Skip to main content
The TCP tab in Traffic Inspector, next to the HTTP tab, lists every TCP connection to your endpoints, including the connections that carry HTTP and HTTPS requests. Each row shows who connected, which endpoint they reached, how long the connection stayed open, how many bytes moved in each direction, and whether it closed cleanly or failed. Use it if you run TCP or TLS endpoints, such as databases, SSH, game servers, or raw TLS services. It also helps with HTTP and HTTPS endpoints when a problem happens below the request level, such as a TLS handshake that fails before the client sends a request. ngrok doesn’t read the bytes on a TCP or TLS endpoint, so these connections record metadata only, with no request or response bodies. Full capture mode and replay apply only to HTTP requests.

​
View your first connection

  1. Start a TCP endpoint, for example by forwarding SSH:
  2. Connect to the endpoint using the host and port from the agent output, then disconnect:
  3. Open Traffic Inspector → TCP in the dashboard. You can also open the endpoint in the dashboard and select Inspect Traffic.
  4. Select the row for your connection to open its detail sheet.
A connection appears in the list only after it closes. Turn on live mode to add connections to the list as they close, without refreshing the page.

​
Connection fields

​
Connections list

​
Detail sheet

Select a connection to open its detail sheet. The sheet has a share link, and you can step to the previous or next connection without closing it.

​
Overview tab

For a failed connection, Failure Type shows the category of failure, such as a TLS error, and ngrok Error shows the error code.

​
TLS tab

The Client Certificate section appears only when the endpoint uses mutual TLS. What the TLS tab shows depends on whether ngrok terminated TLS:
  • If ngrok doesn’t terminate TLS, the tab shows only the JA4 fingerprint. Add the terminate-tls action to see the version, cipher suite, and certificates.
  • If the handshake failed, the tab says so and has no version, cipher suite, or certificate to show.

​
IP Intelligence tab

The IP Intelligence tab shows the same client IP data that HTTP requests show.

​
Connections and requests

Every HTTP or HTTPS request travels over a connection. With HTTP keep-alive or HTTP/2, one connection can carry many requests.
  • From a request, the Connection tab in the request detail shows the connection the request used and links to it.
  • From an HTTP or HTTPS connection, you can open the list of requests that used it.
  • TCP and TLS connections have no requests.

​
Filter connections

The filter box takes key:value terms. To match any of several values for one key, separate the values with commas. When you enter several terms, a connection must match all of them.

​
Troubleshooting

​
A client can’t complete a TLS handshake

  1. Filter for proto:tls outcome:failed.
  2. Open a connection. On the Overview tab, Failure Type is a TLS error and ngrok Error gives the code.
  3. On the TLS tab, use the JA4 fingerprint and client IP to identify the client.
  4. Compare them with connections from clients that succeed. Differences usually point to an outdated TLS stack, or a client that doesn’t send a certificate when the endpoint requires mutual TLS.

​
A database client keeps getting dropped

  1. Filter for exact-host:<your-tcp-host> port:<port>.
  2. Look at Duration, Bytes In, and Bytes Out. Many short connections with 0 bytes and an ngrok error usually mean a Traffic Policy rule rejected them, for example the restrict-ips action in the on_tcp_connect phase.
  3. Open one of the connections. The error banner shows ERR_NGROK_3205, which means restrict-ips blocked it.

​
Limits and availability

  • Plans: Every plan includes the TCP tab.
  • Retention: Connections follow your plan’s Traffic Inspector retention window, the same as HTTP requests. Free accounts keep 24 hours and paid plans keep 72 hours. Pay-as-you-go accounts can purchase an add-on for up to 90 days. After that, opening a connection returns ERR_NGROK_TRAFFIC_INSPECT_CONNECTION_NOT_FOUND.
  • Open connections: A connection appears only after it closes. A long-lived connection, such as an SSH session or a database connection pool, doesn’t appear while it’s still open.
  • Payloads: TCP and TLS connections record metadata only.
  • Permissions: Anyone who can view requests in Traffic Inspector can view connections.
  • Export: To keep connections longer or send them to your own tools, use log exporting with the tcp_connection_closed event.