GTP IPFIX Export [Документация VAS Experts]

GTP IPFIX Export

SSG is able to export processed GTP events via IPFIX protocol. GTP event is request + response.

Only those requests/responses that are processed by SSG are sent to IPFIX. Requests unknown to SSG do not reach IPFIX. SSG processes only the following requests/responses:
  • creation and deletion of a subscriber session;
  • changing the TEID of the session (switching to another SGW/PGW, switching 3G ↔ LTE);
  • changing the ULI (user location info) of the subscriber
GTP IPFIX is generated only when GTP-C processing mode is enabled: parameter bras_gtp_mode must be set to nonzero in fastdpi.conf

Export of GTP events is configured with the following parameters in fastdpi.conf:

ipfix_dev=em1
ipfix_gtp_udp_collectors=1.2.3.4:1533,1.2.3.5:1533
ipfix_gtp_tcp_collectors=1.2.3.6:9418

here:

  • em1 - the network interface name for export
  • ipfix_gtp_udp_collectors - UDP collectors' addresses
  • ipfix_gtp_tcp_collectors - TCP collectors' addresses

GTP event export IPFIX template format

Bytes Data type IANA Description Note
1001 4int32 43823 TIMESTAMP Request arrival time
3300 1int8 43823 VERSION GTP-C version: 1 or 2
3301 1int8 43823 REQUEST Request id (depends on GTP-C version)
3302 1int8 43823 RESPONSE Response id (depends on GTP-C version)
3303 1int8 43823 IE_CAUSE Result code (depends on GTP-C version)
3304 1int8 43823 RESULT Result: 1 - success, 0 - failure. Version-independent success sign of the request is calculated by SSG using the IE_CAUSE code
3305 8int64 43823 SESSION_ID Internal unique id of subscriber session; in this field you can select all messages for the session; 0 - session unknown
3306 4ipv4 43823 SGW_CP_IP SGW control plane IP
3307 4int32 43823 SGW_CP_TEID SGW control plane TEID
3308 4ipv4 43823 SGW_DP_IP SGW data plane IP
3309 4int32 43823 SGW_DP_TEID SGW data plane TEID
3310 4ipv4 43823 PGW_CP_IP PGW control plane IP
3311 4int32 43823 PGW_CP_TEID PGW control plane TEID
3312 4ipv4 43823 PGW_DP_IP PGW data plane IP
3313 4int32 43823 PGW_DP_TEID PGW data plane TEID
3314 4ipv4 43823 USER_IP subscriber's IPv4-address
3315 16ipv6 43823 USER_IP6 subscriber's IPv6-address
3316 8int64 43823 IMSI SIM-card number
3317 8int64 43823 MSISDN telephone number
3318 8int64 43823 IMEI
3319 -string 43823 APN
3320 2int16 43823 ULI_MCC MCC (3GPP country code)
3321 2int16 43823 ULI_MNC MNC (3GPP country operator code)
3322 4int32 43823 ULI_TAC Service area code (version 1); Tracking area code (version 2) inside MCC/MNC
3323 4int32 43823 ULI_ECI In fact, the cell tower code inside the TAC
3324 4int32 43823 ULI_TIMESTAMP ULI update time
3325 1int8 43823 NSAPI
3326 1int8 43823 RAT

Notes:

SESSION_ID - this is the internal ID of the GTP session. It is not related the session_id from Fullflow.

To link records from GTP IPFIX and Fullflow, you can use the subscriber's login: the login field in Fullflow is IMSI or MSISDN, depending on the .conf parameter bras_gtp_login. It also should be taken into account that the sessions of a GTP-subscriber get into Fullflow only if GTP tunnels parsing is enabled.