Abstract: Systems and methods for session-aware GTPv2 load balancing are described. In some embodiments, a method may include receiving a first and a second transaction between an MME and an S-GW over an Sll interface of an LTE/SAE network using a control portion of a second version of a GTPv2-C protocol and storing an uplink UP TEId and IP address, a downlink CP TEId and IP address, and an uplink CP TEId and IP address obtained from the first transaction, and a downlink UP TEId and IP address obtained from the second transaction. The method may further include identifying messages between an eNodeB and the S-GW over a direct tunnel using a user portion of a GTPv1-U protocol as belonging to a session in response to the messages including at least one of: the first uplink UP TEId and IP address, or the first downlink UP TEId and IP address.

Abstract: A monitoring system is coupled to interfaces in an LTE network and passively captures packets from the network interfaces. First data packets associated with an authentication and key agreement procedure are captured on a first interface. Second data packets associated with the authentication and key agreement procedure are captured on a second interface. Individual ones of the first data packets are correlated to individual ones of the second data packets based upon a same parameter. An authentication vector table is created comprising information from the correlated first data packets and second data packets, wherein entries in the table comprise authentication data for a plurality of security contexts. A cipher key is identified to decipher additional packets for the user. The cipher key can also be identified in case of Inter Radio Access Technology Handover by the user equipment.

Abstract: Network nodes and interfaces are identified in a combined CDMA/eHRPD and LTE network. Messages captured by a monitoring system on different interfaces are combined in session records. The session records associated with the same network nodes correlated using parameters in the session records. Session records on an A11, A10 and S2a interfaces are correlated using a home network prefix and interface identifier data or home address information.

Abstract: Network nodes and interfaces are identified in a combined CDMA/eHRPD and LTE network. Messages captured by a monitoring system on different interfaces are combined in session records. The session records associated with the same network nodes correlated using parameters in the session records. Session records on an A11, A10 and S2a interfaces are correlated using a home network prefix and interface identifier data or home address information.

Abstract: A network monitoring system captures data packet from LTE/SAE network interfaces using passive probes. The monitoring system identifies context data associated with a first user on an S1-MME interface. Next hop parameters, such as a Next Hop Key and/or a Next Hop Chaining Counter, are derived for the first user equipment. The monitoring system creates a first context entry for the first user comprising of the next hop parameters. The monitoring system also identifies second context data associated with a second user on a second S1-MME interface. Next hop parameters are also identified for the second context data. The second context next hop parameters are compared to the first context next hop parameters. If they match, it is possible to track the user even in case of mobility, binding its activity on the two legs and retrieving the security parameters to be used for deciphering.

Abstract: A monitoring system is coupled to interfaces in an LTE network and passively captures packets from the network interfaces. First data packets associated with an authentication and key agreement procedure are captured on a first interface. Second data packets associated with the authentication and key agreement procedure are captured on a second interface. Individual ones of the first data packets are correlated to individual ones of the second data packets based upon a same parameter. An authentication vector table is created comprising information from the correlated first data packets and second data packets, wherein entries in the table comprise authentication data for a plurality of security contexts. A cipher key is identified to decipher additional packets for the user. The cipher key can also be identified in case of Inter Radio Access Technology Handover by the user equipment.

Abstract: A network monitoring system probe is coupled to network interfaces and captures data packets. A monitoring system processor identifies messages specific to S1-MME interfaces and identifies GUMMEI parameters in the S1-MME interface messages. The monitoring system creates MME node entries in a network topology list, each of the MME nodes corresponding to a unique GUMMEI value. The monitoring system links individual S1-MME interfaces, SCTP associations, and MME IP addresses to a particular MME in the network topology list. Using authentication messages carried on the S6a and S1-MME interfaces, the monitoring system links individual S6a interfaces and S6a interface IP address to a particular MME in the network topology list and creates one or more HSS node entries in the network topology list. The monitoring system also creates eNodeB, S-GW, and PDN-GW nodes in the network topology list and links them to IP addresses and X2, S11, and S5/S8 interfaces.

Abstract: System and method for correlating multiple frames of data associated with a single call into a call record. One embodiment comprises correlating data in a radio access network by capturing data passing to and from a radio network controller, identifying ATM Adaptation Layer type 5 (AAL5) frames within the data, assigning a first call identifier to the AAL5 frames, identifying ATM Adaptation Layer type 2 (AAL2) frames within the data, assigning a second call identifier to the AAL2 frames, and combining AAL2 frames and AAL5 frames having a same first call identifier and a same second call identifier into a call record. The data passing to and from the first radio network controller may be data passing over an Iub interface between a Node B and the radio network controller or data passing over an Iur interface between two radio network controllers.

Abstract: System and method for correlating multiple frames of data associated with a single call into a call record. One embodiment comprises correlating data in a radio access network by capturing data passing to and from a radio network controller, identifying ATM Adaptation Layer type 5 (AAL5) frames within the data, assigning a first call identifier to the AAL5 frames, identifying ATM Adaptation Layer type 2 (AAL2) frames within the data, assigning a second call identifier to the AAL2 frames, and combining AAL2 frames and AAL5 frames having a same first call identifier and a same second call identifier into a call record. The data passing to and from the first radio network controller may be data passing over an Iub interface between a Node B and the radio network controller or data passing over an Iur interface between two radio network controllers.