i2i Trace
Log management for CGNAT and syslog records, to support traceability and compliance
At a glance
- NAT and syslog records kept under a compliance profile
- Lookup by public IP, port and time
- Evidence exported as CSV, Parquet or NDJSON
- Tamper-evident audit of every search
Overview
i2i Trace is a log management platform for ISPs and carriers, built for IP logs. It captures NAT flow records and router syslog, stores them for the retention period your regulator sets and lets an authorised operator search and export them. The core question it answers is which public IP address and port was in use at a given time, to support traceability and compliance.
Records are preserved and served in their raw form, and your own subscriber or RADIUS data links an address to a subscriber. Retention, residency and audit behaviour come from a compliance profile that you can version and activate per tenant, rather than from code changes.
What is IPDR and IP log management?
IPDR stands for IP detail record. It is a record of what an IP address did on a network: which addresses and ports talked, when and for how long. Regulators in many countries require telecom operators and ISPs to keep such records for a fixed period and to produce them on a lawful request from an authority.
Carrier-grade NAT makes this harder. Many subscribers share one public IPv4 address, so a public address and port alone identify nobody. The operator must record each translation, with its time stamp, and later join it to the subscriber who held the private address. Routers export these translations as NetFlow or IPFIX records, or as syslog lines that differ by vendor.
An IP log management system collects those feeds, normalises them into one structure, stores them for a long time and makes them searchable. It must also prove that records were not altered or deleted early, and show who searched for what. Retention floors and ceilings, legal holds and audit trails are therefore part of the job, not extras.
Capabilities
What i2i Trace does
Collection
- NetFlow and IPFIX collector with NAT44 decoding
- Syslog capture from CGNAT and router sources
- HTTP push ingest for NAT records
- Raw syslog kept as a second evidence class
Syslog decoders
- MikroTik and VyOS syslog
- Cisco ASR CGN syslog
- Conntrack-based virtual BNG logs
- iPACT CGN logs
Feed assurance
- Ingest Sentinel validates each record and quarantines failures
- Feed Reconciler detects silent or dropped sources
- Capture listeners page shows source status
- Disk forecasts warn before storage fills
Retention and compliance
- Compliance profiles for India, EU baseline and US
- Retention floors, ceilings and legal holds
- Purge that leaves a verifiable record
- Residency placement with cross-border deny
Search and export
- Lookup by public IP, port and time
- NAT and syslog record browsers with filters
- Export as CSV, Parquet or NDJSON
- Trend and top-talker dashboards
Audit and access
- Tamper-evident audit chain with a verify command
- Customer-defined roles and permissions
- Multi-tenant model and API keys
- Warrant records and maker-checker authorisation in the India profile
Use cases
Where i2i Trace is used
Answering an authority request
An authority asks who held a public address and port at a stated time. The compliance officer enters the address, port and time in the Lookup page and gets the matching NAT record. The operator then matches the private address against its own subscriber data and exports the evidence.
Keeping CGNAT logs for the retention period
An ISP runs carrier-grade NAT on more than one vendor platform. Trace takes NetFlow, IPFIX and syslog from each into one store, applies the active compliance profile and holds records until the floor has passed, with legal holds to stop deletion.
Finding a silent log source
A router stops exporting flows after a change window and nobody notices. The Feed Reconciler flags the quiet source and the console lists it as a finding to acknowledge, so the gap is found while the records can still be recovered from the device.
Proving who searched
A regulator audit asks who looked up subscriber activity and why. The audit chain records each access. The operator runs the verify command to show the chain is intact, and exports the audit log with its manifest.
FAQ
i2i Trace: frequently asked questions
How does it link a record to a subscriber?
Lookups return the preserved records for a public IP, port and time. Linking a record to a subscriber uses your billing or RADIUS data, or the subscriber identifier where the source record carries one. Ask i2iCore how this fits your setup.
Which log sources can it collect?
NetFlow and IPFIX from routers and CGNAT devices, with NAT44 decoding, plus syslog. Decoders ship for MikroTik, VyOS, Cisco ASR CGN, conntrack-based gateways and iPACT CGN. Ask i2iCore about other formats and collection methods.
How do I get records out for a request?
An authorised operator searches and exports records in CSV, Parquet or NDJSON, filtered by public IP, port and time range. Ask i2iCore about reporting for your regulator and how exports fit your request process.
Which countries do the compliance profiles cover?
Profiles ship for India, an EU baseline and a generic US setting, plus a minimal profile for testing. Each one sets retention, residency and audit behaviour. Ask i2iCore about a profile for your jurisdiction.
How does it support lawful requests?
Trace supports record lookup, export, warrant records and maker-checker authorisation, so each request is recorded and approved. Ask i2iCore about the handover formats your authority requires and how they fit your process.
How is it deployed and scaled?
It installs natively under systemd on Debian from a provisioning script, with no container runtime. You scale by adding shards and ingest consumers, and backup timers are included. Ask i2iCore about a resilience design for your site.
Is this a move from earlier i2i log products?
The current platform is built on Kafka and ClickHouse. Ask i2iCore how it relates to any earlier log collection you run, and what to confirm about your deployment before you plan a move.