Cisco ASR 5000 Series User Manual

Enhanced Charging Service Overview
How ECS Works ▀
Cisco ASR 5000 Series Product Overview ▄
OL-22938-02
Identification of true destination in the case of terminating proxies, where shallow packet inspection
would only reveal the destination IP address/port number of a terminating proxy
De-encapsulation of upper layer protocol headers, such as MMS-over-WTP, WSP-over-UDP, and IP-
over GPRS
Verification that traffic actually conforms to the protocol the layer 4 port number suggests
The Protocol Analyzer performs a stateful packet inspection of complex protocols, such as FTP, RTSP, and SIP, which
dynamically open ports for the data path, so the payload can be classified according to content.
The Protocol Analyzer is also capable of determining which layer 3 packets belong (either directly or indirectly) to a
trigger condition (for example, URL). In cases where the trigger condition cannot be uniquely defined at layers 3 and 4,
then the trigger condition must be defined at layer 7 (i.e., a specific URL must be matched).
Protocol Analyzer Software Stack
Every packet that enters the ECS subsystem must first go through the Protocol Analyzer software stack, which
comprises of individual protocol analyzers for each of the supported protocols.
Figure 178. ECS Protocol Analyzer Stack
L3
IP
L4 TCP UDP
MMS
L7+
WSP
L7
WTP DNS TFTP RTP/RTCP SIP SDP
HTTP S-HTTP IM POP3 FTP SMTP RTSP
Bearer
From, To, CC, BCC, Subject, Status,
Content-Location, Content-type ...
URI, PDUType, Status, Referer
Content-Lenght, Content-Type ...
SrcIP, DstIP, Proto, TotLen, Uplink ...
Analyzer Fields and States
APN, ChargingID, Roaming,
IMSI, SubscriberType ...
Protocol Analyzer Stack
SrcPort, DstPort, SeqNum, AckNum
...
(TCP analyzer)
PDUType, TID, RID, TotLen ...
(WTP analyzer)
URI, Content-Type, Content-Length ...
(HTTP analyzer)
ICMP
Note that protocol names are used to represent the individual protocol analyzers.
Each analyzer consists of fields and states that are compared to the protocol-fields and protocol-states in the incoming
packets to determine packet content.

Cisco ASR 5000 Series Specifications

General

Brand	Cisco
Model	ASR 5000 Series
Category	Network Router
Language	English