I have a web control policy on my network. However I see that one user is continuously blocked from a blocked web site minutes apart from each other. I believe that the web control may be circumvented. Why else would I see multiple "blocked" attempts in such a short span. I would like to see the actual user history for that user to determine if and how web control is being defeated. Any guidance as to how to "follow" this user to see where they have been and what they are doing would be helpful.