Other test equipment providers sell LTE capabilities separately, but following our all-inclusive model, we’ve included LTE testing for every BreakingPoint CTM, existing or new. (All it takes is a firmware update.) The combination of such large-scale testing and our all-in-one pricing model drops the cost per UE to under $0.25. That’s right — less than 25 cents. Contrast that to the $1,000 price tag mentioned above, and it’s not hard to see the impact it makes. The fact that we can now offer our customers the most cost-effective option of simulating millions of concurrent users with real application traffic (plus security attacks and fuzzing, of course) means that they can now validate their LTE network configurations at scale before going live. This is something they simply could not have done before. For more information, please visit www.breakingpoint.com/lte

1. Internet-scale LTE/4G Simulation
BreakingPoint LTE/4G and 3G Testing Capabilities Overview

2. Table of Contents
! LTE Introduction and Overview
! BreakingPoint FireStorm CTM™
! Demonstration: BreakingPoint LTE Test Lab
– MME Emulation Configuration
– SGW / PDN-GW Emulation Configuration
– 3G Testing Capabilities

3. LTE 101: Glossary of Common Terms
! UE – cell phone / air card
! eNodeB – cell phone tower
! SGW – router
! MME – authentication and management
! PDN – the Internet
! PDN-GW or PGW – gateway to the Internet
3

4. LTE Protocol Overview
! SCTP (Stream Control Transmission Protocol)
– Multi-homed protocol allowing a client to talk to multiple servers, with
failover.
– Works over UDP and IP
– Initial support for h.323, HTTP and S1AP
– Compliant with RFC4960, RFC4460, ETSI TS 102 144 v1.1.1 (2003-5)
as applicable
! GTP (Generic Tunneling Protocol)
– Encapsulates traffic to a specific port (not just an IP address)
– GTP-c v1 (3G), v2 (LTE) and GTP-u v1 (3G) variants
! S1AP
– LTE-specific protocol
– Used in eNodeB/MME communication
– Provides information to UE’s from MME
4

5. LTE Network Diagram: What Is Involved?
S1-MME
HSS
UE
MME
eNodeB
PCRF
S11
X2
S7
S1-U S5 / S8
PDN-GW
UE SGW
eNodeB

6. GTP Protocols in LTE: Where Do They Live?
S1-MME HSS
UE
MME
eNodeB
PCRF
GTP-c v2
S11
X2
S7
S1-U
S5 / S8
GTP-u v1
PDN-GW
UE SGW
eNodeB

7. LTE Testing. What Is Important?
! Applications are the reason for
mobility
! LTE driven by user demand to take
apps wherever they go
! Existing LTE testing solutions were
incomplete and ridiculously
cumbersome
! Existing LTE testing price points
were far too high for realistic-scale
simulation and testing

8. LTE Testing Capabilities
Performance, Security, Stability

9. Quick Overview: BreakingPoint FireStorm CTM™
! Simulates 90 million simultaneous users and blended application
traffic at live network speeds of up to 120 Gigabits per second from a
single three-slot chassis
! Performs SSL Bulk Encryption at 24 Gbps with any cipher
! Measures network latency down to 10-nanosecond resolution
! Universal 10GigE / 1GigE ports
! And more…

10. BreakingPoint LTE Test Lab
! No separate charge or license for LTE
! Customers under maintenance receive automatically
! Pricing around $0.25 USD per UE
10

11. LTE Performance and Scalability: The Numbers
! Up to 4,000 eNodeBs
! Up to 3,000,000 UEs
– Gated by # of GTP tunnels / Bearer Channels
– Less when using multiple Bearer Channels
! Up to 3,000,000 GTP tunnels
! Up to 225,000 UE registrations / second
(configurable)
! Up to 26 Gb/s throughput over LTE protocols
– Quoted numbers are for a single FireStorm blade and are preliminary, numbers will
change upon final release +/-

12. 3 Modes of LTE Operation
! UE / eNodeB or UE / eNodeB + PDN
! UE / eNodeB + MME
! SGW + PDN-GW + PDN

13. Emulation Options: Number 1
S1-MME
HSS
UE
MME
eNodeB
PCRF
S11
X2
S7
S1-U S5 / S8
PDN-GW
UE SGW
eNodeB
Emulation Option 1: Interfaces Emulated:
UE / eNodeB or UE / eNodebB + PDN S1-U, S1-MME, optionally SGi

14. Emulation Options: Number 2
S1-MME ✖ HSS
UE
MME
eNodeB
PCRF
S11
X2
S7
S1-U S5 / S8
PDN-GW
SGW
UE
eNodeB
Emulation Option 2: Interfaces Emulated:
UE / eNodeB + MME S1-U, S11

15. Emulation Options: Number 3
S1-MME
HSS
UE
MME
eNodeB
PCRF
S11
X2
S7
S5 / S8
S1-U
PDN-GW
UE SGW
eNodeB
Emulation Option 3: Interfaces Emulated:
SGW + PDN-GW + PDN S1-U, S11

16. BreakingPoint LTE/4G Test Lab
Walkthrough

17. BreakingPoint LTE Test Lab Walkthrough

18. BreakingPoint LTE Test Lab Walkthrough
Total number of UEs
(handsets) to
emulate.

19. BreakingPoint LTE Test Lab Walkthrough
Number of bearer
channels per UE to
establish, up to
1+10. Only one
carries data in this
release.

20. BreakingPoint LTE Test Lab Walkthrough
First in a sequential range of
IMSI numbers (SIM card
identifiers) to be used in the
test.

21. BreakingPoint LTE Test Lab Walkthrough
First in a sequential range of MSISDN
numbers used in the test. Each MSISDN
identifies a subscription in the UMTS
network.

22. BreakingPoint LTE Test Lab Walkthrough
Identification string
for the carrier to
which UEs connect.

23. BreakingPoint LTE Test Lab Walkthrough
Maximum aggregate
bandwidth across all
UEs.

24. BreakingPoint LTE Test Lab Walkthrough
Number of UE
registrations/second.

25. BreakingPoint LTE Test Lab Walkthrough
Base value for a
unique secret key
generated for each
UE.

26. BreakingPoint LTE Test Lab Walkthrough
Value assigned by UE
manufacturer, typically unique
per manufacturer.

27. BreakingPoint LTE Test Lab Walkthrough
Mix of application traffic used
by all UEs in the test.

28. BreakingPoint LTE Test Lab Walkthrough
Choose from
searchable
list of
predefined or
custom traffic
blends.

29. BreakingPoint LTE Test Lab Walkthrough

30. BreakingPoint LTE Test Lab Walkthrough
MME IP address(es). Configuration for
MME if emulated by BreakingPoint is in
Network Neighborhood.

31. BreakingPoint LTE Test Lab Walkthrough
Unique identifier for each cellular
network provider, consisting of Mobile
Country Code and Mobile Network
Code.

32. BreakingPoint LTE Test Lab Walkthrough

33. MME Emulation Configuration
! Used when
BreakingPoint CTM is
emulating MME to
generate GTP-c v2
traffic on S11
interface
! Also used for MME
and eNodeB
configuration outside
of LTE Test Lab
! Same eNodebB fields as Test Lab, plus additional
MME-specific entries

34. SGW/PGW Emulation Configuration
! Used when
BreakingPoint CTM is
emulating unified
SGW & PGW to
generate GTP-c v2
traffic on S11
interface
! Use when
communicating with
real (external) MME
! Same eNodebB fields as Test Lab, plus
configuration of maximum sessions

35. LTE & GTP Reporting Capabilities
! New sections only in LTE reports
! Tabular and graphical data
! LTE Message Reporting:
– UE Attach Requests Sent / Accepted / Failed
– UE Detach Requests Sent / Successes
– S1AP Setup Requests / Successes
– S1AP Reset Requests Received / Reset ACKs Sent
– SCTP Open Requests / Open Successes
– SCTP Close Requests / SCTP Close Successes

36. LTE & GTP Reporting Capabilities
! GTP Message Reporting:
– GTP Create Requests Processed
– GTP Create Responses Processed
– GTP Delete Requests Processed
– GTP Delete Responses Processed
– GTP Client Side Tunnels
– GTP Client Side Sent / Received Data
– GTP Server Side Tunnels
– GTP Server Side Sent / Received Data
! Plus BreakingPoint’s normal application,
latency, etc. reporting

37. BreakingPoint 3G Testing
Capabilities and walkthrough

38. 3G Capability
! DPI & LI inspection of 3G GTP tunnels is a
common request
! BreakingPoint introducing 3G GTP encapsulation
– GTP-c v1 and GTP-u v1
! Includes GGSN/SGSN emulation for purposes of
encapsulation
– Either or both concurrently
! Same general performance as LTE

39. 3G Network Diagram (Simplified)
For 3G GTP encapsulation, BreakingPoint
emulates all elements in this diagram
concurrently, or GGSN or SGSN in isolation.
UE
NodeB
Gn
GTP-u v1
SGSN GGSN
UE
NodeB
BreakingPoint LTE GTP Encapsulation: GTP-u v1

40. Questions
! www.breakingpoint.com
! sregister@breakingpoint.com
! +1.512.821.6000