GTP Packet Correlator for Mobile Network Traffic Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network visibility solutions are inefficient in correlating and filtering GTP and non-GTP packets in mobile core networks, leading to incomplete network monitoring and debugging capabilities due to the inability to accurately associate user and control plane sessions.
Innovation Solution
A system and method for correlating and filtering tapped GTP and non-GTP packets using a GTP and non-GTP packet correlator with a correlation module that receives packets from various tap points, extracts subscriber information, and forwards correlated packets to network monitoring tools, employing techniques such as pseudo tunnel endpoint identifiers and IP address association to ensure accurate session correlation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standard load balancers operate on outer IPs and ports of GTP packets, then traffic routing is simplified, but monitoring completeness deteriorates because encapsulated packets with inner IPs cannot be properly tracked
Solution Approach 1:
The patent introduces a correlator as an intermediary component between the load balancer and network monitoring tools. The correlator receives packets from multiple taps, extracts GTP TEIDs and subscriber information, correlates GTP user plane packets with control plane packets, and forwards correlated packets to monitoring tools. This mediator enables complete monitoring while maintaining routing simplicity.
2Productivity
If advanced load balancers operate stateless on subscriber inner-IP of GTP packets, then user plane traffic can be consolidated on the same tool, but control plane packets are generally flooded causing inefficiency
Solution Approach 1:
The patent segments the packet handling process into distinct phases: (1) receiving packets from multiple tap points, (2) extracting GTP TEIDs and subscriber information, (3) correlating GTP user plane packets with control plane packets, and (4) forwarding correlated packets to monitoring tools. This segmentation allows efficient user plane consolidation while managing control plane packets systematically rather than flooding them.
Solution Approach 2:
The correlator acts as an intermediary that selectively processes control plane packets by correlating them with user plane packets before forwarding to monitoring tools. This prevents unnecessary flooding of control plane packets while maintaining efficient user plane consolidation.
3Loss of information
If network taps are placed at all interfaces to obtain complete network view, then monitoring coverage is maximized, but packet correlation difficulty increases due to multiple tap points and packet types
Solution Approach 1:
The correlator serves as an intermediary component that receives packets from multiple network tap points, extracts relevant information (GTP TEIDs, subscriber IPs), correlates packets according to established rules, and forwards processed packets to monitoring tools. This mediator simplifies the complexity introduced by multiple tap points and packet types.
Solution Approach 2:
The patent extracts key identification fields (GTP TEIDs, subscriber IP addresses) from packets at the correlation point. By extracting these critical identifiers, the system can effectively correlate packets from multiple tap points without being overwhelmed by the complexity of processing all packet fields from all interfaces.
4Reliability
If GTP control and user plane sessions are correlated, then accurate subscriber traffic routing is achieved, but processing time increases due to additional correlation operations
Solution Approach 1:
The patent performs preliminary extraction of GTP TEIDs and subscriber information from packets as they pass through the correlator. By extracting and preparing this correlation data in advance during the packet reception phase, the subsequent correlation matching process is accelerated, reducing overall processing time while maintaining routing accuracy.
Data Source
AI summary
The subject matter described herein includes methods, systems, and computer readable media for correlating, load balancing and filtering tapped GTP and non-GTP packets. One method for correlating, load balancing and filtering tapped GTP and non-GTP packets includes receiving GTP packets tapped from a plurality of GTP network tap points. The method further includes receiving non-GTP packets tapped from at least one non-GTP network tap point. The method further includes correlating GTP packets with non-GTP packets for a particular subscriber. The method further includes forwarding the GTP packets and non-GTP packets correlated for the particular subscriber to a network monitoring tool.