ng_dpi_ifd

7/27/2019 ng_dpi_ifd

http://slidepdf.com/reader/full/ngdpiifd 1/26

Flexi Network Gateway Release 2.1

DPI Reporter Interface Description

DN0976226

Issue 2-3

Nokia Siemens Networks is continually striving to reduce the adverse environmental effects of

its products and services. We would like to encourage you as our customers and users to join

us in working towards a cleaner, safer environment. Please recycle product packaging and

follow the recommendations for power use and proper disposal of our products and their compo-

nents.

If you should have questions regarding our Environmental Policy or any of the environmental

services we offer, please contact us at Nokia Siemens Networks for any additional information.



2 Interface Description

DN0976226 Issue 2-3

DPI Reporter

Id:0900d80580925a7f

The information in this document is subject to change without notice and describes only the

product defined in the introduction of this documentation. This documentation is intended for the

use of Nokia Siemens Networks customers only for the purposes of the agreement under whichthe document is submitted, and no part of it may be used, reproduced, modified or transmitted

in any form or means without the prior written permission of Nokia Siemens Networks. The

documentation has been prepared to be used by professional and properly trained personnel,

and the customer assumes full responsibility when using it. Nokia Siemens Networks welcomes

customer comments as part of the process of continuous development and improvement of the

documentation.

The information or statements given in this documentation concerning the suitability, capacity,

or performance of the mentioned hardware or software products are given "as is" and all liability

arising in connection with such hardware or software products shall be defined conclusively and

finally in a separate agreement between Nokia Siemens Networks and the customer. However,

Nokia Siemens Networks has made all reasonable efforts to ensure that the instructions

contained in the document are adequate and free of material errors and omissions. Nokia

Siemens Networks will, if deemed necessary by Nokia Siemens Networks, explain issues which

may not be covered by the document.

Nokia Siemens Networks will correct errors in this documentation as soon as possible. IN NO

EVENT WILL Nokia Siemens Networks BE LIABLE FOR ERRORS IN THIS DOCUMENTA-

TION OR FOR ANY DAMAGES, INCLUDING BUT NOT LIMITED TO SPECIAL, DIRECT, INDI-

RECT, INCIDENTAL OR CONSEQUENTIAL OR ANY LOSSES, SUCH AS BUT NOT LIMITED

TO LOSS OF PROFIT, REVENUE, BUSINESS INTERRUPTION, BUSINESS OPPORTUNITY

OR DATA,THAT MAY ARISE FROM THE USE OF THIS DOCUMENT OR THE INFORMATION

IN IT.

This documentation and the product it describes are considered protected by copyrights and

other intellectual property rights according to the applicable laws.

The wave logo is a trademark of Nokia Siemens Networks Oy. Nokia is a registered trademark

of Nokia Corporation. Siemens is a registered trademark of Siemens AG.

Other product names mentioned in this document may be trademarks of their respectiveowners, and they are mentioned for identification purposes only.

Copyright © Nokia Siemens Networks 2013/8/21. All rights reserved

f Important Notice on Product SafetyThis product may present safety risks due to laser, electricity, heat, and other sources

of danger.

Only trained and qualified personnel may install, operate, maintain or otherwise handle

this product and only after having carefully read the safety information applicable to this

product.

The safety information is provided in the Safety Information section in the “Legal, Safety

and Environmental Information” part of this document or documentation set.

The same text in German:

f Wichtiger Hinweis zur ProduktsicherheitVon diesem Produkt können Gefahren durch Laser, Elektrizität, Hitzeentwicklung oder

andere Gefahrenquellen ausgehen.

Installation, Betrieb, Wartung und sonstige Handhabung des Produktes darf nur durch

geschultes und qualifiziertes Personal unter Beachtung der anwendbaren Sicherheits-

anforderungen erfolgen.

Die Sicherheitsanforderungen finden Sie unter „Sicherheitshinweise“ im Teil „Legal,

Safety and Environmental Information“ dieses Dokuments oder dieses Dokumentations-

satzes.



Interface Description

DN0976226 Issue 2-3

3

DPI Reporter

Id:0900d80580925a7f

Table of ContentsThis document has 26 pages.

1 Summary of changes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71.1 Changes between release 2.0 and release 2.1 . . . . . . . . . . . . . . . . . . . . 7

1.2 Changes between release 10 CD8 and release 2.0 . . . . . . . . . . . . . . . . 7

1.3 Changes between release 10 CD5.1 and release 10 CD8 . . . . . . . . . . . 7

1.4 Changes between release 10 CD5 and release 10 CD5.1 . . . . . . . . . . . 7

2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2.1 Scope. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2.2 Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

3 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

4 DPI reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114.1 Pushing user-specific reports to SAI . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

4.2 Pushing domain reports to SAI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

4.3 Pushing POP3 server reports to SAI . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

4.4 Pushing email transactions reports to SAI. . . . . . . . . . . . . . . . . . . . . . . 17

4.5 Pushing VoIP reports to SAI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

5 Alarms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

6 Error cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

7 Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

8 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

9 Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26




DN0976226 Issue 2-3

DPI Reporter

Id:0900d80580925a7f

List of FiguresFigure 1 DPI reporting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10




DN0976226 Issue 2-3

5

DPI Reporter

Id:0900d80580925a7f

List of TablesTable 1 DPI Reporter Interface Description glossary . . . . . . . . . . . . . . . . . . . . . 26




DN0976226 Issue 2-3

DPI Reporter

Id:0900d80580925a7f




DN0976226 Issue 2-3

7

DPI Reporter Summary of changes

Id:0900d80580925a81

1 Summary of changesChanges between document issues are cumulative. Therefore, the latest document

issue contains all changes made to previous issues.

1.1 Changes between release 2.0 and release 2.1

Changes between issues 2-2 and 2-3

Chapter Restrictions: editorial corrections.

1.2 Changes between release 10 CD8 and release 2.0


Chapter Pushing VoIP reports to SAI: updated note on reported call duration.

Chapter Restrictions: added note on reported call duration limitations.


Throughout the guide: Added information on the new DPI Trendica Reporting license.

Chapter Pushing VoIP reports to SAI: new chapter added on VoIP reporting type.

Chapter Restrictions:

• changed the restrictions of domain reports to a maximum of 30 000 domains and

12 000 users

• added a note on nodes

1.3 Changes between release 10 CD5.1 and release 10 CD8


Chapter Pushing POP3 server reports to SAI: new chapter added on POP3 server

reporting type.

Chapter Pushing email transactions reports to SAI: new chapter added on email trans-

actions reporting type.

Chapter Pushing domain reports to SAI: updated with the new IMSI reporting type..

Chapter Pushing user-specific reports to SAI: updated the list of the reported parame-

ters with Bearer ID, in order to support reporting for secondary PDP contexts / dedicated

bearers.

Flexi NG10 GGSN L7/L7+ Analysis license/feature has been renamed to Flexi NG Deep

Packet Inspection.

1.4 Changes between release 10 CD5 and release 10 CD5.1


Chapter Pushing user-specific reports to SAI: added Timestamp parameter description.

Chapters Overview and Pushing domain reports to SAI: updated to indicate the need for

external interfaces from the service aware blade.




DN0976226 Issue 2-3

DPI Reporter

Id:0900d80580925a81

Summary of changes


Content and structure updates throughout the guide concerning the new domain report-

ing type.




DN0976226 Issue 2-3

9

DPI Reporter Introduction

Id:0900d805808bf18b

2 IntroductionThis document provides information on the Deep Packet Inspection (DPI) Reporter

interface between Nokia Siemens Networks Flexi Network Gateway (Flexi NG) and

Serve At once Intelligence (SAI).

2.1 Scope

This document contains an overview of the DPI Reporter interface and the interface’s

role in the network architecture.

2.2 Audience

This document is aimed at operators and administrators working with the DPI Reporter

interface of Flexi NG. The reader should be familiar with packet data transfer, 3G net-

works, Evolved Packet System (EPS) and HTTP and SIP protocols and terminology.




DN0976226 Issue 2-3

DPI Reporter

Id:0900d80580938f38

Overview

3 OverviewSAI is a centralized service management business intelligence product which provides

insight into customer experience and helps organizations to make business decisions

and improve customer satisfaction.

The Flexi NG DPI reporting solution periodically sends Comma Separated Value (CSV)

files containing DPI data, from Flexi NG to SAI (TRENDICA), using FTP protocol. DPI

interface is the name of the interface that is used to connect Flexi NG Service Blades

(SBs) or Service Aware Blades (SABs) to the DPI reporter server.

DPI reports (towards Trendica) contain sensitive user information and hence, the DPI

reporting solution is controlled by a license, namely DPI Trendica Reporting. For

detailed information on privacy issues, see Flexi NG Security Hardening .

Figure 1 DPI reporting

Flexi NG reports the following types of information:

• user specific protocol statistics

• domain hits and unique hits (per reporting period)

• unique domains per IMSI

• POP3 server communicated (per reporting period)

• email transactions (per reporting period)

• VoIP related reports (per reporting period)




DN0976226 Issue 2-3

11

DPI Reporter DPI reports

Id:0900d8058091d1f2

4 DPI reports

4.1 Pushing user-specific reports to SAI A reporter process runs on every AS node of Flexi NG and has its own recovery group

name: Reporter.The reporter process creates user-specific reports that contain the

data volume, packets, protocol ID and IP version of protocol that the subscribers have

used within the reporting period.

These reports will be stored in a local ramdisk directory, accumulated and written in a

CSV file, with the help of configurable timers. CSV files are transferred from SB to SAI,

which acts as an FTP server.

The operator needs to include a specific PCC rule in the session profile of each user to

enable this type of reporting for the specific users. This PCC rule will have a parameter

configured that enables this type of reporting during the activation of the user session.

g Before configuring the PCC rule check licenses, see Flexi NG User Guide.

The CSV text files have the following format (the maximum permissible number of char-

acters for each parameter is shown in brackets):

• Timestamp (10 integer, indicates the PDP context creation

time in seconds (after 01/01/1970) in UNIX time stamp

format)

• Bearer ID (10 hexadecimal)

• IMSI (16 integer)

• IMEISV (16 integer)

• MSISDN (18 integer)

• User IP version 4 (8 hexadecimal)

• User IPversion 6 (32 hexadecimal)

• 10 x subscriber used Protocols with the following

parameters:

– Protocol Name (20)

– UL bytes (64bit integer)

– DL bytes (64bit integer)

– UL packets (64bit integer)

– DL packets (64bit integer)

– IP version of Protocol (4)

The naming of the report file includes the following info:

ng-reporting-id, report type, node-id, and timestamp (CSV creation time).

Example:

massggsnsc_dUserSpAppUsgStat_AS7-0_1288713565.dat

After generating the reports, Flexi NG reads the configurable FTP server address, des-

tination directory, user account and password and initiates the file transfer. The file is

transferred from the Flexi NG AS node to SAI, which serves as a configurable FTP

server. The CSV file is sent until SAI receives it successfully. If SAI is not available, then

Flexi NG stores the CSV file until connection is re-established. During this period if DPI




DN0976226 Issue 2-3

DPI Reporter

Id:0900d8058091d1f2

DPI reports

reporting feature is disabled or subscriber application report type is disabled then the

CSV file will not be sent.

g If there is no DPI data found by the reporter process during a period, then an empty CSV

file is being sent to SAI through FTP to indicate the above.

Flexi NG stops sending the CSV file in the following cases:

• When Flexi NG Deep Packet Inspection license is OFF or Flexi NG Deep Packet

Inspection feature is disabled.

• When the DPI Trendica Reporting l icense is OFF or the dpi-reporting feature is dis-

abled.

• When subscriber application report type is disabled (corresponding CSV file not

sent).

• When the subscriber application report interval is set to 0.

• When Traffica reporting feature is enabled (in this case reports will be sent towards

Traffica interface).

When a CSV file reaches to SAI successfully, then Flexi NG removes this CSV file and

keeps sending a *.ctr file until SAI receives it successfully. The *.ctr file is an empty

file and has the same file name as the CSV report file (excluding the *.dat extension).

The only use of the CTR file is to designate that the FTP file transfer was completed suc-

cessfully.




DN0976226 Issue 2-3

DPI Reporter

Id:0900d805808bf187

Flexi NG stores the CSV file until connection is re-established. During this period if DPI

reporting feature is disabled or domain report type is disabled then the CSV file will not

be sent.

gIf there is no DPI data found by the reporter process during a period, then an empty CSVfile is being sent to SAI through FTP to indicate the above.





abled.

• When domain report type is disabled (corresponding CSV files not sent).

• When the domain report interval is set to 0.





cessfully.




DN0976226 Issue 2-3

15

DPI Reporter

Id:0900d805808bf238

4.3 Pushing POP3 server reports to SAI

A reporter process runs on every SAB node of Flexi NG and has its own recovery group

name: ReporterSab. The reporter process creates POP3 server reports that contain

the POP3 Log-in server name along with the volume of transaction used for each POP3server within the reporting period.

These reports will be stored in a local ramdisk directory, accumulated and written in CSV

files, with the help of configurable timers. CSV files are transferred from SAB to SAI,


g Flexi NG SAB also supports external connectivity for the Dr interface (DPI reporting) with

the same routing feature set as the SB. For more information, see Flexi NG Site Con-

nectivity Guidelines and Commissioning and Integrating Flexi NG.





The POP3 server report CSV text files have the following format (the maximum permis-

sible number of characters for each parameter is shown in brackets):

• Log – in Server Name (50)

• Volume Counter (64bit integer, the volume of traffic from/to

the POP3 server excluding the teardown packets of the user

sessions)



Example:

massggsnsc_POP3ServReport_SAB2-0_1288713565.dat




server. The CSV file is sent until SAI receives it successfully. If SAI is not available, then

Flexi NG stores the CSV file until connection is re-established. During this period if DPIreporting feature is disabled or POP3 server report type is disabled then the CSV file will

not be sent.






• When the DPI Trendica Reporting license is OFF or the dpi-reporting feature is dis-

abled.

• When POP3 server report type is disabled (corresponding CSV file not sent).




DN0976226 Issue 2-3

DPI Reporter

Id:0900d805808bf238

• When the POP3 server report interval is set to 0.



file and has the same file name as the CSV report file (excluding the *.dat extension).The only use of the CTR file is to designate that the FTP file transfer was completed suc-

cessfully.




DN0976226 Issue 2-3

17

DPI Reporter

Id:0900d805808bf188

4.4 Pushing email transactions reports to SAI


name: ReporterSab. The reporter process creates top email senders/receivers

reports that contain the time of transaction, the email protocol, email volume, sender email address and receiver email address within the reporting period.











The top email senders/receivers report CSV text files have the following format (the

maximum permissible number of characters for each parameter is shown in brackets):

• Time of transaction (10 integer)

• Email Protocol (5)

• Email Volume (32bit, integer)

• Sender and receivers email addresses (maximum 250 characters

for the sum of addresses)



Example:

massggsnsc_EmailTransReport_SAB2-0_1288713565.dat


tination directory, user account, and password and initiates the file transfer. The file is


server. The CSV file is sent until SAI receives it successfully. If SAI is not available, thenFlexi NG stores the CSV file until connection is re-established. During this period if DPI

reporting feature is disabled or email transactions report type is disabled then the CSV

file will not be sent.






• When the DPI Trendica Reporting license is OFF or the dpi-reporting feature is dis-

abled.




DN0976226 Issue 2-3

19

DPI Reporter

Id:0900d8058091d1ee

4.5 Pushing VoIP reports to SAI


name: ReporterSab. The reporter process creates two reports, VoIP and SIP server

reports. VoIP reports contain the call activation time, the subscriber’s IMSI, the VoIPprotocol and the VoIP call duration within the reporting period. SIP server reports contain

the SIP domain server and the volume within the reporting period.











The VoIP report CSV text files have the following format (in brackets, the maximum per-

missible number of characters for each parameter is shown):

• Call Activation Time (10)

• IMSI (16 integer)

• VoIP Protocol (4)

• VoIP Call Duration (10)



Example:

massggsnsc_VoIPCallReport_SAB2-0_1288713565.dat

The SIP server report CSV text files have the following format (the maximum permissible

number of characters for each parameter is shown in brackets):

• SIP domain server (50)

• Volume (both UL and DL) (64bit integer, the volume of

traffic from/to the SIP domain)



Example:

massggsnsc_SIPReport_SAB2-0_1288713565.dat




server. The CSV file is sent until SAI receives it successfully. If SAI is not available, thenFlexi NG stores the CSV file until connection is re-established. During this period if DPI




DN0976226 Issue 2-3

DPI Reporter

Id:0900d8058091d1ee

reporting feature is disabled or VoIP report type is disabled then the CSV file will not be

sent.



g VoIP calls that have been established prior to the enabling of the VoIP report type, will

not appear in the relevant CSV file (on-the-fly activation of the report type).





abled.

• When VoIP and SIP report types is disabled (corresponding CSV files not sent).

• When the voip report interval is set to 0.





cessfully.




DN0976226 Issue 2-3

21

DPI Reporter Alarms

Id:0900d805808bf185

5 AlarmsThe following alarms are related to the DPI Reporter interface:

• 71516 DATABASE IS FULL• 71503 CONNECTION LOST TO PEER NETWORK ELEMENT (automatically

cleared when the feature is disabled)

• 71508 CONFIGURATION OUT OF SYNC (automatically cleared after successful

reading of its configuration)

• 71506 INSUFFICIENT CONFIGURATION

• 71502 CANNOT INITIALISE APPLICATION PROCESS

For detailed information on alarms, see Flexi NG Alarms.




DN0976226 Issue 2-3

DPI Reporter

Id:0900d805808bf189

Error cases

6 Error casesThe cases below cover the possible reasons for DPI report generation failure:

• expired or non-existent license – Flexi NG Deep Packet Inspection license

– DPI Trendica Reporting license

• incorrect FTP configuration

• the DPI reporting feature is disabled

• the Deep Packet Inspection feature is disabled

• For user-specific reports:

– the subscriber-application-report type is disabled

– the subscriber-application-report-interval is set to 0

• For domain reports:

– the domain-report type is disabled

– the domain-report-interval is set to 0

• For POP3 server reports:

– the pop3-serv-report type is disabled

– the pop3-server-report-interval is set to 0

• For email transactions reports:

– the email-transactions-report type is disabled

– the email-transactions-report-interval is set to 0

• For VoIP reports:

– the voip-report type is disabled

– the voip-report-interval is set to 0

For detailed information on error cases, see Troubleshooting Flexi NG.




DN0976226 Issue 2-3

23

DPI Reporter Restrictions

Id:0900d80580933dbd

7 RestrictionsThese are the restrictions (per node) in the current release.

gService blades / service aware blades host two nodes that work independently of eachother. For detailed information on nodes, see chapter Nodes in Flexi NG User Guide.

Subscriber application report type related:

• There is a maximum limit of the first 30 000 entries representing PDP contexts with

active data flows within the reporting interval.

• Only 10 protocols for each entry can be reported in each CSV file during the report-

ing period (CSV files only include the first 10 protocols, the rest are ignored).

• Only identified protocols will be reported in each CSV file during the reporting period.

• The maximum permissible value for an FTP user account or FTP password is 16

characters.

Domain report type related:

• There is a maximum limit of the first 30 000 entries representing HTTP domains

within the reporting interval.

• Only the first 12 000 users can be tracked for unique hits during the reporting

period.

• Only 50 unique domains can be accounted per user during the reporting period.

• The reported domain name can be 50 characters maximum (in case of domain

names that exceed this limit, only the first 50 characters will be included).

• The maximum permissible value for an FTP user account or FTP password is 16

characters.

• IMSI report type specific: – Only the first 12 000 users can be tracked for IMSI reports during the reporting

period.

– Only 50 unique domains can be accounted per IMSI during the reporting period.

POP3 server report type related:

• The maximum amount of characters for each Log-in server can be 50 characters.

• Only the first 5 000 POP3 server can be accounted during the reporting period.

Email transactions report type related:

• The maximum recorded and transmitted email transactions entries can be the first

10 000.

• For each entry the report can contain the sender/receivers email addresses

(maximum 250 characters for the sum of addresses), along with the time of the

transaction, the size of the email and the email protocol.

VoIP report type related:

• The maximum recorded and transmitted VoIP entries can be the first 30 000.

• The following VoIP protocols are supported: H225, MGCP, SIP, Q931.

g Flexi NG always reports the highest level protocol. In the case of a VoIP protocol

encapsulating another VoIP protocol, only the highest level one will be reported.




DN0976226 Issue 2-3

DPI Reporter

Id:0900d80580933dbd

Restrictions

g VoIP calls that have not been properly terminated (e.g. time-out, data packet loss)

will be reported with 0 call duration. In such cases the reported duration will be

included in the CSV file after a grace period.

• SIP report specific:

– The maximum recorded and transmitted SIP entries can be the first 5 000.

– The maximum amount of characters for each SIP domain can be 50 characters.

– As several SIP servers can be used to relay the VoIP call, only the first VoIP

server is reported in the case of outgoing calls and the last VoIP server in the

case of terminating calls.

– The value of the SIP server is extracted from SIP requests, excluding the SIP

BYE request. This applies to sessions where the SIP server is not already

known. Depending on UL/DL requests the following fields are used for extrac-

tion:

• The value of the SIP server is extracted from URI field in uplink SIP requests.

• The value of the SIP server is extracted from the first VIA field in downlink

SIP requests.

For detailed information on error cases, see Troubleshooting Flexi NG.




DN0976226 Issue 2-3

25

DPI Reporter References

Id:0900d805808bf239

8 References

1. Nokia Siemens Networks Flexi Network Gateway Site Connectivity Guidelines

2.Nokia Siemens Networks Flexi Network Gateway Commissioning and IntegratingFlexi NG

3. Nokia Siemens Networks Flexi Network Gateway User Guide

4. Nokia Siemens Networks Flexi Network Gateway Alarms

5. Nokia Siemens Networks Flexi Network Gateway Troubleshooting Flexi NG

6. Nokia Siemens Networks Flexi Network Gateway Security Hardening



DPI Reporter Glossary

9 Glossary

Term Definition

AS application server

CSV comma separated value

CTR call transfer recall

DL downlink

DPI deep packet inspection

EPS evolved packet system

FNG-ID Flexi network gateway identification

FTP File Transfer Protocol

GGSN gateway GPRS support node

HTTP Hypertext Transfer Protocol

IMEI international mobile equipment identity

IMSI international mobile subscriber identity

IP Internet Protocol

MGCP Media Gateway Control Protocol

MSISDN mobile subscriber integrated services digital network number

NG network gateway

PCC policy and charging control

PDP Packet Data Protocol

POP Post Office Protocol

SAB service aware blade

SAI serve at once intelligence

SIP Session Initiation Protocol

UL uplink

Table 1 DPI Reporter Interface Description glossary

ng_dpi_ifd

Documents