Add telecom-aware privacy and transport profiles

Author: FrnkMrz

README.md

@@ -118,6 +118,7 @@ Common starting points:
 
 - `internal` for local-only work
 - `share` for internal sharing with subscriber pseudonymization
+- `telecom-context` for sharing that keeps IMSI MCC/MNC and MSISDN CC visible
 - `prod-safe` for stronger masking before external sharing
 - `llm-telecom-safe` for external LLM handoff
 
@@ -132,6 +133,17 @@ pcap2llm analyze trace.pcapng \
 
 Full privacy guidance: [`docs/PRIVACY_SHARING.md`](docs/PRIVACY_SHARING.md)
 
+`telecom-context` uses telecom-aware partial protection:
+
+- IMSI: `MCC+MNC` stays visible, MSIN is masked
+- MSISDN: E.164 country code stays visible, subscriber suffix is masked
+- German MSISDNs also keep the built-in mobile NDC when it matches `(0)15`,
+  `(0)160`, `(0)162`, `(0)163`, or `(0)17x`
+- IMEI: TAC stays visible, serial suffix is masked
+
+The default IMSI heuristic is intentionally simple: MCC `3xx` uses a 3-digit
+MNC, all other MCCs use a 2-digit MNC unless overridden in config.
+
 ## Important Limits
 
 By default `detail.json` contains the first **1,000 packets**. You can raise

docs/ANLEITUNG_DE.md

@@ -244,6 +244,7 @@ Typische Startpunkte:
 
 - `internal`: lokal, unveraendert
 - `share`: intern teilen, Endpunkte und Subscriber-Daten pseudonymisieren
+- `telecom-context`: MCC/MNC, CC, deutsche Mobilfunk-NDCs und IMEI-TAC sichtbar lassen, Rest maskieren
 - `prod-safe`: staerker schuetzen, bevor du nach aussen gehst
 - `llm-telecom-safe`: guter Standard fuer externe LLMs
 
@@ -267,6 +268,39 @@ Mehr dazu:
 - [`PRIVACY_SHARING.md`](PRIVACY_SHARING.md)
 - [`LLM_TROUBLESHOOTING_WORKFLOW.md`](LLM_TROUBLESHOOTING_WORKFLOW.md)
 
+### IMSI/MSISDN mit Routing-Kontext schuetzen
+
+Wenn der Empfaenger MCC/MNC oder den E.164-Country-Code fuer die Fehlersuche
+braucht, aber keine vollstaendigen Subscriber-Identifier sehen soll, nutze:
+
+```yaml
+privacy_profile: telecom-context
+```
+
+Oder gezielt pro Lauf:
+
+```yaml
+privacy_modes:
+  imsi: keep_mcc_mnc_mask_msin
+  msisdn: keep_cc_ndc_mask_subscriber
+```
+
+Die IMSI-Heuristik ist bewusst einfach: MCC `3xx` verwendet eine 3-stellige
+MNC, alle anderen MCCs verwenden 2 Stellen. MSISDN ist konservativer: nur der
+Country Code bleibt sichtbar. Deutschland ist die eingebaute Ausnahme; passende
+Mobilfunk-NDCs fuer `(0)15`, `(0)160`, `(0)162`, `(0)163` und `(0)17x` bleiben
+sichtbar. Abweichungen und Partnerlisten kannst du in der Config setzen:
+
+```yaml
+numbering:
+  imsi_mnc_lengths:
+    "262": 2
+    "310": 3
+  msisdn_ndc_prefixes:
+    "31": ["20"]
+    "49": ["15", "160", "162", "163", "170", "171", "172", "173"]
+```
+
 ## Endpunkte lesbarer machen
 
 Du kannst rohe IPs durch bekannte Knoten- oder Rollennamen anreichern.

docs/DOCUMENTATION_MAP.md

@@ -92,6 +92,7 @@ Use it when you want to know:
 | [`PROFILES_5G.md`](PROFILES_5G.md) | 5GC users | 5G SA core profile family guide | [`PROFILES.md`](PROFILES.md), [`WORKFLOWS.md`](WORKFLOWS.md), [`QUICKSTART_5GC.md`](QUICKSTART_5GC.md) |
 | [`PROFILES_VOICE.md`](PROFILES_VOICE.md) | IMS voice users | VoLTE / VoNR profile family guide | [`PROFILES.md`](PROFILES.md), [`WORKFLOWS.md`](WORKFLOWS.md) |
 | [`PROFILES_2G3G.md`](PROFILES_2G3G.md) | legacy-core users | 2G/3G / GERAN profile family guide | [`PROFILES.md`](PROFILES.md), [`WORKFLOWS.md`](WORKFLOWS.md) |
+| [`TRANSPORT_DECODE_PROFILE_PLAN.md`](TRANSPORT_DECODE_PROFILE_PLAN.md) | contributors, transport troubleshooters | plan for TCP, UDP, and SCTP-focused decode profiles | [`PROFILES.md`](PROFILES.md), [`REFERENCE.md`](REFERENCE.md) |
 | [`QUICKSTART_LTE_EPC.md`](QUICKSTART_LTE_EPC.md) | LTE/EPC users | smallest LTE/EPC-oriented starting pattern | [`PROFILES_LTE.md`](PROFILES_LTE.md), [`WORKFLOWS.md`](WORKFLOWS.md), [`REFERENCE.md`](REFERENCE.md) |
 | [`QUICKSTART_5GC.md`](QUICKSTART_5GC.md) | 5GC users | smallest 5G core-oriented starting pattern | [`PROFILES_5G.md`](PROFILES_5G.md), [`WORKFLOWS.md`](WORKFLOWS.md), [`QUICKSTART_HTTP2_SBI.md`](QUICKSTART_HTTP2_SBI.md) |
 | [`QUICKSTART_HTTP2_SBI.md`](QUICKSTART_HTTP2_SBI.md) | SBI users | shortest HTTP/2/SBI-focused command pattern | [`PROFILES_5G.md`](PROFILES_5G.md), [`QUICKSTART_5GC.md`](QUICKSTART_5GC.md), [`PRIVACY_SHARING.md`](PRIVACY_SHARING.md) |
@@ -126,6 +127,7 @@ Across the full set, the documentation now covers:
 - optional signaling-flow visualization with `flow.json`, `flow.svg`, and `visualize`
 - protocol-family workflows for LTE, 5G, voice/IMS, and legacy SS7/GERAN
 - profile selection and custom profile authoring
+- transport decode profile planning for TCP, UDP, and SCTP
 - privacy profiles, sharing rules, and encryption model
 - machine-readable `--llm-mode` behavior
 - external LLM handoff workflow

docs/PRIVACY_SHARING.md

@@ -17,6 +17,7 @@ Related docs:
 | Scenario | Recommended profile | Notes |
 |---|---|---|
 | Internal team troubleshooting | `share` | Good default for most internal work; endpoint and subscriber identifiers are pseudonymized |
+| Telecom-aware cross-team sharing | `telecom-context` | Keeps MCC/MNC, CC, German mobile NDCs, and IMEI TAC visible while masking subscriber-specific suffixes |
 | Vendor ticket | `prod-safe` | Remove tokens, reduce sensitive metadata |
 | Lab replay / test environment | `lab` | Stronger anonymization, still useful context |
 | Personal local analysis | `internal` | Only in fully trusted environments |
@@ -66,6 +67,34 @@ pcap2llm analyze trace.pcapng --profile lte-core --privacy-profile share --out .
 above. It keeps the TAC prefix visible and masks the serial suffix. This mode
 exists only for `imei`; it is not available for `email`.
 
+**Telecom-aware partial subscriber protection** keeps routing context visible
+while protecting the subscriber-specific suffix:
+
+- `imsi: keep_mcc_mnc_mask_msin`
+- `imsi: keep_mcc_mnc_pseudonymize_msin`
+- `imsi: keep_mcc_mnc_encrypt_msin`
+- `msisdn: keep_cc_ndc_mask_subscriber`
+- `msisdn: keep_cc_ndc_pseudonymize_subscriber`
+- `msisdn: keep_cc_ndc_encrypt_subscriber`
+
+For IMSI, the default MNC-length heuristic is MCC `3xx` -> 3-digit MNC,
+otherwise 2-digit MNC.
+
+For MSISDN, the default is more conservative: keep only the E.164 country code
+and protect the rest. Germany is the built-in exception; German mobile NDCs for
+`(0)15`, `(0)160`, `(0)162`, `(0)163`, and `(0)17x` are also kept. Add explicit
+roaming-partner CC/NDC prefixes in the config file:
+
+```yaml
+numbering:
+  imsi_mnc_lengths:
+    "262": 2
+    "310": 3
+  msisdn_ndc_prefixes:
+    "31": ["20"]
+    "49": ["15", "160", "162", "163", "170", "171", "172", "173"]
+```
+
 **Encryption does not make casual sharing safe.** If you share an encrypted artifact and the key is shared separately later, the data is fully recoverable. Pseudonymization is the safer choice when you want irreversible protection for the shared artifact.
 
 ---

docs/PROFILES.md

@@ -24,12 +24,15 @@ Use the family guide that matches the network domain you are troubleshooting:
 | 5G SA Core | 5GC overview, N1/N2, SBI, UDM/AUSF/UDR, policy, charging, DNS, public warning | [`PROFILES_5G.md`](PROFILES_5G.md) |
 | VoLTE / VoNR / IMS | SIP, Diameter, IMS DNS, Session Border Controller, 5GS voice state, auth/policy SBI | [`PROFILES_VOICE.md`](PROFILES_VOICE.md) |
 | 2G/3G Core / GERAN | Gn/Gp, Gr, Gs, GERAN, MAP, CAP, ISUP, SCCP/MTP, legacy DNS | [`PROFILES_2G3G.md`](PROFILES_2G3G.md) |
+| Transport decode | TCP, UDP, SCTP, IP/IPv6, ICMP lower-layer diagnostics | [`TRANSPORT_DECODE_PROFILE_PLAN.md`](TRANSPORT_DECODE_PROFILE_PLAN.md) |
 
 Quick rule:
 
 - Start with the broad family overview profile if the failing interface is still unclear.
 - Move to the narrower interface profile as soon as the real signaling path is known.
 - Prefer the voice family over generic SIP-like thinking when the problem is really IMS voice service.
+- Use `transport-sctp`, `transport-tcp`, `transport-udp`, or `transport-core`
+  when the transport behavior itself is the question or upper-layer decode is unreliable.
 
 ## Where to Put a Custom Profile
 

docs/REFERENCE.md

@@ -163,7 +163,7 @@ For bounded analyze runs, the JSON artifacts also include `selection.start_packe
 ```
 Profile & filtering:
   --profile               Protocol profile (default: lte-core)
-  --privacy-profile       Privacy profile: internal | share | lab | prod-safe | llm-telecom-safe | <path>
+  --privacy-profile       Privacy profile: internal | share | lab | prod-safe | llm-telecom-safe | telecom-context | <path>
   -Y / --display-filter   TShark display filter
   --config                YAML config file
 
@@ -757,6 +757,7 @@ For full details and supported types, see [`NETWORK_ELEMENT_DETECTION.md`](NETWO
 | `lab` | Pseudonymize all subscriber data, mask IPs |
 | `prod-safe` | Maximum protection — mask IPs, pseudonymize all PII, remove tokens/email/URI/payload |
 | `llm-telecom-safe` | External LLM-safe default — pseudonymize endpoints and subscriber IDs, remove secrets/payload, keep telecom structure |
+| `telecom-context` | Keep IMSI MCC/MNC, MSISDN CC, German mobile NDCs, and IMEI TAC visible while masking subscriber-specific suffixes |
 
 ```bash
 pcap2llm analyze sample.pcapng --profile lte-core --privacy-profile share
@@ -783,10 +784,32 @@ pcap2llm analyze sample.pcapng \
 - `remove` — delete the field entirely
 - `keep_tac_mask_serial` — IMEI only; keep the TAC prefix and mask the serial
   suffix
+- `keep_mcc_mnc_mask_msin` — IMSI only; keep MCC/MNC and mask MSIN
+- `keep_mcc_mnc_pseudonymize_msin` — IMSI only; keep MCC/MNC and pseudonymize MSIN
+- `keep_mcc_mnc_encrypt_msin` — IMSI only; keep MCC/MNC and encrypt MSIN
+- `keep_cc_ndc_mask_subscriber` — MSISDN only; keep E.164 CC and mask subscriber suffix
+- `keep_cc_ndc_pseudonymize_subscriber` — MSISDN only; keep E.164 CC and pseudonymize subscriber suffix
+- `keep_cc_ndc_encrypt_subscriber` — MSISDN only; keep E.164 CC and encrypt subscriber suffix
 
 `email` does not have a special partial-keep mode. For email addresses, use the
 standard modes: `keep`, `mask`, `pseudonymize`, `encrypt`, or `remove`.
 
+Partial IMSI protection defaults to a simple MNC-length heuristic: MCC `3xx`
+uses 3 MNC digits, all other MCCs use 2. MSISDN protection keeps only the E.164
+country code by default; Germany is the built-in exception and keeps matching
+mobile NDCs for `(0)15`, `(0)160`, `(0)162`, `(0)163`, and `(0)17x`. Override
+IMSI lengths and add roaming-partner NDC prefixes in config:
+
+```yaml
+numbering:
+  imsi_mnc_lengths:
+    "262": 2
+    "310": 3
+  msisdn_ndc_prefixes:
+    "31": ["20"]
+    "49": ["15", "160", "162", "163", "170", "171", "172", "173"]
+```
+
 **Pseudonyms are stable across runs** — the same input value always produces the same alias (BLAKE2s hash). This allows correlation between separate analyses of related captures.
 
 ### Encryption workflow

docs/TRANSPORT_DECODE_PROFILE_PLAN.md

@@ -0,0 +1,78 @@
+# Transport Decode Profile Plan
+
+This plan is for analysis profiles, not privacy profiles. The goal is to make
+TCP, UDP, and SCTP troubleshooting useful even when the higher-layer protocol is
+unknown, malformed, encrypted, or intentionally ignored.
+
+## Goals
+
+- Add profile-level views for transport-layer diagnostics.
+- Preserve packet-level transport evidence with minimal interpretation loss.
+- Make SCTP troubleshooting first-class, including stream IDs, chunks, PPIDs,
+  associations, retransmission signals, heartbeats, SACK behavior, and ABORT /
+  SHUTDOWN paths.
+- Keep the existing telecom profiles focused on service protocols, while adding
+  explicit transport decode profiles for lower-layer investigations.
+
+## Available Profiles
+
+| Profile | Focus |
+|---|---|
+| `transport-core` | TCP, UDP, SCTP, IP, ICMP overview for mixed captures |
+| `transport-sctp` | SCTP association and chunk-level analysis |
+| `transport-tcp` | TCP streams, retransmissions, resets, handshakes, TLS adjacency |
+| `transport-udp` | UDP conversations, DNS/NTP/RTP-adjacent traffic, fragmentation hints |
+
+## Profile Shape
+
+Each profile should use `verbatim_protocols` for the transport protocol under
+inspection so TShark fields survive reduction with minimal flattening:
+
+```yaml
+name: transport-sctp
+description: SCTP transport decode profile for association, stream, chunk, and retransmission analysis.
+relevant_protocols:
+  - sctp
+  - ip
+top_protocol_priority:
+  - sctp
+  - ip
+protocol_aliases:
+  sctp: [sctp]
+  ip: [ip, ipv6]
+verbatim_protocols:
+  - sctp
+reduced_transport_fields:
+  - proto
+  - src_port
+  - dst_port
+  - stream
+  - sctp_stream
+  - anomaly
+  - notes
+summary_heuristics:
+  - Highlight SCTP retransmissions, duplicate TSNs, gaps, SACK-only bursts, ABORT, and SHUTDOWN.
+```
+
+## Implementation Steps
+
+1. Add the four profile YAML files under `src/pcap2llm/profiles/`. Done.
+2. Extend profile tests so each transport profile loads and has expected
+   protocol aliases, priorities, and verbatim settings.
+3. Extend index inspection to surface transport-specific counters:
+   retransmissions, resets, SCTP chunk types, SACK/ABORT/SHUTDOWN counts, and
+   stream IDs where available.
+4. Add summary heuristics so `summary.json` calls out transport symptoms before
+   the user has to inspect `detail.json`.
+5. Add flow-model support for transport-only diagrams:
+   TCP handshake/reset markers, SCTP INIT/COOKIE/SACK/ABORT/SHUTDOWN, and UDP
+   request/response pair hints where ports or DNS transaction IDs allow it.
+6. Document usage in `docs/PROFILES.md`, `docs/REFERENCE.md`, and the German
+   guide.
+
+## Open Design Choice
+
+SCTP should probably be the first implementation target. It has the clearest
+telecom value and benefits most from verbatim decode because upper layers such
+as S1AP, NGAP, M3UA, or Diameter-over-SCTP can hide transport failure signals
+when the user starts from an application profile.

docs/WEB_GUI.md

@@ -195,7 +195,7 @@ way until you intentionally open it for troubleshooting or auditability.
 - `Delete job` removes the full job directory
 - dashboard available at `/dashboard` with job and privacy-profile statistics
 - jobs can be multi-selected and deleted from the start page
-- Telekom-inspired magenta/neutral visual theme with active navigation states,
+- Neutral teal/gray visual theme with active navigation states,
   consistent focus rings, and shared light/dark color tokens
 - dark-mode toggle in the header persists via `localStorage`
 - responsive layout for smaller screens
@@ -302,6 +302,18 @@ This IMEI-only mode keeps the TAC prefix visible and masks the serial suffix.
 It is not an email-specific mode. Email addresses use only the standard modes:
 `keep`, `mask`, `pseudonymize`, `encrypt`, or `remove`.
 
+For IMSI, the UI also exposes:
+
+- `keep_mcc_mnc_mask_msin`
+- `keep_mcc_mnc_pseudonymize_msin`
+- `keep_mcc_mnc_encrypt_msin`
+
+For MSISDN, the UI also exposes:
+
+- `keep_cc_ndc_mask_subscriber`
+- `keep_cc_ndc_pseudonymize_subscriber`
+- `keep_cc_ndc_encrypt_subscriber`
+
 ### API Endpoints
 
 List all local profiles as JSON:

docs/privacy_coverage.md

@@ -35,6 +35,26 @@ Most configurable data classes support the standard protection modes
 the TAC prefix visible and masks the serial suffix. This specialized mode does
 not apply to `email`.
 
+`imsi` supports telecom-aware partial modes:
+
+- `keep_mcc_mnc_mask_msin`
+- `keep_mcc_mnc_pseudonymize_msin`
+- `keep_mcc_mnc_encrypt_msin`
+
+These keep the E.212 MCC/MNC routing context and protect the MSIN suffix. By
+default, MCC `3xx` uses a 3-digit MNC and other MCCs use a 2-digit MNC unless
+`numbering.imsi_mnc_lengths` overrides the MCC.
+
+`msisdn` supports E.164-aware partial modes:
+
+- `keep_cc_ndc_mask_subscriber`
+- `keep_cc_ndc_pseudonymize_subscriber`
+- `keep_cc_ndc_encrypt_subscriber`
+
+These keep the E.164 country code visible and protect the subscriber suffix.
+Germany is the built-in exception: known German mobile NDCs remain visible.
+Use `numbering.msisdn_ndc_prefixes` for roaming-partner-specific CC/NDC plans.
+
 ## Canonical Classes
 
 - `network_address`