TCP Variables

Connection Variables

The following variables are available under the conn namespace:

Name	Type	Description
conn.bytes_in	int64	The number of bytes entering the endpoint from the client.
conn.bytes_out	int64	The number of bytes leaving an endpoint to the client.
conn.client_ip	string	Source IP of the connection to the ngrok endpoint.
conn.end_ts	timestamp	Timestamp when the connection to ngrok was closed.
conn.server_ip	string	The IP that this connection was established on.
conn.server_port	int32	The port that this connection was established on.
conn.start_ts	timestamp	Timestamp when the connection to ngrok was started.

conn.bytes_in

The number of bytes entering the endpoint from the client.

YAML

# snippet
---
expressions:
  - "conn.bytes_in > 1000"

JSON

// snippet
{
  "expressions": [
    "conn.bytes_in > 1000"
  ]
}

conn.bytes_out

The number of bytes leaving an endpoint to the client.

YAML

# snippet
---
expressions:
  - "conn.bytes_out > 1000"

JSON

// snippet
{
  "expressions": [
    "conn.bytes_out > 1000"
  ]
}

conn.client_ip

Source IP of the connection to the ngrok endpoint.

YAML

# snippet
---
expressions:
  - "conn.client_ip in ['::1', '127.0.0.1']"

JSON

// snippet
{
  "expressions": [
    "conn.client_ip in ['::1', '127.0.0.1']"
  ]
}

conn.end_ts

Timestamp when the connection to ngrok was closed.

YAML

# snippet
---
expressions:
  - "conn.end_ts > timestamp('2024-01-01')"

JSON

// snippet
{
  "expressions": [
    "conn.end_ts > timestamp('2024-01-01')"
  ]
}

conn.server_ip

The IP that this connection was established on.

YAML

# snippet
---
expressions:
  - "conn.server_ip == '192.168.1.1'"

JSON

// snippet
{
  "expressions": [
    "conn.server_ip == '192.168.1.1'"
  ]
}

conn.server_port

The port that this connection was established on.

YAML

# snippet
---
expressions:
  - "conn.server_port == 80"

JSON

// snippet
{
  "expressions": [
    "conn.server_port == 80"
  ]
}

conn.start_ts

Timestamp when the connection to ngrok was started.

YAML

# snippet
---
expressions:
  - "conn.start_ts > timestamp('2023-12-31')"

JSON

// snippet
{
  "expressions": [
    "conn.start_ts > timestamp('2023-12-31')"
  ]
}

Connection Geo Variables

The following variables are available under the conn.geo namespace:

Name	Type	Description
conn.geo.city	string	The name of the city, in EN, where the conn.client_ip is likely to originate.
conn.geo.country	string	The name of the country, in EN, where the conn.client_ip is likely to originate.
conn.geo.country_code	string	The two-letter ISO country code where the conn.client_ip is likely to originate.
conn.geo.latitude	string	The approximate latitude where the conn.client_ip is likely to originate.
conn.geo.longitude	string	The approximate longitude where the conn.client_ip is likely to originate.
conn.geo.radius	string	The radius in kilometers around the latitude and longitude where the conn.client_ip is likely to originate.
conn.geo.subdivision	string	The name of the subdivision, in EN, where the conn.client_ip is likely to originate.

conn.geo.city

The name of the city, in EN, where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.city == 'Strongsville'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.city == 'Strongsville'"
  ]
}

conn.geo.country

The name of the country, in EN, where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.country == 'United States'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.country == 'United States'"
  ]
}

conn.geo.country_code

The two-letter ISO country code where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.country_code != 'US'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.country_code != 'US'"
  ]
}

conn.geo.latitude

The approximate latitude where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "double(conn.geo.latitude) >= 45.0"

JSON

// snippet
{
  "expressions": [
    "double(conn.geo.latitude) >= 45.0"
  ]
}

conn.geo.longitude

The approximate longitude where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "double(conn.geo.longitude) <= -93.0"

JSON

// snippet
{
  "expressions": [
    "double(conn.geo.longitude) <= -93.0"
  ]
}

conn.geo.radius

The radius in kilometers around the latitude and longitude where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.radius <= '5'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.radius <= '5'"
  ]
}

conn.geo.subdivision

The name of the subdivision, in EN, where the conn.client_ip is likely to originate.

YAML

# snippet
---
expressions:
  - "conn.geo.subdivision == 'California'"

JSON

// snippet
{
  "expressions": [
    "conn.geo.subdivision == 'California'"
  ]
}

Time variables

The following variables are available under the time namespace:

Name	Type	Description
time.now	string	The current UTC time in RFC3339 format.

time.now

The current UTC time in RFC3339 format.

YAML

# snippet
---
expressions:
  - "conn.end_ts < timestamp(time.now)"

JSON

// snippet
{
  "expressions": [
    "conn.end_ts < timestamp(time.now)"
  ]
}