Abstract: A network node device in a communication system in which a data packet stream is received in the network monitoring node device having a Paging Message packet that is sent from a network node device. The identity of a User Equipment (UE) associated with the received Paging Message packet is then determined. A determination is then made if Paging Message information associated with the determined UE is stored in memory associated with the network monitoring device, whereupon the received Paging Message packet is filtered from the received data packet stream in the event previous Paging Message information was determined to be associated with the determined UE device in the memory. Additionally, Paging Message information is stored in the memory in the event there are no Paging Message packets stored in the memory associated with the determined UE device.

Abstract: A system having a network monitor communicating with U and C probes monitoring SGW-U and SGW-Cs. The U probes buffer captured user plane packets from which they determine new sessions and send new session data to the network monitor, the new session data including an IP address pair of the corresponding U probe and SGW-U. The C probes inspect captured control plane packets, determine control plane packets having a same IP address as an SGW-U in the new session data, and send associated control data to a particular U probe having the IP address paired with the IP address of the SGW-U, wherein the particular U probe correlates the control data with buffered user plane packets and generates associated monitoring data.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria.

Abstract: First and second pluralities of packets transmitted between UE and the USN over a first interface and a second interface are continuously captured. The first, second and third pluralities contains temporary and permanent identifying information and ciphering key information. A fourth plurality of packets transmitted between the USN and a HSS over a fourth interface is captured. The temporary, permanent identifying information and the ciphering key information are correlated to determine mappings stored in a data repository. A fifth plurality transmitted over a fifth interface is continuously captured. Permanent identifying information corresponding to the temporary identifying information retrieved from the unciphered packets of the fifth plurality is retrieved from the data repository based on the stored mappings. NAS deciphering key information corresponding to the retrieved permanent identifying information is retrieved.

Abstract: A plurality of data packets is received from a wireless communication system. At least one of SIP signaling messages and S1-AP signaling messages associated with calls being made or attempted in the wireless communication system are analyzed for a specified time period to identify one or more dropped calls. At least one of SIP signaling error codes and S1-AP signaling cause codes associated with the identified dropped calls are analyzed to identify one or more call drop reasons. An ASI data set is generated based on the analysis of the at least one of the SIP signaling messages and the S1-AP signaling messages and based on the analysis of the at least one of the SIP signaling error codes and the S1-AP signaling cause codes.

Abstract: First and second pluralities of packets transmitted between UE and the USN over a first interface and a second interface are continuously captured. The first, second and third pluralities contains temporary and permanent identifying information and ciphering key information. A fourth plurality of packets transmitted between the USN and a HSS over a fourth interface is captured. The temporary, permanent identifying information and the ciphering key information are correlated to determine mappings stored in a data repository. A fifth plurality transmitted over a fifth interface is continuously captured. Permanent identifying information corresponding to the temporary identifying information retrieved from the unciphered packets of the fifth plurality is retrieved from the data repository based on the stored mappings. NAS deciphering key information corresponding to the retrieved permanent identifying information is retrieved.

Abstract: A specific user is tracked based on the cell site or service area that the user's device connects to. RANAP, GMM, and SM sessions are associated based on P-TMSI, IMSI, or IMEI. The sessions are maintained based on packets transmitted over the IuPS interface between one or more radio network controllers and a serving GPRS support node. Tracking information associated with information includes usage information such as responsiveness errors, device usage and location. Tracking of a user down to the cell site or service area level assists a mobile service provider in troubleshooting connection issues by providing more complete information and enabling recreation of a user's situation.

Abstract: A system, method and computer program product are provided for network and network application monitoring. Accordingly, one or more media modules are each coupled to an associated network segment. In the case of network application monitoring, each media module is coupled to a network segment on which a network application is running. Each media module monitors and collects data relating to traffic on the associated network segment corresponding to the network application, wherein each media module is tailored for network analysis. An application server module is coupled to the at least one media module and receives the data and analyzes the data for helping to improve the performance of the network and/or network application.

Abstract: A system, method and computer program product are provided for network and network application monitoring. Accordingly, one or more media modules are each coupled to an associated network segment. In the case of network application monitoring, each media module is coupled to a network segment on which a network application is running. Each media module monitors and collects data relating to traffic on the associated network segment corresponding to the network application, wherein each media module is tailored for network analysis. An application server module is coupled to the at least one media module and receives the data and analyzes the data for helping to improve the performance of the network and/or network application.

Abstract: A probe apparatus, method and computer program product for application monitoring are provided. A data collection module collects data from a network segment. A flow processor coupled to the data collection module classifies the collected data into a plurality of flows. A capture system coupled to the flow processor filters and buffers the collected data. A main processor processes the filtered data.

Abstract: A system, method, and computer program product are provided for expert application performance analysis. An application is monitored. Performance data is gathered during the monitoring. A set of metrics is generated based on the performance data. A performance of the application is measured from at least one of a client perspective, a server perspective, and a network perspective using the metrics.

Abstract: A system, method and computer program product are provided for adaptive priority data filtering. Data is collected from a network segment and classified into multiple flows. The flows are prioritized into high and low priority flows. High priority flows are stored in a high priority queue prior to processing, while low priority flows are stored in a low priority queue prior to processing. An amount of data in the high priority flows is monitored. Buffers from the low priority queue are reallocated to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold.