IconWave — We Deliver Your Dreams
IPDR • SECURITY • NETWORK INTELLIGENCE • COMPLIANCE

Complete Visibility. Smarter Security. Simplified Compliance.

IconTrace helps ISPs and telecom operators collect IPDR data, analyze network activity, detect threats, investigate incidents and stay audit-ready from one intelligent platform.

Book a personalized demoSee how it works
A network analyst pointing at an IconTrace wall display showing network visibility, security monitoring, subscriber tracing and compliance status panels.

  • Real-Time Intelligence

    Sub-second telemetry metrics

  • Multi-Source IPDR

    BNG, CGNAT, AAA & NetFlow

  • Audit-Ready Logs

    Lawful interception and LEA ready

  • 24×7 Active Monitoring

    Automated anomaly detection

HOW ICONTRACE WORKS

End-to-End Network Intelligence, Security & Compliance

From wireline packets to certified court-ready electronic evidence in 8 orchestrated stages.

  • Reliable data

    Collect IPDR & Logs

    High-frequency streaming ingest from routers, BNGs, and firewalls.

  • Better context

    Correlate & Enrich

    Align IP translation sessions with RADIUS, TACACS+, and DHCP leases.

  • Deep visibility

    Analyze & Classify

    Protocol identification, bandwidth quotas, and DPI traffic inspection.

  • Early detection

    Detect Threats

    Detect port scans, botnet command loops, and DDoS amplification.

  • Faster triage

    Investigate & Trace

    Instant timeline forensics linking public IP, time slot, and subscriber ID.

  • Rapid response

    Report & Alert

    Push alerts to NOC monitors, SIEM clusters, and law enforcement portals.

  • Audit ready

    Comply & Retain

    Statutory compression vault ensuring immutability for regulatory audits.

  • Continuous QoS

    Optimize & Improve

    Optimize peering capacity, cache routing, and network investments.

CORE CAPABILITIES

Intelligence across the network lifecycle

Modular, carrier-grade architectural blocks engineered to handle tens of gigabits of uninterrupted signaling.

  • Multi-Protocol Capture

  • Session Correlation

  • Subscriber Mapping

  • Threat Analytics

  • Policy Violation Detection

  • Audit Trails

  • Data Retention

  • APIs & Integrations

What do you want IconTrace to improve first?

Choose a challenge and see how IconTrace transforms the operational workflow.

Challenge solved

Trace an incident from IP to subscriber in fewer steps.

Turn disconnected data into a clear investigation journey.

  1. Step 1:

    IPDR Event

    Dest Port: 445Proto: TCP / RST

    Raw log captured

  2. Step 2:

    Session Correlation

    CGNAT translationPublic → Private IP

    Radius matched

  3. Step 3:

    Subscriber Mapping

    User: SUB-44091IMSI / MAC bound

    Identity confirmed

  4. Step 4:

    Evidence Timeline

    Events, sessions,firewall logs

    Full context

  5. Step 5:

    Investigation Result

    Actionable dossiercreated

    Complete Trace • 0.4s

Relevant network, subscriber and session context connected automatically.

See IconTrace in action

ONE PLATFORM. COMPLETE NETWORK INTELLIGENCE.

Everything your teams need for visibility, security and compliance.

Collect, analyze, investigate and act without switching between disconnected systems.

TIERED DATA ENGINE

Store what matters. Find it when you need it.

Petabyte-scale IPDR data requires balanced storage engineering. IconTrace dynamically tiers records across memory, low-latency NVMe arrays, and encrypted compressed vaults.

  • Hot, warm and cold storage

    Automated data lifecycle management migrating cold data seamlessly.

  • Compression & optimization

    Proprietary columnar compression delivers up to 10:1 space reductions.

  • Long-term regulatory retention

    Adhere to 1-year, 2-year, or indefinite telecommunication compliance laws.

  • Fast search & indexing

    Retrieve historical IPDR records across months in seconds, not hours.

  1. Incoming Network Telemetry

    Real-time NetFlow, IPFIX, RADIUS, CGNAT stream

    > 14.8M rec/s

  2. Hot Storage (In-Memory NVMe)

    Sub-second query response • 0 to 7 days

    Ultra-Fast Triage

  3. Warm Storage (Indexed Search Lake)

    High-density indexed columns • 8 to 90 days

    Indexed Analytics

  4. Cold Archive (Compressed Vault)

    Tamper-evident, WORM-compliant • 1 to 5 years

    Audit Vault

OPEN ECOSYSTEM

Built to work with your existing network

Zero vendor lock-in. Connect seamlessly across core, edge, access, and enterprise IT management stacks.

  • BNG / BRAS
  • CGNAT
  • RADIUS / TACACS+
  • DHCP Servers
  • Routers & Switches
  • NextGen Firewalls
  • OSS / BSS
  • SIEM / SOAR
  • REST / Kafka APIs
View integrations

DEFENSE & SURVEILLANCE

Identify suspicious behavior before it becomes a bigger problem.

Automated threat detection tailored for telecom scale with deep subscriber session traceability.

  • DDoS Detection

    Real-time alerts for volumetric UDP/ICMP floods and reflection attempts.

  • Port Scan Detection

    Isolate infected subscriber hosts probing external subnets.

  • Malware & Botnet Comm

    Identify C2 server connections and recursive DNS tunneling.

  • Policy Violations

    Detect unauthorized peer-to-peer tunnels or proxy abuse.

  • Behavioral Anomalies

    Algorithmic baseline spikes against normal regional usage profiles.

  • Suspicious IP / Domain Activity

    Cross-check live traffic against global threat intelligence feeds.

Incident Inspector #8912

High severity

Event signature

High-Frequency TCP SYN Scanning

SRC IP (public)
182.74.88.19:44102
Correlated sub ID
#CR-44019
BNG node
BNG-CENTRAL-02
Rate detected
12,400 pkt/sec

Recommended workflow action

  • Quarantine IP
  • Dispatch NOC Ticket

REGULATORY ASSURANCE

From network records to audit-ready evidence.

IconTrace supports regulatory compliance workflows with certified audit trails, automated retention policies, and cryptographically verified data integrity.

  1. Step 1:

    Capture

    Multi-interface feed

  2. Step 2:

    Retain

    WORM statutory storage

  3. Step 3:

    Trace

    Sub-second timeline

  4. Step 4:

    Audit

    Immutable change logs

  5. Step 5:

    Report

    LEA certified export

  • Lawful Interception Support

    Provides ETSI TS 102 232 and 3GPP compliant interfaces enabling telecom operators to fulfill lawful warrant handovers safely.

  • Tamper-Proof Audit Trails

    Every user query, export, and record view is tracked with cryptographic hashing to guarantee non-repudiation in court evidence.

  • GDPR / PDPA & Local Compliance

    Engineered with strict role-based access control (RBAC), subscriber privacy masking, and automated statutory data destruction.

DEPLOYMENT OPTIONS

Engineered for your infrastructure strategy

Deploy where your network data lives with zero compromise on throughput or security.

  • Public Cloud

    AWS, Azure, and Google Cloud turnkey deployment with automated autoscaling ingestion pools.

    Managed SaaS

  • Private Cloud

    OpenStack, VMware vSphere, or Kubernetes clusters within sovereign telecom cloud perimeters.

    Isolated VPC

  • On-Premise Bare-Metal

    Direct deployment on operator-owned rack hardware for maximum packet processing throughput.

    Air-Gapped Capable

  • HA + Geo-DR

    Active-active multi-datacenter clustering with sub-second failover and cross-site synchronization.

    99.999% SLA

Talk to our infrastructure architects

THE ICONTRACE ADVANTAGE

Why enterprise operators choose IconTrace

Built from the ground up for high-assurance telecom intelligence.

  • Complete Visibility

    Eliminates blind spots between access, core, and peering links with complete wire-speed collection.

  • Security Intelligence

    Translates cryptic network packets into immediate actionable subscriber threat remediation.

  • Faster Investigations

    Reduces multi-day manual investigation forensic cycles into instant sub-second lookups.

  • Regulatory Readiness

    Guarantees peace of mind during national telecom regulatory inspections and lawful audits.

READY TO SEE ICONTRACE IN YOUR NETWORK?

Bring visibility, security and compliance into one workflow.

Schedule a technical session with our telecom intelligence specialists to explore live IPDR capture, session correlation, and investigation pipelines.

What you will experience in the demo:

  • Personalized product walkthrough
  • Explore live IPDR investigation workflows
  • Review multi-vendor network integrations
  • Discuss local regulatory & lawful compliance
Book my personalized demo

FREQUENTLY ASKED QUESTIONS

Everything you need to know about IconTrace

Common queries from telecom network architects, CTOs, and compliance directors.

IconTrace utilizes distributed micro-probes and zero-copy DPDK/eBPF ingestion kernels capable of processing millions of flows per second directly off core BNG, CGNAT, and NetFlow exporters with minimal compute overhead.

Yes. By ingesting both CGNAT translation mapping tables and RADIUS accounting streams in real-time, IconTrace correlates external public port-allocated sessions to exact subscriber IMSIs, MACs, or user IDs within fractions of a second.

IconTrace is vendor-neutral. It unifies Cisco, Juniper, Huawei, Nokia, and MikroTik BNG interfaces and works with BNG/BRAS, CGNAT, RADIUS/TACACS+ and DHCP servers, routers, switches, and next-generation firewalls, ingesting NetFlow, IPFIX, RADIUS, and CGNAT streams. OSS/BSS, SIEM/SOAR, and REST/Kafka APIs connect it to the rest of your stack.

It complies with ETSI TS 102 232 and national security standards by offering role-restricted interfaces, cryptographically sealed export bundles, and tamper-evident audit logs that ensure chain-of-custody validity for legal proceedings.

With proprietary columnar compression (yielding up to 90% disk space reduction), operators can store 1 to 5+ years of complete IPDR records while maintaining automated lifecycle migration into cost-effective cold object storage.

Yes. IconTrace provides rich REST APIs, Kafka event buses, and Syslog forwarders that stream enriched anomaly events directly into Splunk, IBM QRadar, Microsoft Sentinel, and custom Grafana NOC dashboards.

We support 100% on-premise bare-metal deployments inside sovereign operator data centers, fully air-gapped installations, private cloud (OpenStack/Kubernetes), and managed hybrid configurations.