GTP IPFIX Export

SSG is able to export processed GTP events via IPFIX protocol. GTP event is request + response.

Only those requests/responses that are processed by SSG are sent to IPFIX. Requests unknown to SSG do not reach IPFIX. SSG processes only the following requests/responses:

creation and deletion of a subscriber session;
changing the TEID of the session (switching to another SGW/PGW, switching 3G ↔ LTE);
changing the ULI (user location info) of the subscriber

GTP IPFIX is generated only when GTP-C processing mode is enabled: parameter bras_gtp_mode must be set to nonzero in fastdpi.conf

Export of GTP events is configured with the following parameters in fastdpi.conf:

ipfix_dev=em1
ipfix_gtp_udp_collectors=1.2.3.4:1533,1.2.3.5:1533
ipfix_gtp_tcp_collectors=1.2.3.6:9418

here:

em1 - the network interface name for export
ipfix_gtp_udp_collectors - UDP collectors' addresses
ipfix_gtp_tcp_collectors - TCP collectors' addresses

GTP event export IPFIX template format

№	Bytes	Data type	IANA	Description	Note
1001	4	int32	43823	TIMESTAMP	Request arrival time
3300	1	int8	43823	VERSION	GTP-C version: 1 or 2
3301	1	int8	43823	REQUEST	Request id (depends on GTP-C version)
3302	1	int8	43823	RESPONSE	Response id (depends on GTP-C version)
3303	1	int8	43823	IE_CAUSE	Result code (depends on GTP-C version)
3304	1	int8	43823	RESULT	Result: 1 - success, 0 - failure. Version-independent success sign of the request is calculated by SSG using the IE_CAUSE code
3305	8	int64	43823	SESSION_ID	Internal unique id of subscriber session; in this field you can select all messages for the session; 0 - session unknown
3306	4	ipv4	43823	SGW_CP_IP	SGW control plane IP
3307	4	int32	43823	SGW_CP_TEID	SGW control plane TEID
3308	4	ipv4	43823	SGW_DP_IP	SGW data plane IP
3309	4	int32	43823	SGW_DP_TEID	SGW data plane TEID
3310	4	ipv4	43823	PGW_CP_IP	PGW control plane IP
3311	4	int32	43823	PGW_CP_TEID	PGW control plane TEID
3312	4	ipv4	43823	PGW_DP_IP	PGW data plane IP
3313	4	int32	43823	PGW_DP_TEID	PGW data plane TEID
3314	4	ipv4	43823	USER_IP	subscriber's IPv4-address
3315	16	ipv6	43823	USER_IP6	subscriber's IPv6-address
3316	8	int64	43823	IMSI	SIM-card number
3317	8	int64	43823	MSISDN	telephone number
3318	8	int64	43823	IMEI
3319	-	string	43823	APN
3320	2	int16	43823	ULI_MCC	MCC (3GPP country code)
3321	2	int16	43823	ULI_MNC	MNC (3GPP country operator code)
3322	4	int32	43823	ULI_TAC	Service area code (version 1); Tracking area code (version 2) inside MCC/MNC
3323	4	int32	43823	ULI_ECI	In fact, the cell tower code inside the TAC
3324	4	int32	43823	ULI_TIMESTAMP	ULI update time
3325	1	int8	43823	NSAPI
3326	1	int8	43823	RAT

Notes:

SESSION_ID - this is the internal ID of the GTP session. It is not related the session_id from Fullflow.

To link records from GTP IPFIX and Fullflow, you can use the subscriber's login: the login field in Fullflow is IMSI or MSISDN, depending on the .conf parameter bras_gtp_login. It also should be taken into account that the sessions of a GTP-subscriber get into Fullflow only if GTP tunnels parsing is enabled.