IT 09 010 Examensarbete 30 hp March 2009 Traffic Recognition in Cellular Networks Alexandros Tsourtis Institutionen för informationsteknologi Department of Information Technology Abstract Traffic Recognition in Cellular Networks Alexandros Tsourtis Teknisk- naturvetenskaplig fakultet UTH-enheten Traffic recognition is a powerful tool that could provide valuable information about the network to the network operator. The association of additional information Besöksadress: carried by control packets in the core cellular network would help identify the traffic Ångströmlaboratoriet Lägerhyddsvägen 1 that stem from each user and acquire statistics about the usage of the network Hus 4, Plan 0 resources and aid detecting problems that only one or a small group of users experience. The program used is called TAM and it operates only on Internet traffic. Postadress: The enhancements of the program included the support for the Gn and Gi interfaces Box 536 751 21 Uppsala of the cellular network where the control traffic is transferred via the GTP and RADIUS protocols respectively. Furthermore, the program output is verified using Telefon: two other tools that operate on the field with satisfactory results and weaknesses 018 – 471 30 03 were detected on all tools studied. Finally, the results of TAM were demonstrated Telefax: with conclusions being drawn about the statistics of the network. The thesis 018 – 471 30 00 concludes with suggestions for improving the program in the future. Hemsida: http://www.teknat.uu.se/student Handledare: Tord Westholm Ämnesgranskare: Ivan Christoff Examinator: Anders Jansson IT 09 010 Tryckt av: Reprocentralen ITC Acknowledgements My thanks goes first to my supervisor in Ericsson, Tord Westholm for sug- gesting valuable comments, helping to structure the work and the presenta- tion and allowing me to take decisions concerning the project direction. Mr. Jiasu Cao, also from Ericsson, helped me a lot during the project answering many questions that raised from the analysis of the trace files, suggested the packet payload calculation and the duplicate packet detection enhancements and has my sincere gratitudes. I would like also to thank my reviewer, Ivan Christoff, for the support dur- ing the project. A colleague working in the same program as I was working, Zhenfang Wei, contributed some of his work to my thesis, particularly the DHT applic- ation detection ability, and I would like to thank him. Finally, I would like to thank everyone else that helped me on the thesis, particularly my brother that provided comments to an early version of the thesis report, and my family and friends that supported me during the pro- ject. Remarks The thesis work was performed in Ericsson, Kista. However, the views ex- pressed below are the opinions of the writer and should not be considered as the company's perspective. The author is the one to be accounted for any mistakes in the study below. The implementation of some parts of the GTP and the Radius protocol strictly targets only observation of traffic and shall not be seen as a way to implement the protocols to handle traffic in network elements. The traces used in the thesis stem from real networks. However, the loca- tions and operators of the networks shall not be disclosed and action is taken to remove operator related information from the results presented here. To Sofia Table of Contents Chapter 1 Introduction ................................................................................. 9 1.1 Background Information .................................................................. 10 1.2 Scope ............................................................................................... 11 1.3 Objectives ........................................................................................ 12 1.4 Insights on TAM .............................................................................. 12 1.5 Related work .................................................................................... 13 1.6 Overview ......................................................................................... 15 Chapter 2 The cellular network .................................................................. 17 2.1 The GPRS core network .................................................................. 19 2.1.1 Accessing the network – Gn interface ...................................... 20 2.1.2 Gi interface ............................................................................... 21 2.1.3 Network Elements .................................................................... 21 2.2 GPRS tunneling protocol – GTP ...................................................... 22 2.2.1 GTP operation .......................................................................... 24 2.3 RADIUS Accounting protocol ......................................................... 26 Chapter 3 Traffic Analysis Module ............................................................ 29 3.1 Enhancing TAM ............................................................................... 30 3.1.1 Common enhancements ........................................................... 31 3.2 Enhancements for the Gn interface ................................................. 38 3.3 Enhancements for the Gi interface .................................................. 47 3.4 A user filter ..................................................................................... 51 Chapter 4 A real world trace study ............................................................. 53 4.1 Problems Encountered ..................................................................... 55 4.1.1 Trace file problems ................................................................... 55 4.1.2 IP fragmentation ....................................................................... 56 4.1.3 Duplicate linked list entries ...................................................... 57 4.1.4 C language ............................................................................... 57 4.1.5 TAM bugs ................................................................................ 58 4.2 Studying the Gn interface ................................................................ 60 4.3 Studying the Gi interface ................................................................. 70 4.4 Program output ................................................................................ 73 4.5 Verification – Comparison of programs ........................................... 75 4.5.1 CFlow ....................................................................................... 76 4.5.2 MFlow ...................................................................................... 78 4.5.3 CFlow vs MFlow ...................................................................... 86 4.5.4 Differences on the application .................................................. 87 4.5.5 Concluding the verification ...................................................... 89 4.6 Results ............................................................................................. 91 4.6.1 Gn interface .............................................................................. 91 4.6.2 Gi interface ............................................................................. 102 Chapter 5 Performance issues ................................................................... 111 Chapter 6 Conclusion and Discussion ...................................................... 115 6.1 Conclusion ..................................................................................... 115 6.2 Discussion ...................................................................................... 116 6.2.1 Limitations ............................................................................. 117 6.2.3 Future work ............................................................................ 117 Appendices ............................................................................................... 123 Appendix A Definitions ....................................................................... 123 Appendix B Abbreviations ................................................................... 123 Appendix C GTP Protocol ................................................................... 125 Appendix D Protocols of the Gi Interface ............................................ 133 D.1 RADIUS Accounting Protocol ................................................. 133 D.2 GRE ......................................................................................... 136 D.3 L2TP - PPP ............................................................................... 136 Appendix E Program status information .............................................. 137 List of Tables Table 1: The linked list fields on the Gn interface........................................42 Table 2: The linked list fields on the Gi interface.........................................48 Table 3: The studied traces...........................................................................53 Table 4: Important status information of Gn traces......................................69 Table 5: Number of flows recognized per application on TAM and CFlow..87 Table 6: Number of flows recognized per application on TAM and MFlow.88 Table 7: Comparison of TAM - CFlow - MFlow..........................................90 Table 8: GTP header fields.........................................................................125 Table 9: GTP extension header fields.........................................................126