Matching User and Control Plane Data in a Network System Using Control and User Plane Separation

1. A system for correlating user plane and control plane data, the system comprising: a plurality of user plane (U) probes; a control plane (C) probe; and a network monitor configured to communicate in communication with a the plurality of U probes and a plurality of the C probes associated with the network monitor, probe, wherein the plurality of U probes being configured to monitor monitors at least one SGW-U session gateway operating in the user plane (SGW-U) operating on user plane traffic packets of network traffic, and wherein the C probes being configured to monitor at least one SGW-C monitors a session gateway operating in the control plane (SGW-C) operating on control plane traffic packets of the network traffic; wherein the plurality of U probes configured to buffer buffers the user plane packets captured from the at least one SGW-U, detects one or more new sessions, determine each determines a subset of the captured user plane packets that are is associated with respective the one or more new sessions, and send sends, to the network monitor, new session data based on the subset of the captured user plane packets determined to be associated with the respective one or more new sessions, the new session data including, for each U probe of the plurality of U probes that detects one of the one or more new sessions, an IP address pair of each of the U probe and the a SGW-U that processed the corresponding user plane packet; and of the at least one SGW-U that is monitored by the U probe, wherein the plurality of C probes configured to communicate probe communicates with the network monitor and at least a portion of the plurality of U- probes, receive receives the new session data from the network monitor, inspect control plane packets captured from the at least one SGW-C, determine determines one or more control plane packets of the captured control plane packets having a same IP address as an SGW-U that is included in the new session data, and send sends control data associated with the one or more determined control plane packets to a particular U probe of the plurality of U probes having the IP address paired with the IP address of the SGW-U, and wherein the particular U probe is further configured to correlate correlates the control data with one or more of the user plane packets that were buffered by the particular U probe, and generate generates monitoring data based on the correlated control data and user plane packets.

2. The system of claim 1, wherein the plurality of C probes is further configured to select probe selects predetermined fields from the one or more control plane packet packets to be included in the control data.

3. The system of claim 1, wherein the selected predetermined fields include fields for holding information about at least one of international mobile subscriber identity (IMSI), mobile station international subscriber directory number (MSISDN), international mobile station equipment identity and software version number (IMEI-SV), and Cell-Id.

4. The system of claim 1, wherein the plurality of U probes is further configured to buffer buffers the user plane packets with respective timestamps indicating a time of being captured or buffered, and the particular U probe waits a predetermined delay time from the timestamp a time that a user packet was received, the time indicated by the timestamp, before correlating that user packet with the control data.

5. The system of claim 1, wherein the network monitor sends all unsent new session data periodically to all of the C probes of the plurality of C probes probe, wherein previously sent new session data is considered as old session data.

6. The system of claim 1, wherein the network monitor monitors one or more of 5G, 4G, and Wi-Fi protocols.

7. The system of claim 6, wherein the system further includes comprising: a new U probe that was is added to the plurality of U probes by registering itself with the network monitor during operation of the network and performing functions for which the plurality of U probes are configured; or a new C probe that is added to the C probe by registering itself with the network monitor during operation of the network and performing the functions for which the plurality of C probes are configured.

8. The system of claim 6, wherein the system further includes a new C probe that was added to the plurality of C probes by registering itself with the network monitor during operation of the network and performing the functions for which the plurality of C probes are configured.

9. The system of claim 2, wherein the particular U probe is configured to perform performs deep packet inspection in order to access fields in the buffered user plane packets that correspond to fields included in the content data.

10. The system of claim 2, wherein the plurality of C probes are configured to perform probe performs deep packet inspection in order access the predetermined packets from the control plane packets.

11. The system as recited in claim 1, wherein the monitoring data includes Adaptive Service Intelligence (ASI) data.

12. The system as recited in claim 1, wherein at least one of the network monitor and the particular U probe uses the monitoring data to determine a characteristic of the network traffic, wherein the characteristic of the network traffic includes at least one of quality of service, performance, and end user experience.

13. The system as recited in claim 12, wherein the characteristic of the network traffic includes at least one of quality of service, performance, and end user experience.

14. The system as recited in claim 1, wherein the plurality of U probes receive receives the captured user plane packets via a tap that monitors the at least one SGW-U.

15. The system as recited in claim 1, wherein the plurality of C probes receive probe receives the captured control plane packets via a tap that monitors the SGW-C.

16. The system as recited in claim 2, wherein the plurality of C probes are probe is adapted to a protocol being used by the network, wherein adapting the plurality of C probes probe includes adjusting the predetermined fields for selecting information from the control plane packets to be included in the control data.

17. The system as recited in claim 1, wherein the particular U probe performs deep packet inspection to determine whether a user packet is associated with a new session and for obtaining the new session data.

18. The system as recited in claim 1, wherein the particular U probe, for the purpose of correlating the user packets with the control data, limits the deep packet inspection performed on the buffered user packets to deep packet inspection needed for determining a new session and extracting the new session data.

19. The system as recited in claim 1, wherein inspecting by the plurality of C probes probe, for the purpose of correlating the user packets with the control data, includes performing deep packet inspection.

20. The system as recited in claim 19, wherein the plurality of C probes limit the deep packet inspection performed on the buffered control plane packets, for the purpose of correlating the user packets with the control data, to deep packet inspection needed for extracting the control data.

21. A method performed by a network monitor for correlating user plane and control plane data, the method comprising: receiving, from a plurality of U probes that detected one or more new sessions, new session data that includes data about the detected one or more new sessions, wherein the plurality of U probes are configured to monitor monitors at least one SGW-U session gateway operating in the user plane (SGW-U) operating on user plane traffic packets of network traffic and buffer buffers the user plane packets captured from the at least one SGW-U, and wherein the new session data includes, for each U probe of the plurality of U probes that detected one of the one or more new sessions, an IP address pair of each of the U probe and the a SGW-U of at least one SGW-U that processed a user plane packet that is associated with a start of a new session is monitored by the U probe; buffering the new session data; sending the new session data to a plurality of C probes probe associated with the network monitor, wherein the plurality of C probes are configured to monitor at least one SGW-C probe monitors a session gateway operating in the control plane (SGW-C) operating on control plane traffic packets of the network traffic, buffer buffers and perform deep packet inspection on captured control plane packets of the control plane network traffic, determine determines one or more control plane packets of the captured control plane packets having a same IP address as an SGW-U that is included in the new session data, and send sends control data associated with the one or more determined control plane packets to a particular U probe of the plurality of U probes having the IP address paired with the IP address of the SGW-U; and receiving, from the particular U probe, monitoring data based on the correlated control data that can be used to determine a characteristic of the network traffic, wherein the U probe is configured to correlate correlates, after a delay, the control data with one or more user plane packets that were buffered for providing the monitoring data.

22. The method of claim 21, wherein the method further includes comprising periodically sending all new session data that was not sent yet about the at least one or more new session sessions to all of the C probes of the plurality of C probes probe, wherein previously sent new session data is considered as old session data.

23. The method of claim 21, wherein the method further comprises comprising using the monitoring data to determine a characteristic of the network traffic, wherein the characteristic of the network traffic includes at least one of quality of service, performance, and end user experience.

24. A method performed by a C probe of a plurality of C probes for correlating user plane and control plane data, the method comprising: receiving, from a network monitor to which the C probe is associated, new session data, wherein the new session data was provided to the network monitor by a plurality of U probes that detected one or more new sessions, wherein the plurality of U probes are configured to monitor monitors at least one SGW-U session gateway operating in the user plane (SGW-U) operating on user plane traffic packets of network traffic and buffer buffers the user plane packets captured from the at least one SGW-U, and wherein the new session data includes, for each U probe of the plurality of U probes that detected one of the one or more new sessions, an IP address pair of each of the U probe and the a SGW-U that processed a user plane packet that is associated with a start of a new session of the at least one SGW-U that is monitored by the U probe; monitoring at least one SGW-C a session gateway operating in the control plane (SGW-C) operating on control plane traffic packets of the network traffic; capturing and buffering the control plane packetsof the control plane traffic; performing deep packet inspection on the captured control plane packets, wherein the deep packet inspection is limited to deep packet inspection needed to access IP addresses; determining one or more control plane packets of the captured control plane packets having a same IP address as an SGW-U that is included in the new session data; selecting control data from the one or more determined control plane packets; sending only the selected control data to a particular U probe of the plurality of U probes, wherein the particular U probe has an IP address associated paired with an IP address of the SGW-U's IP address SGW-U and the particular U probe is configured to correlate correlates, after a delay, the selected control data with one or more of the user plane packets that were buffered for providing to the network monitor monitoring data that is based on the correlated control datathat can be used to determine a characteristic of the network traffic.

25. The method of claim 24, wherein the selected control data is obtained from predetermined fields of the control plane packets, wherein the predetermined fields include fields for holding information about at least one of international mobile subscriber identity (IMSI), mobile station international subscriber directory number (MSISDN), international mobile station equipment identity and software version number (IMEI-SV), and Cell-Id.

26. A method performed by a U probe of a plurality of U probes for correlating user plane and control plane data, the method comprising: monitoring at least one SGW-U session gateway operating in the user plane (SGW-U) operating on user plane traffic packets of network traffic; buffering user plane packets captured from the at least one SGW-U; determining each a subset of the captured user plane packets that are is associated with respective a plurality of new sessions; sending, to the network monitor, new session data based on the subset of user plane packets determined to be associated with the plurality of new session sessions, wherein the new session data includes, for each U probe of the plurality of U probes that detects one of the one or more new sessions, an IP address pair of each of the U probe and the a SGW-U that processed the corresponding user plane packet of the at least one SGW-U that is monitored by the U probe; receiving control data from one or more C probes, wherein the plurality of one or more C probes are configured to monitor at least one SGW-C session gateway operating in the control plane (SGW-C) operating on control plane traffic packets of the network traffic, buffer and perform deep packet inspection on captured the control plane packets of the control plane traffic captured from the at least one SGW-C, determine one or more control plane packets of the captured control plane packets having a same IP address as an SGW-U that is included in the new session data, and send control data associated with the one or more determined control plane packets to a particular U probe of the plurality of U probes having the IP address paired with the IP address of the SGW-U; correlating the control data with one or more user plane packets that were buffered; and generating monitoring data based on the correlated control data; and providing the monitoring data to the network monitor for determination of a characteristic of the network data.

27. The method of claim 26, wherein the control data is obtained from predetermined fields of the one or more control plane packets, wherein the predetermined fields include at least one of international mobile subscriber identity (IMSI), mobile station international subscriber directory number (MSISDN), international mobile station equipment identity and software version number (IMEI-SV), and Cell-Id.

28. Non-transitory computer readable media with instructions stored thereon, when executed by at least one processor, cause the at least one processor to: receive, from a network montitor, new session data, wherein the new session data was provided to the network monitor by a plurality of U probes that detected one or more new sessions, wherein the plurality of U probes monitors at least one session gateway operating in the user plane (SGW-U) operating on user plane packets of network traffic and buffers the user plane packets captured from the at least one SGW-U, and wherein the new session data includes, for each U probe of the plurality of U probes that detected one of the one or more new sessions, an IP address pair of the U probe and a SGW-U of the at least one SGW-U that is monitored by the U probe; monitor a session gateway operating in the control plane (SGW-C) operating on control plane packets of the network traffic; capture and buffer the control plane packets; determine one or more control plane packets of the captured control plane packets having a same IP address as an SGW-U that is included in the new session; select control data from the one or more determined control plane packets; send the selected control data to a particular U probe of the plurality of U probes, wherein the particular U probe has an IP address paired with an IP address of the SGW-U and the particular U probe correlates, after a delay, the selected control data with one or more of the user plane packets that were buffered for providing to the network monitor monitoring data that is based on the correlated control data.

29. The media of claim 28, wherein the selected control data is obtained from predetermined fields of the control plane packets, wherein the predetermined fields include at least one of international mobile subscriber identity (IMSI), mobile station international subscriber directory number (MSISDN), international mobile station equipment identity and software version number (IMEI-SV), and Cell-Id.