Patent Application
20100211675
The invention relates to a system for analysing the data transferred in the networks, especially the ones provided with packet radio characteristics for the mobile terminals. The aim is to monitor the traffic in a network, measure the network capability and also debug transfer failures in the network. The system comprises both a method and an arrangement to implement the method.
The data transfer rate in the mobile communications networks has risen, and likewise the amount of the user data to be transferred has increased strongly. This means that tracking and analysing the data transferred in the networks, or network data, has become more demanding. So-called protocol analysers are used to this end. Publication US 2008/0037435 discloses an example of such a protocol analyser. It sniffs network data and debugs transfer failures in the communications networks. The analyser utilizes both internal events of a communication device and signalling messages transferred in a communications network. The internal events and external signalling messages are combined, or correlated for speeding up the debugging.
However, the capability of the known analysers, like the one mentioned above, is inadequate to handle high speed traffic, because all data is decoded from down layer to top. One solution is to use filters which limit the amount of data taken into analysis. However, filtering makes complete analysis impossible, because only part of network data is analysed, thus for instance the user plane cannot be analysed at all. Another way of getting around the limitation is to capture all of the network data and then analyse traffic in post processing. However, the post process cannot handle all of the data, because the time needed for analysis is longer than the duration of the analysed traffic, so only a part of the traffic can be analysed.
The ‘user plane’ relates to the data, the transfer of which from/to a user equipment through network(s) is ultimately in question. The ‘control plane’ relates to the signalling, by which the connections in the networks are established, supervised and terminated.
The object of the invention is to implement the network data analysis in a new way, which alleviates the flaws associated with the prior art. The invention utilises the fact that though the amount of user plane traffic and data is increasing fast, the amount of signalling traffic is hardly increasing at all. On the contrary, the newest standards try to reduce the signalling traffic in order to shorten the time needed for establishing and terminating the sessions. In the system according to the invention the analysis of the user plane traffic and data and the analysis of the control plane traffic and data are done separately. The separate analysis results are then combined by certain criteria and the combined data is shown.
An advantage of the invention is that it makes possible at least nearly a real-time network data analysis also in the networks with high speed traffic.
The invention is described below in detail. Reference will be made to the accompanying drawings where
The control plane analysis 104 requires only moderate processing power so that it can be performed with usual protocol analysers like NetHawk M5. Modifying such a protocol analyser to act as a part of analysing arrangement is a relatively straightforward task.
The user plane analysis 102 requires performance optimized detailed protocol analysis applications. Nowadays these kinds of applications are found for example in IP (Internet Protocol) network flow monitors, which, combined with a special high performance network interface card, can analyse traffic with gigabit transmission rates. Utilizing this technique in the user plane analysis 102 and correlating the results with the results of control plane analysis 104 done by a protocol analyser gives an opportunity to reuse the known protocol analysers in analysis of high speed transmission networks.
In the correlation the combining of the results of control plane analysis and user plane analysis takes place in accordance with the binding information collected and stored to the analysis results.
The result presentation 108 means showing the results of both the user plane and control plane analysis bound together. In the result presentation the control plane analysis results such as calls and sessions are bound with the user plane analysis results such as QoS measurements and user plane flows. The result presentation makes it easy to locate a specific call and session, and then locate the related user plane analysis results for example to study the QoS features of the call. Compared with the prior art protocol analysers, the performance is better. The correlation can be done nearly in real time and therefore results can be obtained at once. On the other hand, results can also be utilized in post processing. This means e.g. solving the troubles in user connection after a user has complained to the network operator about those troubles.
The UPA 206 performs user plane analysis and stores some or all of the traffic to the capture files. The user plane analysis means for instance the QoS and flow analysis for the protocols of different layers. In case of said S1 the link layer protocol is high speed Ethernet. The network layer protocol is IP and transport layer protocol SCTP or UDP. All the protocols related to S1 are specified in 3GPP TS 36.414 and 3GPP TS 36.413. Among others the transmission protocol GTP of the general packet radio service and the protocols above it are specified. The connection 208 can be implemented by a network tap or pass through Ethernet capture port in UPA 206. A monitoring port of a switch can also be used. The UPA is for instance a rack mount Linux PC. It has a user interface for the monitoring person(s).
The protocol analyser 204 is for the control plane analysis. It is implemented e.g. by a rack mount Windows PC. Protocol analyser 204 is connected to UPA 206 for instance via a gigabit LAN, and acts also as an interface outwards to the monitoring persons.
The analysing arrangement 11 can be connected to more than one network interface depending on monitoring needs. For instance, when the delay in an EPC is studied, the interface connecting the EPC to the Internet can be connected to the analysing arrangement.
Zero copy principle can be utilized in processing the captured packets to reduce overhead caused by the copying of the captured packets. NIC 302 takes care of storing the packets to shared memory buffers, all of the post processing being done by using the shared memory buffers. After all applications have processed the captured packets, the shared memory buffers are released for reuse. In case the application performs a time-intensive process for captured packets, it makes its own copy of the packets rather than reserves the buffer for a long period of time.
The recording application 408 is used to store the captured packets to the storage 410. Preferably a RAID configured to RAID 0 striped disks for maximum write performance is used for recording. The recorded capture files are used by a packet extractor 412. The extractor reads from the storage the data packets needed for further debugging function in the protocol analyser 204. The extraction takes place on grounds of the timestamps or contents of some fields as IP source/destination address or TCP/UDP/SCTP port.
The system can easily be scaled according to the performance requirements, e.g. the database 414 can run in a separate server. In that case there could be multiple user plane analysis appliances 206, one database server and one protocol analyser 204. The flow monitoring application and QoS measuring application can also be distributed between different appliances depending on performance requirements.
The protocol analyser receives captured packets e.g. via a remote interface like RPCAP from the capturing unit 100. It sets a filter, which limits packets to control plane packets only. In case of 3GPP LTE S1 interface, the filter is set to pass all IP frames where protocol field is SCTP, protocol number 132. In the session analysis unit 602 the signalling is inspected, call and session detail records are formed and stored to the database 414. In addition, a call view is shown on the screen. The session analysis makes it possible to correlate the user plane data and control plane data, because these data are bound to each other, and the binding can be found from the signalling. In case of the GTP tunnelling, the binding is done by the GTP TEID and mobile IP address, which are found in the session analysis from the session setup signalling and stored to the database 414 among other call information. The GTP TEID and mobile IP address can be found by following the S1 AP (application protocol). Other session details, as mobile identities, can be found from NAS messages. The session analysis can then proceed e.g. as follows: When an S1 AP message ‘INITIAL CONTEXT SETUP REQUEST’ is received from the network, MME UE S1 AP identifier and eNB UE S1 AP identifier are read to form a new session record, and used to identify the session later on. The GTP TEID and the network layer address, or mobile IP address, are stored to session record for each bearer to be set up, or established. Then the session record is stored to the database. During the session lifetime, new session records updating the state of the session like changes in the GTP TEID/mobile IP address are written to the database.
The decoder 600 converts the packets to a human readable form and provides a window, which shows the converted packets.
The monitoring person can for instance select a session from the call and session view on the screen of the protocol analyzer and open the session for the diagnosis. The diagnostic unit 604 reads the results of the user plane analysis, as flow and QoS data, and the results of the control plane analysis, as the call and session information from the database 414. These results are tagged e.g. by the GTP TEID and mobile IP address stored to a session record in the database. Based on such binding information the diagnostic unit makes the correlation between the results of the user plane and control plane analysis and visualizes the correlation results in the user interface using tables and graphs. For instance a session throughput graph is shown. Thus the diagnostic unit 604 provides the result presentation 108 seen in
In case a detailed decoding is needed, the captured packets related to a specified session are extracted from the storage 410 by using the extractor 412 and shown in detailed decoding window. The protocol analyser can for example open a certain time frame of a capture file in a detailed window. This window shows the decoded messages to implement drill down function.
It is possible to utilize the information stored in the database 414 to view correlation results like calls, QoS, KPI and network flows in a post processing and offline analysis. Because all the incoming data can be recorded to the storage 410, the offline analysis can drill down message level.
The control plane signalling can be inspected and details from it collected and stored to the database. In that case i.a. the GTP TEID, mobile phone's IP address, IMSI, IMEI are recorded and stored to call details.
There can be several QoS agents 802 connected to one QoS analyser 804, in which case the QoS analyser can calculate correlation results for instance for delay and packet drops between the nodes, to which the agents are connected. The QoS agents can be in the same PC as the QoS analyser or they can be separated, in which case a LAN connection is required therebetween. The QoS analyser stores the results to the database 414.
The system for analysing the data transferred in communications networks has been described above. Its implementation can in details vary from that presented. The inventive idea can be applied in different ways within the scope defined by the independent claims 1 and 3.
| Number | Date | Country | Kind |
|---|---|---|---|
| 20095143 | Feb 2009 | FI | national |
