# Endpoints and ports Every hostname and port that Tracix Collectors, OpenTelemetry SDKs and browsers connect to, and the ports a collector listens on for syslog, flows and traps. Collectors, SDKs and browsers connect out to Tracix over HTTPS on TCP 443. Nothing on this page needs an inbound firewall rule except the listeners your own collectors run for devices on your network. ## Read the hostnames Your workspace's address is its name when it was created followed by an eight-character ID, such as `production-a7k3p2q9.app.tracix.io`. The hostnames collectors and SDKs use carry the ID alone. On this page and across the docs, `` stands for that ID: the workspace above has its collector endpoint at `agents-a7k3p2q9.app.tracix.io`. An older workspace whose address has no ID suffix uses its whole name in both places. > **Copy exact values from your workspace** > > The collector install command on the **Collectors** page, the **Gateway endpoints** card under **Applications › APM & Traces › Setup**, and **Applications › Real User Monitoring › Setup** show the exact hostnames for your workspace. ## Hostnames Tracix serves All of these listen on TCP 443 with TLS. Don't add port 4317 or 4318 to a Tracix hostname: those ports exist only inside your workspace. | Hostname | Who connects | What for | | ---------------------------------------------------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------- | | `cloud.tracix.io` | Browsers | The Tracix Cloud console: sign-in, your organization, workspaces, users and billing | | `-.app.tracix.io`, or a custom domain you added | Browsers, scripts and CI | Your workspace's app, and the endpoints that accept [API keys](https://tracix.io/docs/api/authentication) | | `agents-.app.tracix.io` | Tracix Collectors | Enrollment, policy configuration, heartbeats and live updates | | `ch-.app.tracix.io` | Tracix Collectors | The telemetry collectors write to your workspace's database, in workspaces with a Tracix-managed database | | `otlp-.app.tracix.io` | OpenTelemetry SDKs, agents and collectors | OTLP over gRPC | | `otlp-http-.app.tracix.io` | OpenTelemetry SDKs, agents and collectors | OTLP over HTTP (`http/protobuf`) | | `rum-.app.tracix.io` | Browsers and mobile apps | Real user monitoring data over OTLP/HTTP | | `charts.tracix.io` | Installers, collectors and Helm | Installers, release bundles and their checksums, managed updates and the Helm chart repository | | `public.ecr.aws` | Docker and Kubernetes hosts | The collector container image | ## What each client needs ### Tracix Collector A collector needs outbound HTTPS to these hosts, directly or through an HTTP proxy: | Host | Used for | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `charts.tracix.io` | Downloading the installer and the release at install, and new releases during managed updates | | `agents-.app.tracix.io` | HTTPS requests to `/v1/enroll`, `/v1/config` and `/v1/heartbeat`, and a WebSocket at `/v1/ws` that pushes configuration changes. When the WebSocket can't connect, the collector polls over HTTPS instead | | `ch-.app.tracix.io` | Writing telemetry, with an insert-only credential that comes with the collector's configuration | | `public.ecr.aws` | Pulling the collector image, for Docker and Kubernetes installs only | It also connects to whatever its policy monitors, such as devices it polls over SNMP or cloud APIs. To route collector traffic through a proxy, see [Ports, proxies and firewalls](https://tracix.io/docs/collect/collector/ports-and-proxies). ### OpenTelemetry SDKs and agents Applications send OTLP to your workspace with an ingest key (`apm_…`) from **Applications › APM & Traces › Setup** in the `x-tracix-ingest-key` header. See [API keys and ingest keys](https://tracix.io/docs/admin/api-keys). | Protocol | Endpoint | | -------------- | ----------------------------------------------------------------------------------------------------------------- | | OTLP over gRPC | `https://otlp-.app.tracix.io` | | OTLP over HTTP | `https://otlp-http-.app.tracix.io`, with the standard paths `/v1/traces`, `/v1/metrics` and `/v1/logs` | The gRPC and HTTP endpoints are separate hosts. Set the protocol explicitly: an SDK that defaults to gRPC gets HTTP 415 from the HTTP host. ```bash title="OpenTelemetry SDK environment" export OTEL_EXPORTER_OTLP_ENDPOINT=https://otlp-http-.app.tracix.io export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf export OTEL_EXPORTER_OTLP_HEADERS="x-tracix-ingest-key=" ``` See [OTLP endpoint and ingest keys](https://tracix.io/docs/collect/instrument/otlp) for headers, protocols and examples. ### Browsers and mobile apps Real user monitoring sends OTLP/HTTP to `https://rum-.app.tracix.io` with a public RUM app key from **Applications › Real User Monitoring › Setup** in the `x-tracix-app-key` header. Browser app keys only work from the web origins the app allows. Mobile apps send the same header. ### People, scripts and CI People sign in at `cloud.tracix.io` and open the workspace at its address. Scripts and CI pipelines call the workspace address with an API key; see [Authenticate with API keys](https://tracix.io/docs/api/authentication). ## Ports a collector listens on These listeners run on your collector, inside your network, when its policy includes the integration. Point devices at the collector's address. | Listener | Default port | Transport | Notes | | ----------------------------- | ---------------------------- | ---------- | ------------------------------------------------ | | Syslog (RFC 5424 or RFC 3164) | 514 | UDP or TCP | Set the transport and address in the integration | | NetFlow v5 and v9, IPFIX | 2055 | UDP | | | sFlow | 6343 | UDP | | | SNMP traps and informs | 162 | UDP | Part of the SNMP integration, on by default | | OTLP from local applications | 4317 for gRPC, 4318 for HTTP | TCP | With the OTLP integration | | Health check | 13133 | TCP | Host installs bind it to `127.0.0.1` only | Ports below 1024, such as 514 and 162, need permission to open, and Tracix gives a collector a listener below 1024 only when it can open it. The Kubernetes chart's default profile, for example, can't: set the integration to a port of 1024 or above, such as 1162 for traps, and point devices at it. [Ports below 1024](https://tracix.io/docs/collect/collector/ports-and-proxies#ports-below-1024) covers each platform, and the [SNMP](https://tracix.io/docs/collect/network-data/snmp), [flows](https://tracix.io/docs/collect/network-data/flows) and [syslog](https://tracix.io/docs/collect/network-data/syslog) guides cover each listener. On Windows, the installer adds a firewall rule that lets devices reach the collector's listeners. On other hosts, open the ports in the host firewall and in any cloud security group. ## Ports a collector connects to on your network | Target | Port | Transport | When | | ------------------------ | ---- | --------- | ---------------------------------------------------------- | | Devices polled over SNMP | 161 | UDP | With SNMP monitoring; the integration can set another port | ## Restrict source networks > **The allowlist covers every workspace hostname** > > In the Tracix Cloud console, a workspace's **Access** tab has a source IP allowlist. Empty, it lets connections in from any network. Once you add networks, every hostname of that workspace on this page, from the app to OTLP and RUM, accepts connections only from them, and authentication still applies. Add every network your people, collectors and applications connect from, and keep in mind that RUM data comes from your users' browsers. ## Test a connection Tracix endpoints don't answer ping. Test TCP 443 instead: ```bash curl -sv https://agents-.app.tracix.io ``` ```powershell Test-NetConnection agents-.app.tracix.io -Port 443 ``` ## Next steps - [Ports, proxies and firewalls](https://tracix.io/docs/collect/collector/ports-and-proxies): Run collectors behind a proxy or firewall - [OTLP endpoint and ingest keys](https://tracix.io/docs/collect/instrument/otlp): Point SDKs at your workspace - [Authenticate with API keys](https://tracix.io/docs/api/authentication): Credentials for scripts and CI