Monitoring Tunneled Traffic over Network TAP

Telecom Core Network Monitoring with Link-Capture™ Software

Platform
Napatech SmartNIC
Content Type
Application Note
Capture Software Version
Link™ Capture Software 12.11

Napatech SmartNICs can distribute tunneled traffic over network TAP to multiple CPU cores based on subscriber IP addresses.

Tunneled traffic over network TAP

This figure shows an example of the tunneled traffic monitoring over network TAP in the telecom core network.


An example of the tunneled traffic monitoring over network TAP in the telecom core network. Upstream traffic is received on port 0, and downstream traffic is received on port 1 of the SmartNIC

Upstream traffic is received on port 0, and downstream traffic is received on port 1 of the SmartNIC in this example.

Delivering tunneled traffic from/to one subscriber to the same stream

The received port numbers are used to determine whether a frame is upstream or downstream traffic in this setup. See figure Tunneled traffic over network TAP. This is an NTPL example for IPv4 traffic over network TAP.
Define HashUp = Hash(HashWord0_3=InnerLayer3Header[12]/32)
Define HashDown = Hash(HashWord0_3=InnerLayer3Header[16]/32)
Define FilterUp = Filter(Port==0 AND InnerLayer3Protocol==IPV4)
Define FilterDown = Filter(Port==1 AND InnerLayer3Protocol==IPV4)

Assign[StreamId=(0..3); Hash = HashUp] = FilterUp
Assign[StreamId=(0..3); Hash = HashDown] = FilterDown
This is an NTPL example for IPv6 traffic.
Define HashUp = Hash(HashWord0_3=InnerLayer3Header[8]/128)
Define HashDown = Hash(HashWord4_7=Layer3Header[24]/128)
Define FilterUp = Filter(Port==0 AND InnerLayer3Protocol==IPV6)
Define FilterDown = Filter(Port==1 AND InnerLayer3Protocol==IPV6)

Assign[StreamId=(0..3); Hash = HashUp] = FilterUp
Assign[StreamId=(0..3); Hash = HashDown] = FilterDown
These configuration examples carry out the following scenario.
  • Upstream traffic is received on port 0, and downstream traffic is received on port 1 of the SmartNIC.
  • The hashing is done based on the inner header of a frame where the IP address of a subscriber is located.
    • Upstream traffic on port 0: The inner-layer source IP address field is used for hashing.
    • Downstream traffic on port 1: The inner-layer destination IP address field is used for hashing.
  • As a result, all the frames from/to one subscriber are delivered to the same stream on the host.