> ## Documentation Index > Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Traffic Inspector TCP Connections > Find out who connected to your TCP and TLS endpoints, how much data moved, and why a connection failed, all in Traffic Inspector. The **TCP** tab in [Traffic Inspector](https://ngrok.com/docs/obs/traffic-inspection), next to the **HTTP** tab, lists every TCP connection to your endpoints, including the connections that carry HTTP and HTTPS requests. Each row shows who connected, which endpoint they reached, how long the connection stayed open, how many bytes moved in each direction, and whether it closed cleanly or failed. TCP and TLS connections that are still open appear in their own list above the closed ones, with a graph of the bytes they move over time. Use it if you run TCP or TLS endpoints, such as databases, SSH, game servers, or raw TLS services. It also helps with HTTP and HTTPS endpoints when a problem happens below the request level, such as a TLS handshake that fails before the client sends a request. ngrok doesn't read the bytes on a TCP or TLS endpoint, so these connections record metadata only, with no request or response bodies. [Full capture mode](https://ngrok.com/docs/obs/traffic-inspection/http-requests.md#full-capture-mode) and [replay](https://ngrok.com/docs/obs/traffic-inspection/http-requests.md#replay) apply only to HTTP requests. ## View your first connection 1. Start a TCP endpoint, for example by forwarding SSH: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} ngrok tcp 22 ``` 2. Connect to the endpoint using the host and port from the agent output, and leave the session open: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} ssh user@ -p ``` 3. Open [Traffic Inspector → TCP](https://dashboard.ngrok.com/traffic-inspector/connections) in the dashboard. You can also open the endpoint in the dashboard and select **Inspect Traffic**. 4. Your connection appears under **Open connections** within about 30 seconds. Select its row to open its detail sheet and watch **Bytes over time** grow as you type. 5. Disconnect from the SSH session. The connection moves to **Closed connections**. Turn on live mode to update both lists without refreshing the page. ## Open connections The **Open connections** list shows the TCP and TLS connections that are open right now, newest first. It appears above the closed connections only while at least one connection is open. ngrok reports each open connection about every 30 seconds while it moves data, and about every 30 minutes while it's idle. A new connection appears in the list after its first report, so a connection that closes within a few seconds appears only in the closed list. When a connection closes, it leaves the open list and appears in the closed list. With live mode on, the open list refreshes every 10 seconds and each **Duration** counts up. With live mode off, the list shows the connections that were open when it loaded. If more than 1,000 connections are open, the list shows the 1,000 that opened most recently. Add a filter to find the rest. ## Bytes over time The **Overview** tab of a connection's detail sheet has a **Bytes over time** graph. It shows the running total of **Bytes In** and **Bytes Out** from the moment the connection opened. * A flat line means the connection moved no data in that direction. * A steep step shows a burst, such as a large query result or a file transfer. * While the connection is open, the graph refreshes every 10 seconds. * After the connection closes, the graph ends at its final byte counts. ngrok updates the totals only when it reports the connection, so the lines move in steps rather than slopes. A connection that closed before its first report has no graph. If a connection has more than 2,000 reports, about 16 hours of steady traffic, the graph shows the newest 2,000. ## Connection fields ### Connections list | Column | Description | | - | - | | Closed | When the connection closed. | | Client IP | The IP address of the client that opened the connection. | | Connection | `TCP`, or `TLS` for TLS and HTTPS endpoints. | | Requests | How many HTTP requests ran over the connection. Select a count to see those requests. TCP and TLS endpoints show a dash. | | Bytes In | Bytes received from the client. | | Bytes Out | Bytes sent to the client. | | ngrok Error | The [ngrok error code](https://ngrok.com/docs/errors/reference.md), if the connection failed. | | Duration | How long the connection stayed open. | | Endpoint | The endpoint URL the client connected to, such as `https://app.ngrok.app:443`. | ### Open connections list | Column | Description | | - | - | | Started | When the connection opened. | | Client IP | The IP address of the client that opened the connection. | | Connection | `TCP` or `TLS`. | | Requests | A dash, because open connections are TCP and TLS only. | | Bytes In | Bytes received from the client, as of the last report. | | Bytes Out | Bytes sent to the client, as of the last report. | | Status | **Open**, and how long the connection has moved no data, if it's idle for at least a minute. | | Duration | How long the connection has been open so far. | | Endpoint | The endpoint URL the client connected to. | ### Detail sheet Select a connection to open its detail sheet. The sheet has a share link, and you can step to the previous or next connection without closing it. #### Overview tab | Field | Description | | - | - | | Endpoint | The endpoint URL the client connected to. | | Connection | `TCP`, or `TLS` for TLS and HTTPS endpoints. | | TLS | `Decrypted by ngrok`, `Forwarded encrypted`, or `Handshake failed`. TLS connections only. | | Requests | A **View requests** link to the HTTP requests that ran over the connection. HTTP and HTTPS endpoints only. | | Outcome | `open`, `closed` if the connection closed cleanly, or `failed`. | | Duration | How long the connection stayed open, or has been open so far. | | Started | When the connection opened. | | Closed | When the connection closed. An open connection has none. | | Bytes In | Bytes received from the client. | | Bytes Out | Bytes sent to the client. | | Client | The client IP address. | | Region | The ngrok region that handled the connection. | | Connection ID | The unique ID of the connection. | | Endpoint ID | The ID of the endpoint. | | Tunnel ID | The ID of the agent tunnel that served the connection. | For a failed connection, **Failure Type** shows the category of failure, such as a TLS error, and **ngrok Error** shows the error code. For an open connection, **Outcome** also shows how long the connection has been idle. Below the fields, the [**Bytes over time**](#bytes-over-time) graph shows the bytes the connection moved. #### TLS tab | Section | Fields | | - | - | | Handshake | Version, Cipher Suite, JA4 Fingerprint | | Server Certificate | Certificate ID, Common Name, Serial Number | | Client Certificate | Common Name, Serial Number | The **Client Certificate** section appears only when the endpoint uses mutual TLS. What the **TLS** tab shows depends on whether ngrok terminated TLS: * If ngrok doesn't terminate TLS, the tab shows only the JA4 fingerprint. Add the [`terminate-tls`](https://ngrok.com/docs/gateway/traffic-policy/actions/terminate-tls) action to see the version, cipher suite, and certificates. * If the handshake failed, the tab says so and has no version, cipher suite, or certificate to show. #### IP Intelligence tab The **IP Intelligence** tab shows the same client IP data that HTTP requests show. ## Connections and requests Every connection in this tab is a TCP connection. On a TLS or HTTPS endpoint, the client wraps it in TLS, so **Connection** shows `TLS`. HTTP isn't a kind of connection. On an HTTP or HTTPS endpoint, ngrok reads the HTTP requests that run inside the connection. With HTTP keep-alive or HTTP/2, one connection can carry many requests and stay open for minutes or hours. * From a connection, select the count in the **Requests** column, or **View requests** in the detail sheet, to open the requests that used it. * From a request, the **Connection** tab in the request detail shows the connection the request used and links to it. * ngrok forwards the bytes on a TCP or TLS endpoint without reading them, so those connections have no requests. ## Filter connections The filter box takes `key:value` terms. To match any of several values for one key, separate the values with commas. When you enter several terms, a connection must match all of them. | Key | Example | Matches | | - | - | - | | `host` | `host:db` | Text in the endpoint host. | | `exact-host` | `exact-host:1.tcp.ngrok.io` | The whole endpoint host. | | `port` | `port:20123` | The endpoint port. | | `ip` | `ip:203.0.113.7` | The client IP. | | `proto` | `proto:tcp,tls` | The endpoint protocol: `tcp`, `tls`, `http`, or `https`. | | `outcome` | `outcome:failed` | `closed` or `failed`. | | `error` | `error:3002` | An ngrok error code. | | `duration` | `duration:30s` | Connections open longer than this. | Filters apply to open connections too, with two differences: * `outcome` and `error` match only closed connections, so the open list hides while either is set. * `duration` counts the time a connection has been open so far, so an open connection joins the list once it's open long enough. ## Troubleshooting ### A client can't complete a TLS handshake 1. Filter for `proto:tls outcome:failed`. 2. Open a connection. On the **Overview** tab, **Failure Type** is a TLS error and **ngrok Error** gives the code. 3. On the **TLS** tab, use the JA4 fingerprint and client IP to identify the client. 4. Compare them with connections from clients that succeed. Differences usually point to an outdated TLS stack, or a client that doesn't send a certificate when the endpoint requires mutual TLS. ### A database client keeps getting dropped 1. Filter for `exact-host: port:`. 2. Look at **Duration**, **Bytes In**, and **Bytes Out**. Many short connections with 0 bytes and an ngrok error usually mean a Traffic Policy rule rejected them, for example the [`restrict-ips`](https://ngrok.com/docs/gateway/traffic-policy/actions/restrict-ips) action in the `on_tcp_connect` phase. 3. Open one of the connections. The error banner shows [`ERR_NGROK_3205`](https://ngrok.com/docs/errors/err_ngrok_3205), which means `restrict-ips` blocked it. ### A long-lived connection stops responding 1. Find the connection under **Open connections**. Filter for `ip:` or `exact-host:` if the list is long. 2. Check **Status**. **idle for** shows how long the connection has moved no data in either direction. 3. Open the connection and look at **Bytes over time**. If both lines go flat at the same time, neither side sent anything after that point. If only **Bytes In** keeps growing, the client is still sending but your service has stopped answering. ## Limits and availability * **Plans:** Every plan includes the TCP tab. * **Retention:** Connections follow your plan's [Traffic Inspector retention](https://ngrok.com/docs/obs/traffic-inspection#ngrok-traffic-inspector) window, the same as HTTP requests. Free accounts keep 24 hours and paid plans keep 72 hours. Pay-as-you-go accounts can [purchase an add-on](https://ngrok.com/pricing) for up to 90 days. After that, opening a connection returns [`ERR_NGROK_TRAFFIC_INSPECT_CONNECTION_NOT_FOUND`](https://ngrok.com/docs/errors/err_ngrok_traffic_inspect_connection_not_found). * **Open connections:** Only TCP and TLS connections appear in the open list. HTTP and HTTPS connections appear only after they close. An open connection appears even if it opened before your retention window, because retention counts from when a connection closes. * **Payloads:** TCP and TLS connections record metadata only. * **Permissions:** Anyone who can view requests in Traffic Inspector can view connections. * **Export:** To keep connections longer or send them to your own tools, use [log exporting](https://ngrok.com/docs/obs/events.md) with the [`tcp_connection_closed`](https://ngrok.com/docs/obs/events/reference#tcp-connection-closed) event. ## Related resources * [Traffic Inspector](https://ngrok.com/docs/obs/traffic-inspection) * [Connections in the dashboard](https://dashboard.ngrok.com/traffic-inspector/connections) * [`terminate-tls` action](https://ngrok.com/docs/gateway/traffic-policy/actions/terminate-tls) * [TCP endpoints](https://ngrok.com/docs/gateway/endpoints/tcp.md) * [ngrok error reference](https://ngrok.com/docs/errors/reference.md) * [Inspect TCP connections in Traffic Inspector](https://ngrok.com/changelog/traffic-inspector-tcp-connections): Announced in the changelog on October 26, 2026 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.