A Commsquare Case Study

“GPRS and UMTS corporate user

traffic analysis”

Commsquare December 2005

GPRS and UMTS corporate user traffic analysis
Mobile data security checks

The problem
Corporate users connect from a few ‘tens’ to a few ‘thousands’ of mobile devices over GPRS or UMTS to their
application server or internal network.

Often each individual mobile device is charged for the amount of bytes sent and received, and/or for the number of PDP
contexts created. The total data volume and/or the number of PDP contexts is sometimes surprisingly high for the
customer, and accordingly also the final bill. Therefore the customer wants to understand why the traffic volume is so
high and what they can do about it.

Sometimes mobile network operators charge a fixed amount for each mobile device. To calculate the internal cost of
delivering the data, the network operator needs to know the actual data volume based on measurements in the life
network. This is of interest in particular when the mobile devices are allowed to roam in foreign networks.

Security on the client devices in mobile networks has become a major challenge. A detailed traffic analysis will reveal the
weak points in your security system and help define effective countermeasures to minimise exposure to unwanted traffic.

The detailed analysis of user traffic requires huge amounts of data to achieve statistical relevance. Both the mobile
network provider and the customer are usually limited in statistically analyzing the traffic of big user groups.

Possibly, the customer will capture and analyze the traffic of a (small) set of mobile units in the field, but this often
requires a lot of configuration work and manual analysis. Also, it is possible to take traces on the application servers, but
this approach will fail to capture all traffic from and to the mobile units.

Commsquare’s solution
Commsquare has developed data capturing and analysis capabilities to analyse huge volumes of user data in a statistically
valid way. For a long period of time (typically several days or even a week) data will be captured for a large number of or
even for all mobile devices of a particular customer. The amount of data captured and analysed often exceeds 100GB.

All Commsquare needs is access to the Gn and Gp interface of the mobile network provider. A full Gn and Gp analysis
has the advantage that every data packet can be linked to a specific user.

Commsquare brings its own data capturing equipment for the Gn/Gp interface. The captured data files are then analysed
with Commsquare’s proprietary analysis software, which is specifically designed for fast analysis of huge amounts of
data.

This approach allows the statistical analysis of all traffic from and to the mobile devices of a particular customer; the
Gn/Gp traces also allow the in-depth analysis of individual mobile devices of the same customer.
For certain types of problems Commsquare will complement this approach with tracing on selected mobile units in the
field. Our post-processing software will then correlate the traces on these individual units with the trace information
captured on Gn/Gp-interface.

Results

Commsquare’s traffic analysis breaks down the traffic from and to the customer’s mobile units into various categories:
expected traffic, unexpected traffic and unwanted traffic for instance.

A further detailed breakdown of the traffic gives the customer a clear view of which part of the traffic is essential for the
application, which part can be optimised (less traffic) and which part can be avoided (no traffic wanted). The processes
that cause unexpected and unwanted traffic will be investigated with a view to define corrective measures.

A high level result is shown below; in a real case, each branch is further detailed and investigated.
Conclusion

• Commsquare can perform an in-depth traffic analysis of huge user groups.

• Commsquare has developed software to analyse big amounts of Gn/Gp and Gi data.
• The traffic of all users of a corporate account can be analysed.
• Commsquare gives recommendations on how to optimize the traffic to reduce the data volume.
• The approach can be used to identify weaknesses in the security system of mobile clients.