{"slug":"tailscale-client-metrics","title":"Tailscale client metrics","tags":["tailscale"],"agent_summary":"Last validated: Jan 28, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale client metrics\r\n\r\nLast validated: Jan 28, 2026\r\n\r\nYou can expose and collect Tailscale client metrics for use with monitoring systems such as [Prometheus](https://prometheus.io/) or [Grafana](https://tailscale.com/docs/integrations/grafana) for your Tailscale network (known as a tailnet). These metrics provide insights into client behavior, health, and performance. For example, you can monitor information about client connectivity to [subnet routers](https://tailscale.com/docs/features/subnet-routers) configured in your tailnet.\r\n\r\nTailscale client metrics are supported in Tailscale v1.78.0 and later.\r\n\r\n## [Available metrics](https://tailscale.com/docs/reference/tailscale-client-metrics\\#available-metrics)\r\n\r\nYou can collect the following metrics from the Tailscale clients in your tailnet:\r\n\r\n### [Subnet router](https://tailscale.com/docs/reference/tailscale-client-metrics\\#subnet-router)\r\n\r\nUse the metrics in this section to collect Tailscale client information related to subnet routes.\r\n\r\n`tailscaled_advertised_routes`\r\n\r\n- The metric type is `gauge`.\r\n- Displays the number of routes advertised by the client.\r\n- Includes routes that are not approved.\r\n- Does not include exit nodes.\r\n\r\n`tailscaled_approved_routes`\r\n\r\n- The metric type is `gauge`.\r\n- Displays number of advertised routes that have been [approved](https://tailscale.com/docs/features/subnet-routers#enable-subnet-routes-from-the-admin-console) by an administrator.\r\n\r\n### [Peer relay servers](https://tailscale.com/docs/reference/tailscale-client-metrics\\#peer-relay-servers)\r\n\r\nUse the metrics in this section to collect information about the local [peer relay](https://tailscale.com/docs/features/peer-relay) instance.\r\n\r\n`tailscaled_peer_relay_forwarded_packets_total`\r\n\r\n- The metric type is `counter`.\r\n- Displays the number of packets forwarded by the local peer relay instance.\r\n- Labels:\r\n  - `transport_in`: The transport protocol used for incoming packets. Possible values are `udp4` for UDP over IPv4 and `udp6` for UDP over IPv6.\r\n  - `transport_out`: The transport protocol used for outgoing packets. Possible values are `udp4` for UDP over IPv4 and `udp6` for UDP over IPv6.\r\n\r\n`tailscaled_peer_relay_forwarded_bytes_total`\r\n\r\n- The metric type is `counter`.\r\n- Displays number of bytes forwarded by the local peer relay instance.\r\n- Labels:\r\n  - `transport_in`: The transport protocol used for incoming packets. Possible values are `udp4` for UDP over IPv4 and `udp6` for UDP over IPv6.\r\n  - `transport_out`: The transport protocol used for outgoing packets. Possible values are `udp4` for UDP over IPv4 and `udp6` for UDP over IPv6.\r\n\r\n`tailscaled_peer_relay_endpoints`\r\n\r\n- The metric type is `gauge`.\r\n- Displays number of endpoints (tunnels) currently served by the local peer relay instance.\r\n- Labels:\r\n  - `state`: The endpoint state. Possible values are `connecting` when one or both peers are negotiating a connection, and `open` for endpoints able to forward traffic.\r\n\r\n### [Health](https://tailscale.com/docs/reference/tailscale-client-metrics\\#health)\r\n\r\nUse the metrics in this section to collect Tailscale client information related to health.\r\n\r\n`tailscaled_health_messages`\r\n\r\n- The metric type is `gauge`.\r\n- Displays the number of health messages currently reported by the Tailscale client.\r\n- This metric has a `type` label, reporting health message type. For example, `warning`.\r\n\r\nYou can collect details about the health messages by running [`tailscale status`](https://tailscale.com/docs/reference/tailscale-cli#status).\r\n\r\n### [DERP](https://tailscale.com/docs/reference/tailscale-client-metrics\\#derp)\r\n\r\nUse the metrics in this section to collect Tailscale client information related to [DERP relay servers](https://tailscale.com/docs/reference/derp-servers).\r\n\r\n`tailscaled_home_derp_region_id`\r\n\r\n- The metric type is `gauge`.\r\n- Displays the [DERP region](https://tailscale.com/docs/reference/derp-servers) ID of this node's home relay server.\r\n\r\n### [Throughput](https://tailscale.com/docs/reference/tailscale-client-metrics\\#throughput)\r\n\r\nUse the metrics in this section to collect Tailscale client information related to throughput.\r\n\r\n`tailscaled_inbound_packets_total`\r\n\r\n- The metric type is `counter`.\r\n- Displays the number of packets received by the node from other peers.\r\n\r\n`tailscaled_inbound_bytes_total`\r\n\r\n- The metric type is `counter`.\r\n- Displays the number of bytes received by the node from other peers.\r\n\r\n`tailscaled_outbound_packets_total`\r\n\r\n- The metric type is `counter`.\r\n- Displays the number of packets sent by the device to other peers.\r\n\r\n`tailscaled_outbound_bytes_total`\r\n\r\n- The metric type is `counter`.\r\n- Displays the number of bytes sent by the node to other peers.\r\n\r\nAll throughput metrics contain a `path` label, indicating [the type of connection](https://tailscale.com/docs/reference/connection-types) that\r\na packet took. The `path` label can contain one of the following values:\r\n\r\n- `direct_ipv4`: Packets sent or received directly over IPv4.\r\n- `direct_ipv6`: Packets sent or received directly over IPv6.\r\n- `derp`: Packets sent or received through a [DERP relay](https://tailscale.com/docs/reference/derp-servers).\r\n- `peer_relay_ipv4`: Packets sent or received through a [Tailscale Peer Relay](https://tailscale.com/docs/features/peer-relay) over IPv4.\r\n- `peer_relay_ipv6`: Packets sent or received through a [Tailscale Peer Relay](https://tailscale.com/docs/features/peer-relay) over IPv6.\r\n\r\n### [Dropped packets](https://tailscale.com/docs/reference/tailscale-client-metrics\\#dropped-packets)\r\n\r\nUse the metrics in this section to collect Tailscale client information related to dropped packets.\r\n\r\n`tailscaled_inbound_dropped_packets_total`\r\n\r\n- The metric type is `counter`.\r\n- Displays the number of packets dropped after being received from other peers.\r\n\r\n`tailscaled_outbound_dropped_packets_total`\r\n\r\n- The metric type is `counter`.\r\n- Displays the number of packets dropped while being sent to other peers.\r\n\r\nBoth the `tailscaled_inbound_dropped_packets_total` and `tailscaled_outbound_dropped_packets_total` metrics contain a `reason` label with one of the following values:\r\n\r\n- `acl`: The reported packets dropped by [Tailscale access control](https://tailscale.com/docs/features/access-control).\r\n- `multicast`: The reported packets dropped because they were multicast.\r\n- `link_local_unicast`: The reported packets dropped because they were link-local unicast.\r\n- `too_short`: The reported packets dropped because they were too short.\r\n- `fragment`: The reported packets dropped because they were IP fragments.\r\n- `unknown_protocol`: The reported packets dropped because they had an unknown protocol.\r\n- `error`: The reported packets dropped because of an error.\r\n\r\n## [Collect metrics](https://tailscale.com/docs/reference/tailscale-client-metrics\\#collect-metrics)\r\n\r\nYou can collect Tailscale metrics either from the Tailscale [web interface](https://tailscale.com/docs/features/client/device-web-interface) or the [Tailscale CLI](https://tailscale.com/docs/reference/tailscale-cli#metrics).\r\n\r\n### [Web interface](https://tailscale.com/docs/reference/tailscale-client-metrics\\#web-interface)\r\n\r\nThe Tailscale [web interface](https://tailscale.com/docs/features/client/device-web-interface) exposes client metrics on the conventional `/metrics` path.\r\n\r\n#### [Access metrics locally](https://tailscale.com/docs/reference/tailscale-client-metrics\\#access-metrics-locally)\r\n\r\nEach client exposes metrics locally through the [`http://100.100.100.100/metrics`](https://tailscale.com/docs/reference/quad100) URL. You can use this URL when the monitoring server (or agent) is running on the same host as the Tailscale client.\r\n\r\n#### [Collect metrics over Tailscale](https://tailscale.com/docs/reference/tailscale-client-metrics\\#collect-metrics-over-tailscale)\r\n\r\nTo collect metrics over your tailnet, you must:\r\n\r\n- Enable the Tailscale [web interface](https://tailscale.com/docs/features/client/device-web-interface) on each device that you plan to expose metrics by running using the [`tailscale set --webclient`](https://tailscale.com/docs/reference/tailscale-cli#set) command.\r\n- Grant your monitoring server access to port `5252` of each device in your [tailnet policy file](https://tailscale.com/docs/features/tailnet-policy-file).\r\n\r\nWe recommend using this method when your monitoring server is running on another device in your tailnet.\r\n\r\n#### [Expose metrics to other networks](https://tailscale.com/docs/reference/tailscale-client-metrics\\#expose-metrics-to-other-networks)\r\n\r\nYou can make the web interface available through another network interface on your machine by running the [`tailscale web`](https://tailscale.com/docs/reference/tailscale-cli#web) command. For example, if you have a local interface with an IP address `203.0.113.5`, running `tailscale web --readonly --listen 203.0.113.5:8080` makes metrics accessible at `http://203.0.113.5:8080/metrics`.\r\n\r\nThe `tailscale web --readonly` command starts a separate server that listens only on the provided IP address and port number. It does not expose metrics over a Tailscale IP address.\r\n\r\n### [Command line](https://tailscale.com/docs/reference/tailscale-client-metrics\\#command-line)\r\n\r\nTo use metrics in a script or to inspect them in the [Tailscale CLI](https://tailscale.com/docs/reference/tailscale-cli) command:\r\n\r\n```shell\r\ntailscale metrics print\r\n```\r\n\r\n#### [Write metrics to a file](https://tailscale.com/docs/reference/tailscale-client-metrics\\#write-metrics-to-a-file)\r\n\r\nYou can use the `tailscale metrics write` command to write metric values to a text file provided as its only argument. You can use this alongside [Prometheus node exporter](https://github.com/prometheus/node_exporter) to let the [textfile collector](https://github.com/prometheus/node_exporter#textfile-collector) consume and export Tailscale client metrics.\r\n\r\nFor example:\r\n\r\n```shell\r\ntailscale metrics write /var/lib/prometheus/node-exporter/tailscaled.prom\r\n```\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Tailscale client metrics</h1>\n<p>Last validated: Jan 28, 2026</p>\n<p>You can expose and collect Tailscale client metrics for use with monitoring systems such as <a href=\"https://prometheus.io/\">Prometheus</a> or <a href=\"https://tailscale.com/docs/integrations/grafana\">Grafana</a> for your Tailscale network (known as a tailnet). These metrics provide insights into client behavior, health, and performance. For example, you can monitor information about client connectivity to <a href=\"https://tailscale.com/docs/features/subnet-routers\">subnet routers</a> configured in your tailnet.</p>\n<p>Tailscale client metrics are supported in Tailscale v1.78.0 and later.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#available-metrics\">Available metrics</a></h2>\n<p>You can collect the following metrics from the Tailscale clients in your tailnet:</p>\n<h3><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#subnet-router\">Subnet router</a></h3>\n<p>Use the metrics in this section to collect Tailscale client information related to subnet routes.</p>\n<p><code>tailscaled_advertised_routes</code></p>\n<ul>\n<li>The metric type is <code>gauge</code>.</li>\n<li>Displays the number of routes advertised by the client.</li>\n<li>Includes routes that are not approved.</li>\n<li>Does not include exit nodes.</li>\n</ul>\n<p><code>tailscaled_approved_routes</code></p>\n<ul>\n<li>The metric type is <code>gauge</code>.</li>\n<li>Displays number of advertised routes that have been <a href=\"https://tailscale.com/docs/features/subnet-routers#enable-subnet-routes-from-the-admin-console\">approved</a> by an administrator.</li>\n</ul>\n<h3><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#peer-relay-servers\">Peer relay servers</a></h3>\n<p>Use the metrics in this section to collect information about the local <a href=\"https://tailscale.com/docs/features/peer-relay\">peer relay</a> instance.</p>\n<p><code>tailscaled_peer_relay_forwarded_packets_total</code></p>\n<ul>\n<li>The metric type is <code>counter</code>.</li>\n<li>Displays the number of packets forwarded by the local peer relay instance.</li>\n<li>Labels:\n<ul>\n<li><code>transport_in</code>: The transport protocol used for incoming packets. Possible values are <code>udp4</code> for UDP over IPv4 and <code>udp6</code> for UDP over IPv6.</li>\n<li><code>transport_out</code>: The transport protocol used for outgoing packets. Possible values are <code>udp4</code> for UDP over IPv4 and <code>udp6</code> for UDP over IPv6.</li>\n</ul>\n</li>\n</ul>\n<p><code>tailscaled_peer_relay_forwarded_bytes_total</code></p>\n<ul>\n<li>The metric type is <code>counter</code>.</li>\n<li>Displays number of bytes forwarded by the local peer relay instance.</li>\n<li>Labels:\n<ul>\n<li><code>transport_in</code>: The transport protocol used for incoming packets. Possible values are <code>udp4</code> for UDP over IPv4 and <code>udp6</code> for UDP over IPv6.</li>\n<li><code>transport_out</code>: The transport protocol used for outgoing packets. Possible values are <code>udp4</code> for UDP over IPv4 and <code>udp6</code> for UDP over IPv6.</li>\n</ul>\n</li>\n</ul>\n<p><code>tailscaled_peer_relay_endpoints</code></p>\n<ul>\n<li>The metric type is <code>gauge</code>.</li>\n<li>Displays number of endpoints (tunnels) currently served by the local peer relay instance.</li>\n<li>Labels:\n<ul>\n<li><code>state</code>: The endpoint state. Possible values are <code>connecting</code> when one or both peers are negotiating a connection, and <code>open</code> for endpoints able to forward traffic.</li>\n</ul>\n</li>\n</ul>\n<h3><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#health\">Health</a></h3>\n<p>Use the metrics in this section to collect Tailscale client information related to health.</p>\n<p><code>tailscaled_health_messages</code></p>\n<ul>\n<li>The metric type is <code>gauge</code>.</li>\n<li>Displays the number of health messages currently reported by the Tailscale client.</li>\n<li>This metric has a <code>type</code> label, reporting health message type. For example, <code>warning</code>.</li>\n</ul>\n<p>You can collect details about the health messages by running <a href=\"https://tailscale.com/docs/reference/tailscale-cli#status\"><code>tailscale status</code></a>.</p>\n<h3><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#derp\">DERP</a></h3>\n<p>Use the metrics in this section to collect Tailscale client information related to <a href=\"https://tailscale.com/docs/reference/derp-servers\">DERP relay servers</a>.</p>\n<p><code>tailscaled_home_derp_region_id</code></p>\n<ul>\n<li>The metric type is <code>gauge</code>.</li>\n<li>Displays the <a href=\"https://tailscale.com/docs/reference/derp-servers\">DERP region</a> ID of this node's home relay server.</li>\n</ul>\n<h3><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#throughput\">Throughput</a></h3>\n<p>Use the metrics in this section to collect Tailscale client information related to throughput.</p>\n<p><code>tailscaled_inbound_packets_total</code></p>\n<ul>\n<li>The metric type is <code>counter</code>.</li>\n<li>Displays the number of packets received by the node from other peers.</li>\n</ul>\n<p><code>tailscaled_inbound_bytes_total</code></p>\n<ul>\n<li>The metric type is <code>counter</code>.</li>\n<li>Displays the number of bytes received by the node from other peers.</li>\n</ul>\n<p><code>tailscaled_outbound_packets_total</code></p>\n<ul>\n<li>The metric type is <code>counter</code>.</li>\n<li>Displays the number of packets sent by the device to other peers.</li>\n</ul>\n<p><code>tailscaled_outbound_bytes_total</code></p>\n<ul>\n<li>The metric type is <code>counter</code>.</li>\n<li>Displays the number of bytes sent by the node to other peers.</li>\n</ul>\n<p>All throughput metrics contain a <code>path</code> label, indicating <a href=\"https://tailscale.com/docs/reference/connection-types\">the type of connection</a> that\r\na packet took. The <code>path</code> label can contain one of the following values:</p>\n<ul>\n<li><code>direct_ipv4</code>: Packets sent or received directly over IPv4.</li>\n<li><code>direct_ipv6</code>: Packets sent or received directly over IPv6.</li>\n<li><code>derp</code>: Packets sent or received through a <a href=\"https://tailscale.com/docs/reference/derp-servers\">DERP relay</a>.</li>\n<li><code>peer_relay_ipv4</code>: Packets sent or received through a <a href=\"https://tailscale.com/docs/features/peer-relay\">Tailscale Peer Relay</a> over IPv4.</li>\n<li><code>peer_relay_ipv6</code>: Packets sent or received through a <a href=\"https://tailscale.com/docs/features/peer-relay\">Tailscale Peer Relay</a> over IPv6.</li>\n</ul>\n<h3><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#dropped-packets\">Dropped packets</a></h3>\n<p>Use the metrics in this section to collect Tailscale client information related to dropped packets.</p>\n<p><code>tailscaled_inbound_dropped_packets_total</code></p>\n<ul>\n<li>The metric type is <code>counter</code>.</li>\n<li>Displays the number of packets dropped after being received from other peers.</li>\n</ul>\n<p><code>tailscaled_outbound_dropped_packets_total</code></p>\n<ul>\n<li>The metric type is <code>counter</code>.</li>\n<li>Displays the number of packets dropped while being sent to other peers.</li>\n</ul>\n<p>Both the <code>tailscaled_inbound_dropped_packets_total</code> and <code>tailscaled_outbound_dropped_packets_total</code> metrics contain a <code>reason</code> label with one of the following values:</p>\n<ul>\n<li><code>acl</code>: The reported packets dropped by <a href=\"https://tailscale.com/docs/features/access-control\">Tailscale access control</a>.</li>\n<li><code>multicast</code>: The reported packets dropped because they were multicast.</li>\n<li><code>link_local_unicast</code>: The reported packets dropped because they were link-local unicast.</li>\n<li><code>too_short</code>: The reported packets dropped because they were too short.</li>\n<li><code>fragment</code>: The reported packets dropped because they were IP fragments.</li>\n<li><code>unknown_protocol</code>: The reported packets dropped because they had an unknown protocol.</li>\n<li><code>error</code>: The reported packets dropped because of an error.</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#collect-metrics\">Collect metrics</a></h2>\n<p>You can collect Tailscale metrics either from the Tailscale <a href=\"https://tailscale.com/docs/features/client/device-web-interface\">web interface</a> or the <a href=\"https://tailscale.com/docs/reference/tailscale-cli#metrics\">Tailscale CLI</a>.</p>\n<h3><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#web-interface\">Web interface</a></h3>\n<p>The Tailscale <a href=\"https://tailscale.com/docs/features/client/device-web-interface\">web interface</a> exposes client metrics on the conventional <code>/metrics</code> path.</p>\n<h4><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#access-metrics-locally\">Access metrics locally</a></h4>\n<p>Each client exposes metrics locally through the <a href=\"https://tailscale.com/docs/reference/quad100\"><code>http://100.100.100.100/metrics</code></a> URL. You can use this URL when the monitoring server (or agent) is running on the same host as the Tailscale client.</p>\n<h4><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#collect-metrics-over-tailscale\">Collect metrics over Tailscale</a></h4>\n<p>To collect metrics over your tailnet, you must:</p>\n<ul>\n<li>Enable the Tailscale <a href=\"https://tailscale.com/docs/features/client/device-web-interface\">web interface</a> on each device that you plan to expose metrics by running using the <a href=\"https://tailscale.com/docs/reference/tailscale-cli#set\"><code>tailscale set --webclient</code></a> command.</li>\n<li>Grant your monitoring server access to port <code>5252</code> of each device in your <a href=\"https://tailscale.com/docs/features/tailnet-policy-file\">tailnet policy file</a>.</li>\n</ul>\n<p>We recommend using this method when your monitoring server is running on another device in your tailnet.</p>\n<h4><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#expose-metrics-to-other-networks\">Expose metrics to other networks</a></h4>\n<p>You can make the web interface available through another network interface on your machine by running the <a href=\"https://tailscale.com/docs/reference/tailscale-cli#web\"><code>tailscale web</code></a> command. For example, if you have a local interface with an IP address <code>203.0.113.5</code>, running <code>tailscale web --readonly --listen 203.0.113.5:8080</code> makes metrics accessible at <code>http://203.0.113.5:8080/metrics</code>.</p>\n<p>The <code>tailscale web --readonly</code> command starts a separate server that listens only on the provided IP address and port number. It does not expose metrics over a Tailscale IP address.</p>\n<h3><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#command-line\">Command line</a></h3>\n<p>To use metrics in a script or to inspect them in the <a href=\"https://tailscale.com/docs/reference/tailscale-cli\">Tailscale CLI</a> command:</p>\n<pre><code class=\"language-shell\">tailscale metrics print\n</code></pre>\n<h4><a href=\"https://tailscale.com/docs/reference/tailscale-client-metrics#write-metrics-to-a-file\">Write metrics to a file</a></h4>\n<p>You can use the <code>tailscale metrics write</code> command to write metric values to a text file provided as its only argument. You can use this alongside <a href=\"https://github.com/prometheus/node_exporter\">Prometheus node exporter</a> to let the <a href=\"https://github.com/prometheus/node_exporter#textfile-collector\">textfile collector</a> consume and export Tailscale client metrics.</p>\n<p>For example:</p>\n<pre><code class=\"language-shell\">tailscale metrics write /var/lib/prometheus/node-exporter/tailscaled.prom\n</code></pre>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}