GTP Distribution

Silicom Denmark Session Based GTP Distribution
– Get control of your Load Balancing

Today’s mobile networks are challenged by the increasing amount of data traffic. All parts of the network are under pressure, including the monitoring, analyzing and managing the data traffic. The data traffic is tunneled in the network using the GTP protocol providing its own challenges. Silicom Denmark’s Session Based GTP Distribution offers a solution to these challenges.

Key features
• Distribution of GTP-C and GTP-U based on session
• Distribution channel derived from IMSI
• Flexible and weighted distribution
• Rich set of filtering features
• Fragment handling in distribution

Key applications
• Monitoring/analyzing/managing data traffic in mobile networks
• Dynamic monitoring of specific GTP sessions/users
• Session based analysis
• VIP and lawful intercept of users/IMSIs

Key benefits
• Fully offload session correlation tasks, eliminating typical bottlenecks
• Enables processing of large number of sessions
• Frees CPU cycles for analysis tasks
• Very high number of sessions distributed
• More than 500M tunnel endpoints supported
• Easy integration into host system
• Scale using existing SW/probe architecture
• Zero packet loss
• Coherent user sessions

The correct and on-time distribution of GTP sessions is critical to achieving high performance analysis of the content within the GTP tunnels, providing data service for mobile devices and users. This analysis is vital for operators to understand and capitalize on the information and business insights hidden in the vast data flows.

The mobile operator’s BSS/OSS systems need to receive every correlated packet of a user’s or application’s GTP session within a specific timeframe. Otherwise the usefulness of these expensive backend systems are severely reduced and their ROI significantly crushed. Also negatively impacted is the mobile operator’s ability to track subscriber activities, resolve subscriber issues promptly and be proactively notified of issues with critical revenue generating services.

Most application architectures rely on “all” GTP signalling and “all” GTP user plane being analyzed together in the same analysis engine. This “all traffic to the same engine” requirement poses a significant problem in scaling the performance of such analysis engines. The scaling problems of this architecture, processing “all” signalling and “all” user plane together, can be alleviated by the use of external GTP distribution boxes distributing traffic via various keys, such as IMSI, IMEI or randomly generate per-session keys etc.

Another architecture used, is to process signalling and user plane separately and do on-the fly correlation ofthe two. This architecture suffers from either lack of real-time analysis or scaling problems due to the inter-process communication required. This stems primarily from a need for process synchronization of the engines, in processing steps where it has a considerable impact on performance. Additionally, the inter-process communication and synchronization introduce additional latency in processing. This architecture can be assisted through devices offering inner IP distribution and signaling via one interface. But it does not offer real scalability, and the shortcomings remain.

Yet another architecture distributes GTP-U traffic based on mobile device IPv4 address and copies the GTP-C signalling to all analysis engines. This presents a significant overhead and weaknesses in session coordination between processing engines, as well as a weakness in user sessions being split between engines based on multiple IP addresses for the same device. This is especially relevant with multiple APNs and IPv6, making real-time analysis results unreliable.

These shortcomings are not acceptable to most, and the cost of hardware resources needed should be considered carefully.

Session based GTP Distribution
At the core of Silicom Denmark’s Session Based GTP Distribution, are hardware integrated network traffic decoders and a GTP tracking engine. All based on high performance hardware, harnessing the power and flexibility of FPGAs.

The Silicom Denmark Session Based GTP Distribution is a distribution engine based on the Silicom Denmark hardware capture platform. It provides the session and context management function, as well as the fbCAPTURE framework.

Dual level GTP session distribution
Silicom Denmark Session Based GTP Distribution offers a unique distribution mechanism that not only distributes traffic to interfaces, but also seamlessly provides distribution keys with each packet. This key enables the analyzing machine to also perform a second level of distribution to analysis engines.

This allows for optimal utilization of the hardware platforms employed. Through Dual level GTP session distribution, an unprecedented effectiveness and scalability can be achieved with new or existing analysis engines in multiple sensors while preserving the session coherency for analysing data for vertical and horizontal metrics.


For maximum scalability and analysis, a single node using Session Based GTP Distribution can forward channels to up to 16 other analysing nodes when using a Silicom Denmark Capture Card for GTP Session Based Distribution in a sensor. The fbC8XG, for instance, has 8x10GE Rx interfaces used to acquire GTP traffic from the network. This distributing node acts as a hub in a cluster of analysing hosts, probes or other devices, while at the same time performing traffic analysis by itself.


Using the fbC8XG capture card for Session Based GTP Distribution, it applies the power of 9 servers or devices to the analysis of the GTP interfaces, at the same time being transparent to the analysis engines themselves, in that no major architectural changes to the GTP analysis engines are needed. Cards with other port densities are supported as well.

In addition to dual level distribution, the hashed distribution keys can be provided with the traffic packets for the engine’s use in session management in the analysis engine.

The shift of data traffic from fixed line to mobile networks and the massive increases in mobile services now and in the future, make visibility and analysis crucial components for successful troubleshooting of subscriber issues and proactive notification of degrading application performance.

With the increase of M2M devices, the user plane data volumes and traffic patterns will add additional strain on the analysis tools used. Offloading the GTP tracking and distribution to a solution unaffected by this will protect the investments made in scaleable monitoring solutions.

By utilizing the power and flexibility of FPGAs and the fbCAPTURE framework, Silicom Denmark’s Session Based GTP Distribution, the capacity of analysis systems can be raised to a new level using existing implementations and including even legacy equipment as well as cutting edge.

The Silicom Denmark GTP solution can ensure that monitoring systems can keep up with the growth in traffic volumes while providing the same full and rich analysis as before. This can be realized on standard commodity hardware for analysis rather than the ever more expensive hardware needed if trying to simply scale via pure processing power.