WHITE PAPER

Mobile Broadband Networks

An Aggregated View of Wireless Application and Network Traffic for
Global Mobile Network Operators (MNOs)

www.ixiacom.com

915-3114-01 Rev. B, December 2013

Table of Contents
Executive Summary..................................................................................................................................... 4
I. Mobile Broadband Networks Background................................................................................................. 5
II. Measuring Resiliency and Identifying Stress Fractures in Mobile Network Infrastructure....................16
III. Mobile Protocols and Super Flows........................................................................................................ 17
IV. BreakingPoint Application Profiles....................................................................................................... 20
VI. Glossary................................................................................................................................................ 26

Executive Summary
By the end of 2013, the number of mobile-connected devices will exceed the number of
people on earth, and by 2017 there will be nearly 1.4 mobile devices per capita.1 Google
Android phones, the Apple iPhone, the Apple iPad and similar devices continue to
feed an insatiable consumer appetite for continuous availability of rich content and highspeed premium services. "Mobile broadband subscriptions overtook fixed broadband
subscriptions in 20082, and show an astonishingly high growth rate of some 30% per
year".3 To meet this demand, mobile carriers are responding with aggressive rollouts of
next-generation networks and network infrastructures that will provide subscribers with a
wireless experience comparable to the wired residential broadband experience.
As mobile carriers move forward with next-generation converged networks, they are
deploying network and security devices designed for wireline broadband and traditional
networks. These network and security devices have not been evaluated to support a realworld mix of mobile applications, malicious traffic, and extreme load from tens of millions
of mobile subscribers. If carriers continue to use this strategy, they will not be able to
satisfy wireless network resiliency, security, and performance requirements. The result
will be an ongoing escalation of service failures on every mobile network.

By the end of 2013,

the number of
mobile-connected
devices will exceed
the number of
people on earth, and
by 2017 there will
be nearly 1.4 mobile
devices per capita.1

If quality of service (QoS) is a main focus for a mobile carrier, then continuous service
failures should be the impetus for change. Mobile carriers have taken the first step
in making needed changes by investing in upgrades to their infrastructures to handle
the rapid rate of technology innovation, application growth, and ever-present security
vulnerabilities. As this report will detail, mobile carriers must also validate network
equipment and systems using real traffic and security threats to certify that the production
network will be resilient when faced with extreme load, stress, and attacks.
To prepare this report, Ixia examined 100 terabytes of aggregate mobile traffic data
provided by Ixia BreakingPoint customers in North America and Europe. The paper
outlines the traffic that these mobile networks are transporting, including the size of the
traffic, overall percentages and individual applications. It also provides recommendations
for mobile network operators (MNOs) and outlines the steps BreakingPoint has taken
to help MNOs and equipment manufacturers measure the resiliency of their network
equipment and systems to ensure that they perform as expected.
Data collection from mobile carriers in North America and Europe was conducted over
a 24-hour period on a normal weekday and is representative of an average day. The data
provides no indication of the number of carrier subscribers. Therefore, any per-user
analysis would be purely speculative. Where possible, we note similarities and differences
between the regions.
Additionally, we examine some open questions about the effects of the Apple iPhone
and Google Android devices on wireless networks, which have a significant impact on
the traffic that is passing through the network. As with any network, capacity varies
by location, whether it is cell tower, backhaul, or the core network. The references to
capacity are in regard to backhaul and the core network; the signaling and radio frequency
aspects of mobile broadband are a topic for future discussion.
1
2
3

Cisco Visual Networking Index: Global Mobile Data Traffic Forecast Update 2012-2017. http://www.cisco.
com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11-520862.html
ITU (2013): http://www.itu.int/en/ITU-D/Statistics/Documents/statistics/2013/ITU_Key_2005-2013_ICT_
data.xls
The State of Broadband 2013: Universalizing Broadband, a Report by the Broadband Commission/ITU,
September 2013

Using the data provided in this paper, BreakingPoint has updated its own line of products
with the ability to simulate the real traffic mix seen on todays mobile network. Mobile
operators using BreakingPoint products can then verify whether the network elements
they are deploying will perform adequately when faced with the distinct traffic, unique
load peaks, security attacks, and applications running on mobile networks. That level of
visibility into infrastructure devices allows mobile operators to identify key weaknesses
and potential vulnerabilities to provide the high-level of service demanded by mobile
subscribers.

I. Mobile Broadband Networks Background

Mobile broadband use has risen dramatically, and in some cases, demand has exceeded
network capacity. According to the International Telecommunication Union (ITU), "Mobile
internet subscriptions have increased nearly tenfold over the last six years, from 268
million in 2007 to 2.1 billion in 2013.4 Although Europe had a head start in both cellular and
mobile broadband deployments, the Americas are quickly growing, with the United States
(US) surpassing Europe in 3G market penetration as of 2008.5 According to Pyramid
Research, 4G subscriptions are expected to globally grow tenfold over five years, from 88
million in 2012 to 864 million in 2017.6
The convergence of those growth drivers has led to a dramatic change in the type of traffic
handled by mobile network operators. Networks must advance to handle the broadband
traffic already threating to overtake capacity and Long-Term Evolution (LTE) is in the sites
of many carriers. In FierceWireless, Phil Golstein writes, "The United States is one of the
most advanced LTE markets in the world, along with South Korea, Japan and to a lesser
extent, Germany. If we are to believe the carriers' predictions, by the end of 2013 there will
be four U.S. operators covering at least 200 million people with LTE."7
Mobile traffic is experiencing tremendous growth, so it is important to note that the
network infrastructure components used to transport that traffic are the same components
used in broadband and wireline network data connections. As the paper will reveal,
application traffic running across a mobile network is very different from wireline network
traffic. The traditional wireline network components used in today's mobile networks may
not effectively handle the mix of mobile traffic and load, resulting in more retransmits on
mobile devices, mobile radio frequencies, and the signaling infrastructure. The increase
in retransmits leads to dropped calls, network resource outages, a negative customer
experience, business disruption, and delays in bringing new mobile devices and/or
premium services to market.

The traditional
wireline network
components used
in today's mobile
networks may not
effectively handle
the mix of mobile
traffic and load,
resulting in more
retransmits on
mobile devices,
mobile radio
frequencies, and
the signaling
infrastructure.

As the mix of network traffic increases in volume and complexity, it is critical that
MNOs validate both the security and the performance of their network infrastructure,
understanding the unique conditions and patterns of mobile traffic. That will act as
verification of the components ability to handle the unique characteristics of mobile data
traffic. It will also allow MNOs to more efficiently manage capacity, reduce time to market
with premium services, and ensure a quality subscriber experience.
Since Ixia provides network operators with the ability to validate network infrastructure
elements through the simulation of real-world application traffic, real-time security
attacks, and maximum load, it is in a unique position to see all sides of the network
4
5
6
7

The State of Broadband 2013: Universalizing Broadband, a Report by the Broadband Commission/ITU,
September 2013
comScore. (2008, Sept) comScore Reports that the U.S. Catches Up With Western Europe in Adoption of 3G
Mobile Devices. [Online]. http://ir.comscore.com/releasedetail.cfm?ReleaseID=332170
Pyramid Research, quarterly mobile data forecast, February 2013
FierceWireless, Progress report: A snapshot of U.S. LTE deployments in 2013. http://www.fiercewireless.
com/special-reports/progress-report-snapshot-us-lte-deployments-2013#ixzz2n7O6JW7y

equation. Although carriers are, understandably, protective of the details of their specific
traffic mix, they are also concerned with the massive stability, security, and performance
problems they are now experiencing. Because of these concerns, some of the largest
mobile operators in North America and Europe have provided 100 terabytes of aggregated
traffic data for Ixia to analyze. Careful examination of the data supports the conclusion that
mobile network traffic patterns are unique in their application mix and usage patterns as
detailed throughout this paper.

Since Ixia provides

network operators
with the ability to
validate network
infrastructure
elements through
the simulation
of real-world
application traffic,
real-time security
attacks, and
maximum load,
it is in a unique
position to see all
sides of the network
equation.

Mobile Growth Continues Unabated

North American and European mobile network carriers are witnessing unprecidented
growing demand for data services on their networks. While the application and device
mixes are similar, some important differences are noted. These are likely due to factors
such as earlier 3G deployments in Europe and different market share among handset
manufacturers. Even so, mobile growth in the US is increasing at a rapid pace as shown in
Figure 1.

Figure 1: US Wireline and Mobile Breoadband Penetration8.

Wireline broadband use went from 150 petabytes per month in 2002 to 1,600 petabytes
per month in 2008, a 1,000% increase in only six years. Looking at the wireless curve, we
expect the same growth in data consumption between 2010 and 2013, half the time it took
wireline to reach that level.
Because it is the easiest metric to understand, bandwidth is always the selling point for
new network technologies. However, MNOs need to look beyond bandwidth. If quality
of experience is to improve, the latency inherent in applications, device mixes, and layer
1 and layer 2 technologies needs more attention. For example, MDI and MOS have been
created to measure quality of experience (QoE) in streaming applications, and those are
particularly sensitive to excessive latency. As we continue to examine the data, we will
discuss the need to validate for both latency and bandwidth in order to guarantee a smooth
transition to 4G and beyond.

C. Sharma. (2009, Jul.) Managing Growth and Profits in the Yottabyte Era. [Online]. http://www.
chetansharma.com/Managing_Growth_and_Profits_in_the_Yottabyte_Era.pdf

North American Wireless Carrier

The mobile traffic data Ixia received from one of the largest NA wireless carriers, which
has approximately 89 million subscribers in the United States,9 was collected using one
or more products in the NIKSUN NetOmni Suite.10 Twenty monitoring points within the
network were used for gathering the data during a normal weekday in January 2010.
The NA wireless carrier data totaled 76 terabytes, and no exclusions were made in the
collection. To give a full picture of the NA wireless carriers total network, it has been
reported elsewhere11 that in 2008 its network recorded 3,500 terabytes per month, which
equates to 117 terabytes per day. The top five applications represent 90% of the total and
consume more than 69 terabytes as seen in Table 1.

Application

Gigabytes

Percentage

Web based

59059.00

77.03%

Blackberry

3940.64

5.14%

Flash RTMP

2631.62

3.43%

IPsec ESP

2261.98

2.95%

POP3s

1111.33

1.45%

Total

69004.57

90.00%

Table 1: Top Five Applications for the North American Provider

Of the remaining 34 applications, only port 10000 comprised more than 1% of the total
estimated throughput. Port 10000 represents NDMP, Webmin, and several malware
applications,12 and the data could represent any combination of those. Going beyond the top
five applications and grouping application types together provides further insight, as seen
in Table 2.

Category

Terabytes

Percentage of Traffic

Web

59.059

77.03%

Blackberry

3.940

5.14%

Streaming

3.309

4.32%

Mail

2.104

2.74%

P2P

0.607

0.79%

VoIP

0.341

0.45%

Gaming

0.190

0.25%

IM

0.096

0.12%

Other

7.023

9.16%

Total

76.669

100.00%

MNOs need to look

beyond bandwidth. If
quality of experience
is to improve, the
latency inherent
in applications,
device mixes, and
layer 1 and layer 2
technologies needs
more attention.

Table 2: North American Traffic Categorization

No other application types exist in the Web-browsing category, so its value remains
unchanged (Table 2). Since Web encompasses all HTTP-based traffic, the assumption is
that most HTTP streaming media is included here, and possibly some HTTP-based peer9
10
11
12

Verizon Wireless. About Us Overview. [Online]. http://aboutus.vzw.com/aboutusoverview.html

NIKSUN Inc. NIKSUN NetOmni. [Online]. http://www.niksun.com/product. php?id=1
Wikipedia contributors. (2010, Jan) File:IPhone sales per quarter simple.svg.[Online]. http://en.wikipedia.
org/wiki/File:IPhone_sales_per_quarter_simple.svg
Speedguide.net. Port 10000 (tcp/udp). [Online]. http://www.speedguide. net/port.php?port=10000

to-peer (P2P) services, notably Gnutella. The only streaming media that was individually
categorized was RTSP. However, at only 677 gigabytes, it is a small portion of the traffic.
BlackBerry traffic represents BlackBerry Messenger and push-mail traffic. The mail
applications POP3/POP3S, IMAP/IMAPS, and SMTP totaled 2.1 terabytes, or 2.74% of
traffic.
P2P and VoIP applications, which represent large amounts of data on wireline networks,
were mostly absent, at .79% and .45%, respectively. Gaming was also a small percentage
of the traffic, at 0.25%. The relatively-high latency of wireless networks could explain why
gaming and VoIP are such a small amount of the traffic. The initial claims to consumers
about 3G are for increased bandwidth, but reducing latency will be critical to ensuring that
applications such as VoIP, streaming, and gaming are usable on wireless networks.
While the Android Market represents only .28% of traffic, Hitslink.com reported that
the Android market share increased more than 50% in the last two months of 2009.13
That coincides with the introduction of the DROID by Motorola, which was released on
November 6, 2009,14 with sales estimates between 100,000 and 250,000 units for the
week of its release.15 Although that is significantly less than the iPhones 42 million, it is
an appreciable number, and all Android devices can use the Android Market.

The mobile Web European Wireless Carrier

has evolved beyond The European wireless carrier represented has approximately 16.6 million subscribers, a
basic browsing and figure that includes approximately 750,000 Virgin Mobile subscribers because of a Mobile
now delivers a full Virtual Network Operator (MVNO) agreement.
suite of rich content The European wireless carrier traffic reports that Ixia received were generated using
Service Control Application for Mobile Networks to provide a granular traffic
to mobile users. Cisco
breakdown. The data was collected on a weekday in August 2009. Ixia was not notified
16

17

of any exclusion in the collection data. The number of collection points used in gathering
the data was not provided. Overall, the traffic was 90% downlink and 10% uplink, and the
maximum advertised network speeds are 4.5 Mbps down and 1.7 Mbps up.18 In fairness to
the carrier, it does state the more reasonable expected speeds of 2.0 Mbps down and 700
Kbps up. While simple Web browsing is the single largest application, it is important to
note the diverse set of HTTP applications, as seen in Table 3.
Also of note is that although these applications share HTTP as a transport, they may
behave differently on the network and must be modeled separately. The mobile Web has
evolved beyond basic browsing and now delivers a full suite of rich content to mobile
users.
Other popular applications for mobile broadband users are apparent, as seen in Table 4.

13
14
15
16
17
18

Hitslink.com. Browsing by Device Category Trend. [Online]. http://marketshare.hitslink.com/report.

aspx?qprid=61&sample=13
Wikipedia contributors. Motorola Droid. [Online]. http://en.wikipedia. org/w/index.php?title=Motorola_
Droid&oldid=343270307
A. Thomson H. Miller. (2009, Nov.) Motorola Probably Sold 100,000 Droids in First Days (Update2). [Online].
http://www.bloomberg.com/apps/news?pid=newsarchive&sid=a4IZD2kI6dh8
Deutsche Telekom AG. (2009, Nov.) UNITED STATES SECURITIES AND EXCHANGE COMMISSION Form
6-K. [Online]. http://www.sec.gov/ Archives/edgar/data/946770/000094677009000085/dtagq309.htm
Cisco Systems. (2009, Oct.) Cisco Service Control Application for Mobile Networks. [Online]. http://www.
cisco.com/en/US/products/ps6501/index.html
T-Mobile UK. What speeds can I expect when using Mobile Broadband? [Online]. http://support.tmobile.
co.uk/help-and-support/index?page=support&cat=USB_STICK_620&tab=0&id=FA990

Application

Gigabytes

Percentage

Browsing

5994.848

37.04%

Flash (non-YouTube/Myspace/
Yahoo!)

2559.834

15.82%

YouTube

2474.825

15.29%

HTTP Audio/Video

967.212

5.98%

Misc. Upload/Download

551.373

3.40%

BitTorrent

529.225

3.27%

Streaming

454.851

2.80%

HTTPS

315.706

1.95%

BBC iPlayer

306.180

1.89%

Total

14816.020

100.00%

Table 3: Top 10 Applications for the European Provider

Category

Gigabytes

Percentage

Web

13247.465

81.84%

P2P

810.512

5.01%

Streaming

765.281

4.73%

Email

78.933

0.49%

Gaming

46.297

0.29%

VoIP

39.393

0.24%

IM

31.450

0.19%

Other

1166.730

7.21%

Total

16186.061

100.00%

Grouping various
application
types can more
clearly illustrate
the application
breakdown for the
network

Table 4: European Traffic Categorization

Grouping various application types can more clearly illustrate the application breakdown
for the network (Table 4). P2P applications were the second largest group for the
European wireless carrier. Cisco has reported19 seeing a relative decline in P2P since
2008. It represents less than 5% of the total traffic, not the more than 20% seen on fixed
networks.20
BitTorrent was the largest of these applications, yet its minimum, maximum and average
rates were only 22 Mbps, 148 Mbps, and 49 Mbps, respectively. As a reference point,
the aggregate minimum, maximum, and mean throughput rates were 388 Mbps, 2.657
Gbps, and 1.5 Gbps, respectively. BitTorrent traffic spiked at 2300 GMT and quickly fell
off at 0700 GMT. A plausible explanation is that users are delaying their P2P use until the
evening.
However, while the European wireless carrier is using some form of traffic shaping
on its network, information on traffic shaping policies was not provided. Therefore, no
assumptions are made. Nevertheless, mobile P2P traffic is not yet present in the volume
19

Cisco Systems. (2008, Oct.) Approaching the Zettabye Era. [Online]. http://www.cisco.com/en/US/solutions/
collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11-481374.pdf and Cisco Systems. (2009, Oct.)
Cisco Visual Networking Index: Usage Study. [Online]. http://www.cisco.com/en/US/solutions/collateral/
ns341/ns525/ns537/ns705/Cisco_VNI_Usage_WP.html
20 The Cooperative Association for Internet Data Analysis. (2010, Jan.) Internet Traffic Classification. [Online].
http://www.caida.org/research/traffic-analysis/classification-overview/#discussion

reported to be present on fixed networks,18, 20, 21 and it is not consuming large amounts
of bandwidth, even at its daily peak. Taken together, all of those facts indicate that the
chokepoints with regard to mobile P2P are either the cell towers or the backhaul links,
which corroborates other findings.22

Grouping various
application
types can more
clearly illustrate
the application
breakdown for the
network

It would be interesting to see the P2P impact in future reports as well as its ratio to
streaming traffic. If it follows the same trend as fixed networks, then streaming should
surpass P2P for the European provider in as little as one year. Carriers should not mistake
that, however, to mean that P2P traffic will decline on an absolute level, because, as has
already been shown, overall traffic is expected to growand P2P with it. Instead, it will
likely decline relative to other applications.19, 21
Since music and video are the most popular media types downloaded via P2P networks,21
carriers should leverage that and provide value-added content in the form of streaming
media. That will also allow carriers to define data consumption on their own terms as far
as quality of service, routing policies and bandwidth management. Options could include
using caching and content distribution networks to achieve results similar to those already
realized by fixed networks.
The European wireless carrier could be an example that strategy, by capitalizing on what
might otherwise be viewed as detrimental applications on its network. By providing its
own video-on-demand (VoD) service, the European wireless carrier is able to provide a
service that reduces the load of P2P and other streaming applications on its network. Now
the European wireless carrier can choose where to place the content in its network and
potentially reduce core network bandwidth consumption of video streaming.
Only one reference to VoD was found23 on the European wireless carrier Web site. It is
possible that if VoD were positioned more prominently and marketed more aggressively,
the European wireless carrier would see an increase in its own video streaming relative to
other services (currently 45th on the list). The European wireless carrier Fair Use Policy
for its unlimited mobile broadband plans includes a monthly cap of 3GB, so VoD would
be lucrative if subscribers were to incur overages. Using a conservative estimate of 1
Mbps for a streaming video means that a single 90-minute movie would consume at least
675MB, with higher bit rates common.24
The European wireless carrier data also shows that mobile broadband networks are
starting to closely resemble fixed networks in many regards. Many applications are being
seen for the first time on mobile networks because of increased handset functionality.
In addition, more traditional devices such as laptops and netbooks are being brought
onto the mobile network via data cards and USB dongles. Those networks can be called
transitional networks because they represent an evolution from traditional voice-only
wireless networks toward the rich application mix of fixed networks.
Two notable exclusions are VoIP and instant messaging, for which the data shows traffic is
low. Those services likely are not widely used because of the phones native talk and

21

ipoque. (2009) Internet Study 2008/2009. [Online]. http://www.ipoque.com/resources/internetstudies/

internet-study-2008_2009
22 Allot Communications. (2009, July) Global Mobile Broadband Traffic Report, Q2/2009. [Online]. http://www.
allot.com/download/Allot_GMBT_Report.pdf
23 T-Mobile UK. FAQ. [Online]. http://support.t-mobile.co.uk/help-andsupport/index?iqaction=5&answerid=167
77216&highlightinfo=6291627,24,44&type=open&page=answeropen&url=http%3A%2F%2Fsupport.t-mobile.
co.uk%2Fhelp-andsupport%2Findex%3Fpage%3Dcontent%26id%3DFA1101%26actp%3Dsearch%26viewloca
le%3Den_GB&searchid=1264517201257#__highlight
24 Amazon.com. Amazon MP3 Music Downloads Frequently Asked Questions. [Online]. http://www.amazon.
com/gp/help/customer/display.html?nodeId=200154210&#specvideo

10

SMS/MMS capabilities or because the applications are being blocked.2526 One should not
expect mobile networks to align exactly with fixed networks but should expect to see
some similarities, in both benign and malicious traffic. The malware traffic that plagues
fixed networks will seep into wireless networks in step with the entrance of traditional
endpoint devices.27

Figure 2: North American Application Mix

The European
wireless carrier
data also shows that
mobile broadband
networks are
starting to closely
resemble fixed
networks in many
regards.

Figure 3: European Application Mix

25 T. Keating. (2007, Jun.) T-Mobile blocks VoIP - again! [Online]. http://blog.tmcnet.com/blog/tomkeating/voip/
tmobile-blocks-voip-again.asp
26 Fring.com. (2008, Dec) VoIP Blocking in the UK. [Online]. http://www.fring.com/forums/showthread.
php?t=13906
27 iGillott Research, 2007

11

Figure 4: Traffic Comparison

Figure 5: Non-Web Traffic Comparison

12

Comparison of North American and European

Application Mixes
Although the European wireless carriers data had a more granular classification of
applications, the traffic is quite similar, as noted in Figure 4. Web browsing dominates
both data sets, and streaming has a similar percentage. Mail protocols make up a greater
percentage in the North American data set, and P2P applications were a larger fraction of
traffic in Europe.
Mobile broadband is beginning to move out of its early adopter phase. Therefore, one
would expect that some of the applications seen on university networks would also be
used over wireless networks, as university students are also early adopters. High latency,
cost and bandwidth are all barriers to those applications.
First, latency can be extremely detrimental to streaming, VoIP, and gaming applications.
Although LTE/4G latency is projected to decrease, it will still be higher than on wireline
networks. There is little that MNOs can do at the base station physical and link layers to
reduce latency, so reducing it elsewhere will be a crucial factor for those applications.
Second, mobile broadband still commands a premium price over wireline broadband,
so business users would be more likely target customers than, say, P2P users. As cost
decreases and availability increases, more users will move to mobile broadband, following
a pattern similar to the migration from landline to mobile phones.
Finally, the amount of bandwidth available still lags behind wireline offerings. Using P2P
as an example, it makes little sense to pay more for a slower connection when other
options are available. Factoring those together, mobile networks simply are not ready
for the load about to be placed on them. The migration to mobile broadband will not be
business as usual.

Mobile Devices

Offloading is only a
stopgap measure,
and carriers
LTE/4G deployments
must at least keep
pace with the
rapid adoption of
smartphones and
other devices.

One nagging question remains regarding the Apple iPhone: would traffic patterns be the
same on both iPhone and non-iPhone networks with different devices? Several stories
exist about AT&Ts network being unable to handle all of the iPhone traffic, especially
when iPhone density is high.28, 29 However, AT&T is not alone. The first UK carrier to
support the iPhone, O2, has apologized for issues on its own network.30 It seems as
though there was pent-up demand for network capacity, which was realized only by the
introduction of the iPhone.
As mentioned earlier, Android traffic was up more than 50% for November and December
2009, which closely correlates to the DROID release date. Many customers choose the
iPhone either because of contractual obligations or its earlier market availability, but
the Android sales numbers show consumers are willing to choose alternative devices a
significant fraction of the time.
28 C. Kang. (2010, Jan.) Lots of iPhone/AT&T woes at CES. [Online]. http://www.washingtonpost.com/wp-dyn/
content/article/2010/01/07/AR2010010704803.html
29 Michael Calore. (2009, March) SXSW: IPhone Influx Pushes AT&T to the Limit [Updated]. [Online]. http://
www.wired.com/epicenter/2009/03/sxsw-atts-spott/
30 A. Parker. (2009, Dec.) O2 says sorry for snags in London network. [Online]. http://www.ft.com/cms/
s/0/3b911fd4-f41a-11de-ac55-00144feab49a.html

13

Now that mature handsets are mainstream, one must wonder if carriers networks will be
able to support such a large number of devices. According to Cisco, an iPhone is capable
of generating 30 times the amount of traffic of a feature phone. A laptop with a data
card generates 450 times as much data. Additionally, mobile data will double every year
through 2014.31 Network equipment manufacturers must be prepared with products that
will meet those demands as carriers upgrade their networks to handle the increased load.
Although the market share for mobile devices will be discussed later in this paper,
AdMob Mobile Metrics reports32, 33 provide two important points. The approximate traffic
breakdown of the most popular devices for an Alternate North American wireless carrier
did not change drastically from October to December, as shown in Table 5.

Distributed Denial
of Service (DDoS)
attacks are no
longer the domain
of casual vandals
but are more likely
now to be criminally
or financially
motivated.

Manufacturer

October

December

Apple

68.00%

72.00%

Samsung

11.00%

10.00%

LG

10.00%

10.00%

RIM

2.00%

2.00%

Other

2.00%

2.00%

Table 5: Alternate North American Carrier Devices

Over the same time frame, the North American wireless carrier saw a massive shift in its
traffic mix, as shown in Table 6.

Manufacturer

October

December

RIM

35.00%

10.00%

Samsung

28.00%

12.00%

LG

22.00%

9.00%

Motorola

6.00%

55.00%

Other

4.00%

2.00%

HTC

1.00%

10.00%

Table 6: North American Carrier Devices

While the traffic breakdown remained constant for the Alternate North American wireless
carrier, the North American wireless carrier shows strong growth for DROID by Motorola
and DROID ERIS by HTC devices, at 25% and 9%, respectively (Table 6). The growth can
be attributed to a combination of three factors. The first is new subscribers with new
devices. The second factor is users who switched over to one of the Android devices, as
it appears that Research in Motion (RIM), Samsung, and LG device traffic decreased on a
relative basis. Third, since these numbers are relative, the volume of traffic generated by
the Android devices reduced the relative amount of traffic from other handsets.
31

Cisco Systems. (2010, Feb.) Cisco Visual Networking Index: Global Mobile Data Traffic Forecast Update,
2009-2014. [Online]. http://www.cisco.com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/
white_paper_c11-520862.html
32 AdMob. (2009, Nov.) AdMob Mobile Metrics Report October 2009. [Online]. http://www.cisco.com/en/US/
solutions/collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11-520862.html
33 AdMob. (2010, Jan.) AdMob Mobile Metrics Report. [Online]. http://metrics.admob.com/wpcontent/
uploads/2010/01/AdMob-Mobile-Metrics-Dec-09.pdf

14

It is apparent that Android phones have caused a massive shift in data use on the North
American wireless carriers network, a shift also likely seen by AT&T with the successive
release of each iPhone model. That equates to an absolute increase in data consumption.
The AdMob data shows that for all US carriers, there were 4.983 billion requests in
October, compared to 5.545 billion requests in December, an 11.27% increase in a twomonth period.
How will carriers deal with the surge in mobile broadband consumption? Alternatives
such as femtocells and Wi-Fi offloading are available, but subscriber sentiment is varied
with regard to the different technology and location used for layers 1 and 2.33,34 There is
also an upward trend of requests using Wi-Fi connections.31, 32 If that growth continues
proportional to all mobile traffic, it seems that carriers will initially be able to add capacity
at the same rates that they are now. Unfortunately, for those carriers offering quadruple
play services, the problem is just being shifted to a wireline network. The bandwidth
problem may be solved, but the latency issues for mobile content delivery still exist.
Devices like the iPhone are accelerating demand by increasing the functional utility of
mobile networks. Subscriber usage patterns clearly show a transition from a traditional
view of mobile networks. Offloading is only a stopgap measure, and carriers LTE/4G
deployments must at least keep pace with the rapid adoption of smartphones and other
devices.8
Over time, the application mix will more closely match fixed networks. Using the mobile
traffic and application data it was given, Ixia has created Application Profiles and Super
Flows, all of which are customizable so that customer networks can be accurately
modeled, simulated and measured using BreakingPoint products. Additionally, Ixia will
deliver Application Profiles and Super Flows in future BreakingPoint Application and
Threat Intelligence (ATI) to ensure that customers have the latest models available for
mobile broadband networks.

Security Considerations for Mobile Network Operators

Mobile networks are subject to unique security threats as well as the threats faced by
traditional wireline networks. For example, Distributed Denial of Service (DDoS) attacks
are no longer the domain of casual vandals but are more likely now to be criminally or
financially motivated. A hacker, for instance, may disable a MNOs network or threaten to
do so in order to extort money. The hacker may attack a MNOs subscriber database in
order to capture exploitable personal information, as was the case in the highly publicized
attack on T-Mobile in 2004.35
Because of the constrained bandwidth available to MNOs for signaling, researchers have
theorized that a successful denial of service affecting more than a million mobile users
could be conducted from behind a single cable modem.36 Increasingly, attacks are directed
not just against bandwidth constraints but at other critical resources as attackers take aim
at firewalls, load-balancers, and back-end database infrastructures.37

Unfortunately,
for those carriers
offering quadruple
play services, the
problem is just being
shifted to a wireline
network. The
bandwidth problem
may be solved, but
the latency issues
for mobile content
delivery still exis

34 Hacker Penetrates T-Mobile Systems, SecurityFocus Online, January 11, 2005. [Online]. http://www.
securityfocus.com/news/10271
35 Hacker Penetrates T-Mobile Systems, SecurityFocus Online, January 11, 2005. [Online]. http://www.
securityfocus.com/news/10271
36 K. Sabnani. (2009, Jun.) DOS Attacks Threaten Mobile Network Security. [Online]. http://www.theregister.
co.uk/2009/06/08/mobile_dos_threat/
37 Arbor Networks. (2010 Feb.) Worldwide Infrastructure Security Report, 5th Edition [Online]. http://www.
arbornetworks.com/report

15

Validating the resiliency of MNO infrastructure deployments requires the ability to

subject infrastructure components to the well-known and growing class of wireline
security threats and the emerging set of mobile-specific attacks, within the context of
heavy legitimate mobile traffic. Only with this combination can both the resiliency of the
network components, as well as the impact of attacks on legitimate traffic, be understood.
BreakingPoints MNO partners are evaluating their current and planned deployments under
those exact conditions.

Mobile networks are

subject to unique
security threats as
well as the threats
II. Measuring Resiliency and Identifying Stress
faced by traditional
wireline networks. Fractures in Mobile Network Infrastructure

After evaluating the traffic data provided by NA and European mobile carriers, Ixia
was able to import the intelligence into its products to provide a more comprehensive
assessment of network elements to be responsible for mobile traffic. The following section
details what Ixia provides and how mobile network operators can use these products to
harden their infrastructure and provide customers with an enhanced quality of experience.
During the design, development and deployment phases, mobile carriers can reduce their
risk if they know precisely how network equipment will perform, given their specific
traffic and application mix, load and user behavior. By measuring the performance and
security claims made by network equipment vendors, mobile operators will know whether
a network device will perform as advertised in the real world.
BreakingPoint Application Simulator is a feature of BreakingPoint products that allows
users to generate real-world application traffic, using more than 200 application protocols
at realistic speeds blended with live security attacks. Nearly every major application is
supported, with more being added as requested. For realistic modeling, those applications
can be combined with more than 6,000 security strikes in a blended stream and directed
at infrastructure components. It is critical to measure infrastructure performance and
stability with that type of blended stream to accurately predict real-world behavior and
stress fractures; security threats will not be encountered in isolation, and their impact on
performance of benign traffic must be measured and understood.
BreakingPoint products use the concepts of Flows, Super Flows, and Application Profiles
to organize benign traffic. A single application protocol, client, and server define a Flow.
A Super Flow is a collection of Flows used to create a realistic application. An example of
a Super Flow would be a Web request, which is actually a DNS request (or multiple DNS
requests) combined with an HTTP request (or multiple HTTP requests).
Finally, Application Profiles are weighted collections of Super Flows used to simulate
the actual traffic mix of a network. For enhanced realism and stability testing, mobile
operators can also use BreakingPoint products to apply protocol fuzzing to valid
application traffic, intentionally injecting errors in order to stress a devices ability to deal
with malformed packet or protocol data.
BreakingPoint also includes a cyber attack library of more than 6,000 attacks and an
integrated security search capability, which lets the user define attack types (by category,
vulnerability, keyword, etc.) and automatically updates when Ixia publishes new attacks.
No manual intervention is required to subject infrastructure components to the latest
DDoS or other security threats. For example, a MNO may create a smart strike list
consisting of mobile handset vulnerabilities and threats to large core routers from the
strike library, which is updated frequently.

16

Ixia has also released a one-click BreakingPoint Resiliency Score for completely
automated resiliency measurement, and detailed Resiliency Methodologies for validating
infrastructure performance against DDoS and Botnet attacks. The combination of new
mobile-specific Super Flows and integrated fuzzing and strike capability makes resiliency
testing for MNOs a straightforward proposition with BreakingPoint.

III. Mobile Protocols and Super Flows

Based on these current mobile Application Profiles, new Super Flows were created to
enable BreakingPoint products to simulate real world stateful application and attack traffic.
Those include h.264 mp4 streaming video, the Apple App Store, BlackBerry, and Push
to Talk. Additionally, the HTTP application was modified to include support for mobile
browsers. A new HTTP mobile Super Flow was added that defaults to using a mix of
iPhone, Android, BlackBerry, Opera, Nokia, and Windows mobile devices. A customer
may choose to use one or multiple browser types.
To accurately simulate mobile browsing, the breakdown of the mobile browser had to
be determined. BreakingPoint gathered a list of the most popular mobile browsers for
November 2009 through January 2010,38, 39 and the numbers were adjusted slightly to
exclude the iPod touch, which does not have a cellular data connection.
Although the US browser market share for the iPhone is nearly double that of all
BlackBerry devices, it does not represent device market share. Instead, the amount of Web
traffic for all iPhone users is nearly twice that of all BlackBerry users. iPhones make up
around 25% of smartphones, while BlackBerry handsets have a 42% share.40 In fact, US
iPhone users consume around 273MB of data per month, while BlackBerry users consume
just 54MB,41 so the average iPhone consumption is five times that of a BlackBerry.
The situation is slightly different in Europe. First, iPhone users represent slightly less of
all Web browsing. Second, BlackBerry is a distant fourth. The prominence of the Nokia and
Opera browsers can likely be attributed to that fact that both companies began and remain
in Europe. Finally, since Opera runs on multiple hardware platforms, it could be drawing
from multiple manufacturers.
38 StatCounter.com. (2010, Feb.) Top 9 Mobile Browsers in the United States from Nov 09 to Jan 10.
[Online]. http://gs.statcounter.com/chart.php?bar=1&statType_hidden=mobile_browser&region_hid
den=US&granularity=monthly&statType=Mobile%20Browser&region=United%20States%20of%20
America&fromMonthYear=2009-11&toMonthYear=2010-01&csv=1
39 StatCounter.com. (2010, Feb.) Top 9 Mobile Browsers in Europe from Nov 09 to Jan 10. [Online]. http://
gs.statcounter.com/chart.php?bar=1&statType_hidden=mobile_browser&region_hidden=eu&granularity
=monthly&statType=Mobile%20Browser&region=Europe&fromMonthYear=2009-11&toMonthYear=201001&csv=1
40 comScore. (2010, Feb.) comScore Reports December 2009 U.S. Mobile Subscriber Market Share.
[Online]. http://www.comscore.com/Press_Events/Press_Releases/2010/2/comScore_Reports_
December_2009_U.S._Mobile_Subscriber_Market_Share
41 Consumer Reports. (2010, Feb.) Exclusive: iPhones hog much more data than other smartphones.
[Online]. http://blogs.consumerreports.org/electronics/2010/02/iphone-data-usage-smartphonessmartphonesblackberry-mb-network-att-carrier-istress.html?EXTKEY=I91CONL&CMP=OTCConsume
ristRSS

Based on these
current mobile
Application
Profiles, new
Super Flows were
created to enable
BreakingPoint
products to simulate
real world stateful
application and
attack traffic.

17

HTTP Mobile Protocol

To support those browser types, a new Super Flow had to be implemented. The new
Super Flow performs actions similar to what a mobile user would do. Mobile browsers
have matured to the point that they can deliver content as well as desktop browsers, but
their usage patterns and interaction models differ. BreakingPoint focuses on short, high
bandwidth sessions, including those as predefined options to reduce configuration effort
for users.
1. Basic Web browsing (gzipped/chunked)
2. HTTP audio download
3. Pipelined HTTP request
4. HTTP video download
Finally, to support mobile browsers, new user agents were added to the HTTP application
simulation.
1. iPhone

The new Super Flow

performs actions
similar to what a
mobile user would
do.

2. BlackBerry

a. 8310 Curve

b. 9000 Bold

c. 9630 Tour

3. Android
a. DROID by Motorola
b. HTC Dream
c. Samsung Moment
4. Nokia
a. S60
b. X3
c. E71
5. Opera

a. Mobile v9.51

b. Mini
i. v8.0
ii. v9.6
iii. v9.8

6. Windows Mobile
a. HTC Touch Pro
b. HTC Artemis

BlackBerry Services Protocol

BlackBerry devices use push e-mail and the BlackBerry Messenger service, both of which
are encrypted. Both of those are needed to simulate that service, which represented
approximately 5% of the North American traffic.

18

H.264 Streaming Protocol

The h.264 standard is used in YouTube videos for both the iPhone and the iTunes store.
Android devices also use h.264-encoded videos. The videos in this Super Flow use the
MP4 container format.

BBC iPlayer Protocol

The BBC iPlayer service is available in the UK, and it runs on several platforms, including
the Nokia S60 and Apple iPhone. BBC iPlayer also has desktop players and content,
including TV and radio shows.

IPsec Protocol
IPsec is required for IPv6. However, it was designed to be used with IPv4 as well. It can
provide IP authentication and encryption, which are useful for creating a VPN. The IPsec
traffic that was seen in those collections was ESP and/or NAT-T.

Tunneled IP Protocol from BreakingPoint

GRE, which is defined by RFC 2784, allows the creation of stateless network layer tunnels.
IP-in-IP is defined by RFC 2003 and is used specifically for tunneling IP traffic over an IP
network layer. Both GRE and IP-in-IP IP protocol numbers 47 and 4, respectively, were
seen.

Apple App Store Protocol

The Apple App Store was launched simultaneously with iPhone OS 2.0 in July 2008.
Several portions of the App Store protocol are needed to simulate iPhone traffic. While
the full protocol is proprietary, the relevant portions are browsing, purchasing, and
downloading.

Android Market Protocol

The Android Market was launched in October 2008 and is similar to the Apple App Store,
except that all of the different Android devices may access it. Although the Android Market
was only a small fraction of traffic seen, it will grow, and BreakingPoint has chosen to
create a simulation for it. As with the Apple App Store, the relevant actions are browsing,
purchasing, and downloading.

RTMP Protocol
RTMP allows for multiplexing Flash video and audio streams over TCP. Although
BreakingPoint already has support for Adobe Flash file simulation, adding RTMP provides
us with the ability to better simulate streaming Flash video and audio. Adobe released the
specification in June 2009.

19

OpenVPN Protocol
OpenVPN is an open source SSL VPN implementation using TCP or UDP with the ability to
create encrypted tunnels and work with NAT gateways.

Xbox Live Protocol

Xbox Live is the online gaming service originally created for use with the Microsoft Xbox
platform. Mobile devices will also be supported in the future, so this is an application
simulation that will continue to evolve.

IV. BreakingPoint Application Profiles

Using these Super Flows, Ixia then constructed Application Profiles to match the data.
All of those weights and values are customizable to fine-tune the application mix and
bandwidth for any simulation.

Using these Application Profile: European Wireless Carrier Full Weekday

Super Flows, Ixia 2010
then constructed Table 9 represents the top 10 applications seen in the European wireless carrier collection,
Application Profiles which comprises 87% of average daily traffic. The traffic weights are based on the
for the entire 24-hour period during which the collection was performed. The
to match the data. averages
BreakingPoint Raw Super Flow can be used to create generic TCP and UDP data and is
used here to represent the remaining traffic that is below the 1% threshold.

Super Flow
HTTP Mobile Protocol from BreakingPoint

37%

HTTP Flash Video Protocol from BreakingPoint

31%

HTTP Video Protocol from BreakingPoint

4%

HTTP Audio Protocol from BreakingPoint

2%

HTTP Compressed Protocol from BreakingPoint

4%

BitTorrent Data Transfer Protocol from BreakingPoint

3%

BBC iPlayer Protocol from BreakingPoint

2%

HTTPS Protocol from BreakingPoint

2%

Gnutella Protocol from BreakingPoint

3%

eDonkey Data Transfer Protocol from BreakingPoint

1%

BreakingPoint Raw

11%

Table 9: European Weekday Profile

20

Weight (Percentage)

Application Profile: European Wireless Carrier Daytime 2010

This profile is intended to model from 8:00 a.m. to 11:00 p.m. The values in Table 10 are
not drastically different from those in Table 9. P2P traffic is reduced during the daytime
hours, as are video and audio consumption.

Super Flow

Weight (Percentage)

HTTP Mobile Protocol from BreakingPoint

37%

HTTP Flash Video Protocol from BreakingPoint

28%

HTTP Video Protocol from BreakingPoint

3%

HTTP Audio Protocol from BreakingPoint

2%

HTTP Compressed Protocol from BreakingPoint

4%

BitTorrent Data Transfer Protocol from BreakingPoint

3%

BBC iPlayer Protocol from BreakingPoint

2%

HTTPS Protocol from BreakingPoint

2%

Gnutella Protocol from BreakingPoint

1%

BreakingPoint Raw

18%

Table 10: European Daytime Profile

Application Profile: European Wireless Carrier Weeknight 2010

This profile is intended to model from 11:00 p.m. to 8:00 a.m. The main changes are the
rise in P2P traffic and video/audio traffic, which would correspond to a rise in afterwork recreational Internet use. The reason that P2P is not higher is that there is an
extended ramp-down time, from 11:00 p.m. to around 1:00 a.m., which causes the weight
for BitTorrent to be skewed lower. Without this ramp-down period, the weight would be
around 35% for BitTorrent.

Super Flow

Weight (Percentage)

HTTP Mobile Protocol from BreakingPoint

29%

HTTP Flash Video Protocol from BreakingPoint

32%

HTTP Video Protocol from BreakingPoint

5%

HTTP Audio Protocol from BreakingPoint

4%

HTTP Compressed Protocol from BreakingPoint

4%

BitTorrent Data Transfer Protocol from BreakingPoint

6%

BBC iPlayer Protocol from BreakingPoint

1%

HTTPS Protocol from BreakingPoint

1%

Gnutella Protocol from BreakingPoint

1%

eDonkey Data Transfer Protocol from BreakingPoint

1%

BreakingPoint Raw

16%

Table 11: European Weeknight Profile

21

Application Profile: North American Wireless Carrier Weekday

2010
In Table 12, weights greater than 100 have been used to provide a richer application mix.
Dividing the weight and the sum of all weights and then multiplying by 100 will determine
the actual percentage. That will allow Super Flows below a 1% threshold. In this example,
the weights sum to 10,000, so they will correlate directly to percentages. So HTTP Mobile
Protocol will be 77.03% of traffic, while AOL Instant Messenger set at .12%

Super Flow
HTTP Mobile Protocol from BreakingPoint

7703

BlackBerry ServicesProtocol from BreakingPoint

514

RTMP Protocol from BreakingPoint

343

IPsec ESP Protocol from BreakingPoint

295

POP3-Advanced over SSL Protocol from BreakingPoint

143

Tunneled IP Protocol from BreakingPoint

143

RTSP Protocol from BreakingPoint

88

BitTorrent Data Transfer Protocol from BreakingPoint

76

POP3-Advanced Protocol from BreakingPoint

74

SIP/RTP Simple Call Protocol from BreakingPoint

44

SMTP Email Protocol from BreakingPoint

43

IMAPv4-Advanced Protocol from BreakingPoint

39

IMAPv4-Advanced over SSL Protocol from BreakingPoint

38

IPsec NAT-T Protocol from BreakingPoint

28

Android Market Protocol from BreakingPoint

28

SMTP Email over SSL Protocol from BreakingPoint

17

World of Warcraft Protocol from BreakingPoint

15

NNTP Protocol from BreakingPoint

14

AOL Instant Messenger Protocol from BreakingPoint

12

Open VPN Protocol from BreakingPoint

11

Xbox Live Protocol from BreakingPoint

10

BreakingPoint Raw

312

Table 12: North American Weekday Profile

22

Weight

Application Profile: North American Wireless Carrier Daytime

2010
As with the European daytime profile, entertainment applications have a reduced daytime
presence. Gaming has been removed, and BitTorrent has been reduced from .78% to .5%.
Mail was increased to 5.89% total0.5% each for POP3/POP3s, IMAP/IMAPs and SMTP.

Super Flow

Weight

HTTP Mobile Protocol from BreakingPoint

7703

BlackBerry ServicesProtocol from BreakingPoint

514

RTMP Protocol from BreakingPoint

343

IPsec ESP Protocol from BreakingPoint

295

POP3-Advanced over SSL Protocol from BreakingPoint

195

Tunneled IP Protocol from BreakingPoint

143

POP3-Advanced Protocol from BreakingPoint

124

SMTP Email Protocol from BreakingPoint

93

IMAPv4-Advanced Protocol from BreakingPoint

89

IMAPv4-Advanced over SSL Protocol from BreakingPoint

88

RTSP Protocol from BreakingPoint

88

BitTorrent Data Transfer Protocol from BreakingPoint

50

SIP/RTP Simple Call Protocol from BreakingPoint

44

IPsec NAT-T Protocol from BreakingPoint

34

Android Market Protocol from BreakingPoint

28

SMTP Email over SSL Protocol from BreakingPoint

17

NNTP Protocol from BreakingPoint

14

AOL Instant Messenger Protocol from BreakingPoint

12

Open VPN Protocol from BreakingPoint

11

BreakingPoint Raw

291

As with the
European
daytime profile,
entertainment
applications have
a reduced daytime
presence.

Table 13: North American Daytime Profile

23

Application Profile: North American Wireless Carrier Weeknight

2010
Email has been reduced to 1.64%, and gaming and P2P have both increased by 1%.

Super Flow

Weight

HTTP Mobile Protocol from BreakingPoint

7703

BlackBerry ServicesProtocol from BreakingPoint

514

RTMP Protocol from BreakingPoint

343

IPsec ESP Protocol from BreakingPoint

295

BitTorrent Data Transfer Protocol from BreakingPoint

Tunneled IP Protocol from BreakingPoint

143

POP3-Advanced over SSL Protocol from BreakingPoint

143

RTSP Protocol from BreakingPoint

88

World of Warcraft Protocol from BreakingPoint

15

Xbox Live Protocol from BreakingPoint

10

SIP/RTP Simple Call Protocol from BreakingPoint

44

IPsec NAT-T Protocol from BreakingPoint

28

Android Market Protocol from BreakingPoint

28

POP3-Advanced Protocol from BreakingPoint

74

SMTP Email Protocol from BreakingPoint

43

SMTP Email over SSL Protocol from BreakingPoint

17

IMAPv4-Advanced Protocol from BreakingPoint

39

NNTP Protocol from BreakingPoint

14

IMAPv4-Advanced over SSL Protocol from BreakingPoint

38

AOL Instant Messenger Protocol from BreakingPoint

12

Open VPN Protocol from BreakingPoint

11

BreakingPoint Raw

312

Table 14: North American Weeknight Profile

24

V. Conclusion
Mobile carriers may be investing more than $72B into infrastructure in 2010,42 but are they
spending it in the right places? The data contained in this paper indicates where mobile
carriers should concern themselves when committing dollars to their infrastructure.
As is clearly apparent from BreahkingPoints examination of traffic data from major
European and North American mobile carriers, mobile network traffic is changing
dramatically. Mobile phones have evolved from voice and simple Web browsing into mini
computers and gaming platforms running bandwidth-intensive applications like video,
VoIP, P2P and multi-player games. The mobile carrier traffic BreakingPoint reviewed
also shows that mobile broadband data consumption is trending beyond traditional fixednetwork traffic and is plagued by both mobile-specific and traditional wireline security
threats. The problem is only compounded by the release of more feature-rich smartphones
and tablets and the adoption of laptop data dongles, which offer both heavy bandwidth
demands and malware target opportunities.
Beyond the unique distinctions of mobile network traffic, network outages make it
evident that carriers must begin viewing their infrastructure in a different manner. To
avoid trafficand security-related outages, mobile carriers must be prepared to handle
the increased load on their networks from smartphone and tablet devices. The volume
of data and complexity of those devices is much greater than that of traditional phones.
That does not mean simply building out more infrastructure. In fact, it points to validating
network equipment and systems based on the mobile network traffic mix and patterns
presented in this paper. With an increasing set of mobile devices and a shift toward
latency-intolerant traffic, it is critical that MNOs thoroughly measure the resiliency of their
network infrastructure components. That must be accomplished using a real-world blend
of mobile-specific and fixed network traffic and security threats prior to deployment or
service rollouts in production.
In response, Ixia has created new application simulations and Super Flows that match
the real traffic profiles of mobile network operators during different times of the day.
By blending those traffic flows with BreakingPoint protocol fuzzing and thousands
of BreakingPoint security attacks, MNOs and equipment manufacturers can quickly
expose the vulnerabilities and weaknesses hidden throughout their infrastructure. With
the weakness and vulnerabilities identified, MNOs are able to take the remedial action
necessary to ensure highly resilient services and devices.

The data contained

in this paper
indicates where
mobile carriers
should concern
themselves
when committing
dollars to their
infrastructure.

42 GSMA (2010, Feb.) Mobile Broadband Investment Set to Soar as HSPA Connections Pass 200 Million
[Online]. http://www.mobileworldlive.com/mobile-broadband-investment-set-to-soar-as-hspa-connectionspass-200-million

25

VI. Glossary
3G: The family of ITU standards known as International Mobile Telecommunications-2000.
Typical download throughput 200Kbps2 Mbps.43
4G: Next-generation network standards pertaining to IMT-Advanced. Minimum expected
download throughput between 20100Mbps. LTE-Advanced and WiMAX are both efforts to
meet IMT-Advanced requirements.44
ESP: Encapsulating Security Payload, IP protocol 50, an IPsec protocol that provides
confidentiality, and optionally, authentication.
GRE: Generic Routing Encapsulation, an IP tunneling protocol created by Cisco Systems.
LTE: Long Term Evolution, an evolutionary approach to upgraded 3G networks that
provides increased data rates and allows MNOs to support increased numbers of users.
LTE-Advanced: Further evolution of LTE to comply with IMT-Advanced requirements and
support download rates of up to 1Gbps.45
MDI: Media Delivery Index, a measure of multimedia content delivery quality that measures
loss and jitter in a network.
MNO: Mobile network operator. Used interchangeably with Mobile Carrier.
Mobile broadband: Broadband, as defined by the ITU, is transmission capacity that is
faster than primary rate Integrated Services Digital Network (ISDN) at 1.5 or 2.0 Megabits
per second (Mbits).46 Here we refer to 3G and later technologies as mobile broadband.
MOS: Mean opinion score, a quality of experience rating for multimedia content delivery.
MVNO: Mobile Virtual Network Operator. A mobile service operator without licensed
spectrum or network that leases wireless capacity from other carriers to resell to end
customers.47
NAT-T: Network Address Translation Traversal, a method of enabling hosts behind NAT
gateways to use IPsec.
Petabyte: 1015 bytes, or 1,000 terabytes.
43 International Telecommunication Union. (2008, Jul.) What really is a Third Generation (3G) Mobile
Technology. [Online]. http://www.itu.int/ITU-D/imt-2000/DocumentsIMT2000/What_really_3G.pdf
44 3G Americas. (2008, Oct.) Defining 4G: Understanding the ITU Process for the Next Generation of Wireless
Technology.
45 T. Nakamura. (2009, Oct.) Proposal for Candidate Radio Interface Technologies for IMT Advanced Based on
LTE Release 10 and Beyond (LTEAdvanced). [Online]. http://www.3gpp.org/IMG/pdf/2009_10_3gpp_IMT.
pdf
46 International Telecommunication Union. (2003, Sept.) The Birth of Broadband Frequently Asked Questions.
[Online]. http://www.itu.int/osg/spu/publications/birthofbroadband/faq.html
47 TELUS. Glossary. [Online]. http://about.telus.com/investors/en/glossary.html

26

Smartphone: An advanced mobile device or personal digital assistant (PDA) that provides
text messaging, e-mail, multimedia downloads, and social networking (e.g., Facebook
Mobile) functionality in addition to voice.47
Terabyte: 1012 bytes, or 1,000 gigabytes.
WiMAX: Worldwide Interoperability for Microwave Access, a 4G technology defined in IEEE
802.16-2004 and IEEE 802.16e-2005.

27

WHITE PAPER

915-3114-01 Rev. B, December 2013