0-RTT (TLS 1.3)
A TLS 1.3 feature that sends application data in the first handshake flight, speeding up connections while removing an early visibility point.
Learn
A practical guide to the technologies, protocols and concepts shaping modern telecom and intelligent networks
Terms (144)
3GPP
The global standards body that defines mobile network architecture and protocols from GSM through 5G.
5G Core (5GC)
The service-based core network architecture of 5G, in which functions such as the UPF and PCF communicate through standard APIs.
5-Tuple
The five values that identify a network flow, combining the endpoint IP addresses and ports with the transport protocol.
AAA (Authentication, Authorization and Accounting)
The framework that controls subscriber access and records usage, typically carried over RADIUS or Diameter.
Agentic AI Traffic
Network traffic generated by autonomous AI agents and other automated systems acting on behalf of users or services.
AIOps
The use of AI to automate network and IT operations tasks such as monitoring, troubleshooting and remediation.
Anomaly Detection
The identification of unusual network behavior that may indicate performance issues, misuse, or threats.
Application-Aware Billing
Billing based on the specific applications, services, or traffic types a subscriber uses.
Application Classification
The process of identifying which applications or services are generating network traffic.
Application Signature
A defined pattern used to recognize a specific application or service, maintained in a continuously updated signature library.
ARPU (Average Revenue Per User)
A telecom metric showing the average revenue generated per subscriber over a given period.
Bandwidth
The maximum amount of data that can be transmitted over a network connection in a given time.
Behavioral Traffic Analysis
The analysis of traffic patterns and behavior to understand network activity without relying only on packet payloads.
Bill Shock
Unexpectedly high subscriber bills caused by uncontrolled usage, typically prevented with real-time notifications and spend controls.
Botnet
A network of malware-infected devices controlled from central infrastructure and used for attacks such as DDoS or spam.
BRAS / BNG (Broadband Network Gateway)
The provider-edge platform that terminates broadband subscriber sessions and enforces per-subscriber policy and QoS.
BSS / OSS (Business / Operations Support Systems)
The operator systems that run business functions such as billing (BSS) together with network operations (OSS), integrating with policy and charging.
Bypass Detection
The identification of techniques such as VPNs, proxies, or spoofing used to avoid network controls or visibility.
Bypass NIC
A network interface card that keeps traffic flowing through a link when an inline system fails or loses power.
Captive Portal
An intercept page that redirects subscribers to sign in or top up before granting internet access, common in prepaid and hotspot models.
Carrier-Grade
Designed to meet the high availability, scale, reliability, and performance requirements of telecom networks.
CDN (Content Delivery Network)
A distributed network of servers that delivers content from locations close to users to improve speed and reliability.
CGNAT (Carrier-Grade NAT)
A large-scale address translation technique that lets many subscribers share public IP addresses, complicating per-subscriber visibility.
CHF (Charging Function)
The 5G converged charging function that replaces the separate online and offline charging systems of 4G.
Churn
The rate at which customers stop using a service or leave a provider.
Cloud-Native
An approach to building software for flexible deployment, scaling, and operation in cloud environments.
Congestion
A network condition in which traffic demand exceeds available capacity, reducing performance or service quality.
Content Filtering
The blocking or restriction of websites, applications or content categories according to policy or regulation.
CUPS (Control and User Plane Separation)
A 3GPP architecture that splits control-plane and user-plane functions so forwarding nodes can be placed at the network edge.
Data Localization
A requirement that data about a country's users is stored and processed within that country's borders.
Data Plane
The part of a network responsible for processing and forwarding live traffic.
DDoS Attack (Distributed Denial of Service)
A coordinated attack that floods a service or network with traffic from many sources to make it unavailable.
Deep Packet Inspection (DPI)
A technology that identifies and analyzes network traffic beyond basic packet headers to support visibility, policy, security, and service management.
Deep Packet Intelligence
An evolution of DPI that combines traffic visibility with AI-driven analytics to understand network behavior and support real-time decisions.
Diameter
A signaling protocol widely used in telecom networks for authentication, authorization, accounting, and policy functions.
DNS Tunneling
An evasion technique that hides data or control traffic inside DNS queries and responses, abusing a protocol networks rarely block.
Domain Fronting
An evasion technique that hides a connection's true destination behind a reputable front-end domain, complicating encrypted traffic identification.
DPDK (Data Plane Development Kit)
An open-source framework that accelerates packet processing by moving it out of the operating system kernel into optimized software.
East-West Traffic
Traffic flowing between workloads inside data centers and clouds, as opposed to north-south traffic between users and services.
Encrypted Client Hello (ECH)
A TLS extension that encrypts the SNI and other handshake details, so observers see only an outer name for the front server while the real inner SNI stays hidden.
Encrypted DNS (DoH / DoT / DoQ)
The transport of DNS queries over encrypted channels such as HTTPS, TLS or QUIC, hiding domain lookups from the network.
Encrypted Traffic
Network traffic whose content is protected by encryption, making traditional payload-based inspection more difficult.
Encrypted Traffic Classification
The identification of applications and services in encrypted traffic using metadata, patterns, and behavior rather than decrypting content.
EPC (Evolved Packet Core)
The 4G core network architecture whose gateways host policy enforcement and connect subscribers to the internet.
Evasive Traffic
Traffic that deliberately hides its nature using techniques such as tunneling or protocol mimicry to bypass detection and policy controls.
Fair Usage Policy (FUP)
Operator rules that share capacity fairly among subscribers during congestion so heavy users do not degrade the experience of others.
Fixed Wireless Access (FWA)
Broadband delivered to homes and businesses over 4G or 5G radio instead of fixed lines, a fast-growing and congestion-prone segment.
Flow
A sequence of related packets exchanged between endpoints as part of a network communication session.
Flow Metadata
Information describing a traffic flow, such as endpoints, timing, volume and protocol, revealing activity without exposing content.
Gi/SGi Interface (Gi-LAN)
The point where the mobile core hands subscriber traffic to the internet and the service segment around it where visibility and policy systems are deployed.
GTP (GPRS Tunneling Protocol)
The protocol that carries subscriber traffic and signaling through the core of mobile networks.
GTP Correlation
The matching of mobile control-plane and user-plane traffic so tunneled sessions can be resolved to individual subscribers.
Gx Interface
A Diameter interface that carries policy and charging rules from the PCRF to the PCEF, succeeded by N7 in 5G.
Gy Interface
A Diameter interface that reports usage from the PCEF to the OCS for real-time quota control, succeeded by N40 in 5G.
Header Enrichment
The insertion of subscriber identifiers into HTTP requests so operator and partner platforms can apply per-subscriber services or billing.
Heuristic Analysis
A classification method that identifies traffic from rule-based inference on packet and flow attributes rather than exact signature matches.
HTTP/3
The latest version of the web protocol, running over QUIC instead of TCP and encrypting more of each connection.
Inline Deployment
A deployment mode in which a system sits directly in the traffic path and can apply policies in real time.
Intent-Based Networking
An approach in which operators state desired outcomes and the network translates them into configuration and policy automatically.
IPTV
The delivery of television content over IP networks, spanning managed operator services and unmanaged streaming.
Jitter
The variation in packet delay across a network, affecting the quality of real-time services such as voice and video.
Large Language Model (LLM)
An AI model trained on large volumes of text that can understand and generate natural language.
Latency
The time it takes for data to travel across a network from source to destination.
Lawful Intercept
The legally authorized provision of access to specific communications for law enforcement under national regulation and frameworks such as the ETSI lawful interception standards.
Layer 7 (Application Layer)
The top OSI layer where application protocols operate, making Layer 7 visibility the classic shorthand for application identification.
Mean Opinion Score (MOS)
A standardized score for perceived voice and video quality, widely used to steer per-stream optimization decisions.
Microservices Architecture
A software design approach in which a platform is built as independent services that can be developed and scaled separately.
Monetization
The use of network data, capabilities, and insights to create or increase revenue.
Multi-access Edge Computing (MEC)
A distributed architecture that places compute close to users at network edge sites, enabling low-latency services.
N6 Interface
The 5G reference point between the UPF and the data network, the deployment point equivalent to the 4G Gi-LAN.
Natural-Language Interface
A system that allows users to query, control, or interact with technology using everyday language.
NetFlow / IPFIX
Standard formats for exporting summarized flow records from network devices for analysis and reporting.
Net Neutrality
The regulatory principle that operators treat internet traffic equally, shaping how practices such as zero-rating and traffic management may be applied.
Network Analytics
The collection and analysis of network data, increasingly in real time, to improve performance, security and business decisions.
Network Detection and Response (NDR)
A security category that detects malicious activity in network traffic and supports investigation and mitigation.
Network Intelligence
The actionable understanding of network behavior produced when traffic data is combined with AI-driven analytics and operational context.
Network Observability
The ability to understand network health and behavior through metrics, events, traffic data, and other signals.
Network Packet Broker (NPB)
A device that consolidates copied network traffic and distributes the right portions to monitoring or security tools.
Network Policy
A set of rules that defines how network traffic, users, applications, or services should be handled.
Network Slicing
The creation of multiple virtual end-to-end networks on shared 5G infrastructure, each with tailored resources and service levels.
Network Sovereignty
The ability to keep control of network data, infrastructure, processing, and policies within required organizational or national boundaries.
Network Traffic Analysis
The examination of network traffic to understand usage, performance, behavior, anomalies, and potential threats.
NWDAF (Network Data Analytics Function)
The 5G core function standardized by 3GPP that collects network data and exposes analytics and predictions to other network functions.
OCS (Online Charging System)
A telecom system that rates and charges service usage in real time, often driven by traffic classification data.
OTT (Over-The-Top)
Services such as streaming, messaging and voice apps delivered over the internet rather than by the network operator.
Out-of-Band Deployment
A passive deployment mode that observes copied network traffic without sitting directly in the live traffic path.
Packet
A formatted unit of data transmitted across a network.
Packet Capture (PCAP)
The recording of network packets for analysis, troubleshooting and validation of classification accuracy.
Packet Loss
The share of packets that fail to reach their destination, degrading application performance and user experience.
Parental Controls (Network-Level)
Operator-provided tools that let families filter content, set schedules and manage limits per application across all devices.
Payload
The part of a network packet that contains the actual transmitted data, excluding protocol headers.
PCEF (Policy and Charging Enforcement Function)
The enforcement point in the 4G packet gateway that applies policy rules and meters usage for charging.
PCF (Policy Control Function)
The 5G policy function that decides how sessions and traffic are treated, succeeding the PCRF.
PCRF (Policy and Charging Rules Function)
The 4G policy engine that decides per-subscriber rules and pushes them to enforcement points over Gx.
Policy Enforcement
The real-time application of network rules to traffic, users, applications, or services.
Post-Quantum Cryptography (PQC)
Encryption algorithms designed to resist attacks from quantum computers, now appearing in mainstream TLS traffic.
PPPoE / IPoE
The two dominant broadband access methods, authenticated PPP sessions over Ethernet or direct IP over Ethernet with DHCP.
Predictive Analytics
The use of data and models to forecast future network conditions, anomalies, or subscriber behavior.
Private Cloud
A cloud environment dedicated to one organization, providing greater control over infrastructure and data.
Protocol Mimicry
An evasion technique in which traffic imitates a legitimate protocol to avoid classification and policy controls.
QCI / 5QI
Standardized identifiers that tell the network how to treat each class of traffic, defined as QCI in 4G and 5QI in 5G.
QoE (Quality of Experience)
A measure of how users perceive the quality and performance of a digital or network service.
QoS (Quality of Service)
Techniques used to manage network resources and prioritize traffic to meet defined performance levels.
QUIC
A transport protocol that runs over UDP with built-in encryption, used by HTTP/3 and much of today's web traffic.
Quota Management
Real-time tracking and enforcement of per-subscriber data or application allowances within a service plan.
RADIUS
A protocol commonly used for centralized authentication, authorization, and accounting of network users.
RAN Congestion Management
The detection and mitigation of radio access network congestion using traffic intelligence from the core or transport network.
RBAC (Role-Based Access Control)
A security model that grants system permissions according to a user's assigned role.
Real-Time Policy Management
The ability to create, distribute, update, and enforce network policies as conditions change.
Revenue Leakage
Revenue lost to fraud or plan misuse, such as zero-rating abuse, that traffic-based validation can detect and prevent.
Round-Trip Time (RTT)
The time for a packet to travel from source to destination and back, a core metric of network performance.
SBI (Service-Based Interface)
A 5G core interface model that enables network functions to communicate through standardized services and APIs.
Sd Interface
The Diameter interface between the TDF and the PCRF, used for application detection reporting and policy control.
Service Chaining
The steering of selected traffic flows through an ordered sequence of value-added functions from a single integration point.
Service Tiering
The creation of subscriber plans with differentiated speeds and quotas so customers can choose the level that fits their budget.
Shadow AI
The unauthorized or unmanaged use of AI applications and agents inside an organization, exposed through traffic visibility.
Shallow Packet Inspection
A legacy inspection approach that reads only packet headers, contrasted with the deeper analysis performed by DPI.
SIEM (Security Information and Event Management)
A system that collects and analyzes security events and logs to support threat detection and investigation.
SNI (Server Name Indication)
A TLS extension that indicates the hostname a client is trying to reach during connection setup.
SNI Spoofing
The manipulation or falsification of SNI information to disguise or bypass identification of network traffic.
Sponsored Data
A model in which a content or service partner pays for the data its service consumes instead of the subscriber.
Statistical Traffic Analysis
A classification method that identifies applications from statistical flow properties such as packet sizes and timing, without reading payloads.
Subscriber Awareness
The ability to attribute traffic and usage to individual subscribers so policy and analytics can adapt to identity, plan or context.
TAP / SPAN Port
A dedicated hardware tap or a switch mirror port that feeds a copy of live traffic to monitoring and analysis systems.
TDF (Traffic Detection Function)
The application detection and control function defined by 3GPP, effectively the standardized role for DPI in the mobile core.
Tethering Detection
The identification of cases where a subscriber shares a mobile connection with other devices.
Throughput
The actual rate of data successfully delivered over a network connection, as opposed to its theoretical capacity.
TLS (Transport Layer Security)
The standard protocol for encrypting connections on the internet, protecting web, application and API traffic.
TLS Fingerprinting (JA3 / JA4)
The identification of clients and applications in encrypted sessions from TLS handshake characteristics, without decryption.
Traffic Classification
The process of identifying and grouping network traffic by application, service, protocol, or behavior.
Traffic Management
The monitoring and control of network traffic to improve performance, quality, efficiency, or policy compliance.
Traffic Policing
The enforcement of bandwidth profiles by dropping or marking traffic that exceeds them, complementing traffic shaping.
Traffic Shaping
The deliberate control of traffic rates to smooth congestion, prioritize services or enforce plan limits.
Traffic Visibility
The ability to identify and understand the applications, services, users, and behaviors present in network traffic.
UPF (User Plane Function)
The 5G core function that forwards subscriber traffic and applies policy, a natural insertion point for traffic visibility.
Value-Added Services (VAS)
Revenue-generating services layered on top of connectivity, such as security or parental controls, that raise ARPU and loyalty.
Video Optimization
The management of streaming bitrates and resolution to reduce bandwidth consumption while preserving perceived quality.
VNF / CNF (Virtual / Cloud-Native Network Function)
Network functions implemented as software on virtual machines or as containers instead of dedicated hardware.
VPN (Virtual Private Network)
A technology that creates an encrypted connection between a device or network and another network endpoint.
VPN Detection
The identification of traffic using virtual private networks, including attempts to conceal applications or destinations.
Wi-Fi Offload
The shifting of mobile data traffic from the cellular radio network onto Wi-Fi while retaining operator policy.
Zero-Rating
A billing practice in which traffic from selected applications is excluded from a subscriber's data allowance, often examined under net-neutrality rules.
Zero Trust
A security approach that continuously verifies access rather than automatically trusting users, devices, or network locations.