What you’re building

SignalBridge reads LTE/5G signalling (S1AP/NGAP) from PCAP or streams, optionally filters and anonymises IMSIs, and writes PCAP, TCP, UDP, or HTTP(S) NDJSON batches. This walkthrough goes: install deps → build → run once from a file → optional YAML config → optional local HTTP ingest.

Prerequisites

• C++20, CMake 3.20+
• Libraries: libpcap, yaml-cpp, libcurl, OpenSSL, zlib
• Dev checkout: If third_party/s1see/ is missing, you need S1-SEE next to the repo or -DS1_SEE_DIR= (see README.md).

macOS (Homebrew):

brew install libpcap yaml-cpp

Ubuntu/Debian:

sudo apt-get install -y libpcap-dev libyaml-cpp-dev libcurl4-openssl-dev libssl-dev zlib1g-dev

(Public-bundle docs also mention pkg-config on Debian — see README.publish.md.)

Step 1 — Configure and build

From the repository root:

cmake -S . -B build
cmake --build build -j

Binary: build/signalbridge.

Step 2 — First run (CLI, file in → file out)

./build/signalbridge run --help
./build/signalbridge run -i capture.pcap -o anonymised.pcap

Use a real S1AP/NGAP PCAP you’re allowed to process. This confirms decode + anonymise + write path without touching YAML.

Step 3 — Run from YAML

./build/signalbridge run -c config/conduit.yaml

Check a config without processing:

./build/signalbridge validate -c config/conduit.yaml

Open config/conduit.yaml and adjust inputs (file, TCP listener, stdin), outputs (PCAP path, tcp://, udp://, http:///https://), filters, and metrics bind (default metrics often documented as 127.0.0.1:9090 in the README). HTTP paths often look like /frames/{uuid} — align with config/ingest_endpoints.yaml if you use the reference server.

Step 4 — Local HTTP ingest (optional)

Terminal 1:

pip install -r server/requirements.txt
python server/signalvault_ingest.py --port 9876

Terminal 2: point your YAML HTTP output at that host/port/path, then run signalbridge run -c ... again. This validates streaming before production or Signal Cloud–style endpoints.

Step 5 — TCP listener input (concept)

You can feed live PCAP over TCP (e.g. tshark piped through socat into SignalBridge’s listener). The root README documents the pattern; use --loop if you need multiple connections and config hot-reload.