SS7 logging strategies for security audits and troubleshooting

Signaling System No. 7 networks generate far more low-level traffic than most operators ever look at until something breaks. The events you decide to record before that moment decide whether root cause takes five minutes or two weeks, and whether your audit trail stands up in front of a regulator.

Australian carriers answer to ACMA and the Telecommunications (Interception and Access) Act, so SS7 logs need to be defensible in Sydney or Melbourne, not just useful to engineers in a Network Operations Centre. The Privacy Act adds another layer, since customer identifiers in logs are personal information from the moment they land on disk.

The temptation is to capture everything. Continuous full-rate PCAP from every link quickly arrives at a storage bill the procurement team will not enjoy. A deliberate strategy trims capture to what actually defends the network and the operator's compliance position.

This article covers the event classes worth recording, the formats that survive an audit, and how Australian operators balance retention against storage budget.

Core signaling events to capture

MTP3, SCCP, and TCAP traffic forms the substrate of every SS7 exchange. MTP3 link state changes, transfer prohibited messages, and congestion indications should land in the log from day one. SCCP subsystem status updates and Global Title translations tell an investigator how routing decisions were made, often the first question on the table during a fraud investigation.

TCAP transactions carry the actual application payloads and deserve careful handling. Dialogue aborts, U-ABORT primitives, and component reject errors frequently precede fraud or signalling misuse. Practitioners working with TCAP abort and reject handling will recognise that abort causes and invoke IDs have to be recorded with enough fidelity to reconstruct the dialogue later.

MAP and CAMEL application messages sit above TCAP and should be logged with their component sequence intact. SIM swap fraud and location-tracking probes reveal themselves in sendRoutingInformation and INSERT SUBSCRIBER DATA traffic, exactly as it crossed the wire.

Call-related signaling records

ISUP drives every voice call across the PSTN, and it remains relevant in Australia even as the NBN shifts much of the access layer to IP. Initial Address Messages, Answer Messages, Release messages, and the cause values attached to them form the audit trail for billing disputes and the lawful intercept obligations placed on every carrier.

Australian operators supporting inbound international routing, common in Sydney and Brisbane gateway switches, need to retain originating point codes and carrier identification codes. Without these, tracing an unsolicited international call back to its true origin becomes guesswork rather than investigation.

SIGTRAN and IP-layer capture

M3UA, SUA, M2PA, and SCTP traffic traverse IP backbones, often between capital-city data centres and regional STPs. SCTP association state changes, heartbeat failures, and stream resets all need timestamps aligned to AEST or AEDT, depending on the operator's canonical time zone.

IPsec on SIGTRAN links is now standard across Australian Tier 1 carriers. Captures taken upstream of the cryptographic boundary give plaintext, while captures downstream give forensic-grade association evidence but require keys for payloads. Strategically, the upstream capture is for engineers, the downstream capture is for the courtroom.

Engineers typically sample 1:100 or 1:1000 for baseline capture and switch to 1:1 once an incident is declared.

Security audit trail requirements

A genuine SS7 security audit asks different questions from routine troubleshooting. Which Global Titles sent which messages, when, and against which subscriber. Locating a probe or fraud attempt means scrolling through message logs for anomalies like SMS home-routed to a foreign Global Title, or a sendLocationRequest that asks for a subscriber who never left the country.

Tamper-resistant storage matters here. Logs written to append-only storage, hashed periodically and exported to an independent SIEM, satisfy the evidentiary expectations ACMA observers bring to a carrier visit. Retention periods in Australia typically run from two to seven years depending on the data class, with location data at the stricter end.

Log storage, rotation, and compliance

Practical storage architecture compresses older records aggressively and keeps recent records in fast retrieval tiers. Rotation policies often keep 30 days of full-fidelity capture on disk, 90 days compressed on object storage, and the rest in cold archive for the long compliance tail.

Time synchronisation matters more than many teams realise. Every logger should pull from a stratum-one NTP source or a GPS-disciplined clock; drift between probes is the silent killer of correlation and produces audit findings that are awkward to explain. The Privacy Act 1988 puts the customer at the centre of retention. Logs containing subscriber identifiers should be pseudonymised where business needs allow, with de-anonymisation keys restricted to a small, audited group.

Tooling and practical choices

Open source stacks around Wireshark, tshark, and custom Python parsers cover most engineering needs on a modest budget. Commercial probes from NetScout, Cisco, and Empirix add correlation, alerting, and long-term indexing that pays off at scale for operators the size of Telstra or Optus.

Building the deployment pipeline with code rather than by hand, using approaches like Grails Terraform pipelines, makes the difference between a logging estate that survives an audit and one that does not.

Choosing tooling also depends on integration. If your SIEM already ingests syslog, native integration matters more than raw capture fidelity. Audit success comes from logs that arrive in the analyst's view within seconds.

Recording approach	Storage cost	Audit defensibility	Troubleshooting speed
Full PCAP on every link	Very high	Excellent	Slow without indexing
Filtered PCAP with MTP3/SCCP/ISUP	Moderate	Good	Fast
Decoded CDR-style logs	Low	Moderate	Very fast
Sampled capture with alerting	Low	Moderate	Variable

Practical recommendations for Australian operators

• Capture MTP3 link state, SCCP subsystem status, and full TCAP dialogues as the minimum audit baseline.
• Retain at least 90 days of indexed SIGTRAN metadata and 30 days of full PCAP for live troubleshooting.
• Synchronise every logger to a single GPS-disciplined time source and document the accuracy in your audit pack.
• Write logs to append-only storage and hash them daily, exporting the hash to an independent SIEM.

The next concrete step is to map your current logging output against the recommendations above and identify the single largest gap. For most Australian operators that gap is append-only storage with cryptographic hashing, and closing it is usually a two-week project rather than a six-month programme.