How Does ASN-DPI Deliver Correlated Application Analytics Across 4G and 5G Networks?
April 28, 2026
Deep Network Observability
TL;DR
ASN-DPI correlates subscriber identity with application traffic to deliver real-time, subscriber-aware analytics for better visibility, QoE, and network optimization in 4G and 5G.
Introduction
The evolution of mobile networks from 4G to 5G has fundamentally transformed how subscribers consume data. With 5G Standalone (SA) and Non-Standalone (NSA) architectures now coexisting alongside legacy 4G EPC networks, telecom operators face a critical question: Who is using what application, how much bandwidth are they consuming, and what is their quality of experience?
Answering this question requires more than just Deep Packet Inspection (DPI) for application identification. It requires correlation the ability to bind subscriber identity (IMSI, MSISDN, IMEI) from the control plane with the user-plane traffic carrying the actual application data. Without correlation, DPI can tell you what is flowing through the network, but not who is behind it.
ASN-DPI addresses this challenge head-on by combining high-performance application identification, rich payload metadata extraction, and real-time control-plane to user-plane correlation delivering Subscriber-Aware Application Analytics at line rate.
Why Is Application Identification Alone Not Enough in Modern Networks?
Traditional DPI solutions focus on inspecting user-plane packets to classify traffic by application identifying services like YouTube, WhatsApp, Instagram, or enterprise SaaS applications. While this capability is important, it provides only a partial picture.
Consider the following scenarios:
| Scenario | DPI Alone | DPI + Correlated Data |
|---|---|---|
| “YouTube is consuming 40% of bandwidth” | ✅ Identified | ✅ Identified |
| “Which subscriber is streaming 4K YouTube?” | ❌ Unknown | ✅ IMSI: 404XXXXXXXXXX |
| “What is the QoE for subscriber X on WhatsApp calls?” | ❌ Unknown | ✅ Latency: 12ms, Jitter: 2ms |
| “Which APN is generating the most gaming traffic?” | ❌ Unknown | ✅ APN: internet.mno.com |
| “How many subscribers in Cell Tower Y are using TikTok?” | ❌ Unknown | ✅ 1,247 subscribers, ECGI: 40450302 |
The missing link is correlation. In mobile networks, subscriber identity lives in the control plane (GTP-C, N11/HTTP2), while application data flows through the user plane (GTP-U). Bridging these two planes is what transforms raw DPI output into actionable, subscriber-aware intelligence.
What Is Correlation and How Does It Work in Telecom Networks?
Correlation is the process of linking subscriber signaling information from the control plane with the data sessions in the user plane to produce a unified, enriched view of each subscriber’s activity.
In simpler terms:
- The control plane provides essential subscriber identity details (IMSI, MSISDN, IMEI), location information (Cell ID, TAC), access point identification (APN/DNN), and session setup parameters (TEIDs, bearer IDs).
- The user plane delivers insights into subscriber activity, including the applications utilized, data transfer volumes, and session quality metrics.
What Metadata Is Extracted Per User Flow for Subscriber-Level Insights?
The end goal is to extract as much metadata as possible which can be used to generate the per flow insights which, interlinked with the subscriber information, creates per flow data narrowed down to one single subscriber. The final information extracted is:
User Information -This includes the subscriber information, the key information that uniquely identifies the subscriber and its location. This is directly extracted from the control information as mentioned briefly above. Some of the most important fields are IMSI/IMEI, APN, UE Location, RAT Type, etc. This information is helpful while querying the data for further analysis of a specific subscriber.
Flow Information - This includes IP, Port and Protocol Details of the user packet for a unique flow. Since the GTP/N11 control packets are encapsulating the actual payload, service nodes extract the actual payload tuple as well if it carries. Along with these basic details it also carries the session creation and elapsed time information crucial for session tracking, which also helps in yielding the latency information.
Flow Latency Parameters - Often there is a need to extract and find the latency for a unique flow and hence for a unique subscriber as mentioned above. This information can also be used to get further understanding about a particular APN or Cell. The latency information includes RTT (Round Trip Latency) in nanosecond granularity, and jitter — all this along with the high performance DPI tracking in-line and at line rate.
Flow Sequence Tracking- Service nodes also do TCP sequence numbers analysis and find out if there are packet losses or OOO (out of order) TCP segments. This is crucial and helps in detection of packet drop issues across one control segment, say one specific cell or APN.
Application Information- The DPI engine helps in extraction of the application name and its category, helping in bifurcating the traffic type from the get go. This also includes further information like server name and SNI for encrypted payload. This extracts the media server name as well — like OTT server names, Game Names, or at least Game servers like Nintendo, Steam, etc.
Advanced Rich Protocol Metadata- Beyond the basic application identification, ASN-DPI extracts deep, protocol-level metadata from the subscriber’s traffic. ASN is capable of extracting protocol level metadata as described in the table below:
| Protocol | Metadata Details |
|---|---|
| HTTP | Request Method, URL, Host, User-Agent, Response Status Code, Content-Type, Server, Content-Length, Referrer |
| DNS | Query Name, Query Type (A, AAAA, CNAME, MX), Response Records, TTL, DNS Response Code |
| DHCP | Assigned IP, Hostname, Client MAC, Lease time, DNS servers |
| QUIC | QUIC version negotiation, chosen/available versions, grease/version agility signals; DCID/SCID, active CID limits, initial SCID, connection continuity and routing hints; STK, retry/validation tokens, address validation and anti-amplification context; SNI, UAID, CCS, TLS-over-QUIC extensions → client fingerprint surface (JA3/JA4); Flow control (max data/streams), stream limits, UDP payload size, datagram support; max_idle_timeout, ack_delay_exponent, max_ack_delay; disable_active_migration flag, CID rotation limits, path migration capability; JA3/JA4 over QUIC, inferred client OS / stack characteristics |
| HTTP/2 | HTTP/2 Header frames (method, path, authority), Stream multiplexing details, HPACK compressed header decoding |
| RTP/SIP | SIP Call-ID, From/To URIs, RTP SSRC, Codec, Payload Type, Media quality metrics |
| NetBIOS | NetBIOS Name, Domain, Service type information |
| TLS/SSL | TLS version (client/server), session IDs, and compression used; Negotiated cipher suite, signature scheme, and key exchange parameters (curve, key length); Server TLS version, selected parameters, and server fingerprint (JA3S); Serial number, version, validity period, subject, and issuer fields; JA3, JA3S, and JA4 for traffic identification and profiling |
What Are the Key Use Cases of Subscriber-Aware Application Analytics?
The fusion of DPI application identification with control-plane correlation unlocks powerful analytics use cases:
- Per-Subscriber Application Usage Analytics
Track exactly which applications each subscriber uses, how much data they consume per app, and their usage patterns over time.
Example Insight: “Subscriber IMSI 404XXXXXXXXXX consumed 2.3 GB on YouTube, 450 MB on Instagram, and 120 MB on WhatsApp in the last 24 hours on APN internet.mno.com.” - QoE-Aware Network Optimization
Correlate per-application KPIs (latency, jitter, packet loss, bandwidth) with subscriber and cell-site information to identify QoE hotspots.
Example Insight: “Subscribers in Cell Tower ECGI 40450302 are experiencing 85ms average latency on video streaming applications during 6 PM – 9 PM, compared to 12ms in neighboring cells.” - Security & Anomaly Detection
Detect anomalous subscriber behavior by correlating application usage patterns with subscriber profiles e.g., a subscriber suddenly generating unusual DNS query volumes or connecting to known malicious domains. - Cell-Site Application Analytics
Aggregate correlated data per cell (ECGI/NR Cell ID) to understand application demand distribution across the RAN, enabling capacity planning and RAN optimization. - Intelligent Policy Enforcement & Traffic Steering
Feed correlated application analytics into PCRF/PCF policy engines for dynamic QoS management based on subscriber tier, application type, and real-time network conditions. - Encrypted Traffic Visibility (TLS/QUIC Intelligence)
Infer application and service identity from SNI, certificates, QUIC transport params, and JA3/JA4 without payload decryption. - Device & OS Fingerprinting
Correlate DHCP (hostname/MAC), User-Agent, TLS/QUIC fingerprints to classify device type, OS, and client stack behavior. - OTT Service Breakdown & CDN Mapping
Use HTTP host, TLS SNI, QUIC CID patterns to distinguish services behind shared CDNs (e.g., video vs ads vs API endpoints). - DNS Intelligence & Domain Analytics
Track domain access patterns, TTL behavior, NXDOMAIN spikes, and query types to detect misconfigurations, tunneling, or exfiltration.
ASN-DPI operates as a passive network probe it receives traffic from Telco or DC, performs all correlation and DPI processing, and exports the enriched data. It never injects traffic into the network, ensuring zero impact on production traffic flows.
Conclusion
In the era of 5G, where networks carry billions of diverse application flows across complex multi-generation architectures, DPI application identification alone is no longer sufficient. Telecom operators need to know not just what is flowing through their networks, but who is behind each flow, where they are, and how their experience compares to expectations.
ASN-DPI’s correlation engine bridges the control plane and user plane, transforming raw network packets into subscriber-aware application intelligence. By parsing GTPv2-C, N11/HTTP2, and RADIUS signaling and correlating it with DPI-enriched user-plane data in real time, ASN-DPI enables a new class of Subscriber-Aware Application Analytics that powers smarter network optimization, targeted monetization, proactive QoE management, and robust security posture.
Whether deployed in a 4G EPC, 5G NSA, 5G SA, or hybrid environment, ASN-DPI delivers the deep, correlated visibility that modern telecom networks demand at line rate, at scale, and with zero network impact.
Frequently Asked Questions
1. What problem does ASN-DPI solve for telecom operators?
Telecom operators already know what apps are running on their network. What they struggle to answer is who is using those apps, how much data each person is consuming, and whether their experience is good or bad. ASN-DPI ties subscriber identity from the control plane to actual app traffic in the user plane, so operators get a full picture of each subscriber rather than just traffic stats with no names attached.
2. Why is plain DPI not enough in 4G and 5G networks?
DPI on its own can tell you YouTube is eating 40 percent of bandwidth. It cannot tell you which subscriber is doing it, what their experience looks like, or which cell tower they are connected to. In mobile networks, subscriber identity lives in the control plane while the actual traffic runs through the user plane. Without something connecting both sides, operators are flying half blind.
3. What subscriber details does ASN-DPI extract and link to app traffic?
ASN-DPI pulls subscriber identity fields like IMSI, MSISDN, and IMEI from control plane signaling. It then links those to the actual app traffic that subscriber is generating, along with their cell location, APN, device type, and session quality data like latency and jitter. The result is a single enriched record per flow tied to one specific subscriber rather than an anonymous traffic entry.
4. What are the main use cases operators get from subscriber-aware analytics?
Operators can track per-subscriber app usage and data consumption, spot QoE issues at specific cell towers, detect unusual behaviour like DNS spikes that point to security threats, do capacity planning per cell site, and feed real-time data into policy engines for dynamic QoS decisions. Encrypted traffic like TLS and QUIC can also be identified through fingerprinting without decrypting the payload.
5. Does ASN-DPI affect live network traffic while running?
No. ASN-DPI works as a passive probe. It receives a copy of traffic, processes all the correlation and DPI work on its side, and exports the enriched data to wherever it needs to go. Nothing gets injected back into the network. Operators get full visibility with zero risk of ASN-DPI touching or disrupting production traffic flows.
6. How does ASN-DPI handle encrypted traffic like TLS and QUIC without decrypting it?
ASN-DPI uses fingerprinting techniques like JA3, JA3S, and JA4 to identify what application or service is behind an encrypted session. It also reads signals like SNI, TLS certificates, QUIC transport parameters, and connection IDs to classify traffic without ever opening the payload. Operators get visibility into encrypted flows without touching the data inside or creating any compliance risk.
7. What network environments does ASN-DPI support?
ASN-DPI works across 4G EPC, 5G NSA, 5G SA, and mixed environments where all three coexist. It parses GTPv2-C for 4G control signaling, N11 over HTTP2 for 5G SA, and RADIUS alongside both. Most operators run a mix of generations at any given time, and ASN-DPI is built to handle that without needing separate tools for each network type.
8. How can subscriber-aware data help with network security?
When subscriber identity is tied to every flow, unusual patterns become much easier to catch. A subscriber suddenly sending thousands of DNS queries or connecting to a known bad domain stands out immediately. Without correlation, that same behaviour just looks like anonymous traffic volume with no easy way to trace it back or act on it quickly.
Explore how ASN-DPI can transform your network visibility and analytics. Contact us to learn more.
