Proactive and intelligent packet capturing for a mobile packet core

1. A method comprising:

storing historical information for a session of a user equipment (UE) within a mobile network;

detecting an anomaly associated with the session of the UE based on the historical information stored for the session of the UE; and

activating a first trace for the session of the UE at a first data-path network element based on detecting the anomaly associated with the session of the UE, wherein activating the first trace comprises communicating a first trace activation notification to the first data-path network element, wherein the first trace activation notification causes the first data-path network element to capture packet information for a data packet flow associated with the session of the UE and causes the first data-path network element to activate a second trace for the session of the UE at a second data-path network element via a second trace activation notification that is to be included in an extension header for at least one encapsulated packet, the at least one encapsulated packet to be communicated from the first data-path network element to the second data-path network element.

2. The method of claim 1 , wherein the first data-path network element at which the first trace is activated is one of:

a serving gateway (SGW); or

a packet data network gateway (PGW).

3. The method of claim 1 , wherein the detecting is performed by an anomaly detection application that is external to the first data-path network element and the second data-path network element.

4. The method of claim 3 , wherein the historical information stored for the session of the UE is obtained from one or more control plane network elements of the mobile network or one or more user plane network elements of the mobile network.

5. The method of claim 1 , wherein the first trace activation notification comprises an identifier for the session of the UE and a tracing level indicator for the first trace.

6. The method of claim 1 , wherein the historical information stored for the session of the UE further comprises:

an International Mobile Subscriber Identity (IMSI) for the UE;

location information for the UE;

Radio Access Technology (RAT) type information for the session of the UE;

call termination information for the UE; and

timestamp information for one or more events associated with the session of the UE.

7. The method of claim 6 , wherein the anomaly associated with the session of the UE is detected based on at least one of:

determining, based on the RAT type information and the timestamp information, frequent RAT type switches for a period of time;

determining, based on the location information, that the UE is in an abnormal location;

determining, based on the location information, that the UE is entering a cell area associated with anomalies;

determining, based on the call termination information for the UE and the timestamp information for one or more events associated with the session of the UE, frequent call terminations for a period of time; and

determining, based on the timestamp information, frequent session establishment rejections.

8. The method of claim 1 ,

wherein the extension header is a user plane General Packet Radio Service (GPRS) Tunneling Protocol (GTP-U) extension header and the at least one encapsulated packet is at least one GTP-U encapsulated data packet.

9. The method of claim 8 ,

wherein the GTP-U extension header includes a first content field comprising an indicator for the second trace activation notification.

10. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to perform operations, comprising:

storing historical information for a session of a user equipment (UE) within a mobile network;

detecting an anomaly associated with the session of the UE based, at least in part, on the historical information stored for the session of the UE; and

activating a first trace for the session of the UE at a first data-path network element based on detecting the anomaly associated with the session of the UE, wherein activating the first trace comprises communicating a first trace activation notification to the first data-path network element, wherein the first trace activation notification causes the first data-path network element to capture packet information for a data packet flow associated with the session of the UE and causes the first data-path network element to activate a second trace for the session of the UE at a second data-path network element via a second trace activation notification that is to be included in an extension header for at least one encapsulated packet, the at least one encapsulated packet to be communicated from the first data-path network element to the second data-path network element.

11. The media of claim 10 , wherein the detecting is performed by an anomaly detection application that is external to the first data-path network element and the second data-path network element.

12. The media of claim 11 , wherein the historical information stored for the session of the UE is obtained from one or more control plane network elements of the mobile network or one or more user plane network elements of the mobile network.

13. The media of claim 10 , wherein the first trace activation notification comprises an identifier for the session of the UE and a tracing level indicator for the first trace.

14. The media of claim 10 , wherein the historical information stored for the session of the UE further comprises:

an International Mobile Subscriber Identity (IMSI) for the UE;

location information for the UE;

Radio Access Technology (RAT) type information for the session of the UE;

call termination information; and

timestamp information.

15. The media of claim 10 , wherein the extension header is a user plane General Packet Radio Service (GPRS) Tunneling Protocol (GTP-U) extension header and the at least one encapsulated packet is at least one GTP-U encapsulated data packet.

16. The media of claim 15 ,

wherein the GTP-U extension header includes a first content field comprising an indicator for the second trace activation notification.

17. A system comprising:

at least one memory element for storing data; and

at least one processor for executing instructions associated with the data, wherein executing the instructions causes the system to perform operations, comprising:

storing historical information for a session of a user equipment (UE) session within a mobile network;

detecting an anomaly associated with the session of the UE based on the historical information stored for the session of the UE; and

activating a first trace for the session of the UE at a first data-path network element based on detecting the anomaly associated with the session of the UE, wherein activating the first trace comprises communicating a first trace activation notification to the first data-path network element, wherein the first trace activation notification causes the first data-path network element to capture packet information for a data packet flow associated with the session of the UE and causes the first data-path network element activate a second trace for the session of the UE at a second data-path network element via a second trace activation notification that is to be included in an extension header for at least one encapsulated packet, the at least one encapsulated packet to be communicated from the first data-path network element to the second data-path network element.

18. The system of claim 17 , wherein the first data-path network element at which the first trace is activated is one of:

a serving gateway (SGW); or

a packet data network gateway (PGW).

19. The system of claim 17 , wherein the detecting is performed by an anomaly detection application that is external the first data-path network element and the second data-path network element.

20. The system of claim 17 , wherein the extension header is a user plane General Packet Radio Service (GPRS) Tunneling Protocol (GTP-U) extension header and the at least one encapsulated packet is at least one GTP-U encapsulated data packet.