TCP Variables
Connection Variables
The following variables are available under the conn
namespace:
Name | Type | Description |
---|---|---|
conn.bytes_in | int64 | The number of bytes entering the endpoint from the client. |
conn.bytes_out | int64 | The number of bytes leaving an endpoint to the client. |
conn.client_ip | string | Source IP of the connection to the ngrok endpoint. |
conn.end_ts | timestamp | Timestamp when the connection to ngrok was closed. |
conn.server_ip | string | The IP that this connection was established on. |
conn.server_port | int32 | The port that this connection was established on. |
conn.start_ts | timestamp | Timestamp when the connection to ngrok was started. |
conn.bytes_in
The number of bytes entering the endpoint from the client.
- YAML
- JSON
# snippet
---
expressions:
- "conn.bytes_in > 1000"
// snippet
{
"expressions": [
"conn.bytes_in > 1000"
]
}
conn.bytes_out
The number of bytes leaving an endpoint to the client.
- YAML
- JSON
# snippet
---
expressions:
- "conn.bytes_out > 1000"
// snippet
{
"expressions": [
"conn.bytes_out > 1000"
]
}
conn.client_ip
Source IP of the connection to the ngrok endpoint.
- YAML
- JSON
# snippet
---
expressions:
- "conn.client_ip in ['::1', '127.0.0.1']"
// snippet
{
"expressions": [
"conn.client_ip in ['::1', '127.0.0.1']"
]
}
conn.end_ts
Timestamp when the connection to ngrok was closed.
- YAML
- JSON
# snippet
---
expressions:
- "conn.end_ts > timestamp('2024-01-01')"
// snippet
{
"expressions": [
"conn.end_ts > timestamp('2024-01-01')"
]
}
conn.server_ip
The IP that this connection was established on.
- YAML
- JSON
# snippet
---
expressions:
- "conn.server_ip == '192.168.1.1'"
// snippet
{
"expressions": [
"conn.server_ip == '192.168.1.1'"
]
}
conn.server_port
The port that this connection was established on.
- YAML
- JSON
# snippet
---
expressions:
- "conn.server_port == 80"
// snippet
{
"expressions": [
"conn.server_port == 80"
]
}
conn.start_ts
Timestamp when the connection to ngrok was started.
- YAML
- JSON
# snippet
---
expressions:
- "conn.start_ts > timestamp('2023-12-31')"
// snippet
{
"expressions": [
"conn.start_ts > timestamp('2023-12-31')"
]
}
Connection Geo Variables
The following variables are available under the conn.geo
namespace:
Name | Type | Description |
---|---|---|
conn.geo.city | string | The name of the city, in EN, where the conn.client_ip is likely to originate. |
conn.geo.country | string | The name of the country, in EN, where the conn.client_ip is likely to originate. |
conn.geo.country_code | string | The two-letter ISO country code where the conn.client_ip is likely to originate. |
conn.geo.latitude | string | The approximate latitude where the conn.client_ip is likely to originate. |
conn.geo.longitude | string | The approximate longitude where the conn.client_ip is likely to originate. |
conn.geo.radius | string | The radius in kilometers around the latitude and longitude where the conn.client_ip is likely to originate. |
conn.geo.subdivision | string | The name of the subdivision, in EN, where the conn.client_ip is likely to originate. |
conn.geo.city
The name of the city, in EN, where the conn.client_ip
is likely to originate.
- YAML
- JSON
# snippet
---
expressions:
- "conn.geo.city == 'Strongsville'"
// snippet
{
"expressions": [
"conn.geo.city == 'Strongsville'"
]
}
conn.geo.country
The name of the country, in EN, where the conn.client_ip
is likely to originate.
- YAML
- JSON
# snippet
---
expressions:
- "conn.geo.country == 'United States'"
// snippet
{
"expressions": [
"conn.geo.country == 'United States'"
]
}
conn.geo.country_code
The two-letter ISO country code where the conn.client_ip
is likely to originate.
- YAML
- JSON
# snippet
---
expressions:
- "conn.geo.country_code != 'US'"
// snippet
{
"expressions": [
"conn.geo.country_code != 'US'"
]
}
conn.geo.latitude
The approximate latitude where the conn.client_ip
is likely to originate.
- YAML
- JSON
# snippet
---
expressions:
- "double(conn.geo.latitude) >= 45.0"
// snippet
{
"expressions": [
"double(conn.geo.latitude) >= 45.0"
]
}
conn.geo.longitude
The approximate longitude where the conn.client_ip
is likely to originate.
- YAML
- JSON
# snippet
---
expressions:
- "double(conn.geo.longitude) <= -93.0"
// snippet
{
"expressions": [
"double(conn.geo.longitude) <= -93.0"
]
}
conn.geo.radius
The radius in kilometers around the latitude and longitude where the conn.client_ip
is likely to originate.
- YAML
- JSON
# snippet
---
expressions:
- "conn.geo.radius <= '5'"
// snippet
{
"expressions": [
"conn.geo.radius <= '5'"
]
}
conn.geo.subdivision
The name of the subdivision, in EN, where the conn.client_ip
is likely to originate.
- YAML
- JSON
# snippet
---
expressions:
- "conn.geo.subdivision == 'California'"
// snippet
{
"expressions": [
"conn.geo.subdivision == 'California'"
]
}
Time variables
The following variables are available under the time
namespace:
Name | Type | Description |
---|---|---|
time.now | string | The current UTC time in RFC3339 format. |
time.now
The current UTC time in RFC3339 format.
- YAML
- JSON
# snippet
---
expressions:
- "conn.end_ts < timestamp(time.now)"
// snippet
{
"expressions": [
"conn.end_ts < timestamp(time.now)"
]
}