Protocol Analyzer Software Stack - Cisco ASR 5000 series Product Overview

Enhanced Charging Service Overview
The Protocol Analyzer performs a stateful packet inspection of complex protocols, such as FTP, RTSP, and SIP, which
dynamically open ports for the data path, so the payload can be classified according to content.
The Protocol Analyzer is also capable of determining which layer 3 packets belong (either directly or indirectly) to a
trigger condition (for example, URL). In cases where the trigger condition cannot be uniquely defined at layers 3 and 4,
then the trigger condition must be defined at layer 7 (i.e., a specific URL must be matched).

Protocol Analyzer Software Stack

Every packet that enters the ECS subsystem must first go through the Protocol Analyzer software stack, which
comprises of individual protocol analyzers for each of the supported protocols.
Figure 178. ECS Protocol Analyzer Stack
L7+
L7
HTTP S-HTTP IM POP3 FTP SMTP RTSP
L4 TCP
L3
Note that protocol names are used to represent the individual protocol analyzers.
Each analyzer consists of fields and states that are compared to the protocol-fields and protocol-states in the incoming
packets to determine packet content.
OL-22938-02
Identification of true destination in the case of terminating proxies, where shallow packet inspection
would only reveal the destination IP address/port number of a terminating proxy
De-encapsulation of upper layer protocol headers, such as MMS-over-WTP, WSP-over-UDP, and IP-
over GPRS
Verification that traffic actually conforms to the protocol the layer 4 port number suggests
Protocol Analyzer Stack
MMS
WSP
WTP DNS TFTP RTP/RTCP SIP SDP
UDP
ICMP
IP
Bearer
Analyzer Fields and States
From, To, CC, BCC, Subject, Status,
Content-Location, Content-type ...
URI, PDUType, Status, Referer
Content-Lenght, Content-Type ...
URI, Content-Type, Content-Length ...
(HTTP analyzer)
PDUType, TID, RID, TotLen ...
(WTP analyzer)
SrcPort, DstPort, SeqNum, AckNum
...
(TCP analyzer)
SrcIP, DstIP, Proto, TotLen, Uplink ...
APN, ChargingID, Roaming,
IMSI, SubscriberType ...
Cisco ASR 5000 Series Product Overview ▄
How ECS Works ▀