Abstract: An illustrative embodiment disclosed herein is a non-transitory computer readable medium. In some embodiments, the medium includes instructions for providing a mobile user monitoring solution that, when executed by a processor, cause the processor to capture a first message transmitted over a packet forwarding control protocol (PFCP) interface, extract a permanent ID and a first user plane tunnel endpoint identifier (TEID) from the first message, store the permanent ID and the first user plane TEID in a PFCP protocol data unit (PDU) session record, store the permanent ID in a session details record, capture a second message transmitted over a user plane interface after the first message is transmitted, extract a second user plane TEID from the second message, wherein the second user plane TEID matches the first user plane TEID, and retrieve the session details record using the second user plane TEID.

Abstract: In some embodiments, a non-transitory computer readable medium is disclosed. In some embodiments, the medium includes instructions for providing a mobile user monitoring solution that, when executed by a processor, cause the processor to capture a first message transmitted over an N11 interface, extract at least one type of session ID and a first Next Generation Application Protocol (NGAP) tunnel endpoint identifier (TEID) from the first message, store the at least one type of session ID and the first NGAP TEID in a first N11 protocol data unit (PDU) session record, capture a second message transmitted over an N3 interface, extract a general packet radio service (GPRS) tunneling protocol (GTP)-user plane (U) TEID from the second message, wherein the GTP-U TEID matches the first NGAP TIED, and retrieve information associated with session details record using the GTP-U TEID.

Abstract: An illustrative embodiment disclosed herein is a non-transitory computer readable medium. In some aspects, the non-transitory computer readable medium includes instructions for providing a mobile user monitoring solution that, when executed by a processor, cause the processor to capture a transaction transmitted over an N12 interface, extract, from the transaction, one of an expected response (XRES) or an authentication token (AUTN), a user identifier (ID), and a cipher key, capture a first message transmitted over an N1 interface, and determine that the first message is associated with the user ID and the cipher key extracted from the transaction.

Abstract: An illustrative embodiment disclosed herein is a non-transitory computer readable medium. The medium includes instructions for providing a mobile user monitoring solution that, when executed by a processor, cause the processor to identify a user database record associated with a user equipment (UE) using a mobile identity (ID), associate a Next Generation application protocol (NGAP) session with the user database record using an NGAP ID, capture a ciphered message associated with the NGAP session, decipher the ciphered message associated with the NGAP session, extract, from the deciphered message, session details associated with the UE, and store the session details in a session detail record.

Abstract: A method for assessing and improving network performance using video session data. Control plane signaling data comprising geographic location data from network monitoring equipment connected to a communications network is collected. Video session data comprising data of a plurality of video sessions from video monitoring equipment connected to the communications network is collected. The plurality of video sessions are associated with a plurality of mobile devices streaming videos on the respective mobile device across the communications network. The video session data and control plane signaling data within a cell of the communications network is correlated. The correlated data is provided to a communications network provider. The communications network is reorganized according to the correlated data.

Abstract: Generating synthetic transactions with packets is provided. A synthetic transaction generator can store, in a packet capture trace file, packets corresponding to a test of a service provided through a network. The synthetic transaction generator can transmit the packet capture trace file to a data processing system to cause the data processing system to play or analyze the packet capture trace file to evaluate the performance of the service provided by the service provider.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria.

Abstract: A method for assessing and improving network performance using video session data. Control plane signaling data comprising geographic location data from network monitoring equipment connected to a communications network is collected. Video session data comprising data of a plurality of video sessions from video monitoring equipment connected to the communications network is collected. The plurality of video sessions are associated with a plurality of mobile devices streaming videos on the respective mobile device across the communications network. The video session data and control plane signaling data within a cell of the communications network is correlated. The correlated data is provided to a communications network provider. The communications network is reorganized according to the correlated data.

Abstract: A computer-implemented method for repurposing one or more software configurable layer 2 switches in an IP (Internet Protocal) computer network to function as a layer 1 switch. Ternary Content-Addressable Memory (TCAM) is reconfigured in each of the one or more layer 2 switches and one or more pipeline engines are routed to emulate layer 1 switching functionality in each of the one or more layer 2 switches.

Abstract: A computer-implemented method of monitoring a radio access network (RAN) is provided. The method includes receiving access stratum data that is a function of cell trace records (CTRs) associated with wireless communication transported to or from one or more cells of the RAN, wherein the CTRs are obtained at a granularity sufficient to detect one or more events, the events defining a segment or occurring during a segment, wherein a segment is defined by the beginning, end, or any handovers of a call included in the wireless communication. The method further includes detecting in the access stratum data one or more state transitions as indicated by the events and outputting an enhanced session record (ESR) including information processed from the access stratum data associated with the respective one or more detected state transitions.

Abstract: Decrypting synthetic transactions with beacon packets is provided. A probe receives, from a client device, a start beacon packet that identifies a test of a service provided by one or more servers. The probe establishes, responsive to receipt of the start beacon packet, a log for the test. The probe stores, in the log established responsive to the start beacon packet, data packets transmitted between the client device and the one or more servers subsequent to the start beacon packet and encrypted with a key using a security protocol. The probe receives, from the client device, key information used to decrypt the data packets of the test encrypted with the key using the security protocol. The probe provides at least one of the data packets for evaluation or decryption using the key information to determine a performance of the service.

Abstract: A system for selective user plane (UP) monitoring includes a service gateway (SGW) having a plurality of units. The system further includes a network packet broker (NPB) configured to receive packets including UP data from tunnels created to enable transmission of the UP packets from UE to the plurality of SGW units. The NPB is also configured to receive packets including control plane (CP) data from channels enabling transmission of the CP packets from a base transceiver station to the SGW. The system also includes a plurality of probes operatively coupled to the NPB. The probes are configured to generate first metrics associated with the received CP packets and to selectively generate second metrics associated with the received UP packets based on one or more identifiers. The NPB is configured to forward UP packets being processed by a particular SGW unit to a particular probe of the plurality of probes.

Abstract: A system and method to aggregate subscriber-perspective data from live data packets of network traffic. The method includes inspecting live packets of network traffic exchanged with a plurality of subscriber end devices. Network traffic exchanged with a subscriber end device can include network traffic exchanged with a different subscriber end device or with an application server. The packet inspection is performed at a location of interception of the live packets, each subscriber end device being an end device correlated with a subscriber. The method further includes selecting, at the location, content data of the inspected packets that correspond to packets exchanged with a selected subscriber end device of the plurality of subscriber end devices, aggregating, at the location, the content data selected, wherein the content data has not been previously aggregated, and outputting, at the location, results of the aggregation.

Abstract: A system and method is provided for calculating session initiation protocol (SIP) key performance indicators (KPIs) for multimedia communication in a network accessing network packets monitored over time. The method includes accessing network packets monitored over time, detecting a SIP response message of the monitored network packets, and accounting for the detected SIP response message in a time window of a series of consecutive time windows that includes the SIP response message's associated observed time. The SIP response message has an associated observed time at which the monitored SIP message was observed during monitoring. The method further includes pairing a SIP request message expected to be paired with the detected SIP response message with the detected SIP response message and accounting for the paired SIP request message in the time window with which the detected SIP response message is accounted.

Abstract: A system having a network monitor communicating with U and C probes monitoring SGW-U and SGW-Cs. The U probes buffer captured user plane packets from which they determine new sessions and send new session data to the network monitor, the new session data including an IP address pair of the corresponding U probe and SGW-U. The C probes inspect captured control plane packets, determine control plane packets having a same IP address as an SGW-U in the new session data, and send associated control data to a particular U probe having the IP address paired with the IP address of the SGW-U, wherein the particular U probe correlates the control data with buffered user plane packets and generates associated monitoring data.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria.

Abstract: A computer-implemented method of monitoring a radio access network (RAN) is provided. The method includes receiving access stratum data that is a function of cell trace records (CTRs) associated with wireless communication transported to or from one or more cells of the RAN, wherein the CTRs are obtained at a granularity sufficient to detect one or more events, the events defining a segment or occurring during a segment, wherein a segment is defined by the beginning, end, or any handovers of a call included in the wireless communication. The method further includes detecting in the access stratum data one or more state transitions as indicated by the events and outputting an enhanced session record (ESR) including information processed from the access stratum data associated with the respective one or more detected state transitions.

Abstract: A system and method of accessing a container environment having one or more containers is provided. The method of the disclosure includes receiving the container network namespace assigned to the container as established in a container runtime, switching from a host container network namespace to the container network namespace of the container, opening the container network interface of the container network namespace for allowing access to packets received or transmitted by the container network interface, and accessing the packets.

Abstract: A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.