User Plane Monitoring for a Mobile Network Operator (MNO) Jan 2018 www.cubro.com
User Plane Monitoring for a MNO The challenges Growing traffic High costs Complicated network architecture The Cubro solution Traffic filtering on user IP address Traffic filtering on subscriber s IMSI and MSISDN GTP tunnel removal for monitoring Generation of XDRs and CDRs which are sent to the Big Data
User Plane Monitoring for a MNO Business benefits Guaranteed 100 % output of the Packetmaster Increased return on investment because the Packet Switch (PS) Probe is most powerful and cost effective compared to any other probe in the market Cost effective and highly scalable solution
GTP inner IP range filtering Cubro G5 devices (EXA32100 and EXA48600) are the only network packet brokers on the market which can do inner IP filtering in hardware at full line speed. Cubro offers the most cost efficient solution: Usually the S1U interfaces are the most loaded on a mobile network Other Vendors can do this task only in expensive CPU solutions Cubro devices can do up to multiple TB inner IP range and unique IP filtering & load balancing The EXA32100 provides all kinds of relevant interface for this task (32 x 100 Gbit, 32 x 40 Gbit, 128 x 25 Gbit, 128 x 10 Gbit)
GTP inner IP range filtering A simple and scalable solution to offload irrelevant traffic from the probes and save costs
GTP inner IP load balancing Cubro G5 devices (EXA32100 and EXA48600) are the only network packet brokers on the market which can do GTP inner IP load balancing in hardware at full line speed. Cubro offers the most cost efficient solution: Usually the S1U interfaces are the most loaded on a mobile network Other Vendors can do this task only in expensive CPU solutions Cubro devices can do up to multiple TB inner IP range and unique IP filtering & load balancing The EXA32100 provides all kinds of relevant interface for this task (32 x 100 Gbit, 32 x 40 Gbit, 128 x 25 Gbit, 128 x 10 Gbit) We need this feature for the next two solutions - IMSI filtering and user plane monitoring
GTP inner IP load balancing Load balancing based on the inner IP hash of the GTP tunnel
IMSI Filtering Monitoring user plane in LTE networks involves two problems: traffic growth/volume legal issues The solutions for this issue is not to monitor the user plane but instead filter and monitor only specific users/devices. Filtering on a particular customer in a highly loaded LTE network is difficult and expensive. However, Cubro offers solutions which can maximise your return on investment. With the advanced features of Cubro EXA32100 and EXA48600 platform in combination with EXA24160 and the technologies from the Cubro probing business, the user can solve this issue. Cubro offers a combined solution to do IMSI filtering on highly loaded networks which provide customer satisfaction and reduces costs of monitoring.
IMSI filtering solution up to 240 Gbit and up to 1 million IMSI In this application, first the user plane traffic is load balanced by EXA32100 and then the control plane is broadcasted to all units. Then the EXA24160 does the correlation and the IMSI filtering. The output is control and user plane for the relevant (filtered) traffic.
User Plane Monitoring User plane monitoring is a hot topic. It is not only important and useful for technical purpose, but it is also possible to generate additional revenue for the MNO. The flip side of the coin is the price, and complexity. The solution is the Cubro Probes, and the advanced load balancing feature of the EXA32100. The combination of these two devices helps to reduce the costs and enhance the performance for customers who have an existing control plane monitoring solution. Several major MNOs use Cubro solution to add the user plane monitoring to off-load the existing control plane monitoring.
Cubro Probe Solution Tapping, Aggregation, load balancing, inner IP filtering and monitoring solution TAP (Layer 1) NPB (Layer 2-6) aggregation and load balancing Probing and meta data extraction (some of the meta data from the Probes are forwarded back to NPB for load balancing) Existing Control Plane Monitoring solution
Big Data Integration in Mobile Networks Elastic search Real-time trouble shooting and raw packet capture Mongo MongoDB DB (Short term storage) Kafka Kafka Kafka Instances Kafka Instances Instances Instances & Cubro Hadoop IBM Q Radar Many supported outputs Interface Raw capture XDR as UDP stream real-time Probe Probe Currently, the Apache Kafka (a distributed streaming platform) supports up to 50 different connectors to interconnect between several data sources like the Cubro Probe. Some examples include: Vertica, Syslog, Hadoop, SQL, Hbase, InfluxDB, Hazelcast, S3, DynamoDB, Splunk Raw Packet Data Big Data
EXA48600 (Management ports on the back) Packet load 2.16 Tbps Ports 10 Gbit 48 SFP+ Ports 100 Gbit 6 QSFP28 GUI WEB/CLI/GUI Packet buffer YES 24 MB Delay < 700 ns Dual Power YES VLAN tag/detag / Q in Q Header modification Layer 4 GTP inner IP load-balancing GTP inner IP hashing GTP header stripping GRE decapsulation VXLAN decapsulation MPLS detag All ports activated All software activated Low power design 8000 IPv4-5 tuple filter rules 4000 IPv6-5 tuple filter rules
EXA32100 (Management ports on the back) Packet load 3,2 Tbps Ports 40 Gbit 32 QSFP Ports 100 Gbit 32 QSFP28 GUI WEB/CLI/GUI Packet buffer YES 24 MB Delay < 700 ns Dual Power YES VLAN tag/detag / Q in Q Header modification Layer 4 GTP inner IP load-balancing GTP inner IP hashing GTP header stripping GRE decapsulation VXLAN decapsulation MPLS detag All ports activated All software activated Low power design 8000 IPv4-5 tuple filter rules 4000 IPv6-5 tuple filter rules 112 x 10 Gbit (with breakout cable) + 4 x 100 Gbit 128 x 10 Gbit (with breakout cable)
128 Ports 10/25 Gbit Each of the 32 ports of EXA32100 can be used as 100 / 40 Gbit or in split mode in 4 x 10 or 4 x 25 Gbit. In total you can reach 128 x 10 Gbit ports in one unit. This can be done with breakout cables, breakout box, or special TAP version.
Cubro 2G/3G/4G/5G PS Domain Monitoring Probe Network meta data extraction Hardware based solution for Cavium/ARM multicore DPI, Mobile Probing solution, mobile XDR
Different types of Cubro Probe Performance 10 Gbps (1 CPU) Performance 20 Gbps (2 CPU) Performance 60 Gbps (2 CPU) Performance 30 Gbps (1 CPU) NG Probe > 100 Multicore ARM based solution Performance 250 Gbps (2 CPUs) 4 x 100 Gbit interface GA end 2018
Cubro Product Portfolio Probes Mobile Probes and FlowVista Network Packet Brokers Packetmasters & Sessionmasters TAPs Bypass Optical, BIDI, Copper, Flex, Converter, Aggregation Optical and Copper Misc. Breakout boxes and Media Converters
Thank you EMEA North America Cubro Network Visibility Ghegastraße 1030 Vienna, Austria Cubro US 337 West Chocolate Ave Hershey, PA 17033 Tel.: +43 1 29826660 Fax: +43 1 2982666399 Tel.:717-576-9050 Fax.: 866-735-9232 Email: support@cubro.com Email: support@cubro.com APAC Japan Cubro Asia Pacific Cubro Japan 8, Ubi Road 2 #04-12 Zervex Singapore 408538 8-11-10-3F, Nishi-Shinjuku, Shinjuku, Tokyo, 160-0023 Japan Tel.: +65-97255386 Email: jl@cubro.com Email: japan@cubro.com