PLDTS IP NETWORK

MONITORING SYSTEM

Table of Content
1

Executive Summary.......................................................................3
1.1
The Need For Real-Time...........................................................4
1.2
Enhanced Correlated Intelligence.............................................5
1.3
Customer Centric Service Management....................................5

Business Benefits..........................................................................7

Solution Overview.........................................................................9

Sample Application Areas.............................................................14

4.1
IP Core..................................................................................14
4.2
Fixed Broadband Network......................................................14

Detail Solution Description...........................................................15

5.1
How does IPXPlorer work?...................................................17
5.2
The QXManager - QXM...........................................................18
5.3
IPXPlorer Flex.....................................................................22
5.3.1 IPXPlorer Flex 4B Features..............................................................22
5.3.2 IPXPlorer Flex 4A Features..............................................................23
5.4
IPXplorer Physical Interfaces.................................................23
5.5
IPXplorer Performances.........................................................24
5.6
Multiple Technologies............................................................25
5.7
IPXPlorer Key Features.......................................................28
5.8
Open Connectivity.................................................................29
5.9
ASDR: The new wave in Call Detail Record Concept..............30
5.10 Decode, Trace, and HEMS.......................................................32
5.11 Alarm Generation..................................................................34
5.12 KPIs......................................................................................36
5.13 Result Aggregation................................................................37
5.14 Trends and Statistics.............................................................38
5.15 Geographic Viewer Management............................................39
5.16 Probe Management...............................................................40
5.17 Probe Inventory....................................................................41
5.18 Flexible Dashboard................................................................42
5.19 Results Collection..................................................................42

Core Concepts.............................................................................43
6.1
Group Concepts.....................................................................43
6.2
Correlation Concept...............................................................43
6.3
Synchronization Technique....................................................44
6.3.1 Synchronization at IPXPlorer Flex level...........................................45
6.3.2 Synchronization of IPXPlorer Flex at site level.................................45
6.3.3 Synchronization of QXManager and IPXPlorer Flex at network level46

IPXplorer Software Packages........................................................46

7.1
All-IP Package.......................................................................47
7.2
WEB Package........................................................................47
7.3
Email Package.......................................................................47
7.4
DNS Package.........................................................................47
7.5
AAA Package.........................................................................48
7.6
Sigtran Package....................................................................48
7.7
VoIP Package........................................................................48
7.8
IMS Package.........................................................................48
7.9
IPTV Package........................................................................49
7.10 VOD Package.........................................................................49
7.11 P2P Package.........................................................................49

1 Executive Summary
globeOSS Monitoring Solution is the truly the one-stop
service/customer oriented solution available in the industry. It

www.globeoss.com

addresses the need for legacy networks, current networks and

future networks. It is therefore critical to have the expertise
monitoring team with various domain backgrounds that covers
services across multiple protocols and network types (IP, ATM, SS7,
or legacy). This is what globeOSS can offer today. This will be
required in order to become truly customer centric as customers will
use voice, data and content services over IP networks.
Understanding the customer's experiences for all services over all
networks is key. We bring all this data together, turning it into
information and presenting it to the end user that enables the
Telecom Operators to make faster and better decisions in business
intelligence and troubleshooting for all services, for all networks,
and for all customers to give a single view of the truth, particularly
as it relates to customer experience.
The Next-Generation Passive Probes, we are providing is much more
cost effective than other probes in the market. So we are able to
cover monitoring of all 10GE links, in more cost effective manner. As
the total solution we offer covers 24 x 7 continuous monitoring of
the network.
The proposed solution also will be much lower TCO for PLDT, since
the solution does not require any fiber infrastructure and PLDT could
use the fibers for more revenue generating purposes than for just
monitoring purposes.
And the proposed solution is more easily scalable, as compare to
using a optical switch, since if PLDT decide to tap more than 12 links
to be monitored at the output or more than 72 links to be monitored
at the input, the cost of expansion will be much higher, as compare
to pure probe based expansion.

www.globeoss.com

Our unique value propositions are:

1. Monitor all the links 24 x 7, not just selected ones
2. Showcase Customer Experience
3. Scalability addition of probes and links to be
monitored can be done easily
4. Lower Total Cost of Ownership (TCO) more values can
be extended in long run
It is therefore critical that the data collection solution services
across multiple protocols and network types (IP, SS7, or legacy).
This is what globeOSS can offer today. This will be required in order
to become truly customer centric as customers will use voice, data
and content services over circuit switched and IP networks.
Understanding the customers experience for all ervices, over all
networks is key. We bring all this data together, turning it into
information and presenting it to the end user that enables the
Telecom Operators to make faster and better decisions in business
intelligence and troubleshooting for all services, for all networks,
and for all customers to give a single view of the truth, particularly
as it relates to customer experience.

1.1The Need For Real-Time

Convergence and the switch to IP networks will drive up the volume
of data that Telecom Operators produce. The time has come that
customer experience data be presented in near-real time (1 minute
or less). No longer is a 90 day cycle time for analysis and
subsequent retention action prudent. If a customer a major
customer gets a busy signal, or cannot download news information
to his new mobile handset, then the operators will want that
information fast, so that corrective action can be taken as quickly as

www.globeoss.com

possible. The increased data volumes and requirement for near real
time information availability will require a system that can collect
information from the network in real-time and presenting the data in
near real-time.
Moving into IP, the data rate is at gigabyte level. Traditional passive
probe providers doing processing at the software level is going to
make the solution extremely expensive and clunky. A new approach
is needed in terms of processing. The passive probe has to collect
and process the signaling data at the hardware level to achieve the
performance level required and therefore driving down the cost of
the solution significantly.

1.2Enhanced Correlated Intelligence

Using correlated signaling and user data as the source for OSS
network data provides a richer set of information than switched
data. Combining this OSS information from various networks
Packet Switch Core, Circuit Switch Core, NGN and IP Core Customer
Experience can be measured. At the same time, the troubleshooting
by customer is made possible across the networks. This enhanced
intelligence enables Telecom Operators to take a proactive approach
to customer assurance.
Providing proactive customer assurance using enhanced correlated
intelligence requires capturing KPIs, customer and service in a single
record! Often IPDR, xDR and CDR does not contain KPI data.
Most Telecom Operators uses mediated and or billed data for churn
prediction models and are in fact missing the negative elements of
the customer experience. This is because there are cases when an
attempted call doesnt even make it to the switch.
It is the ability to capture and analyze successful and unsuccessful
calls that provides the foundation for measuring customer
experience.
This paper will discuss sample OSS business uses that Telecom
Operators can use for convergent networks.

1.3Customer Centric Service Management

As operators moving towards modern IP infrastructure, troubleshooting becomes complex and theres a new need for a new
paradigm to trouble-shoot from customer perspective.

www.globeoss.com

The solution will provide the operator to perform new customer

centric management system.

www.globeoss.com

2 Business Benefits
The challenge by modern network operators to move from network
based management to customer centric management. The drive
towards customer centricity is no longer an option as the network is
getting more complex with many complex services. The challenges
are described in the diagram below and globeOSS Service
Assurance Solution addresses those needs.

The features of Customer Assurance will benefit a number of

functions in the operator organization.

Network quality department: Enables accurate monitoring of

the network and service quality that was actually delivered to
a customer or group of customers and provides the
information needed to bridge between the perceived quality
and the quality actually delivered.
Operations: Provides information on where to fine-tune the
network for an enhanced customer experience and enables
the focus of the departments efforts to be set according to
the corporate focus of the operator. Trouble-shooting by
customer can be done easily.

www.globeoss.com

Marketing & Sales: Adds context to existing network statistics

and customer satisfaction surveys correlating it with usage
statistics per customer, service and location. It provides
support to the process of building a brand experience and also
provides account managers with detailed reports on the actual
level of service provided to the accounts.
Customer Care: Allows Customer Care to be proactive in their
interaction with customers rather than re-active in waiting for
a customer complaint and enables the build-up of customer
profiles.
CxO level executives: Provides dashboard information on
major corporate service quality and service levels.

Below are some of the challenges of the various professionals within

service providers environment. The solution is able to address issues
across organization. For example, most operators has customer care
organization that receives complains from the subscribers. This
complains is logged in the CRM system. The challenge will be to
correlate the network statistics and performance to what is services
experienced by the subscribers. In most situation, theres a
disconnect between the CRM data and the network data.

www.globeoss.com

This is where we play the major role. By using the new affordable
passive probe technology, we are able to correlate the signaling
plane, user plane and transport plane in real-time. What this means
is that we can view the user experience and relate that to

the handset/devices
network parts end-to-end
location of the faults
services
network elements
protocols etc.

3 Solution Overview
The proposed solution is described as per the diagram below.

The passive probe solution is based on the Mutina Technology next

generation passive probe system IPXPlorer .
It is the breakthrough solution that combines the legacy needs and
future monitoring needs of service providers.

www.globeoss.com

IPXPlorer provides critical information on:

Detail records on control and user planes

Signaling and User Traffic Alarming
Links Status and Usage
KPI Generation and SLA Analysis
Service Assurance Reports with QOE approach
GRQ reports for Roaming on GRX and IPX networks
Quality of signaling, voice, video and images services scoring
Troubleshooting of packets & circuit based services

www.globeoss.com

10

At a glance, the IPXPlorer MIP-DMA1 supports the following:

Services and Communications Analyzer for Next Generation

and High Speed Networks
Combined IP Data with Telecom Services Analysis
Simultaneous coverage for Transport, Control and User Planes
Support for Gigabits Traffic Examination
Multiple LAN and WAN Interfaces in the same box
Application, Service and Session Detail Record (ASDR)
generation such as: IPDR, CDR, TDR..
Over 3500 KPIs such as Network and Application Response
Time, MOS/MDI for Voice/Video, Call Completion ratio, ASR and
ABR generation
Service Anomalies Finder System automatically finds and
shows unusual conditions
Protocols Trace, Decode and Filters
Stand Alone, Module and Probe Versions

Whats New?

First Information Communication Technology Service and

Protocols Analyzer and monitor probe
PCM, SDH, Giga Ethernet, and 10G Ethernet support in-a-box

1 MIP-DMA = Mutech IP Distributed Monitoring Architecture

www.globeoss.com

11

Specifically designed for the high performance for IP, NGN and
monitoring User Traffic in real-time
Full analysis and correlation of Control and User planes
Top down approach for Analysis and Problem Resolution
Next Generation IPDR: Evolution of Call Detail Record towards
Application and Service Detail Record ->ASDR
Intuitive and straight forward web-based and built-in GUIs
Cuts over 70% the weight, size, and the power consumption of
traditional Protocol Analyzers
Integration with Net-Flow and IP-Fix

The IPXPlorer applications covers all the legacy, current and future
networks.

www.globeoss.com

12

The real break-through in terms of technology is its ability to

correlate the user plane, control plane and transport plane in realtime. This provides the operator with the ability to monitor customer
centric service management with real troubleshooting capability.

www.globeoss.com

13

4 Sample Application Areas

IPXPlorer can be used in various networks and applications. Some
of the application areas will be as follows:

4.1IP Core
Telecommunication network is moving towards all IP network and
the solution provides an evolution path towards LTE and SAE.

4.2Fixed Broadband Network

www.globeoss.com

14

5 Detail Solution Description

Following are the two components of the IPXplorer :

IPXPlorer Flex as probes in the monitoring sites;

QXManager Centrex Viewer as the control system in the
central site of the network.

The IPXPlorer was designed by considering the following concepts:

Network. The IPXPlorer is designed to support IP-based data,

signaling, voice and video services over LAN and for Mobile IP
along with Legacy Technologies such as SS7.

Speed is key. Customers and Services require high speed

connections and fast response time to the network, solution
provider and operator.

www.globeoss.com

15

The hardware and software design allows IPXPlorer to

monitor, capture, filter, analyze, and search multiple gigabits
per second, while many of traditional SS7 and core network
systems were designed to work at mega bits per seconds
speed.
Future flexibilities. The communication process is complex and
both user and the operator visions are different. Network
Managers have to have a global end-to-end view to
understand how the users perceive and use the services.

The IPXPlorer provides a network wide vision for traffic,

usage, and activities divided by users, groups, locations, and
services that allow the Telecomm Operator to see and track
end to end communications.

Control is vital. Owning and running a network means

controlling it and the services and applications transported by
it. Knowing traffic volumes, usage profiles, capabilities,
bottlenecks and interactions between the different
technologies and vendors in the network is paramount.

IPXPlorer detects anomalies in the communication flows as

soon as the event happens. The capability to monitor and link
multiple events at different communication levels from
network, to transport, up to the application layer together with
a built-in smart system which allows IPXPlorer to show the
Network Manager only the unusual situations.

High Quality Results. A quality solution ensures satisfied

customers, lower costs in troubleshooting fewer disputes and
a cleaner image.

For a realistic and accurate quality of service evaluation it is

necessary to analyze and measure different parameters at
multiple monitoring points within a network. IPXPlorer
calculates quality of the signalling such as call completion
ratio, transport statistics such as response time and transfer
speed, disconnection reason such as premature interruptions.
All these results are combined in the Application Service
Details Record-ASDR which represents a new concept for call
detail records.

Simplicity is key. IPXPlorer is a simple concept and for the

user it is also easy to install, maintain and manage. The power
of IPXPlorer is in the probes that represent the latest
technology available today.

www.globeoss.com

16

Scalability and Flexibility. Network change and growth.

Solutions for network monitoring have to be flexible and easily
scalable.

IPXPlorer probes support multiple physical ports and

seamlessly work together in high-density port and
geographically distributed solutions. The centralised system is
based on industry standard IT hardware components.

Open Solution Framework. The integrated IPXPlorer data and

results are simple and open. IPXPlorer results are provided in
standard format such as Comma Separated Variable fields
(CSV) and PDF. PCAP format for data and all logs and alarms
are compatible with Syslog. Files are transferred via ftp and
databases can be connected directly by network drivers. The
software components run over Linux OS.

5.1How does IPXPlorer work?

IPXPlorer probes are deployed in the sites with (tapped or
spanned) monitoring points. These probes capture, filter, group,
analyze, and aggregate all the information and create individual
location results.
IPXPlorer probes are totally autonomous and can work without any
central system, providing details from that location. To ensure
maximum availability, configuration is carried out in the probe, so
that in the event of fault such as power loss or communication
problems with the centre, the probe continues to operation
autonomously, capturing and analysing the data and storing the
results in the built-in storage until the transfer to the Centex Viewer
is once again available.
The Operator can access the IPXPlorer probes directly by web and
retrieve results and analysis without the QXManager Centrex Viewer.
Packets and frames are stored inside the probes and recalled by
Centex Viewer when necessary.
To ensure accuracy of result, multiple IPXPlorer probes are
synchronized together to guarantee the same frequency, phase, and
absolute date and time.
QXManager is the Centrex Viewer of IPXPlorer and is deployed in a
central network site. QXManager provides a network wide view of

www.globeoss.com

17

the different services provided to Users by the Network and

monitored by the IPXPlorer probes.
The communication between QXManager and IPXPlorer probes are
based on TCP/IP standards including, FTP, Syslog service for logs,
http/https for web access, and RPC for real-time events.
QXManager is an IT server running the MuTech manager software to
collect results and details records from the remote IPXPlorer
appliances, storing that data to a central database, aggregating the
data together where necessary, and finally generating network wide
views trends and reports.
QXManager is also responsible for operator, authentication and
access management.
The dimensioning of QXManager server and storage depends on the
applications, network size, quantity of results and data, and duration
of raw information recording.

5.2The QXManager - QXM

QXManager is the Centrex Viewer of IPXPLORER . The origin of
Centrex name given to QXManager is from the telephony history.
Centrex concept was created at the beginning of 1960s by New York
Bell Telephone Company than became Bell Atlantic, to replace the
PBX of large customers with a centralised dedicated telephone
switching service. We are doing something similar with IP networks
that are replacing the switching capability of existing transmission
and signalling infrastructure with the packet switching concept.
QXM software described in this section. The current software version
of QXM supports:

Up to 10 IPXPlorer Flex appliances.

Up to 10 operators can access the system simultaneously.
SS7 & IP Packet Switching technologies.

The QXManager architecture is shown in the figure below.

www.globeoss.com

18

They key elements of QXManager architecture are the following:

1) Probe Manager:
This section is responsible for collecting the results from the
probes and making specific requests for real-time operations;
Operators may require alarms delivered or tracking of specific IP,
User, and mobile or fixed phone number. There are three ways to
collect information and results from probes:
o Statistics of Traffic and protocols counters becomes
available on the probes every 30 seconds; the
QXManager collects them by using an ftp connection.
o ASDR and the linked detail records counters become
available on the probes every minute; the QXManager
collects them by using an ftp connection.
o Services-Applications and QoS Analysis become
available on the probes every minute; the QXManager
collects them by using an ftp connection.
o For Alarms and Logs there are two cases:
Real-time alarms are dispatched from probes to
QXManager by either XML/RPC or Syslog type of
connection.

www.globeoss.com

19

Non real-time alarms and logs are sent by Syslog

type of connection or become available on the
probes every 30 seconds; the QXManager collects
them by using an ftp connection.

In all cases, specific, pre-configured alarms can be also

sent by email from any or all probes to specific
administrator email address.
2) Users and Sessions Manager:
This section is responsible of the Access Control List and
forwarding of the different results. The User accesses the
QXManager by browser through http or https connection.
The QXManager GUI, which runs over a standard web browser, is
based on Adobe Flex Technology. This technology allows multiple
windows, tabular, chart, real-time, and full graphical presentation
without having to install any application on the User PC.
QXManager manages the IPXPlorer Flex by sites. The User can
create geographical and logical maps of its network and move
from one site to another just with a click on the map as shown in
the next figure.
The type of results and reports available for the users of
QXManager depend on the rights set by the administrator of the
system in the ACL. The typologies of results available are:
a. Traffic, ASDR and QoS analysis. This group of analysis
contains different type of results such as:
i. Traffic: these are mainly statistics from layer 1
through layer 5 of the ISO-OSI protocol stacks. This
includes measurement interfaces counters, statistics
for link, network, and transport communication
activities per single user, host, device, site, service or
group.
ii. ASDR: all the service and application analysis are
generated based on Application Service Details
Record. The System User has the possibility to look
for a specific user, service, site; QoS score and obtain
the data from the QXManager. From the ASDR view,
the operator can decode the packets exchanged
during the selected application session. QXManager
will query for the packets the probes involved in the
communication and then present decodes to the
operator.

www.globeoss.com

20

iii. QoS: probes calculate QoS scores for audio and video
streams payloads (for telephony, videocommunication) and for signalling sections like call
completion, PDP context attach-detach, multicast
joining and releasing etc. The results of QoS are
stored in the ASDR. QXManager aggregates QoS
statistics for site, service, group, or specific end to
end communication and present the results to the
User.
iv. Trend: This group is similar to Traffic but based on
historical data that allows the operator to have a
view on how events, parameters, and traffic figures
have changed over a period as shown in the example
of the next figure.

v. Alarms: Probes send alarms in real-time or as log

report to the QXManager. The system forwards the
alarms to the different operators: if the operator is
currently connected to the QXManager, the alarm is
shown on the GUI running in the browser, otherwise it
is emailed.
vi. Selective real-time analysis: The operator may need
to look for specific events like a data or voice
connection, or a generic session between two
addresses (IP, phone numbers, email addresses etc.)
as they occur. In this case operator can set a search
filter that QXManager will forward to all the probes.
When a probe detects the requested event, it
delivers this information to the QXManager, which re-

www.globeoss.com

21

assembles all the information received from different

probes in a common network wide view.
3) Results Import and Export Section: This functional block allows
QXManager to export data and results to another system.
QXManager can also import data from outside sources. The
implementation is normally done on case by case to connect
external databases or standards-based communication such as
Syslog servers, ASCII CSV fields records transfer, ftp/ftps services
and direct databases socket connection.

5.3IPXPlorer Flex
IPXPlorer Flex is a rack mount solution for IP and
telecommunication centres. Its High Performance, Large Storage,
and Analysis capabilities make IPXPlorer Flex the perfect tool for
broad Network Monitoring; Data, Voice and Video Recording; End-toEnd Session Trace and Troubleshooting; and Quality of Service and
Quality of Experience measurements.

5.3.1 IPXPlorer Flex 4B Features

4U 19 rack mount
24 x LAN GE/SDH-SONET analysis ports
48 PCM ports
2 GE Management ports
8->48TB built in storage with high performance RAID system
24 Hot swappable disk bays
Fiber Channel for SAN

www.globeoss.com

22

Performances:
o 4.5 Gbps packet recording
o 2.0 Million packet/second analysis capability
o 15 Gbps data capture and hardware filtering capability
Up to 10 Simultaneous Web Clients
AC Redundant Power Supply (DC -48 optional)

5.3.2 IPXPlorer Flex 4A Features

4U 19 rack mount
2 x 10GE analysis ports
4 to 8 LAN GE/SDH-SONET analysis ports
2 GE Management ports
8->48TB built in storage with high performance RAID system
24 Hot swappable disk bays
Fiber Channel for SAN
Performances:
o 4.5 Gbps packet recording
o 2.5 Million packet/second analysis capability
o Over 20 Gbps data capture and hardware filtering
capability
Up to 10 Simultaneous Web Clients
AC Redundant Power Supply (DC -48 optional)

5.4IPXplorer Physical Interfaces

The IPXplorer interfaces includes:

www.globeoss.com

23

LAN Ethernet: from 2 to 24 FE/GE Optical and/or Electrical LAN

Ports
SONET/SDH: from 2 to 24 STM1/OC3 Optical and/or Electrical
Links. VC11/ VC12, ATM AAL5 support
Both LAN and SONET/SDH ports are SFP based
PCM: From 8 to 48 E1/T1/J1 ports for Low/High Speed Links
and B-ISDN SS7. All time slots (signaling links) are accessible
10GE: From 2 to 4 10G Ethernet ports SFP+ based

5.5IPXplorer Performances
IPXPlorer combines hardware and software to set new
performances records in the industry, such as:

Wire speed traffic capture and filtering.

From 600,000 to 1,5 Millions packets per second real-time
analysis. Analysis performance figures vary depending on
model.
For SS#7 LSL and HSL,1 Erlang per signaling link is supported.
Frame and packet off-load and filtering technology M-CEFTM
(patent pending) allows maximum network resources without
slowdowns or outages. The MuTech Cognition Engine Filters MCEFTM combine high speed dedicated flows tagging system,
signaling and payload pattern comparison hardware logic,
software algorithms for protocol events and programmable
recognition of specific data stream sequences.
Over 300 Mbps data recording on disk for IPXPlorer One and
Mod models, and over 2Gbps for IPXPlorer Flex.

www.globeoss.com

24

10GE ready

5.6Multiple Technologies
The IPXPlorer is a unique solution in the market that covers wide
range of technologies such as:

SS#7 MTP & Sigtran

NGN-VoIP-IMS
IuCS & Voice Core
Iub, IuPS, Gb and Packet Core
Gn/Gp-Gi
IPTV & VoD
Enterprise

The solution can be configured to meet the requirement of the

customer and the packages offered:

IP Data Packages: tcp/ip/udp, http, ftp, pop3, smtp, imap, p2p,

msn, dns, mms, wap, radius, diameter, pppoE
Multimedia IP Packages: IPTV, VoD, SIP, and H323
SS#7 Packages: SigTran, ISUP, BICC, Camel, MAP and INAP
Mobile PS Packages: IuPS, Gb, Gn/Gp, Gi
Mobile CS Packages: IuCS
Mobile Roaming Package: GRX and IPX with GRQ analysis
NGN and IMS Packages: SIP 3G, H248, MGCP, NCS, RTP/RTCP,
SIP-I
IP Core: MPLS
Telephony and Access: ISDN-PRI, DPNSS

www.globeoss.com

25

Features of Application Packages:

All packages:

ASDR generation
KPIs
Traffic analysis
Drill-down
Reporting
Protocol decode
ASDR to packets
Filtering for each field of ASDR and analysis
Detail Records Forwarding

Selected packages only:

Correlation with other application packages

Alarms
Logical Maps
Anomalies
DPI- Deep Packet Inspection
Capture Filters

5.7IPXPlorer Key Features

IPXPlorer comes with many features and among the key ones are:

Breakdown of traffic, QoS, problem causes, usage and activity

for every user
Correlation of communication events over multiple interfaces,
protocols/services and sites
Traffic analysis for all the meaningful elements such as user,
host, site, phone number, and addresses, URL, network etc.
ASDR includes network, transport (IPDR), signaling (CDR), the
services (SDR) and QoE information
Over 3500 KPIs for most important services and protocols
Real-time programmable alarms and anomalies
Trend Analysis for the most significant parameters such as
MOS, MDI, Call Attempts, ASR, ABR, PDP Context,
Location and Mobility Analysis for CS and PS traffic

www.globeoss.com

26

Built-in probe Management system with geographical map

representation.

www.globeoss.com

27

5.8Open Connectivity
The IPXPlorer is designed to be open to interact with other OSS /
BSS systems.
This includes:

Detail Record Export in CSV

Export system with field customization
SQM-CEM platform such as the IBM Tivoli
KPI in CSV format
Trend and statistics in PDF and CSV format
Alarm as xDRs or SNMP format
Logical and Symbolic Maps in CSV
Direct Access to external DB

www.globeoss.com

28

5.9ASDR: The new wave in Call Detail

Record Concept
Application Service Details Record-ASDR is an aggregation of the
procedures running at the different protocols layers for an
application or service.
ASDR concept is similar to the Call Details Record-CDR concept for
a call based service in Telephony or the IPDR in the data
environment, with the difference being that ASDR works for any
type of services: voice, data, or video based. In some ways ASDR
is the evolution of the CDR and IPDR concepts, merging and
extending them in a new concept.

ASDR
IPDR
TDR

CDR
limited to
Signaling
information and
call control in
telephony

mainly for
Control plane
information
such as
signaling for
roaming, sms,
mobility, and
intelligent
network
services

limited to the
UDP or TCP
session and
without any
reference to the
application or
service

Provides one record for

all Services and
Applications being
monitored
Automatic Link between
Transport, signaling,
payload, service, and
quality of service
Address QoS QoE
KPIs for Multimedia
oriented Services
Includes links to User
Traffic such as
conversation and video
streams information

MuTech has extended the Details Record fields by adding useful

information for diagnostic, troubleshooting, network planning, QoS
assessment etc.
IPXPlorer Flex probe generates an Application Service Details
Record (ASDR)for each end-to-end communication at application
level for the most significant services.
ASDR gives a complete report on the activities generated between
the two hosts at the application level by combining together the
necessary protocol handshake that happen at the protocol layers to
serve the application.

www.globeoss.com

29

ASDR is aggregation of all the important information related to a

session, a call, a service or an application running between two
hosts or users. ASDR links all the xDR generated from 2 through
layer 6 of ISO-OSI architecture. An ASDR also includes values for
traffic exchanged, bandwidth utilization, connection duration,
quality, and possible communication problems.
IPXPlorer probe also provides standard IP, Calls, and Transaction
Details Records (IPDR, CDR, and TDR) without aggregation in
ASDR, for backward export compatibility to existing systems.
An example of ASDR is represented by a complete VoIP session
that generates an ASDR combining the IPDR for TCP connection
between the hosts, the IPDR of SIP Agent registration to proxy, the
CDR of the SIP call, and the IPDR generated by the RTP connection
carrying the voice packets. Plus ASDR contains the information
about voice quality score (such as MOS the Mean Opinion Score),
the network and the application response time typical of IP sessions,
and the IP impairments that may cause degradation of the quality.
If the User needs to see the VoIP traffic in terms of quantity and
quality, it is enough to recall the VoIP ASDR and see the data as
call completion analysis, voice quality, traffic trend, and network
response time to get a complete picture of the service.
The alternative is manually combining, creating complex queries or
accessing multiple data sources from xDR, with statistics from
counters and QoS score from quality analyzers, and finally link and
correlate all of these results together. With IPXPlorer probe, all this
is not necessary and everything is done transparent to the User and
instantly.
Application Service Details Record-ASDR is a pending patent and
trademark of MuTech.

www.globeoss.com

30

5.10

Decode, Trace, and HEMS

IPXPlorer Flex has the ability to capture packets and frames and
elaborate them in sessions or transaction called xDR- Detail
Records. xDR are generated at different protocol levels which are
part of the same service transaction and are linked together into the
ASDR as explained in the previous section.
The ASDR has links to the different xDR (i.e. IPDR, CDR, TDR,
and/or SDR), so the User can zoom from a specific ASDR to the
xDR components and vice versa. The xDR has links to the packets
and frames stored in PCAP format in the IPXPlorer Flex. Therefore,
the User can drill-down from ASDR to xDR to frames and packets.
IPXPlorer Flex has also a built-in engine to decode packets and
frames. This engine is the Wireshark open-source that is derivate
from ethereal project. Because Wireshark does not support all the
protocols required by IPXPlorer Flex, MuTech has expanded and
completed the open-source project by fixing and adding the missing
and non working parts. When the User drills-down from ASDR or
xDR to packets, the protocol decode shown on screen is generated
with MuTech modified and supported Wireshark engine.

www.globeoss.com

31

With the decode engine, the User gets full decode with mnemonic
messages of all the main protocols fields, layers split presentation,
and hex-ASCII view.
IPXPlorer Flex has also a graphical engine called HEMS. It is able to
show the message flows between the hosts for each leg part of the
entire communication process. In this case, the User selects the
packets decode starting from ASDR, the entire end-to-end process
flow with packets/frames decode is shown.
This capability is available on the local and remote web-browser
based GUI. A sample of protocol decode with graphical message
flow on web GUI is shown in the previous figure.
The graphical presentation of message flow is also available at
QXManager level after the correlation process for a wide network
end-to-end communication process involving multiple IPXPlorer
Flex probes.

www.globeoss.com

32

5.11

Alarm Generation

IPXPlorer Flex has a specific engine to generate alarms based on

protocol or service conditions. A condition can be a simple event or
complex series of events detected in the communication process
being monitored. The condition triggers an alarm and when the
condition becomes true, action is executed by the alarm system.
The events considered for generating alarms are the result of
analysis or counting of the activities of IPXPlorer Flex.

www.globeoss.com

33

The main sources of the event that can be set to generate alarms
are the followings:

ASDR
xDR
Statistic Counters
Quality of Service Analysis
Call Completion Analysis.

An alarm is characterized by parameters such as:

Conditions and Parameters:

o Protocol Event: The event considered as trigger
condition.
o Severity: it determines the level of importance of the
alarm. In this way the alarm will be flagged with a
coloured Flag depending on the importance set. The
setting of severity will help in filtering and finding
specific alarms in the Alarm Detail Record Log and to set
the priority of event delivery to the QXManager Centrex
Viewer. The possible choices for the severity level are:
Emergency
Alert
Critical
Error

www.globeoss.com

34

 Warning
Notice
Informal
Debug
o Group: it allows the User to specify if the selected event
should be considered for all the traffic being monitored
or only the traffic related to a Group.
o Set Condition: it allows the User to set the number or
value, and the mathematical operator which an event
should match before the alarm conditions are met. This
does not necessarily mean that the alarm will be
generated, but indicates that the conditions have
become true. An alarm will be generated when these
conditions are satisfied and the conditions configured in
Set Mode are verified. The possible choices for the
mathematical operators for conditions are:
Greater Than (>)
Greater Than or Equal To (>=)
Less Than (<)
Less Than or Equal To (< =)
Equal To (=)
o Set Mode: a User can determine the frequency of an
event that would satisfy the conditions set in the
previous field (Set Condition) before the Instrument
generates a real alarm. This is how a User can set a
hysteresis cycle for an alarm. The Set Mode allows the
following choices:
Single Event: when enabled, the alarm will be
generated every time the alarm condition
becomes true.
Interval Time: this enables a period of time in
seconds over which the instrument evaluates the
events as set in the conditions. If it is the case
where the event is true (the event matches the
Set Condition described above), the instrument
calculates the percentage of true events against
the total number of the same events in the time
period (true and false events). If the percentage
of true events is equal to or greater than the value
set in the Threshold (%) field, the alarm will be
generated. This is a very sophisticated system
because it evaluates the true and false alarms
over a period of time to avoid false alarms, which
may be generated for transitional events.
Counts: when enabled, the alarm will be
generated when the number of true events

www.globeoss.com

35

(events that match the values set in Set

Condition) is equal to or greater than the
values set in this field.
Actions: here are the possible actions when
the conditions are satisfied:
o Send Email: it allows the generation of email if the alarm
becomes true. The lists of destinations are set during
the configuration phase.
o Deliver the alarm to the QXManager Centrex Viewer.
o Start / Stop PCAP Data recording on internal storage.

5.12

KPIs

The solutions come with more than 3500 KPIs out of the box,
including the following:
o IP impairments such as network response time, latency, jitter,
packet loss, duplication, and retransmission, fragmentation
level
o Generic Applications impairments such as application
response time, traffic figures per direction, retransmissions,
speed in uplink & downlink.
o Specific Service impairments and performance such as session
established, released and duration time, real User perceived
speed, QoS scoring, telephony type analysis (ASR, ABR, Call
attempts etc)
o Inter-Protocol and inter-Site correlation impairments such as
transit delay, message loss, overhead, efficiency, speed
bottlenecks, QoS effectiveness .
*Please refer to the KPI document for further detail.

www.globeoss.com

36

5.13

Result Aggregation

IPXPlorer aggregates analysis results in several ways, such as:

o Physical: site, port, VLAN,Q-in-Q, MPLS label, tunnel.
o Network/Transport: Server, Client, Hosts, and Pairs..
o Equipment address: IP, Point Code, SGSG, GGSN, HLR, SP,
SCP, HLR, Media Gateway, MGC, Call Agent, Proxy
o Signaling numbers: E164, IMSI, MSISDN, URL, email
o Terminal type and service
o Per programmable groups

www.globeoss.com

37

5.14

Trends and Statistics

IPXPlorer provides snapshot of analysis and trends in several

modes:
o TOP N: site, Server, Client, Hosts, Pairs, Users, calling, called,
MSISDN, Equipment type, conversations, ..
o KPIs: fastest and slowest elements, quickest responses time,
bandwidth, utilization, usage, sessions, tunnels, .
o QoS: MOS, MDI, Jitter, other IP & services impairments,..
o Time interval of trends are fully programmable

www.globeoss.com

38

5.15

Geographic Viewer Management

The IPXPlorer can also be managed geographically with the

geographic viewer management.
o QXManager manages logical and geographic maps
o Maps representations are for probes, circuits, IP, Signaling
Points, Area Codes, Service Areas, PLMNs
o Geographic maps are real time from Enterprise Google map
o Probes/Sites are identified by the geo coordinates
o Probes can be equipped with GPS option for auto-location

www.globeoss.com

39

5.16

Probe Management

QXManager manages all the probes connected to it.

Hardware status for CPU, monitor interfaces, memory, hard disks,
temperature, fans, batteries and power supplies
Software status for release and firmware versions, time
synchronizations, alarms log, and MTTF (Mean Time To Failure) MTTR
(Mean Time To Repair) reports
Inventory information and geo position of the probe

www.globeoss.com

40

5.17

Probe Inventory

QXManager allows the User to create and maintain an inventory of

probes, sites and configuration.
o
o
o
o
o
o

Inventory information includes:

Site address
geo position of the probe
Local operators and administrator
Equipment type and configuration
IP and email address

www.globeoss.com

41

5.18

Flexible Dashboard

The solution comes with flexible dashboard. Each user can save
their own environment for future use. It can also be easily
customizable.

5.19

Results Collection

Complete Analysis is
applications-services:

available

for

network,

transports

and

Statistics of Traffic and protocol counters are updated on the probes

every 30 seconds
Trend analysis based on historical data is programmable over any
period of time
ASDR on the probes are updated every minute
Services-Applications and QoS Analysis are updated on the probes
every minute
Real-time alarms and anomalies are directly dispatched from probes
to QXManager
Non real-time alarms, anomalies and logs are updated on the probes
every 30 seconds

www.globeoss.com

42

KPIs are generated on the basis of ASDR and Traffic counters

every minute

6 Core Concepts
6.1Group Concepts
One of the most interesting features of IPXPlorer Flex is the
capability to classify results in groups at the time of data acquisition
and analysis. In other words, the probes analyze the traffic in real
time and can divide the results of analysis in groups programmed by
the User.
Groups can be characterized by specific device or network
addresses, VLAN, point codes, services type, UDP or TCP ports and
many other elements. This grouping feature allows the User to get
results of specific traffic groups quickly without having to wait for
database query generation at a centralised level.
The results per-group as well as the global network results are
available locally at the probe level or at the centralised level.
In case of centralised system, MuTech provides the QXManager as
Centrex Viewer and Manager of IPXPlorer Flex probes.

6.2Correlation Concept
Correlation in the IPXPlorer Flex is the ability to link together
sessions, calls, transactions, pdp-context, or any signalling basedprocedures which belong to different protocols and running on
different type of physical interfaces, but are part of the same endto-end user communication.
For example, when a data connection is requested from a ADSL
Modem to retrieve emails from a remote POP3 server, this
connection goes through different network elements and are transcoded in different protocols (for example BRAS, Ip Interfaces and
then of generic IP connection with possible insertion of Gs in case of
automatic association for deciphering).
When IPXPlorer Flex is connected to the different network
elements monitoring points, it has the ability to monitor all the
messages belonging to the same call, in this result section a User
can see the actual end-to-end conversation between the two end
users linked together.
The correlation in IPXPlorer Flex architecture is always based on
xDR or better on ASDR. The intrinsic capability of ASDR to link
packets and frames, allows to the correlation engine to show the

www.globeoss.com

43

complete end-to-end process flow and the packet-frame flow as

well.
In the example mentioned of tracking a data connection from BRAS,
through Ip, then MPLS, and finally over Intranet-Internet connection,
each session detected over one of the monitoring point will
generate an xDR, specifically:
All these xDR will be linked in a single ASDR for every session the
User will activate. From the ASDR, IPXPlorer Flex extracts the
xDR part of the same communication process and from xDR it can
link the every packet or frame of the flow, including payload
carrying the user traffic (i.e. the POP3 taken for this example).
This xDR will be linked with the others of the same user by the
ASDR. Therefore, from ASDR the IPXPlorer Flex can link not
only the traffic exchanged during a sessions over multiple interfaces
being monitored, but also the logical links between the different
addresses existing in the system.
In case of geographic distribution of probes, there are two level of
correlation:
o Site level.
o Network level.
The correlation at site level is managed by the MT-OS running on
IPXPlorer Flex and all the data coming from different interfaces
and protocols that are part of the same flow can be correlated
together in an ASDR as explained previously.
In the correlation at network level there are two distinct phase:

The IPXPlorer Flex collects and generates local ASDR with

correlation when possible. Then QXManager Centrex Viewer
loads the ASDR in its database. Packets and frames remain
stored in the probe and are not delivered to the QXM. Packets
may be recalled by QXM on-demand for troubleshooting
analysis or drill-down functions.
The QXManager Centrex Viewer collects ASDR from multiple
probes, store ASDR in the database, then execute the
correlation between ASDR to create, when applicable, a
Network-Application Service Details Record or N-ASDR. The
N-ASDR is also stored in the internal database.

The operator at QXM level can recall on the console the correlation
at:

www.globeoss.com

44

IPXPlorer probes level. In this case correlation, trace, and

decode are performed by the probe, and the QXM works as
simple dispatcher, while the communication between console
and probe are peer-to-peer.
QXManager Centrex Viewer level. In this case QXM recalls the
N-ASDR from the internal database and divide in the original
ASDR, then inquires each probe for the packets. The packets
will be temporarily transferred from the IPXPlorer Flex to the
QXM, subsequently decoded, and displayed to the Users
console.

6.3Synchronization Technique
When more measurement interfaces or ports are involved in
monitoring multiple network points, synchronization and timing
become an important issue to guarantee that the entire protocols
event captured are stamped with the same clock and precision.
This situation is even more important when multiple sites are
involved in a distributed monitoring network.
There are two different situations involving synchronization:
o Ensure all the measurements ports sample the incoming
packets and frames with a common time ticks (or clock);
o Guarantee the same absolute time through all the probes.
MuTech has developed a specific technique in the MT-OS running on
IPXPlorer Flex to provide all the necessary level of timing and
synchronization. There are three level of action:
o At probe level;
o At site level;
o At system level.
6.3.1 Synchronization at IPXPlorer Flex level
Each IPXPlorer Flex has multiple measurement interfaces as
described in the section 1.3.1. All these interfaces are synchronized
to a common timing signal provided by a timing card built-in the
probe.
This timing card generates and distributes a common clock called
Synch bus and all the interfaces synchronize its time stamp clock to
this clock (Please refer to the Figure 7).
The timestamp resolution of IPXPlorer Flex is 10 nanoseconds. The
frequency or phase shifting between measurements interface is
avoided thanks to the master clock.

www.globeoss.com

45

The absolute time (year, month, day, hour, minute, second,

millisecond) is provided by the software of IPXPlorer Flex and it
can be synchronized with external Stratum 1 or 2 NTP servers.
IPXPlorer Flex can also be equipped with GPS optional device. In
this case, both the common clock and the absolute time are
supplied by the GPS. All the cards share these clocks through the
timing board.
6.3.2 Synchronization of IPXPlorer Flex at site level
In case of multiple IPXPlorer Flex installed in the same site, a
synchronization strategy per site allows multiple probes to share the
same clocks.
As described in the previous section an IPXPlorer Flex is set as
master probe and it generates a Synch Bus synchronized with the
GPS option installed to share with internal interfaces cards and the
other IPXPlorer Flex connected to it.
The other IPXPlorer Flex receives the synch bus from the master
unit and shares the signals to the internal interfaces cards.
This strategy guarantees that all the internal clocks of the
IPXPlorer Flex probes located in the same site have a 10
nanoseconds time stamp synchronized as far as frequency and
phase. The absolute date and time is also the same for all the
probes in the site.
In case of multiple probes per site, GPS option is required.

www.globeoss.com

46

6.3.3 Synchronization of QXManager and IPXPlorer Flex at

network level
MuTech has developed two different approaches to guarantee the
same absolute date and time to all the probes in the network.
The first approach is based on external Stratum 1 and 2 Public NTP
servers. Either QXManager or IPXPlorer Master Flex are configured
to require the current date and time from one or two close public
NTP servers and then set the internal clock of the devices to values
received. This strategy is simple and cheap but it recommended
especially when probes and QXManager are spread around the
globe. The main limitation is due the maximum precision of the time
is 10 ms in theory even if does not exceed 50 or 100 ms in the
reality.
The second approach requires GPS option installed on QXManager
and the IPXPlorer Master Flex. The QXManager is also a NTP server
with absolute date and time synchronized by GPS. IPXPlorer Flex
requests date and time update from QXM periodically to ensure the
same values everywhere. This approach gives the best precision
and it can be applied where the maximum distance between QXM
running as NTP server and most far probe is less than around 2000
Km.

7 IPXplorer Software Packages

IPXplorer has many packages to serve the needs of various service
providers. It is flexible and upgrades can be done on need basis.

7.1All-IP Package

Analysis Package for IPv4 and IPv6:

o UDP, TCP, ICMP, SCTP, RTP, and RTCP
Analysis based on well-known port definitions and Deep
Packet Inspection for special services such as Skype or chat
rooms
ASDR->IPDR generation
IP impairment measurement
Alarm on TCP error, bandwidth, and KPIs
Single host , host pair, port and service group results
IP Logical Mapping and Symbolic name assignment
Sources:
o Ethernet, STM1+ATM+AAL5, E1+HDLC+Eth-MAC, NetFlow/IP-Fix
Two stacks analysis capability:
o Physical + IP + tunnel + IP + Services

www.globeoss.com

47

7.2WEB Package

Analysis Package for http and ftp services

Analysis based on User programmable ports
ASDR for http session, http page, ftp control and data sessions
Analysis and KPIs on traffic, error, url, client-server, requestresponse handshake
Alarm on KPIs
Export the sessions in PCAP format
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.3Email Package

Analysis Package for smtp, pop3 and imap services

Analysis based on User programmable ports
ASDR for smtp, pop3, and imap sessions
Analysis and KPIs on traffic, error, username, message, mail
server, client/server
Alarm on KPIs
Export the sessions in PCAP format
Keywords Search function
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.4DNS Package

Analysis Package for dns and whois services

Analysis based on user programmable ports
ASDR
Analysis and KPIs on query, error, dns server, client-server
Alarm on KPIs
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.5AAA Package

Analysis Package for pppoe, radius, and diameter protocols

and services
Analysis based on User programmable ports
ASDR for pppoe, dhcp, radius, and diameter session
Correlation between pppoe, dhcp and radius
Analysis and KPIs for session, error, username, authentication
failure, server, user-server, command-response
Alarm on KPIs
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.6Sigtran Package

Analysis Package for SigTran:

www.globeoss.com

48

o M2UA, M2PA and M3UA (SCTP: IETF RFC 2960: Stream

Control Transmission Protocol, M2UA: RFC 3331
Signaling System 7 (SS7) Message Transfer Part 2
(MTP2)- User Adaptation Layer, M2PA: IETF RFC 4165:
SS7 MTP2-User Peer-to-Peer Adaptation Layer, M3UA:
IETF RFC 4666: SS7 MTP3-User Adaptation Layer)
ASDR generation for SCTP, M2PA, M2UA and MTP3
Error , Association, and Traffic analysis
Alarm on KPIs
IP, and Point Code, Logical Mapping and Symbolic name
assignment
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.7VoIP Package

Analysis Package for SIP, H.323, RTP, RTCP, SDP

ASDR->CDR for SIP, H.323 and RTP
Call and Registration Completion error cause analysis
Alarm on KPIs
Call Trace
Analysis for phone numbers and url, area and country code
Audio and Video quality analysis on RTP flows with MOS
(G.107) and MDI
Compatible with OLOs traffic package
IP, Point Codes, and Area Codes Logical Mapping and Symbolic
name assignment
Correlation with ISUP and MEGACO
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.8IMS Package

Analysis Package for IMS includes

o Diameter for Cx, Dh, Dx, Gq, Rf, Ro, and Sh Interfaces
o SIP-3G for Gm, ISC, Ma, Mg, Mi, Mj, Mk, Mr, and Mw
Interfaces
o H.248 for Mn and Mp Interfaces
o HTTP for Sr and Ut Interfaces
o MAP/SigTran for Si Interface
ASDR generation for H.248, SIP, RTP, MAP
Analysis for phone number, IMSI, MSISDN, area and country
codes
Alarm on KPIs
Audio and Video quality analysis on RTP flows with MOS
(G.107) and MDI
Compatible with OLOs traffic package

www.globeoss.com

49

IP, Point Code, area and country code Logical Mapping and
Symbolic name assignment
Correlation with ISUP
Sources: ALL-IP

7.9IPTV Package

Analysis Package for IPTV includes: Multicast (IGMP) and

Unicast, RTP, MPEG transport streams
Join/Leave functionality
ASDR generation by IGMP, MPEGTS, RTP
Analysis for TS, PID, User, Zapping, QoS by Program
ETR290 Results
Audio and Video quality analysis on RTP flows with MOS
(G.107) and MDI
IP Logical Mapping and Symbolic name assignment
Correlation IGMP->RTP->MPEGTS->Audio/Video Streams
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.10

Analysis Package for Video on Demand includes: HTTP, RTSP,

RTP, MPEG transport streams
ASDR generation for RTSP, MPEGTS, RTP
Analysis for client, url, server, program, duration QoS by
Program and User
Audio and Video quality analysis on RTP flows with MOS
(G.107) and MDI
IP Logical Mapping and Symbolic name assignment
Correlation HTTP->RTSP->RTP->MPEGTS->Audio/Video
Streams
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

7.11

VOD Package

P2P Package

Analysis Package for P2P services

Analysis based on Deep Packet Inspection DPI
Identification of BitTorrent, WinMx, eMule, Kazaa, Gnutella
ASDR for P2P
Analysis and KPIs on traffic, host, host pair
IP impairments
Alarms on KPIs
Sources: ALL-IP, Gn/Gp, IuPS, Gi, packages

www.globeoss.com

50