An example demonstrates how to correlate fragmented packets across a mobile network.
If an application must capture packets at different monitoring points as they traverse the mobile network, for instance to calculate the latencies introduced at each network segment, the application must be able to identify each packet regardless of protocol encapsulation. The major issue is correlation of packets inside the mobile network (S1-U and S5/S8 interfaces) with packets on the Internet side (SGi interface).
Since subscriber IP addresses are translated by NAT (Network Address Translation) in the P-GW (Packet Data Network Gateway), the subscriber IP addresses cannot be used for correlation. There is too little information in the protocol headers for reliable correlation based on the headers alone.
A solution to this issue is use a CRC calculated over the payload inside TCP/UDP as a correlation key supporting correlation between IP datagrams on SGi , non-fragmented IP datagrams on S5/S8 and first fragment of fragmented IP datagrams on S1-U or S5/S8. The maximum length of the range of L4 payload data used must be smaller than the fragmentation limit (MTU).
This NTPL example assumes that port 0 is connected to S5/S8 and port 1 is connected to SGi.
In the descriptor recipe, the option ColorBits=8 makes the correlation key available in color1 field in the DYN4 descriptor.
L4 payload data is used for the correlation key calculation, and the range of data used is restricted with KeyLength set to 1000, so that the first fragment of fragmented IP datagrams on S5/S6 can be correlated with IP datagrams on SGi.
Define desc = Descriptor(DYN4,ColorBits=8) Define ckInner = CorrelationKey(Begin=InnerLayer4Payload, End=InnerLayer3PayloadEnd, KeyLength=1000) Define ckOuter = CorrelationKey(Begin=Layer4Payload, End=Layer3PayloadEnd, KeyLength=1000) Assign[StreamId=0;Descriptor=desc;CorrelationKey=ckInner] = Port == 0 AND TunnelType == GTPv1-U Assign[StreamId=0;Descriptor=desc;CorrelationKey=ckOuter] = Port == 1 AND Layer4Protocol == UDP,TCP