Abstract: Transaction and session processing of packets within a network monitoring system may be distributed among tightly-coupled processing elements by marking each received packet with a time-ordering sequence reference. The marked packets are distributed among processing elements by any suitable process for transaction processing by the respective processing element to produce transaction metadata. Where a session-owning one of the processing elements has indicated ownership of the session to the remaining processing elements, the transaction-processed packet and transaction metadata are forwarded to the session owner. The session owner aggregates transaction-processed packets for the session, time-orders the aggregated packets, and performs session processing on the aggregated, time-ordered transaction-processed packets to generate session metadata with the benefit of context information.

Abstract: Systems and methods for session-aware GTPv2 load balancing are described. In some embodiments, a method may include receiving a first and a second transaction between an MME and an S-GW over an S11 interface of an LTE/SAE network using a control portion of a second version of a GTPv2-C protocol and storing an uplink UP TEId and IP address, a downlink CP TEId and IP address, and an uplink CP TEId and IP address obtained from the first transaction, and a downlink UP TEId and IP address obtained from the second transaction. The method may further include identifying messages between an eNodeB and the S-GW over a direct tunnel using a user portion of a GTPv1-U protocol as belonging to a session in response to the messages including at least one of: the first uplink UP TEId and IP address, or the first downlink UP TEId and IP address.

Abstract: Systems and methods for session-aware GTPv2 load balancing are described. In some embodiments, a method may include receiving a first and a second transaction between an MME and an S-GW over an Sll interface of an LTE/SAE network using a control portion of a second version of a GTPv2-C protocol and storing an uplink UP TEId and IP address, a downlink CP TEId and IP address, and an uplink CP TEId and IP address obtained from the first transaction, and a downlink UP TEId and IP address obtained from the second transaction. The method may further include identifying messages between an eNodeB and the S-GW over a direct tunnel using a user portion of a GTPv1-U protocol as belonging to a session in response to the messages including at least one of: the first uplink UP TEId and IP address, or the first downlink UP TEId and IP address.

Abstract: Systems and methods for session-aware GTPv1 load balancing are described. In some embodiments, a method may include receiving a first message transmitted from an SGSN to a GGSN using a GTP-C protocol and storing a downlink UP TEId and IP address and a downlink CP TEId and IP address. The method may also include receiving a second message transmitted from the GGSN to the SGSN using the GTP-C in response to the first message and storing an uplink UP TEId and IP address and an uplink CP TEId and IP address. The method may further include identifying one or more messages exchanged between the SGSN and the GGSN using a GTP-U protocol as belonging to a given session in response to the one or more messages including at least one of: (i) the downlink UP TEId and IP address, or (ii) the uplink UP TEId and IP address.