GTP Inspect Inspector

GTP Inspect Inspector Overview

Type	Inspector (service)
Usage	Inspect
Instance Type	Multiton
Other Inspectors Required	`stream_udp`
Enabled	`false`

The General Service Packet Radio (GPRS) Tunneling Protocol (GTP) provides communication over a GTP core network.

The gtp_inspect inspector detects anomalies in GTP traffic and forwards command channel signaling messages to the rules engine for inspection.

GTP Inspect Inspector Parameters

GTP Inspect service and ports configuration

The binder inspector defines the GTP Inspect service and ports configuration. For more information, see the Binder Inspector Overview.

Example:

[
   {
       "when": {
           "service": "gtp_inspect",
           "role": any
       },
       "use": {
           "type": "gtp_inspect"
       }
   },
   {
       "when": {
           "proto": "tcp",
           "role": "server",
           "ports": "2123 2152 3386"
       },
       "use": {
           "type": "gtp_inspect"
       }
   }
]

version

Specifies a valid GTP version.

Type: integer

Valid values: 0, 1, 2

Default value: 2

messages[]

Specifies an array of information about valid GTP messages.

Type: array (object)

Example:

{
    messages: [
        {
            "type": 0,
            "name": ""
        }
    ]
}

messages[].type

Specifies a valid GTP message type. See GTP Message Types table.

Type: integer

Valid range: 0 to 255

Default value: None

messages[].name

Specifies a valid GTP message name. See GTP Message Types table.

Type: string

Valid values: A valid GTP message name

Default value: None

infos[]

Specifies an array of GTP information elements.

Type: array (object)

Example:

{
    infos: [
        {
            "type": 0,
            "name": "echo_request",
            "length": 0
        }
    ]
}

infos[].type

Specifies a valid GTP element type code. See GTP Information Elements table.

Type: integer

Valid range: 0 to 255

Default value: 0

infos[].name

Specifies a valid GTP element name.

Type: string

Valid values: Valid GTP information element names. See GTP Information Elements table.

infos[].length

Specifies the length of a valid GTP information element.

Type: integer

Valid range: 0 to 255

Default value: 0

GTP Inspect Inspector Rules

Enable the gtp_inspect inspector rules to generate events and, in an inline deployment, drop offending packets.

Table 1. GTP Inspector Rules
GID:SID	Rule Message
143:1	message length is invalid
143:2	information element length is invalid
143:3	information elements are out of order
143:4	TEID is missing

GTP Inspect Inspector Intrusion Rule Options

The gtp_inspect inspector intrusion rule options allow you to inspect the GTP command channel for the GTP version, message type, and information elements.

You cannot use GTP options in combination with content or byte_jump. You must use gtp_version in each rule that uses gtp_info or gtp_type.

gtp_version

Check the specified GTP version against the version of the GTP control messages.

Type: integer

Syntax: gtp_version: <version>;

Valid values: 0, 1, 2

Examples: gtp_version: 1;

gtp_type

Each GTP message is identified by a message type, which is comprised of both a numeric value and a string. Check the specified GTP types against the type of the GTP messages.

You can specify a defined decimal value for a message type, a defined string, or a comma-separated list of either or both in any combination, as seen in the following example:

Type: string

Syntax: gtp_type: <message_type>;

Valid values: Listed in the GTP Message Types table. See GTP Message Types table.

Examples: gtp_type: "10, 11, echo_request";

The system uses an OR operation to match each value or string that you list. The order in which you list values and strings does not matter. Any single value or string in the list matches the keyword. The system generates an error if you attempt to save a rule that includes an unrecognized string or an out-of-range value.

Note that different GTP versions sometimes use different values for the same message type. For example, the sgsn_context_request message type has a value of 50 in GTPv0 and GTPv1, but a value of 130 in GTPv2.

The gtp_type option matches different values depending on the version number in the packet. For instance the sgsn_context_request message matches the value 50 in a GTPv0 or GTPv1 packet and the value 130 in a GTPv2 packet. The option does not match a packet when the message type value in the packet is not a known value for the version specified in the packet.

If you specify an integer for the message type, the option matches if the message type matches the value in the GTP packet, regardless of the version specified in the packet.

gtp_message_type is a numeric value or keyword from the GTP Message Types table.

Table 2. GTP Message Types
Type	Name for Version 0	Name for Version 1	Name for Version 2
`1`	`echo_request`	`echo_request`	`echo_request`
`2`	`echo_response`	`echo_response`	`echo_response`
`3`	`version_not_supported`	`version_not_supported`	`version_not_supported`
`4`	`node_alive_request`	`node_alive_request`	N/A
`5`	`node_alive_response`	`node_alive_response`	N/A
`6`	`redirection_request`	`redirection_request`	N/A
`7`	`redirection_response`	`redirection_response`	N/A
`16`	`create_pdp_context_request`	`create_pdp_context_request`	N/A
`17`	`create_pdp_context_response`	`create_pdp_context_response`	N/A
`18`	`update_pdp_context_request`	`update_pdp_context_request`	N/A
`19`	`update_pdp_context_response`	`update_pdp_context_response`	N/A
`20`	`delete_pdp_context_request`	`delete_pdp_context_request`	N/A
`21`	`delete_pdp_context_response`	`delete_pdp_context_response`	N/A
`22`	`create_aa_pdp_context_request`	`init_pdp_context_activation_request`	N/A
`23`	`create_aa_pdp_context_response`	`init_pdp_context_activation_response`	N/A
`24`	`delete_aa_pdp_context_request`	N/A	N/A
`25`	`delete_aa_pdp_context_response`	N/A	N/A
`26`	`error_indication`	`error_indication`	N/A
`27`	`pdu_notification_request`	`pdu_notification_request`	N/A
`28`	`pdu_notification_response`	`pdu_notification_response`	N/A
`29`	`pdu_notification_reject_request`	`pdu_notification_reject_request`	N/A
`30`	`pdu_notification_reject_response`	`pdu_notification_reject_response`	N/A
`31`	N/A	`supported_ext_header_notification`	N/A
`32`	`send_routing_info_request`	`send_routing_info_request`	`create_session_request`
`33`	`send_routing_info_response`	`send_routing_info_response`	`create_session_response`
`34`	`failure_report_request`	`failure_report_request`	`modify_bearer_request`
`35`	`failure_report_response`	`failure_report_response`	`modify_bearer_response`
`36`	`note_ms_present_request`	`note_ms_present_request`	`delete_session_request`
`37`	`note_ms_present_response`	`note_ms_present_response`	`delete_session_response`
`38`	N/A	N/A	`change_notification_request`
`39`	N/A	N/A	`change_notification_response`
`48`	`identification_request`	`identification_request`	N/A
`49`	`identification_response`	`identification_response`	N/A
`50`	`sgsn_context_request`	`sgsn_context_request`	N/A
`51`	`sgsn_context_response`	`sgsn_context_response`	N/A
`52`	`sgsn_context_ack`	`sgsn_context_ack`	N/A
`53`	N/A	`forward_relocation_request`	N/A
`54`	N/A	`forward_relocation_response`	N/A
`55`	N/A	`forward_relocation_complete`	N/A
`56`	N/A	`relocation_cancel_request`	N/A
`57`	N/A	`relocation_cancel_response`	N/A
`58`	N/A	`forward_srns_contex`	N/A
`59`	N/A	`forward_relocation_complete_ack`	N/A
`60`	N/A	`forward_srns_contex_ack`	N/A
`64`	N/A	N/A	`modify_bearer_command`
`65`	N/A	N/A	`modify_bearer_failure_indication`
`66`	N/A	N/A	`delete_bearer_command`
`67`	N/A	N/A	`delete_bearer_failure_indication`
`68`	N/A	N/A	`bearer_resource_command`
`69`	N/A	N/A	`bearer_resource_failure_indication`
`70`	N/A	`ran_info_relay`	`downlink_failure_indication`
`71`	N/A	N/A	`trace_session_activation`
`72`	N/A	N/A	`trace_session_deactivation`
`73`	N/A	N/A	`stop_paging_indication`
`95`	N/A	N/A	`create_bearer_request`
`96`	N/A	`mbms_notification_request`	`create_bearer_response`
`97`	N/A	`mbms_notification_response`	`update_bearer_request`
`98`	N/A	`mbms_notification_reject_request`	`update_bearer_response`
`99`	N/A	`mbms_notification_reject_response`	`delete_bearer_request`
`100`	N/A	`create_mbms_context_request`	`delete_bearer_response`
`101`	N/A	`create_mbms_context_response`	`delete_pdn_request`
`102`	N/A	`update_mbms_context_request`	`delete_pdn_response`
`103`	N/A	`update_mbms_context_response`	N/A
`104`	N/A	`delete_mbms_context_request`	N/A
`105`	N/A	`delete_mbms_context_response`	N/A
`112`	N/A	`mbms_register_request`	N/A
`113`	N/A	`mbms_register_response`	N/A
`114`	N/A	`mbms_deregister_request`	N/A
`115`	N/A	`mbms_deregister_response`	N/A
`116`	N/A	`mbms_session_start_request`	N/A
`117`	N/A	`mbms_session_start_response`	N/A
`118`	N/A	`mbms_session_stop_request`	N/A
`119`	N/A	`mbms_session_stop_response`	N/A
`120`	N/A	`mbms_session_update_request`	N/A
`121`	N/A	`mbms_session_update_response`	N/A
`128`	N/A	`ms_info_change_request`	`identification_request`
`129`	N/A	`ms_info_change_response`	`identification_response`
`130`	N/A	N/A	`sgsn_context_request`
`131`	N/A	N/A	`sgsn_context_response`
`132`	N/A	N/A	`sgsn_context_ack`
`133`	N/A	N/A	`forward_relocation_request`
`134`	N/A	N/A	`forward_relocation_response`
`135`	N/A	N/A	`forward_relocation_complete`
`136`	N/A	N/A	`forward_relocation_complete_ack`
`137`	N/A	N/A	`forward_access`
`138`	N/A	N/A	`forward_access_ack`
`139`	N/A	N/A	`relocation_cancel_request`
`140`	N/A	N/A	`relocation_cancel_response`
`141`	N/A	N/A	`configuration_transfer_tunnel`
`149`	N/A	N/A	`detach`
`150`	N/A	N/A	`detach_ack`
`151`	N/A	N/A	`cs_paging`
`152`	N/A	N/A	`ran_info_relay`
`153`	N/A	N/A	`alert_mme`
`154`	N/A	N/A	`alert_mme_ack`
`155`	N/A	N/A	`ue_activity`
`156`	N/A	N/A	`ue_activity_ack`
`160`	N/A	N/A	`create_forward_tunnel_request`
`161`	N/A	N/A	`create_forward_tunnel_response`
`162`	N/A	N/A	`suspend`
`163`	N/A	N/A	`suspend_ack`
`164`	N/A	N/A	`resume`
`165`	N/A	N/A	`resume_ack`
`166`	N/A	N/A	`create_indirect_forward_tunnel_request`
`167`	N/A	N/A	`create_indirect_forward_tunnel_response`
`168`	N/A	N/A	`delete_indirect_forward_tunnel_request`
`169`	N/A	N/A	`delete_indirect_forward_tunnel_response`
`170`	N/A	N/A	`release_access_bearer_request`
`171`	N/A	N/A	`release_access_bearer_response`
`176`	N/A	N/A	`downlink_data`
`177`	N/A	N/A	`downlink_data_ack`
`179`	N/A	N/A	`pgw_restart`
`180`	N/A	N/A	`pgw_restart_ack`
`200`	N/A	N/A	`update_pdn_request`
`201`	N/A	N/A	`update_pdn_response`
`211`	N/A	N/A	`modify_access_bearer_request`
`212`	N/A	N/A	`modify_access_bearer_response`
`231`	N/A	N/A	`mbms_session_start_request`
`232`	N/A	N/A	`mbms_session_start_response`
`233`	N/A	N/A	`mbms_session_update_request`
`234`	N/A	N/A	`mbms_session_update_response`
`235`	N/A	N/A	`mbms_session_stop_request`
`236`	N/A	N/A	`mbms_session_stop_response`
`240`	`data_record_transfer_request`	`data_record_transfer_request`	N/A
`241`	`data_record_transfer_response`	`data_record_transfer_response`	N/A
`254`	N/A	`end_marker`	N/A
`255`	`pdu`	`pdu`	N/A

gtp_info

A GTP message can include multiple information elements, each of which is identified by both a defined numeric value and a defined string. You can use the gtp_info option to start inspection at the beginning of a specified information element, and restrict inspection to that information element.

You can specify either the defined decimal value or the defined string for an information element. You can specify a single value or string, and you can use multiple gtp_info options in a rule to inspect multiple information elements.

When a message includes multiple information elements of the same type, all are inspected for a match. When information elements occur in an invalid order, only the last instance is inspected.

Depending on the version, a GTP message can use different values for the same information element. For example, the cause information element has a value of 1 in GTPv0 and GTPv1, but a value of 2 in GTPv2.

The gtp_info option matches different values depending on the version number in the packet. In the example above, the keyword matches the information element value 1 in a GTPv0 or GTPv1 packet and the value 2 in a GTPv2 packet. The option does not match a packet when the information element value in the packet is not a known value for the version specified in the packet.

If you specify an integer for the information element, the option matches if the message type matches the value in the GTP packet, regardless of the version specified in the packet.

Type: string

Syntax: gtp_info: <identifier>;

Valid values: Listed in the GTP Information Elements table.

Examples: gtp_info: "qos";

Table 3. GTP Information Elements
Type	Name for Version 0	Name for Version 1	Name for Version 2
`1`	`cause`	`cause`	`imsi`
`2`	`imsi`	`imsi`	`cause`
`3`	`rai`	`rai`	`recovery`
`4`	`tlli`	`tlli`	N/A
`5`	`p_tmsi`	`p_tmsi`	N/A
`6`	`qos`	N/A	N/A
`8`	`recording_required`	`recording_required`	N/A
`9`	`authentication`	`authentication`	N/A
`10`	N/A	N/A	N/A
`11`	`map_cause`	`map_cause`	N/A
`12`	`p_tmsi_sig`	`p_tmsi_sig`	N/A
`13`	`ms_validated`	`ms_validated`	N/A
`14`	`recovery`	`recovery`	N/A
`15`	`selection_mode`	`selection_mode`	N/A
`16`	`flow_label_data_1`	`teid_1`	N/A
`17`	`flow_label_signalling`	`teid_control`	N/A
`18`	`flow_label_data_2`	`teid_2`	N/A
`19`	`ms_unreachable`	`teardown_ind`	N/A
`20`	N/A	`nsapi`	N/A
`21`	N/A	`ranap`	N/A
`22`	N/A	`rab_context`	N/A
`23`	N/A	`radio_priority_sms`	N/A
`24`	N/A	`radio_priority`	N/A
`25`	N/A	`packet_flow_id`	N/A
`26`	N/A	`charging_char`	N/A
`27`	N/A	`trace_ref`	N/A
`28`	N/A	`trace_type`	N/A
`29`	N/A	`ms_unreachable`	N/A
`71`	N/A	N/A	`apn`
`72`	N/A	N/A	`ambr`
`73`	N/A	N/A	`ebi`
`74`	N/A	N/A	`ip_addr`
`75`	N/A	N/A	`mei`
`76`	N/A	N/A	`msisdn`
`77`	N/A	N/A	`indication`
`78`	N/A	N/A	`pco`
`79`	N/A	N/A	`paa`
`80`	N/A	N/A	`bearer_qos`
`80`	N/A	N/A	`flow_qos`
`82`	N/A	N/A	`rat_type`
`83`	N/A	N/A	`serving_network`
`84`	N/A	N/A	`bearer_tft`
`85`	N/A	N/A	`tad`
`86`	N/A	N/A	`uli`
`87`	N/A	N/A	`f_teid`
`88`	N/A	N/A	`tmsi`
`89`	N/A	N/A	`cn_id`
`90`	N/A	N/A	`s103pdf`
`91`	N/A	N/A	`s1udf`
`92`	N/A	N/A	`delay_value`
`93`	N/A	N/A	`bearer_context`
`94`	N/A	N/A	`charging_id`
`95`	N/A	N/A	`charging_char`
`96`	N/A	N/A	`trace_info`
`97`	N/A	N/A	`bearer_flag`
`99`	N/A	N/A	`pdn_type`
`100`	N/A	N/A	`pti`
`101`	N/A	N/A	`drx_parameter`
103	N/A	N/A	`gsm_key_tri`
`104`	N/A	N/A	`umts_key_cipher_quin`
`105`	N/A	N/A	`gsm_key_cipher_quin`
`106`	N/A	N/A	`umts_key_quin`
`107`	N/A	N/A	`eps_quad`
`108`	N/A	N/A	`umts_key_quad_quin`
`109`	N/A	N/A	`pdn_connection`
`110`	N/A	N/A	`pdn_number`
`111`	N/A	N/A	`p_tmsi`
`112`	N/A	N/A	`p_tmsi_sig`
`113`	N/A	N/A	`hop_counter`
`114`	N/A	N/A	`ue_time_zone`
`115`	N/A	N/A	`trace_ref`
`116`	N/A	N/A	`complete_request_msg`
`117`	N/A	N/A	`guti`
`118`	N/A	N/A	`f_container`
`119`	N/A	N/A	`f_cause`
`120`	N/A	N/A	`plmn_id`
`121`	N/A	N/A	`target_id`
`123`	N/A	N/A	`packet_flow_id`
`124`	N/A	N/A	`rab_contex`
`125`	N/A	N/A	`src_rnc_pdcp`
`126`	N/A	N/A	`udp_src_port`
`127`	`charge_id`	`charge_id`	`apn_restriction`
`128`	`end_user_address`	`end_user_address`	`selection_mode`
`129`	`mm_context`	`mm_context`	`src_id`
`130`	`pdp_context`	`pdp_context`	N/A
`131`	`apn`	`apn`	`change_report_action`
`132`	`protocol_config`	`protocol_config`	`fq_csid`
`133`	`gsn`	`gsn`	`channel`
`134`	`msisdn`	`msisdn`	`emlpp_pri`
`135`	N/A	`qos`	`node_type`
`136`	N/A	`authentication_qu`	`fqdn`
`137`	N/A	`tft`	`ti`
`138`	N/A	`target_id`	`mbms_session_duration`
`139`	N/A	`utran_trans`	`mbms_service_area`
`140`	N/A	`rab_setup`	`mbms_session_id`
`141`	N/A	`ext_header`	`mbms_flow_id`
`142`	N/A	`trigger_id`	`mbms_ip_multicast`
`143`	N/A	`omc_id`	`mbms_distribution_ack`
`144`	N/A	`ran_trans`	`rfsp_index`
`145`	N/A	`pdp_context_pri`	`uci`
`146`	N/A	`addi_rab_setup`	`csg_info`
`147`	N/A	`sgsn_number`	`csg_id`
`148`	N/A	`common_flag`	`cmi`
`149`	N/A	`apn_restriction`	`service_indicator`
`150`	N/A	`radio_priority_lcs`	`detach_type`
`151`	N/A	`rat_type`	`ldn`
`152`	N/A	`user_loc_info`	`node_feature`
`153`	N/A	`ms_time_zone`	`mbms_time_to_transfer`
`154`	N/A	`imei_sv`	`throttling`
`155`	N/A	`camel`	`arp`
`156`	N/A	`mbms_ue_context`	`epc_timer`
`157`	N/A	`tmp_mobile_group_id`	`signalling_priority_indication`
`158`	N/A	`rim_routing_addr`	`tmgi`
`159`	N/A	`mbms_config`	`mm_srvcc`
`160`	N/A	`mbms_service_area`	`flags_srvcc`
`161`	N/A	`src_rnc_pdcp`	`nmbr`
`162`	N/A	`addi_trace_info`	N/A
`163`	N/A	`hop_counter`	N/A
`164`	N/A	`plmn_id`	N/A
`165`	N/A	`mbms_session_id`	N/A
`166`	N/A	`mbms_2g3g_indicator`	N/A
`167`	N/A	`enhanced_nsapi`	N/A
`168`	N/A	`mbms_session_duration`	N/A
`169`	N/A	`addi_mbms_trace_info`	N/A
`170`	N/A	`mbms_session_repetition_num`	N/A
`171`	N/A	`mbms_time_to_data`	N/A
`173`	N/A	`bss`	N/A
`174`	N/A	`cell_id`	N/A
`175`	N/A	`pdu_num`	N/A
`177`	N/A	`mbms_bearer_capab`	N/A
`178`	N/A	`rim_routing_disc`	N/A
`179`	N/A	`list_pfc`	N/A
`180`	N/A	`ps_xid`	N/A
`181`	N/A	`ms_info_change_report`	N/A
`182`	N/A	`direct_tunnel_flags`	N/A
`183`	N/A	`correlation_id`	N/A
`184`	N/A	`bearer_control_mode`	N/A
`185`	N/A	`mbms_flow_id`	N/A
`186`	N/A	`mbms_ip_multicast`	N/A
`187`	N/A	`mbms_distribution_ack`	N/A
`188`	N/A	`reliable_inter_rat_handover`	N/A
`189`	N/A	`rfsp_index`	N/A
`190`	N/A	`fqdn`	N/A
`191`	N/A	`evolved_allocation1`	N/A
`192`	N/A	`evolved_allocation2`	N/A
`193`	N/A	`extended_flags`	N/A
`194`	N/A	`uci`	N/A
`195`	N/A	`csg_info`	N/A
`196`	N/A	`csg_id`	N/A
`197`	N/A	`cmi`	N/A
`198`	N/A	`apn_ambr`	N/A
`199`	N/A	`ue_network`	N/A
`200`	N/A	`ue_ambr`	N/A
`201`	N/A	`apn_ambr_nsapi`	N/A
`202`	N/A	`ggsn_backoff_timer`	N/A
`203`	N/A	`signalling_priority_indication`	N/A
`204`	N/A	`signalling_priority_indication_nsapi`	N/A
`205`	N/A	`high_bitrate`	N/A
`206`	N/A	`max_mbr`	N/A
`251`	`charging_gateway_addr`	`charging_gateway_addr`	N/A
`255`	`private_extension`	`private_extension`	`private_extension`

Snort 3 Inspector Reference

Bias-Free Language

Book Title

Snort 3 Inspector Reference

Chapter Title

GTP Inspect Inspector

Results

Chapter: GTP Inspect Inspector

GTP Inspect Inspector

GTP Inspect Inspector Overview

GTP Inspect Inspector Parameters

GTP Inspect service and ports configuration

version

messages[]

messages[].type

messages[].name

infos[]

infos[].type

infos[].name

infos[].length

GTP Inspect Inspector Rules

GTP Inspect Inspector Intrusion Rule Options

gtp_version

gtp_type

gtp_info

Was this Document Helpful?

Contact Cisco