Import trace data
Open files, folders, gzip logs, ZIP and nested ZIP bundles, packet captures, normalized TranslatorX exports, or text copied to the clipboard.
TranslatorX
A desktop application for reading, filtering, correlating, and visualizing signaling logs from Cisco collaboration systems and related endpoints.
Latest announcement
TranslatorX has been rebuilt on a modern foundation
The public beta is a ground-up rewrite designed for faster, safer development while preserving deep protocol visibility.
Functions
What TranslatorX does
The application keeps the original protocol detail available while adding a normalized view across different products and log formats.
Order messages from multiple sources
Normalize timestamps to GMT, infer source timezones and missing years, and allow per-source time overrides when automatic alignment is not correct.
Search, filter, and decode
Use text search, structured reusable filters, protocol visibility, routine-traffic controls, and decoded details for supported signaling protocols.
Identify calls and SIP sessions
Review Unified CM CDR records, trace-derived SIP calls, and multi-leg sessions correlated by explicit Session-ID and vendor identifiers.
Visualize signaling across products
Follow messages between endpoints, Unified CM, CUBE, Expressway, and other systems in a chronological call-flow window with editable device labels and lanes.
Collect logs remotely
Collect a timeframe from Unified CM, CUBE, or Expressway; coordinate multiple devices; or run live CUBE and Expressway traces.
Analyze selected evidence with an LLM
Optionally analyze a SIP call, session, or filtered trace using Ollama, Anthropic, AWS Bedrock, or a configured Anthropic-compatible endpoint.
Export results
Create readable text, a normalized re-importable trace, or a call-flow diagram without retaining the original vendor log wrapper.
Main workspace
Trace data and context in one view
Select a marker to see how the main TranslatorX window supports common investigation tasks.
Open trace dataLoad individual files, folders, compressed bundles, packet captures, normalized exports, or text from the clipboard.
Control what is displayedApply reusable filters, include or exclude routine traffic, and choose which protocols are visible without changing the imported data.
Move from messages to an investigationOpen a call flow, review detected calls and sessions, start troubleshooting collection, or analyze selected evidence with a configured model.
Find messages quicklySearch the loaded message set while keeping the surrounding trace available for context.
Inspect the selected messageRead the decoded or raw message, filter by related identifiers, and jump back to the source log.
Understand SIP and SDP fieldsHover over recognized SIP headers and SDP elements for plain-language explanations and links to the relevant standards.
Compatibility
Sources and protocols
Support depends on the information present in each source. Summary-only logs can be correlated and displayed, but cannot provide message bodies that were never recorded.
Primary products
- Cisco Unified CM SDL, SDI, calllogs, CDR, and CMR
- Cisco CUBE and IOS gateway VoIP traces and SIP debugs
- Cisco Expressway and VCS Network Log and diagnostic bundles
- Webex App, Jabber, phones, and supported endpoint logs
Protocols
- SIP and SDP
- SCCP / Skinny
- Q.931 / Q.SIG
- MGCP and MGCP backhaul
- H.225, RAS, and H.245
Additional inputs
- SIP extracted from supported PCAP files
- CUSP and BroadWorks signaling logs
- Portable
.txtracefiles exported by TranslatorX
Remote access
- HTTPS with TLS 1.2 or newer for supported APIs
- SSH passwords, keys, FIDO2 security keys, and interactive MFA
- Optional SSH jump hosts with separate credentials
Call List
Calls and sessions found from loaded data
TranslatorX separates standalone or embedded Unified CM CDR records from calls and sessions derived automatically from the signaling messages in the loaded traces.
SIP calls
Initial INVITEs are grouped by Call-ID with participants, result, duration, observed endpoints, and message counts. A selected call can be filtered, analyzed, or opened directly in Call Flow.
SIP sessions
Related call legs are correlated through explicit Session-ID and vendor identifiers, providing an end-to-end session summary without relying on phone-number or timing heuristics.
Unified CM CDR
Embedded and standalone CDR files remain available in their own tab with decoded disconnect causes, search, trace filtering, and complete record details.
Call Flow
Visualize message flows across products
Follow signaling chronologically as a call moves between endpoints, Unified CM, CUBE, Expressway, and service-provider systems. Select any row to inspect its decoded message while retaining the complete flow as context.
Remote Collection
Collect the right interval from the right systems
Saved connection profiles support focused historical collection, coordinated collection across products, bounded troubleshooting sessions, and real-time tracing.
Single-device collection
Collect a relative or absolute timeframe from one Unified CM, CUBE, or Expressway profile. A Unified CM publisher profile discovers and collects every cluster node.
Use when
The incident time is known and one product contains the evidence you need.
Products
Unified CM, CUBE, Expressway
Multi-device collection
Apply one relative or absolute timeframe to several saved profiles. Independent collectors run in parallel and the results open as one correlated timeline.
Use when
A known incident crossed product or network boundaries.
Products
Unified CM, CUBE, Expressway
Troubleshooting session
Select the participating systems, start the session, reproduce the issue, and stop. TranslatorX records the exact interval and coordinates Expressway diagnostic capture.
Use when
The issue can be reproduced now and the relevant devices are known.
Products
Unified CM, CUBE, Expressway
Live collection
Stream signaling from one or more CUBE and Expressway profiles. Incoming messages immediately update filters, call analysis, and open call-flow windows.
Use when
You need to watch signaling and calls while the issue occurs.
Products
CUBE, Expressway
Data handling
Local processing by default
Parsing, filtering, correlation, call-flow generation, and export run on the local computer. Remote collection connects only to profiles selected by the user.
Credentials and connections
Saved credentials are kept in the operating system credential manager. SSH host keys and HTTPS certificates that are not already trusted must be reviewed before use; accepted HTTPS certificates are pinned to the selected origin.
Optional AI analysis
Local Ollama analysis does not send trace evidence off the computer. Cloud providers receive evidence only after the user starts an analysis. Cloud identifier anonymization is enabled by default and can be disabled when organizational policy permits it.