# Inspect TCP connections in Traffic Inspector

> Traffic Inspector now lists TCP connections next to HTTP requests, including connections to TCP and TLS endpoints.

- Date: 2026-10-26
- Author: Ayden Adair
- Products: Gateway
- URL: https://ngrok.com/changelog/traffic-inspector-tcp-connections

Debug a database, SSH, or raw TLS endpoint without guessing. Traffic Inspector now shows TCP connections as well as HTTP requests, so you can see who connected, how long the connection stayed open, how many bytes moved, and whether it failed. It's available to all customers.

![The Traffic Inspector TCP tab in dark mode with example data. Ten connections list their close time, client IP, protocol, bytes in and out, ngrok error, duration, and endpoint. Four connections from 198.51.100.23 to 5.tcp.ngrok.io:21843 show 0 B, 2 to 3 ms, and ngrok error 3205.](https://ngrok.com/blog-assets/images/2026-10-26-traffic-inspector-tcp-connections/tcp-connections-list-dark.png)

In this example, a Postgres database sits behind the TCP address `5.tcp.ngrok.io:21843`, and an MQTT broker sits behind the TLS endpoint `mqtt.example.com:443`. Most connections ran for minutes and moved megabytes. Four didn't.

Those four connections come from `198.51.100.23`. Each one lasted 2 or 3 ms and moved 0 bytes. Select one, and its details show `ERR_NGROK_3205`: a `restrict-ips` action blocked it. Here, that client isn't on the database's allowlist. Many short connections with 0 bytes and an ngrok error usually mean a rule is rejecting the client.

<Figure className="max-w-176">

![Connection Details for one of the failed example connections, in dark mode. The Overview tab shows endpoint 5.tcp.ngrok.io:21843, protocol TCP, outcome Failed, ngrok error 3205, failure type TCP error, a duration of 3 ms, 0 B in and out, client 198.51.100.23, and the connection, endpoint, and tunnel IDs.](https://ngrok.com/blog-assets/images/2026-10-26-traffic-inspector-tcp-connections/tcp-connection-failed-detail-dark.png)

</Figure>

Filter the list with `key:value` terms. A connection must match every key you use. For keys such as `proto` and `port`, separate values with a comma, or repeat the key, to match any of them. For example, `error:3205` finds every connection that `restrict-ips` blocked, and `proto:tls outcome:failed` finds TLS connections that failed.

The **Overview** tab shows the endpoint, protocol, outcome, duration, start and close times, bytes in (client to ngrok), bytes out (ngrok to client), client address, region, and the connection, endpoint, and tunnel IDs. The **IP Intelligence** tab adds detail about the client IP, and a TLS endpoint adds a **TLS** tab.

A connection appears after it closes. Turn on live mode to add connections as they close, without refreshing the page. ngrok doesn't read the bytes on a TCP or TLS endpoint, so a connection records metadata only, with no request or response bodies.

Connections follow the same retention as HTTP requests: 24 hours on free accounts and 72 hours on paid plans. Pay-as-you-go accounts can add up to 90 days of retention.

## Get started

1. [Sign in to the dashboard](https://dashboard.ngrok.com/).
2. Open [**Traffic Inspector** → **TCP**](https://dashboard.ngrok.com/traffic-inspector/connections).
3. Connect to one of your TCP or TLS endpoints, then disconnect. The connection appears once it closes.
4. Select the connection to read its **Overview** and **IP Intelligence** details. A TLS endpoint also shows a **TLS** tab.

The [TCP connections docs](https://ngrok.com/docs/obs/traffic-inspection/tcp-connections) list every field and filter key.