One row per enrolled device — USER is the per-device VPN login (tt_login), or rkn/sosat for grace-period devices still on the shared creds — plus any live TT connection that matches no enrolled device (shown italic as unknown). VER is the client app version (version+build) reported on the device's last heartbeat — all platforms. Row text color shows the connection state: green-tinted = connected right now (IP is the live connection address), grey = offline (IP is the last one seen). IP / country / ISP come from each device's last heartbeat IP (GeoIP via ip-api.com, free tier), overlaid with the live address while online. ↑/↓ are best-effort all-time bytes attributed from the 30s ss poll by matching the device's public IP while online — they undercount (offline / NAT / IP-change traffic isn't counted) and never reconcile with TT's own counters, so treat as approximate; for unattributed rows they are the live cumulative bytes since the socket opened. Last traffic = last time non-zero bytes were attributed (not last heartbeat). A +N mark on TYPE/VER/DEVICE/IP means the credential was seen with N additional distinct values in the last 7 days (token reused across installs, or a roaming IP) — hover or tap the mark for the full list with last-seen times; ↑/↓ and Last traffic stay summed per credential. Revoked devices are hidden from the list (the count in the summary still includes them; their history stays in the DB).