Compliance & Logging
Carrier-grade NetFlow/IPFIX logging with every session attributed to a real subscriber, and lawful data-retention reports (BTRC and equivalent regulators) generated from the same records SentraNet bills from.
Ingest — live
liveWhat Compliance & Logging gives an ISP.
Retention obligations are unforgiving: the data has to be complete, attributable, verifiable, indexed and protected. This module is built around those constraints, on the same subscriber record as the rest of SentraNet.
Ingestion at carrier scale
The collector is built for ISP peak traffic on commodity hardware and absorbs bursts without dropping records, because a retention log with holes in it is not a retention log.
Compact columnar storage
Per-column compression keeps long retention periods on a sane amount of disk. Storage cost is what usually kills a retention project; this is the part that fixes it.
Subscriber attribution behind CGNAT
A public IP and a timestamp are not an answer when hundreds of subscribers share that address. The module correlates NAT translation records with SentraNet RADIUS sessions so a query returns the actual subscriber.
Indexed for instant queries
Indexed by time, address and subscriber, so a regulator request against a full retention window returns in seconds. Your compliance team gets an answer in the meeting, not the following week.
BTRC and lawful-retention reports
Retention reports are generated on demand from the same records SentraNet bills from. No separate export, no spreadsheet stitched together for the regulator.
Role-based access, fully audited
Who may query, over what date range, and for which subscribers — enforced by role. Every query is itself logged, so access to retained data is as accountable as the data is.
Built for the peak, not the average.
The module takes NetFlow and IPFIX exports directly from your routers and CGNAT platform. Records are parsed, correlated and committed in a streaming pipeline sized for your busiest hour, not your daily mean — because that is the hour a gap would appear.
- NetFlow v5/v9 and IPFIX ingestion from standard exporters
- Carrier-grade throughput on commodity server hardware
- Back-pressure handling so bursts queue rather than drop
Collector
liveFrom a public IP to an actual subscriber.
Under carrier-grade NAT, one public address may be shared by hundreds of subscribers at the same moment. Answering a lawful request means correlating the flow record with the NAT translation that was live at that exact second. The module does that correlation on ingest, so the answer already exists when the request arrives.
- NAT translation records correlated with flow records on ingest
- Subscriber identity resolved from SentraNet RADIUS sessions or a DHCP source
- Query by subscriber, by address, or by address and timestamp
Attribution query
Regulator-ready reports from records that can prove they weren't touched.
Every flow record is written once, checksummed at the moment of ingest, and indexed immediately by time, address and subscriber — so a record is verifiable on demand, not just recoverable. BTRC and other lawful data-retention reports are generated from those records, with the retention period set to the requirement you are held to.
- Write-once records, checksummed on ingest
- Immediate indexing by time, address and subscriber
- Columnar layout with per-column compression
- Retention period configured to your regulatory requirement
Retention
Access to retained data is itself a record.
Holding subscriber data creates an obligation to control who reads it. Roles determine who may query, which subscribers they may query, and how far back they may look — and every query is written to an audit log that the querying role cannot alter.
- Role-based query permissions with date-range limits
- Immutable audit trail of every query executed
- Deployed on your premises — retained data never leaves your network
Query audit
Deployed on your premises, in your control.
The module is normally installed on-premises alongside SentraNet, because the whole point is that retained subscriber data stays inside your network.
Scope
Peak flow rate, required retention period and applicable obligations determine the hardware. We size it against your busiest hour.
Install
Collector and storage nodes are installed on your hardware, with the second node configured for backup from day one.
Connect
Exporters are pointed at the collector and correlated with your CGNAT and SentraNet RADIUS sources so attribution works from the first record.
Verify
We run test queries against known sessions to prove attribution and record integrity end to end before the deployment is signed off.
The details engineers ask about.
No asterisks. If something depends on your hardware or your regulator, it says so.
- Ingestion protocols
- NetFlow v5, NetFlow v9 and IPFIX from standard router and CGNAT exporters.
- Throughput
- Carrier-grade ingestion; final figure depends on the hardware provided and is sized during scoping.
- Storage efficiency
- Columnar storage with per-column compression keeps long retention periods affordable.
- Attribution
- NAT translation correlation with subscriber identity resolved from SentraNet RADIUS sessions or DHCP sources.
- Verifiability
- Write-once records, checksummed on ingest, so tampering after the fact is detectable.
- Indexing
- Every record indexed immediately by time, address and subscriber at the moment of ingest.
- Retention
- Configurable to your regulatory requirement; capacity scales with attached storage.
- Reports
- BTRC and other lawful data-retention reports generated on demand from the retained records.
- Query
- Indexed by time, address and subscriber. Lawful-request queries against a full retention window typically return in seconds.
- High availability
- Two-node configuration with a synchronised replica for backup and failover.
- Access control
- Role-based query permissions with date-range scoping and an immutable audit log of all queries and exports.
- Deployment
- On-premises on your own hardware. The data does not leave your network at any point.
- Compliance note
- Compliance & Logging provides the retention, attribution, verifiability and access-control capability. Which obligations apply to you, and for how long, is a determination for you and your legal advisers — we build to the requirement you specify.
Run your ISP on one platform.
We will walk SentraNet through your own network — your plans, your NAS estate, your OLT vendors — so you can judge it on the operation you actually run.