Beyond the 5-Tuple: Accurate Session Tracking for Telecom Networks

TL;DR

The increased subscribers/services sharing the same Inner 5-Tuple on modern telecom networks presents challenges for accurate User Session Identification. ASN’s Enhanced User Session Identification enhances standard session keys to include tunnel/QoS configurations like outer IP addresses, GTP TEIDs and DSCPs which aids better flow/ subscriber correlation, richer metadata/KPI creation, as well as more robust Kafka/IPFIX exports.

Introduction

Today's mobile networks are designed to carry packets for multiple services - across a single infrastructure - resulting in billions of network flows on a daily basis. In order to turn network flows into actual analytics, merely sniffing packets isn't sufficient - we need to precisely classify which packets belong to the same user session.

The ASN solution synthesizes network flows that are related to individual user sessions, andexports rich session information (metadata, performance KPI, etc.) out of Kafka and IPFIX. These exported records fuel subscriber analytics, network monitoring, performance analysis and reporting.

However, the entire purpose of this analytical ecosystem comes into play, under one critical assumption: accurate user session identification. For instance, if individual traffic flows are erroneously lumped together in one session, then the metadata and KPI exported, including subscriber-related data, won't accurately reflect the reality of your network operations.

Why Do Different Services Get Merged?

ASN traditionally identifies a user session using the Inner 5-Tuple:

• Inner Source IP Address
• Inner Destination IP Address
• Source Port
• Destination Port
• Transport Protocol

These methods are mostly reliable enough to use forIdentifying session when they are deployed. But where your service has services other the 5Tuple would be the same if you were sending down different Imsi's on same Inner 5 Tuple. TheInner 5tuple can no longer differentiate two users and would place two completely separate IMSis into the same user session.

This can lead to:

• Incorrect session aggregation
• IMSI mis-correlation
• Inaccurate metadata exports
• Incorrect KPI calculations
• Reduced visibility into individual services

You'll usually notice the outer tunnel information differs, although the inner packet data remains the same. The outer IP source, outer IP destination, GTP TEID, and DSCP fields give you extra data points to distinguish the traffic flows further.

How Does Aviz Service Node Solve This?

To overcome these limitations, we present ASN's Enhanced User Session Identification. This enhanced version gives operators the capability to inject various tunnel and QoS attributes to make User session keys longer.

Supported attributes include:

Attribute	Description
Outer Source IP	Outer tunnel source IP address
Outer Destination IP	Outer tunnel destination IP address
GTP TEID	GTP-U Tunnel Endpoint Identifier
Outer DSCP	Outer IP DSCP (ToS) value
Inner DSCP	Inner IP DSCP (ToS) value

In particular, with this option switched on, such attributes form part of the session key (used as subscriber/service identifier if matching, based on an Inner 5-Tuple of an Inner) traffic passing between various subscribers or services.

The feature is configurable to allow to add/omit and only the necessary fields from a local operator's deployment needs. Existing deployments, with the feature switched off, still utilize a conventional session-identification mechanism, etc.

A similar session identification mechanism is used to createKafka Topic Key and IPFIX Flow Key, which means no changes in end-to-end analytics architecture are needed to utilize it.

What Does This Mean for Network Operators?

Improved User Session Identifiers: ASN now accurately displays network traffic, giving operators more confidence in metrics and analysis extracted from exported user sessions.

Key benefits include:

Accurate Flow Separation

This ensures that traffic for separate subscriber or service accounts is tracked as its own user session, and doesn't get aggregated with the wrong session.

Improved Subscriber Correlation

Enhanced accuracy of session identity boosts IMSI correlation, providing a more granular mapping of subscriber details to individual user sessions.

Reliable Metadata and KPIs

Metadata, such as bandwidth, latency metrics, as well as information of application, and other key metrics will be emitted from the user-per-session scope to elevate your reports.

Consistent Kafka and IPFIX Exports

It's an enriched, extended user session key which is used to create Kafka topic keys and IPFIX flow keys. Downstream analytics are therefore assured of receiving unique session IDs for each user's session.

Flexible Deployment

User session keys can be set up depending on the specific needs of the operator and also be only using required tunnel attributes with full backward compatibility.

Conclusion

Even as the current generation of mobile networks offers ever more services on shared infrastructure, reliable subscriber analytics, metadata collection, and KPIs depend on precise user session identification.

The new Enhanced User Session Identification extends existing flow identification capabilities to use a user session key with customizable tunnel and QoS attributes, making it possible to isolate all traffic across different subscribers and services. You'll gain more accurate metadata and KPIs while remaining fully compatible with prior versions.