Feature Description

The Monitor Subscriber (MonSub) feature enables tracing of subscriber-related information which includes user and control traffic, and events such as charging and internal events that are useful for debugging. By default, this information is displayed on the Session Management Function (SMF) console, where the user executes MonSub tracing CLI command and captured in a Packet Capture (PCAP) file on the UPF.

User traffic is carried on slowpath when packets traverse to the application, or fastpath when packets don't have to traverse up to the application and are offloaded to fastpath processing (VPP). Slowpath mode was the default mode until fastpath offload (VPP) into SAEGW was introduced.

Monitor Subscriber provides the following functionality:

  • Continuous capture of user traffic from fastpath in PCAP files in the UPF.

  • The control event traffic and other related information are captured in separate PCAP files in the UPF.

  • New option, UP PCAP trace [W - UP PCAP Trace (ON)], is introduced for SMF and UPF in MonSub CLI. The slow-path and fast-path PCAP generates only when this option is ON.

  • Maximum of 4 MonSub sessions can be enabled per UPF.

Following are some of the important definitions related to this feature:

  • Chassis Traffic Volume: The total volume of packet throughput on the chassis.

  • Monitored Traffic Volume: Monitoring of the total throughput of all the subscribers through MonSub across all the MonSub sessions.

  • PCAP Success: The percentage of the MonSub traffic capture request and the successful capture in the PCAP files.

PCAP Success

The PCAP success depends on the following factors:

  • The level of PCAP success depends on several factors, including monitored traffic volume, VPP utilization, MonSub monitor priority, and background disk I/O.

  • In general, the PCAP success rates are greater for the following cases:

    • When the VPP utilization is low and/or MonSub monitor priority is above best-effort.

    • When the monitored traffic volume is less than 10% of the chassis traffic volume.

    Example: When VPP is running at 80% utilization and handling approximately 10Gbps chassis traffic volume, then monitored traffic volume up to 1Gbps is likely to yield high PCAP success percentages.