PERFORMANCE ANALYSIS OF TRAFFIC RECOGNITION IN

CELLULAR NETWORKS

ABSTRACT

Traffic recognition is a powerful tool that could provide valuable

information about the network to the network operator. The association of
additional information carried by control packets in the core cellular network
would help identify the traffic that stem from each user and acquire statistics
about the usage of the network resources and aid detecting problems that only
one or a small group of users experience. The program used is called TAM and it
operates only on Internet traffic. The enhancements of the program included the
support for the Gn and Gi interfaces of the cellular network where the control
traffic is transferred via the GTP and RADIUS protocols respectively.
Furthermore, the program output is verified using two other tools that operate on
the field with satisfactory results and weaknesses were detected on all tools
studied. Finally, the results of TAM were demonstrated with conclusions being
drawn about the statistics of the network. The thesis concludes with suggestions
for improving the program in the future.

TABLE OF CONTENT

Chapter 1 Introduction .......................................................................1

1.1 Background Information .......................................................2
1.2 Scope ............................................................................... 4
1.3 Objectives ......................................................................... 4
1.4 Insights on TAM ............................................................ 5
1.5 Overview .......................................................................... 5
Chapter 2 The cellular network .................................................. 7
2.1 The GPRS core network ...................................................... 8
2.1.1 Accessing the network Gn interface................................. 10
2.1.2 Gi interface ................................................................... 11
2.1.3 Network Elements .......................................................... 12
2.2 GPRS tunneling protocol GTP ......................................... 13
2.2.1 GTP operation ............................................................... 14
2.3 RADIUS Accounting protocol ............................................ 16
Chapter 3 Traffic Analysis Module ........................................... 18
3.1 Enhancing TAM ............................................................... 19
3.1.1 Common enhancements ................................................... 20
3.2 Enhancements for the Gn interface......................................... 25
3.3 Enhancements for the Gi interface ........................................ 35
3.4 A user filter ...................................................................... 40
Chapter 4 A real world trace study ............................................ 41
4.1 Problems Encountered ....................................................... 44
4.1.1 Trace file problems ........................ ................................ 44
4.1.2 IP fragmentation ............................................................. 45
4.1.3 Duplicate linked list entries............................................... 46
4.1.4 TAM bugs .................................................................... 47
4.2 Studying the Gn interface ................................................... 48
4.3 Studying the Gi interface .................................................... 63
4.4 Program output ................................................................. 66
4.5 Verification Comparison of programs ................................ 70
4.5.1 CFlow .......................................................................... 71
4.5.2 MFlow ......................................................................... 73

4.5.3 CFlow vs MFlow ........................................................... 82

4.5.4 Differences on the application ............................................. 83
4.5.5 Concluding the verification ................................................. 87
4.6 Results ........................................................................................ 89
4.6.1 Gn interface ......................................................................... 89
4.6.2 Gi interface ........................................................................ 102
Chapter 5 Performance issues ................................................... 111
Chapter 6 Conclusion and Discussion ........................................... 116
6.1 Conclusion ............................................................................... 116
6.2 Discussion ............................................................................... 117
6.2.1 Limitations ............................................................................ 118
6.2.3 Future work ........................................................................ 119

List of Tables
Table 1: The linked list fields on the Gn interface.............................30
Table 2: The linked list fields on the Gi interface.............................37
Table 3: The studied traces................................................................41
Table 4: Important status information of Gn traces..........................62
Table 5: Number of flows recognized per application
on TAM and CFlow84
Table 6: Number of flows recognized per application on TAM and
MFlow85
Table 7: Comparison of TAM -CFlow -MFlow..............................88

List of Figures
Figure 1: The GPRS architecture based on the Release 7 3GPP
specification TS 123.060.....................................................................7
Figure 2: The GPRS architecture, a closer look..................................8
Figure 3: The protocol stack of the Gn interface...............................14
Figure 4: The PDP context creation...................................................16
Figure 5: RADIUS Accounting procedure.........................................17
Figure 6: Sequence of messages in the Gn and Gi interfaces.
Note that no RADIUS authentication messages are used in the
termination of the user session...........................................................39
Figure 7: Downlink and uplink traffic per APN................................91
Figure 8: Number of packets sent as downlink and uplink per
APN....92
Figure 9: Amount of data transferred per transport layer protocol on
identified flows...................................................................................93
Figure 10: Amount of data transferred per application......................94
Figure 11: Data transferred per application on unidentified flows....95
Figure 12: Data transferred per application in Apn1.........................96
Figure 13: Data transferred per application in Apn2.........................96
Figure 14: The number of users per APN..........................................97
Figure 15: Duration of PDP contexts per APN. The mean
value and standard deviation per APN are displayed here............ ...98
Figure 16: Cumulative distribution function of the percentage of
users per PDP context duration.................................................... ....99
Figure 17: Cumulative distribution function of the percentage of
users per data traffic volume............................................................100
Figure 18: Cumulative distribution function of the percentage
of users per number of PDP contexts...............................................101
Figure 19: Downlink and uplink traffic per APN............................102
Figure 20: Number of packets sent as downlink and uplink per
APN..............................................................................103
Figure 21: Amount of data transferred per transport layer
protocol.104
Figure 22: Amount of data transferred per application....................105
Figure 23: The number of users per APN........................................106

Figure 24: Duration of RADIUS sessions per APN. The mean

value and standard deviation per APN are shown...........................107
Figure 25: Cumulative distribution function of the percentage of
users per RADIUS session duration.................................................108
Figure 26: Cumulative distribution function of the percentage of
users per data traffic volume............................................................109
Figure 27: Cumulative distribution function of the percentage of
users per number of RADIUS sessions............................................110