geedge.lantern.io
detection confidence: medium public

The same TSG API/DB documentation shows subscriber-identity fields (TSG_DYN_SUBSCRIBER_IP table, RADIUS attribute support added 2019-11-08) are built into TSG's core security-policy schema itself, not only into the separate CyberNarrator add-on — session-to-subscriber correlation is a base-platform capability at any TSG deployment, carrier-RADIUS-integrated or not.

学利增加radius属性 / TSG_ DYN_SUBSCRIBE_IP变更为TSG_ DYN_SUBSCRIBER_IP
capabilitysubscriber-correlation

extracted_by: claude-sonnet-5 · added 2026-08-26 · id: 2026-tsgdoc-subscriber-radius

Related findings

deployment

The same GEEDGE employee handbook dates the launch of 网络叙事者 (CyberNarrator) to April 2021, and separately states the company's products serve 18 data centers and carriers worldwide processing over 20 Tbps of traffic — the first primary-source confirmation of CyberNarrator's launch date and a company-stated global deployment-scale figure.

deployment

The galaxy/tsg_olap/dll-multipoint-aggregation repo defines a Flume-based multi-site log-aggregation pipeline with five parallel categories -- "active_defence", "connection" (call-detail/通联日志), "proxy", "security", and "radius" -- the last explicitly ingesting RADIUS data, corroborating that the CyberNarrator subscriber-correlation capability's RADIUS feed sits inside this broader TSG OLAP log-aggregation architecture rather than as a standalone system.

deployment

A Postman API collection titled '银河api' (Galaxy API) documents production query endpoints against the tsg_galaxy analytics backend, including dedicated 'radius日志标准查询' / 'raduis日志clickhouse查询' (RADIUS log queries) and 'Traffic Top Intercept Policies By Hits/Bandwidth' endpoints -- showing RADIUS-based subscriber correlation and interception-policy analytics are standard, generally-available query features of TSG's management API rather than a one-off built solely for the Pakistan deployment.

detection

TSG's central ClickHouse analytics schema ('tsg_galaxy_v3', deployed on cluster 'ck_cluster') defines a 'session_record' table where every logged session carries subscriber_id, imei, imsi, phone_number, and apn fields alongside client/server geolocation and ASN -- showing that per-session subscriber-identity correlation is a built-in, standard field of TSG's core traffic-log schema (used for ordinary session_record, not a bespoke table), not an add-on limited to the already-documented Pakistan CyberNarrator deployment.

detection

The Bifang (TSG-UI) automated-deployment manual configures a dedicated 'subid' microservice that consumes a Kafka topic literally named 'RADIUS-RECORD-LOG' under consumer group 'mapping-subid-ip' -- an operational pipeline that ingests carrier RADIUS accounting records specifically to map subscriber identity to IP address in near-real-time -- concrete infrastructure-level detail for the subscriber-identity-correlation capability elsewhere associated with the CyberNarrator/vpn-thwarting component.

export/sales

Geedge Networks' 2023 new-hire onboarding deck gives a corporate timeline: TSG's first international market win (with a codename "Nezha" launching the same month) in September 2018, "网络叙事者" (CyberNarrator) launching November 2020, a "South Asia" country project landing August 2021 (overseas market expansion), and Geedge winning a bid as overall solution provider for an "East Africa" country project in May 2022 — timing and regions consistent with this corpus's existing Pakistan (WMS-UTR/P19) and Ethiopia (E21) site attributions, though the deck itself does not name the countries.