# US 11,122,452 B2 · System and method for load balancing of network packets received from a MME with smart filtering > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,452 B2 - Document ID: US11122452B2 - Status: Granted - Kind: B2 - Application number: 16/849,470 - Filed: 2020-04-15 - Published: 2020-10-15 - Granted: 2021-09-14 - Earliest claimed: 2019-04-15 - Assignees: NetScout Systems, Inc. - Applicants: NetScout Systems, Inc - Inventors: Rajeev Nadkarni; Abhishek Saraswati; Anil K. Singhal; Bruce A. Kelley, Jr.; Narendra Byrapuram; John Peter Curtin; Tauras Liubinskas - Web page: https://patentgrep.com/patent/US11122452B2 ## CPC - H04W 24/08: Testing, {supervising or monitoring} using real traffic - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 43/028: by filtering - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/06: Generation of reports - H04L 43/065: related to network devices - H04L 43/12: Network monitoring probes - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04W 12/037: of the control plane, e.g. signalling traffic - H04W 12/75: Temporary identity - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria. KPI and other session related data is generated in a network probe associated with a subscriber session from the retained deciphered packet information. Subscriber session related data from each clustered network probe is then aggregated with at least one monitoring device operably coupled to the clustered probes such that a user of the monitoring device is provided with the perception that the monitoring device is coupled to a single probe. ## Claims ### Claim 1 A computer implemented method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of clustered Virtual Machines (VMs), comprising: receiving ciphered packets in a packet switching device from one or more MMEs; sending each of the received ciphered packets from the packet switching device to each of the plurality of clustered VMs; receiving, in each of the plurality of clustered VMs, the ciphered packets sent from the packet switching device; deciphering, in each of the plurality of clustered VMs, the received ciphered packets; extracting metadata from the deciphered packets in each of the plurality of clustered VMs; retaining deciphered packet information, based upon analysis of extracted metadata, at each individual respective VM of the plurality of clustered VMs wherein the retained packet information is associated with an individual subscriber assigned to a respective VM retaining the packet information; and discarding deciphered packet information at each individual respective VM of the plurality of clustered VMs wherein the discarded packet information is associated with one or more subscribers not assigned to a respective VM discarding the packet information. ### Claim 2 (depends on 1) The method as recited in claim 1, further including the steps: generating KPI data, in each of the plurality of VMs, associated with an individual subscriber assigned to a respective VM; and aggregating subscriber related data from the plurality of clustered VMs in at least one monitoring device operably coupled to the plurality of clustered VMs wherein a user of the at least one monitoring device is provided with the perception that the monitoring device is coupled to a single VM. ### Claim 3 (depends on 2) The method as recited in claim 2, wherein each of the plurality of clustered VMs is configured to generate multiple synthetic packets from a received synthetic packet wherein each of the multiple synthetic packets is associated with an individual subscriber whereby each of the plurality of VMs retains packet information associated with a certain subscriber as prescribed by the monitoring device and discards the remaining synthetic packets associated with other subscribers. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein the metadata consists of session information utilized by the plurality of VMs for parallel processing of packet sessions across multiple subscriber session threads. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the deciphering of packets in each of the plurality of VMs determines Temporary Identifiers (M-TMSI) assigned to an individual subscriber. ### Claim 6 (depends on 1) The method as recited in claim 1, further including detecting subscriber session transitions during MME handovers. ### Claim 7 (depends on 1) The method as recited in claim 1, further including detecting session transitions during inter-RAT handovers. ### Claim 8 (depends on 1) The method as recited in claim 1, wherein a plurality of monitoring devices are operably coupled to the plurality of clustered VMs. ### Claim 9 (depends on 2) The method as recited in claim 2, wherein the at least one monitor device is configured to perform on-demand analysis of subscriber packet information. ### Claim 10 (depends on 9) The method as recited in claim 9, wherein the at least one monitoring device includes aggregated subscriber information received from the plurality of clustered VMs such that subscriber data is aggregated from each of the plurality of clustered VMs. ### Claim 11 (depends on 10) The method as recited in claim 10, wherein the monitoring device is configured to aggregate Key Performance Indicator (KPI) data from each of the plurality of clustered VMs associated with one or more subscribers. ### Claim 12 (depends on 1) The method as recited in claim 1, wherein the at least one monitor device is configured to perform real-time analysis of subscriber packet information by querying and retrieving subscriber information from each of the plurality of clustered VMs relating to a user analysis request so as to retrieve subscriber data from an individual VM regarding a subscriber associated with the user analysis. ### Claim 13 (depends on 1) The method as recited in claim 1, wherein each VM is a network probe device. ### Claim 14 (depends on 13) The method as recited in claim 13, wherein each network probe device is an ISNG device configured to generate Adaptive Service Intelligence (ASI) data. ### Claim 15 (depends on 1) The method as recited in claim 1, wherein the MME includes at least one of S1-MME, S3, S10 and S6a feed interfaces. ### Claim 16 A computer system for monitoring one or more Mobility Management Entities (MMEs), comprising: a packet switching device coupled to one or more MMEs configured for receiving ciphered packets from the one or more MMEs; a plurality of clustered VMs coupled to the packet switching device, each of the plurality of clustered VMs configure to: receive ciphered packets sent from the packet switching device; decipher the received ciphered packets; extract metadata from the deciphered packets; selectively retain deciphered packet information, based upon analysis of extracted metadata, wherein the retained packet information is associated with an individual subscriber assigned to a respective VM retaining the packet information; and discard deciphered packet information wherein the discarded packet information is associated with one or more subscribers not assigned to a respective VM discarding the packet information. ### Claim 17 (depends on 16) The computer system as recited in claim 16, wherein KPI data is generated in each of the plurality of VMs relating to an individual subscriber assigned to VM generating the KPI data. ### Claim 18 (depends on 17) The computer system as recited in claim 17, further including at least one monitoring device operably coupled to the plurality of clustered VMs configured to aggregate subscriber related data from the plurality of clustered VMs wherein a user of the at least one monitoring device is provided with the perception that the monitoring device is coupled to a single VM. ### Claim 19 (depends on 18) The computer system as recited in claim 18, wherein each of the plurality of clustered VMs is configured to generate multiple synthetic packets from a received synthetic packet wherein each of the multiple synthetic packets is associated with an individual subscriber whereby each of the plurality of VMs retains packet information associated with a certain subscriber as prescribed by the monitoring device and discards the remaining synthetic packets associated with other subscribers. ### Claim 20 (depends on 18) The computer system as recited in claim 18, wherein the at least one monitoring device includes aggregated subscriber information received from the plurality of clustered VMs such that subscriber data is aggregated from each of the plurality of clustered VMs.