Correlating tapped general packet radio service (GPRS) tunneling protocol (GTP) and non-GTP packets for a subscriber's session for load balancing and filtering monitored traffic in a mobile network
View Patent ↗The subject matter described herein includes methods, systems, and computer readable media for correlating, load balancing and filtering tapped GTP and non-GTP packets. One method for correlating, load balancing and filtering tapped GTP and non-GTP packets includes receiving GTP packets tapped from a plurality of GTP network tap points. The method further includes receiving non-GTP packets tapped from at least one non-GTP network tap point. The method further includes correlating GTP packets with non-GTP packets for a particular subscriber. The method further includes forwarding the GTP packets and non-GTP packets correlated for the particular subscriber to a network monitoring tool.
1. A method for correlating and filtering tapped general packet radio service (GPRS) tunneling protocol (GTP) and non-GTP packets, the method comprising:
receiving GTP packets tapped from a plurality of GTP network tap points;
receiving non-GTP packets tapped from at least one non-GTP network tap point; and
correlating GTP packets with non-GTP packets for a particular subscriber; and
forwarding the GTP packets and non-GTP packets correlated for the particular subscriber to a chosen network monitoring tool.
2. The method of claim 1 wherein receiving the GTP packets includes receiving GTP control plane and/or GTP user plane packets.
3. The method of claim 1 wherein the GTP packets are received from at least one of an S11, S5/8, S12, S4 or Gn interface and wherein the non-GTP packets are received from at least one of a Gi or SGi interface.
4. The method of claim 1 wherein correlating the GTP and non-GTP packets includes identifying an IP address for the subscriber from a GTP control plane message and using the IP address as a pseudo tunnel endpoint identifier to identify non-GTP packets involving the subscriber.
5. The method of claim 1 wherein correlating the GTP and non-GTP packets includes comparing at least one IP address in the non-GTP packets to a table of IP addresses stored as pseudo tunnel endpoint identifiers.
6. The method of claim 5 comprising using at least one parameter associated with the non-GTP packets to determine whether to perform a lookup in the table based on a source IP address, a destination IP address or both the source and destination IP addresses in a non-GTP packets.
7. The method of claim 1 comprising filtering the GTP and non-GTP packets to be correlated based on session or subscriber attributes.
8. The method of claim 1 comprising filtering the GTP and non-GTP packets to be correlated based on bearer attributes.
9. The method of claim 1 wherein correlating the GTP and non-GTP packets includes using a GTP tunnel endpoint identifier to identify the GTP packets.
10. The method of claim 1 wherein forwarding the GTP and non-GTP packets to a network monitoring tool includes forwarding GTP and non-GTP packets associated with the same session to the network monitoring tool.
11. A system for correlating and filtering tapped General Packet Radio Service (GPRS) Tunneling Protocol (GTP) and non-GTP packets, the system comprising:
a GTP and non-GTP packet correlator, the GTP and non-GTP correlator including:
at least one processor; and
a GTP and non-GTP correlation module implemented by the at least one processor for receiving GTP packets tapped from a plurality of GTP network tap points, for receiving non-GTP packets tapped from at least one non-GTP network tap point, for correlating GTP packets with non-GTP packets for a particular subscriber, and for forwarding the GTP packets and non-GTP packets correlated for the particular subscriber to a network monitoring tool.
12. The system of claim 11 wherein receiving the GTP packets includes receiving GTP control plane and GTP user plane packets.
13. The system of claim 11 wherein the GTP packets are received from at least one of an S11, S5/8, S12, S4 or Gn interface and wherein the non-GTP packets are received from at least one of a Gi or SGi interface.
14. The system of claim 11 wherein correlating the GTP and non-GTP packets includes identifying an IP address for the subscriber from a GTP control plane message and using the IP address as a pseudo tunnel endpoint identifier to identify non-GTP packets involving the subscriber.
15. The system of claim 11 wherein correlating the GTP and non-GTP packets includes comparing at least one IP address in the non-GTP packets to a table of IP addresses stored as pseudo tunnel endpoint identifiers.
16. The system of claim 15 comprising using at least one parameter associated with the non-GTP packets to determine whether to perform a lookup in the table based on a source IP address, a destination IP address or both the source and destination IP addresses in a non-GTP packets.
17. The system of claim 11 comprising filtering the GTP and non-GTP packets to be correlated based on bearer type.
18. The system of claim 11 wherein correlating the GTP and non-GTP packets includes using a GTP tunnel endpoint identifier to identify the GTP packets.
19. The system of claim 11 wherein forwarding the GTP and non-GTP packets to a network monitoring tool includes forwarding GTP and non-GTP packets associated with the same session to the network monitoring tool.
20. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
receiving GTP packets tapped from a plurality of GTP network tap points;
receiving non-GTP packets tapped from at least one non-GTP network tap point; and
correlating GTP packets with non-GTP packets for a particular subscriber; and
forwarding the GTP packets and non-GTP packets correlated for the particular subscriber to a network monitoring tool.