> ## Documentation Index > Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Traffic Inspector TCP Connections > View the TCP connections to your ngrok endpoints in Traffic Inspector, including client IPs, TLS handshake details, bytes transferred, and ngrok errors. The **TCP** tab in [Traffic Inspector](https://ngrok.com/docs/obs/traffic-inspection), next to the **HTTP** tab, lists every TCP connection to your endpoints, including the connections that carry HTTP and HTTPS requests. Each row shows who connected, which endpoint they reached, how long the connection stayed open, how many bytes moved in each direction, and whether it closed cleanly or failed. Use it if you run TCP or TLS endpoints, such as databases, SSH, game servers, or raw TLS services. It also helps with HTTP and HTTPS endpoints when a problem happens below the request level, such as a TLS handshake that fails before the client sends a request. ngrok doesn't read the bytes on a TCP or TLS endpoint, so these connections record metadata only, with no request or response bodies. [Full capture mode](https://ngrok.com/docs/obs/traffic-inspection/http-requests.md#full-capture-mode) and [replay](https://ngrok.com/docs/obs/traffic-inspection/http-requests.md#replay) apply only to HTTP requests. ## View your first connection 1. Start a TCP endpoint, for example by forwarding SSH: ```bash theme={null} ngrok tcp 22 ``` 2. Connect to the endpoint using the host and port from the agent output, then disconnect: ```bash theme={null} ssh user@ -p ``` 3. Open [Traffic Inspector → TCP](https://dashboard.ngrok.com/traffic-inspector/connections) in the dashboard. You can also open the endpoint in the dashboard and select **Inspect Traffic**. 4. Select the row for your connection to open its detail sheet. A connection appears in the list only after it closes. Turn on live mode to add connections to the list as they close, without refreshing the page. ## Connection fields ### Connections list | Column | Description | | - | - | | Closed | When the connection closed. | | Client IP | The IP address of the client that opened the connection. | | Protocol | `tcp`, `tls`, `http`, or `https`. | | Bytes In | Bytes received from the client. | | Bytes Out | Bytes sent to the client. | | ngrok Error | The [ngrok error code](https://ngrok.com/docs/errors/reference.md), if the connection failed. | | Duration | How long the connection stayed open. | | Endpoint | The endpoint the client connected to. | ### Detail sheet Select a connection to open its detail sheet. The sheet has a share link, and you can step to the previous or next connection without closing it. #### Overview tab | Field | Description | | - | - | | Endpoint | The endpoint the client connected to. | | Protocol | `tcp`, `tls`, `http`, or `https`. | | Outcome | `closed` if the connection closed cleanly, or `failed`. | | Duration | How long the connection stayed open. | | Started | When the connection opened. | | Closed | When the connection closed. | | Bytes In | Bytes received from the client. | | Bytes Out | Bytes sent to the client. | | Client | The client IP address. | | Region | The ngrok region that handled the connection. | | Connection ID | The unique ID of the connection. | | Endpoint ID | The ID of the endpoint. | | Tunnel ID | The ID of the agent tunnel that served the connection. | For a failed connection, **Failure Type** shows the category of failure, such as a TLS error, and **ngrok Error** shows the error code. #### TLS tab | Section | Fields | | - | - | | Handshake | Version, Cipher Suite, JA4 Fingerprint | | Server Certificate | Certificate ID, Common Name, Serial Number | | Client Certificate | Common Name, Serial Number | The **Client Certificate** section appears only when the endpoint uses mutual TLS. What the **TLS** tab shows depends on whether ngrok terminated TLS: * If ngrok doesn't terminate TLS, the tab shows only the JA4 fingerprint. Add the [`terminate-tls`](https://ngrok.com/docs/gateway/traffic-policy/actions/terminate-tls) action to see the version, cipher suite, and certificates. * If the handshake failed, the tab says so and has no version, cipher suite, or certificate to show. #### IP Intelligence tab The **IP Intelligence** tab shows the same client IP data that HTTP requests show. ## Connections and requests Every HTTP or HTTPS request travels over a connection. With HTTP keep-alive or HTTP/2, one connection can carry many requests. * From a request, the **Connection** tab in the request detail shows the connection the request used and links to it. * From an HTTP or HTTPS connection, you can open the list of requests that used it. * TCP and TLS connections have no requests. ## Filter connections The filter box takes `key:value` terms. To match any of several values for one key, separate the values with commas. When you enter several terms, a connection must match all of them. | Key | Example | Matches | | - | - | - | | `host` | `host:db` | Text in the endpoint host. | | `exact-host` | `exact-host:1.tcp.ngrok.io` | The whole endpoint host. | | `port` | `port:20123` | The endpoint port. | | `ip` | `ip:203.0.113.7` | The client IP. | | `proto` | `proto:tcp,tls` | `tcp`, `tls`, `http`, or `https`. | | `outcome` | `outcome:failed` | `closed` or `failed`. | | `error` | `error:3002` | An ngrok error code. | | `duration` | `duration:30s` | Connections open longer than this. | ## Troubleshooting ### A client can't complete a TLS handshake 1. Filter for `proto:tls outcome:failed`. 2. Open a connection. On the **Overview** tab, **Failure Type** is a TLS error and **ngrok Error** gives the code. 3. On the **TLS** tab, use the JA4 fingerprint and client IP to identify the client. 4. Compare them with connections from clients that succeed. Differences usually point to an outdated TLS stack, or a client that doesn't send a certificate when the endpoint requires mutual TLS. ### A database client keeps getting dropped 1. Filter for `exact-host: port:`. 2. Look at **Duration**, **Bytes In**, and **Bytes Out**. Many short connections with 0 bytes and an ngrok error usually mean a Traffic Policy rule rejected them, for example the [`restrict-ips`](https://ngrok.com/docs/gateway/traffic-policy/actions/restrict-ips) action in the `on_tcp_connect` phase. 3. Open one of the connections. The error banner shows [`ERR_NGROK_3205`](https://ngrok.com/docs/errors/err_ngrok_3205), which means `restrict-ips` blocked it. ## Limits and availability * **Plans:** Every plan includes the TCP tab. * **Retention:** Connections follow your plan's [Traffic Inspector retention](https://ngrok.com/docs/obs/traffic-inspection#ngrok-traffic-inspector) window, the same as HTTP requests. Free accounts keep 24 hours and paid plans keep 72 hours. Pay-as-you-go accounts can [purchase an add-on](https://ngrok.com/pricing) for up to 90 days. After that, opening a connection returns [`ERR_NGROK_TRAFFIC_INSPECT_CONNECTION_NOT_FOUND`](https://ngrok.com/docs/errors/err_ngrok_traffic_inspect_connection_not_found). * **Open connections:** A connection appears only after it closes. A long-lived connection, such as an SSH session or a database connection pool, doesn't appear while it's still open. * **Payloads:** TCP and TLS connections record metadata only. * **Permissions:** Anyone who can view requests in Traffic Inspector can view connections. * **Export:** To keep connections longer or send them to your own tools, use [log exporting](https://ngrok.com/docs/obs/events.md) with the [`tcp_connection_closed`](https://ngrok.com/docs/obs/events/reference#tcp-connection-closed) event. ## Related resources * [Traffic Inspector](https://ngrok.com/docs/obs/traffic-inspection) * [Connections in the dashboard](https://dashboard.ngrok.com/traffic-inspector/connections) * [`terminate-tls` action](https://ngrok.com/docs/gateway/traffic-policy/actions/terminate-tls) * [TCP endpoints](https://ngrok.com/docs/gateway/endpoints/tcp.md) * [ngrok error reference](https://ngrok.com/docs/errors/reference.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.