Abstract: A distributed network monitoring device monitors via a lightweight session tracking module of a network monitoring device, control plane data for connectivity sessions of User Equipment (UE) in a communication network. The lightweight session tracking module selectively identifies at least one bearer for a corresponding connectivity session according to one or more control plane attributes and associates each selectively identified bearer for the corresponding connectivity session with a bearer routing rule for user plane data. A packet routing module receives user plane data for connectivity sessions of UE and transmits the user plane data of the connectivity sessions according to the bearer routing rule of the lightweight session tracking module to a flow processing module for subsequent data flow analysis.

Abstract: A mapper for use in processing messages captured from a telecommunications network is disclosed. In one embodiment, one or more LTE messages are received from a LTE network, and one or more CDMA messages are received from a CDMA network. An LTE/CDMA mapper entry associated with the LTE and CDMA messages is identified. The LTE/CDMA mapper is associated with UE that is capable of operating on both the LTE and CDMA networks. The LTE and CDMA messages are processed using the LTE/CDMA mapper. The processing of the LTE and CDMA messages may comprise extracting parameters from the LTE or CDMA messages and storing the parameters to the LTE/CDMA mapper. The content in the LTE or CDMA messages may be deciphered using authentication parameters stored in the LTE/CDMA mapper. A generic client library may be used, for example, to access the LTE/CDMA mapper.

Abstract: An subscriber location device for determining location information for User Equipment (UE) in a communication network monitors a network interface between a Mobility Management Entity node and an Evolved Serving Mobile Location Center (E-SMLC) node, receive location information from network interface between the MME node and the E-SMLC node, associates the received location information with corresponding UE to yield associated location information and stores the associated location information in a subscriber location database, indexed according to the UE.

Abstract: A monitoring system is coupled to interfaces in an LTE network and passively captures packets from the network interfaces. First data packets associated with an authentication and key agreement procedure are captured on a first interface. Second data packets associated with the authentication and key agreement procedure are captured on a second interface. Individual ones of the first data packets are correlated to individual ones of the second data packets based upon a same parameter. An authentication vector table is created comprising information from the correlated first data packets and second data packets, wherein entries in the table comprise authentication data for a plurality of security contexts. A cipher key is identified to decipher additional packets for the user. The cipher key can also be identified in case of Inter Radio Access Technology Handover by the user equipment.

Abstract: There is provided a passive network monitoring device that monitors one or more network interfaces between network nodes including a SGW node, a PGW node, an ePDG node, and a PCRF node and a PCEF node. The device receives a handover indication for UE from untrusted non-3GPP network access to 3GPP network access and receives a response to an attach request from one or more of the network interfaces, the response including a MSIP address and a charging ID for the UE. The device determines the UE is from a single subscriber based on each of the handover, the MSIP address of the response and the charging ID of the response, and correlates information for the UE at each of the one or more network interfaces with the single subscriber.

Abstract: An subscriber location device for determining location information for User Equipment (UE) in a communication network monitors a network interface between a Mobility Management Entity node and an Evolved Serving Mobile Location Center (E-SMLC) node, receive location information from network interface between the MME node and the E-SMLC node, associates the received location information with corresponding UE to yield associated location information and stores the associated location information in a subscriber location database, indexed according to the UE.

Abstract: Systems and methods for monitoring 3G/4G handovers in telecommunication networks are described. In some embodiments, a method may include receiving a plurality of packets at a telecommunications monitoring system, the plurality of packets including a first packet following a first version of a protocol and a second packet following a second version of the protocol. The method may also include determining, via the a telecommunications monitoring system, that the first packet belongs to a first communication session that is correlated with a second communication session to which the second packet belongs. The method may further include using the telecommunications monitoring system to associate the first packet with the second packet in response to the determination.

Abstract: Systems and methods for monitoring traffic across Diameter Core Agents (DCAs) such as, for example, Diameter Signaling Routers (DSRs) and/or Diameter Routing Agents (DRAs). In some embodiments, a method may include receiving a first set of one or more messages at a telecommunications monitoring system, the first set of one or more messages transmitted between a Diameter client and a Diameter device. The method may also include receiving a second set of one or more messages at the telecommunications monitoring system, the second set of one or more messages transmitted between the Diameter device and a Diameter server. The method may further include correlating the first set of one or more messages with the second set of one or more messages as part of a single Diameter call.

Abstract: A computer implemented method and telecommunications diagnostic apparatus that correlates packets on a core network with those on the access network. Generated is an identification attribute from Information Elements (IEs) in S1AP packets present in the core network and accessible to the access network. The generated identification attribute is integrated to an access and core session of the access and core network to correlate data packets between the access and core session by comparing if a core session contains the same identification attribute as that of an access session within the life span of the access session.

Abstract: A network monitoring system probe is coupled to network interfaces and captures data packets. A monitoring system processor identifies messages specific to S1-MME interfaces and identifies GUMMEI parameters in the S1-MME interface messages. The monitoring system creates MME node entries in a network topology list, each of the MME nodes corresponding to a unique GUMMEI value. The monitoring system links individual S1-MME interfaces, SCTP associations, and MME IP addresses to a particular MME in the network topology list. Using authentication messages carried on the S6a and S1-MME interfaces, the monitoring system links individual S6a interfaces and S6a interface IP address to a particular MME in the network topology list and creates one or more HSS node entries in the network topology list. The monitoring system also creates eNodeB, S-GW, and PDN-GW nodes in the network topology list and links them to IP addresses and X2, S11, and S5/S8 interfaces.

Abstract: Systems and methods for deciphering Internet Protocol (IP) security in an IP Multimedia Subsystem (IMS) using a monitoring system are described. In some embodiments, a method may include identifying a Security Association (SA) between a User Equipment (UE) and a Proxy Call Session Control Function (P-CSCF) of an Internet Protocol (IP) Multimedia Subsystem (IMS) over a Gm interface during a registration procedure, correlating the SA with a ciphering key (CK) exchanged between the P-CSCF and a Serving CSCF (S-CSCF) of the IMS over an Mw interface during the registration procedure, and storing an indication of the correlated SA and CK in a deciphering record.

Abstract: Systems and methods for session-aware GTPv2 load balancing are described. In some embodiments, a method may include receiving a first and a second transaction between an MME and an S-GW over an S11 interface of an LTE/SAE network using a control portion of a second version of a GTPv2-C protocol and storing an uplink UP TEId and IP address, a downlink CP TEId and IP address, and an uplink CP TEId and IP address obtained from the first transaction, and a downlink UP TEId and IP address obtained from the second transaction. The method may further include identifying messages between an eNodeB and the S-GW over a direct tunnel using a user portion of a GTPv1-U protocol as belonging to a session in response to the messages including at least one of: the first uplink UP TEId and IP address, or the first downlink UP TEId and IP address.

Abstract: A method for monitoring GPRS Tunneling Protocol (GTP) sessions in a mobile communication network having a monitoring module. The method includes the steps of monitoring, by the monitoring module, a plurality of subscriber GTP sessions, and storing recovery parameters related to the subscriber GTP sessions and subscribers associated therewith in records in a database in the monitoring module, wherein the recovery parameters are associated with initial session data for each subscriber GTP session. Upon an outage in monitoring, the method restarts the monitoring module to determine restart parameters associated with existing subscriber GTP sessions and subscribers associated therewith in the records in the database wherein the restart parameters are associated with subsequent session data for each subscriber GTP session.

Abstract: Systems and methods for Long Term Evolution (LTE) interface correlation are described. In some embodiments, a method may include receiving a first message, the first message having been intercepted over an air (Uu) interface of an LTE network (e.g., probed via a Common Public Radio Interface (CPRI) between an Evolved-Universal Terrestrial Radio Access Network (UTRAN) Node B (eNB)'s remote radio head and baseband processing unit), the first message having a first identifier. The method may also include receiving a second message, the second message having been intercepted over the S1 interface between the eNB and a Mobility Management Entity (MME) within an Evolved Packet Core (EPC) portion of the LTE network within a given time window from the first message, the second message having a second identifier. The method may further include correlating the first and second messages in response to a match between the first and second identifiers.

Abstract: Systems and methods for monitoring traffic across Diameter Core Agents (DCAs) such as, for example, Diameter Signaling Routers (DSRs) and/or Diameter Routing Agents (DRAs). In some embodiments, a method may include receiving a first set of one or more messages at a telecommunications monitoring system, the first set of one or more messages transmitted between a Diameter client and a Diameter device. The method may also include receiving a second set of one or more messages at the telecommunications monitoring system, the second set of one or more messages transmitted between the Diameter device and a Diameter server. The method may further include correlating the first set of one or more messages with the second set of one or more messages as part of a single Diameter call.

Abstract: Systems and methods for monitoring 3G/4G handovers in telecommunication networks are described. In some embodiments, a method may include receiving a plurality of packets at a telecommunications monitoring system, the plurality of packets including a first packet following a first version of a protocol and a second packet following a second version of the protocol. The method may also include determining, via the a telecommunications monitoring system, that the first packet belongs to a first communication session that is correlated with a second communication session to which the second packet belongs. The method may further include using the telecommunications monitoring system to associate the first packet with the second packet in response to the determination.

Abstract: Systems and methods for deciphering Internet Protocol (IP) security in an IP Multimedia Subsystem (IMS) using a monitoring system are described. In some embodiments, a method may include identifying a Security Association (SA) between a User Equipment (UE) and a Proxy Call Session Control Function (P-CSCF) of an Internet Protocol (IP) Multimedia Subsystem (IMS) over a Gm interface during a registration procedure, correlating the SA with a ciphering key (CK) exchanged between the P-CSCF and a Serving CSCF (S-CSCF) of the IMS over an Mw interface during the registration procedure, and storing an indication of the correlated SA and CK in a deciphering record.

Abstract: A network monitoring system captures data packet from LTE/SAE network interfaces using passive probes. The monitoring system identifies context data associated with a first user on an S1-MME interface. Next hop parameters, such as a Next Hop Key and/or a Next Hop Chaining Counter, are derived for the first user equipment. The monitoring system creates a first context entry for the first user comprising of the next hop parameters. The monitoring system also identifies second context data associated with a second user on a second S1-MME interface. Next hop parameters are also identified for the second context data. The second context next hop parameters are compared to the first context next hop parameters. If they match, it is possible to track the user even in case of mobility, binding its activity on the two legs and retrieving the security parameters to be used for deciphering.

Abstract: A mapper for use in processing messages captured from a telecommunications network is disclosed. In one embodiment, one or more LTE messages are received from a LTE network, and one or more CDMA messages are received from a CDMA network. An LTE/CDMA mapper entry associated with the LTE and CDMA messages is identified. The LTE/CDMA mapper is associated with UE that is capable of operating on both the LTE and CDMA networks. The LTE and CDMA messages are processed using the LTE/CDMA mapper. The processing of the LTE and CDMA messages may comprise extracting parameters from the LTE or CDMA messages and storing the parameters to the LTE/CDMA mapper. The content in the LTE or CDMA messages may be deciphered using authentication parameters stored in the LTE/CDMA mapper. A generic client library may be used, for example, to access the LTE/CDMA mapper.

Abstract: Systems and methods for Long Term Evolution (LTE) interface correlation are described. In some embodiments, a method may include receiving a first message, the first message having been intercepted over an air (Uu) interface of an LTE network (e.g., probed via a Common Public Radio Interface (CPRI) between an Evolved-Universal Terrestrial Radio Access Network (UTRAN) Node B (eNB)'s remote radio head and baseband processing unit), the first message having a first identifier. The method may also include receiving a second message, the second message having been intercepted over the S1 interface between the eNB and a Mobility Management Entity (MME) within an Evolved Packet Core (EPC) portion of the LTE network within a given time window from the first message, the second message having a second identifier. The method may further include correlating the first and second messages in response to a match between the first and second identifiers.