TOEIC Link Network Traffic and VPN Detection: How Remote Proctoring Inspects Your Connection

Remote TOEIC Link sessions live on top of your home internet. Before the test starts and throughout the session, the proctoring stack inspects connection metadata to answer two questions: are you actually sitting where the registration data says you are sitting, and is anyone else on the same connection acting as a relay between you and a third party. Both questions are answered by reading network signals, not by reading content — the proctor is not decrypting your traffic, but they are looking at how it behaves.

That distinction matters because it explains which connection setups trip flags and which do not. A test-taker on a clean residential connection in the registered city has nothing to worry about. A test-taker on a corporate VPN, a privacy-focused commercial VPN, or a Tor circuit will trigger inspection even if the underlying behavior is innocent, because the network signature looks like the signature an actual cheater would use to relay screen contents to a coach in another timezone. This guide walks through what the proctor reads, which configurations trigger which flags, and how to prepare the connection before test day.

What the proctor reads from your connection

The proctoring agent collects four categories of network signal during a TOEIC Link session: the public IP address and its geolocation, latency and route characteristics to the proctoring service, evidence of tunneling or proxy chains, and bandwidth profiles from the camera and screen capture streams. The agent does not inspect packet contents — encryption prevents that — but the metadata above is enough to reconstruct a plausible picture of the connection.

Public IP geolocation is the first check. Your registered home address is associated with a region and timezone; if the IP geolocates to a different country, or to a known datacenter range rather than a residential ISP, the session opens with a soft flag. Soft flags do not cancel the test, but they raise the threshold for other anomalies — a test-taker on a flagged IP who also has multiple faces in frame is reviewed faster than one on a clean IP with the same anomaly.

Route characteristics catch tunneling. If your packets to the proctoring endpoint take an unusually long path, or if the round-trip latency does not match the expected residential-to-datacenter pattern for the registered region, the agent records a route anomaly. A connection that looks like it is going through Frankfurt when the test-taker registered in Tokyo is the canonical pattern that suggests a VPN or proxy chain.

Bandwidth profiles catch concurrent screen sharing. The proctoring stream consumes a known range of upstream bandwidth for camera and screen capture; if the link shows additional sustained upstream usage on top of that profile, the agent records a bandwidth anomaly. This is how the system catches a test-taker who is mirroring their screen to a remote helper while the test runs.

VPN, proxy, and tunneling configurations that trigger flags

Most VPN and proxy configurations were not designed with remote testing in mind, and the patterns they create on the wire overlap heavily with the patterns that exfiltration tools create. The proctoring stack does not try to distinguish a privacy-conscious user from an actual cheater at the network layer — it flags both and lets the human reviewer sort it out.

Commercial privacy VPNs. Services that route consumer traffic through datacenter exit nodes will geolocate the connection to a datacenter range, which fails the residential-IP check. Even if the exit node is in the registered country, the IP range itself is a flag. Disable the VPN before opening the proctoring agent and confirm with a third-party IP lookup that your public IP resolves to your residential ISP.

Corporate VPNs and remote work tunnels. A test-taker connected to their employer's VPN for work hours will route TOEIC Link traffic through the corporate network, which often exits in a different region from the home connection. The proctoring agent reads the corporate datacenter IP and flags a geolocation mismatch. Disconnect from the corporate VPN before the session starts.

Tor and onion routing. Tor exit nodes are listed in publicly available block lists used by the proctoring stack. A connection from a Tor exit will not just be flagged — it will usually be refused at the session start. This is not configurable.

Split tunneling and selective routing. Some users configure their VPN to route only specific applications through the tunnel and leave the rest on the residential connection. The proctoring agent reads the IP that its own traffic uses, which is the residential IP, so split tunneling with the proctor outside the tunnel passes the IP check. However, if the test-taker has another application inside the tunnel running concurrently — a screen share, for example — the bandwidth anomaly catches it. Split tunneling should be turned off entirely for the session.

Mesh networks and remote desktop tools. Tools like Tailscale, ZeroTier, or any remote-desktop relay that maintains an outbound tunnel to a control plane will produce sustained outbound traffic that does not match the proctoring profile. The agent flags this as a possible relay. Quit these clients before the session.

Captive portals and hotel networks. Public WiFi often inserts proxy hops between you and the destination. The added latency and middlebox interference can trip the route anomaly detector, and the shared IP makes geolocation unreliable. Test from a residential connection — not from a hotel, café, or coworking space.

How to prepare your home network before test day

Most test-takers have nothing to fix and nothing to worry about. The preparation steps are short, and they apply mostly to people who have layered privacy or remote-work tooling on top of their home connection.

First, run a public IP check the day before the test. Visit an IP geolocation service from the device you will test on and confirm the IP resolves to your residential ISP and the city you registered with. If it resolves to a datacenter, you have a VPN or proxy active that you may not remember turning on — find it and disable it.

Second, audit the always-on tunneling tools on your test device. Open the VPN client, the corporate work tunnel, any mesh network agent, and remote-desktop tools, and quit each of them. Check the system network preferences for any persistent VPN profile that auto-reconnects, and disable it for the day.

Third, free up upstream bandwidth. Cloud backup tools, video upload tools, and peer-to-peer clients consume sustained upstream and look like screen-mirroring on the proctor's bandwidth graph. Pause them. If your household has other people streaming or video-calling, ask them to stop for the test window — not because the bandwidth is insufficient, but because their traffic is on the same upstream link and the agent reads the aggregate.

Fourth, use a wired connection if possible. WiFi instability causes route flapping that the agent can read as connection switching. A wired Ethernet connection produces a stable single-route signal and reduces false positives.

Fifth, reboot the router and the test device the morning of the test. This clears stale connection state and ensures any transient tunnel that was left running gets cleared.

What happens if a flag fires during your session

A network flag during the session does not immediately end the test. The agent records the anomaly and either prompts the test-taker for a real-time check — for example, a request to confirm no other applications are running — or appends the flag to the session report for human review afterward.

The downstream consequence depends on the flag severity. A soft flag (residential IP that geolocated to a neighboring city, transient bandwidth spike) usually closes with a note in the report and no action. A hard flag (datacenter IP, sustained tunnel-pattern traffic, bandwidth pattern matching screen mirroring) escalates to a manual review by the proctoring service, and the score is held until the review completes. Reviewers can request a retake, void the score, or release it depending on what they find.

The fastest path to a clean session is the boring one: residential ISP, no VPN, wired connection, no concurrent uploads, single device on the network during the test window. This is also covered in the broader TOEIC Link test day checklist and the TOEIC Link adaptive testing explained overview, which together describe both the network and the cognitive demands of a remote test session.

When to dispute a network flag

If your score is held and the proctoring report cites a network flag you believe was a false positive, you have a documentation path. Save the IP geolocation lookup and the network-tool audit you ran before the test, and submit them to the proctoring service review channel. False positives most often involve mobile-network IPs (which sometimes geolocate to carrier datacenters rather than the user's region) and shared residential connections (where another household member's traffic created the bandwidth anomaly). These cases are usually resolved in the test-taker's favor with the right evidence.

The harder cases are split-tunnel configurations and mesh-network agents that the test-taker forgot to turn off. The proctoring agent has its readings, and without contemporaneous evidence that the agent was wrong, the held score usually leads to a retake requirement. The preparation steps above are designed to keep these cases from arising in the first place.