LTE:

A feature based introduction

LTE Core Features

Annex. GTP Primer

Irfan Ali

Video at youtube:
https://www.youtube.com/watch?v=FPfExr9bEEg&list=PLgQvzs
PaZX_bimBc5Wu4m6-cVD4bZDav9&index=9

İki Teknoloji 1
What is GTP?

• GTP = GPRS Tunneling Protocol

• What is Tunneling in the IP World?

Ø Tunneling in the IP world means putting an IP packet inside
another IP packet.

IP_src -> IP_a->

IP_dst IP_b Payload

Inner IP Packet

Outer IP Packet

GPRS General Packet Radio Service

İki Teknoloji
Irfan Ali 2 2
What is the purpose of GTP Tunneling?

• Route an IP packet along a path that is not topologically correct for

the packet.

Mehmet’s IP address
46.1.78.189 -> GTP is
10.40.40.12 Internet IP-in-UDP Tunneling
10.10.10.1 P-GW Ayse
DHCP
10.10.10.0/24 IP_a ->
Hi
IP_m
10.10.10.2

UDP_
S-GW IP_pgw -> IP_a ->
dst= TEID_k Hi
IP_sgw 2152 IP_m
10.10.20.1
GTP Tunnel

IP UDP GTP-U
header
10.10.20.0/24
UDP_
IP_sgw -> IP_a ->
dst= TEID_x Hi
IP_enb 2152 IP_m
10.10.20.2

eNB
IP_a ->
Hi
IP_m

Mehmet
Mehmet’s IP address
10.40.40.12

İki Teknoloji
Irfan Ali 3 3
How does the GTP-U Tunnel get setup?

• GTP Protocol has two parts

Ø Signaling part called GTP-C (GTP-Control)
Ø User data part called GTP-U (GTP-User)
• GTP-C is used to setup GTP-U tunnel
• Both GTP-C and GTP-U run on top of UDP
• IP-in-UDP tunneling is only used for GTP-U
• GTP-C carries control/signaling messages

UDP_ UDP_
IP_pgw -> IP_a -> IP_pgw ->
IP_sgw
dst= TEID_a
IP_m IP_sgw
dst= TEID_k GTP-C message
2152 2123

IP UDP GTP-U GTP-C

header IP UDP
header

İki Teknoloji
Irfan Ali 4 4
 How does GTP-U Tunnel get setup: Example

SGW PGW SGW PGW

C.S. Req (IMSIa, C: IPc,sgw ,TEIDas,
EBID5:IPu,sgw ,TEIDas) C.S. Rsp (C:IPu,pgw ,TEIDap,
EBID5:IPu,pgw, TEIDxp)
0

TEIDas TEIDas TEIDap

2123 2123 2123 2123

TEIDbs TEIDbs TEIDbp

TEIDcs Rx Tx Tx Rx TEIDcs
Rx Tx Tx Rx TEIDcp
IPc,sgw IPc,pgw
TEID IPc,sgw IPc,pgw
TEID TEID TEID

2152 2152 2152 2152

TEIDas TEIDap

TEIDbs
TEIDbp

TEIDcs
Tx TEIDcp
Rx Tx Rx Rx Tx Tx Rx
IPu,sgw IPu,pgw IPu,sgw IPu,pgw
TEID TEID
TEID TEID

İki Teknoloji
Irfan Ali 5 5
Packet Trace: Create Session Request (S11); MME->SGW

SGW/
MME S11 PGW

0x1
2123 2123

SGW/
eNB S1U PGW

2152 2152

İki Teknoloji
Irfan Ali 6 6
Packet Trace: Create Session Response (S11); SGW -> MME

SGW/
MME S11 PGW

0x80..01
0x1
2123 2123

SGW/
eNB S1U PGW

0xc0..1
2152 2152

İki Teknoloji
Irfan Ali 7 7
Packet Trace: Modify Bearer Request (S11); MME ->SGW

SGW/
MME S11 PGW
0x800..001

0x80..01
0x1
2123 2123

SGW/
eNB S1U PGW

0xc0..1
0x3ea 2152 2152

İki Teknoloji
Irfan Ali 8 8
Packet Trace: GTP-U: S1-U; eNB -> SGW/PGW

SGW/
UE eNB PGW Server
S1U
10.255.1.111 10.1.2.11 10.1.1.12 10.0.0.100

0x010000
2152 2152
Rx Tx
Tx Rx

İki Teknoloji
Irfan Ali 9 9
Packet Trace GTP-U: S1-U; eNB <- SGW/PGW

SGW/
UE eNB PGW Server
S1U
10.255.1.111 10.1.2.11 10.1.1.12 10.0.0.100

0x010000 2152 2152

Rx Tx

İki Teknoloji
Irfan Ali 10 10
GTP Path and Path Management

SGW PGW
• Path is between two endpoints. Each end
Path point is IP_address+UDP_Port#
TEIDas
• There can be several GTP tunnels on a
TEIDbs
2123 2123 path (each with different TEIDs).
TEIDcs
IPc,pgw
• There is typically a “software process” that
IPc,sgw
binds to each end-point.
TEIDxs
2152
Path
2152
• Path Management messages: To ensure
TEIDys
that a path is alive (both the physical link
TEIDzs
and process at the endpoint), periodic
Rx
IPu,sgw
Tx Tx Rx
IPu,pgw
echo-request and echo-response are sent.
TEID
TEID • Failure-detection and error-recovery
mechanisms are defined.

İki Teknoloji
Irfan Ali 11 11
Packet Traces: GTP-U Echo-request & Echo Response

In GTP-Cv2 Echo
request/response messages
do not contain TEID field

In GTP-Cv2 Echo
request/response messages
do not contain TEID field

İki Teknoloji
Irfan Ali 12 12
Interfaces on which GTP is used
Internet
UE’s IP address

• GTP-Cv2 is used not only for

HSS
P-GW mobility management, but
GTP C also for general signaling
S6a
purposes, eg providing UE’s
S5
GTP C
cell information to the PGW
S-GW
S11 and from there to operator’s
service network.
MME
S10
S1-U
MME

S1-MME

S1AP

eNB

İki Teknoloji
Irfan Ali 13 13
Specifications

• GTPC v2 TS 29.274
• GTPU v1 TS 29.281

• GTPC v1 TS 29.060

• Historically (before Rel-8, i.e. before 2009Q1), TS 29.060 used to be

the key GTP specification (both GTPC v1 and GTPU v1). But since
Rel-8, TS 29.060 is only applicable to 3G interfaces (Gn/Gp,
between SGSN <-> GGSN and between SGSNs) and not to EPC
interfaces. Its specification only applies to GTPC v1
Ø Ignore anything that 29.060 says about GTPU.

İki Teknoloji
Irfan Ali 14 14
 Annex

İki Teknoloji 15
Rules for GTP-C IP address and port numbers
• Three types of messages GTP-C GTP-C
Peer A Peer B
Initial Message

Triggered Message

Triggered Reply Message

• Rules for Port# and IP addresses
Ø Initial Message:
1. The UDP Destination Port number for GTPv2 Initial messages shall be 2123
2. The UDP Source Port for a GTPv2 Initial message is a locally allocated port number.
3. During the establishment of the GTP tunnel, the GTPv2 entity selects and communicates to the peer GTPv2 entity the IP Destination Address at
which it expects to receive subsequent control plane Initial messages related to that GTP tunnel via the "Sender F-TEID for Control Plane" IE
Ø Triggered message
1. The IP Source Address of a GTPv2 Triggered message and for a Triggered Reply message shall be copied from the IP destination address of the
message to which this GTPv2 entity is replying
2. The IP Destination Address of a GTPv2 Triggered message and for a Triggered Reply message shall be copied from the IP Source Address of the
message to which this GTPv2 entity is replying
3. The UDP Source Port of a GTPv2 Triggered message shall be the value from the UDP Destination Port of the corresponding message to which
this GTPv2 entity is replying
4. The UDP Destination Port value of a GTPv2 Triggered message shall be the value of the UDP Source Port of the corresponding message to which
this GTPv2 entity is replying
Ø Triggered Reply message
1. Same rules as triggered message.
• Rules for TEID#
Ø The first Create Session Request message on S11 for a UE shall have TEID = 0x0
Ø The (first and subsequent) Create Session Request message on S5 for a UE shall have TEID = 0x0

İki Teknoloji
Irfan Ali 16 16