One row per enrolled device — USER is the per-device VPN login (tt_login), or rkn/sosat for grace-period devices still on the shared creds — plus any live TT connection that matches no enrolled device (shown italic as unknown). VER is the client app version (version+build) reported on the device's last heartbeat — all platforms. The green dot = currently connected (heartbeat within 120s); ⚡ marks a row whose IP is the live connection address. IP / country / ISP come from each device's last heartbeat IP (GeoIP via ip-api.com, free tier), overlaid with the live address while online. ↑/↓ are best-effort all-time bytes attributed from the 30s ss poll by matching the device's public IP while online — they undercount (offline / NAT / IP-change traffic isn't counted) and never reconcile with TT's own counters, so treat as approximate; for unattributed rows they are the live cumulative bytes since the socket opened. Last traffic = last time non-zero bytes were attributed (not last heartbeat). ⚠N IPs flags a credential seen from several IPs lately (possible reuse across devices — the server can't separate copies). Revoked devices stay visible (greyed) for forensics.