This document discusses Cubro's IMSI filtering solution implemented by a European mobile operator to filter signaling and user plane traffic for specific IMSIs, MSISDNs, or IMEIs while addressing challenges of high traffic volumes, mixed 3G and 4G technologies, and scalability. The solution uses Cubro tapping, aggregation, and filtering devices to separate, filter, load balance, and correlate signaling and user plane traffic across multiple sites and send matched traffic to monitoring tools. Key components are the EXA32100 for filtering, load balancing, and distributing traffic to EXA24160 Sessionmasters for IMSI filtering and output to analyzers.

1. IMSI, MS-ISDN & IMEI Filtering with
Cubro EXA24160 Sessionmaster
EXA24160 Deployment example at a European
Mobile Operator
May 2018
www.cubro.com

2. Purpose of this presentation
This presentation explains the concept of IMSI
Filtering using Cubro products.
It describes the entire Cubro solution from layer 1
tapping, aggregation, load-balancing to traffic
correlation as implemented by a European mobile
operator.

3. Project Goals
• Due to high traffic volume the monitoring
of all user plane traffic does not make
sense.
– And by law it is not allowed without specific
order from authority or agreement of the
user.
• However, for trouble-shooting a full call
monitoring/tracing is vital. Requires
both, signalling and user data of a
specific customer.
• Therefore, the customer requires an on-
demand IMSI filtering solution that
correlates signalling and user plane.

4. Challenges
• Find all signalling and user-
plane traffic of a specific IMSI,
MSISDN or IMEI.
– Total traffic volume several
hundred Gbps
– Mixed technology (3G & 4G)
• Security
– Highly sensitive information –
strict rules to access data
– User agreement to activate
monitoring (user support portal)
• Scalability
– Due to massive traffic growth
scalability is a must

5. Terms
• IMSI … International Mobile Subscriber Identity
– The IMSI is used to identify the user of a cellular network and
is a unique identification associated with all cellular networks.
The IMSI is usually provisioned in the SIM card.
• MSISDN … Mobile Station International Subscriber
Directory Number (=Telephone Number)
– MSISDN is a unique number identifying a subscriber in a
mobile network. Simply put, it is the mapping of the telephone
number to the SIM card in a mobile/cellular phone. The
MSISDN together with IMSI are two important numbers used
for identifying a mobile subscriber. A SIM has a unique IMSI
that does not change, while the MSISDN can change in time,
i.e. different MSISDNs can be associated with the SIM.
• IMEI … International Mobile Equipment Identity
– The IMEI is a unique number that identifies mobile devices
(=hardware identification). The IMEI number is used by a
mobile network to identify valid devices and therefore can be
used for stopping a stolen phone from accessing that network.

6. IMSI Filtering
• Throughout this presentation the term IMSI
Filtering means filtering out signalling plane and
user plane traffic of a specific user/call.
• This specific user can be identified by:
– IMSI
– MSISDN
– IMEI

7. Deployment Overview
vEPC
Site 1
vEPC
Site 2
vEPC
Central Site
Tapping
Aggregation
Tapping
Aggregation
Tapping
Aggregation
Filtering
Load-Balancing
IMSI Filtering
Traffic
Distribution
Monitoring Tools

8. Layer 1 Tapping at Site 1 and 2
• Cubro MTP TAP
– 4 MTP Links in 1/3 U 19”
– supports 40G and 100G
– totally passive and secure
Monitoring outputs
8 x 40G
4 x 40G live traffic
to Packetmaster EX20400
for Aggregation

9. Aggregation at Site 1 and 2
• Cubro Packetmaster EX20400
– 20 x 40G plus 4 x 40G/100G ports via QSFP/QSFP28
– 2,4Tbps throughput!
– Aggregation, Filtering, Load-balancing
– Managed via WebGUI and Cubro Vitrum
8 x 40G inputs
from MTP TAPs
4 x 100G
Load-balanced outputs
total traffic load about 240Gbps
• EX20400 aggregates all incoming
vEPC traffic of site 1 and 2 (user and
signaling) and load-balances it by
means of five tuple hashing.
– Filtering is not used  have all traffic
available at Central Site.
Transport Network to Central Site

10. Central Site – Concept Overview
• Incoming interfaces (as per May 2018)
– 4 x 100G from Site 1 (vEPC 1)
– 4 x 100G from Site 2 (vEPC 2)
– 8 x 100G from Central Site (vEPC C)
• Total incoming traffic is approx. 400Gbps.
– Signalling (S11, GN-c, …) and User (GN-u and S1-U).
• Requirements
– Aggregate, Filter (Forward & Drop) and Load-balance
• Forward all signalling traffic to more than one output port for different
analysing systems including Cubro IMSI Filtering system.
– Total signalling is about 50Mbit/s
• Drop non-required user traffic (e.g. drop all traffic with DSCP=0)
– After drop filtering approx. 180Gbps remains (400Gbps incoming in total)
» All DSCP=0 packets are dropped
• Load-balance remaining user traffic to Cubro IMSI Filtering system
– Each IMSI Filter unit gets approx. 45Gbps user traffic

11. Drop (DSCP=0)
Signalling plane filters
(VLAN IDs, IP Addresses,
UDP Port 2123)
User plane filters (VLAN IDs, IP
Addresses, UDP Port 2152)
Load-balancing by means of
inner (user IP)
Cubro IMSI Filtering System
Cubro Mobile Probe
Multiplication and Distribution
Other Probes Other Probe Wireshark Server
Multiplication and Distribution
Central Site – Concept Overview
EXA24160
EXA32100
EX20400
EX20400
Signalling
User

12. Central Site – Connection Diagram
16 x 100G
4 x 100G from Site 1
4 x 100G from Site 2
8 x 100G local traffic
400Gbps in total • Filtering = Separation
signalling and user plane
• Drop non-required traffic
(DSCP=0)
• Load-balance user traffic
by means of GTP inner IP
4 x 40G user plane
load-balanced
4 x 40G user plane
load-balanced
Distribution
1 x 40G signalling plane
Break-out Box
converts MTP to LC
10G LC outputs to Monitoring Tools
IMSI Filtering (Signalling & User)

13. Central Site – Filtering & load-
balancing
• Core element is the Cubro EXA32100
– 32 x 40G/100G ports (can also be used as 128 x 10G solution)
– Filtering including GTP Layer; separates signalling
and user traffic.
– GTP Load-balancing based on inner (user) IP
address; distribute user traffic evenly to the
IMSI filtering solution.
• Load-balancing S1-U traffic by means of GTP
inner IP is the only feasible way to share user
traffic between the different IMSI Filter boxes!

14. Sessionmaster EXA32100
 Filtering including GTP layer –
e.g. filter a full range if user IPs
 Up to 8000 parallel filter rules
 Aggregation
 GTP Load-balancing by inner
(user IP)
 All ports activated
 All software activated
 Low power design
 Jumbo Frames 16000 Bytes
 24MB Buffer for overload
protection
Packet load 6,4 Tbps
Ports 40 Gbit 32 QSFP
Ports 100 Gbit 32 QSFP28
GUI WEB/CLI/GUI
Packet buffer YES 24 MB
Delay < 700 ns
Dual Power YES
128 x 10 Gbit (with breakout)
All ports activated, no extra charge

15. IMSI Filtering Overview
• IMSI Filtering = ALL signalling and user packets of a
call.
• Requires to find signalling message that contains
the IMSI.
– Certain messages only include the IMSI information
• PDP Context Request (3G)
• Session Create Request (4G)
• After finding these messages a correlation
mechanism is required.
– Find ALL signalling and ALL user traffic data that
belong to this call
• Send all correlated packets to an external
analyser/probe.

16. Example - Session Create
Message
• Cubro EXA24160 Sessionmaster finds the message and
ALL other packets that belong to this call

17. IMSI Filtering Concept
• Every EXA24160 gets full signalling.
– Reason: It is unknown which EXA24160 will receive the user traffic
of a specific call
• User data packets are distributed (load-balanced) among the
EXA24160s  by adding EXA24160s the solution is extremely
flexible in terms of traffic growth!!! Scalability.
Signalling
broadcast
User Load-balanced (GTP
inner IP)
Signalling User

18. Sessionmaster EXA24160
 2 x Octeon III CN7890 CPU (48 cores each)  consider as
two independent units
 4 x 40G ports and 24 x 10G ports per EXA24160
 1U 19” dual power supply
 Up to 120Gbps L4 filtering performance
 Up to 120Gbps GTP inner IP filtering performance
 Up to 120Gbps GTP inner IP Load-balancing
 Up to 100G mobile data correlation (=IMSI Filtering)
 Up to 100000 IMSIs in parallel
 Up to 80Gbps keyword search performance
 Up to 30 Gbps flow-aware REGEX performance
GTP, Correlation and REGEX in one unit

19. Current traffic volume
• Every EXA24160 needs to run the same configuration.
– Unknown which EXA24160 gets the traffic. Thus it is also
unknown where the traffic is sent out.
• Keep the EXA24160 synchronized!
User-plane: approx. 23Gbps per port(about 180Gbps in total)
Signalling-plane: approx. 50Mbps per port
Filtered outputs - connected to distribution layer (Cubro EX20400)
to multiply traffic when needed and to connect
parallel monitoring systems. Output bandwidth
depends on the number of IMSIs filtered (up to 100000)

20. Why traffic distribution layer?
• Full flexibility – just add new probes/analyzers
– Straight forward way to multiply traffic.
• Scalable – Cubro solution can easily grow when
traffic increases; just add new EXA24160 when
traffic goes beyond 200Gbps.

21. System Management
• Central software that controls all units.
– Keep configurations consistent.
– Management of filter rules
– Highly protected to avoid misuse
– Security logs
Output bandwidth monitoring IMSI filter setup

22. Summary
• Future-proof (investment protected).
– Just add EXA24160s when traffic grows.
• Easy to use and straight forward to
implement.
• Flexible – add/remove probes/analyzers
without affecting others.
• Full solution from Layer 1 tapping to traffic
correlation from a single vendor.

23. Thank you
EMEA
Cubro Network Visibility
Ghegastraße 1030 Vienna,
Austria
Tel.: +43 1 29826660
Fax: +43 1 2982666399
Email: support@cubro.com
Cubro US
337 West Chocolate Ave
Hershey, PA 17033
Tel.:717-576-9050
Fax.: 866-735-9232
Email: support@cubro.com
Cubro Asia Pacific
8, Ubi Road 2 #04-12 Zervex
Singapore 408538
Tel.: +65-97255386
Email: jl@cubro.com
North America APAC Japan
Cubro Japan
8-11-10-3F, Nishi-Shinjuku,
Shinjuku,
Tokyo, 160-0023 Japan
Email: japan@cubro.com