Traffic Inspector & Metrics

Traffic Inspector

Real-time traffic monitoring and analysis in the dashboard under Observability → Traffic Inspector.

Live Mode

Auto-refreshing traffic feed that polls every 3 seconds. Pause/resume at any time. Switch to Custom mode for historical queries with date range picker.

Filters

• Protocol — Multi-select: HTTP, TCP, UDP. Filters by transport scheme derived from the recorded request URL — handy on accounts mixing HTTP endpoints with raw TCP/UDP forwards.
• Method — Multi-select: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS (HTTP only)
• Status Code — Multi-select: individual codes or wildcard groups (2xx, 4xx, 5xx)
• Path — Free-text search (HTTP only)
• Host — Filter by endpoint host
• Client IP — Filter by source IP
• Date Range — Custom start/end with time precision

TCP & UDP traffic

TCP and UDP requests are logged alongside HTTP and render with the transport scheme prefixed in the Host column (e.g. tcp://your-app.ngris.com:17032, udp://…:51820). The Path column shows an em-dash for these rows since neither protocol carries a request path. The detail panel mirrors the list: Method / Path / Request / Response tabs are hidden for non-HTTP rows; latency, bytes, geo info, edge vs origin status, and the AI analysis tab remain.

AI Smart Search

Search traffic using natural language. Examples: "4xx responses for GET /v1/login in the past 2 hours", "last 5 requests from 203.0.113.7", "only 500 and 502 since yesterday".

Request Detail Panel

Click any request to open the detail panel with four tabs:

• Request — Method, path, duration, browser/OS (parsed from User-Agent), headers, cookies, body (JSON-formatted with syntax highlighting), client IP with country flag
• Request Intelligent — Auto-generated AI analysis of the request (client intent, risk assessment)
• Response — Status code, response headers, cookies, body (syntax-highlighted)
• AI Analysis — On-demand analysis with focus modes: General, Security, Performance, Debugging

The detail view also shows: connection ID, endpoint, bytes in/out, firewall action/policy, geo information (country flag + timezone), and edge vs origin status comparison. In the request list, the Duration column is color-coded by speed (green < 200 ms, amber 200–800 ms, red > 800 ms).

Timing Breakdown

Every HTTP request records a three-phase timing waterfall, shown as a stacked bar in the detail panel. The phases are sequential and non-overlapping, so they add up to the request's total Duration. All three are measured at the Ngris edge (no client-side instrumentation) and reported in milliseconds:

• Edge — Ngris edge processing before your origin is contacted: the firewall, rate-limit and authentication pipeline plus request framing. Measured from when the edge first received the request to when it handed the request off to your agent.
• Origin — time waiting for your origin to return the first response byte (connection + server processing), measured from the hand-off to the first byte. This is also the request's time-to-first-byte (TTFB / latency_ms).
• Transfer — streaming the response body from your origin to the client, measured from the first byte to when the full response was delivered.

Duration = Edge + Origin + Transfer — the full time from when the edge received the request to when the client received the complete response. A phase is omitted when it doesn't apply: a request blocked at the edge never reaches the origin, so it has no Origin or Transfer phase, and the breakdown is hidden entirely for TCP/UDP sessions (no HTTP request phases).

Replay

Replay any captured request with two modes:

• Replay Original — Instantly re-send the exact same request
• Replay with Modifications — Full request editor with:
  • Method selector and URL editor
  • Headers editor (Table, JSON, or Raw view modes)
  • Body editor (none, raw, or JSON with syntax highlighting)
  • Query parameters editor
  • Cookie editor
  • Auth configuration (None, Basic Auth, Bearer Token, API Key)
  • Copy as cURL

Replay Presets

Save replay configurations as reusable presets for quick testing:

• Save Preset — Save current method, URL, headers, body, and auth config with a custom name
• Load Preset — Load a saved preset from the dropdown to pre-fill the replay editor
• Export — Export presets to a JSON file for sharing or backup
• Import — Import presets from a JSON file

Bulk Replay

Select multiple requests using checkboxes and click Replay Selected to re-send them all at once. You can also bulk-compare two selected requests or clear the selection.

Share Request

Click the Share button on any request detail panel to share a captured request with team members.

Diff Viewer

Compare any two requests side-by-side. Select two requests and click Compare to see a line-by-line diff of headers and body content with additions (green) and removals (red).

Export

Export traffic data as JSON or CSV with all active filters applied.

Connected Agents & Load Balancing

View and manage agent connections in the dashboard. Navigate to a tunnel's detail page to see all connected agent sessions.

Agent Sessions Table

The tunnel detail page shows a real-time table of all connected agents with the following information:

Load Balancing Configuration

When multiple agents connect to the same tunnel, traffic is distributed via weighted round-robin. Configure per-agent load balancing parameters via CLI flags:

Example: ngris --token TOKEN --lbWeight 2 --lbMaxFails 3

Connected Agents List

On the tunnels overview page, each tunnel card shows a collapsible Connected Agents (Load Balanced) section when more than one agent is connected, displaying each agent's IP and version.

Metrics & Observability

Monitor your traffic and performance in the dashboard under Observability.

Metrics Dashboard

• Time range selector: 1 hour, 24 hours, 7 days, 30 days
• Real-time metrics via Server-Sent Events (SSE)
• Request volume and data transfer charts
• Endpoint comparison view
• SLO/SLI tracking
• Geographic traffic distribution (world map)

Dashboard Overview

The main dashboard shows:

• Stat cards: Requests, Bandwidth, Active Tunnels, Active Endpoints (with delta %)
• Traffic analytics charts (requests over time, data transfer)
• Top endpoints by requests and data transfer
• Plan usage gauges with limit warnings
• Smart alerts: usage warnings (75%, 90%), low success rate, no-traffic detection

Threshold Alerts

Define alert rules that page you when a traffic metric crosses a threshold. Configured in the dashboard under Observability → Alerts. Rules are evaluated by a background worker on a steady cadence; when a rule fires, the worker delivers one notification per configured channel and respects a per-rule cooldown to suppress repeats.

Anatomy of a rule

• Metric — one of request_rate, error_rate_pct, p95_latency_ms, p99_latency_ms, bandwidth_in_bps, bandwidth_out_bps.
• Operator + threshold — >, >=, <, or <= applied to the observed value.
• Window — sliding aggregation window in seconds (60–86400). The metric is averaged across this window.
• Scope — account-wide by default, or pinned to a single endpoint by UUID.
• Cooldown — minimum gap between consecutive notifications while the rule stays firing.
• Channels — at least one of: email (any address) or webhook (https URL; optional shared secret used to HMAC-sign each delivery as X-Ngris-Signature).

Lifecycle

• unknown — new rule, before the first evaluator cycle.
• ok — the most recent observation didn't cross the threshold.
• firing — the threshold was crossed. The first transition into firing dispatches notifications; subsequent observations in the same firing state are silent until either the cooldown elapses or the rule clears.

Toggling a rule off persists its history and configuration but skips evaluation — use it to mute an alert during planned changes.

UI features

• Filter bar — search by name/description, filter by status (ok/firing/unknown), metric, and enabled state.
• Events drawer — per-rule history of state transitions, observed value, and delivery success/failure.
• Test button — sends a one-shot test notification to every channel so you can verify webhook signatures and email deliverability without waiting for a real threshold crossing.
• AI Generate — describe what you want in natural language (e.g. "page me when error rate exceeds 1% for 5 minutes, and when p95 latency exceeds 500ms; email ops@acme.dev") and the assistant drafts a batch of rules. Each draft is reviewed and saved one at a time.

Webhook delivery

Webhook channels receive a POST with a JSON body describing the firing rule, the observed value, and the trigger timestamp. If a secret was supplied at create time, the worker signs the request body with HMAC-SHA256 and sends the hex digest in the X-Ngris-Signature header — reject any request whose computed digest doesn't match.

Programmatic access

The same surface is available over the public API at /traffic/alerts. See the API reference for the full CRUD, toggle, test, and events endpoints.