Abstract: A computer implemented method and telecommunications diagnostic apparatus that correlates packets on a core network with those on the access network. Generated is an identification attribute from Information Elements (IEs) in S1AP packets present in the core network and accessible to the access network. The generated identification attribute is integrated to an access and core session of the access and core network to correlate data packets between the access and core session by comparing if a core session contains the same identification attribute as that of an access session within the life span of the access session.

Abstract: A central node sends a query indicating at least one key performance indicator (KPI) and a first KPI filter criterion to one or more edge nodes causing each edge node to cache subscriber data from each subscriber having a KPI value corresponding to the KPI. The central node receives subscriber data, responsive to the query, and aggregates the subscriber data according to each subscriber and the corresponding KPI value to yield an aggregated initial subscriber dataset and sends a subsequent query to each edge node that (for each edge node) indicates a subscriber from the initial subscriber dataset not returned by the edge node. The central node receives subsequent subscriber, responsive to the subsequent query, and aggregates the subsequent subscriber data with the initial subscriber dataset to yield a final subscriber dataset that indicates a total KPI value for each subscriber.

Abstract: Systems and methods for determining web page download times are described. HTTP transactions data is collected from flow records or PDUs. A subscriber IP address, HTTP URI, and referrer are extracted from the flow records. A subscriber record is identified using the subscriber IP address, and a configured web page is identified using the HTTP URI. A processing path is then determined for the HTTP transaction The processing path is selected from one of: a new page download path for a configured page, a collision path for HTTP transactions that collide with an existing page download, and a page object path for artifacts pages that are already being tracked.

Abstract: A method for monitoring GPRS Tunneling Protocol (GTP) sessions in a mobile communication network having a monitoring module. The method includes the steps of monitoring, by the monitoring module, a plurality of subscriber GTP sessions, and storing recovery parameters related to the subscriber GTP sessions and subscribers associated therewith in records in a database in the monitoring module, wherein the recovery parameters are associated with initial session data for each subscriber GTP session. Upon an outage in monitoring, the method restarts the monitoring module to determine restart parameters associated with existing subscriber GTP sessions and subscribers associated therewith in the records in the database wherein the restart parameters are associated with subsequent session data for each subscriber GTP session.

Abstract: A central node sends a query indicating at least one key performance indicator (KPI) and a first KPI filter criterion to one or more edge nodes causing each edge node to cache subscriber data from each subscriber having a KPI value corresponding to the KPI. The central node receives subscriber data, responsive to the query, and aggregates the subscriber data according to each subscriber and the corresponding KPI value to yield an aggregated initial subscriber dataset and sends a subsequent query to each edge node that (for each edge node) indicates a subscriber from the initial subscriber dataset not returned by the edge node. The central node receives subsequent subscriber, responsive to the subsequent query, and aggregates the subsequent subscriber data with the initial subscriber dataset to yield a final subscriber dataset that indicates a total KPI value for each subscriber.

Abstract: A computer implemented method and telecommunications diagnostic apparatus that correlates packets on a core network with those on the access network. Generated is an identification attribute from Information Elements (IEs) in S1AP packets present in the core network and accessible to the access network. The generated identification attribute is integrated to an access and core session of the access and core network to correlate data packets between the access and core session by comparing if a core session contains the same identification attribute as that of an access session within the life span of the access session.

Abstract: A network monitoring system probe is coupled to network interfaces and captures data packets. A monitoring system processor identifies messages specific to S1-MME interfaces and identifies GUMMEI parameters in the S1-MME interface messages. The monitoring system creates MME node entries in a network topology list, each of the MME nodes corresponding to a unique GUMMEI value. The monitoring system links individual S1-MME interfaces, SCTP associations, and MME IP addresses to a particular MME in the network topology list. Using authentication messages carried on the S6a and S1-MME interfaces, the monitoring system links individual S6a interfaces and S6a interface IP address to a particular MME in the network topology list and creates one or more HSS node entries in the network topology list. The monitoring system also creates eNodeB, S-GW, and PDN-GW nodes in the network topology list and links them to IP addresses and X2, S11, and S5/S8 interfaces.

Abstract: Systems and methods for session-aware GTPv2 load balancing are described. In some embodiments, a method may include receiving a first and a second transaction between an MME and an S-GW over an S11 interface of an LTE/SAE network using a control portion of a second version of a GTPv2-C protocol and storing an uplink UP TEId and IP address, a downlink CP TEId and IP address, and an uplink CP TEId and IP address obtained from the first transaction, and a downlink UP TEId and IP address obtained from the second transaction. The method may further include identifying messages between an eNodeB and the S-GW over a direct tunnel using a user portion of a GTPv1-U protocol as belonging to a session in response to the messages including at least one of: the first uplink UP TEId and IP address, or the first downlink UP TEId and IP address.

Abstract: A method for monitoring GPRS Tunneling Protocol (GTP) sessions in a mobile communication network having a monitoring module. The method includes the steps of monitoring, by the monitoring module, a plurality of subscriber GTP sessions, and storing recovery parameters related to the subscriber GTP sessions and subscribers associated therewith in records in a database in the monitoring module, wherein the recovery parameters are associated with initial session data for each subscriber GTP session. Upon an outage in monitoring, the method restarts the monitoring module to determine restart parameters associated with existing subscriber GTP sessions and subscribers associated therewith in the records in the database wherein the restart parameters are associated with subsequent session data for each subscriber GTP session.

Abstract: Systems and methods for Long Term Evolution (LTE) interface correlation are described. In some embodiments, a method may include receiving a first message, the first message having been intercepted over an air (Uu) interface of an LTE network (e.g., probed via a Common Public Radio Interface (CPRI) between an Evolved-Universal Terrestrial Radio Access Network (UTRAN) Node B (eNB)'s remote radio head and baseband processing unit), the first message having a first identifier. The method may also include receiving a second message, the second message having been intercepted over the S1 interface between the eNB and a Mobility Management Entity (MME) within an Evolved Packet Core (EPC) portion of the LTE network within a given time window from the first message, the second message having a second identifier. The method may further include correlating the first and second messages in response to a match between the first and second identifiers.

Abstract: Systems and methods for Long Term Evolution (LTE) interface correlation are described. In some embodiments, a method may include receiving a first message, the first message having been intercepted over an air (Uu) interface of an LTE network (e.g., probed via a Common Public Radio Interface (CPRI) between an Evolved-Universal Terrestrial Radio Access Network (UTRAN) Node B (eNB)'s remote radio head and baseband processing unit), the first message having a first identifier. The method may also include receiving a second message, the second message having been intercepted over the S1 interface between the eNB and a Mobility Management Entity (MME) within an Evolved Packet Core (EPC) portion of the LTE network within a given time window from the first message, the second message having a second identifier. The method may further include correlating the first and second messages in response to a match between the first and second identifiers.

Abstract: Systems and methods for session-aware GTPv1 load balancing are described. In some embodiments, a method may include receiving a first message transmitted from an SGSN to a GGSN using a GTP-C protocol and storing a downlink UP TEId and IP address and a downlink CP TEId and IP address. The method may also include receiving a second message transmitted from the GGSN to the SGSN using the GTP-C in response to the first message and storing an uplink UP TEId and IP address and an uplink CP TEId and IP address. The method may further include identifying one or more messages exchanged between the SGSN and the GGSN using a GTP-U protocol as belonging to a given session in response to the one or more messages including at least one of: (i) the downlink UP TEId and IP address, or (ii) the uplink UP TEId and IP address.

Abstract: Systems and methods for session-aware GTPv2 load balancing are described. In some embodiments, a method may include receiving a first and a second transaction between an MME and an S-GW over an Sll interface of an LTE/SAE network using a control portion of a second version of a GTPv2-C protocol and storing an uplink UP TEId and IP address, a downlink CP TEId and IP address, and an uplink CP TEId and IP address obtained from the first transaction, and a downlink UP TEId and IP address obtained from the second transaction. The method may further include identifying messages between an eNodeB and the S-GW over a direct tunnel using a user portion of a GTPv1-U protocol as belonging to a session in response to the messages including at least one of: the first uplink UP TEId and IP address, or the first downlink UP TEId and IP address.

Abstract: Systems and methods for intelligent and scalable network monitoring using a hierarchy of devices are described. In some embodiments, a method may include monitoring network traffic having a first data rate and identifying a portion of that traffic. For example, the network traffic may include packet-based traffic in a mobile telecommunications network (e.g., 3G, 4G, LTE, etc.), and identifying the portion of the traffic may include identifying high-value and/or low-value portions as determined by one or more traffic identification rules (e.g., by user, session, transport protocol, type of content, etc.). The method may also include selecting a network analyzer to receive the high (or low) value traffic, and which may not be capable of and/or configured to analyze packets at the first data rate. Accordingly, the method may further include transmitting the identified traffic portion to the selected analyzer with a second data rate smaller than the first data rate.

Abstract: Video data packets transmitted through a wireless network are captured by a network monitoring system. Video data sessions are detected from the video data packets. Key parameters are identified within the video data packets, such as video bit rate, resent or failed video packets, and video session duration. A Quality of Experience (QoE) is determined for some or all users associated with the video sessions based upon the key parameters. A header extension is added to the video data packets by a transcoding system. The header extension includes data associated with original and transcoded video data packets. The network monitoring system monitors the header extension and evaluates the effect of video transcoding upon the overall QoE for users. The monitoring system provides feedback to a transcoding policy engine based upon the effect of transcoding upon QoE.

Abstract: A method and system for identifying the topology of a network is disclosed. One or more monitoring probes capture data packets from network interfaces. Network elements, such as physical ports, physical links, network nodes, logical links, and SCTP associations, are identified from the captured data packets. A data model is created for storing the network elements, including the physical ports, physical links, network nodes, logical links, and SCTP associations. The data model also stores associations between the network elements. The monitoring probes pass network element data to a monitoring server. A topology agent in each monitoring probe identifies duplicates of previously detected network elements within the probe. A topology agent in the monitoring system server identifies duplicates of previously detected network elements within the monitoring system server.

Abstract: Video data packets transmitted through a wireless network are captured by a network monitoring system. Video data sessions are detected from the video data packets. Key parameters are identified within the video data packets, such as video bit rate, resent or failed video packets, and video session duration. A Quality of Experience (QoE) is determined for some or all users associated with the video sessions based upon the key parameters. A header extension is added to the video data packets by a transcoding system. The header extension includes data associated with original and transcoded video data packets. The network monitoring system monitors the header extension and evaluates the effect of video transcoding upon the overall QoE for users. The monitoring system provides feedback to a transcoding policy engine based upon the effect of transcoding upon QoE.

Abstract: Systems and methods are disclosed for correlating IP flows across a NAT firewall. Data packets are captured from a first interface using a monitor probe coupled to the first interface and are correlated into a first group of session records. For each of the first group of session records, a correlation key is created using data in one of the packets in the session record. Data packets are captured from a second interface using a monitor probe coupled to the second interface and are correlated into a second group of session records. For each of the second group of session records, a correlation key is created using data in one of the packets in the session record. The correlation key for one of the first group is compared to the correlation keys for each of the second group of session records to identify session records with matching correlation keys.

Abstract: The data rate for video data being transmitted through a wireless network is adjusted based upon cell congestion levels. A network monitoring system identifies the congestion levels in network cells based upon data traffic captured from network interfaces. When a cell congestion level reaches a first level, an alert is sent to a video transcoding device. The video transcoding device adjusts the data rate for video data being sent to one or more subscribers in the congested cell. The data rate adjustments may be based upon a subscriber profile or a user equipment type. When cell congestion levels drop below a second threshold, the monitoring system sends a second alert indicating that the data rate can be increased.

Abstract: A network monitoring system probe is coupled to network interfaces and captures data packets. A monitoring system processor identifies messages specific to S1-MME interfaces and identifies GUMMEI parameters in the S1-MME interface messages. The monitoring system creates MME node entries in a network topology list, each of the MME nodes corresponding to a unique GUMMEI value. The monitoring system links individual S1-MME interfaces, SCTP associations, and MME IP addresses to a particular MME in the network topology list. Using authentication messages carried on the S6a and S1-MME interfaces, the monitoring system links individual S6a interfaces and S6a interface IP address to a particular MME in the network topology list and creates one or more HSS node entries in the network topology list. The monitoring system also creates eNodeB, S-GW, and PDN-GW nodes in the network topology list and links them to IP addresses and X2, S11, and S5/S8 interfaces.