MantisNet's Tawon CVF (Containerized Visibility Fabric) provides platform teams with full visibility into containerized environments, with a specific ability to address the visibility challenges facing 5G mobile network operators. Working closely with key partner (and leading telco platform and solution provider) Red Hat, MantisNet continues to prove how establishing real-time visibility solutions for 5G telco networks can be accomplished by leveraging solutions built on cloud-native principles. 

With the arrival and increased ramp up of 5G Stand Alone (SA) mobile networks, telecommunications operators have rightfully earned a (very large) seat at the cloud-native table. After all, these are fully containerized networks we are talking about- without any VNF stepping stones left. Nothing gets more cloud-native than that.

However, there is a uniqueness to “telco cloud-native” that doesn’t necessarily exist across the board for all “generic cloud-native” companies. 5G telcos are not only tasked with embracing and deploying fully containerized

In part one of this blog series, we explored the reasons behind “why” messages may be a better path forward for 5G visibility strategies than simply relying on a traditional approach of “grabbing more packets”. The main motivator for overhauling visibility/observability strategies for stand alone (SA) 5G networks is that these networks are fundamentally different from previous generations’ telecommunications networks. These differences were broken down into the following challenges that the engineering team at MantisNet set out to address:

Around four years ago MantisNet’s engineering team set out to answer a question that seemed glaringly obvious, but consistently ignored by others in the visibility space- “How do monitoring solutions need to evolve to handle the changes that 5G bring?”

There are many aspects of 5G environments that are challenging for establishing visibility. The first example may be the most obvious- 5G is promising an extreme growth in the amount of data being generated. All forecasts for 5G environments indicate that there will be an explosive growth in data, full stop. Cutting edge smart use cases, the proliferation of IoT environments, and a growing reliance on mobile technology for communications and media consumption will all generate a massive amount of data that 5G networks will serve up and host. Given this incoming data storm, does it make sense moving forward with current visibility approaches? Current solutions largely center around the concept of “grab all packets”, or at the very least are "packet centric". Will this approach continue to be sufficient given the enormous amount of data within 5G?

Taking a step back

When discussing the specific benefits and approaches of leveraging eBPF programs, it is very easy to head directly into a technical rabbit hole. The technology is very detailed and can be used for a wide variety of use cases. Consequently, conversations can quickly get wrapped around specifics while glossing over the fundamental elements of the technology. As is true with any newer technology, it is often helpful to level-set and take a step back to discuss the basics. This post will serve to do just that- provide a high level view into the fundamentals of an eBPF program, and more specifically, into an eBPF program being used for 5G SA visibility.

As 5G stand alone (SA) environments are beginning to roll out in more earnest, there is an ongoing conversation about how to best support visibility of these container-centric platforms. Network function vendors, carriers, MNOs, and MVNOs all have skin in the game and are taking part in this conversation. At the core of the discussion is a very simple question- what is the best way to instrument and observe these complex and heavily containerized systems?

Traditional tools are no longer viable- this is common knowledge across the ecosystem. The days of deploying taps are long gone, and the days of relying on virtual taps for “cloud resources” have also faded away. We are now firmly in the era of “cloud-native”- the first major evolution of the cloud. Cloud-native has ushered in a new focus on how to best leverage virtual resources and distributed computing, with the core tenet being a shift from VMs and VNFs to containers and CNFs. The challenge now is determining how to best introspect these containerized environments.

One of the biggest drivers that has impacted the design of 5G systems is the goal of providing extremely low latency and high-speed data rates throughout the entire network. The increase in data delivery speeds with 5G environments promises staggering benefits- we are talking about moving from the 1 Gbps world of 4G into a promised 10 Gbps future- or more simply put, an evolution akin to shifting from the horse and buggy to internal combustion engines. Such an enormous jump in the speed at which the world’s most valuable resource (data) can be exchanged helps explain the amount of energy and excitement around 5G that we are all collectively experiencing.

But how does this translate into architecture principles?

Leaving carrier aggregation (CA) and massive MIMO aside for another conversation, we will focus on the network itself. For starters, the 3GPP determined early on that the control plane (CP) and user plane (UP) must be split (across both the RAN and the core) so that each plane can be independently scaled and flexibly deployed. In addition to this split, the decision to take a NFV/SDN, or “cloud-native” approach to the underlying resources is critical in achieving the promised speeds of 5G. Cloud-native allows for centralization of compute resources, and optimization of all physical resources that are serving network functions (NF), regardless of location in the network.

NF communications within the SBA

This is a continuation of our blog series on the advanced functions for network visibility solutions with fully programmable data pipelines. Read our introduction to the series here.

Another great example of the power behind fully programmable pipelines is the ability to gain insight into the actual visibility solution itself. Solutions such as the MantisNet RFP-NG are able to leverage the processing logic of these pipelines to better visualize what types of events are unfolding on the wire over time and provide metrics related to the rules that are running. Once again, let’s simplify things here for a moment to best understand this concept….

This is a continuation of our blog series on the advanced functions for network visibility solutions with fully programmable data pipelines. Read our introduction to the series here.

The biggest elephant in the network visibility room has always been the fact that you don’t know what you are missing. If there are packets with structures that fall outside of your fixed-function ASIC-based chip/solutions capabilities (and trust me, there always are), you are not only going to drop those packets, but you also have zero indication that you just missed a packet. The packets simply fail to parse, and you will not know that you are missing that information. You can’t control, what you can’t see.