What Are the Best Packet Inspection Tools for Global Telecom Scenarios?

Telecom networks offer unparalleled scale and complexity that very few other networks can match. Millions of simultaneous subscriber sessions, an incredibly wide range of device types, rapidly changing applications and increasingly complex security threats necessitate network visibility that the average monitoring tools cannot provide. Packet inspection has thus become a necessary component for global telecom providers, but not all inspection tools are designed to carrier-grade standards.

Unique Challenges of Global Telecom Networks

Global telecom networks have challenges that enterprise and data center networks are rarely confronted with. Scale alone is the difference; a top-tier provider could be dealing with hundreds of Gbps or Tbps across its backbone, while having millions of simultaneous flows requiring inspection. Geography adds complexity, as networks span numerous countries, varying regulatory standards, and differing infrastructure quality. Protocol diversity is another challenge ranging from legacy SS7 to current HTTP/3 and encrypted peer-to-peer traffic. Subscriber behavior changes from region to region, time zone to time zone, cultural habit to cultural habit, meaning that inspection tools must be dynamic enough to accommodate changing traffic patterns. Targeted security attacks are part of the threat; these may range from SMS phishing and SIM box fraud, to signaling based attacks that compromise the SS7 network. All these challenges must be addressed simultaneously by the chosen packet inspection tool for a global telecom, effectively ruling out many general-purpose solutions.

Core Requirements for Telecom-Grade Inspection Tools

There are several features that all telecom-grade packet inspection tools must have. Performance is number one; the tool must be capable of inspecting traffic at line rate without impacting subscriber experience or adding milliseconds of latency. Packet loss or the introduction of delay is completely unacceptable for voice and video services. Reliability is equally critical. Telecom providers typically require a high grade of reliability-99.999%. Reliability demands include: hitless failover between active and standby components, state synchronization so that traffic is not interrupted during failover, and support for redundant hardware and power. Scalability demands both performance scaling, so that a system deployed today can easily be scaled to 400 Gbit/s in the future, and feature scaling. New protocol decoders must be easily deployable via software. Regulatory Compliance is yet another requirement for the inspector. Many countries have specific laws governing lawful intercept, retention of data, reporting standards, etc. The inspection tool must be able to comply with a large range of these standards.

Operational Requirements: A telecom network is an extremely complex environment, meaning that any additional complexity added by an inspection tool must be handled as efficiently as possible. Operational requirements focus on the management and operation of the inspection tools; this may involve monitoring through an existing OSS (Operational Support System) or an SIEM (Security Information and Event Management).

Key Features of Trusted Packet Inspection Solutions

Trusted packet inspection tools for telecom offer the following features: over 3,500 application-layer protocols and sub-categorie, as well as encrypted traffic analysis through behavioral fingerprints when decryption is not possible. They support reassembly of complete transactions across several packets to support malicious sample restoration, file reconstruction, and deep metadata extraction for security auditing and compliance. Extraction of metadata on a per flow basis. This metadata will include application identifier, volume of data transmitted, time in transmission and protocol specific fields like DNS names and HTTP URLs. Signature Management should be instantly updateable without downtime, providing the ability to track newly launched applications or new malware signatures within hours instead of weeks or months. Availability features for inspection tools include stateful failover that synchronizes traffic between active and standby inspection boxes, thus ensuring that no packets are lost when a switch occurs. Management Interfaces. Many operators need both real-time viewing capability through live Dashboards and the ability to dump logs to be used in a Data Warehouse or by SIEMs.

Adaptable Tools for Multi-Regional Deployment

Global telecom providers need to deploy packet inspection tools that are adaptable to regional requirements without the need for separate products or SKUs. Adaptability comes in two key forms: support for different languages, of course, but also deeper regional awareness, such as the ability to recognize region-specific applications and comply with local regulations. European providers for example need to track specific, European developed applications, whereas operators in Asia need to monitor specific Asian applications (e.g. WeChat or Line) if they are in high use locally. The second level of adaptability is the regulatory and technical requirement; can the inspection tool meet a specific country's lawful intercept requirements? Can it work in both centrally managed and distributed inspection modes to meet the demands of diverse infrastructures and local privacy laws?

Balance Performance, Cost and Usability

Telecom providers are caught in a squeeze between meeting performance and budget targets and ensuring a good quality of experience for the end user. A truly powerful inspection tool that is so complex that it requires dedicated specialists to manage will drive up costs through additional personnel. On the other hand, a cheap inspection tool might seem like a bargain-until it inspects only a portion of traffic at slow speed, forcing you to purchase more equipment than you would otherwise be necessary. The sweet spot here is an inspection tool that can scale linearly on both performance and cost, and requires minimal training to use fully. Metrics like cost per Gigabyte need to be taken into account, considering hardware, software licenses, maintenance fees, as well as cost of power, cooling, and floor space. Usability is not so much about the basic functionality of inspecting traffic, but rather about the ease of managing, configuring, and generating reports.

Stable Inspection Tools for Long-Term Operation

A telecom network is an extremely long term investment, sometimes planned over decades. Therefore, a packet inspection tool needs to be very stable. By “stable” we mean that after initial deployment and configuration it requires minimal troubleshooting and rebooting. It means consistent behavior across software releases. Reliable hardware with a reasonable lifecycle, and sustainable support. The tool must also not introduce backward compatibility issues. An older configuration file must work with a new software release and vice versa. Features must have a documented life span. And crucially, all new signatures or applications must be backwards compatible.

Tailored Solutions for Global Telecom Needs

Sino-Telecom provides packet inspection solutions that are specifically designed to meet global telecom providers' needs. Our solutions feature advanced control-plane and user-plane correlation (including GTP-U and 5GC N1-N40 interfaces), hardware-accelerated NAS message decryption, and dynamic user ID backfilling (SUPI/PEI). Our 1U mobile DPI appliances process up to 120 Gbps of 5G traffic, while our fixed network platforms scale up to an industry-leading 1200 Gbps per system with native support for 400GE ports, with robust carrier-grade reliability including redundant power, hot swappable hardware, and hitless failover between active and standby units. Our DPIs decode thousands of applications with support for signatures that are unique to Asian, Latin American, European and African networks. The metadata export features support for IETF IPFIX and flow specifications like NetFlow, as well as providing REST APIs for integration into existing OSS and SIEM solutions. Our DPI solutions can be deployed in appliance, virtual machine or containerized formats.

Conclusion

Choosing packet inspection solutions for global telecom is complex. Unique challenges posed by a global network require equally unique solutions. There is an overwhelming number of important features to consider for any truly robust and usable telecom-grade packet inspection solution. Balancing cost and performance in a usable solution is key. Stability is crucial to ensure long-term operation and low total cost of ownership. For more information please do not hesitate to contact Sino-Telecom.