Abstract: Network monitoring devices and network monitoring techniques are disclosed and use inferential statistical approaches to determine one or more Key Performance Indicators, particularly for Circuit Switched FallBack (CSFB) scenarios. For example, the network monitoring node monitors a plurality of ciphered or clear text messages for a network interface in a communication network, determines a Mobile Terminating (MT) count for MT calls and a Mobile Originating (MO) count for User Equipment (UE) from at least one message of the plurality of messages and defines an inferred MT ratio based on the MT count and the MO count for a total number of messages. The network monitoring device further applies the inferred MT ratio to a CSFB idle mode count for UE and/or a CSFB active mode count for UE to yield an estimated total number of CSFB idle mode successes and an estimated total number of CSFB active mode successes, respectively.

Abstract: Network monitoring devices and network monitoring techniques are disclosed and use inferential statistical approaches to determine one or more Key Performance Indicators, particularly for Circuit Switched FallBack (CSFB) scenarios. For example, the network monitoring node monitors a plurality of ciphered or clear text messages for a network interface in a communication network, determines a Mobile Terminating (MT) count for MT calls and a Mobile Originating (MO) count for User Equipment (UE) from at least one message of the plurality of messages and defines an inferred MT ratio based on the MT count and the MO count for a total number of messages. The network monitoring device further applies the inferred MT ratio to a CSFB idle mode count for UE and/or a CSFB active mode count for UE to yield an estimated total number of CSFB idle mode successes and an estimated total number of CSFB active mode successes, respectively.

Abstract: A monitoring system is coupled to interfaces in an LTE network and passively captures packets from the network interfaces. First data packets associated with an authentication and key agreement procedure are captured on a first interface. Second data packets associated with the authentication and key agreement procedure are captured on a second interface. Individual ones of the first data packets are correlated to individual ones of the second data packets based upon a same parameter. An authentication vector table is created comprising information from the correlated first data packets and second data packets, wherein entries in the table comprise authentication data for a plurality of security contexts. A cipher key is identified to decipher additional packets for the user. The cipher key can also be identified in case of Inter Radio Access Technology Handover by the user equipment.

Abstract: A system, method and computer program product are disclosed for monitoring a telecommunications network that comprises a plurality of Mobility Management Entity (MME) nodes and a plurality of evolved UTRAN NodeB (eNodeB) nodes coupled by S1-MME interfaces. A Stream Control Transmission Protocol (SCTP) association identifier is assigned to an SCTP association between interconnected MME and eNodeB nodes. Specific S1-MME messages allow discovering the MME nodes and the eNodeB nodes with their network identifiers, identifying the connections between them and populating proper tables for this topology information.

Abstract: A network monitoring system captures data packet from LTE/SAE network interfaces using passive probes. The monitoring system identifies context data associated with a first user on an S1-MME interface. Next hop parameters, such as a Next Hop Key and/or a Next Hop Chaining Counter, are derived for the first user equipment. The monitoring system creates a first context entry for the first user comprising of the next hop parameters. The monitoring system also identifies second context data associated with a second user on a second S1-MME interface. Next hop parameters are also identified for the second context data. The second context next hop parameters are compared to the first context next hop parameters. If they match, it is possible to track the user even in case of mobility, binding its activity on the two legs and retrieving the security parameters to be used for deciphering.

Abstract: A monitoring system is coupled to interfaces in an LTE network and passively captures packets from the network interfaces. First data packets associated with an authentication and key agreement procedure are captured on a first interface. Second data packets associated with the authentication and key agreement procedure are captured on a second interface. Individual ones of the first data packets are correlated to individual ones of the second data packets based upon a same parameter. An authentication vector table is created comprising information from the correlated first data packets and second data packets, wherein entries in the table comprise authentication data for a plurality of security contexts. A cipher key is identified to decipher additional packets for the user. The cipher key can also be identified in case of Inter Radio Access Technology Handover by the user equipment.

Abstract: Network nodes and interfaces are identified in a combined CDMA/eHRPD and LTE network. Messages captured by a monitoring system on different interfaces are combined in session records. The session records associated with the same network nodes correlated using parameters in the session records. Session records on an A11, A10 and S2a interfaces are correlated using a home network prefix and interface identifier data or home address information.

Abstract: Network nodes and interfaces are identified in a combined CDMA/eHRPD and LTE network. Messages captured by a monitoring system on different interfaces are combined in session records. The session records associated with the same network nodes correlated using parameters in the session records. Session records on an A11, A10 and S2a interfaces are correlated using a home network prefix and interface identifier data or home address information.

Abstract: A system, method and computer program product are disclosed for monitoring a telecommunications network that comprises a plurality of Mobility Management Entity (MME) nodes and a plurality of evolved UTRAN NodeB (eNodeB) nodes coupled by S1-MME interfaces. A Stream Control Transmission Protocol (SCTP) association identifier is assigned to an SCTP association between interconnected MME and eNodeB nodes. Specific S1-MME messages allow discovering the MME nodes and the eNodeB nodes with their network identifiers, identifying the connections between them and populating proper tables for this topology information.

Abstract: A network monitoring system captures data packet from LTE/SAE network interfaces using passive probes. The monitoring system identifies context data associated with a first user on an S1-MME interface. Next hop parameters, such as a Next Hop Key and/or a Next Hop Chaining Counter, are derived for the first user equipment. The monitoring system creates a first context entry for the first user comprising of the next hop parameters. The monitoring system also identifies second context data associated with a second user on a second S1-MME interface. Next hop parameters are also identified for the second context data. The second context next hop parameters are compared to the first context next hop parameters. If they match, it is possible to track the user even in case of mobility, binding its activity on the two legs and retrieving the security parameters to be used for deciphering.

Abstract: A monitoring system is coupled to interfaces in an LTE network and passively captures packets from the network interfaces. First data packets associated with an authentication and key agreement procedure are captured on a first interface. Second data packets associated with the authentication and key agreement procedure are captured on a second interface. Individual ones of the first data packets are correlated to individual ones of the second data packets based upon a same parameter. An authentication vector table is created comprising information from the correlated first data packets and second data packets, wherein entries in the table comprise authentication data for a plurality of security contexts. A cipher key is identified to decipher additional packets for the user. The cipher key can also be identified in case of Inter Radio Access Technology Handover by the user equipment.

Abstract: A system, method and computer program product are disclosed for monitoring a telecommunications network that comprises a plurality of Mobility Management Entity (MME) nodes and a plurality of evolved UTRAN NodeB (eNodeB) nodes coupled by S1-MME interfaces. A Stream Control Transmission Protocol (SCTP) association identifier is assigned to an SCTP association between interconnected MME and eNodeB nodes. Specific S1-MME messages allow discovering the MME nodes and the eNodeB nodes with their network identifiers, identifying the connections between them and populating proper tables for this topology information.

Abstract: A system and method for communication monitoring in a mobile radio network uses a distributed system having one or more processing devices coupled to different links of a serving switching entity of the mobile radio network. The processing devices extract current deciphering parameters from data on the different links, including an additional deciphering parameter set obtained from a subscriber data base entity, from the data flow of the connection, and from each packet data unit as the sequence number of data packets (PDUs) making up the data. The current deciphering parameters are stored in a deciphering parameter providing device so they are available for other processing devices upon request, the deciphering parameter providing device being coupled to the processing device(s) by a communication link such as a LAN or WAN.

Abstract: A method of non-invasive estimation of round trip time (RTT) between a sender and receiver in a packet oriented acknowledgment based transmission system uses a probe to monitor signals transmitted between the sender and receiver at any point in the transmission system. For a presetable number of acknowledgments in a sequence of acknowledgments received by the probe within a time interval, the time stamps of the acknowledgments are compared (i) with the timestamps of the packets received before the acknowledgments to determine an estimated value for the round trip time between the probe and receiver, and (ii) with the timestamps of the packets received after the acknowledgments to determine an estimated value for the round trip time between the probe and sender. Also sequence numbers of the same group of acknowledgments are compared with the packets encountered to perform a distance function along the sequence numbers themselves.

Abstract: A method of multi-protocol call trace on GPRS Gb and Gr interfaces of a GSM network uses distributed processing. Probes are situated at locations where measurements are desired in a monitored mobile network, such as at Gb and Gr interfaces, and are connected in a non-intrusive manner to the mobile network. A remote server is coupled to each probe over a local area network (LAN) to process data as it is acquired by the probe. The probe and remote server are coupled to a central server via a wide area network (WAN), as are client servers. The remote servers manage the probe data (packet data units—PDUs) in real time to create appropriate transactional and raw data indices that are stored locally with the PDUs. Call/procedure trace applications are initiated from the client servers and disseminated by the central server to the remote servers.

Abstract: A method of non-invasive estimation of round trip time (RTT) between a sender and receiver in a packet oriented acknowledgment based transmission system uses a probe to monitor signals transmitted between the sender and receiver at any point in the transmission system. For a presetable number of acknowledgments in a sequence of acknowledgments received by the probe within a time interval, the time stamps of the acknowledgments are compared (i) with the timestamps of the packets received before the acknowledgments to determine an estimated value for the round trip time between the probe and receiver, and (ii) with the timestamps of the packets received after the acknowledgments to determine an estimated value for the round trip time between the probe and sender. Also sequence numbers of the same group of acknowledgments are compared with the packets encountered to perform a distance function along the sequence numbers themselves.

Abstract: A system and method for communication monitoring in a mobile radio network uses a distributed system having one or more processing devices coupled to different links of a serving switching entity of the mobile radio network. The processing devices extract current deciphering parameters from data on the different links, including an additional deciphering parameter set obtained from a subscriber data base entity, from the data flow of the connection, and from each packet data unit as the sequence number of data packets (PDUs) making up the data. The current deciphering parameters are stored in a deciphering parameter providing device so they are available for other processing devices upon request, the deciphering parameter providing device being coupled to the processing device(s) by a communication link such as a LAN or WAN.

Abstract: A method of multi-protocol call trace on GPRS Gb and Gr interfaces of a GSM network uses distributed processing. Probes are situated at locations where measurements are desired in a monitored mobile network, such as at Gb and Gr interfaces, and are connected in a non-intrusive manner to the mobile network. A remote server is coupled to each probe over a local area network (LAN) to process data as it is acquired by the probe. The probe and remote server are coupled to a central server via a wide area network (WAN), as are client servers. The remote servers manage the probe data (packet data units—PDUs) in real time to create appropriate transactional and raw data indices that are stored locally with the PDUs. Call/procedure trace applications are initiated from the client servers and disseminated by the central server to the remote servers.