Skip to main content
BlogNewsletterRSS
Back to changelog

Inspect TCP connections in Traffic Inspector

Avatar for Ayden Adair

Ayden Adair

Debug a database, SSH, or raw TLS endpoint without guessing. Traffic Inspector now shows TCP connections as well as HTTP requests, so you can see who connected, how long the connection stayed open, how many bytes moved, and whether it failed. It’s available to all customers.

In this example, a Postgres database sits behind the TCP address 5.tcp.ngrok.io:21843, and an MQTT broker sits behind the TLS endpoint mqtt.example.com:443. Most connections ran for minutes and moved megabytes. Four didn’t.

Those four connections come from 198.51.100.23. Each one lasted 2 or 3 ms and moved 0 bytes. Select one, and its details show ERR_NGROK_3205: a restrict-ips action blocked it. Here, that client isn’t on the database’s allowlist. Many short connections with 0 bytes and an ngrok error usually mean a rule is rejecting the client.

Filter the list with key:value terms. A connection must match every key you use. For keys such as proto and port, separate values with a comma, or repeat the key, to match any of them. For example, error:3205 finds every connection that restrict-ips blocked, and proto:tls outcome:failed finds TLS connections that failed.

The Overview tab shows the endpoint, protocol, outcome, duration, start and close times, bytes in (client to ngrok), bytes out (ngrok to client), client address, region, and the connection, endpoint, and tunnel IDs. The IP Intelligence tab adds detail about the client IP, and a TLS endpoint adds a TLS tab.

A connection appears after it closes. Turn on live mode to add connections as they close, without refreshing the page. ngrok doesn’t read the bytes on a TCP or TLS endpoint, so a connection records metadata only, with no request or response bodies.

Connections follow the same retention as HTTP requests: 24 hours on free accounts and 72 hours on paid plans. Pay-as-you-go accounts can add up to 90 days of retention.

Get started

  1. Sign in to the dashboard.
  2. Open Traffic Inspector → TCP.
  3. Connect to one of your TCP or TLS endpoints, then disconnect. The connection appears once it closes.
  4. Select the connection to read its Overview and IP Intelligence details. A TLS endpoint also shows a TLS tab.

The TCP connections docs list every field and filter key.