Skip to main content
The TCP tab in Traffic Inspector, next to the HTTP tab, lists every TCP connection to your endpoints, including the connections that carry HTTP and HTTPS requests. Each row shows who connected, which endpoint they reached, how long the connection stayed open, how many bytes moved in each direction, and whether it closed cleanly or failed. TCP and TLS connections that are still open appear in their own list above the closed ones, with a graph of the bytes they move over time. Use it if you run TCP or TLS endpoints, such as databases, SSH, game servers, or raw TLS services. It also helps with HTTP and HTTPS endpoints when a problem happens below the request level, such as a TLS handshake that fails before the client sends a request. ngrok doesn’t read the bytes on a TCP or TLS endpoint, so these connections record metadata only, with no request or response bodies. Full capture mode and replay apply only to HTTP requests.

View your first connection

  1. Start a TCP endpoint, for example by forwarding SSH:
  2. Connect to the endpoint using the host and port from the agent output, and leave the session open:
  3. Open Traffic Inspector → TCP in the dashboard. You can also open the endpoint in the dashboard and select Inspect Traffic.
  4. Your connection appears under Open connections within about 30 seconds. Select its row to open its detail sheet and watch Bytes over time grow as you type.
  5. Disconnect from the SSH session. The connection moves to Closed connections.
Turn on live mode to update both lists without refreshing the page.

Open connections

The Open connections list shows the TCP and TLS connections that are open right now, newest first. It appears above the closed connections only while at least one connection is open. ngrok reports each open connection about every 30 seconds while it moves data, and about every 30 minutes while it’s idle. A new connection appears in the list after its first report, so a connection that closes within a few seconds appears only in the closed list. When a connection closes, it leaves the open list and appears in the closed list. With live mode on, the open list refreshes every 10 seconds and each Duration counts up. With live mode off, the list shows the connections that were open when it loaded. If more than 1,000 connections are open, the list shows the 1,000 that opened most recently. Add a filter to find the rest.

Bytes over time

The Overview tab of a connection’s detail sheet has a Bytes over time graph. It shows the running total of Bytes In and Bytes Out from the moment the connection opened.
  • A flat line means the connection moved no data in that direction.
  • A steep step shows a burst, such as a large query result or a file transfer.
  • While the connection is open, the graph refreshes every 10 seconds.
  • After the connection closes, the graph ends at its final byte counts.
ngrok updates the totals only when it reports the connection, so the lines move in steps rather than slopes. A connection that closed before its first report has no graph. If a connection has more than 2,000 reports, about 16 hours of steady traffic, the graph shows the newest 2,000.

Connection fields

Connections list

Open connections list

Detail sheet

Select a connection to open its detail sheet. The sheet has a share link, and you can step to the previous or next connection without closing it.

Overview tab

For a failed connection, Failure Type shows the category of failure, such as a TLS error, and ngrok Error shows the error code. For an open connection, Outcome also shows how long the connection has been idle. Below the fields, the Bytes over time graph shows the bytes the connection moved.

TLS tab

The Client Certificate section appears only when the endpoint uses mutual TLS. What the TLS tab shows depends on whether ngrok terminated TLS:
  • If ngrok doesn’t terminate TLS, the tab shows only the JA4 fingerprint. Add the terminate-tls action to see the version, cipher suite, and certificates.
  • If the handshake failed, the tab says so and has no version, cipher suite, or certificate to show.

IP Intelligence tab

The IP Intelligence tab shows the same client IP data that HTTP requests show.

Connections and requests

Every connection in this tab is a TCP connection. On a TLS or HTTPS endpoint, the client wraps it in TLS, so Connection shows TLS. HTTP isn’t a kind of connection. On an HTTP or HTTPS endpoint, ngrok reads the HTTP requests that run inside the connection. With HTTP keep-alive or HTTP/2, one connection can carry many requests and stay open for minutes or hours.
  • From a connection, select the count in the Requests column, or View requests in the detail sheet, to open the requests that used it.
  • From a request, the Connection tab in the request detail shows the connection the request used and links to it.
  • ngrok forwards the bytes on a TCP or TLS endpoint without reading them, so those connections have no requests.

Filter connections

The filter box takes key:value terms. To match any of several values for one key, separate the values with commas. When you enter several terms, a connection must match all of them. Filters apply to open connections too, with two differences:
  • outcome and error match only closed connections, so the open list hides while either is set.
  • duration counts the time a connection has been open so far, so an open connection joins the list once it’s open long enough.

Troubleshooting

A client can’t complete a TLS handshake

  1. Filter for proto:tls outcome:failed.
  2. Open a connection. On the Overview tab, Failure Type is a TLS error and ngrok Error gives the code.
  3. On the TLS tab, use the JA4 fingerprint and client IP to identify the client.
  4. Compare them with connections from clients that succeed. Differences usually point to an outdated TLS stack, or a client that doesn’t send a certificate when the endpoint requires mutual TLS.

A database client keeps getting dropped

  1. Filter for exact-host:<your-tcp-host> port:<port>.
  2. Look at Duration, Bytes In, and Bytes Out. Many short connections with 0 bytes and an ngrok error usually mean a Traffic Policy rule rejected them, for example the restrict-ips action in the on_tcp_connect phase.
  3. Open one of the connections. The error banner shows ERR_NGROK_3205, which means restrict-ips blocked it.

A long-lived connection stops responding

  1. Find the connection under Open connections. Filter for ip:<client-ip> or exact-host:<your-tcp-host> if the list is long.
  2. Check Status. idle for shows how long the connection has moved no data in either direction.
  3. Open the connection and look at Bytes over time. If both lines go flat at the same time, neither side sent anything after that point. If only Bytes In keeps growing, the client is still sending but your service has stopped answering.

Limits and availability

  • Plans: Every plan includes the TCP tab.
  • Retention: Connections follow your plan’s Traffic Inspector retention window, the same as HTTP requests. Free accounts keep 24 hours and paid plans keep 72 hours. Pay-as-you-go accounts can purchase an add-on for up to 90 days. After that, opening a connection returns ERR_NGROK_TRAFFIC_INSPECT_CONNECTION_NOT_FOUND.
  • Open connections: Only TCP and TLS connections appear in the open list. HTTP and HTTPS connections appear only after they close. An open connection appears even if it opened before your retention window, because retention counts from when a connection closes.
  • Payloads: TCP and TLS connections record metadata only.
  • Permissions: Anyone who can view requests in Traffic Inspector can view connections.
  • Export: To keep connections longer or send them to your own tools, use log exporting with the tcp_connection_closed event.