Appearance
Telecom and O-RAN Overview
The telecom sensor flavor adds network function role detection, 5G and O-RAN protocol parsing, per-NF SLO monitoring, and WG11 compliance evidence to the standard Telovix sensor.
Requires: Telecom sensor flavor and
telecomConsole vertical. See Standard vs Telecom Flavor to confirm your setup.
Where to start
| If you are... | Start here |
|---|---|
| Deploying the telecom sensor for the first time | Standard vs Telecom Flavor to choose the correct binary, then Sensor: VM / Bare Metal or Sensor: Kubernetes (Helm) |
| Monitoring AMF, SMF, or UPF (5G Core) | 5G Core (AMF / SMF / UPF) |
| Monitoring O-DU, gNB-CU, or Near-RT RIC (O-RAN) | O-RAN Architecture (DU / CU / RIC) |
| Monitoring GTP-U tunnels and PFCP sessions (user plane) | User Plane (GTP-U / PFCP) |
| Monitoring NGAP, F1AP, or E2AP (RAN signaling) | RAN Signaling (NGAP / F1AP / E2AP) |
| Checking NF availability and SLO breach status | SLO and Resource Monitoring |
| Evaluating O-RAN WG11 compliance posture | O-RAN WG11 Compliance |
| Verifying that specific detections fire on O-RAN nodes | Threat Exercises |
| Diagnosing opaque TLS coverage on SBI interfaces | TLS Visibility |
| Monitoring Diameter, RADIUS, or SIP in a mixed 4G/5G environment | Legacy Protocols (Diameter / RADIUS / SIP) |
What the telecom flavor adds
When you deploy the telecom sensor and enable the telecom Console vertical, the following capabilities become active:
On the sensor:
- NF role detection from port binding patterns, process names, binary paths, and gRPC service detection
- Protocol parsing for NGAP, PFCP, GTP-U, F1AP, E1AP, XnAP, E2AP, SCTP, Diameter, RADIUS, SIP, SBI/HTTP2, NAS5G, M3UA, IKEv2
- Per-NF SLO monitoring with breach detection and MTTR tracking
- TLS uprobe coverage for NF-to-NF encrypted traffic (OpenSSL, Go TLS, BoringSSL)
- O-RAN WG11 security checks (E2 peer verification, O1 management interface monitoring, xApp baseline)
- NF-specific process integrity monitoring and privilege escalation detection
- Telecom anomaly scoring combining protocol violations, SLO breaches, and behavioral signals
In the Console:
- The Telco navigation section (hidden on
standardvertical) - Fleet filtering and grouping by NF role
- Protocol KPI dashboards (NGAP procedure success rates, PFCP session metrics)
- NF resource history (hourly CPU, memory, power per role)
- O-RAN WG11 compliance framework
- AI assistant telecom tools (NGAP KPIs, SLO status, telco snapshot, NF inventory)
NF role detection
The sensor detects the network function role of running processes automatically using four signal types:
1. Port binding analysis
| Port | Protocol | Role indicated |
|---|---|---|
| 8805 UDP | PFCP | SMF (no GTP-U) or UPF (with GTP-U) |
| 2152 UDP | GTP-U | UPF (combined with PFCP) |
| 38412 SCTP | NGAP | AMF (listens) or gNB (connects) |
| 38472 SCTP | F1AP | gNB-CU-CP |
| 38462 SCTP | E1AP | gNB-CU-CP or gNB-CU-UP |
| 38422 SCTP | XnAP | gNB (Xn interface) |
| 36412 SCTP | S1AP | eNB or MME |
| 36421 SCTP | E2AP | Near-RT RIC (listens) or E2 Node |
| 36422 SCTP | E42 | xApp (connects to Near-RT RIC) |
| 3868 / 5658 TCP/SCTP | Diameter | Diameter Node |
| 5060 / 5061 TCP/UDP | SIP | IMS Node |
| 2905 SCTP | M3UA | SIGTRAN Gateway |
| 319/320 UDP | PTP | PTP Node |
| 830 TCP | NETCONF | OAM Endpoint |
| 7777, 29500–29599 TCP | SBI | Any 5G Core NF |
2. Process name heuristics: binary names such as smf, upf, amf, nrf are matched case-insensitively.
3. Binary path patterns: paths like /opt/open5gs/, /usr/local/open5gc/, /opt/ericsson/, /opt/nokia/, /opt/srsenb/ indicate vendor-specific NF implementations.
4. gRPC service detection: listening on port 7777 (Open5GS/Free5GC SBI default) or observing h2c HTTP/2 frames on SBI ports confirms a 5G Core NF.
Confidence scoring
Each role classification includes a confidence score from 0.0 to 1.0:
| Confidence | Meaning |
|---|---|
| 0.9 or higher | High confidence: used for alerts, SLO calculations, and compliance checks |
| 0.5 to 0.9 | Medium: informational, further evidence being gathered |
| Below 0.5 | Low: not yet classified; additional heartbeats expected |
Console auto-promotion
When a generic_linux or unclassified sensor sends heartbeat data containing a telecom NF inventory, the Console automatically promotes the sensor’s declared role:
- Detected 5G Core NFs (AMF, SMF, UPF, PCF, AUSF, UDM, UDR, NRF, SCP, BSF, NSSF) promote to
telecom_core - Detected RAN nodes (gNB variants, CU-CP, CU-UP, DU) promote to
telecom_ran
Auto-promotion only upgrades from generic_linux, generic, or unknown. It never downgrades a sensor that already has a specific telecom role assigned.
Supported network functions
5G Core (3GPP SA Release 15+)
| Role | Full name | SLO target | Enrollment value |
|---|---|---|---|
| AMF | Access and Mobility Management Function | 99.999% | amf |
| SMF | Session Management Function | 99.999% | smf |
| UPF | User Plane Function | 99.999% | upf |
| NRF | Network Repository Function | 99.99% | nrf |
| UDM | Unified Data Management | 99.99% | (auto-detected) |
| UDR | Unified Data Repository | 99.99% | (auto-detected) |
| PCF | Policy Control Function | 99.9% | pcf |
| AUSF | Authentication Server Function | 99.99% | ausf |
| NEF | Network Exposure Function | 99.9% | (auto-detected) |
| CHF | Charging Function | 99.9% | (auto-detected) |
| BSF | Binding Support Function | 99.9% | (auto-detected) |
| NSSF | Network Slice Selection Function | 99.9% | (auto-detected) |
| NWDAF | Network Data Analytics Function | 99.0% | (auto-detected) |
| SMSF | Short Message Service Function | 99.0% | (auto-detected) |
| SEPP | Security Edge Protection Proxy | 99.0% | (auto-detected) |
| LMF | Location Management Function | 99.0% | (auto-detected) |
| GMLC | Gateway Mobile Location Centre | 99.0% | (auto-detected) |
| AF | Application Function | 99.0% | (auto-detected) |
4G / EPC
| Role | Full name | SLO target |
|---|---|---|
| MME | Mobility Management Entity | 99.999% |
| SGW | Serving Gateway | 99.999% |
| PGW | Packet Data Network Gateway | 99.999% |
| HSS | Home Subscriber Server | 99.99% |
| PCRF | Policy and Charging Rules Function | 99.0% |
O-RAN and RAN
| Role | Full name | SLO target | Enrollment value |
|---|---|---|---|
| gNB-CU-CP | gNB Central Unit Control Plane | 99.9% | cucp |
| gNB-CU-UP | gNB Central Unit User Plane | 99.9% | cuup |
| gNB-DU | gNB Distributed Unit | 99.9% | o_du |
| gNB | gNB N2 endpoint | 99.9% | (auto-detected) |
| eNB | eNodeB (4G) | 99.9% | (auto-detected) |
| Near-RT RIC | Near-Real-Time RAN Intelligent Controller | 99.9% | near_rt_ric |
| xApp | O-RAN xApp (E42 client) | 99.0% | (auto-detected from port 36422) |
| E2 Node | E2 interface endpoint | 99.9% | (auto-detected) |
| O-RU | O-RAN Radio Unit | 99.0% | o_ru |
Infrastructure and support
| Role | Full name | Detection signal |
|---|---|---|
| IMS Node | IP Multimedia Subsystem | SIP port 5060/5061 |
| SIGTRAN Gateway | SS7/SIGTRAN transport | M3UA port 2905 |
| Diameter Node | Diameter peer | Port 3868/5658 |
| RADIUS Server | RADIUS authentication | Port 1812/1813 |
| OAM Endpoint | Operations and Maintenance | NETCONF port 830 |
| PTP Node | Precision Time Protocol | Port 319/320 UDP |
| TelecomProcess | Generic telecom binary | Name/path heuristic |
Fallback
| Value | Use when |
|---|---|
generic_linux | Node needs telecom flavor but explicit classification is deferred |
Do not leave production NF workloads at generic_linux permanently. Accurate role assignment unlocks role-specific policy packs, dashboards, protocol monitoring, and compliance controls from the first heartbeat.
SLO monitoring
The sensor monitors NF availability against these 3GPP TS 22.261 targets:
| Availability target | Roles |
|---|---|
| 99.999% (5-nines) | AMF, SMF, UPF, MME, SGW, PGW |
| 99.99% (4-nines) | NRF, AUSF, UDM, UDR, HSS |
| 99.9% (3-nines) | PCF, CHF, BSF, NSSF, NEF, gNB variants, Near-RT RIC |
| 99.0% (2-nines) | All others |
A breach alert fires after the NF has been observed for at least 300 seconds and the availability falls below its target. The sensor tracks Mean Time To Repair using a sliding window of the last 10 recovery samples. Breach alerts are suppressed for 3,600 seconds after firing to prevent alert storms.
Operational workflow
- Install the telecom flavor and declare the node role during sensor enrollment using the Console enrollment wizard.
- Validate in the Fleet view that the sensor shows the correct NF role classification.
- Assign a policy pack aligned to the role (O-DU, O-CU, O-Cloud baselines).
- Use the Telecom views to compare protocol behavior, topology, and resource trends before enabling containment on critical functions.
::: note Declare the node role explicitly during enrollment instead of relying on auto-detection. Accurate roles improve dashboards, pack suggestions, and the relevance of telecom-specific detections from the first heartbeat. :::
Further reading
- 5G Core (AMF / SMF / UPF)
- O-RAN Architecture (DU / CU / RIC)
- User Plane (GTP-U / PFCP)
- RAN Signaling (NGAP / F1AP / E2AP)
- SLO and Resource Monitoring
- O-RAN WG11 Compliance
- Sensor Flavors
- 3GPP TS 22.261 - Service requirements for the 5G system
- 3GPP TS 23.501 - System architecture for the 5G system (5GS)
- O-RAN Alliance - O-RAN Architecture Description