Proactive and intelligent packet capturing for a mobile packet core

Patent metadata

Field	Value
Publication number	US-11271831-B2
Application number	US-202016743147-A
Country	US
Kind code	B2
Filing date	Jan 15, 2020
Priority date	Feb 28, 2019
Publication date	Mar 8, 2022
Grant date	Mar 8, 2022

Abstract

Techniques that provide proactive and intelligent packet capturing are described herein. In one embodiment, a method includes storing information associated with a plurality of user equipment (UE) sessions of a plurality of UEs within a mobile network; detecting an anomaly associated with at least one UE session of at least one UE based, at least in part, on the information stored for the at least one UE session; and activating a trace for the at least one UE session based, at least in part, on detecting the anomaly associated with the at least one UE session, wherein activating the trace comprises capturing packet information for a data packet flow associated with the at least one UE session at one or more data-path network elements of a plurality of data-path network elements within the mobile network.

First claim

What is claimed is:

1. A method comprising:
storing historical information for a session of a user equipment (UE) within a mobile network;
detecting an anomaly associated with the session of the UE based on the historical information stored for the session of the UE; and
activating a first trace for the session of the UE at a first data-path network element based on detecting the anomaly associated with the session of the UE, wherein activating the first trace comprises communicating a first trace activation notification to the first data-path network element, wherein the first trace activation notification causes the first data-path network element to capture packet information for a data packet flow associated with the session of the UE and causes the first data-path network element to activate a second trace for the session of the UE at a second data-path network element via a second trace activation notification that is to be included in an extension header for at least one encapsulated packet, the at least one encapsulated packet to be communicated from the first data-path network element to the second data-path network element.

2. The method of claim 1 , wherein the first data-path network element at which the first trace is activated is one of:
a serving gateway (SGW); or
a packet data network gateway (PGW).

3. The method of claim 1 , wherein the detecting is performed by an anomaly detection application that is external to the first data-path network element and the second data-path network element.

4. The method of claim 3 , wherein the historical information stored for the session of the UE is obtained from one or more control plane network elements of the mobile network or one or more user plane network elements of the mobile network.

5. The method of claim 1 , wherein the first trace activation notification comprises an identifier for the session of the UE and a tracing level indicator for the first trace.

6. The method of claim 1 , wherein the historical information stored for the session of the UE further comprises:
an International Mobile Subscriber Identity (IMSI) for the UE;
location information for the UE;
Radio Access Technology (RAT) type information for the session of the UE;
call termination information for the UE; and
timestamp information for one or more events associated with the session of the UE.

7. The method of claim 6 , wherein the anomaly associated with the session of the UE is detected based on at least one of:
determining, based on the RAT type information and the timestamp information, frequent RAT type switches for a period of time;
determining, based on the location information, that the UE is in an abnormal location;
determining, based on the location information, that the UE is entering a cell area associated with anomalies;
determining, based on the call termination information for the UE and the timestamp information for one or more events associated with the session of the UE, frequent call terminations for a period of time; and
determining, based on the timestamp information, frequent session establishment rejections.

8. The method of claim 1 ,
wherein the extension header is a user plane General Packet Radio Service (GPRS) Tunneling Protocol (GTP-U) extension header and the at least one encapsulated packet is at least one GTP-U encapsulated data packet.

9. The method of claim 8 ,
wherein the GTP-U extension header includes a first content field comprising an indicator for the second trace activation notification.

10. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to perform operations, comprising:
storing historical information for a session of a user equipment (UE) within a mobile network;
detecting an anomaly associated with the session of the UE based, at least in part, on the historical information stored for the session of the UE; and
activating a first trace for the session of the UE at a first data-path network element based on detecting the anomaly associated with the session of the UE, wherein activating the first trace comprises communicating a first trace activation notification to the first data-path network element, wherein the first trace activation notification causes the first data-path network element to capture packet information for a data packet flow associated with the session of the UE and causes the first data-path network element to activate a second trace for the session of the UE at a second data-path network element via a second trace activation notification that is to be included in an extension header for at least one encapsulated packet, the at least one encapsulated packet to be communicated from the first data-path network element to the second data-path network element.

11. The media of claim 10 , wherein the detecting is performed by an anomaly detection application that is external to the first data-path network element and the second data-path network element.

12. The media of claim 11 , wherein the historical information stored for the session of the UE is obtained from one or more control plane network elements of the mobile network or one or more user plane network elements of the mobile network.

13. The media of claim 10 , wherein the first trace activation notification comprises an identifier for the session of the UE and a tracing level indicator for the first trace.

14. The media of claim 10 , wherein the historical information stored for the session of the UE further comprises:
an International Mobile Subscriber Identity (IMSI) for the UE;
location information for the UE;
Radio Access Technology (RAT) type information for the session of the UE;
call termination information; and
timestamp information.

15. The media of claim 10 , wherein the extension header is a user plane General Packet Radio Service (GPRS) Tunneling Protocol (GTP-U) extension header and the at least one encapsulated packet is at least one GTP-U encapsulated data packet.

16. The media of claim 15 ,
wherein the GTP-U extension header includes a first content field comprising an indicator for the second trace activation notification.

17. A system comprising:
at least one memory element for storing data; and
at least one processor for executing instructions associated with the data, wherein executing the instructions causes the system to perform operations, comprising:
storing historical information for a session of a user equipment (UE) session within a mobile network;
detecting an anomaly associated with the session of the UE based on the historical information stored for the session of the UE; and
activating a first trace for the session of the UE at a first data-path network element based on detecting the anomaly associated with the session of the UE, wherein activating the first trace comprises communicating a first trace activation notification to the first data-path network element, wherein the first trace activation notification causes the first data-path network element to capture packet information for a data packet flow associated with the session of the UE and causes the first data-path network element activate a second trace for the session of the UE at a second data-path network element via a second trace activation notification that is to be included in an extension header for at least one encapsulated packet, the at least one encapsulated packet to be communicated from the first data-path network element to the second data-path network element.

18. The syste

Assignees

• Cisco Tech Inc

Inventors

• Patil Santosh Ramrao
• Dhammawat Abhishek
• Boon Gary

Classifications

• H04W72/51

  based on terminal or device properties · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L43/04 Primary

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L67/14 Primary

  Session management (for real-time applications in data packet communications networks H04L65/1066) · CPC title