01 · PASSIVE
Zero impact on live traffic.
Read-only at the wire. Probes and mirror ports. No inline processing. The capture layer is invisible to the call path — operationally and operationally-safely.
0Inline footprint
Platforms · Signaling & CDR Intelligence
Vendor-agnostic signalling + CDR intelligence — court-ready, passive monitoring.
An end-to-end platform that captures signalling across SS7, SIGTRAN and SIP / VoIP, correlates it with CDRs, and turns the result into live dashboards, anomaly alerts, and evidence-ready packages with full chain of custody. Read-only, passive, and vendor-independent — zero impact on live traffic.
Passive · read-onlyRetention 30d → 7+ yearsChain-of-custody export
BroadNet · signaling CDR
Signaling intelligence
300M+
records / day
200+
countries
99.99%
SLA
Operators that run BroadNet as their signalling intelligence layer
Tier-1 GCC operatorMENA carrier groupPan-African operatorSouth Asian MNOCaribbean operatorRegional MVNOMulti-country operator groupLevant MNO
The operating shape
Passive. Vendor-agnostic. Built to last seven years.
The capture layer your vendor cannot give you because they see only their own switches. Read once, retained for seven, audit-ready every step.
Ingest
100K
CDRs / second
Peak ingestion supported on commodity hardware tiers.
Compression
10:1
typical ratio
Storage-efficient archive across long retention tiers.
Retention
7y+
configurable tiers
From 30 days hot to 7+ years cold for compliance.
Live latency
<5s
dashboard refresh
Time from capture to operator-visible dashboard tile.
Signaling evidence console
Every call, captured and court-ready.
Passive signaling analytics with a chain-of-custody trail — ASR, ACD and ASD at a glance, every CDR replayable, every export sealed. Below is an illustrative view built from sample data.
Example
Signaling analytics
last 24hASR
71.4%
answer-seizure ratio
ACD
3:12
avg call duration
ASD
2.8s
avg setup delay
NER
88.6%
network efficiency ratio
Call detail records
live capture · sample window| Time | Origin | Destination | Protocol | Duration | Status |
|---|---|---|---|---|---|
| 09:42:07 |  +9715••4821 |  +9198••2270 | SS7/ISUP | 04:12 | Answered |
| 09:42:05 |  +9665••1180 |  +2010••7745 | SIP | 02:48 | Answered |
| 09:42:03 |  +4479••5560 |  +2348••9013 | SS7/ISUP | — | No answer |
| 09:42:01 |  +9613••2204 | +9665••8890 | SIP | 00:54 | Busy |
| 09:41:58 |  +5511••3391 |  +9234••1120 | SS7/ISUP | 06:30 | Answered |
| 09:41:55 |  +2547••7788 | +4479••4412 | SIP | — | Failed |
Chain of custody
RecordCDR-A7F3-09420 7
SHA-256 seal
a3f9 8c21 … b71c
Sealed2026-08-28 09:42:07 UTC
RetentionVault · 7y+
IntegrityTamper-evident
Export for audit
CSV · signed manifest
Illustrative example — sample data, not an audited SLA or a live feed.
End-to-end pipeline
From passive capture
to court-ready package.
Five stages — capture, ingest, normalise, correlate, surface — each independently scalable and replaceable. Read-only at the wire, structured at the warehouse, signed at the export.
- 01 · CapturePassive capture
Probes, mirror ports, signalling-gateway interfaces, SBC and softswitch logs. Read-only — zero impact on live traffic.
0 impact - 02 · IngestCDR / EDR ingest
ASN.1, CSV, XML, vendor-proprietary. Switches, mediation, billing — anything that emits a record.
100K CDR/s - 03 · NormaliseCanonical model
Every record converted to a single canonical schema regardless of source. Enriched with country, operator, MCC / MNC.
p50 < 1ms - 04 · CorrelateSignaling ↔ CDR
Signalling messages tied to the CDR they belong to — the complete story of every transaction across switch and trunk.
live + batch - 05 · SurfaceDashboards · evidence
Live ASR / QoS dashboards, anomaly alerts, role-based reports, chain-of-custody export for legal and audit.
<5s refresh - ← chain-of-custody packages · regulator-ready
01 · Capture
Passive capture
Probes, mirror ports, signalling-gateway interfaces, SBC and softswitch logs. Read-only — zero impact on live traffic.
0 impact
02 · Ingest
CDR / EDR ingest
ASN.1, CSV, XML, vendor-proprietary. Switches, mediation, billing — anything that emits a record.
100K CDR/s
03 · Normalise
Canonical model
Every record converted to a single canonical schema regardless of source. Enriched with country, operator, MCC / MNC.
p50 < 1ms
04 · Correlate
Signaling ↔ CDR
Signalling messages tied to the CDR they belong to — the complete story of every transaction across switch and trunk.
live + batch
05 · Surface
Dashboards · evidence
Live ASR / QoS dashboards, anomaly alerts, role-based reports, chain-of-custody export for legal and audit.
<5s refresh
Why operators run an independent capture layer
The intelligence layer your switch vendor cannot give you.
Four reasons revenue, fraud, and legal teams put their own capture-and-correlation platform on the network — even where vendor reporting exists.
02 · VENDOR-AGNOSTIC
Every vendor in one canonical model.
Pre-built parsers for every major switch and mediation vendor. Custom parsers added during discovery. Every record converges into one canonical schema before correlation.
1Canonical model
03 · CORRELATED
Signalling and CDR in one timeline.
SIP ingress, SS7 routing, ISUP setup, M3UA transport, CDR landing — every transaction replayed end-to-end. ASR / QoS dips drill into the signalling event that caused them.
End-to-endReplay
04 · COURT-READY
Chain-of-custody as a built-in export.
Structured exports with documented integrity and expert-witness-grade technical explanations. Regulatory and legal requests addressed inside hours, not weeks.
SealedEvidence packs
Protocol coverage
SS7. SIGTRAN. SIP.
One capture layer.
Generations of telecom transport, captured passively and decoded in one place. Pre-built parsers for major switch vendors mean integration does not start at protocol primer.
SS7 stack
Classic signalling, fully decoded — MTP2 / MTP3 transport, ISUP for circuit-switched voice, SCCP for routing, TCAP for transactions, MAP for mobile services, CAP and INAP for intelligent network.
MTP2MTP3ISUPSCCPTCAPMAPCAPINAP
SIGTRAN over SCTP
All four SIGTRAN adaptations carried over SCTP: M2PA, M2UA, M3UA and SUA. Direct integration with modern core networks running SS7-over-IP transport.
M2PAM2UAM3UASUASCTP
SIP · VoIP
RFC 3261 compliant capture — all methods, all headers. SBC logs, softswitch interfaces, SIP-trunk monitoring. Full call-flow visibility ingress to egress.
RFC 3261INVITEREGISTERBYEOPTIONSall headers
ASR · QoS monitoring
Answer-Seizure Ratio,
at every level of the network.
ASR by route, trunk, time-of-day, destination. Baseline established per slice, deviation flagged proactively. Root-cause analysis correlates degradation with signalling-layer events — operators see why a route is failing, not just that it is.
- Multi-dimensional baselines — per route, trunk, destination, time of day, day of week.
- Real-time deviation alerts — proactive notification when KPIs drift outside the baseline envelope.
- Signalling-driven root cause — drill from a KPI dip into the signalling events that caused it.
- Capacity planning — historical trends fuel forward-looking projection of switch and trunk load.
Signaling ↔ CDR correlation · sample windowlive
- 00:00sipINVITE · SIP ingress
- 00:01ss7MAP_SRI_FOR_SM · MAP
- 00:02ss7ISUP IAM · trunk-A
- 00:03sigtranM3UA · routing miss
- 00:04sipBYE · session ended
- 00:05cdrCDR · correlated
Signalling and CDR layered in time so a single transaction can be replayed end-to-end — from SIP ingress through SS7 routing to the CDR that landed in billing.
Retention tiers
From operations to
regulatory vault.
Storage tiered by access pattern and retention requirement. Cold tiers run at 10:1 compression; vault tier ships with chain-of-custody seals for regulator and law-enforcement requests.
Hot
30d
Most recent traffic, query in seconds, optimised for live dashboards and ad-hoc forensics.
Warm
90d
Reconciliation and trend analysis, query in tens of seconds, full-resolution records.
Cold
2y
Archive for compliance and dispute review, compressed 10:1, query in minutes.
Vault
7y+
Long-term retention for regulatory and legal mandates, sealed with chain-of-custody.
Pre-built parsers
Integration does not start at protocol primer.
Parsers exist for the switch and mediation kit you already run, from every major network-equipment provider. Custom parsers for proprietary formats are scoped during the discovery phase.
Major NEP A
Major NEP B
Major NEP C
Major NEP D
Use cases
One platform.
Three teams that fight different fires.
Revenue Assurance
Multi-point reconciliation across switch → mediation → billing → partner. Leakage detection by route and trunk. Margin verification on retail vs wholesale.
Fraud & Security
Abnormal-pattern detection on signalling and CDR. Velocity checks, suspicious destination distributions, IRSF and bypass-fraud signatures.
Legal & Compliance
Court-ready evidence packages with chain-of-custody, structured CSV / XLSX exports, expert-witness-grade technical explanations. Regulator response in hours, not weeks.
Illustrative operator scenarios
What a court-ready
intelligence layer changes.
Tier-1 GCC operatorTelecom · Gulf
- Challenge
- A long-running interconnect dispute lacked attributable evidence; partner billing showed completed calls the operator's own systems did not record.
- Approach
- Passive SS7 / SIGTRAN capture replayed end-to-end transactions and signalling-to-CDR correlation matched each disputed call across switch, trunk, and mediation.
Revenue assurance lead
End-to-end
Transaction replay
Chain-of-custody
Evidence
MENA carrier groupTelecom · Levant
- Challenge
- ASR degradation on one international trunk was visible in the NOC dashboard but root cause was hard to attribute and operations was chasing the wrong layer.
- Approach
- Signalling-driven drill-down from the ASR dip surfaced an M3UA routing miss correlated with the failed calls; capacity planning identified a sustained trend.
NOC team lead
Signalling root
Attribution
Re-usable
Correlation template
Pan-African operatorTelecom · Sub-Saharan
- Challenge
- A regulator inquiry requested signalling and CDR evidence for a multi-week window covering several trunks, and the existing reporting tools could not assemble it.
- Approach
- The vault retention tier was queried for the time-range; signalling and CDR were correlated and packaged with chain-of-custody documentation.
Compliance officer
Multi-week
Evidence window
Vault-tier
Storage
Template-driven
Compliance pack
Audit-ready, regulator-recognised, deployable on-premise or in private cloud.
ISO27001ISO9001ISO22301GSMAMemberGDPRReadyTDRAUAECSTKSA
Companion platforms
Pair with the rest of the intelligence stack.
ESME CDR Intelligence
The SMS-focused companion. ESME CDR specialises in A2P / ESME reconciliation; Signaling CDR adds the signalling-layer capture and court-ready forensic packages.
Learn moreSignaling Firewall
Active protection layer for SS7 and Diameter. The Signaling & CDR Intelligence platform is its evidence and audit companion.
Learn morePerformance System
Real-time service monitoring. Signaling & CDR feeds the long-horizon KPIs that the Performance System surfaces for ops and management.
Learn moreQuestions buyers ask
Eight questions
NOC, RA, and legal ask.
Zero. The platform is read-only and passively monitored — traffic is captured through probes, mirror ports, signalling-gateway interfaces, SBC and softswitch logs. Nothing is inline. No processing in the call path. No modification of any message.
Pre-built parsers exist for every major network-equipment provider. Custom parsers for proprietary formats are scoped during the discovery phase and added to the canonical-model mapping. Whatever the source format, every record converges into a single canonical schema before correlation.
Full SS7 — MTP2, MTP3, ISUP, SCCP, TCAP, MAP, CAP, INAP. Full SIGTRAN over SCTP — M2PA, M2UA, M3UA, SUA. Full SIP / VoIP per RFC 3261 — all methods, all headers, SBC and softswitch capture. One platform, every generation of telecom signalling that touches the network.
Signalling messages and CDRs share keys — call-id, trunk-id, timestamps, party identifiers. The correlation engine matches them in real-time and on-replay, so a single transaction can be replayed end-to-end: SIP ingress through SS7 routing through CDR landing in billing. The result is a complete story per transaction, not isolated layer-by-layer views.
Structured data exports (CSV / XLSX) with all relevant fields, chain-of-custody documentation proving data integrity from capture to export, and an expert-witness-grade technical explanation suitable for legal proceedings. Packages are sealed with cryptographic checksums and tamper-evident logging.
Four tiers: hot (typically 30 days, query in seconds), warm (typically 90 days, full resolution for reconciliation), cold (typically two years, 10:1 compression, query in minutes), and vault (7+ years with chain-of-custody for regulatory and legal mandates). Tier durations are configured per operator policy and storage budget.
Switch-vendor reports show what the switch sees. The Signaling & CDR Intelligence System correlates across switches, trunks, mediation, billing and signalling-layer events from passive capture — it is the independent verification layer. It catches the discrepancies that single-vendor reports cannot, because no single vendor sees the whole network.
A typical engagement runs in three phases: discovery and source mapping, pilot deployment against a defined slice of traffic, then full rollout. Operator infrastructure complexity drives the timeline — most operators are in production-grade pilot inside a quarter and fully rolled out shortly after.
Question not here? Ask our engineering team
Carrier-grade platform
Infrastructure engineered since 2003.
The same platform that carries 300M+ messages a day, available as building blocks for your stack.
300M+
Msgs·day
99.99%
SLA
23+
Years
Passive monitoring · court-ready evidenceSee the network
See the network
you have, not the one your vendor reports.
Bring your NOC, RA and legal teams. We will scope the capture points, design the correlation layer, and walk a court-ready evidence package for a transaction of your choice.
Related guides & answers
Go deeper on the concepts behind this product.