User Plane Monitoring for a Mobile Network Operator (MNO)

Jan 2018

www.cubro.com

The challenges

• Growing traffic • High costs • Complicated network architecture

The Cubro solution

• Traffic filtering on user IP address• Traffic filtering on subscriber’s IMSI and MSISDN• GTP tunnel removal for monitoring• Generation of XDRs and CDRs which are sent to the Big Data

User Plane Monitoring for a MNO

Business benefits

• Guaranteed 100 % output of the Packetmaster

• Increased return on investment because the Packet Switch (PS) Probe is most powerful and cost effective compared to any other probe in the market

• Cost effective and highly scalable solution

User Plane Monitoring for a MNO

GTP inner IP range filtering

Cubro G5 devices (EXA32100 and EXA48600) are the only network packet brokers on the market which can do inner IP filtering in hardware at full line speed.

Cubro offers the most cost efficient solution:

● Usually the S1U interfaces are the most loaded on a mobile network

● Other Vendors can do this task only in expensive CPU solutions

● Cubro devices can do up to multiple TB inner IP range and unique IP filtering & load balancing

● The EXA32100 provides all kinds of relevant interface for this task (32 x 100 Gbit, 32 x 40 Gbit, 128 x 25 Gbit, 128 x 10 Gbit)

GTP inner IP range filtering

A simple and scalable solution to offload irrelevant traffic from the probes and save costs

GTP inner IP load balancing

Cubro G5 devices (EXA32100 and EXA48600) are the only network packet brokers on the market which can do GTP inner IP load balancing in hardware at full line speed.

Cubro offers the most cost efficient solution:

● Usually the S1U interfaces are the most loaded on a mobile network

● Other Vendors can do this task only in expensive CPU solutions

● Cubro devices can do up to multiple TB inner IP range and unique IP filtering & load balancing

● The EXA32100 provides all kinds of relevant interface for this task (32 x 100 Gbit, 32 x 40 Gbit, 128 x 25 Gbit, 128 x 10 Gbit)

● We need this feature for the next two solutions - IMSI filtering and user plane monitoring

GTP inner IP load balancing

Load balancing based on the inner IP hashof the GTP tunnel

The solutions for this issue is not to monitor the user plane but instead filter and monitor only specific users/devices. Filtering on a particular customer in a highly loaded LTE network is difficult and expensive. However, Cubro offers solutions which can maximise your return on investment. With the advanced features of Cubro EXA32100 and EXA48600 platform in combination with EXA24160 and the technologies from the Cubro probing business, the user can solve this issue. Cubro offers a combined solution to do IMSI filtering on highly loaded networks which provide customer satisfaction and reduces costs of monitoring.

IMSI Filtering

Monitoring user plane in LTE networks involves two problems:

● traffic growth/volume ● legal issues

IMSI filtering solution up to 240 Gbit and up to 1 million IMSI In this application, first the user plane traffic is load balanced by EXA32100 and then the control plane is broadcasted to all units. Then the EXA24160 does the correlation and the IMSI filtering. The output is control and user plane for the relevant (filtered) traffic.

User Plane Monitoring

User plane monitoring is a hot topic. It is not only important and useful for technical purpose, but it is also possible to generate additional revenue for the MNO. The flip side of the coin is the price, and complexity.

The solution is the Cubro Probes, and the advanced load balancing feature of the EXA32100. The combination of these two devices helps to reduce the costs and enhance the performance for customers who have an existing control plane monitoring solution.

Several major MNOs use Cubro solution to add the user plane monitoring to off-load the existing control plane monitoring.

Cubro Probe Solution

TAP (Layer 1)

NPB (Layer 2 - 6) aggregation and load balancing

Probing and meta data extraction (some of the meta data from the Probes are forwarded back to NPB for load balancing)

Existing Control Plane Monitoring solution

Tapping, Aggregation, load balancing, inner IP filtering and monitoring solution

Mongo DB

Probe

Raw Packet Data

XDR as UDP stream real-time

Mongo DB(Short term storage)

Real-time trouble shooting and raw packet capture

Big Data

Probe

Kafka InstancesKafka InstancesKafka Instances

Kafka Instances& Cubro Interface

Elastic search Hadoop IBM Q

Radar

Many supported

outputs

Currently, the Apache Kafka (a distributed streaming platform) supports up to 50 different connectors to interconnect between several data sources like the Cubro Probe.

Some examples include: Vertica, Syslog, Hadoop, SQL, Hbase, InfluxDB, Hazelcast, S3, DynamoDB, Splunk …

Raw capture

Big Data Integration in Mobile Networks

EXA48600

Packet load 2.16 Tbps

Ports 10 Gbit 48 SFP+

Ports 100 Gbit 6 QSFP28

GUI WEB/CLI/GUI

Packet buffer YES 24 MB

Delay < 700 ns

Dual Power YES

(Management ports on the back)✓ VLAN tag/detag / Q in Q✓ Header modification Layer 4✓ GTP inner IP load-balancing✓ GTP inner IP hashing✓ GTP header stripping✓ GRE decapsulation✓ VXLAN decapsulation✓ MPLS detag✓ All ports activated✓ All software activated✓ Low power design✓ 8000 IPv4 - 5 tuple filter rules✓ 4000 IPv6 - 5 tuple filter rules

EXA32100

✓ VLAN tag/detag / Q in Q✓ Header modification Layer 4✓ GTP inner IP load-balancing✓ GTP inner IP hashing✓ GTP header stripping✓ GRE decapsulation✓ VXLAN decapsulation✓ MPLS detag✓ All ports activated✓ All software activated✓ Low power design✓ 8000 IPv4 - 5 tuple filter rules✓ 4000 IPv6 - 5 tuple filter rules

Packet load 3,2 Tbps

Ports 40 Gbit 32 QSFP

Ports 100 Gbit 32 QSFP28

GUI WEB/CLI/GUI

Packet buffer YES 24 MB

Delay < 700 ns

Dual Power YES

112 x 10 Gbit (with breakout cable) + 4 x 100 Gbit128 x 10 Gbit (with breakout cable)

(Management ports on the back)

128 Ports 10/25 Gbit

Each of the 32 ports of EXA32100 can be used as 100 / 40 Gbit or in split mode in 4 x 10 or 4 x 25 Gbit.

In total you can reach 128 x 10 Gbit ports in one unit.

This can be done with breakout cables, breakout box, or special TAP version.

Cubro 2G/3G/4G/5G PS Domain Monitoring Probe

Network meta data extraction

Hardware based solution for Cavium/ARM multicore

DPI, Mobile Probing solution, mobile XDR

Different types of Cubro Probe

Performance 10 Gbps (1 CPU) Performance 20 Gbps (2 CPU)

Performance 60 Gbps (2 CPU)Performance 30 Gbps (1 CPU)

NG Probe > 100 Multicore ARM based solution

Performance 250 Gbps (2 CPUs)

4 x 100 Gbit interface

GA end 2018

Cubro Product Portfolio

ProbesMobile Probes and FlowVista

Network Packet BrokersPacketmasters & Sessionmasters

TAPsOptical, BIDI, Copper, Flex, Converter, Aggregation

BypassOptical and Copper

Misc.Breakout boxes and Media Converters

Thank you

EMEA

Cubro Network VisibilityGhegastraße 1030 Vienna, Austria

Tel.: +43 1 29826660Fax: +43 1 2982666399

Email: support@cubro.com

Cubro US337 West Chocolate AveHershey, PA 17033

Tel.:717-576-9050Fax.: 866-735-9232

Email: support@cubro.com

Cubro Asia Pacific

8, Ubi Road 2 #04-12 Zervex Singapore 408538

Tel.: +65-97255386

Email: jl@cubro.com

North America APAC Japan

Cubro Japan

8-11-10-3F, Nishi-Shinjuku, Shinjuku, Tokyo, 160-0023 Japan

Email: japan@cubro.com