Mobile Network Traffic captuing and Distributing Solution
1.1 Application background
With the coming of digital communication era, there have emerged more and more new technologies and solutions. A connection involves all equipments in the networks. As the information among the interfaces appear as segments, so the analysis of a user action or network quality/efficiency needs to be systematical with the combination of information from multiple interfaces.
The biggest difference of mobile communication network from fixed network is: good mobility of access users and signal quality fluctuations due to location or even time. To locate and analyze a user action, you should obtain the dynamic information (signal and user data) from multiple interfaces in the local networks or roaming networks.
However, from so many interfaces of different types and different locations, how to obtain the information needed from large amounts of data and how to collect them to send to service analysis platform together.
With the development of the SoftSwitch technology and IMS, the Mobile Network step into the IP bearer era, Traffic capture of whole network step at a higher layer, and face some new challenge: capture device not only supports traffic capture, but also solves L2~L7 traffic identification in various interfaces or various protocols, flexible collection and forwarding feature, and multi service.
The mobile-oriented capture solution composed of ExTAP and ExProbe developed by EmbedWay may perfectly fit demands of the Mobile Network detection and maintenance.
1.2 Product Introduce
ExProbe3810/3820 is two Ethernet/IP traffic capture equipments, which targeted for traffic sniffer of high density Ethernet links in carrier networks.。
ExProbe3800 supports 24 Gigabit Ethernet ports in SFP or RJ45, which can be configured as either traffic input or output. The SFP port can be configured with SM/MM modules, supporting single-fiber receive-only working mode. And the RJ45 port supports 10/100/1000M auto-negotiation. A main feature of ExProbe3800 is supporting classification and filtering based on L3~L7 information and forwarding in load-balance mode among output ports. For the difference, ExProbe3810 supports one 10GBase-CX4 cascade port, and ExProbe3820 supports two 10GE XFP ports.
ExTAP2480 is new intelligent equipment for signal capture and distributing. It features in high port density, diversified protocol identification and convenient management and maintenance, and provides effective signal for network protocol analyzers and signal analyzers based on needs in real time.
Through analyzing the features of various signal protocols, ExTAP2480 filters or forwards packets for the selective signal monitoring in order to meet the operators' requirement of “more captured less monitoring”. Then the end-to-end monitoring and maintenance of the whole networks can be accomplished only with limited investment.
ExTAP 3400/3420 supports TAP based on GE.
2. Capture solutions for different interfaces
Fig.1 capture in GSM/WCDMA system
Fig.2 capture in CDMA2000 system
2.1 Mc interface/ (xx)
The Mc interface between Msc Server and Media Gateway contains not only H.248 but also RANAP signal with RNC. Mc interface type is FE 100M-electrical commonly.
First is the traffic tapping. Some Msc Server and Media Gateway share a datacenter. ExTAP2480 is serially connected between Msc Server and Media Gateway. When providing two-way data for these two equipments, it duplicates all two-way traffic to the specified ports to forward to other equipments.
When it is capturing and distributing traffic by serially connection, ExTAP2480 also accepts the mirroring data from the switchboards nearby for the unified output.
ExTAP not only enables capture and distribution, but also can filter. It can pre-process the traffic captured according to filtering rules, like only forwarding matched traffic or discarding part of traffic.
For the signal transmission involving RNC/ Msc Server/ Media gateway, Mc is of great importance. Features like zero-time-delay, lossless transmission and interruption-free power failure protection enable ExTAP to confirm the safety and reliability of Mc communication. When concatenated directly, ExTAP will transmit the link fault information correctly from the one end to the other, regardless of the source of failure.
When Msc Server is connected with MGW through switchboard, the tapping mode of ExTAP can be applied, or the mode of capturing by ExTAP or ExProbe after mirroring output through switchboard can be used.
2.2 Nb interface/ (yy include zz)
Nb interface locates among circuit domain Media Gateways, and transmits interoffice voice through RTP and RTCP. The links are GE optical ports commonly. The links of Nb interface also contain Nc interface signal used for interoffice interaction diverted through Media Gateway.
As Media Gateway is deployed dispersedly and only connects with tandem exchange and gateway, the links of Nb interface will be connected with other offices through LAN Switch.
Generally, traffics of Nb interface are captured by ExProbe though optical splitter. In small networks, when mirroring output ports of switchboard are FE, they can be connected to ExTAP for the unified output.
Specially mention that both ExTAP and ExProbe can combine five-tuple and other matching rules for the obtaining and filtering of RTP/RTCP protocols.
2.3 Gn interface/(R-P)
Gn interface locates among packet domain core-network equipment SGSN and other network units, and transmits signal and data through GTP protocol. The link type is GE optical generally. SGSN can be connected with other SGSN and GGSN. The interface between SGSN and RNC isn't Gn interface, but enables bearing by GTP/IP protocol.
So the capture of links around SGSN will contain all signal and data involved in PS domain. As referred before, these links are GE, traffic can be captured and distributed directly using ExProbe, or output to ExProbe through the switchboard mirroring 10G port.
According to the filtering and forwarding rules issued by up-layer application, ExProbe can locate GTP signal and data of specified users and pre-process them, improving the processing performance of up-layer indirectly.
For PDSN of CDMA core-network, ExProbe not only enables traffic capture, but also enables the identification, filtering and forwarding of GRE as the way to GTP.
2.4 Gi interface (Or Pi)
Gi locates between GGSN and external Internet, in CDMA that is Pi between PDSN and Internet. According to the size of local network and statistics difference of user action, output links between GGSN (PDSN) and Internet are mostly GE, 10GE, and the data is the pure IP different from other interfaces.
So the traffic capture of this interface is the traditional. For GE/10GE interface, traffic can be captured using ExProbe by mirroring or optical splitter.
3. Solutions for the next generation
The features of the next generation are: Access network operating over IP bearer, unified core-network, multi-service coexistence, and mobile IP. IMS is a typically achieved example, so the traffic capture system for the next generation should cover all applications when capturing full-network information, and intelligently match the service types according to the back-end service needs and then output them as needed.
The mobile-oriented capture solution composed of ExTAP and ExProbe, support capture traffic from all IP links, and even is a capture solution to next generation network.
3.1 Support multi-service concurrent
The mobile-oriented capture solution composed of ExTAP and ExProbe has following features: work as unified capture & distribution platform, supporting the coexistence of multi-manufacturer, multi-system and multi-service of the backstage.
1. Support the match according to five-tuple, feature domain and floating string.
2. Various load balancing and duplication mechanism
3. Detection targeted for signal type: RANAP/BICC/H.248 and MAP, SIP
4. Detection targeted for service type: Video/Voice/Data
So with the matched filtering rules above, in the unified capture platform the system can output the traffic to the corresponding service analyzing system according to specified rules. For example, it obtains the specified Gn interface data between two SGSN by five-tuple filtering and GTP protocol identification for the network-action analysis across service areas.
In IMS core-network, multiple services coexist and they are controlled by various SIP messages. Both ExTAP and ExProbe can identity SIP protocol, according to which to forward messages and data to the specified service analyzing systems.
3.2 Unified management
All EmbedWay products (including ExTAP and ExProbe) can be managed by the unified network management platform, such as data configuration, system maintenance and fault notice. They can also be managed by other network management equipments through the standard SNMP protocol.
And the full-network capture system composed of ExTAP and ExProbe can be regarded as a network unit when managed. Thus the reversed lookup initiated by the back-end service will become more convenient.
3.3 Entire capture
Currently, there has been several enterprises using the full-network capture and distribution solution composed of ExTAP and ExProbe for the analysis and monitoring of mobile service.
Analysis system of the whole mobile network, applies the solution, specially targeted for the simultaneous capture of access network and core network, to realize the positioning analysis of the whole process problems of specified users and specified services, enabling the network optimization and analysis to be processed based on the whole network. As a result, the efficiency of the whole network has been improved greatly and the time for solving problems has been reduced.
Gi/Pi interface traffic control, applies the solution, by the traffic analysis at Gi/Pi interface and by obtaining location information (the relationship among IP, BTS and cell) through analyzing Gn/RASAP, to realize the traffic control at Gi/Pi interface and to realize the equitable resources distribution at the air interface side.
According to the difference of service strategies, two kinds of traffic control can be supported at Gi/Pi: one is that based on user actions introduced above, the other is that based on global service type.