Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria.

Abstract: A computer-implemented method of monitoring a radio access network (RAN) is provided. The method includes receiving access stratum data that is a function of cell trace records (CTRs) associated with wireless communication transported to or from one or more cells of the RAN, wherein the CTRs are obtained at a granularity sufficient to detect one or more events, the events defining a segment or occurring during a segment, wherein a segment is defined by the beginning, end, or any handovers of a call included in the wireless communication. The method further includes detecting in the access stratum data one or more state transitions as indicated by the events and outputting an enhanced session record (ESR) including information processed from the access stratum data associated with the respective one or more detected state transitions.

Abstract: A system and method of accessing a container environment having one or more containers is provided. The method of the disclosure includes receiving the container network namespace assigned to the container as established in a container runtime, switching from a host container network namespace to the container network namespace of the container, opening the container network interface of the container network namespace for allowing access to packets received or transmitted by the container network interface, and accessing the packets.

Abstract: A network node device in a communication system in which a data packet stream is received in the network monitoring node device having a Paging Message packet that is sent from a network node device. The identity of a User Equipment (UE) associated with the received Paging Message packet is then determined. A determination is then made if Paging Message information associated with the determined UE is stored in memory associated with the network monitoring device, whereupon the received Paging Message packet is filtered from the received data packet stream in the event previous Paging Message information was determined to be associated with the determined UE device in the memory. Additionally, Paging Message information is stored in the memory in the event there are no Paging Message packets stored in the memory associated with the determined UE device.

Abstract: A system for performing computer network service chain analytics includes network-connected devices containing a plurality of virtual network functions having elements and a data model for storing a plurality of metrics related to the plurality of virtual network functions and a service chain intelligence engine in communication with the one or more network-connected devices and the data model. The memory device contains a set of instructions that causes a processor to analyze the plurality of virtual network functions to automatically identify one or more service chains, to automatically determine, using the data model, performance behavior characteristics of each element for each of the identified service chains and to automatically generate an alarm, in response to determining that the performance behavior characteristics of one or more elements of at least one of the identified one or more service chains does not meet a predefined set of the performance behavior characteristics.

Abstract: A computer implemented method for determining the identity of an Over-the Top (OTT) application or service being accessed over the Internet from a HTTP, HTTPS or QUIC connection request received in a network monitoring device. Determine if one or more entries are present in the received connection request have an IP address that matches a known server IP address. A determination is then made as to whether if the received connection request is one of a HTTP, HTTPS or QUIC connection request, and if this cannot be determined than determine if a subject field in the received connection request is available. And determine if a candidate domain name is available from IP cache created from one or more of the above steps if a subject field is not available in the received connection request.

Abstract: Internet protocol packets are statelessly identified as associated with a particular session-instance by identifying a key, or session-instance identifier, within the data (or payload) portion of a user plane packet. This identifier is specific to the session-instance and remains constant throughout the session-instance. Using this stateless identification, transmitted user plane packets are automatically routed at the transmission speed of the transmission link using a method that automatically balances the analysis processing load between network probes. The load is balanced by routing the user plane packet to a network probe that is either already analyzing the session-instance or by routing the user plane packet to a system that has processing capacity to analyze a new session-instance. The network probe then analyzes the user plane packet and the session-instance to measure the quality of the user experience of the session-instance and performance of the network.

Abstract: A network node device in a communication system in which a data packet stream is received in the network monitoring node device having a Paging Message packet that is sent from a network node device. The identity of a User Equipment (UE) associated with the received Paging Message packet is then determined. A determination is then made if Paging Message information associated with the determined UE is stored in memory associated with the network monitoring device, whereupon the received Paging Message packet is filtered from the received data packet stream in the event previous Paging Message information was determined to be associated with the determined UE device in the memory. Additionally, Paging Message information is stored in the memory in the event there are no Paging Message packets stored in the memory associated with the determined UE device.

Abstract: A method for detecting user triggered call drops includes identifying one or more user terminated calls from a plurality of monitored calls. Signaling information associated with the identified user terminated calls is correlated with media channel information associated with the identified user terminated calls. A determination is made if termination of the one or more of the identified user terminated calls is related to quality of media across corresponding media channels. A predefined cause code is assigned to the one or more of the identified user terminated calls, in response to determining that the termination of the one or more of the identified user terminated calls is related to the quality of media across the corresponding media channels.

Abstract: A method for optimizing a radio access network includes receiving at least one area of the radio access network to be analyzed from a user and receiving a desired outcome from a user. A plurality of network monitoring parameters related to a user requested analysis is identified. The identified plurality of network monitoring parameters is correlated. A root cause analysis is performed using an automated classification model based on the correlated plurality of network monitoring parameters. A recommendation related to the desired outcome is generated based on the performed root cause analysis.

Abstract: A computer implemented method for determining the identity of an Over-the Top (OTT) application or service being accessed over the Internet from a HTTP, HTTPS or QUIC connection request received in a network monitoring device. Determine if one or more entries are present in the received connection request have an IP address that matches a known server IP address. A determination is then made as to whether if the received connection request is one of a HTTP, HTTPS or QUIC connection request, and if this cannot be determined than determine if a subject field in the received connection request is available. And determine if a candidate domain name is available from IP cache created from one or more of the above steps if a subject field is not available in the received connection request.

Abstract: A system having a network monitor communicating with U and C probes monitoring SGW-U and SGW-Cs. The U probes buffer captured user plane packets from which they determine new sessions and send new session data to the network monitor, the new session data including an IP address pair of the corresponding U probe and SGW-U. The C probes inspect captured control plane packets, determine control plane packets having a same IP address as an SGW-U in the new session data, and send associated control data to a particular U probe having the IP address paired with the IP address of the SGW-U, wherein the particular U probe correlates the control data with buffered user plane packets and generates associated monitoring data.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria.

Abstract: A method for monitoring tunneled Internet Protocol (IP) traffic in a communication network includes monitoring tunnel signaling flows to determine relationships between tunnels and subscriber sessions for each established tunnel. A first tunnel signaling state is stored in a data repository for each established tunnel. The first tunnel signaling state is indicative of the determined relationship between the tunnel and corresponding subscriber sessions. A second tunnel signaling state is validated based on the stored first tunnel signaling state to identify incorrect association between a monitored tunnel and corresponding subscriber session, in response to detecting a monitoring gap.

Abstract: Internet protocol packets are statelessly identified as associated with a particular session-instance by identifying a key, or session-instance identifier, within the data (or payload) portion of a user plane packet. This identifier is specific to the session-instance and remains constant throughout the session-instance. Using this stateless identification, transmitted user plane packets are automatically routed at the transmission speed of the transmission link using a method that automatically balances the analysis processing load between network probes. The load is balanced by routing the user plane packet to a network probe that is either already analyzing the session-instance or by routing the user plane packet to a system that has processing capacity to analyze a new session-instance. The network probe then analyzes the user plane packet and the session-instance to measure the quality of the user experience of the session-instance and performance of the network.

Abstract: A system for selective user plane (UP) monitoring includes a service gateway (SGW) having a plurality of units. The system further includes a network packet broker (NPB) configured to receive packets including UP data from tunnels created to enable transmission of the UP packets from UE to the plurality of SGW units. The NPB is also configured to receive packets including control plane (CP) data from channels enabling transmission of the CP packets from a base transceiver station to the SGW. The system also includes a plurality of probes operatively coupled to the NPB. The probes are configured to generate first metrics associated with the received CP packets and to selectively generate second metrics associated with the received UP packets based on one or more identifiers. The NPB is configured to forward UP packets being processed by a particular SGW unit to a particular probe of the plurality of probes.

Abstract: A system for correcting network planning data includes a planning repository containing information related to network traffic, network element locations and network element connectivity. The system further includes a repository of a wireless network that includes a plurality of call trace records. In addition, the system includes an information processing system including a processor and a memory device coupled to the processor in communication with the planning database and with the repository of the wireless network. The memory device contains a set of instructions that, when executed by the processor, cause the processor to receive at least of the plurality of call trace records from the repository of the wireless network and cause the processor to compare information in the at least one call trace record with corresponding information stored in the planning repository to identify one or more errors in the information stored in the planning repository.

Abstract: A method for processing a plurality of fragments of IP packet flows in a communication network includes receiving the plurality of packet fragments. The received packet fragments are associated with one or more packet flows. A first set of packet flows is selected from the one or more received packet flows. The first set of packet flows corresponds to a subset of the plurality of packet segments received during a first predetermined time interval. Only packet fragments associated with the first set of packet flows are reassembled into full packets.

Abstract: A system and computer-implemented method to manage alerts, wherein the method includes receiving anomaly triggers associated with detected anomalies, associating an anomaly trigger of the received anomaly triggers with an alert, tracking the alert using a state machine, determining whether to change a state of the state machine if a subsequent anomaly trigger associated with the alert is received or if a predetermined amount of time passes without receiving trigger information, and generating an alarm based on the state of the state machine.