Connecting the Dots in 5G: A Deep Dive into Session-Aware N11 Correlation

TL;DR

Further improving Active 5G-SA passive observation, correlation of signaling in the N11 control and user plane (N3) is implemented in ASN. By implementing session-awareness in HTTP/2 decoding and broadening the scope of the SBI, NAS and NGAP messaging, ASN achieves better resilience and optimal processing of session records for subscriber context in all phases of the 5G session.

Introduction

Passive observability of 5G Standalone core networks is an essential capability expected from modern monitoring systems by network operators.

With the transition to Standalone 5G, most of the valuable information about subscriber experience, session, and mobility will not be found on legacy interfaces. They will reside in service-based signaling that traverses the core network functions.

The value of this signal will depend on correlation: the capability to join individual messages into records for individual subscribers and individual sessions.

We have made significant enhancements to how Aviz Service Node (ASN) correlates one of the critical interfaces: N11, along with user-plane traffic tapped via N3.

This post outlines the challenges in correlating N11 passively, how ASN accomplishes much more accurate, more complete, and more reliable correlations of N11.

How Does 5G Standalone Use a Service-Based Architecture?

In 5G Non-Standalone (NSA), the 5G radio is bound to a 4G/EPC Core. 5G Standalone doesn’t have that dependency. The 5G New Radio connects to a 5G Core (5GC) native built on a Service-Based Architecture (SBA).

Unlike rigid point-to-point interfaces of earlier generations, 5GC exposes and consumes network functions as and over HTTP/2 APIs, using JSON payloads, and a common service-based interface (SBI) framework.

Two network functions matter most for session management:

• AMF (Access and Mobility Management Function): the control-plane anchor for the device. It controls registration, connection, reachability, and movement of the device and terminates NAS signaling between the device and the control-plane anchor.
• SMF (Session Management Function): the owner of PDU sessions. It controls the creation, modification, and deletion of data sessions and carrier traffic, as well as user traffic. It issues IP address assignments and commands the user plane function (UPF).

Why Is the N11 Interface Important to Observe?

N11 is the connection between the AMF and SMF.

If a device wishes to have data connectivity, the AMF uses SMF services through N11 to set up a PDU session. If there are changes in session characteristics, N11 is also used to facilitate modification in QoS flows, handovers, bearer movements, and signaling for session modification and release.

For a passive observability platform, N11 is extremely useful.

Analyzing correlated N11 signaling gives an operator per-subscriber, per-session information on the success of establishment and the latency of sessions, events of modification and mobility, and the reason for session release(termination), without any manipulation of or interaction with the live control plane.

It has its challenges. N11 uses HTTP/2. This means that many messages can be exchanged over multiple independent sessions and are compressed using HPACK over an existing persistent connection.

Passive taps capture the real world. That includes out-of-order, duplicate, lost, retransmitted fragments, and other invalid frames.

How Does ASN Correlate the N11 Control Plane With N3 User-Plane Traffic?

N11 has some, but not all, of the information on subscriber sessions. N11 provides some basic information about subscriber sessions. It indicates the subscriber, which PDU session was established and how it was set up, including the IP address and the user plane tunnel endpoints associated with that session.

What N11 does not cover is the subscriber's data traffic.

Those data packets are actually traversing N3, the user plane reference point or interface, between the Radio Access Network (NG-RAN) and the User Plane Function (UPF). Data packets for each PDU session are carried within GTP-U tunnels on this interface.

In isolation, neither the control nor the user plane is sufficient. The control plane knows the identity of users, while the user plane knows the packets, but not the users.

This is why ASN passively taps both N11 and N3.

ASN decodes the control plane signaling on N11, learns the identity and tunnel binding information of each session, and correlates that information with what it observed on the user plane, N3. As a result, ASN is able to switch two independent, packet flows into one flow that is subscriber aware.

What Has ASN Enhanced for N11 Correlation?

How Has ASN Improved Passive TCP-HTTP/2 Session Support?

The largest change is moving to fully session-aware HTTP/2 decoding of N11 traffic.

Aviz Service Node now tracks HTTP/2 connection and stream state as endpoints do. This is the only correct approach to decoding HPACK-compressed headers and associating response to request.

ASN also has extended message coverage, PDU session modification and interworking-related signalling, to cover mobility and mid-session changes, in addition to the recording of establishment and release.

How Has ASN Expanded SBI, NAS, and NGAP Message Coverage?

N11 is not one message type. It is a set of service-based operations where payloads, in turn, are multipart and transport nested structures of 5G NAS and NGAP.

ASN tracks the principal service operations that carry PDU-session state, including:

• Nsmf_PDUSession: Create SM Context
• Nsmf_PDUSession: Update SM Context
• Nsmf_PDUSession: Release SM Context
• Nsmf_PDUSession: Retrieve SM Context
• Namf_Communication: N1N2 Message Transfer

Within these operations, ASN decodes 5G NAS session-management messages embedded in EMM Signaling including PDU Session Establishment Request, Establishment Accept, and Release Complete.

ASN has also broadened coverage of NGAP PDU-session-resource transfer containers, including:

• PDU Session Resource Setup
• Path Switch Request
• Handover Command

These containers allow the radio-side tunnel to provide information to ASN in order to detect mobility events, handovers, and path switches. They also decrease the complexity of user-plane GTP-U tunnel endpoint detection.

How Does ASN Handle Real-World Traffic Conditions?

A passive platform succeeds or fails based on how effectively it deals with poor input.

ASN has increased the hardening of parsing paths by implementing strict, bounded field and length handling for all input received. This allows ASN and its users to safely and predictably handle unexpected, truncated, or malformed messages.

ASN also improved stability during high message rate by re-optimizing how large internal buffers are managed.

How Has ASN Improved N11 Processing Efficiency and Observability?

The advanced internal filters on ASN identify and dump wasted traffic, such as IP fragments and oversized `likely-corrupt` frames, and empty or zero-sequence segments as early as possible within the system.

Removing irresponsible traffic frees up bandwidth and ensures that valuable time and resources are not being used to decode traffic that will be discarded later.

ASN has also increased the breadth of information available during system operation with statistics based on NIC counters, as well as the components and health of the system's internal packet processing, with some key metrics enabled for outbound monitoring.

What Does Enhanced N11 Correlation Mean for Operators?

For a Tier-1 operator running a passive observability deployment, these augmentations translate directly into business value:

• True subscriber-aware visibility: by correlating the N11 control plane with the N3 user plane, ASN attributes real data-plane activity to the right subscriber and session.
• More trustworthy session records: because both request and response legs are correlated and subscriber-to-session mapping is more complete, the data feeding analytics, troubleshooting, and reporting is more accurate.
• Broader event coverage: establishment, modification, mobility, and release are all captured.
• Dependable operation at scale: hardened processing and reduced memory pressure mean consistent behaviour under sustained, high-rate production traffic.
• Faster time-to-insight: richer built-in statistics and forensic instrumentation shorten diagnosis when questions arise.

How Does ASN's N11 Enhancement Support the Future of 5G Observability?

N11 is an essential part of 5G-SA control plane visibility. These improvements show a significant enhancement to how faithfully ASN correlates N11. .

The same principles of accurate, standards-faithful decoding, resilience to real-world traffic, and efficient, transparent processing apply to our work on the broader set of 5G-SA interfaces.

Operators constructing passive observability in their 5G-SA networks will now have a more thorough and dependable view of the signaling that characterizes subscriber experience, thanks to ASN.

Conclusion

Enhanced N11 correlation offers operators more visibility of 5G-SA subscriber sessions by correlating control-plane signaling with actual user-plane traffic.

With session-aware HTTP/2 decoding, extended SBI, NAS, and NGAP coverage, greater resilience, and advanced operational visibility; ASN is strengthening the accuracy and reliability of passive 5G observability.