13 Where the packets actually go

13.1 Why the core needs a forwarder it can program

A 5G core cannot inspect every packet in its control plane. There are too many, and the functions that make the decisions — the SMF (the function that sets up and steers a data session), the PCF, the AMF — are built to handle events, not line rate.

So the system splits the job. The SMF decides; a User Plane Function does the work on every packet. Deployments with a single UPF for a session and with several are both supported, and the number is unrestricted §5.8.1.

The SMF may control at least four things at a UPF: traffic detection, traffic reporting, QoS enforcement and traffic routing §5.8.1. The clause says "at least", so that list is a floor and not a fence.

13.2 One N4 session, one bag of rules

Each PDU session gets an N4 session, named by an N4 Session ID that the SMF assigns §5.8.5.1. Establishing or modifying it hands rules to the UPF, releasing it removes every rule, and reporting carries events back the other way.

Six kinds of rule may be in the bag §5.8.5.1:

• PDR, Packet Detection Rule — how to recognise a packet.

• FAR, Forwarding Action Rule — what to do with one that was recognised.

• QER, QoS Enforcement Rule — bit rate limits and packet marking.

• URR, Usage Reporting Rule — what to count and when to say so.

• MAR, Multi-Access Rule — how to steer, switch or split traffic across two accesses, which belongs to Using two accesses at once.

• SRR, Session Reporting Rule — events that are not tied to any one PDR, such as per-flow QoS monitoring §5.8.5.11.

Alongside them the SMF may send trace requirements, a port management container and bridge or router information.

Both ends keep an N4 Session Context holding the S-NSSAI (the name of the network slice the session belongs to), the PDU session type, the DNN (the name of the data network the session connects to) and the rules themselves §5.8.5.2.

13.3 The PDR is the classifier

A PDR detects packets in one direction only — uplink or downlink — and a precedence value settles the order in which they are tried §5.8.5.3.

What it can match on:

• Source interface, one of "access side", "core side", "SMF", "N6-LAN" or "5G VN internal".

• UE IP address, one IPv4 address and/or one IPv6 prefix.

• Network instance, needed when one UPF serves several data networks with overlapping addresses, or sits in more than one IP domain.

• CN tunnel info, the F-TEID (the tunnel's own number together with the IP address it arrives at) of the N3 or N9 tunnel the packet came in on.

• Packet Filter Set §5.7.6, application identifier (an index into detection rules configured in the UPF), and the QFI (the number stamped on a packet that says which quality treatment it gets).

• Ethernet session information, framed route information, and an FQDN filter that matches unciphered DNS queries.

Then come the actions bolted to it: strip one or more outer headers; carry on looking at further PDRs if told to; and pointers — one FAR ID or one MAR ID, never both, plus a list of URR IDs and a list of QER IDs §5.8.5.3.

What may be matched depends on the session type §5.8.2.4.2. Ethernet sessions swap the IP packet filter set for the Ethernet one. For unstructured sessions the UPF does no flow-level traffic detection for QoS enforcement in this release.

13.4 The FAR: forward, duplicate, drop or buffer

The FAR's Action attribute is exactly those four §5.8.5.6. When it says forward or duplicate, a set of further attributes comes with it; when it says buffer, a Buffering Action Rule does.

The important ones are the destination interface, outer header creation (the tunnel info of the peer — a radio node, another UPF, the SMF, or a local data-network access) and transport level marking.

Last comes a forwarding policy, which points at behaviour preconfigured in the UPF, such as steering traffic through operator service functions or redirecting it §5.8.5.6.

The FAR may also ask the UPF to answer ARP (the address resolution protocol, which finds the hardware address behind an IP address) and IPv6 Neighbour Solicitation itself for an Ethernet data network §5.8.1, and to construct end marker packets.

The destination interface "5G VN internal" is the odd one: it sends the packet back into the UPF for a second round of classification against another N4 session's PDRs §5.8.5.6.

That two-step loop is how one UPF switches traffic between two devices in the same group §5.8.2.13.0, which is the user-plane half of Networks that are not for everybody.

13.5 Rate, marking and counting

The QER carries a gate status per direction — open, closed, or closed after the next measurement report — plus maximum and guaranteed bit rates and the averaging window.

It also carries the QFI to insert in the outgoing tunnel header, the Paging Policy Indicator to put in the outer header of downlink packets, and downlink flow level marking for reflective QoS §5.8.5.4.

Every PDR that points at the same QER shares the same allowance. That is how one QER expresses the Session-AMBR (one ceiling on the bit rate of a whole session) and another expresses an MBR for a single flow. The QoS side of this is What the network promises.

The URR says what to measure — volume, duration, both, or events — and when to report: at a volume, time or event threshold, periodically, on inactivity, or when traffic of an application starts or stops §5.8.5.5. Linked URR IDs let several measurements be reported in one go.

The SMF builds one URR per monitoring key and one per charging key out of the active policy rules, and keeps the mapping so it can translate the reports back §5.8.2.6.2.

Reports arrive as Usage Reports, repeated while a trigger still applies and once more, finally, when the URR is removed §5.8.5.7. That feeds Rules, and paying for them.

13.6 Choosing the path, and moving it

UPF selection is the SMF's, and the list of inputs is long §6.3.3. Among them: the UPF's dynamic load and static capacity, its location and the UE's, the DNN and the S-NSSAI.

Then the PDU session type, the SSC mode (whether the session keeps its anchor, and so its IP address, as the device moves), the access technology, and the capabilities the session needs §6.3.3.3.

A UPF advertises what it can do either over N4 when the association is set up, or by registering in the NRF (the directory where network functions look each other up), including operator-defined capabilities that are not standardised at all §5.8.2.21.

The UPF at the far end, the one with the N6 link to the data network, is the PDU Session Anchor. Between the radio network and the first UPF there is a per-session N3 tunnel; between UPFs, N9 §5.8.2.10.

The tunnel endpoint — a TEID and an IP address, together the CN Tunnel Info — is allocated and released by the UPF, never by the SMF, which only asks §5.8.2.3.1.

13.6.1 Uplink classifier and branching point

Both are UPF functionality, not session features. The SMF handles them "using generic N4 and UPF capabilities": it may insert one during or after session establishment, and may remove one only afterwards §5.6.4.2.

An uplink classifier examines uplink packets — typically their destination address — and sends some of them to a second anchor, while merging the downlink traffic coming back from both anchors onto the one link to the device. The device is unaware and still holds a single IP address §5.6.4.2.

The branching point is the IPv6 version of the same idea: the session has several prefixes, and uplink traffic branches by source prefix towards different anchors §5.6.4.3. More than one classifier may sit in a path, and one UPF may be classifier and anchor at once §5.6.4.2.

13.6.2 End markers

When a handover moves the tunnel endpoint, the target radio node has to know where the old stream stopped so it can put the packets back in order.

Either the UPF constructs the end markers itself on the SMF's indication, sending them down the old path after the last real packet §5.8.2.9.1, or the SMF builds them and hands them to the UPF to forward §5.8.2.9.2. Network configuration decides which §5.8.2.9.0.

13.7 Downlink for a device that is asleep

Tunnels between UPFs stay established when a device goes idle §5.8.2.10. The SMF may release the UPF that terminates N3, and then whichever UPF was upstream — a classifier or the anchor — does the buffering instead.

When the connection comes back on a newly chosen UPF, a forwarding tunnel carries the buffered packets across.

Buffering in the UPF is mandatory; in the SMF it is optional, and the SMF chooses which of the two holds the packets §5.8.2.19.1.

The instructions are: buffer downlink packets, optionally reporting the first one that arrives and the first one thrown away; or drop them, optionally reporting the first discard; or buffer uplink packets §5.8.2.19.2.

Limits are set by timer or by amount of data, and the SMF decides whether the UPF or the SMF keeps them.

When that first packet lands, the UPF sends a Downlink Data Report over N4 naming the PDR that matched. It carries the QFI, and for IP sessions the packet's own DSCP value (the priority byte an IP header carries for the transport network to read) §5.8.5.15.

That is what makes paging policy differentiation possible §5.4.3.2. On the first such report for a flow, the SMF sets paging in motion §5.4.3.1, covered in Registration, reachability and paging.

Not every packet deserves that. Node level rules let the SMF tell a UPF to drop or throttle abnormal traffic, or to inhibit downlink data reporting altogether, so junk arriving for an idle device does not wake it §5.8.6.

13.8 Guarding the border between operators

An operator may put UPFs with the Inter PLMN User Plane Security function at the edge of its network. It can be the same UPF doing everything else, or a separate one inserted into the path; either way the SMF drives it over N4.

Such a UPF forwards a GTP-U packet (a user packet wrapped in the tunnel header the core uses between its own nodes) arriving on N9 only if it belongs to an active PDU session and is not malformed §5.8.2.14.

13.9 How big may a packet be

The network can tell a device a link MTU: for IPv4 in the protocol configuration options, for IPv6 in the Router Advertisement §5.6.10.4. The point is to stop packets being fragmented in the backbone between the device and the anchor, because fragmentation there is expensive.

Annex J works out the worst case. A user packet goes into a GTP-U tunnel — 40 octets of IPv6 header, 8 of UDP, 16 of extended GTP-U header.

That whole thing then goes into an IPsec tunnel: another 40 for IPv6, 4 plus 4 for the security parameter index and sequence number, 16 for the initialisation vector, 2 for padding length and next header, and 12 for the integrity check value §Annex J.

With no padding needed that is 142 octets, so a 1500-octet transport leaves 1358 for the user. The annex says 1358 is small enough for most deployments, and that where the transport carries jumbo frames throughout, a far larger value pays off §Annex J.

One more subtraction: a device may run its own tunnel, a VPN say, and it is desirable to leave at least the MTU minus 220 octets inside it. On a 1500-octet transport that lands on 1280, which is the IPv6 minimum §Annex J.