example, it tracks if a user has opened a webpage on their device, and at the same time has  another application actively running in the background, such as maps or email apps. 

Does the Events and Alerts page record when alert emails are sent to Pastoral Care users?

No. However, it records when certain events that trigger alerts to be emailed to Pastoral Care users occur. For example, when a student attempts to open a blocked website, this event is captured in the page. 

Is there a work-around if I can’t find the detail I’m looking for using the search bar?

You can try using the Find function of your browser: CTRL + F (Windows) or Command  + F (macOS). Using the Search bar is still more reliable, however.

Does School Manager capture real-time connections for other equipment, such as routers or printers?  

School Manager also tracks live connection data from all networked equipment, such as printers, routers, and switches, to name a few examples. These equipment do not have to authenticate on School Manager in order to work, therefore certain details about their connections, such as usernames, login times and methods, and quarantine statuses are blank. 

Does School Manager capture real-time connections for user devices that are not authenticated to School Manager?

Yes. Unauthenticated user devices that connect to the school network are also recorded. But because these devices are not authenticated, data on their real-time connections are incomplete or left blank in some columns.