Protocol Testing for the Changing Network

As networks evolve and new challenges arise, protocol analysis plays a bigger role in keeping a network running efficiently.

Offering more capacity and data services than ever before, CDMA networks are making the transition to next-generation systems. With the deployment of technologies like CDMA2000, mobile wireless communications are moving into the packet-switched domain, adding a host of new services and network complexities in the process.

The transition to 3G networks, still underway, began with a profusion of proposed standards. Some were designed to build on GSM infrastructures, and others emerged directly from CDMA technology.

Ultimately, the ITU took a position on the matter, defining an IMT-2000 standard that encompassed five radio interfaces including CDMA2000. All of the IMT-2000 protocols use spread-spectrum techniques, which have implications about network installation, operation, and maintenance.

The ITU defines a 3G network as one that delivers, among other capabilities, improved system capacity and spectrum efficiency vs. 2G systems. It supports data services at transmission rates of at least 144 kb/s in mobile (moving) environments and at least 2 Mb/s in fixed (indoor) environments. The CDMA2000 architecture meets these objectives and includes several selectable implementations to best serve a transition strategy based on competitive concerns, existing infrastructures, cost, and other variables.

Among these implementations are CDMA2000 1X and CDMA2000 1xEV.

CDMA2000 1X doubles the voice capacity of cdmaOne networks, delivering peak data rates of 307 kb/s per subscriber in a mobile environment.
CDMA2000 1xEV includes two variants, both backward compatible with CDMA2000 1X and cdmaOne technologies.

CDMA2000 1xEV-DO (data only) can supply data multimedia services such as MP3 transfers and video conferencing at peak data rates of 2.4 Mb/s per subscriber in a mobile environment. CDMA2000 1xEV-DV (data and voice) delivers integrated voice and simultaneous data multimedia services at peak data rates of 3.09 Mb/s per subscriber.

Network Structure for Packetized Communications
Figure 1 illustrates a simplified CDMA2000 1X network, showing both telephony (ANSI-41) and data structures.

Figure 1. Structure of a CDMA Network

Mobile Stations
In a CDMA2000 1X network, the MS, the subscriberï¿½s handset, functions as a mobile IP client. It interacts with the access network to obtain appropriate radio resources for the exchange of packets and keeps track of the status of radio resources such as active, standby, and dormant. The MS also accepts buffer packets from the mobile host when radio resources are not in place or insufficient to support the flow to the network.

Upon power-up, the MS automatically registers with the HLR to authenticate the mobile for the environment of the accessed network, provide the HLR with the mobileï¿½s current location, and supply the MSC-S with the mobileï¿½s permitted feature set.

After successfully registering with the HLR, the mobile is ready to place voice and data calls. These may be either CSD or PSD depending on the mobileï¿½s own compliance (or lack thereof) with the IS-2000 standard. This document defines protocols for several critical CDMA interfaces pertaining to packet transmission, specifically A1, A7, A9, and A11.

MSs must comply with IS-2000 standards to initiate a packet data session using the 1xRTT network, a network that provides a 1x chip rate of 1.2288 Mc/s for Radio Transmission Technology. MSs having only IS-95 capabilities are limited to CSD while IS-2000 terminals can select either the PSD or CSD. Parameters forwarded by the terminal over the AL to the network will determine the type of service requested.

CSD has a maximum rate of 19.2 kb/s and is delivered over traditional TDM circuits. This service allows users to select the point of attachment into a data network using ordinary dialled digits.

The PSD service has a maximum data rate of 144 kb/s. For each data session, a PPP session is created between the MS and the PDSN. The IP address assignment for each mobile can be provided by either the PDSN or a DHCP server via an HA.

Radio Access Network
The RAN is the mobile subscriberï¿½s entry point for communicating either data or voice content. It has a number of responsibilities that impact the networkï¿½s delivery of packet services. The RAN must map the mobile client identifier reference to a unique link-layer identifier used to communicate with the PDSN, validate the mobile station for access service, and maintain the established transmission links.

The BTS controls the activities of the AL and acts as the interface between the network and the mobile. RF resources such as frequency assignments, sector separation, and transmit power control are managed at the BTS.

The BTS also manages the back-haul from the cell site to the BSC to minimize delays between these two elements. Normally, a BTS connects to the BSC through unchannelized T1 facilities or direct cables in co-located equipment. The protocols used within this facility are proprietary and based on HDLC.

The BSC routes voice and CSD messages between the cell sites and the MSC. It also bears responsibility for mobility management: it controls and directs handoffs from one cell site to another as needed. It also connects to each MTX using channelized T1 lines for voice- and circuit-switched data and to unchannelized T1 lines for signalling and control messages to the PDSN using the 10Base-T Ethernet protocol.

The PCF routes IP packet data between the MS within the cell sites and the PDSN. During packet data sessions, it will assign available supplemental channels as needed to comply with the services requested by the mobile and paid for by the subscribers.

The PCF maintains a reachable state between the RAN and the MS, ensuring a consistent link for packets; buffers packets arriving from the PDSN when radio resources are not in place or insufficient to support the flow from the PDSN; and relays packets between the MS and the PDSN.

The Core Networkï¿½s Role
PDSN/Foreign Agent
The PDSN/FA is the gateway from the RAN into the public and/or private packet networks. In a simple IP network, the PDSN acts as a stand-alone NAS; in a mobile IP network, it can be configured as an HA or an FA.

AAA Server
The AAA server is used to authenticate and authorize users for network access and store subscriber usage statistics for billing and invoicing.

Home Agent
The HA supports seamless data roaming into other networks that support 1xRTT. It provides an anchor IP address for the mobile and forwards any mobile-bound traffic to the appropriate network for delivery to the handset. It also maintains user registration, redirects packets to the PDSN, and optionally tunnels securely to the PDSN. Lastly, the HA supports dynamic assignment of users from the AAA and optionally assigns dynamic home addresses.

Detecting and Solving Common Problems
All of the features and capacities embodied in the 3G mobile network make for a complex system with many modes, nodes, elements, interfaces, and protocols. Problems, when they arise, may have their origins in either hardware or software. As mobile Internet connectivity becomes common, the challenge of maintaining uninterrupted data transactions will require new, more powerful monitoring solutions and procedures.

Mobile-Initiated Packet Data Call Setup and IP Registration
To obtain packet data services, the mobile performs registration with the serving wireless network on the A1 interface and then with the packet network on the A10/A11 interface. The mobile sends an origination message to the BS that includes the packet data service option. This results in assignment of the traffic channel, establishment of the A10 connection and the link layer (PPP), and for the case where mobile IP is used by the terminal, mobile IP registration with the serving packet network.

User data traffic now can be passed over the A10 connection encapsulated within GRE frames. The PCF periodically reregisters with the selected PDSN by sending the A11-Registration Request message before the A10 connection lifetime expires.

Figure 2. Setting Up a CDMA2000 1X Mobile Data Call

A successful call-setup scenario is illustrated in Figure 2. This standard message sequence chart outlines a series of 12 steps. This explanation bypasses the radio reception/transmission activities of the BTS, concentrating instead on the protocol functions that begin with the origination dialog between the mobile and the BSC.

To register for packet data services, the mobile sends an origination message over the access channel to the BSS.
The BS acknowledges the receipt of the origination message, returning a BS Ack order to the mobile.
The BS constructs a CM service request message and sends the message to the MSC.
The MSC sends an assignment request message to the BSS requesting assignment of radio resources. No terrestrial circuit between the MSC and the BS is assigned to the packet data call.
The BS and the mobile perform radio resource setup procedures. The PCF recognizes that no A10 connection associated with this mobile is available and selects a PDSN for this data call.
The PCF sends an A11-Registration Request message to the selected PDSN.
The A11-Registration Request is validated, and the PDSN accepts the connection by returning an A11-Registration Reply message. Both the PDSN and the PCF create a binding record for the A10 connection.
After the radio link and A10 connection are set up, the BS sends an assignment-complete message to the MSC.
The mobile and the PDSN establish the link-layer (PPP) connection and then perform the MIP registration procedures over the link-layer (PPP) connection.
After completion of MIP registration, the mobile can send/receive data via GRE framing over the A10 connection.
The PCF periodically sends an A11-Registration Request message for refreshing registration for the A10 connection.
For a validated A11-Registration Request, the PDSN returns an A11-Registration Reply message.

Both the PDSN and the PCF update the A10 connection binding record.

This necessarily complex process can be the source of some problems that affect service and quality. A rigorous monitoring scheme involving simultaneous observation of the A1 interface and the A10/A11 interface is the best way to detect and correct errors early. A multi-interface call-trace application is especially productive since it can trace and group all of the procedures related to the activity of each single subscriber in a CDMA network, even as the procedures evolve over multiple interfaces.

Within the call-setup process, an error in any element or procedural step can inhibit the remaining steps. For example, suppose that the MSC does not respond to the CM service request message (Step 3 in Figure 2) sent by the BSC/PCF over the A1 interface. This sometimes is caused by internal MSC problems.

If this prevents the CM service request from reaching completion, the BSC/PCF cannot assign radio resources to the mobile station, in turn preventing establishment of the connection. The user finds it impossible to make a data callï¿½a service for which he or she has paid a premium.

Before a specific timer expires, the PCF periodically sends A11-Registration Request messages (Step 11) to refresh the registration for the A10 connection. For a validated A11-Registration Request, the PDSN returns an A11-Registration Reply message (Step 12). Here again, internal problems in the PDSN can cause it to respond late or not at all.

As a result, the process of establishing or maintaining the connection cannot continue. The user once again is unable to make a data call.

In both cases, a protocol analyzer connected to the A1 and A10/A11 interfaces can help track down the problem. The call-trace application can distinguish the origin of messages and detect any failure to respond. This makes it easy to pinpoint the MSC and the PDSN in these examples.

Inefficiency in User Data Packet Transmission
Frequently in a CDMA2000 network, the TCP user-plane packets have a small window size. This implies that end-to-end TCP connections are not stable. The more TCP packets lost in the network and not acknowledged, the smaller the window size, with the result that more TCP connections are dropped and reestablished. The small TCP window size is a byproduct of the soft-start mechanism built into the TCP protocol.

To characterize this problem, it is necessary to capture the TCP/IP user plane packets flowing on the GRE tunnels on the A10 interface. Protocol filtering allows the tool to home in on the data of interest. By applying different types of filtering with an increasing level of details, it is possible to drill down and isolate the root cause of the shrinking TCP packet window size.

Routing Loops of User Data Packets
Tunnel router loops also can degrade the quality of service for subscribers. The problem is caused by misconfiguration in the PDSN routers. It can be detected by acquiring and analyzing IP traffic on the P-H interface (Figure 1).

To understand tunnel router loops, imagine a subscriber surfing the Web with a laptop connected to a CDMA2000 handset. Packets addressed to a specific HTTP proxy are routed (after passing through the PCF) from the PDSN/FA to the HA for detunneling.

With certain incorrect internal routing configurations, packets destined for Port 80 WWW are not detunnelled by the HA. Instead, they are sent back downstream toward the PDSN/FA. As a result, multiple packets travel on the same network segment with the same packet identification, wasting precious bandwidth and not reaching the intended destination.

In addition, for each repetitive hop a packet takes between the PDSN/FA and the HA nodes, the IP TTL field is decremented. If the packet is stuck in a router loop, the TTL eventually decrements all the way to zero, and the packet is discarded by the network nodes. Lost packets must be retransmitted, leading to excessive packet retransmission overhead and reduced throughput.

As in the earlier examples, the solution is to use protocol filtering to capture IP packets on the P-H interface. Browsing through the captured data by applying increasingly fine levels of filtering, it is possible to see the repeating packets and resolve the problem.

Duplication of IP Traffic
PDSN configuration problems can give rise to other types of problems in addition to tunnel loops. One common issue is associating the logical IP addresses of the PDSN with more than one physical MAC address. When this occurs, more than one hardware card has the same IP address.

All traffic sent to that IP address goes to two different hardware entities and receives responses from both. This effectively doubles the amount of IP traffic associated with that single IP address on that segment. Once again, protocol-filtering capabilities are required for effective troubleshooting.

A protocol analyzer should capture IP packets travelling to a specific IP destination address via the P-H interface. Browsing through the data and using filtering to successively narrow down the inquiry, the duplicated address soon becomes apparent.

Routing Problems in the Core Network
Sometimes, internal problems can cause PDSN routers to go off-line and come back online after a period of time. This can happen frequently and continuously in a CDMA2000 core data network.

When a router first comes online, its routing tables are not optimized. It takes time for the built-in OSPF routing algorithm to learn the best way to route packets depending on adjacent available routers. Until the routing tables are optimized, there will be degradation in the quality of service.

By capturing IP packets on the P-H interface with a protocol analyzer and applying filters on the OSPF routing messages, changes in designated routers and neighbors of a router can be easily identified. Using intelligent and detailed filtering capability on OSPF messages and information elements within these messages, identifying routing problems on an IP network becomes an easy task.

Conclusion
Troubleshooting activities for CDMA networks now require an understanding of both traditional telecom concepts related to the circuit-switched domain and new concepts related to the packet switched domain. Network operation and maintenance personnel must refine their processes to meet new complex troubleshooting challenges. These range from misconfiguration problems to duplicated IP addresses. Protocol analysis tools are playing a bigger role than ever in keeping networks running efficiently, with features such as multi-interface call tracing and protocol filtering becoming critical to the job of network troubleshooting and maintenance.

About the Author
Wayne Newitts is the senior manager of Americas Marketing responsible for business development in North and South America for all Tektronix market segments. Prior to joining Tektronix in 1999, he worked as national sales manager for GN Nettest and held sales and engineering positions with ADC Telecommunications, INET, and COMSAT. Mr. Newitts holds a B.S.E.E. from Texas A&M University. Tektronix, 14200 SW Karl Braun Dr., Beaverton, OR 97077, 800-835-9433, e-mail: [email protected]

FOR MORE INFORMATION

on CDMA2000 PDSN capacity testing
www.rsleads.com/408ee-176

August 2004