Delivering Meaningful Context for Every Message

AGILITY performs a significant amount of intelligent processing to construct flows across different services in a way that any engineer, regardless of experience level, can easily understand and work with. However, there are situations where standards are not fully followed, traces contain noise, timestamps are inaccurate, or the capture quality is low. In these cases, certain messages may fall outside the main flow and remain uncorrelated, and in rare situations, a flow may even become fragmented.

While AGILITY continues to evolve and improve its ability to build accurate flows, Capture Insights ensures engineers always have full visibility into every message in the trace. It provides access to all messages considered during the analysis, allowing users to identify items that sit outside the flow, compare them against the complete capture, and build the full context needed to understand what is happening in the trace without relying on external tools or guesswork.

Use this view when:

You need a complete snapshot of all activity that surrounds or impacts a flow built by AGILITY.
You need the full message context beyond what’s shown in the call-flow diagram.
You want a complete view of both the messages AGILITY places within a flow and the messages that are not part of any flow but can still provide essential context, including errors or critical indicators.

In this guide, you will find:

Why Capture Insights Makes Troubleshooting Faster and More Accurate

Capture Insights provides a rich, context-aware view of your network messages, going far beyond a simple packet listing. It transforms raw data into meaningful, structured insights that directly support diagnostics, RCA, and performance investigations.

Content That Helps You Analyze Faster

Capture Insights gives you access to key information that helps you understand every message in your analysis. Some content is displayed by default, allowing you to view the most important details immediately. Additional content can be enabled when you require deeper insight.

The section below describes the types of content each provides, helping you tailor the view to your workflow.

The table below lists all columns in alphabetical order.

Column Name	Description	Default?

Column Name	Description	Default?
APN/DNN Class	Class or category of the APN/DNN, inferred from QoS when the APN/DNN Name is not available. e.g. ims, data, sos
APN/DNN Name	Access Point Name or Data Network Name used during the session.
Dialog ID (Dialog Identifier)	Links responses to their parent request within the same dialog.
Failure Indication	Indicates whether the message contains a failure or error condition.
Flow Capture Descriptor	Provides context on how the Elementary-Flow was correlated across protocols and interfaces.
Flow ID (Flow Identifier)	Identifies the Elementary-Flow, grouping related messages across protocols.
Flow Type	Human-readable description of the correlated Elementary-Flow (e.g., “4G SIP Registration”).
Frame	Raw capture frame number used to track message order. This can’t be hidden from the ui.
IMEI	International Mobile Equipment Identity of the device.
Interface	Network interface where the message was transmitted.
Message	Core message content exchanged between network elements.
Message Hints	Displays contextual hints extracted from the message, when available.
Message Type	High-level classification of the message (request, response, notification, etc.).
Network Elements	Lists the source and destination network elements involved in the message.
Procedure	Identifies synchronous events within an Elementary-Flow (e.g., Attach, Detach).
Protocol	Protocol used in the message exchange (e.g., SIP, HTTP/2, GTPv2).
RAT Type	Radio Access Technology of the message (e.g., 4G, 5G).
Response Description	Description associated with the response code.
Response Success	Indicates whether the response was successful.
Session ID (Session Identifier)	Protocol-level identifier linking dialogs to a parent session.
Status	Shows whether the message is successful, failed, or contains an error.
SubSession Index	Unique index identifying each subsession instance.
SubSession Type	Logical grouping category within a session (e.g., EMM, ESM, H2SM, CALL).
Subscriber	Displays subscriber identifier in the format IMSI/MSISDN.
Timestamp	The time the message was captured (displayed as hh:mm:ss.ms).
UE IPv4	The IPv4 address assigned to the subscriber device.
UE IPv6	The IPv6 address assigned to the subscriber device.

Enriched Message Interpretation

Capture Insights automatically interprets and enriches messages to reflect their actual intent and function in the network.
For example, SIP messages are classified into their true operational meaning—such as REGISTER, RE-REGISTER, DE-REGISTER, INVITE, giving you immediate clarity without manual decoding.

Intelligent Network Function Resolution

Where possible, AGILITY resolves Network Elements and identifies whether they are serving the originating or terminating side of a call or session. This context helps you understand directionality and sequence at a glance.

3GPP-Aware HTTP/2 Message Mapping

In 5G, where HTTP/2 is central and JSON-based structures can be difficult to interpret or even read, AGILITY simplifies the process by presenting essential information up front. It helps users quickly understand services, roles, and key attributes without needing to manually decode or convert complex structures that may contain critical details.

For example:
/npcf-smpolicycontrol/v1/sm-policies is presented as POST_npcf-smpolicycontrol_CreateSMPolicy, making the message’s meaning immediately clear.

Session and Sub-Session Grouping

This feature supports flexible grouping and sub-grouping, allowing engineers to dynamically filter and narrow the analysis using key attributes such as:

IMSI and IMEI
APN
UE IP Address
Interfaces, and more.

This grouping provides a complete view of how messages relate to one another, ensuring that engineers can quickly isolate patterns, anomalies, and protocol-level behaviors within the flow.

Beyond attribute-based grouping, AGILITY also organizes traffic into sessions and sub-sessions that reflect how real mobile networks operate.
4G, 5G, and IMS architectures are composed of Network Functions that communicate through well-defined interfaces and protocols. Each protocol manages multiple independent “streams” for the same subscriber, and each of these streams represents a distinct aspect of user activity.

For example:

S1AP / NAS-EPS (4G) handles both:
- Mobility-management — attach and authorization
- Session-management — establishing APN/DNN tunnels that connect the user to IMS or data networks
NGAP / NAS-5GS (5G) handles both:
- Mobility-management — registration and authorization
- Session-management — PDU session setup and APN/DNN connectivity
HTTP/2 supports multiple parallel user-level streams, such as:
- mobility-management
- session-management
- SMS-management
- IMS-related control
SIP also carries multiple independent streams for the same subscriber, including:
- SIP registration
- Third-party registration
- Notifications
- Voice call signaling
- SMS over SIP

Each of these protocol-specific streams is represented as a sub-session within a protocol session, providing engineers with a structured, accurate model of the user’s end-to-end activity.

Together, attribute filtering + session/sub-session grouping provide a unified analytical view, making it easier to trace behaviors, validate flows, and understand how events correlate across network planes and protocols.

Built-In Diagnostic Indicators

Capture Insights exposes additional information that supports troubleshooting, for example:

MESSAGE_HINTS surface important indicators extracted from requests and responses, including:
- In S1AP, a UEContextReleaseRequest may be sent from the eNB to the MME for several reasons. One example is the cause radioNetwork-cause::radio-connection-with-ue-lost.
  This cause will appear in the MESSAGE_HINTS column for that specific request.
- In DIAMETER-Gx, a Credit-Control Request may be issued from the PGW to the PCRF for different purposes, including notifying the PCRF that a requested RESOURCE ALLOCATION has failed.
  In this case, the following cause/reason details will appear in the MESSAGE_HINTS column for that request:
  {"ChRR_failure_code": "RESOURCE_ALLOCATION_FAILURE",
  "ChRR_name": ["Default_Signalling_Rule0585D8B8"],
  "ChRR_status": "ACTIVE"}
The STATUS column highlights conditions that help you spot anomalies faster, including:
- Identification of proxy-duplicate messages in both HTTP/2 and DIAMETER flows.
- Header-related exceptions detected during HTTP/2 decoding, such as:
  - Requests missing a “path” header
  - Requests where the method is UNKNOWN
  - Messages missing path, method, and status headers — making it impossible to determine if the message is a request or a response

These indicators surface issues automatically, reducing the need for deep manual inspection during troubleshooting.

How to Access the Capture Insights

After your analysis completes successfully:

Go to the Analysis Hub page.
Select your desired analysis from the dropdown list.
In the top action bar, click Capture Insights.
Capture Insights Access
The Capture Insights table opens, showing all detected messages for that analysis.

Working With the Capture Insights Table

Understanding the Page Content

The Capture Insights table presents all messages evaluated during correlation and provides several tools to help you effectively interpret and navigate the data.

Capture Insights: Understanding the Page Content

N.	Name	Description

N.	Name	Description
1	Correlated vs. Uncorrelated Messages	Messages are visually differentiated based on their correlation status: Correlated messages display solid connectors and indicate the flow type to which they belong. Uncorrelated messages are displayed with dashed connectors, indicating they do not belong to any flow.
2	Filtering by Message Type	You can refine the list by choosing one of the available message-type filters: Uncorrelated messages only All flows Errors only All messages (default view)
3	Timestamp Format Options	The table supports multiple timestamp formats, allowing you to choose the format most useful for your analysis: Epoch time From the start (relative to the beginning of the message) Delta (difference from the previous message) Readable (standard human-readable format)
4	Sharing Report	A sharing option is available for exporting or sharing the Capture Insights report, enabling collaboration or offline review. See the full details about this capability here.
5	Highlighting Specific Rules	Users can create custom highlighting rules to emphasize specific messages or patterns. These rules can be based on attributes, values, or conditions, enabling you to spot items of interest. See the full details about this capability here.
6	Column Management	You can tailor the table layout to your needs by managing which columns appear in the view. Below this section, a table can list: Default columns (shown automatically) Additional available columns (optional, user-selectable) See the full details about this capability here.
7	Protocol Color Coding	Protocols are represented using color-coded chips, making it easier to identify message types at a glance throughout the table.

Using Additional Tools

Sharing the Report

The Share Report option allows you to export or share the current Capture Insights results for collaboration or offline review.

Capture Insights: Share Report

With this feature, you can:

Share a direct link to the analysis with colleagues who already have AGILITY access. This ensures they see the filtered and customized view exactly as you configured it.
Customize the table before sharing or exporting by selecting which columns you want to appear in the report.
Export the data in your preferred file format — either .xlsx or .csv — for further processing, investigation, or documentation outside of AGILITY.

Column Management

Column Management enables you to personalize the table layout, allowing you to see only what matters to your analysis.

Capture Insights: Manage Columns

Once you open the Manage Columns panel, you can:

Hide a column by clicking the remove icon next to its name.
Hide Columns
Show a column by clicking the add icon next to its name.
Show Columns
Reorder columns by dragging and dropping the entire row to your preferred position.
Reorder Columns

The table below lists all columns in alphabetical order.

Column Name	Description	Default?

Column Name	Description	Default?
APN/DNN Class	Indicates the class or category assigned to the APN/DNN.
APN/DNN Name	Displays the Access Point Name or Data Network Name used in the session.
Dialog ID	Shows the unique dialog identifier used in protocol dialogs (e.g., SIP).
Failure Indication	Highlights error causes or failure codes contained in the message.
Flow Capture Descriptor	Provides metadata about how the flow was detected or categorized.
Flow ID	Displays the unique identifier of the flow to which the message belongs.
Flow Type	Indicates the type of flow the message belongs to (e.g., Registration, Session).
IMEI	Shows the device’s International Mobile Equipment Identity.
Interface	Identifies the network interface used by the message (e.g., N2, N3, S1).
Message	Provides a summary of the message content, method, or event.
Message Hints	Displays contextual hints extracted from the message, when available.
Message Type	Provides the high-level category or protocol-specific type of the message.
Network Elements	Lists the source and destination network elements involved in the message.
Procedure	Indicates the network procedure related to the message (e.g., Attach, Handover).
Protocol	Shows the protocol used (e.g., SIP, GTP, HTTP/2).
RAT Type	Indicates the Radio Access Technology (e.g., 4G, 5G).
Response Description