TCP Variables

Connection Variables

The following variables are available under the conn namespace:

Name	Type	Description
conn.bytes_in	int64	The number of bytes entering the endpoint from the client.
conn.bytes_out	int64	The number of bytes leaving an endpoint to the client.
conn.client_ip	string	Source IP of the connection to the ngrok endpoint.
conn.client_port	int32	Source port of the connection to the ngrok endpoint.
conn.server_ip	string	The IP that this connection was established on.
conn.server_port	int32	The port that this connection was established on.
conn.ts.end	timestamp	Timestamp when the connection to ngrok was closed.
conn.ts.start	timestamp	Timestamp when the connection to ngrok was started.

conn.bytes_in

The number of bytes entering the endpoint from the client.

YAML

# snippet
---
expressions:
  - "conn.bytes_in > 1000"

JSON

// snippet
{
  "expressions": [
    "conn.bytes_in > 1000"
  ]
}

conn.bytes_out

The number of bytes leaving an endpoint to the client.

YAML

# snippet
---
expressions:
  - "conn.bytes_out > 1000"

JSON

// snippet
{
  "expressions": [
    "conn.bytes_out > 1000"
  ]
}

conn.client_ip

Source IP of the connection to the ngrok endpoint.

YAML

# snippet
---
expressions:
  - "conn.client_ip in ['::1', '127.0.0.1']"

JSON

// snippet
{
  "expressions": [
    "conn.client_ip in ['::1', '127.0.0.1']"
  ]
}

conn.client_port

Source port of the connection to the ngrok endpoint.

YAML

# snippet
---
expressions:
  - "conn.client_port == 80"

JSON

// snippet
{
  "expressions": [
    "conn.client_port == 80"
  ]
}

conn.ts.end

Timestamp when the connection to ngrok was closed.

YAML

# snippet
---
expressions:
  - "conn.ts.end > timestamp('2024-01-01')"

JSON

// snippet
{
  "expressions": [
    "conn.ts.end > timestamp('2024-01-01')"
  ]
}

conn.server_ip

The IP that this connection was established on.

YAML

# snippet
---
expressions:
  - "conn.server_ip == '192.168.1.1'"

JSON

// snippet
{
  "expressions": [
    "conn.server_ip == '192.168.1.1'"
  ]
}

conn.server_port

The port that this connection was established on.

YAML

# snippet
---
expressions:
  - "conn.server_port == 80"

JSON

// snippet
{
  "expressions": [
    "conn.server_port == 80"
  ]
}

conn.ts.start

Timestamp when the connection to ngrok was started.

YAML

# snippet
---
expressions:
  - "conn.ts.start > timestamp('2023-12-31')"

JSON

// snippet
{
  "expressions": [
    "conn.ts.start > timestamp('2023-12-31')"
  ]
}

Connection Geo Variables

The following variables are available under the conn.geo namespace:

Name	Type	Description
conn.geo.city	string	The name of the city, in EN, where the conn.client_ip is likely to originate.
conn.geo.country	string	The name of the country, in EN, where the conn.client_ip is likely to originate.
conn.geo.country_code	string	The two-letter ISO country code where the conn.client_ip is likely to originate.
conn.geo.latitude	string	The approximate latitude where the conn.client_ip is likely to originate.
conn.geo.longitude	string	The approximate longitude where the conn.client_ip is likely to originate.
conn.geo.radius	string	The radius in kilometers around the latitude and longitude where the conn.client_ip is likely to originate.
conn.geo.subdivision	string	The name of the subdivision, in EN, where the conn.client_ip is likely to originate.

conn.geo.city

The name of the city, in EN, where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.city == 'Strongsville'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.city == 'Strongsville'"
  ]
}

conn.geo.country

The name of the country, in EN, where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.country == 'United States'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.country == 'United States'"
  ]
}

conn.geo.country_code

The two-letter ISO country code where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.country_code != 'US'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.country_code != 'US'"
  ]
}

conn.geo.latitude

The approximate latitude where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "double(conn.geo.latitude) >= 45.0"

JSON

// snippet
{
  "expressions": [
    "double(conn.geo.latitude) >= 45.0"
  ]
}

conn.geo.longitude

The approximate longitude where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "double(conn.geo.longitude) <= -93.0"

JSON

// snippet
{
  "expressions": [
    "double(conn.geo.longitude) <= -93.0"
  ]
}

conn.geo.radius

The radius in kilometers around the latitude and longitude where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.radius <= '5'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.radius <= '5'"
  ]
}

conn.geo.subdivision

The name of the subdivision, in EN, where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.subdivision == 'California'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.subdivision == 'California'"
  ]
}

Time variables

The following variables are available under the time namespace:

Name	Type	Description
time.now	string	The current UTC time in RFC3339 format.

time.now

The current UTC time in RFC3339 format.

YAML

# snippet
---
expressions:
  - "conn.ts.end < timestamp(time.now)"

JSON

// snippet
{
  "expressions": [
    "conn.ts.end < timestamp(time.now)"
  ]
}