ericsson.

com/5g-core/
software-probes

Securing the 5G
experience with
software probes
March 2020
2 Ericsson  |  Securing the 5G experience with software probes

Executive summary

Contents
03 Introduction
04 VNF/CNF built-in probes for
cloud native and 5G security
06 Ericsson‘s software
probe solution
07 SW probe high-level
architecture overview
08 TCO gains with Ericsson’s
SW probe
09 Integration with
existing probe solution
10 S1-U/N3 and SGI/N6 user
plane interface tapping
12 Customer benefits from a
new probe solution
14 Conclusion
Currently, probes play an important role in
allowing communications service providers
to ensure customer experience and manage
their existing networks effectively. The
introduction of 5G and increased complexity
of networks will only increase the need
for probing, as access to actionable data
is essential to enable automation and
customer experience management.
The development of the new 5G
standard includes security as an essential
factor and, as a result, a new service
based architecture (SBA) was introduced
that utilizes encrypted interfaces
between network functions (NF). This
encryption, along with the introduction
of container-based cloud native NFs,
poses new challenges to traditional probing
methods. As a result, a new method is
needed to maintain security while still
capturing the desired data, one which
utilizes built-in software (SW) probes
within the NFs and delivers the
appropriate data to analytics over
industry-standard interfaces.
To address these challenges, we have
introduced built-in software probes within
dual-mode 5G Core in order to secure output
and enable optimal performance. This
reduces complexity and the cost of utilizing
common probing interfaces across all NFs.
This report details our perspective on
tapping, probing and brokering functions in
cloud native dual-mode 5G Core. It presents
how optimized monitoring solutions can
reduce service providers’ historically high
total cost of ownership (TCO). We estimate
reductions of up to 60 percent for capex
and up to 90 percent for opex. Furthermore,
we show the value of the pre-integration
of Ericsson Expert Analytics (EEA) into our
probe solutions to capture events with a
high degree of granularity.

Figure 1: Reducing TCO with the Ericsson software probe

Traditional probing
Total cost of ownership approach

Data volumes
and complexity
Ericsson software probe
5G encryption

Network
expansion

2G 3G 4G 5G Network complexity and data growth

3 Ericsson  |  Securing the 5G experience with software probes
Introduction
With both customer expectations on
experience and the volume of traffic
constantly growing, current probing
solutions are increasingly a burden to
service providers, especially in terms
of both opex and capex. The advent of
5G will only increase the importance
of probing in order to support the new
needs of both customers and businesses.
Additionally, probing and access to
actionable data play a vital role in
achieving increased levels of automation
and the application of technologies
such as Artificial Intelligence (AI)
and Machine Learning (ML).
Introducing 5G Core (5GC) brings new
challenges related to traditional probing
practices. One of the cornerstones of 5GC
is the new SBA and increased security,
where all the traffic is encrypted. This poses
a problem for traditional probing solutions
when it comes to capturing the desired data
without breaching security. Furthermore,
the increased distribution and elasticity
of cloud native 5GC networks will present
even more challenges for traditional probing
methods and solutions.
Continuous monitoring and deep analysis
of networks is essential in guaranteeing Tapping is capturing or mirroring
• 
network and subscriber assurance. Most network packets sent between NFs.
importantly, it generates uninterrupted data Probing is basic processing of
• 
sets on network statuses and behaviors, packets to create metadata,
both of which are important tools in correlate data sources or
investigating and troubleshooting any carry out other processing
issues that could compromise network of network packets.
performance and security. As well as being Brokering functions are more
• 
used preventatively, the collected data can advanced data processes, such
be used proactively in improving network as network traffic filtering,
planning and performance, and as a tool for answering multiple consumer
better marketing and customer experience. needs or optimizing security
With our software probes we address the and traffic flow.
challenges outlined above, as illustrated
in Figure 1.
Currently, a standard monitoring solution
utilizes appliances to perform tapping,
probing and brokering functions on the
data. By feeding the data into back-end
monitoring systems or analytics frameworks,
we can develop advanced insights.
This report details our perspective
on tapping, probing and brokering
functions in cloud native dual-mode
5G Core. It further shows how tapping
and probing can be conducted in
container-based environments without
jeopardizing network security, and how
optimizing monitoring solutions can help
to minimize service providers’ historically
high TCO. We present a solution which
addresses the demands of monitoring
cloud native networks. In addition, we
explore how it can be gradually integrated
in combination with existing network
solutions for a seamless transition.
4 Ericsson  |  Securing the 5G experience with software probes

VNF/CNF built-in probes for

cloud native and 5G security

The challenges of 5G networks necessitate

a paradigm shift in probing solutions.

Current probe solutions handle high data
volumes from many separate points in a
network, resulting in the need for a high
network footprint. Often, the solution is
dimensioned to handle maximum loads,
even when traffic is low, resulting in
inefficient use of computing and storage
resources for service providers. Now that
virtualization has been adopted through
the deployment of VNFs on VM-based
clouds, the next big technological step
for service providers will be the shift to
cloud native network functions (CNFs).
While there are many advantages to
be gained from this cloud deployment,
there are things to consider due to the
impact on NF architecture mandating a
paradigm shift in probing solutions. Until
now, probe deployment has been made
possible by identifying what network
traffic travels along which physical or
virtual link. However, the adoption of
Kubernetes networking will change the
network infrastructure and how probes
are deployed.

Figure 2: Current probing solution

Virtual Packet Core Physical Packet Core

Raw
data

PHY
Tap
MME GW-C PGW-U
MME GW-C PCRF
on VM on VM on VM
Application PHY
layer Tap

PHY
NFVI vSwitch vSwitch Tap
PGW-U
Physical
layer TOR Switch/DC-GW
Local probe
with NPB

Raw Raw Raw 3GPP Raw

data data data packets data
3GPP
Local Probe packets
with Network Central Probe with NPB Local probe
Packet Broker functions (PNF or VNF) with NPB
(NPB)

Northbound API:
Subscriber Events 3GPP
packets
5 Ericsson  |  Securing the 5G experience with software probes
As a result, here are the main considerations:
•A utomation
CNFs are supported with automated
lifecycle management procedures.
A CNF can be instantiated (see Figure 3),
or pod scaled in or out to improve
network resource utilization. The NFs
are no longer anchored to the underlying
physical or virtual hardware. It is a
challenge to deploy probes with static
locations and defined capacities in an
elastic network.
• Cloud native characteristics
Traffic between NFs deployed in a
Kubernetes node will not be visible
outside the Kubernetes cluster, and
therefore neither in the NFVi layer nor on
the hardware infrastructure gateway. It
is a challenge to tap all 3GPP traffic with
probes located in the NFVi or underlying
hardware infrastructure.
Figure 3: The complications of Kubernetes software dynamism and elasticity
CNF
K8s master
Controller Scheduler
API server
• Distributed networks
IoT and 5G technologies bring a
multitude of use cases across several
industries, in areas such as smart
manufacturing, augmented reality and
IoT applications. To realize these use
cases, operators need infrastructure
with edge computing and distributed
cloud capabilities. Networks will become
distributed and optimized to meet the
need for automation. It is a challenge to
distribute and automate probe solutions
to match flexible network distribution.
• Enhanced security with encrypted SBI
5G requires SBA and Service Based
Interfaces (SBI). Control plane
communication through SBI requires
encryption, which is expected due to
the prevalence of network vulnerability
as an industry topic. Inter-pod traffic
will become encrypted within container
clusters. The NFs, as the security key
owner, will be the most convenient
component for providing data decryption.
It is a challenge to tap data with probes
outside NFs when data is encrypted.
Host
K8s node 2
Host
K8s node 1
NF 1 Pod 1 NF 2
Pod 1
eth0
veth0
cbr
eth0
With these challenges in mind, the industry
needs a new solution based on virtual
probes to capture the relevant traffic raw
packets. The answer to this is built-in
tapping and probing functionality within
the software of CNFs themselves.
Additional difficulties can come from
introducing containerized NF built-in
probe agents for tapping and probing
or using integrated third-party probe
agents. A lack of industry standardization
to define best practice in implementing
NF integrated tapping would lead to
fragmented and inconsistent solutions,
with no standardization between
different probe vendors. This lack of
standardization creates unnecessary
complexity for vendors with multi-vendor
lifecycle management dependencies,
while integration is needed to ensure
the proper placement for tapping
and probing. As a result of this, there
are necessary changes needed to the
Kubernetes cluster in order to house
external probe agents, which may
compromise performance and security.
Each solution that houses integrated
third-party probe agents will demand
extra deployment testing and more
complex troubleshooting. For this reason,
we will not integrate third-party probe
agents, but rather focus on supplying all
necessary data via standardized interfaces
to all third-party users.
Host
K8s node n
NF 2 Pod 1
Pod 1
Additional
instance
Pod 1
Pod 1
eth0 One instance
veth0
6 Ericsson  |  Securing the 5G experience with software probes
Ericsson‘s software
probe solution
Our software probe addresses many of the
challenges associated with probing.
Probing and monitoring
Our software (SW) probe is a built-in
virtual network probe solution for cloud
native architecture. It is specifically
designed to monitor and troubleshoot
CNFs and provide data streams for
analytics. Our SW probe is delivered
as an additional service along with our
usual Operation, Administration and
Maintenance (OAM) service set across
all our dual-mode 5G Core products,
applicable to both EPC and 5GC NFs.
Our SW probe addresses the challenges
associated with probing discussed earlier
in this paper. It allows the network taps
and probes to be embedded into the NF
business logic.
Figure 4: SW probe solution
AMF
4G/5G
MME
With this solution there is no need to
orchestrate and scale separately, with
zero human intervention a very achievable
possibility. The solution also allows efficient
data movement and processing, as data
capture and filtering occurs at the source
NF, resulting in significant traffic reduction
within the infrastructure.
The embedded functionality of the
SW probe means that the probe solution
is distributed to edge sites alongside the
NF’s distribution in the network.
The solution is independent of cloud
infrastructure and has access to
decrypted 5GC SBI packets. The use
of metadata produced by NFs means
that minimal post-processing
SMF UPF NF
UPF NF
PGW-C PCRF
PGW-U
will be required, resulting in a
noticeable footprint reduction.
The Service Communication Proxy
(SCP) is an optional value added 3GPP
component which, among other things,
acts as a TLS termination point when
included in the SBI signaling path.
The Ericsson Service Communication
Proxy will be able to tap decrypted SBI
signaling data. However, since the SCP
is mainly needed for the regionalization
of large networks, access across vendors
or firewalling from unsecure edge sites,
the Packet Core NFs will need to be
able to provide tapping of decrypted
SBI signaling for direct NF to NF
communication - in other words,
when no SCP is involved.
EPC 5GC Tapping and event reporting
Software Probe Common Module
7 Ericsson  |  Securing the 5G experience with software probes

SW probe high-level
architecture overview

Our SW probe consists of three components: the vTap module,

the Event Reporting module and the Probe Controller.

The vTap and Event Reporting are built-in
NF components. They are in each pod
where signaling or payload is processed
across our Packet Core Controller (PCC)
and our Packet Core Gateway (PCG) node,
as depicted in Figure 5.
• The vTap continuously captures and
mirrors 3GPP raw packet streams. Extra
information like network topology and
protocol can be added to the streams.
The vTap is an industrialized and
containerized version of Integrated
Traffic Capture (ITC), previously provided
as a troubleshooting feature in Ericsson
PC products.
• Event Reporting is based on our
proprietary subscriber event records
called Event Based Monitoring (EBM).
Figure 5: SW probe high-level architecture
Control plane event records are generated
for each 3GPP procedure type and NF
type, and contain compiled data in
the context of network, session and
subscriber information.
The user plane event records are
generated for each subscriber’s user plane
traffic flow levels: service data sessions
(e.g. a Netflix video session), transport
flows (e.g. individual Transmission Control
Protocol flows in a Netflix session) and
L7 transactions (e.g. individual Transport
Layer Security transactions involved in a
Netflix session). These events are enriched
with user and session data, PCG smart
data (advanced network and application
contextual analytics and internal
configuration data) and, in the case of
service session and transport flow events,
TCP KPI data.
This event data allows analytic systems
to produce network signaling KPIs and
user plane application usage, or tiered
QoE reports based on various subscriber
and network dimensions. This represents
a valuable source of data for different
service provider departments, such as
network assurance, network planning and
engineering, customer care and marketing.
The SW Probe Controller acts as the
common VNF API towards consumers
and provides broker functions, such as
multi-consumer support, data filtering,
in-built encryption, masking of output
data and timestamp alignment for
simplified correlation.
It also acts as a responsive API that
provides online communication with
consumer on-boarding and consumer
data requests. It supports AI in data
streams for smarter collection, insights
and consumer-driven feature development
through customization options.

Northbound e.g. ENM/CNOM,

CNF EEA, 3PP applications

3P consumer
Common O&M framework

3P consumer
PM FM CM

Netconf yang Ericsson

Expert Analytics
Data broker
Logs

Probe Controller function

~10 consumers
Serialized and binary Industry standard/
Serialized and binary driven API
bit packed raw
bit packed XML
packet/messages
streamed over TCP Common components
streamed over TCP
Probe Controller – Control data production in NF, provides broker
functions like transmit data to multi-consumers and applies filters,
vTap Event reporting metadata, encryptions, etc.
vTap Event reporting
vTap Event reporting vTap – Provides raw 3GPP interfaces telemetry packets
captured/mirrored for all (CP) or a subset of (UP) subscribers

Event Reporting – Provides

Cloud native 5G EPC and 5GC NF(s) • CP signaling event records containing user and session
contexts and status, combining multi-interface communication
• UP service usage with TCP related KPIs

d
8 Ericsson  |  Securing the 5G experience with software probes

TCO gains with

Ericsson‘s SW probe

In this section we discuss whether a built-in SW probe

can provide a more cost-efficient alternative to traditional probes.

The answer is best shown when comparing
a hardware-based probe and our software
built-in probe solution, particularly when
calculating the respective impacts on
both capex and opex. For this exercise,
we devised the following scenario:
• A new PGW NF is deployed at an
edge/deep edge site.
• Traffic volume of 150Gbps with
100 percent Deep Packet Inspection
(DPI) is enabled.
•N  etwork traffic probing is needed at a
remote site and then transferred back to
the service provider’s analytical center.
Figure 6 describes the metrics included
under capex and opex.
Our SW built-in probe solution can enable
up to 60 percent savings in capex depending
on network configuration. A traditional
hardware-based probe would deploy a
complete solution, including switches,
physical taps, packet brokers and physical
hardware probes with a computing power
sufficient in supporting the 150Gbps
data throughput. In contrast, our built-in
software probe would only require
additional computing power on existing
PGW NFs based on dimensioning.
In regards to opex, there can be
up to 90 percent savings with our SW
built-in probe solution. A traditional
hardware-based probe would require
services in order to deploy the solution e.g.
installation, powering up, SW load and node
configuration. The solution’s components
are then integrated with the service
provider’s NMS, MANO and analytical
systems. Finally, the solution is integrated
with the PGW NF. The most important
distinction with our software built-in probe
solution is the pre-integration of probing
with the PGW NF software, which allows
hopping over new integrations with existing
systems. Another impact is the
use of Ericsson Automated Acceptance
Tests (AAT) to achieve acceptance in
hours instead of weeks.
Conclusion
We expect the use of automation in
our SW built-in probe to achieve savings
in both capex and opex. The capex
footprint savings are estimated to be up to
60 percent and opex savings are estimated
to be up to 90 percent. The gains presented
are exemplified by our dual-mode
5G Core products: PCC and PCG. Having
dual-mode 5G Core products allows
these gains to be applicable to not only
service providers planning standalone
5G launches, but also existing LTE and
5G non-standalone networks.

Figure 6: Base for calculations, not including HW and SW for overlay security solutions

Impact on Metrics

Capex Hardware (HW) and software (SW) licenses require purpose-built probe solutions.
For HW-based probes, this typically includes switches and physical taps, packet brokering functions and physical
hardware-probe processing.
For software embedded probes, this includes COTS servers (e.g. Ericsson dual socket 24 core HDS used for EPC User Plane).

Opex Services (SE) for installation, power up, SW install and configuration
SE for Network Management System (NMS) integrations
SE for Management and Orchestration (MANO) system integrations
SE for integrating packet brokers to physical probes
SE for integration of packet brokers to Packet GateWay (PGW) NFs (HW-based probe only)
SE for integrating PGW NFs to service providers’ analytical centers (Ericsson software built-in probes only)
9 Ericsson  |  Securing the 5G experience with software probes
Integration with
existing probe solution
There are different integration models for different
existing solutions to reduce disruption.
The reality is that all operators today
possess install bases of 3P probe vendors
consisting mainly of physical HW
probes and their back-end monitoring
systems. Our probe enables different
types of integration models with existing
monitoring solutions in order to achieve
TCO gains over physical probes and
not disrupt ongoing business practices.
Integration with northbound systems
is simplified by using open, transparent
and secure interfaces that adhere to
industry standards. Data can be pushed
or pulled and even streamed directly to
northbound systems or ingested into data
lakes, in highly compressed TCP streams,
or sent as messages to message brokers
such as Kafka.
The most effective approach from a TCO
perspective is to enable SW probe event
reporting on dual-mode 5G Core products,
so that existing analytic systems ingest
the SW probe control plane and user plane
Customers can utilize different integration models in order to reduce disruption
subscriber events. In this case, an SW probe
replaces network taps, packet brokers
and external probes deployed at Ericsson
Packet Core interfaces.
Integrating these probes can be
relatively simple depending on the
complexity of use cases, the analytic tools
ecosystem, the heterogeneity of probes
deployed, and the exposed data set. It
could be a direct integration with few tool
adaptations or utilize a mediation system
which translates event data schemas in
order to avoid tool impact. There are cases
that require more complex integration
strategies. We are already collaborating
with different tool vendors so the SW probe
can be used as an alternative to their
probe appliances.
SW Probe vTap can be enabled
occasionally for troubleshooting issues
detected by SW Probe Event Reporting.
It is also possible to adopt partial event
reporting integration approaches, such
as integrating only the control plane or
user plane events and limit certain NFs
depending on the analytic use cases.
In cases where event reporting
integration is not applicable and existing
probes are needed, SW Probe vTap can
be used as an alternative to network taps
and packet brokers. SW Probe vTap can
also provide contextual metadata using
standard trace file formats, which can
be used to reduce probe processing and
facilitate troubleshooting of infrastructure
problems impacting an application.
The value of using PCC SW Probe vTap
(and other dual-mode 5G Core control
plane products) is large, as it provides a
future-proof solution, agnostic to cloud
native deployment and 5G security aspects.
10 Ericsson  |  Securing the 5G experience with software probes

S1-U/N3 and SGI/N6 user

plane interface tapping

There are several integration options to suit different needs.

In the case of S1-U/N3 or SGI/N6
user plane interface tapping, there are
different options to be evaluated. One
is to keep physical taps on the DC-GW
physical interfaces, which avoids
impacting NFVi transport, but requires
integration and maintenance of taps and
brokers every time a PCG is deployed in a
new data center. An alternative is to use
PCC SW Probe vTap, allowing filtering of
relevant traffic and providing valuable
metadata, such as subscriber identity,
application ID or networking.
These are of value for the probing
system but at the expense of an
additional load in NFVi. Other solution
alternatives, such as NFVi tapping as a
service solution or vNIC port mirroring,
can be explored but are not recommended
as they depend on VIM and NFVi specific
support and have a large impact on NFVi,
as filtering is carried out by the packet
broker appliance.
Both SW Probe Event Reporting and
SW probes can be easily customized to
facilitate the selected integration approach.
The integration of 3P probe tapping or
brokering agents in dual-mode 5G Core
Kubernetes containers is not supported due
to the impact on the commercial packaging,
telco application SW lifecycle, resource
management and required customization.
Figures 7 to 9 show the different
forms of monitoring solution, be they
current solutions or the potential ways of
updating them.

Figure 7: Current monitoring solution

Analytics tools ecosys- External probe

Marketing and External tap/broker

Subscriber Network Subscriber
business
troubleshooting assurance experience
intelligence

Not future proof and

Data lake capex/opex costly.

Note: only PCC/PCG included,

not adding all dual-mode 5G
Existing 3P probe events Core NFs for simplicity

Ericsson IMS RAN Policy 3P GTP UMTS CS

IMS 3P Probe probe MOT probe 3P probe probe
Events
Mw Top/Podiet eNodeB
broker
Packet Core Top/Podiet Top/Podiet Top/Podiet Top/Podiet
Controller broker broker broker broker

Top/Podiet Gp
broker Gn A
Top/Podiet
broker

Top/Podiet
28/NB broker

Top/Podiet
broker
511/N11 Top/Podiet
broker Packet Core
3v Gateway

Gx/N7 Top/Podiet
broker

WI-FI and 5G/4G Top/Podiet

Gy Int DG3 LAN
Fixed IMS and VOLTE broker 2G and 3G
11 Ericsson  |  Securing the 5G experience with software probes

Figure 8: Monitoring solution swapping 5G probes

Note: only PCC/PCG included, not adding
Analytics tools ecosystem all dual-mode 5G Core NFs for simplicity

Marketing and External probe

Subscriber Network Subscriber
business
troubleshooting assurance experience
intelligence
External tap/broker
Existing 3P probe events
Zero touch solution.
Mediation (optional) Data lake
60% capex and
97% opex savings
compared to PHY probing.
Ericsson Ericsson Ericsson
Existing 3P probe events
events events events

Ericsson
RAN 3P GTP UMTS CS
IMS
probe MOT 3P probe probe

Mw
eNodeB

Packet Core Top/Podiet Top/Podiet Top/Podiet Top/Podiet

28/NB Controller broker broker broker broker
Gp
3v 511/N11 Other ? Packet Core
3v Gateway Gn A
Gx/N7
Gy
WI-FI and 5G/4G
Int DG3 LAN
Fixed IMS and VOLTE 2G and 3G

Figure 9: Monitoring solution keeping existing probes

Analytics tools ecosystem External probe
Marketing and
Subscriber Network Subscriber External tap/broker
business
troubleshooting assurance experience
intelligence
Future proof, fixes
Tapping issues and
Data lake
reduces capex/opex.
Note: only PCC/PCG included,
not adding all dual-mode 5G
Existing 3P probe events Core NFs for simplicity

Ericsson IMS RAN Policy 3P GTP UMTS CS

IMS 3P Probe probe MOT probe 3P probe probe
Events
Mw Top/Podiet vTap vTap
eNodeB
broker
Packet Core Top/Podiet Top/Podiet Top/Podiet Top/Podiet
Controller broker broker broker broker
28/NB Mw
511/N11 Other ? Gp
Packet Core
3v Gx/N7 Gateway Gn A
Gy
Mw Top/Podiet
broker (DCGW)

WI-FI and 5G/4G

Fixed IMS and VOLTE 2G and 3G
12 Ericsson  |  Securing the 5G experience with software probes

Customer benefits from a

new probe solution

How can our SW probe solution

improve customer experience?

A major promise of 5G is the improvement
of user experience in terms of throughput
and low latency. As a result, end-customer
experiences with telecom services will be of
supreme importance to service providers.
Furthermore, this will require analytics in
order to produce relevant insights from
complex networks.
In a mobile network, we are going from
millions to billions of possible dimensions
of customer experience, i.e. new types of
devices, locations, network topologies,
OTT services and consumers. With 5G,
experience is everything and often the
foundation for new business.
Ericsson Expert Analytics creates the
visibility to uncover issues that are necessary
for superior customer experience. Tightly
integrated with Ericsson dual-mode 5G
Core, it captures the events that matter in
real-time with high granularity.
This includes service and application usage
data per individual user session when
visualizing end-to-end service sessions in
mobile network environments.
Expert Analytics is enabled to ingest
SW probe event reporting exposed by
Ericsson dual-mode 5G Core products,
PCC and PCG.
The Event Reporting interface
exposed via SW probes in PCC and PCG
will provide measurement metrics with
high granularity and time precision,
enabling efficient session event
correlation for further processing
and analysis by Expert Analytics.
Expert Analytics will provide insights
about subscriber UE capabilities and
mobility behavior in mixed 4G and 5G
network environments based on PCC
event reporting.
This also means PCC and PCG SW probes
can replace the use of network taps
currently used in Expert Analytics, packet
brokers and external probes deployed on
dual-mode 5G Core network interfaces.
This can help to decrease TCO for
operations and integration for
monitoring, all while performing general
troubleshooting and analytics solutions.
Incidents are generated based on
service and resource quality indicators,
defined by rules, and include configurable
cause information and recommendations
for next actions. Generation of incidents
enables proactive actions, either via
manual tasks or via automated settings
for closed-loop actuation.

Figure 10: Insights with analytics

Market-leading customer-centric intelligence Superior 5G

experience leakage

5G subscriber insights
powered by Expert Analytics
Customer Automated Built-in
experience incidents root cause insights

Pre-integrated E2E insights Using AI/ML

Increase 5G
adoption usage
13 Ericsson  |  Securing the 5G experience with software probes

Figure 11: SW probe solution overview

EPC 5GC Tapping and event reporting

Central handling of:
Built-in SW probe data producers: • Configuration
• Event reporting • Probing interface data
• 3GPP interface raw packets • Data brokering functionality
Request per consumer,
with individual filters e.g.
• Metadata 
• Interface encryption
• Data masking

AMF NF MME MF CM
3P consumer

3P consumer
SW Probe
Controller

SMF NF
broker function
Packet/event Ericsson
Expert Analytics

SGW-C NF PGW-C NF
Packet/event output

Monitoring
Short-term Troubleshooting
Cloud native dual-mode 5G Core store Streamed, secure, Analytics
(e.g. Packet Core Controller) transparent and Assurance
industry standard

Expert Analytics is pre-integrated Understand and deliver Increase 5G adoption

for 5G and comes with: superior experiences • Monitor 5G uptake in a
• c ontinuous data analysis, as it correlates • Proactively at subscriber level with multi-dimensional view
data at the source to capture automatic root cause detection • Isolate bottlenecks to accelerate
relevant experience insights about every • Analyze network triggers 5G adoption
user session in real-time
•a  utomated root cause analysis across Identify 5G leakage 5G usage
domain end-to-end views by • Uncover spots where 5G-enabled • Analyze 5G usage across locations,
monitoring what matters efficiently users are still using LTE applications and devices
• analytics and ML: to produce • Fast-track the 5G onboarding • Plan recommendations to
out-of-the-box intelligence with by fixing problem areas accelerate the strategy
500+ embedded incidents and
advanced anomaly detection

d
14 Ericsson  |  Securing the 5G experience with software probes

Conclusion

Ericsson Expert Analytics is enabled to packet brokers and external probes

ingest SW probe event reporting exposed
by Ericsson dual-mode 5G Core products.
The Event Reporting interface exposed
via SW probes in PCC and PCG will
provide measurement metrics with high
granularity and time precision, enabling
efficient session event correlation for
further processing and analysis by Expert
Analytics. Expert Analytics will provide
insights about subscriber UE capabilities
and mobility behavior in mixed 4G and 5G
network environments based on PCC event
reporting. This also means PCC and PCG
SW probes can replace the use of network
taps currently used in Expert Analytics,
deployed on dual-mode 5G Core
network interfaces. Furthermore, we
can see a decrease in TCO for operations
along with integration for monitoring,
all while performing general
troubleshooting and analytics solutions.
Incidents are generated based on service
and resource quality indicators, defined
by rules and include configurable cause
information and recommendations for next
actions. By generating incidents proactive
actions are enabled, either via manual
tasks or via automated settings for
closed-loop actuation.

In summary: we are changing the game from day one in 5G

We ensure the 5G experience with SW probes
• Monitor and ensure the 5G customer promise
• Drastically improve TCO compared to traditional solutions
• Keep sensitive data secure

Our dual-mode 5G Core – SW probes Monitor and secure the

• NF built-in 5G customer promise
• Common probing interfaces across all NFs
• Open, transparent and secure interfaces

+ Drastically reduce
the traditional TCO

Ericsson Expert Analytics for 5G

• Pre-integrated with Ericsson 5G RAN and Core
• Automated, customer-centric intelligence
Keep sensitive data secure
• Experience focus from day one in 5G

Ericsson
SE-164 80 Stockholm, Sweden
Telephone +46 10 719 0000
www.ericsson.com
Ericsson enables communications service providers
to capture the full value of connectivity. The company’s
portfolio spans Networks, Digital Services, Managed
Services, and Emerging Business and is designed to
help our customers go digital, increase efficiency and
find new revenue streams. Ericsson’s investments in
innovation have delivered the benefits of telephony
and mobile broadband to billions of people around
the world. The Ericsson stock is listed on Nasdaq
Stockholm and on Nasdaq New York.
www.ericsson.com
The content of this document is subject to 18/28701-FGB 101 0909
revision without notice due to continued © Ericsson 2020
progress in methodology, design and
manufacturing. Ericsson shall have no
liability for any error or damage of any kind
resulting from the use of this document