IPNMS Technical Proposal - Final.docx

PLDT’S IP NETWORK MONITORING SYSTEM

Table of Content

1 Executive Summary...............................................................................................................................31.1 The Need For Real-Time............................................................................................................41.2 Enhanced Correlated Intelligence..........................................................................................51.3 Customer Centric Service Management...............................................................................5

2 Business Benefits....................................................................................................................................7

3 Solution Overview..................................................................................................................................9

4 Sample Application Areas.................................................................................................................144.1 IP Core...........................................................................................................................................144.2 Fixed Broadband Network.....................................................................................................14

5 Detail Solution Description..............................................................................................................155.1 How does IPXPlorer® work?.................................................................................................175.2 The QXManager - QXM.............................................................................................................185.3 IPXPlorer® Flex.........................................................................................................................22

5.3.1 IPXPlorer® Flex 4B Features...........................................................................................................225.3.2 IPXPlorer® Flex 4A Features...........................................................................................................23

5.4 IPXplorer Physical Interfaces...............................................................................................235.5 IPXplorer Performances.........................................................................................................245.6 Multiple Technologies.............................................................................................................255.7 IPXPlorer® Key Features.......................................................................................................285.8 Open Connectivity.....................................................................................................................295.9 ASDR™: The new wave in Call Detail Record Concept..................................................305.10 Decode, Trace, and HEMS.......................................................................................................325.11 Alarm Generation......................................................................................................................345.12 KPIs.................................................................................................................................................365.13 Result Aggregation....................................................................................................................375.14 Trends and Statistics................................................................................................................385.15 Geographic Viewer Management.........................................................................................395.16 Probe Management...................................................................................................................405.17 Probe Inventory.........................................................................................................................415.18 Flexible Dashboard...................................................................................................................425.19 Results Collection......................................................................................................................42

6 Core Concepts........................................................................................................................................436.1 Group Concepts..........................................................................................................................436.2 Correlation Concept..................................................................................................................436.3 Synchronization Technique...................................................................................................44

6.3.1 Synchronization at IPXPlorer® Flex level..................................................................................456.3.2 Synchronization of IPXPlorer® Flex at site level....................................................................456.3.3 Synchronization of QXManager and IPXPlorer® Flex at network level........................46

7 IPXplorer Software Packages..........................................................................................................467.1 All-IP Package.............................................................................................................................477.2 WEB Package...............................................................................................................................477.3 Email Package.............................................................................................................................477.4 DNS Package................................................................................................................................477.5 AAA Package................................................................................................................................487.6 Sigtran Package..........................................................................................................................487.7 VoIP Package...............................................................................................................................487.8 IMS Package.................................................................................................................................487.9 IPTV Package...............................................................................................................................497.10 VOD Package...............................................................................................................................497.11 P2P Package................................................................................................................................49

www.globeoss.com 2

1 Executive Summary

globeOSS Monitoring Solution is the truly the one-stop service/customer oriented solution available in the industry. It addresses the need for legacy networks, current networks and future networks. It is therefore critical to have the expertise monitoring team with various domain backgrounds that covers services across multiple protocols and network types (IP, ATM, SS7, or legacy). This is what globeOSS can offer today. This will be required in order to become truly customer centric as customers will use voice, data and content services over IP networks. Understanding the customer's experiences for all services over all networks is key. We bring all this data together, turning it into information and presenting it to the end user that enables the Telecom Operators to make faster and better decisions in business intelligence and troubleshooting for all services, for all networks, and for all customers to give a single view of the truth, particularly as it relates to customer experience.

The Next-Generation Passive Probes, we are providing is much more cost effective than other probes in the market. So we are able to cover monitoring of all 10GE links, in more cost effective manner. As the total solution we offer covers 24 x 7 continuous monitoring of the network.

The proposed solution also will be much lower TCO for PLDT, since the solution does not require any fiber infrastructure and PLDT could use the fibers for more revenue generating purposes than for just monitoring purposes.

And the proposed solution is more easily scalable, as compare to using a optical switch, since if PLDT decide to tap more than 12 links to be monitored at the output or more than 72 links to be monitored at the input, the cost of expansion will be much higher, as compare to pure probe based expansion.

www.globeoss.com

Subscriber base growth

Subscriber Retention

Best EffortGuaranteed

Service LevelsFew Simples

ServicesMany Complex

Services

Network FocusService + Customer

FocusSimple Network

Complex Networks

(Legacy and Next

Generation)

3

Our unique value propositions are:

1. Monitor all the links 24 x 7, not just selected ones2. Showcase Customer Experience3. Scalability – addition of probes and links to be monitored can be

done easily4. Lower Total Cost of Ownership (TCO) – more values can be extended

in long run

It is therefore critical that the data collection solution services across multiple protocols and network types (IP, SS7, or legacy). This is what globeOSS can offer today. This will be required in order to become truly customer centric as customers will use voice, data and content services over circuit switched and IP networks. Understanding the customer’s experience for all ervices, over all networks is key. We bring all this data together, turning it into information and presenting it to the end user that enables the Telecom Operators to make faster and better decisions in business intelligence and troubleshooting for all services, for all networks, and for all customers to give a single view of the truth, particularly as it relates to customer experience.

1.1The Need For Real-TimeConvergence and the switch to IP networks will drive up the volume of data that Telecom Operators produce. The time has come that customer experience data be presented in near-real time (1 minute or less). No longer is a 90 day cycle time for analysis and subsequent retention action prudent. If a customer a major customer gets a busy signal, or cannot download news information to his new mobile handset, then the operators will want that information fast, so that corrective action can be taken as quickly as possible. The increased data volumes and requirement for near real time information availability will require a system that can collect information from the network in real-time and presenting the data in near real-time.

Moving into IP, the data rate is at gigabyte level. Traditional passive probe providers doing processing at the software level is going to make the solution extremely expensive and clunky. A new approach is needed in terms of processing. The passive probe has to collect and process the signaling data at the hardware level to achieve the performance level required and therefore driving down the cost of the solution significantly.

1.2Enhanced Correlated IntelligenceUsing correlated signaling and user data as the source for OSS network data provides a richer set of information than switched data. Combining this OSS information from various networks – Packet Switch Core, Circuit Switch Core, NGN and IP Core – Customer Experience can be measured. At the same time, the troubleshooting by customer is made possible across the networks. This

www.globeoss.com 4

enhanced intelligence enables Telecom Operators to take a proactive approach to customer assurance.

Providing proactive customer assurance using enhanced correlated intelligence requires capturing KPIs, customer and service in a single record! Often IPDR, xDR and CDR does not contain KPI data.

Most Telecom Operators uses mediated and or billed data for churn prediction models and are in fact missing the negative elements of the customer experience. This is because there are cases when an attempted call doesn’t even make it to the switch.

It is the ability to capture and analyze successful and unsuccessful calls that provides the foundation for measuring customer experience.

This paper will discuss sample OSS business uses that Telecom Operators can use for convergent networks.

1.3Customer Centric Service ManagementAs operators moving towards modern IP infrastructure, trouble-shooting becomes complex and there’s a new need for a new paradigm to trouble-shoot from customer perspective.

The solution will provide the operator to perform new customer centric management system.

www.globeoss.com 5

2 Business Benefits

The challenge by modern network operators to move from network based management to customer centric management. The drive towards customer centricity is no longer an option as the network is getting more complex with many complex services. The challenges are described in the diagram below and globeOSS Service Assurance Solution addresses those needs.

The features of Customer Assurance will benefit a number of functions in the operator organization.

Network quality department: Enables accurate monitoring of the network and service quality that was actually delivered to a customer or group of customers and provides the information needed to bridge between the perceived quality and the quality actually delivered.

Operations: Provides information on where to fine-tune the network for an enhanced customer experience and enables the focus of the department’s efforts to be set according to the corporate focus of the operator. Trouble-shooting by customer can be done easily.

Marketing & Sales: Adds context to existing network statistics and customer satisfaction surveys correlating it with usage statistics per customer, service and location. It provides support to the process of

www.globeoss.com 6

building a brand experience and also provides account managers with detailed reports on the actual level of service provided to the accounts.

Customer Care: Allows Customer Care to be proactive in their interaction with customers rather than re-active in waiting for a customer complaint and enables the build-up of customer profiles.

CxO level executives: Provides dashboard information on major corporate service quality and service levels.

Below are some of the challenges of the various professionals within service providers environment. The solution is able to address issues across organization. For example, most operators has customer care organization that receives complains from the subscribers. This complains is logged in the CRM system. The challenge will be to correlate the network statistics and performance to what is services experienced by the subscribers. In most situation, there’s a disconnect between the CRM data and the network data.

www.globeoss.com 7

This is where we play the major role. By using the new affordable passive probe technology, we are able to correlate the signaling plane, user plane and transport plane in real-time. What this means is that we can view the user experience and relate that to

the handset/devices network parts end-to-end location of the faults services network elements protocols etc.

3 Solution OverviewThe proposed solution is described as per the diagram below.

The passive probe solution is based on the Mutina Technology next generation passive probe system – IPXPlorer® .

It is the breakthrough solution that combines the legacy needs and future monitoring needs of service providers.

www.globeoss.com 8

IPXPlorer® provides critical information on:

Detail records on control and user planes Signaling and User Traffic Alarming Links Status and Usage KPI Generation and SLA Analysis Service Assurance Reports with QOE approach GRQ reports for Roaming on GRX and IPX networks Quality of signaling, voice, video and images services scoring Troubleshooting of packets & circuit based services

www.globeoss.com 9

At a glance, the IPXPlorer® MIP-DMA1 supports the following:

Services and Communications Analyzer for Next Generation and High Speed Networks

Combined IP Data with Telecom Services Analysis Simultaneous coverage for Transport, Control and User Planes Support for Gigabits Traffic Examination Multiple LAN and WAN Interfaces in the same box Application, Service and Session Detail Record (ASDR) generation such as:

IPDR, CDR, TDR.. Over 3500 KPIs such as Network and Application Response Time,

MOS/MDI for Voice/Video, Call Completion ratio, ASR and ABR generation Service Anomalies Finder System automatically finds and shows unusual

conditions Protocols Trace, Decode and Filters Stand Alone, Module and Probe Versions

What’s New?

First Information Communication Technology Service and Protocols Analyzer and monitor probe

PCM, SDH, Giga Ethernet, and 10G Ethernet support “in-a-box” Specifically designed for the high performance for IP, NGN and

monitoring User Traffic in real-time Full analysis and correlation of Control and User planes

1 MIP-DMA = Mutech IP Distributed Monitoring Architecture

www.globeoss.com 10

Top down approach for Analysis and Problem Resolution Next Generation IPDR: Evolution of Call Detail Record towards

Application and Service Detail Record ->ASDR™ Intuitive and straight forward web-based and built-in GUIs Cuts over 70% the weight, size, and the power consumption of traditional

Protocol Analyzers Integration with Net-Flow and IP-Fix

The IPXPlorer® applications covers all the legacy, current and future networks.

www.globeoss.com 11

The real break-through in terms of technology is it’s ability to correlate the user plane, control plane and transport plane in real-time. This provides the operator with the ability to monitor customer centric service management with real troubleshooting capability.

www.globeoss.com 12

4 Sample Application AreasIPXPlorer® can be used in various networks and applications. Some of the application areas will be as follows:

4.1IP CoreTelecommunication network is moving towards all IP network and the solution provides an evolution path towards LTE and SAE.

4.2Fixed Broadband Network

www.globeoss.com 13

5 Detail Solution Description

Following are the two components of the IPXplorer® :

IPXPlorer® Flex as probes in the monitoring sites; QXManager Centrex Viewer as the control system in the central site of the

network.

The IPXPlorer® was designed by considering the following concepts:

Network. The IPXPlorer® is designed to support IP-based data, signaling, voice and video services over LAN and for Mobile IP along with Legacy Technologies such as SS7.

Speed is key. Customers and Services require high speed connections and fast response time to the network, solution provider and operator.

The hardware and software design allows IPXPlorer® to monitor, capture, filter, analyze, and search multiple gigabits per second, while

www.globeoss.com 14

many of traditional SS7 and core network systems were designed to work at mega bits per seconds speed.

Future flexibilities. The communication process is complex and both user and the operator visions are different. Network Managers have to have a global end-to-end view to understand how the users perceive and use the services.

The IPXPlorer® provides a network wide vision for traffic, usage, and activities divided by users, groups, locations, and services that allow the Telecomm Operator to see and track end to end communications.

Control is vital. Owning and running a network means controlling it and the services and applications transported by it. Knowing traffic volumes, usage profiles, capabilities, bottlenecks and interactions between the different technologies and vendors in the network is paramount.

IPXPlorer® detects anomalies in the communication flows as soon as the event happens. The capability to monitor and link multiple events at different communication levels from network, to transport, up to the application layer together with a built-in “smart system” which allows IPXPlorer® to show the Network Manager only the unusual situations.

High Quality Results. A quality solution ensures satisfied customers, lower costs in troubleshooting fewer disputes and a “cleaner” image.

For a realistic and accurate quality of service evaluation it is necessary to analyze and measure different parameters at multiple monitoring points within a network. IPXPlorer® calculates quality of the signalling such as call completion ratio, transport statistics such as response time and transfer speed, disconnection reason such as premature interruptions. All these results are combined in the Application Service Details Record-ASDR™ which represents a new concept for call detail records.

Simplicity is key. IPXPlorer® is a simple concept and for the user it is also easy to install, maintain and manage. The power of IPXPlorer® is in the probes that represent the latest technology available today.

Scalability and Flexibility. Network change and growth. Solutions for network monitoring have to be flexible and easily scalable.

IPXPlorer® probes support multiple physical ports and seamlessly work together in high-density port and geographically distributed solutions. The centralised system is based on industry standard IT hardware components.

Open Solution Framework. The integrated IPXPlorer® data and results are simple and open. IPXPlorer® results are provided in standard format

www.globeoss.com 15

such as Comma Separated Variable fields (CSV) and PDF. PCAP format for data and all logs and alarms are compatible with Syslog. Files are transferred via ftp and databases can be connected directly by network drivers. The software components run over Linux OS.

5.1How does IPXPlorer® work?

IPXPlorer® probes are deployed in the sites with (tapped or spanned) monitoring points. These probes capture, filter, group, analyze, and aggregate all the information and create individual location results.

IPXPlorer® probes are totally autonomous and can work without any central system, providing details from that location. To ensure maximum availability, configuration is carried out in the probe, so that in the event of fault such as power loss or communication problems with the centre, the probe continues to operation autonomously, capturing and analysing the data and storing the results in the built-in storage until the transfer to the Centex Viewer is once again available.

The Operator can access the IPXPlorer® probes directly by web and retrieve results and analysis without the QXManager Centrex Viewer.

Packets and frames are stored inside the probes and recalled by Centex Viewer when necessary.

To ensure accuracy of result, multiple IPXPlorer® probes are synchronized together to guarantee the same frequency, phase, and absolute date and time.

QXManager is the Centrex Viewer of IPXPlorer® and is deployed in a central network site. QXManager provides a network wide view of the different services provided to Users by the Network and monitored by the IPXPlorer® probes.

The communication between QXManager and IPXPlorer® probes are based on TCP/IP standards including, FTP, Syslog service for logs, http/https for web access, and RPC for real-time events.

QXManager is an IT server running the MuTech manager software to collect results and details records from the remote IPXPlorer® appliances, storing that data to a central database, aggregating the data together where necessary, and finally generating network wide views trends and reports.

QXManager is also responsible for operator, authentication and access management.

The dimensioning of QXManager server and storage depends on the applications, network size, quantity of results and data, and duration of raw information recording.

www.globeoss.com 16

5.2The QXManager - QXM

QXManager is the Centrex Viewer of IPXPLORER® . The origin of Centrex name given to QXManager is from the telephony history.

Centrex concept was created at the beginning of 1960s by New York Bell Telephone Company than became Bell Atlantic, to replace the PBX of large customers with a centralised dedicated telephone switching service. We are doing something similar with IP networks that are replacing the switching capability of existing transmission and signalling infrastructure with the packet switching concept.

QXM software described in this section. The current software version of QXM supports:

Up to 10 IPXPlorer® Flex appliances. Up to 10 operators can access the system simultaneously. SS7 & IP Packet Switching technologies.

The QXManager architecture is shown in the figure below.

www.globeoss.com 17

They key elements of QXManager architecture are the following:

1) Probe Manager: This section is responsible for collecting the results from the probes and making specific requests for real-time operations; Operators may require alarms delivered or tracking of specific IP, User, and mobile or fixed phone number. There are three ways to collect information and results from probes:

o Statistics of Traffic and protocols counters becomes available on the probes every 30 seconds; the QXManager collects them by using an ftp connection.

o ASDR™ and the linked detail records counters become available on the probes every minute; the QXManager collects them by using an ftp connection.

o Services-Applications and QoS Analysis become available on the probes every minute; the QXManager collects them by using an ftp connection.

o For Alarms and Logs there are two cases: Real-time alarms are dispatched from probes to QXManager

by either XML/RPC or Syslog type of connection. Non real-time alarms and logs are sent by Syslog type of

connection or become available on the probes every 30 seconds; the QXManager collects them by using an ftp connection.

In all cases, specific, pre-configured alarms can be also sent by email from any or all probes to specific administrator email address.

2) Users and Sessions Manager: This section is responsible of the Access Control List and forwarding of the different results. The User accesses the QXManager by browser through http or https connection.

The QXManager GUI, which runs over a standard web browser, is based on Adobe Flex Technology. This technology allows multiple windows, tabular, chart, real-time, and full graphical presentation without having to install any application on the User PC.

QXManager manages the IPXPlorer® Flex by sites. The User can create geographical and logical maps of its network and move from one site to another just with a click on the map as shown in the next figure.

The type of results and reports available for the users of QXManager depend on the rights set by the administrator of the system in the ACL. The typologies of results available are:

www.globeoss.com 18

a. Traffic, ASDR™ and QoS analysis. This group of analysis contains different type of results such as:

i. Traffic: these are mainly statistics from layer 1 through layer 5 of the ISO-OSI protocol stacks. This includes measurement interfaces counters, statistics for link, network, and transport communication activities per single user, host, device, site, service or group.

ii. ASDR™: all the service and application analysis are generated based on Application Service Details Record. The System User has the possibility to look for a specific user, service, site; QoS score and obtain the data from the QXManager. From the ASDR™ view, the operator can decode the packets exchanged during the selected application session. QXManager will query for the packets the probes involved in the communication and then present decodes to the operator.

iii. QoS: probes calculate QoS scores for audio and video streams payloads (for telephony, video-communication) and for signalling sections like call completion, PDP context attach-detach, multicast joining and releasing etc. The results of QoS are stored in the ASDR™. QXManager aggregates QoS statistics for site, service, group, or specific end to end communication and present the results to the User.

iv. Trend: This group is similar to Traffic but based on historical data that allows the operator to have a view on how events, parameters, and traffic figures have changed over a period as shown in the example of the next figure.

v. Alarms: Probes send alarms in real-time or as log report to the QXManager. The system forwards the alarms to the different operators: if the operator is currently connected to the

www.globeoss.com 19

QXManager, the alarm is shown on the GUI running in the browser, otherwise it is emailed.

vi. Selective real-time analysis: The operator may need to look for specific events like a data or voice connection, or a generic session between two addresses (IP, phone numbers, email addresses etc.) as they occur. In this case operator can set a search filter that QXManager will forward to all the probes. When a probe detects the requested event, it delivers this information to the QXManager, which re-assembles all the information received from different probes in a common network wide view.

3) Results Import and Export Section: This functional block allows QXManager to export data and results to another system. QXManager can also import data from outside sources. The implementation is normally done on case by case to connect external databases or standards-based communication such as Syslog servers, ASCII CSV fields records transfer, ftp/ftps services and direct databases socket connection.

5.3IPXPlorer® FlexIPXPlorer® Flex is a rack mount solution for IP and telecommunication centres. Its High Performance, Large Storage, and Analysis capabilities make IPXPlorer® Flex the perfect tool for broad Network Monitoring; Data, Voice and Video Recording; End-to-End Session Trace and Troubleshooting; and Quality of Service and Quality of Experience measurements.

5.3.1 IPXPlorer® Flex 4B Features 4U 19” rack mount

www.globeoss.com 20

24 x LAN GE/SDH-SONET analysis ports 48 PCM ports 2 GE Management ports 8->48TB built in storage with high performance RAID system 24 Hot swappable disk bays Fiber Channel for SAN Performances:

o 4.5 Gbps packet recordingo 2.0 Million packet/second analysis capabilityo 15 Gbps data capture and hardware filtering capability

Up to 10 Simultaneous Web Clients AC Redundant Power Supply (DC -48 optional)

5.3.2 IPXPlorer® Flex 4A Features

4U 19” rack mount 2 x 10GE analysis ports 4 to 8 LAN GE/SDH-SONET analysis ports 2 GE Management ports 8->48TB built in storage with high performance RAID system 24 Hot swappable disk bays Fiber Channel for SAN Performances:

o 4.5 Gbps packet recordingo 2.5 Million packet/second analysis capabilityo Over 20 Gbps data capture and hardware filtering capability

Up to 10 Simultaneous Web Clients AC Redundant Power Supply (DC -48 optional)

www.globeoss.com 21

5.4IPXplorer Physical Interfaces

The IPXplorer interfaces includes:

LAN Ethernet: from 2 to 24 FE/GE Optical and/or Electrical LAN Ports SONET/SDH: from 2 to 24 STM1/OC3 Optical and/or Electrical Links.

VC11/ VC12, ATM AAL5 support Both LAN and SONET/SDH ports are SFP based PCM: From 8 to 48 E1/T1/J1 ports for Low/High Speed Links and B-ISDN

SS7. All time slots (signaling links) are accessible 10GE: From 2 to 4 10G Ethernet ports SFP+ based

5.5IPXplorer PerformancesIPXPlorer® combines hardware and software to set new performances records in the industry, such as:

Wire speed traffic capture and filtering. From 600,000 to 1,5 Millions packets per second real-time analysis.

Analysis performance figures vary depending on model. For SS#7 LSL and HSL,1 Erlang per signaling link is supported. Frame and packet off-load and filtering technology M-CEFTM (patent

pending) allows maximum network resources without slowdowns or outages. The MuTech Cognition Engine Filters M-CEFTM combine high speed dedicated flows tagging system, signaling and payload pattern comparison hardware logic, software algorithms for protocol events and programmable recognition of specific data stream sequences.

Over 300 Mbps data recording on disk for IPXPlorer® One and Mod models, and over 2Gbps for IPXPlorer® Flex.

10GE ready

www.globeoss.com 22

5.6Multiple TechnologiesThe IPXPlorer® is a unique solution in the market that covers wide range of technologies such as:

SS#7 MTP & Sigtran NGN-VoIP-IMS IuCS & Voice Core Iub, IuPS, Gb and Packet Core Gn/Gp-Gi IPTV & VoD Enterprise

The solution can be configured to meet the requirement of the customer and the packages offered:

IP Data Packages: tcp/ip/udp, http, ftp, pop3, smtp, imap, p2p, msn, dns, mms, wap, radius, diameter, pppoE

Multimedia IP Packages: IPTV, VoD, SIP, and H323 SS#7 Packages: SigTran, ISUP, BICC, Camel, MAP and INAP Mobile PS Packages: IuPS, Gb, Gn/Gp, Gi Mobile CS Packages: IuCS Mobile Roaming Package: GRX and IPX with GRQ analysis NGN and IMS Packages: SIP 3G, H248, MGCP, NCS, RTP/RTCP, SIP-I IP Core: MPLS Telephony and Access: ISDN-PRI, DPNSS

Features of Application Packages:

www.globeoss.com 23

All packages:

ASDR generation KPIs Traffic analysis Drill-down Reporting Protocol decode ASDR to packets Filtering for each field of ASDR and analysis Detail Records Forwarding

Selected packages only:

Correlation with other application packages Alarms Logical Maps Anomalies DPI- Deep Packet Inspection Capture Filters

5.7IPXPlorer® Key Features

IPXPlorer® comes with many features and among the key ones are:

Breakdown of traffic, QoS, problem causes, usage and activity for every user

Correlation of communication events over multiple interfaces, protocols/services and sites

Traffic analysis for all the meaningful elements such as user, host, site, phone number, and addresses, URL, network etc.

ASDR includes network, transport (IPDR), signaling (CDR), the services (SDR) and QoE information

Over 3500 KPIs for most important services and protocols Real-time programmable alarms and anomalies Trend Analysis for the most significant parameters such as MOS, MDI, Call

Attempts, ASR, ABR, PDP Context, … Location and Mobility Analysis for CS and PS traffic Built-in probe Management system with geographical map

representation.

www.globeoss.com 24

www.globeoss.com 25

5.8Open Connectivity

The IPXPlorer® is designed to be open to interact with other OSS / BSS systems.

This includes:

Detail Record Export in CSV Export system with field customization SQM-CEM platform such as the IBM Tivoli KPI in CSV format Trend and statistics in PDF and CSV format Alarm as xDRs or SNMP format Logical and Symbolic Maps in CSV Direct Access to external DB

www.globeoss.com 26

5.9ASDR™: The new wave in Call Detail Record Concept

Application Service Details Record-ASDR™ is an aggregation of the procedures running at the different protocols layers for an application or service.

ASDR™ concept is similar to the Call Details Record-CDR concept for a call based service in Telephony or the IPDR in the data environment, with the difference being that ASDR™ works for any type of services: voice, data, or video based. In some ways ASDR™ is the evolution of the CDR and IPDR concepts, merging and extending them in a new concept.

MuTech has extended the Details Record fields by adding useful information for diagnostic, troubleshooting, network planning, QoS assessment etc.

IPXPlorer® Flex probe generates an Application Service Details Record (ASDR™)for each end-to-end communication at application level for the most significant services.

ASDR™ gives a complete report on the activities generated between the two hosts at the application level by combining together the necessary protocol handshake that happen at the protocol layers to serve the application.

ASDR™ is aggregation of all the important information related to a session, a call, a service or an application running between two hosts or users. ASDR™ links all the xDR generated from 2 through layer 6 of ISO-OSI architecture. An ASDR™

www.globeoss.com

CDRlimited to Signaling information and call control in telephony

TDRmainly for Control plane information such as signaling for roaming, sms, mobility, and intelligent network services

IPDRlimited to the UDP or TCP session and without any reference to the application or service

ASDRProvides one record for all Services and Applications being monitoredAutomatic Link between Transport, signaling, payload, service, and quality of serviceAddress QoS – QoE – KPIs for Multimedia oriented ServicesIncludes links to User Traffic such as conversation and video streams information

27

also includes values for traffic exchanged, bandwidth utilization, connection duration, quality, and possible communication problems.

IPXPlorer® probe also provides standard IP, Calls, and Transaction Details Records (IPDR, CDR, and TDR) without aggregation in ASDR™, for backward export compatibility to existing systems.

An example of ASDR™ is represented by a complete VoIP session that generates an ASDR™ combining the IPDR for TCP connection between the hosts, the IPDR of SIP Agent registration to proxy, the CDR of the SIP call, and the IPDR generated by the RTP connection carrying the voice packets. Plus ASDR™ contains the information about voice quality score (such as MOS – the Mean Opinion Score), the network and the application response time typical of IP sessions, and the IP impairments that may cause degradation of the quality.

If the User needs to see the VoIP traffic in terms of quantity and quality, it is enough to recall the VoIP ASDR™ and see the data as call completion analysis, voice quality, traffic trend, and network response time to get a complete picture of the service.

The alternative is manually combining, creating complex queries or accessing multiple data sources from xDR, with statistics from counters and QoS score from quality analyzers, and finally link and correlate all of these results together. With IPXPlorer® probe, all this is not necessary and everything is done transparent to the User and instantly.

Application Service Details Record-ASDR™ is a pending patent and trademark of MuTech.

www.globeoss.com 28

5.10 Decode, Trace, and HEMSIPXPlorer® Flex has the ability to capture packets and frames and elaborate them in sessions or transaction called xDR- Detail Records. xDR are generated at different protocol levels which are part of the same service transaction and are linked together into the ASDR™ as explained in the previous section.

The ASDR™ has links to the different xDR (i.e. IPDR, CDR, TDR, and/or SDR), so the User can zoom from a specific ASDR™ to the xDR components and vice versa. The xDR has links to the packets and frames stored in PCAP format in the IPXPlorer® Flex. Therefore, the User can drill-down from ASDR™ to xDR to frames and packets.

IPXPlorer® Flex has also a built-in engine to decode packets and frames. This engine is the Wireshark open-source that is derivate from ethereal project. Because Wireshark does not support all the protocols required by IPXPlorer® Flex, MuTech has expanded and completed the open-source project by fixing and adding the missing and non working parts. When the User drills-down from ASDR™ or xDR to packets, the protocol decode shown on screen is generated with MuTech modified and supported Wireshark engine.

www.globeoss.com 29

With the decode engine, the User gets full decode with mnemonic messages of all the main protocols fields, layers split presentation, and hex-ASCII view.

IPXPlorer® Flex has also a graphical engine called HEMS. It is able to show the message flows between the hosts for each leg part of the entire communication process. In this case, the User selects the packets decode starting from ASDR™, the entire end-to-end process flow with packets/frames decode is shown.

This capability is available on the local and remote web-browser based GUI. A sample of protocol decode with graphical message flow on web GUI is shown in the previous figure.

The graphical presentation of message flow is also available at QXManager level after the correlation process for a wide network end-to-end communication process involving multiple IPXPlorer® Flex probes.

www.globeoss.com 30

5.11 Alarm Generation

IPXPlorer® Flex has a specific engine to generate alarms based on protocol or service conditions. A condition can be a simple event or complex series of events detected in the communication process being monitored. The condition triggers an alarm and when the condition becomes true, action is executed by the alarm system.

The events considered for generating alarms are the result of analysis or counting of the activities of IPXPlorer® Flex.

www.globeoss.com 31

The main sources of the event that can be set to generate alarms are the followings:

ASDR™ xDR Statistic Counters Quality of Service Analysis Call Completion Analysis.

An alarm is characterized by parameters such as:

Conditions and Parameters:o Protocol Event: The event considered as trigger condition.o Severity: it determines the level of importance of the alarm. In this

way the alarm will be flagged with a coloured Flag depending on the importance set. The setting of severity will help in filtering and finding specific alarms in the Alarm Detail Record Log and to set the priority of event delivery to the QXManager Centrex Viewer. The possible choices for the severity level are:

Emergency Alert Critical Error Warning Notice Informal

www.globeoss.com 32

Debugo Group: it allows the User to specify if the selected event should be

considered for all the traffic being monitored or only the traffic related to a Group.

o Set Condition: it allows the User to set the number or value, and the mathematical operator which an event should match before the alarm conditions are met. This does not necessarily mean that the alarm will be generated, but indicates that the conditions have become true. An alarm will be generated when these conditions are satisfied and the conditions configured in Set Mode are verified. The possible choices for the mathematical operators for conditions are:

Greater Than (>) Greater Than or Equal To (>=) Less Than (<) Less Than or Equal To (< =) Equal To (=)

o Set Mode: a User can determine the frequency of an event that would satisfy the conditions set in the previous field (Set Condition) before the Instrument generates a real alarm. This is how a User can set a hysteresis cycle for an alarm. The Set Mode allows the following choices:

Single Event: when enabled, the alarm will be generated every time the alarm condition becomes true.

Interval Time: this enables a period of time in seconds over which the instrument evaluates the events as set in the conditions. If it is the case where the event is true (the event matches the Set Condition described above), the instrument calculates the percentage of true events against the total number of the same events in the time period (true and false events). If the percentage of true events is equal to or greater than the value set in the Threshold (%) field, the alarm will be generated. This is a very sophisticated system because it evaluates the true and false alarms over a period of time to avoid false alarms, which may be generated for transitional events.

Counts: when enabled, the alarm will be generated when the number of true events (events that match the values set in Set Condition) is equal to or greater than the values set in this field.

Actions: here are the possible actions when the conditions are satisfied:

o Send Email: it allows the generation of email if the alarm becomes true. The lists of destinations are set during the configuration phase.

o Deliver the alarm to the QXManager Centrex Viewer.

www.globeoss.com 33

o Start / Stop PCAP Data recording on internal storage.

5.12 KPIsThe solutions come with more than 3500 KPIs out of the box, including the following:

o IP impairments such as network response time, latency, jitter, packet loss, duplication, and retransmission, fragmentation level…

o Generic Applications impairments such as application response time, traffic figures per direction, retransmissions, speed in uplink & downlink….

o Specific Service impairments and performance such as session established, released and duration time, real User perceived speed, QoS scoring, telephony type analysis (ASR, ABR, Call attempts etc)…

o Inter-Protocol and inter-Site correlation impairments such as transit delay, message loss, overhead, efficiency, speed bottlenecks, QoS effectiveness ….

*Please refer to the KPI document for further detail.

www.globeoss.com 34

5.13 Result AggregationIPXPlorer® aggregates analysis results in several ways, such as:

o Physical: site, port, VLAN,Q-in-Q, MPLS label, tunnel….o Network/Transport: Server, Client, Hosts, and Pairs…..o Equipment address: IP, Point Code, SGSG, GGSN, HLR, SP, SCP, HLR, Media

Gateway, MGC, Call Agent, Proxy……o Signaling numbers: E164, IMSI, MSISDN, URL, email…o Terminal type and serviceo Per programmable groups

www.globeoss.com 35

5.14 Trends and StatisticsIPXPlorer® provides snapshot of analysis and trends in several modes:

o TOP ‘N’: site, Server, Client, Hosts, Pairs, Users, calling, called, MSISDN, Equipment type, conversations, …..

o KPIs: fastest and slowest elements, quickest responses time, bandwidth, utilization, usage, sessions, tunnels, ….

o QoS: MOS, MDI, Jitter, other IP & services impairments,…..o Time interval of trends are fully programmable

www.globeoss.com 36

5.15 Geographic Viewer ManagementThe IPXPlorer® can also be managed geographically with the geographic viewer management.

o QXManager manages logical and geographic mapso Maps representations are for probes, circuits, IP, Signaling Points, Area

Codes, Service Areas, PLMNs…o Geographic maps are real time from Enterprise Google mapo Probes/Sites are identified by the geo coordinateso Probes can be equipped with GPS option for auto-location

www.globeoss.com 37

5.16 Probe ManagementQXManager manages all the probes connected to it.

Hardware status for CPU, monitor interfaces, memory, hard disks, temperature, fans, batteries and power supplies

Software status for release and firmware versions, time synchronizations, alarms log, and MTTF (Mean Time To Failure) MTTR (Mean Time To Repair) reports

Inventory information and geo position of the probe

www.globeoss.com 38

5.17 Probe InventoryQXManager allows the User to create and maintain an inventory of probes, sites and configuration.

o Inventory information includes:o Site addresso geo position of the probeo Local operators and administratoro Equipment type and configuration o IP and email address

www.globeoss.com 39

5.18 Flexible DashboardThe solution comes with flexible dashboard. Each user can save their own environment for future use. It can also be easily customizable.

5.19 Results CollectionComplete Analysis is available for network, transports and applications-services:

Statistics of Traffic and protocol counters are updated on the probes every 30 seconds

Trend analysis based on historical data is programmable over any period of time

ASDR™ on the probes are updated every minute

Services-Applications and QoS Analysis are updated on the probes every minute

Real-time alarms and anomalies are directly dispatched from probes to QXManager

Non real-time alarms, anomalies and logs are updated on the probes every 30 seconds

KPIs are generated on the basis of ASDR™ and Traffic counters every minute

www.globeoss.com 40

6 Core Concepts

6.1Group ConceptsOne of the most interesting features of IPXPlorer® Flex is the capability to classify results in groups at the time of data acquisition and analysis. In other words, the probes analyze the traffic in real time and can divide the results of analysis in groups programmed by the User.

Groups can be characterized by specific device or network addresses, VLAN, point codes, services type, UDP or TCP ports and many other elements. This grouping feature allows the User to get results of specific traffic groups quickly without having to wait for database query generation at a centralised level.

The results per-group as well as the global network results are available locally at the probe level or at the centralised level.

In case of centralised system, MuTech provides the QXManager as Centrex Viewer and Manager of IPXPlorer® Flex probes.

6.2Correlation ConceptCorrelation in the IPXPlorer® Flex is the ability to link together sessions, calls, transactions, pdp-context, or any signalling based-procedures which belong to different protocols and running on different type of physical interfaces, but are part of the same end-to-end user communication.

For example, when a data connection is requested from a ADSL Modem to retrieve emails from a remote POP3 server, this connection goes through different network elements and are trans-coded in different protocols (for example BRAS, Ip Interfaces and then of generic IP connection with possible insertion of Gs in case of automatic association for deciphering).

When IPXPlorer® Flex is connected to the different network elements monitoring points, it has the ability to monitor all the messages belonging to the same call, in this result section a User can see the actual end-to-end conversation between the two end users linked together.

The correlation in IPXPlorer® Flex architecture is always based on xDR or better on ASDR™. The intrinsic capability of ASDR™ to link packets and frames, allows to the correlation engine to show the complete end-to-end process flow and the packet-frame flow as well.

In the example mentioned of tracking a data connection from BRAS, through Ip, then MPLS, and finally over Intranet-Internet connection, each session detected over one of the monitoring point will generate an xDR, specifically:

All these xDR will be linked in a single ASDR™ for every session the User will activate. From the ASDR™, IPXPlorer® Flex extracts the xDR part of the same communication process and from xDR it can link the every packet or frame of the

www.globeoss.com 41

flow, including payload carrying the user traffic (i.e. the POP3 taken for this example).

This xDR will be linked with the others of the same user by the ASDR™. Therefore, from ASDR™ the IPXPlorer® Flex can link not only the traffic exchanged during a sessions over multiple interfaces being monitored, but also the logical links between the different addresses existing in the system.

In case of geographic distribution of probes, there are two level of correlation:

o Site level.o Network level.

The correlation at site level is managed by the MT-OS running on IPXPlorer® Flex and all the data coming from different interfaces and protocols that are part of the same flow can be correlated together in an ASDR™ as explained previously.

In the correlation at network level there are two distinct phase:

The IPXPlorer® Flex collects and generates local ASDR™ with correlation when possible. Then QXManager Centrex Viewer loads the ASDR™ in its database. Packets and frames remain stored in the probe and are not delivered to the QXM. Packets may be recalled by QXM on-demand for troubleshooting analysis or drill-down functions.

The QXManager Centrex Viewer collects ASDR™ from multiple probes, store ASDR™ in the database, then execute the correlation between ASDR™ to create, when applicable, a Network-Application Service Details Record or N-ASDR™. The N-ASDR™ is also stored in the internal database.

The operator at QXM level can recall on the console the correlation at:

IPXPlorer® probes level. In this case correlation, trace, and decode are performed by the probe, and the QXM works as simple dispatcher, while the communication between console and probe are peer-to-peer.

QXManager Centrex Viewer level. In this case QXM recalls the N-ASDR™ from the internal database and divide in the original ASDR™, then inquires each probe for the packets. The packets will be temporarily transferred from the IPXPlorer® Flex to the QXM, subsequently decoded, and displayed to the User’s console.

6.3Synchronization TechniqueWhen more measurement interfaces or ports are involved in monitoring multiple network points, synchronization and timing become an important issue to guarantee that the entire protocols event captured are stamped with the same clock and precision.

This situation is even more important when multiple sites are involved in a distributed monitoring network.

There are two different situations involving synchronization:

www.globeoss.com 42

o Ensure all the measurements ports sample the incoming packets and frames with a common time ticks (or clock);

o Guarantee the same absolute time through all the probes.

MuTech has developed a specific technique in the MT-OS running on IPXPlorer® Flex to provide all the necessary level of timing and synchronization. There are three level of action:

o At probe level;o At site level;o At system level.

6.3.1 Synchronization at IPXPlorer® Flex levelEach IPXPlorer® Flex has multiple measurement interfaces as described in the section 1.3.1. All these interfaces are synchronized to a common timing signal provided by a timing card built-in the probe.

This timing card generates and distributes a common clock called Synch bus and all the interfaces synchronize its time stamp clock to this clock (Please refer to the Figure 7).

The timestamp resolution of IPXPlorer® Flex is 10 nanoseconds. The frequency or phase shifting between measurements interface is avoided thanks to the master clock.

The absolute time (year, month, day, hour, minute, second, millisecond) is provided by the software of IPXPlorer® Flex and it can be synchronized with external Stratum 1 or 2 NTP servers.

IPXPlorer® Flex can also be equipped with GPS optional device. In this case, both the common clock and the absolute time are supplied by the GPS. All the cards share these clocks through the timing board.

6.3.2 Synchronization of IPXPlorer® Flex at site levelIn case of multiple IPXPlorer® Flex installed in the same site, a synchronization strategy per site allows multiple probes to share the same clocks.

As described in the previous section an IPXPlorer® Flex is set as master probe and it generates a Synch Bus synchronized with the GPS option installed to share with internal interfaces cards and the other IPXPlorer® Flex connected to it.

The other IPXPlorer® Flex receives the synch bus from the master unit and shares the signals to the internal interfaces cards.

This strategy guarantees that all the internal clocks of the IPXPlorer® Flex probes located in the same site have a 10 nanoseconds time stamp synchronized as far as frequency and phase. The absolute date and time is also the same for all the probes in the site.

In case of multiple probes per site, GPS option is required.

www.globeoss.com 43

6.3.3 Synchronization of QXManager and IPXPlorer® Flex at network levelMuTech has developed two different approaches to guarantee the same absolute date and time to all the probes in the network.

The first approach is based on external Stratum 1 and 2 Public NTP servers. Either QXManager or IPXPlorer® Master Flex are configured to require the current date and time from one or two close public NTP servers and then set the internal clock of the devices to values received. This strategy is simple and cheap but it recommended especially when probes and QXManager are spread around the globe. The main limitation is due the maximum precision of the time is 10 ms in theory even if does not exceed 50 or 100 ms in the reality.

The second approach requires GPS option installed on QXManager and the IPXPlorer® Master Flex. The QXManager is also a NTP server with absolute date and time synchronized by GPS. IPXPlorer® Flex requests date and time update from QXM periodically to ensure the same values everywhere. This approach gives the best precision and it can be applied where the maximum distance between QXM running as NTP server and most far probe is less than around 2000 Km.

7 IPXplorer Software Packages

IPXplorer has many packages to serve the needs of various service providers. It is flexible and upgrades can be done on need basis.

7.1All-IP Package Analysis Package for IPv4 and IPv6:

o UDP, TCP, ICMP, SCTP, RTP, and RTCP Analysis based on well-known port definitions and Deep Packet

Inspection for special services such as Skype or chat rooms

www.globeoss.com 44

ASDR->IPDR generation IP impairment measurement Alarm on TCP error, bandwidth, and KPIs Single host , host pair, port and service group results IP Logical Mapping and Symbolic name assignment Sources:

o Ethernet, STM1+ATM+AAL5, E1+HDLC+Eth-MAC, Net-Flow/IP-Fix Two stacks analysis capability:

o Physical + IP + tunnel + IP + Services

7.2WEB Package Analysis Package for http and ftp services Analysis based on User programmable ports ASDR for http session, http page, ftp control and data sessions Analysis and KPIs on traffic, error, url, client-server, request-response

handshake Alarm on KPIs Export the sessions in PCAP format Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.3Email Package Analysis Package for smtp, pop3 and imap services Analysis based on User programmable ports ASDR for smtp, pop3, and imap sessions Analysis and KPIs on traffic, error, username, message, mail server,

client/server Alarm on KPIs Export the sessions in PCAP format Keywords Search function Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.4DNS Package Analysis Package for dns and whois services Analysis based on user programmable ports ASDR Analysis and KPIs on query, error, dns server, client-server Alarm on KPIs Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.5AAA Package Analysis Package for pppoe, radius, and diameter protocols and services Analysis based on User programmable ports ASDR for pppoe, dhcp, radius, and diameter session Correlation between pppoe, dhcp and radius Analysis and KPIs for session, error, username, authentication failure,

server, user-server, command-response Alarm on KPIs

www.globeoss.com 45

Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.6Sigtran Package Analysis Package for SigTran:

o M2UA, M2PA and M3UA (SCTP: IETF RFC 2960: Stream Control Transmission Protocol, M2UA: RFC 3331 Signaling System 7 (SS7) Message Transfer Part 2 (MTP2)- User Adaptation Layer, M2PA: IETF RFC 4165: SS7 MTP2-User Peer-to-Peer Adaptation Layer, M3UA: IETF RFC 4666: SS7 MTP3-User Adaptation Layer)

ASDR generation for SCTP, M2PA, M2UA and MTP3 Error , Association, and Traffic analysis Alarm on KPIs IP, and Point Code, Logical Mapping and Symbolic name assignment Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.7VoIP Package Analysis Package for SIP, H.323, RTP, RTCP, SDP ASDR->CDR for SIP, H.323 and RTP Call and Registration Completion error cause analysis Alarm on KPIs Call Trace Analysis for phone numbers and url, area and country code Audio and Video quality analysis on RTP flows with MOS (G.107) and MDI Compatible with OLOs traffic package IP, Point Codes, and Area Codes Logical Mapping and Symbolic name

assignment Correlation with ISUP and MEGACO Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.8IMS Package Analysis Package for IMS includes

o Diameter for Cx, Dh, Dx, Gq, Rf, Ro, and Sh Interfaceso SIP-3G for Gm, ISC, Ma, Mg, Mi, Mj, Mk, Mr, and Mw Interfaceso H.248 for Mn and Mp Interfaceso HTTP for Sr and Ut Interfaceso MAP/SigTran for Si Interface

ASDR generation for H.248, SIP, RTP, MAP Analysis for phone number, IMSI, MSISDN, area and country codes Alarm on KPIs Audio and Video quality analysis on RTP flows with MOS (G.107) and MDI Compatible with OLOs traffic package IP, Point Code, area and country code Logical Mapping and Symbolic

name assignment Correlation with ISUP Sources: ALL-IP

www.globeoss.com 46

7.9IPTV Package Analysis Package for IPTV includes: Multicast (IGMP) and Unicast, RTP,

MPEG transport streams Join/Leave functionality ASDR generation by IGMP, MPEGTS, RTP Analysis for TS, PID, User, Zapping, QoS by Program ETR290 Results Audio and Video quality analysis on RTP flows with MOS (G.107) and MDI IP Logical Mapping and Symbolic name assignment Correlation IGMP->RTP->MPEGTS->Audio/Video Streams Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.10 VOD Package Analysis Package for Video on Demand includes: HTTP, RTSP, RTP, MPEG

transport streams ASDR generation for RTSP, MPEGTS, RTP Analysis for client, url, server, program, duration QoS by Program and

User Audio and Video quality analysis on RTP flows with MOS (G.107) and MDI IP Logical Mapping and Symbolic name assignment Correlation HTTP->RTSP->RTP->MPEGTS->Audio/Video Streams Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.11 P2P Package Analysis Package for P2P services Analysis based on Deep Packet Inspection – DPI Identification of BitTorrent, WinMx, eMule, Kazaa, Gnutella ASDR for P2P Analysis and KPIs on traffic, host, host pair IP impairments Alarms on KPIs Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

www.globeoss.com 47