Skip to content
Back to projects

Personal project · Live at telcomiq.com

TelcomIQ

A reference platform for mobile network engineers. Every protocol, node and generation is a page; every relationship between them is structured data — so the whole knowledge base is browsable as a graph, filterable by generation and threat level, and searchable in a single field.

Open telcomiq.com (opens in a new tab)
  • Next.js 14
  • TypeScript
  • MDX / Contentlayer
  • React Flow
  • Supabase
  • Vercel
Period
2026 — present
Context
Personal project, live and public
Role
Content, design, engineering, deployment
Live at
telcomiq.com
38
Published topics

Protocols, network nodes, generations and concepts, from 2G GSM to 5G Standalone.

142
Specification references

Every claim anchored to a primary source: 3GPP, GSMA, IETF, ITU-T and ANSI.

27
Interactive diagrams

11 network architectures and 16 signalling call flows.

212
Graph edges

Unique relationships resolved from 660 declarations across the topic set.

01Why it exists

The knowledge exists. The shape does not.

3GPP and GSMA specifications are authoritative and close to unreadable at speed. Answering something as ordinary as what talks to the HSS over S6a, and why that is a problem, means opening four PDFs and holding the answer together in your head.

The alternatives are worse. Wikipedia and vendor blogs are shallow and inconsistent, and they rarely connect a protocol to the nodes that speak it, the generation it belongs to, or its attack surface. Internal wikis rot, and none of them show you the shape of the network — what supersedes what, and what is built on what.

The questions engineers actually ask are relational: what replaced this, what depends on it, where is the exposure, which specification says so. TelcomIQ is built around those relationships. Every topic declares them in structured data, so the reference is not a pile of articles — it is a graph you can walk.

Who it is for

Core and roaming
Fast lookup of node roles, interfaces and migration paths between generations: HLR to HSS to UDM, MME to AMF, PCRF to PCF.
Security teams
Attack surface per protocol, mitigations aligned to GSMA FS.11 and FS.19, and a six-domain threat library.
Presales and solutions
Citable answers in an operator conversation, with the specification reference attached to each one.
New to telecom
A structured path from 2G GSM to 5G Standalone, with a diagram for every major call flow and a quiz to check it landed.
The home page: live counts, a global coverage preview, featured topics and a threat breakdown by topic type.
The home page: live counts, a global coverage preview, featured topics and a threat breakdown by topic type.

02Topics

Thirty-eight topics, one shape

Every topic is written to the same nine-section structure, so a reader always knows where to look and a section cannot quietly go missing.

  • Search. Full-text search across the whole corpus, running client-side against an index generated at build time. No query leaves the browser.
  • Filters. Multi-select pills for type, generation and threat level, combinable with the search field and with each other.
  • Readable cards. Every card carries its type badge, threat pill, generation tags and a bookmark star, so a result is useful without opening it.
  • Sidebar. Type, generations, threat level, linked specifications, a per-topic quiz, and a live one-hop graph of everything the topic touches.
  • Attack surface. Each vector is written up with its mechanism, its impact and how hard it is to execute — not just named.
  • Diagrams inline. Diagrams are mapped to topics declaratively, so a topic page surfaces its own architectures and call flows without anyone maintaining a list.

The shape of a topic

  1. 01Overview
  2. 02How it works
  3. 03Architecture role
  4. 04Key interfaces
  5. 05Security posture
  6. 06Attack surface
  7. 07Mitigations
  8. 08Spec references
  9. 09Related topics
Browse: search, filter pills for type, generation and threat level, and 38 cards that stay readable at a glance.
Browse: search, filter pills for type, generation and threat level, and 38 cards that stay readable at a glance.
A topic page — SS7. The article on the left; type, threat level, specifications and a one-hop relationship graph on the right.
A topic page — SS7. The article on the left; type, threat level, specifications and a one-hop relationship graph on the right.
The attack surface section of a topic. Every vector carries its mechanism, its impact and its difficulty.
The attack surface section of a topic. Every vector carries its mechanism, its impact and its difficulty.

What is covered

Generations
  • 2G GSM
  • 3G UMTS
  • 4G EPC
  • 5G NSA
  • 5G SA
Protocols
  • SS7
  • MAP
  • ISUP
  • SIGTRAN
  • SCTP
  • Diameter
  • GTP-C
  • GTP-U
  • PFCP
  • SIP
  • RTP
2G / 3G nodes
  • HLR
  • MSC
  • SGSN
  • GGSN
  • STP
  • SMSC
4G nodes
  • MME
  • HSS
  • S-GW
  • P-GW
  • PCRF
  • DRA
5G nodes
  • AMF
  • SMF
  • UPF
  • AUSF
  • UDM
  • PCF
  • NRF
  • NEF
  • SEPP
Concepts
  • IMS Core

03Knowledge graph

Relationships as data, not as a “see also”

Most references treat a relationship as a link in a footer. Here it is a typed field in the topic’s frontmatter, validated before the build runs: 660 declarations across 38 topics resolve into 212 unique edges.

The graph renders with React Flow over a Dagre layout. Nodes are coloured by type and sized by how many relationships they hold, so the structurally important topics — SS7, Diameter, the EPC — are visibly larger. Hovering a node highlights it and its direct neighbours and dims the rest; clicking opens the topic.

The builder is the part that turns a reference into a teaching tool. Select the SS7, MAP, STP and SIGTRAN cluster, or just the 5G core, and explore that subgraph on its own.

Six typed edges

relatedTo
A topic worth reading alongside this one.
builtOn
The layer underneath — SS7 over SIGTRAN is built on SCTP.
supersedes
What this replaced.
supersededBy
What replaced it: HLR by HSS, MME by AMF, PCRF by PCF.
usedBy
The network nodes that speak this protocol.
interfaces
The named reference points, from the A interface to N32.
The full graph: 38 topics and 212 relationships. Hovering a node reads out its complete relationship set and dims everything it does not touch.
The full graph: 38 topics and 212 relationships. Hovering a node reads out its complete relationship set and dims everything it does not touch.
The graph builder. Select a cluster — here the SS7, MAP, Diameter, HLR and HSS group — and render just that subgraph.
The graph builder. Select a cluster — here the SS7, MAP, Diameter, HLR and HSS group — and render just that subgraph.

04Security

Six domains, written at operator depth

Security is not an appendix here. Every topic carries a threat level, its attack vectors with severity, and its mitigations — in the frontmatter, which is why they are filterable and aggregatable, and why the home page can put a threat breakdown on the front door.

On top of that sits a library of six interconnected domains, each with its own threat level, threat vectors, real-world impact analysis and mitigation guidance: 31 documented vectors and 39 mitigations.

The writing is deliberately specific. Vectors are described at the message level — MAP SendRoutingInfoForSM, RegisterSS, CancelLocation, Diameter over S6a — and mitigations reference GSMA FS.11, FS.19 and FS.37 category filtering, SMS home routing and SEPP deployment, rather than generic security advice.

The six domains

Signalling
SS7, Diameter, MAP and SIGTRAN. Legacy signalling exposes subscriber data, call routing and SMS delivery to manipulation across trusted inter-operator networks.
Voice
Call interception, VoIP fraud and lawful intercept abuse, across both circuit-switched and IP-based voice networks.
SMS and messaging
Sender ID spoofing, smishing, OTP bypass and SIM swap, on a legacy channel that is still carrying authentication.
Roaming
GRX/IPX, GTP and SEPP. Cross-border trust relationships exploitable for location tracking, fraud and signalling attacks.
Radio access
IMSI catchers, rogue base stations and jamming — an interface that is physically accessible to any attacker in range.
Identity and SIM
SIM cloning, eSIM profile injection and IMSI privacy. Compromise here breaks authentication at every layer above it.
The security landing page: six domains, each with its own threat level and a summary of what it exposes.
The security landing page: six domains, each with its own threat level and a summary of what it exposes.
The signalling domain in detail. Each vector names the actual MAP or Diameter operation, its severity and its concrete impact.
The signalling domain in detail. Each vector names the actual MAP or Diameter operation, its severity and its concrete impact.
The threat breakdown on the home page, aggregated from the threat level every topic declares for itself.
The threat breakdown on the home page, aggregated from the threat level every topic declares for itself.

05Diagrams

27 diagrams, two renderers

Block architectures and signalling sequences are different problems. Forcing one renderer to do both degrades both, so the library uses each where it belongs.

Architectures — React Flow
11 network architectures with 146 labelled reference interfaces: 2G GSM/GPRS, 3G UMTS, 4G EPC, 4G roaming, 5G NSA, the 5G Core service-based architecture, 5G roaming over SEPP and N32, IMS, the IMS-to-PSTN gateway, the SS7 signalling network and VoLTE QoS. All pan and zoom.
Call flows — Mermaid
16 signalling sequences, roughly 180 messages in total: SMS across MAP, Diameter and SIP; location update from 2G through to 5G; circuit-switched voice; CSFB; SIP registration; VoLTE call setup; and data session establishment from PDP context to 5G PDU session.
The diagram library: 27 diagrams across nine sections, searchable, with the architectures expanded.
The diagram library: 27 diagrams across nine sections, searchable, with the architectures expanded.
5G Core service-based architecture — every network function and reference interface from N1 to N37, in a pan-and-zoom modal.
5G Core service-based architecture — every network function and reference interface from N1 to N37, in a pan-and-zoom modal.
MAP_SEND_ROUTING_INFO_FOR_SM, drawn message by message with its parameters, per 3GPP TS 29.002.
MAP_SEND_ROUTING_INFO_FOR_SM, drawn message by message with its parameters, per 3GPP TS 29.002.

06Coverage

What the world actually has, country by country

The ITU publishes population coverage cumulatively: at least 2G, at least 3G, at least 4G. That is the wrong shape for the question most people are asking, which is what a population actually has.

A build script pulls the ITU DataHub dataset and computes exclusive slices — the share of a population whose highest available generation is exactly 2G, 3G, 4G or 5G, plus those with none at all. The result is an SVG choropleth with zoom, pan, hover tooltips and a per-country detail panel.

From the latest ITU DataHub release

239
Countries tracked
102
With measurable 5G
28.0%
Average 5G population coverage
80.8%
Average 4G and above
The coverage explorer. Colour is the highest generation available to most of the population; hovering a country opens its breakdown.
The coverage explorer. Colour is the highest generation available to most of the population; hovering a country opens its breakdown.

07Platform

Quizzes, accounts, and a site that works on a phone

A weekly 15-question quiz runs with a rolling archive and a queue of pre-authored weeks, alongside 13 per-topic knowledge checks of 10 questions each, launched from the topic sidebar. Around 280 questions are authored, and every one of them shows its explanation after you answer.

Accounts are passwordless — Google OAuth or a magic link, handled by Supabase — and entirely optional. All content stays public and there are no auth guards in the middleware: if authentication is down, the reference still works. Signing in adds bookmarks, quiz history and the ability to comment.

  • Quizzes. Guests can retake freely; a signed-in user gets one scored attempt per quiz, stored to their profile history.
  • Bookmarks. Star any topic from its card or its sidebar, synced across devices.
  • Discussion. One-level comment threads per topic, with a per-user choice between commenting publicly or anonymously.
  • Row-level security. Five Postgres tables behind Supabase, each with its own policy: a profile, a bookmark or a quiz result is readable by its owner and nobody else.
  • Privacy. Cookie consent gates analytics and nothing fires before it is given; the one form on the site is captcha-protected and there is a published privacy policy.
  • Phone width. Every page is built for it: the topic page moves its sidebar metadata above the article, and the navigation collapses to a drawer.
The weekly quiz: fifteen questions, an explanation after each answer, and a rolling archive behind it.
The weekly quiz: fifteen questions, an explanation after each answer, and a rolling archive behind it.
Per-topic discussion. Threads are one level deep, public or anonymous at the commenter’s choice.
Per-topic discussion. Threads are one level deep, public or anonymous at the commenter’s choice.
Browse on a phone — the filter pills wrap and the grid becomes a single column.
Browse on a phone — the filter pills wrap and the grid becomes a single column.
A topic on a phone — type, threat level, quiz and discussion move above the article.
A topic on a phone — type, threat level, quiz and discussion move above the article.

Content

The engineering is the delivery mechanism

What makes the platform worth opening is what is written in it: all of it original, and anchored to primary sources from 3GPP, the GSMA, the IETF, ITU-T and ANSI rather than to other people’s summaries.

MeasureCount
Published topics38
Specification references142
Documented attack vectors169
Documented mitigations196
Rows in structured tables293
Relationship declarations660
Unique graph edges212
Unique search tags168
Interactive diagrams27
Quiz questions authored~280

Stack

Built with

Framework

  • Next.js 14 (App Router)
  • React
  • TypeScript (strict)
  • Tailwind CSS

Content

  • MDX
  • Contentlayer
  • Fuse.js
  • Build-time validation

Visualisation

  • React Flow 11
  • Dagre
  • Mermaid 11
  • react-simple-maps

Platform

  • Supabase (Postgres + RLS)
  • Cloudflare Turnstile
  • Vercel
  • ITU DataHub

Each choice shows up in the product. The search index is built ahead of time, so results narrow as you type. React Flow over a Dagre layout is what gives the graph its stable shape and its hover behaviour, and what lets the builder redraw any subgraph on demand. Mermaid draws the call flows with their parameters annotated, message by message. And Supabase carries the optional layer — bookmarks, quiz history and discussion — for anyone who signs in, without ever gating the reference itself.

Credits

Designed, written and shipped end to end

The content model, the 38 topics, the diagram library, the security research, the application and the deployment are all my own work. It is a personal project rather than something built for an employer, and it is still being extended.

Role
Content, design, engineering and deployment
Sources
3GPP, GSMA, IETF, ITU-T and ANSI specifications
Coverage data
ITU DataHub population coverage dataset
Next
A retrieval pipeline over the topic and specification corpus, answering with citations
Back to projects