İki Teknoloji 1
LTE:
A	feature	based	introduction
LTE	Core	Features
Annex.	GTP	Primer
Irfan Ali
Video at youtube:
https://www.youtube.com/watch?v=FPfExr9bEEg&list=PLgQvzs
PaZX_bimBc5Wu4m6-cVD4bZDav9&index=9
Irfan Ali 2İki Teknoloji 2
What	is	GTP?
• GTP		=	GPRS	Tunneling Protocol
• What	is	Tunneling in	the	IP	World?
Ø Tunneling	in	the	IP	world	means	putting	an	IP	packet	inside	
another	IP	packet.	
IP_src ->
IP_dst Payload
IP_a->
IP_b
Inner	IP	Packet
Outer	IP	Packet
GPRS General Packet Radio Service
Irfan Ali 3İki Teknoloji 3
What	is	the	purpose	of	GTP	Tunneling?
• Route	an	IP	packet	along	a	path	that	is	not	topologically	correct	for	
the	packet.
Mehmet’s IP address
46.1.78.189->
10.40.40.12 Internet
S-GW
P-GW
eNB
Ayse
Mehmet
10.10.10.1
10.10.10.2
10.10.10.0/24
10.10.20.1
10.10.20.0/24
10.10.20.2
GTPTunnel
IP_sgw ->
IP_enb
UDP_
dst=
2152
TEID_x
IP_pgw ->
IP_sgw
IP
UDP_
dst=
2152
UDP
TEID_k
GTP-U
header
Mehmet’s IP address
10.40.40.12
DHCP
GTP is
IP-in-UDP Tunneling
HiIP_a ->
IP_m
HiIP_a ->
IP_m
HiIP_a ->
IP_m
HiIP_a ->
IP_m
Irfan Ali 4İki Teknoloji 4
How	does	the	GTP-U	Tunnel	get	setup?
• GTP	Protocol	has	two	parts
Ø Signaling	part	called	GTP-C	(GTP-Control)
Ø User	data	part	called	GTP-U	(GTP-User)
• GTP-C	is	used	to	setup	GTP-U	tunnel
• Both	GTP-C	and	GTP-U	run	on	top	of	UDP
• IP-in-UDP	tunneling	is	only	used	for	GTP-U
• GTP-C	carries	control/signaling	messages
IP_pgw ->
IP_sgw
IP_a ->
IP_m
UDP_
dst=
2152
TEID_a
IP_pgw ->
IP_sgw
UDP_
dst=
2123
TEID_k
IP UDP GTP-U
header IP UDP GTP-C
header
GTP-C message
Irfan Ali 5İki Teknoloji 5
SGW PGW
TEID
21232123
2152
TEID
IPc,sgw
2152
IPu,pgwIPu,sgw
TxRx Tx Rx
TEID
TEID
TxRx Tx Rx
TEIDas
TEIDbs
TEIDcs
IPc,pgw
SGW PGW
TEID
2123
2152
2123
2152
TEID
IPc,sgw
IPu,sgw
IPc,pgw
IPu,pgw
TxRx Tx Rx
TxRx Tx Rx
TEIDTEID
How	does	GTP-U	Tunnel	get	setup:	Example
TEIDas
TEIDas
0
C.S. Req (IMSIa, C: IPc,sgw,TEIDas,
EBID5:IPu,sgw,TEIDas) C.S. Rsp (C:IPu,pgw,TEIDap,
EBID5:IPu,pgw, TEIDxp)
TEIDbs
TEIDcs
TEIDap
TEIDbp
TEIDcp
TEIDap
TEIDbs
TEIDcs
TEIDbp
TEIDcp
Irfan Ali 6İki Teknoloji 6
Packet	Trace:	Create	Session	Request	(S11);	MME->SGW
MME
SGW/
PGW
0
21232123
0x1
eNB
SGW/
PGW
21522152
S11
S1U
Irfan Ali 7İki Teknoloji 7
Packet	Trace:	Create	Session	Response	(S11);	SGW	->	MME
MME
SGW/
PGW
21232123
0x1
eNB
SGW/
PGW
21522152
S11
S1U
0x80..01
0xc0..1
Irfan Ali 8İki Teknoloji 8
Packet	Trace:	Modify	Bearer	Request	(S11);	MME	->SGW
MME
SGW/
PGW
21232123
0x1
eNB
SGW/
PGW
21522152
S11
S1U
0x80..01
0xc0..1
0x800..001
0x3ea
Irfan Ali 9İki Teknoloji 9
Packet	Trace:	GTP-U:	S1-U;	eNB ->	SGW/PGW
eNB
SGW/
PGW
21522152
S1U
0x010000
UE Server
10.255.1.111 10.0.0.10010.1.2.11 10.1.1.12
TxRx
Tx Rx
Irfan Ali 10İki Teknoloji 10
Packet	Trace	GTP-U:	S1-U;	eNB <- SGW/PGW
eNB
SGW/
PGW
21522152
S1U
0x010000
UE Server
10.255.1.111 10.0.0.10010.1.2.11 10.1.1.12
TxRx
Irfan Ali 11İki Teknoloji 11
GTP	Path	and	Path	Management
• Path	is	between	two	endpoints.	Each	end	
point	is	IP_address+UDP_Port#	
• There	can	be	several	GTP	tunnels	on	a	
path	(each	with	different	TEIDs).
• There	is	typically	a	“software	process”	that	
binds	to	each	end-point.
• Path	Management	messages:	To	ensure	
that	a	path	is	alive	(both	the	physical	link	
and	process	at	the	endpoint),	periodic	
echo-request and	echo-response are	sent.	
• Failure-detection	and	error-recovery	
mechanisms	are	defined.
SGW PGW
TEID
2123
2152
2123
2152
TEIDas
TEIDbs
TEIDcs
TEIDxs
TEIDys
TEIDzs
TEID
IPc,sgw
IPu,sgw
IPc,pgw
IPu,pgw
TxRx Tx Rx
Path
Path
Irfan Ali 12İki Teknoloji 12
Packet	Traces:	GTP-U	Echo-request	&	Echo	Response
In GTP-Cv2 Echo
request/response messages
do not contain TEID field
In GTP-Cv2 Echo
request/response messages
do not contain TEID field
Irfan Ali 13İki Teknoloji 13
Interfaces	on	which	GTP	is	used
• GTP-Cv2	is	used	not	only	for	
mobility	management,	but	
also	for	general	signaling	
purposes,	 eg providing	 UE’s	
cell	information	 to	the	PGW	
and	from	there	to	operator’s	
service	network.
Internet
MME
S-GW
P-GW
HSS
eNB
UE’s IP address
S1-MME
S11
S6a
S5
S1-U
MME
S10
S1AP
GTP C
GTP C
Irfan Ali 14İki Teknoloji 14
Specifications
• GTPC	v2 TS	29.274
• GTPU	v1 TS	29.281
• GTPC	v1 TS	29.060
• Historically	(before	Rel-8,	i.e.	before	2009Q1),	TS	29.060	used	to	be	
the	key	GTP	specification	(both	GTPC	v1	and	GTPU	v1).	But		since	
Rel-8,	TS	29.060	is	only	applicable	to	3G	interfaces	(Gn/Gp,	
between	SGSN	<->	GGSN	and	between	SGSNs)	and	not	to	EPC	
interfaces.	Its	specification	only	applies	to	GTPC	v1	
Ø Ignore	anything	that	29.060	says	about	GTPU.
İki Teknoloji 15
Annex
Irfan Ali 16İki Teknoloji 16
Rules	for	GTP-C	IP	address	and	port	numbers
• Three	types	of	messages
• Rules	for	Port#	and	IP	addresses
Ø Initial	Message:
1. The	UDP	Destination	 Port	number	for	GTPv2	Initial	 messages	shall	be	2123
2. The	UDP	Source	Port	 for	a	GTPv2	Initial	message	is	a	locally	allocated	port	 number.
3. During	the	establishment	 of	the	GTP	tunnel,	 the	GTPv2	entity	selects	and	communicates	 to	the	peer	GTPv2	entity	the	IP	Destination	 Address	at	
which	it	expects	 to	receive	subsequent	 control	 plane	Initial	messages	related	to	that	GTP	tunnel	 via	the "Sender	F-TEID	for	Control	 Plane"	IE	
Ø Triggered	message
1. The	IP	Source	Address	of	a	GTPv2	Triggered	message	and	for	a	Triggered	Reply	message	shall	be	copied	 from	the	IP	destination	 address	of	the	
message	to	which	 this	GTPv2	entity	is	replying
2. The	IP	Destination	 Address	of	a	GTPv2	Triggered	message	and	for	a	Triggered	Reply	message	shall	be	copied	 from	the	IP	Source	Address	of	the	
message	to	which	 this	GTPv2	entity	is	replying
3. The	UDP	Source	Port	 of	a	GTPv2	Triggered	message	shall	be	the	value	from	the	UDP	Destination	 Port	of	the	corresponding	 message	to	which	
this	GTPv2	entity	is	replying
4. The	UDP	Destination	 Port	 value	of	a	GTPv2	Triggered	 message	shall	be	the	value	of	the	UDP	Source	Port	 of	the	corresponding	 message	to	which	
this	GTPv2	entity	is	replying
Ø Triggered	Reply	message
1. Same	rules	as	triggered	message.
• Rules	for	TEID#
Ø The	first Create	Session	 Request	message	on	S11	for	a	UE	shall	have	TEID	=	0x0
Ø The	(first	and	subsequent)	 Create	Session	 Request	message	on	S5	for	a	UE	shall	have	TEID	=	0x0
GTP-C
Peer A
GTP-C
Peer B
Initial Message
Triggered Message
Triggered Reply Message

GTP Overview

  • 1.
    İki Teknoloji 1 LTE: A feature based introduction LTE Core Features Annex. GTP Primer IrfanAli Video at youtube: https://www.youtube.com/watch?v=FPfExr9bEEg&list=PLgQvzs PaZX_bimBc5Wu4m6-cVD4bZDav9&index=9
  • 2.
    Irfan Ali 2İkiTeknoloji 2 What is GTP? • GTP = GPRS Tunneling Protocol • What is Tunneling in the IP World? Ø Tunneling in the IP world means putting an IP packet inside another IP packet. IP_src -> IP_dst Payload IP_a-> IP_b Inner IP Packet Outer IP Packet GPRS General Packet Radio Service
  • 3.
    Irfan Ali 3İkiTeknoloji 3 What is the purpose of GTP Tunneling? • Route an IP packet along a path that is not topologically correct for the packet. Mehmet’s IP address 46.1.78.189-> 10.40.40.12 Internet S-GW P-GW eNB Ayse Mehmet 10.10.10.1 10.10.10.2 10.10.10.0/24 10.10.20.1 10.10.20.0/24 10.10.20.2 GTPTunnel IP_sgw -> IP_enb UDP_ dst= 2152 TEID_x IP_pgw -> IP_sgw IP UDP_ dst= 2152 UDP TEID_k GTP-U header Mehmet’s IP address 10.40.40.12 DHCP GTP is IP-in-UDP Tunneling HiIP_a -> IP_m HiIP_a -> IP_m HiIP_a -> IP_m HiIP_a -> IP_m
  • 4.
    Irfan Ali 4İkiTeknoloji 4 How does the GTP-U Tunnel get setup? • GTP Protocol has two parts Ø Signaling part called GTP-C (GTP-Control) Ø User data part called GTP-U (GTP-User) • GTP-C is used to setup GTP-U tunnel • Both GTP-C and GTP-U run on top of UDP • IP-in-UDP tunneling is only used for GTP-U • GTP-C carries control/signaling messages IP_pgw -> IP_sgw IP_a -> IP_m UDP_ dst= 2152 TEID_a IP_pgw -> IP_sgw UDP_ dst= 2123 TEID_k IP UDP GTP-U header IP UDP GTP-C header GTP-C message
  • 5.
    Irfan Ali 5İkiTeknoloji 5 SGW PGW TEID 21232123 2152 TEID IPc,sgw 2152 IPu,pgwIPu,sgw TxRx Tx Rx TEID TEID TxRx Tx Rx TEIDas TEIDbs TEIDcs IPc,pgw SGW PGW TEID 2123 2152 2123 2152 TEID IPc,sgw IPu,sgw IPc,pgw IPu,pgw TxRx Tx Rx TxRx Tx Rx TEIDTEID How does GTP-U Tunnel get setup: Example TEIDas TEIDas 0 C.S. Req (IMSIa, C: IPc,sgw,TEIDas, EBID5:IPu,sgw,TEIDas) C.S. Rsp (C:IPu,pgw,TEIDap, EBID5:IPu,pgw, TEIDxp) TEIDbs TEIDcs TEIDap TEIDbp TEIDcp TEIDap TEIDbs TEIDcs TEIDbp TEIDcp
  • 6.
    Irfan Ali 6İkiTeknoloji 6 Packet Trace: Create Session Request (S11); MME->SGW MME SGW/ PGW 0 21232123 0x1 eNB SGW/ PGW 21522152 S11 S1U
  • 7.
    Irfan Ali 7İkiTeknoloji 7 Packet Trace: Create Session Response (S11); SGW -> MME MME SGW/ PGW 21232123 0x1 eNB SGW/ PGW 21522152 S11 S1U 0x80..01 0xc0..1
  • 8.
    Irfan Ali 8İkiTeknoloji 8 Packet Trace: Modify Bearer Request (S11); MME ->SGW MME SGW/ PGW 21232123 0x1 eNB SGW/ PGW 21522152 S11 S1U 0x80..01 0xc0..1 0x800..001 0x3ea
  • 9.
    Irfan Ali 9İkiTeknoloji 9 Packet Trace: GTP-U: S1-U; eNB -> SGW/PGW eNB SGW/ PGW 21522152 S1U 0x010000 UE Server 10.255.1.111 10.0.0.10010.1.2.11 10.1.1.12 TxRx Tx Rx
  • 10.
    Irfan Ali 10İkiTeknoloji 10 Packet Trace GTP-U: S1-U; eNB <- SGW/PGW eNB SGW/ PGW 21522152 S1U 0x010000 UE Server 10.255.1.111 10.0.0.10010.1.2.11 10.1.1.12 TxRx
  • 11.
    Irfan Ali 11İkiTeknoloji 11 GTP Path and Path Management • Path is between two endpoints. Each end point is IP_address+UDP_Port# • There can be several GTP tunnels on a path (each with different TEIDs). • There is typically a “software process” that binds to each end-point. • Path Management messages: To ensure that a path is alive (both the physical link and process at the endpoint), periodic echo-request and echo-response are sent. • Failure-detection and error-recovery mechanisms are defined. SGW PGW TEID 2123 2152 2123 2152 TEIDas TEIDbs TEIDcs TEIDxs TEIDys TEIDzs TEID IPc,sgw IPu,sgw IPc,pgw IPu,pgw TxRx Tx Rx Path Path
  • 12.
    Irfan Ali 12İkiTeknoloji 12 Packet Traces: GTP-U Echo-request & Echo Response In GTP-Cv2 Echo request/response messages do not contain TEID field In GTP-Cv2 Echo request/response messages do not contain TEID field
  • 13.
    Irfan Ali 13İkiTeknoloji 13 Interfaces on which GTP is used • GTP-Cv2 is used not only for mobility management, but also for general signaling purposes, eg providing UE’s cell information to the PGW and from there to operator’s service network. Internet MME S-GW P-GW HSS eNB UE’s IP address S1-MME S11 S6a S5 S1-U MME S10 S1AP GTP C GTP C
  • 14.
    Irfan Ali 14İkiTeknoloji 14 Specifications • GTPC v2 TS 29.274 • GTPU v1 TS 29.281 • GTPC v1 TS 29.060 • Historically (before Rel-8, i.e. before 2009Q1), TS 29.060 used to be the key GTP specification (both GTPC v1 and GTPU v1). But since Rel-8, TS 29.060 is only applicable to 3G interfaces (Gn/Gp, between SGSN <-> GGSN and between SGSNs) and not to EPC interfaces. Its specification only applies to GTPC v1 Ø Ignore anything that 29.060 says about GTPU.
  • 15.
  • 16.
    Irfan Ali 16İkiTeknoloji 16 Rules for GTP-C IP address and port numbers • Three types of messages • Rules for Port# and IP addresses Ø Initial Message: 1. The UDP Destination Port number for GTPv2 Initial messages shall be 2123 2. The UDP Source Port for a GTPv2 Initial message is a locally allocated port number. 3. During the establishment of the GTP tunnel, the GTPv2 entity selects and communicates to the peer GTPv2 entity the IP Destination Address at which it expects to receive subsequent control plane Initial messages related to that GTP tunnel via the "Sender F-TEID for Control Plane" IE Ø Triggered message 1. The IP Source Address of a GTPv2 Triggered message and for a Triggered Reply message shall be copied from the IP destination address of the message to which this GTPv2 entity is replying 2. The IP Destination Address of a GTPv2 Triggered message and for a Triggered Reply message shall be copied from the IP Source Address of the message to which this GTPv2 entity is replying 3. The UDP Source Port of a GTPv2 Triggered message shall be the value from the UDP Destination Port of the corresponding message to which this GTPv2 entity is replying 4. The UDP Destination Port value of a GTPv2 Triggered message shall be the value of the UDP Source Port of the corresponding message to which this GTPv2 entity is replying Ø Triggered Reply message 1. Same rules as triggered message. • Rules for TEID# Ø The first Create Session Request message on S11 for a UE shall have TEID = 0x0 Ø The (first and subsequent) Create Session Request message on S5 for a UE shall have TEID = 0x0 GTP-C Peer A GTP-C Peer B Initial Message Triggered Message Triggered Reply Message