Monitoring userplane in LTE networks involves two problems - traffic growth/volume and legal issues.
Solution 1: One of the solutions for this issue is not to monitor userplane and instead filter and monitor only specific users/devices. Filtering on a particular customer in a high loaded LTE network is difficult and expensive. However, Cubro offers solutions which can maximise your return on investment. With the advanced features of Cubro EXA32100 and EXA48600 platform and the technologies from the Cubro probing business, the user can solve this issue. Cubro offers a combined solution to do IMSI filtering on high loaded networks which provide customer satisfaction and reduces costs of monitoring.
Solution 2: This is the subscriber triggered userplane monitoring solution. The EXA platform can filter on the S1U interface on the inner IP address of the GTP tunnel. This is done in hardware so the load on the unit is not relevant and even a few 100 Gbit of network traffic and several 1000 filters per unit can be handled. However, this IP address is dynamic and can change in each PDB context. Typically, this IP address is managed by the network itself, and it is not easy even for the operator to find it. Cubro Probe offers the right solution for this issue. We use the Cubro Probe to decode all signaling traffic on the network and build a dynamic correlation list IMSI user IP. This list can be used in a 3rd party application to do a filtering based on IMSI.
How does the subscriber triggered userplane monitoring solution work?
This drawing shows an actual implementation. The traffic arrives at an EXA32100 and then separate into userplane and signaling. One copy of the signaling is sent to the monitoring systems and other stream is sent to the Cubro Probe. The Cubro Probe extracts the metadata and builds this correlated IMSI - IP Table. This table is handled in a standard server. The operator's customer portal triggers the approval from the subscriber via rest API.
After this approval from the subscriber, the server configures the rules on EXA32100. The same moment the monitoring system receives the userplane data from this subscriber. After a configurable time frame the approval is recalled automatically in order to stop forwarding userplane traffic.