Proactive and intelligent packet capturing for a mobile packet core

One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to perform operations, comprising:

• storing information associated with a plurality of user equipment (UE) sessions of a plurality of UEs within a mobile network;
• detecting, by an anomaly detection application, an anomaly associated with at least one UE session of at least one UE based, at least in part, on the information stored for the at least one UE session;
• and
• activating a trace for the at least one UE session based, at least in part, on detecting the anomaly associated with the at least one UE session, wherein activating the trace comprises communicating a first trace activation notification to a first data-path network element of a plurality of data-path network elements from the anomaly detection application, communicating a second trace activation notification to a second data-path network element of the plurality of data-path network elements from the anomaly detection application, and capturing packet information for a data packet flow associated with the at least one UE session at the first data-path network element and the second data-path network element, wherein the anomaly detection application is external to the first data-path network element and the second data-path network element, the first data-path network element is a packet data network gateway (PGW), and the second data-path network element is a serving gateway (SGW).

A system comprising:

• at least one memory element for storing data;
• and
• at least one processor for executing instructions associated with the data, wherein executing the instructions causes the system to perform operations, comprising:
• storing information associated with a plurality of user equipment (UE) sessions of a plurality of UEs within a mobile network;
• detecting, by an anomaly detection application, an anomaly associated with at least one UE session of at least one UE based, at least in part, on the information stored for the at least one UE session;
• and
• activating a trace for the at least one UE session based, at least in part, on detecting the anomaly associated with the at least one UE session, wherein activating the trace comprises communicating a first trace activation notification to a first data-path network element of a plurality of data-path network elements from the anomaly detection application, communicating a second trace activation notification to a second data-path network element of the plurality of data-path network elements from the anomaly detection application, and capturing packet information for a data packet flow associated with the at least one UE session at the first data-path network element and the second data-path network element, wherein the anomaly detection application is external to the first data-path network element and the second data-path network element, the first data-path network element is a packet data network gateway (PGW), and the second data-path network element is a serving gateway (SGW).