Traffic and metrics

Every connection HLE runs is measured, and every one of them is measured the same way: a chart of traffic over time, and three numbers above it. Whether you are looking at a tunnel, a webhook receiver, an agent, or a firepuncher forward, the widget is the same and the axes mean the same thing.

Where to find it

You want	Open
Everything on the account	Dashboard → Analytics
One tunnel or webhook receiver	its page, from the connections list
One agent, summed over its endpoints	Connections → Agents → the agent
An agent’s TCP forwards	Firepuncher, on the agent

Each view offers 24 hours, 7 days and 30 days.

What the three numbers mean

The metric strip changes with what you are looking at, because the honest answer is different for each. Nothing is averaged across things that cannot be meaningfully averaged.

View	Metrics
Account	Requests · Traffic · WS streams
Tunnel	Requests · Traffic · Latency
Webhook receiver	Deliveries · Traffic · Latency
Firepuncher	Forwards · Traffic · Median length

Two deliberate omissions:

The account view has no latency. Latency is a property of a connection. Averaging it across every tunnel on an account produces a number that describes nothing.
Firepuncher counts forwards, not requests. A forward is a TCP session, so its useful second dimension is how long it lasted, not how quickly it replied.

A forward that is still open counts, and its traffic is included as the agent relays it — an SSH session held open for hours would otherwise show as nothing at all until you closed it. When something is open you get a fourth number, Open now, which is what explains a traffic figure that keeps climbing while the forward count and the median sit still. The median covers finished forwards only: an open session’s age is not its length.

For a forward, in means bytes travelling toward the target service and out means bytes coming back — the same direction convention as a tunnel’s request and response bodies, so bars point the same way on every chart.

Webhook outcomes

A webhook receiver’s chart splits deliveries by what happened to them: delivered, failed, rate limited, rejected. This is the fastest way to tell “the provider stopped sending” from “we turned it away”.

Outcomes are recorded hourly. On the 30-day view they are absent rather than approximated, because the coarser table that backs long ranges does not record them — an empty outcome breakdown at 30 days is not a sign that nothing failed.

Resolution and retention

Range	Bucket	Source
24 hours	1 hour	hourly rows
7 days	6 hours	hourly rows
30 days	24 hours	daily rollups

Per-tunnel hourly rows are purged after two weeks, so ranges longer than 7 days are served from the rollups. The account’s own hourly table is never purged, which is why the account chart stays hour-resolution at every range.

The connection log

The chart says how much; the logs say who, at two levels.

The Activity log lists connection events — tunnels coming up and going down, auth failures, errors — filterable by event type, tunnel and date range. Read it from Activity.

Per-request access logs are separate: each access rule shows the visits it was responsible for, and the fall-through rule shows everyone it turned away. Those requests are recorded with the client address, which rule matched, and the outcome, under each rule in Access Control.

Retention follows your plan: 7 days on Free, up to 30 on PAYG.

When you need the bodies

Metrics deliberately contain no payloads. When a specific tunnel is misbehaving in a way counters cannot explain, HLE has a per-tunnel capture mode that records full requests and responses for a bounded window.

It is administrator-initiated and off by default — capture is a privacy-sensitive operation, not something a chart turns on. If you are debugging a tunnel and need it, ask.

Agent — one process, many endpoints
Firepuncher — TCP forwards, and their forward log
Webhooks — receivers, rate limits and delivery outcomes