Provides an overview of the GTP protocol. Tutorial video at: https://www.youtube.com/watch?v=FPfExr9bEEg&index=9&list=PLgQvzsPaZX_bimBc5Wu4m6-cVD4bZDav9&t=1s

1. İki Teknoloji 1
LTE:
A feature based introduction
LTE Core Features
Annex. GTP Primer
Irfan Ali
Video at youtube:
https://www.youtube.com/watch?v=FPfExr9bEEg&list=PLgQvzs
PaZX_bimBc5Wu4m6-cVD4bZDav9&index=9

2. Irfan Ali 2İki Teknoloji 2
What is GTP?
• GTP = GPRS Tunneling Protocol
• What is Tunneling in the IP World?
Ø Tunneling in the IP world means putting an IP packet inside
another IP packet.
IP_src ->
IP_dst Payload
IP_a->
IP_b
Inner IP Packet
Outer IP Packet
GPRS General Packet Radio Service

3. Irfan Ali 3İki Teknoloji 3
What is the purpose of GTP Tunneling?
• Route an IP packet along a path that is not topologically correct for
the packet.
Mehmet’s IP address
46.1.78.189->
10.40.40.12 Internet
S-GW
P-GW
eNB
Ayse
Mehmet
10.10.10.1
10.10.10.2
10.10.10.0/24
10.10.20.1
10.10.20.0/24
10.10.20.2
GTPTunnel
IP_sgw ->
IP_enb
UDP_
dst=
2152
TEID_x
IP_pgw ->
IP_sgw
IP
UDP_
dst=
2152
UDP
TEID_k
GTP-U
header
Mehmet’s IP address
10.40.40.12
DHCP
GTP is
IP-in-UDP Tunneling
HiIP_a ->
IP_m
HiIP_a ->
IP_m
HiIP_a ->
IP_m
HiIP_a ->
IP_m

4. Irfan Ali 4İki Teknoloji 4
How does the GTP-U Tunnel get setup?
• GTP Protocol has two parts
Ø Signaling part called GTP-C (GTP-Control)
Ø User data part called GTP-U (GTP-User)
• GTP-C is used to setup GTP-U tunnel
• Both GTP-C and GTP-U run on top of UDP
• IP-in-UDP tunneling is only used for GTP-U
• GTP-C carries control/signaling messages
IP_pgw ->
IP_sgw
IP_a ->
IP_m
UDP_
dst=
2152
TEID_a
IP_pgw ->
IP_sgw
UDP_
dst=
2123
TEID_k
IP UDP GTP-U
header IP UDP GTP-C
header
GTP-C message

5. Irfan Ali 5İki Teknoloji 5
SGW PGW
TEID
21232123
2152
TEID
IPc,sgw
2152
IPu,pgwIPu,sgw
TxRx Tx Rx
TEID
TEID
TxRx Tx Rx
TEIDas
TEIDbs
TEIDcs
IPc,pgw
SGW PGW
TEID
2123
2152
2123
2152
TEID
IPc,sgw
IPu,sgw
IPc,pgw
IPu,pgw
TxRx Tx Rx
TxRx Tx Rx
TEIDTEID
How does GTP-U Tunnel get setup: Example
TEIDas
TEIDas
0
C.S. Req (IMSIa, C: IPc,sgw,TEIDas,
EBID5:IPu,sgw,TEIDas) C.S. Rsp (C:IPu,pgw,TEIDap,
EBID5:IPu,pgw, TEIDxp)
TEIDbs
TEIDcs
TEIDap
TEIDbp
TEIDcp
TEIDap
TEIDbs
TEIDcs
TEIDbp
TEIDcp

6. Irfan Ali 6İki Teknoloji 6
Packet Trace: Create Session Request (S11); MME->SGW
MME
SGW/
PGW
0
21232123
0x1
eNB
SGW/
PGW
21522152
S11
S1U

7. Irfan Ali 7İki Teknoloji 7
Packet Trace: Create Session Response (S11); SGW -> MME
MME
SGW/
PGW
21232123
0x1
eNB
SGW/
PGW
21522152
S11
S1U
0x80..01
0xc0..1

8. Irfan Ali 8İki Teknoloji 8
Packet Trace: Modify Bearer Request (S11); MME ->SGW
MME
SGW/
PGW
21232123
0x1
eNB
SGW/
PGW
21522152
S11
S1U
0x80..01
0xc0..1
0x800..001
0x3ea

9. Irfan Ali 9İki Teknoloji 9
Packet Trace: GTP-U: S1-U; eNB -> SGW/PGW
eNB
SGW/
PGW
21522152
S1U
0x010000
UE Server
10.255.1.111 10.0.0.10010.1.2.11 10.1.1.12
TxRx
Tx Rx

10. Irfan Ali 10İki Teknoloji 10
Packet Trace GTP-U: S1-U; eNB <- SGW/PGW
eNB
SGW/
PGW
21522152
S1U
0x010000
UE Server
10.255.1.111 10.0.0.10010.1.2.11 10.1.1.12
TxRx

11. Irfan Ali 11İki Teknoloji 11
GTP Path and Path Management
• Path is between two endpoints. Each end
point is IP_address+UDP_Port#
• There can be several GTP tunnels on a
path (each with different TEIDs).
• There is typically a “software process” that
binds to each end-point.
• Path Management messages: To ensure
that a path is alive (both the physical link
and process at the endpoint), periodic
echo-request and echo-response are sent.
• Failure-detection and error-recovery
mechanisms are defined.
SGW PGW
TEID
2123
2152
2123
2152
TEIDas
TEIDbs
TEIDcs
TEIDxs
TEIDys
TEIDzs
TEID
IPc,sgw
IPu,sgw
IPc,pgw
IPu,pgw
TxRx Tx Rx
Path
Path

12. Irfan Ali 12İki Teknoloji 12
Packet Traces: GTP-U Echo-request & Echo Response
In GTP-Cv2 Echo
request/response messages
do not contain TEID field
In GTP-Cv2 Echo
request/response messages
do not contain TEID field

13. Irfan Ali 13İki Teknoloji 13
Interfaces on which GTP is used
• GTP-Cv2 is used not only for
mobility management, but
also for general signaling
purposes, eg providing UE’s
cell information to the PGW
and from there to operator’s
service network.
Internet
MME
S-GW
P-GW
HSS
eNB
UE’s IP address
S1-MME
S11
S6a
S5
S1-U
MME
S10
S1AP
GTP C
GTP C

14. Irfan Ali 14İki Teknoloji 14
Specifications
• GTPC v2 TS 29.274
• GTPU v1 TS 29.281
• GTPC v1 TS 29.060
• Historically (before Rel-8, i.e. before 2009Q1), TS 29.060 used to be
the key GTP specification (both GTPC v1 and GTPU v1). But since
Rel-8, TS 29.060 is only applicable to 3G interfaces (Gn/Gp,
between SGSN <-> GGSN and between SGSNs) and not to EPC
interfaces. Its specification only applies to GTPC v1
Ø Ignore anything that 29.060 says about GTPU.

15. İki Teknoloji 15
Annex

16. Irfan Ali 16İki Teknoloji 16
Rules for GTP-C IP address and port numbers
• Three types of messages
• Rules for Port# and IP addresses
Ø Initial Message:
1. The UDP Destination Port number for GTPv2 Initial messages shall be 2123
2. The UDP Source Port for a GTPv2 Initial message is a locally allocated port number.
3. During the establishment of the GTP tunnel, the GTPv2 entity selects and communicates to the peer GTPv2 entity the IP Destination Address at
which it expects to receive subsequent control plane Initial messages related to that GTP tunnel via the "Sender F-TEID for Control Plane" IE
Ø Triggered message
1. The IP Source Address of a GTPv2 Triggered message and for a Triggered Reply message shall be copied from the IP destination address of the
message to which this GTPv2 entity is replying
2. The IP Destination Address of a GTPv2 Triggered message and for a Triggered Reply message shall be copied from the IP Source Address of the
message to which this GTPv2 entity is replying
3. The UDP Source Port of a GTPv2 Triggered message shall be the value from the UDP Destination Port of the corresponding message to which
this GTPv2 entity is replying
4. The UDP Destination Port value of a GTPv2 Triggered message shall be the value of the UDP Source Port of the corresponding message to which
this GTPv2 entity is replying
Ø Triggered Reply message
1. Same rules as triggered message.
• Rules for TEID#
Ø The first Create Session Request message on S11 for a UE shall have TEID = 0x0
Ø The (first and subsequent) Create Session Request message on S5 for a UE shall have TEID = 0x0
GTP-C
Peer A
GTP-C
Peer B
Initial Message
Triggered Message
Triggered Reply Message