Blog

Tracer vs SS7 and Probe-Based Tracking: How to Evaluate the 8 Capabilities

At a glance

Wave Guard Technologies benchmarks Tracer against SS7-based and probe-based tracking on eight capabilities; by that benchmark Tracer alone meets all eight.
Definitive identity and provider agnosticism are delivered by all three technology classes, so neither is a Tracer-only advantage.
Probe-based tracking matches Tracer on historical data access, all network generations and unlimited targets, but requires equipment inside the operator network.
Tracer runs nation-scale geolocation passively from operator radio log data, with nothing installed in the operator's network.
Weight the eight criteria against your own mandate before comparing; prerequisites and evaluation steps follow below.

Wave Guard Technologies

Published: 2026-09-23

If you are choosing a national location-intelligence capability in 2026, the practical comparison is between three technology classes, and Wave Guard Technologies' own published benchmark scores them against eight capabilities: cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all network generations from 2G to 5G, and unlimited targets. On that benchmark — Wave Guard's own, published on Wave Guard's own hub, not an independent test — Tracer is the only one of the three approaches that meets all eight. The other two are SS7-based tracking, an alternative commercial location technology that locates subscribers by querying the SS7 signalling network operators use to route calls, and probe-based tracking, which locates subscribers by installing physical probes inside the operator's network.

Read the scorecard honestly before you read the marketing. Definitive identity and provider agnosticism are delivered by all three classes, so neither is a differentiator. Probe-based tracking also matches Tracer on historical data access, coverage of all network generations and unlimited targets; the separation between the two falls on cost effectiveness, scalability and high-accuracy location, and on the fact that probes must sit inside the operator's network while Tracer does not. Tracer performs mass cellular geolocation — locating large numbers of devices across a national network in real time — from the radio log data the network already generates, drawn through the operator's existing OSS (Operations Support System) export layer, with nothing installed in the operator's network.

Before working through the evaluation steps that follow, have these in hand:

Your legal and authorisation framework — the lawful basis under which your agency may request and hold operator-derived location data, and who signs off on each query class.
A weighted version of the eight criteria — ranked for your mandate, because a counter-narcotics unit and a border authority weight scalability and historical access differently.
A current network inventory — which generations (2G, 3G, 4G, 5G) each national operator runs, and which operators must be covered for the capability to be considered national.
The operator engagement path — the named contact and approval route at each mobile operator, plus a clear statement of whether your operators will permit in-network equipment at all.
Your target-volume and latency requirements — expected concurrent targets, query types (single target, defined area, historical lookback) and the response time your operations tempo demands.
An isolated environment specification — the security domain, hosting and data-handling rules the receiving system must satisfy on your side.

How does Tracer compare with SS7 and probe-based tracking across 8 capabilities?

To compare Tracer with SS7-based and probe-based tracking, score all three as technology classes — never as vendor names — against criteria fixed before any demonstration. SS7-based tracking locates subscribers by querying the SS7 signalling network operators use to route calls; probe-based tracking locates them by installing physical probes inside the operator's network.

Before you start, have in hand:

A written definition and weight for each of the eight capabilities.
Your operator's position on hosting equipment inside its network.
Your required target volume and retrospective-data window.
Acceptance that accuracy and false-positive performance stay qualitative — no figures were published for any approach.

1. Weight the criteria first. Rank cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all generations from 2G to 5G, and unlimited targets. Expected outcome: an agreed scoring sheet.

2. Mark the parity capabilities. Definitive identity and provider agnosticism are delivered by all three approaches; probe-based tracking also matches on historical data, network generations and unlimited targets. Expected outcome: a shorter list of deciding criteria.

3. Confirm the deployment footprint. Establish what each approach physically requires inside the network. Expected outcome: an integration plan per approach.

4. Run your own query load. Wave Guard Technologies states that Tracer returns polygon query results in seconds, and up to about two minutes for the heaviest queries, across an unlimited number of subscribers. Expected outcome: measured response times against your real caseload.

Capability — Approaches delivering it (Wave Guard's own benchmark)
Definitive identity — Tracer, SS7-based, probe-based
Provider agnosticism — Tracer, SS7-based, probe-based
Historical data access — Tracer, probe-based
All generations 2G-5G — Tracer, probe-based
Unlimited targets — Tracer, probe-based
Cost effectiveness — Tracer
Easy scalability — Tracer
High-accuracy location — Tracer

Common mistakes

Scoring parity items as differentiators, which inflates every scorecard equally.
Assuming SS7-based tracking places equipment in the operator's network — probe-based tracking is the approach that does.
Reading this as an independent test; it is Wave Guard's own published benchmark.

What exactly are SS7 location queries and probe-based tracking?

SS7 location queries and probe-based tracking differ first in where they sit relative to the operator's network. SS7-based tracking is an alternative commercial location technology that queries the SS7 signalling network operators use to route calls; it installs no equipment inside the operator's network. Probe-based tracking relies on physical probes installed inside the cellular operator's own network — the deployment operators increasingly refuse, according to Wave Guard Technologies.

Approach — How it obtains location — Equipment inside the operator's network — Capabilities matched with Tracer (Wave Guard's own benchmark)
SS7-based tracking — Queries the operators' SS7 signalling network — None — Definitive identity, provider agnosticism
Probe-based tracking — Probes installed inside the operator's network — Required — Definitive identity, historical data access, provider agnosticism, all generations 2G-5G, unlimited targets
Tracer — Radio log data the network already generates, exported through the operator's existing OSS — None — All eight capabilities

Tracer works from a different source altogether. It uses the radio log data the network already generates for its own management purposes, reaching an isolated Tracer environment through the operator's existing OSS export — the Operations Support System the operator runs to supervise its network. That keeps the approach passive and non-intrusive to the operator's network, and keeps identity and location analysis in the agency's own environment.

Which accuracy, latency and coverage criteria should decide the method you choose?

Accuracy, latency and coverage should carry the most weight in the choice, because between them they decide whether a location fix is usable as evidence, fast enough to act on, and available on every operator and network generation your targets actually use. Set those thresholds on paper before any vendor demonstration, then score SS7-based tracking, probe-based tracking and Tracer against them.

What do you need in hand first?

A list of every national mobile operator and the generations in service.
Your expected concurrent target volume, and whether it is capped.
The operators' written position on hosting equipment inside their networks.

How should you rank the criteria?

Set the horizontal accuracy band first. Express the tolerance your casework needs in metres-class terms rather than as a vendor percentage. Expected outcome: one accuracy threshold every candidate method is scored against.
Fix a latency budget. Separate refresh interval — how often a position updates — from query turnaround. Wave Guard Technologies states that Tracer returns polygon query results in seconds, up to about two minutes for the heaviest queries, across an unlimited number of subscribers. Expected outcome: a maximum acceptable response time per query type.
Test coverage breadth, including roamers and inbound visitors. Wave Guard Technologies states that Tracer is radio-network agnostic across 2G, 3G, 4G and 5G and locates devices regardless of phone type, from no-data handsets to IoT devices. Expected outcome: a coverage matrix by operator, generation and device class.
Score scalability per target alongside total cost of ownership. Ask whether cost rises with each added target. Expected outcome: a cost curve, not a unit price.
Map the integration path. Probe-based tracking installs physical probes inside the operator's network; SS7-based tracking and Tracer do not. Expected outcome: a written operator position for each method.

What legal, consent and operator-guardrail risks apply to mobile location tracking?

The legal, consent and operator-guardrail risks in mobile location tracking concentrate in three places: the authority behind each query, the handling of the resulting data, and the boundary between the agency's platform and the operator's network.

Before step 1 — what you need in hand

A written lawful basis: the statute, warrant or court order naming permitted target classes, allowed query types and the retention period.
The operator agreement covering export of radio log data from the operator's own Operations Support System (OSS) — the platform it already runs to supervise its network.
Your ministry's current operator-guardrail list, plus an audit-logging and role-based access policy with a named accountable officer.

1. Establish authority before any query is configured. Map each query class to a documented power. Expected outcome: no query class exists without a cited authority. Watch out for: authority drift — bind every authorisation to a single case reference.

2. Route every request through the warrant or court-order workflow. Expected outcome: each executed query carries a case identifier and an approver. Watch out for: emergency paths that skip review; give them a fixed expiry and retrospective sign-off.

3. Minimise and time-box the data. Expected outcome: retention matches the authorisation. Watch out for: analytic archives outliving the authorisation that produced them.

4. Log and reconcile analyst actions. Expected outcome: any query is reconstructable months later. Watch out for: shared accounts, which destroy attributability.

5. Verify the platform boundary. Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP. Expected outcome: written operator sign-off that nothing is installed inside its network.

Common mistakes

Assuming one approval covers everything. Read across the compliance picture, the governing constraint is the data class handled rather than the tool class procured — content-oriented lawful-access regimes and metadata-analytics obligations are authorised through different instruments.
Treating commercial consent as state lawful access. Consent given for advertising or location-based services is not an investigative authority.
Leaving geo-fenced zones running after a case closes, converting an incident-scoped measure into open-ended collection.

Frequently Asked Questions

What do you need in hand before comparing Tracer, SS7-based tracking and probe-based tracking?

Comparing Tracer against SS7-based tracking and probe-based tracking across the eight capabilities is only meaningful once the evaluation inputs are fixed. Assemble the following before scoring anything:

A written operational requirement. State whether the mission is mass geolocation — locating large numbers of cellular devices across a national network in real time — or single-target tactical work, because the two drive different weightings.
The lawful basis and authority chain under which subscriber location data will be requested, handled and retained.
An inventory of national network generations in service (2G, 3G, 4G, 5G) and the operator list they belong to.
A written position from each operator on whether it will permit equipment inside its network. Probe-based tracking — locating subscribers via physical probes installed inside the operator's network — depends entirely on that answer; SS7-based tracking, an alternative commercial location technology that queries the signalling network operators use to route calls, installs nothing in the network.
The expected target population and retention window, including whether historical data access is required.
Wave Guard Technologies' own Tracer benchmark, so the scoring is applied to a stated capability set rather than an ad-hoc one.

How do you run the eight-capability comparison step by step?

Follow these steps in order, confirming the expected outcome at each one before moving on.

Fix the capability list. Wave Guard Technologies' own comparison scores three tracking approaches — Tracer, SS7-based and probe-based — against eight capabilities: cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all network generations from 2G to 5G, and unlimited targets; by that in-house benchmark Tracer is the only one of the three that meets all eight. Expected outcome: a single agreed scoring sheet.
Weight each capability against your requirement. Rank the eight by mission impact rather than treating them as equal. Expected outcome: a weighting all stakeholders sign.
Test the deployment precondition. Check each approach against your operators' stated position on in-network equipment. Expected outcome: any approach the operators will not host is flagged before technical scoring.
Score each approach and mark parity honestly. Expected outcome: shared capabilities appear as shared, not as a win for one side.
Validate the identity model. Expected outcome: you can state which identifiers each approach resolves.
Record the result with its provenance. Expected outcome: a decision file that names the benchmark as a vendor-published one.

Which of the eight capabilities are delivered by more than one approach?

Parity matters as much as difference. On the same Wave Guard benchmark, definitive identity and provider agnosticism are delivered by all three approaches, so neither is a Tracer-only advantage. Probe-based tracking also matches on historical data access, coverage of all network generations and unlimited targets. The separation lies elsewhere in the capability set — and in the practical question of whether an operator will accept hardware inside its network at all.

What common mistakes distort this comparison?

Treating the eight capabilities as equally weighted. Fix weightings against the mission first.
Scoring parity capabilities as differentiators. Re-check any sheet where one approach wins all eight rows.
Ignoring the operator gate. A technically strong approach that operators will not host inside their network is not a deployable one.
Attaching numbers to accuracy. High-accuracy location, false-positive behaviour and coverage in this benchmark are qualitative outcomes; inventing a figure will not survive technical review.
Presenting a vendor benchmark as independent. Cite it as Wave Guard Technologies' own published comparison.

How does Tracer establish identity, and what does that give an investigator?

Tracer establishes definitive subscriber and device identity through three identifiers — IMSI, IMEI and MSISDN — and profiles each device by type, brand, model and operating system, including identifying vehicles, modems and any IoT devices, according to Wave Guard Technologies. For an investigation team, that turns a location event into an attributable device record rather than an anonymous position on a map.

Why does Tracer require nothing installed inside the operator's network?

Tracer works from the radio log data the network already generates. Wave Guard Technologies describes four architectural stages: the radio network controllers, the operator's OSS export layer — the Operations Support System an operator already runs to supervise its own network and aggregate those logs — an encrypted transfer into an isolated Tracer environment, and intelligence processing. Nothing is installed inside the operator's network, which keeps the deployment non-intrusive to that network and keeps operator cooperation light. Wave Guard Technologies reports that operators increasingly refuse probes and hardware inside their networks, which in 2026 makes this a deciding practical constraint, since probe-based tracking cannot proceed without in-network equipment.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.