GTP traffic logs

You can use the console or syslog to view GPRS Tunneling Protocol (GTP) version traffic logs.

Understanding GTP traffic logs

To help you troubleshoot issues, the GTP logs include messages indicating the type of problem that occurred. GTP packets are dropped because of the following reasons:

GTP header sanity check failure
GTP payload sanity check failure
Disallowed by configuration
System resource failure
System internal failure

Table 1 lists the reasons and explanations for GTP packet drop due to GTP header sanity check failure.

Table 1: Reasons for GTP Packet Drop Due to GTP Header Sanity Check Failure
`GTP Packet Drop Reason`	`Explanation`
Invalid GTP header	The GTP header is malformed because of the following reasons: Invalid length Unexpected messages For example, GTP protocol data unit (GTP-PDU) or GTP user plane (GTP-U) messages are received on the GTP control (GTP-C) port.
Inconsistent length between UDP and GTP headers	The length of the UDP payload differs from the length of the GTP message. For example, the length of the UDP payload is smaller than the minimum length of the GTP header.
Long extension header (GTPv1)	The total length of extension headers exceeds the UDP length (GTPv1 only).
Invalid GTPv0 TID	The GTPv0 tunnel identifier (TID) format is incorrect.
Invalid piggyback flag (GTPv2)	There is a piggyback flag in the piggyback packet header. The piggyback packet header should not include a piggyback flag.

Table 2 lists the reasons and explanations for GTP packet drop due to GTP payload sanity check failure.

Table 2: Reasons for GTP Packet Drop Due to GTP Payload Sanity Check Failure
`GTP Packet Drop Reason`	`Explanation`
Invalid IMSI	The International Mobile Subscriber Identity (IMSI) format is incorrect.
Zero chargID	The information element (IE) of the charging ID carries zero value.
Req Rsp context not match	The response message matches the request, but some content information does not match the request.
Bad retransmit response	The retransmitted response has the same content as the original one. So, if the original response is invalid, the retransmit ones will be dropped without check.
Missing IE	GTP-C messages are missing mandatory IEs.
IE unexpected	Unexpected IEs are present in the GTP message. For example, the Packet Data Protocol (PDP) context IE number exceeds the maximum context number supported in the SGSN context message.
Unknown IE type	Unknown IE types are present. Valid IE values range from 1–255. Unknown IE types are either zero or not supported.
Non-ascending order IEs	IEs are incorrectly ordered in the GTPv0 and GTPv1 messages.
Bad IE length	The IE length is incorrect. For example, the IE length is zero, but the IE should have data content.
Duplicate IE	Some IEs are repeated in a message. Packets are dropped because duplicate IEs should not be repeated in a message.
Non-zero TID/TEID	The header contains a nonzero tunnel endpoint identifier (TEID) (GTPv1/GTPv2) or TID (GTPv0). The value must be zero, such as in an Echo Request.
Zero TID/TEID	Zero TEID or TID is used for tunnel messages. The value must be nonzero, such as in the GTP-PDU transmitted on a tunnel (TEID).
TEIDcontrol IE is zero or incorrect	TEID IE for GTP-C tunnel is incorrect. For example, the TEID carried in the Update PDP Response message varies from the TEID of the GTP-C tunnel's uplink endpoint.
TEIDdata IE is zero	The TEID IE for the GTP-U tunnel is zero. For example, the TEID of the GTP-U tunnel carried in the Create PDP Request message is zero.
Bad control GSNaddr IE	The GPRS support node (GSN) address for the GTP-C tunnel is incorrect or an invalid IP address.
Bad user GSNaddr IE	The GSN address for the GTP-U tunnel is incorrect or an invalid IP address.
Bad EndUserAddr IE	This type of error occurs because of the following reasons: The end-user address is invalid. The end-user address validation is enabled, and the Create message does not include the end-user address IE.
C-tunnel not found	The GTP-C tunnel is not found when the device receives a message to modify or delete the GTP-U tunnel or to create a secondary GTP-U tunnel of the GTP-C tunnel.
U-tunnel not found	The GTP-U tunnel is not found when the device receives a message to modify or delete the GTP-U tunnel or to send the GTP-PDU through the GTP-U tunnel.
Invalid GTP control tunnel	The GTP-C tunnel is invalid when the device receives messages to modify or delete the GTP-U tunnel or to create a secondary GTP-U tunnel of the GTP-C tunnel. For example, the tunnel is deleted by CLI command or by another Delete message and becomes invalid during message processing.
Invalid GTP user tunnel	The GTP-U tunnel is invalid when the device receives messages to modify or delete the GTP-U tunnel or to send the GTP-PDU through the GTP-U tunnel. For example, the tunnel is deleted by CLI command or by another Delete message and becomes invalid during message processing.
No request for match	A response message does not match a request because of the following reasons: An unexpected response A late response after request timeout For example, you can see a Delete PDP Response, but you did not see the matching Delete PDP Request.
EBI not found (GTPv2)	The Evolved Packet System (EPS) bearer ID (EBI) IE is not found in GTP-C messages. For example, if the EBI IE is not carried in the Delete Bearer Request message, the message is dropped.
IE context error (GTPv2)	Errors exist in the bearer context IE. For example, the IP address in the bearer context IE is an invalid IP address.
Wrong source IP	The source IP address of a GTP message is incorrect. For example, when you receive a Delete PDP Request message, you use the destination IP address to find a GTP-C tunnel. The destination IP address is the same as one endpoint of the GTP-C tunnel. If the source IP address varies from the other endpoint of the GTP-C tunnel, the message is dropped.
Wrong destination IP	The destination IP address of a GTP message is incorrect. For example, a GTPv0 tunnel is found by a GTPv0 TID. When you receive a Delete PDP Request message, if the source IP address matches one endpoint of the tunnel, but the destination IP address varies from the other endpoint of the tunnel, the message is dropped.
Invalid EBI (GTPv2)	Packets are dropped because an invalid EBI value is used in the GTPv2 message. The value of EBI should be in range from 5–15.
Not supported GTPv2 interface type	Incorrect interface type in F-TEID IE. For example, in the Create Session Response message, if the Packet Data Network Gateway (PGW) F-TEID is included and the interface type is not S5/8 PGW, the message is dropped.
Bad NSAPI	The Network Service Access Point Identifier (NSAPI) is incorrect for the following reasons: NSAPI range must be 5–15. The GTP-U tunnel with an NSAPI cannot be created, modified, or deleted, because the tunnel does not exist or it was created, modified, or deleted by another message process of the same type.
Bad primary utnl not exist	The primary GTP-U tunnel does not exist when a secondary tunnel is created.
Too many same type IE	The number of IEs of the same type exceeds the maximum allowed. For example, the maximum IE number for bearer context is 11.
Bad V2 LBI	The GTP-C message carries invalid linked bearer ID (LBI) IE. For example, the GTP-U tunnel with the bearer ID in the LBI IE does not exist or is not a primary GTP-U tunnel.
Bad conflict with primary utnl	The newly created GTP-U tunnel conflicts with the other tunnel, and the conflicting tunnel is the primary tunnel of the newly created one.
Bad ctnl endpoint restarted	The Create PDP Context message for secondary context includes a recovery IE to change the restart counter of GSN.
Bad V0 GGSN IP	The IP address of GSN address IE is different from the GGSN IP address of the tunnel in the GTPv0 Update PDP Context Response message.
Not support Bi-NAT	When static NAT is configured in both forward and reverse directions, the packet is dropped. We support static NAT in only one direction.
Illegal retransmit request	The content of a retransmit request message is different from the original request message. The error check is for security consideration to drop the malformed messages.
Over PDP connection max number	The number of PDP connection IEs exceeds the maximum tunnel number range for one user equipment (UE) device.

Table 3 lists the reasons and explanations for GTP packet drop that occurs because an action is disallowed by configuration.

Table 3: Reasons for GTP Packet Drop Because Action Is Disallowed by Configuration
`GTP Packet Drop Reason`	`Explanation`
Too short	The length of the GTP packet payload is less than the minimum length configured. The minimum length is configured by the user.
Too long	The length of the GTP packet payload is greater than the maximum length configured. The maximum length is configured by the user.
Filtered by IMSI/APN filter	The APN/IMSI IE in the GTP-C packet matches the filter for the APN/IMSI that is configured to be denied.
Over GSN packet rate limit	The traffic sent to the GSN exceeds the GSN aggregate rate limit.
Bad message type for GTP version	This type of error occurs because of the following reasons: A GTP message with message type is configured as to be dropped. When you drop a message type, you drop all messages of the specified type. An incorrect message type is used. For example, a GTP-C message carries an `error indication` message type.
Over path rate limit	The packets have reached the path rate limit (drop-threshold value).
Cross group handover deny	The handover message is dropped because the old and new nodes are in different GTP handover groups, which are configured by the user.
Default handover group deny	The handover message is dropped after you configure a default handover option as deny.
NE group check failure	The IP address of the GSN in the message is not included in the network equipment (NE) group.
UE group check failure	The IP address of the end user in the message is not included in the UE group.
Bad sequence number	In GTP-U inspection, the GTP FW compares the received GTP-U packet sequence number with the sequence number stored in the GTP-U tunnel. If they are not in the specified range, then the GTP packet is dropped.
GTP-in-GTP	In GTP-in-GTP checks, if the received GTP-U packet's payload is an IP packet with a GTP well-known port, then the GTP packet is dropped.
Bad end user address	In GTP-U inspection, if the user tunnel is found for the GTP-U packet, then the GTP FW checks for the end-user address. If the received GTP-U payload address does not match the end-user address assigned at the creation of the tunnel, then the GTP packet is dropped.

Table 4 lists the reasons and explanations for GTP packet drop due to system resource failure.

Table 4: Reasons for GTP Packet Drop Due to System Resource Failure
`GTP Packet Drop Reason`	`Explanation`
Out of new GSN	The GSN number exceeds the maximum allowed number.
Duplicate JBUF failed	This error indicates a memory allocation failure.
New GTP JMPI cookie	This error indicates a memory allocation failure.
Bad new rt_cookie	This error indicates a memory allocation failure.
Out of new path	The number of path objects for the path rate limit exceeds the maximum number.
Bad new sync action	This error indicates a memory allocation failure.
Bad new redirect utnl	This error indicates a memory allocation failure.
Out of request	This error indicates a memory allocation failure.
Out of action	This error indicates a memory allocation failure.
New create C-tunnel	Creation of GTP-C tunnel fails because the tunnel limit is exceeded or because of a failed memory allocation.
New create U-tunnel	Creation of GTP-U tunnel fails because the tunnel limit is exceeded or because of a failed memory allocation.

Table 5 lists the reasons and explanations for GTP packet drop due to system internal failure.

Table 5: Reasons for GTP Packet Drop Due to System Internal Failure
`GTP Packet Drop Reason`	`Explanation`
Send JMPI failed	Juniper Message Passing Interface (JMPI) request fails on the SRX5000 line of devices with SPC2/SPC3.
JMPI remote process failed	JMPI remote process fails on the SRX5000 line of devices with SPC2/SPC3.
Bad reinject	Internal failure is caused by invalid reinjection of packets on the SRX5000 line of devices with SPC2/SPC3.
Wrong SPU	Internal failure is caused by incorrect Services Processing Units (SPUs) on the on SRX5000 line of devices with SPC2/SPC3.
Unknown action type	Internal failure is caused by unexpected data in memory. For example, memory is overwritten due to software or hardware bugs.
IP group not found	Internal failure is caused by unexpected data in memory.
No action for request	Internal failure is caused by unexpected data in memory.
System under resetting	Tunnel cleanup is not yet complete when you run the `clear security gprs gtp tunnel all` command, and the packets are dropped.

GTP traffic logs

Understanding GTP traffic logs

See Also