Aviz Service Node details session-aware N11 and N3 correlation
Aviz Service Node (ASN) adds session-aware HTTP/2 decoding and expands N11 signaling coverage to correlate N11 control-plane events with N3 user-plane traffic, improving subscriber/session records for passive 5G-SA observability.
Research Overview
The vendor describes passive observability for 5G Standalone (5G-SA) as a monitoring capability that depends on correlating service-based signaling messages into subscriber- and session-level records.
The post focuses on correlation of N11 between AMF and SMF alongside user-plane traffic captured via N3, and outlines decoding, coverage, and operational changes in ASN.
Technical Breakdown
In 5G-SA, the 5G Core uses a service-based architecture (SBA) where network functions expose and consume APIs over HTTP/2 with JSON payloads within a shared service-based interface (SBI) framework.
The post highlights AMF and SMF roles for session management: AMF anchors control-plane procedures and terminates NAS signaling, while SMF creates, modifies, and deletes PDU sessions and coordinates user-plane behavior via UPF.
Key Findings on N11 Correlation and N3 Linking
N11 is described as the AMF-to-SMF interface used to set up PDU sessions and to facilitate changes such as QoS flow modifications, handovers, bearer movements, and signaling for session modification and release.
ASN is positioned as collecting complementary information by decoding N11 to learn subscriber identity and tunnel bindings, then correlating with N3 user-plane packet activity to combine separate flows into a subscriber-aware view.
ASN Enhancements for N11 Processing
The post states that ASN’s largest N11 update is fully session-aware HTTP/2 decoding, including tracking HTTP/2 connection and stream state to handle HPACK-compressed headers and map responses to requests.
ASN is also reported to extend message coverage beyond establishment and release, including PDU session modification and interworking-related signaling tied to mobility and mid-session changes, and to broaden SBI message coverage for key operations.
Expanded Coverage and Operational Hardening
For SBI, NAS, and NGAP, ASN is described as tracking Nsmf_PDUSession operations for create, update, release, and retrieve SM context, and Namf_Communication N1N2 message transfer, then decoding embedded 5G NAS session-management messages such as PDU Session Establishment Request, Establishment Accept, and Release Complete.
For NGAP, the post says ASN broadened decoding of PDU-session-resource transfer containers including PDU Session Resource Setup, Path Switch Request, and Handover Command to support detection of mobility events and reduce complexity in user-plane GTP-U tunnel endpoint detection.
Operational Impact for Operators
ASN’s changes are described as improving subscriber-aware visibility by attributing N3 data-plane activity to the right subscriber and session through N11-to-N3 correlation.
The post also attributes improved session record trust to correlated request/response legs and more complete subscriber-to-session mapping, with broader coverage across establishment, modification, mobility, and release.
It further reports resilience under real-world conditions through strict bounded parsing for unexpected, truncated, or malformed inputs, along with stability improvements under high message rates via internal buffer management.
For operation and troubleshooting, ASN is described as adding filtering for wasted traffic (such as IP fragments and oversized likely-corrupt frames) and increasing runtime observability using statistics based on NIC counters and internal packet-processing health metrics.
This vendor blog signals a fact-based update to Aviz Service Node’s passive 5G-SA observability by improving session-aware HTTP/2 decoding and extending N11 SBI, NAS, and NGAP message coverage to correlate N11 control-plane signaling with N3 user-plane traffic for more complete subscriber and session records.
Source: aviznetworks.com, by Jatin Batra.