SCTPScan — SCTP Telecom Signaling Discovery Scanner

SCTPScan is a specialized network scanner for the Stream Control Transmission Protocol (SCTP), the transport protocol underpinning all modern telecom signaling. Within TelcoChisel, it is used to discover SIGTRAN SS7 signaling endpoints (M2UA/M3UA), Diameter peers (S6a, Gx, Gy), and 4G/5G S1-AP/NG-AP interfaces during carrier network penetration tests.

Key Capabilities & Security Vectors

• SIGTRAN Endpoint Discovery: Scan IP ranges for M2UA (port 2904), M3UA (port 2905), and SUA (port 14001) signaling gateways.
• Diameter Peer Enumeration: Identify Diameter relay agents and proxies on standard ports (3868 TCP/SCTP) for S6a/Gx/Gy testing.
• S1-MME / NG-AP Discovery: Find exposed eNodeB and gNodeB SCTP associations on carrier infrastructure (port 36412 / 38412).
• SCTP INIT Fingerprinting: Fingerprint SCTP stack implementations to identify vendor-specific signaling equipment.

TelcoChisel Execution Cheatsheet

1. Scan for SIGTRAN SS7 Nodes

# Discover M3UA signaling transfer points on a carrier subnet
sudo sctpscan -d 10.0.0.0/24 -p 2905 -r

2. Scan for Diameter Peers

# Find Diameter relay agents (HSS, PCRF, OCS endpoints)
sudo sctpscan -d 172.16.0.0/16 -p 3868 -r

3. Enumerate S1-MME Interfaces

# Discover LTE eNodeB S1-AP SCTP associations
sudo sctpscan -d 192.168.0.0/16 -p 36412 -r

Practice in TelcoSec Academy

👉 Launch SCTP Reconnaissance Lab on App.TelcoSec.Net