It sounds like this would not detect someone using Firesheep and also tunneling their traffic through SSH or a VPN, right?