(51) Int Cl.: H04L 12/26 ( )

Transcription

1 (19) (11) EP B1 (12) EUROPEAN PATENT SPECIFICATION (4) Date of publication and mention of the grant of the patent: Bulletin 11/38 (1) Int Cl.: H04L 12/26 (06.01) (21) Application number: (22) Date of filing: (4) Real-time traffic monitoring in a mobile data network Echtzeit-Verkehrsüberwachung in einem mobilen Datennetzwerk Surveillance de trafic en temps réel dans un réseau de données mobile (84) Designated Contracting States: AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO SE SI SK SM TR () Priority: FI (43) Date of publication of application: Bulletin /13 (73) Proprietor: Iptune Oy Helsinki (FI) (72) Inventor: Haimi, Vesa 00380, Helsinki (FI) (74) Representative: Tanskanen, Jarmo Tapio et al PAPULA OY Mechelininkatu 1 a Helsinki (FI) (6) References cited: WO-A-03/00244 US-A US-B EP B1 Note: Within nine months of the publication of the mention of the grant of the European patent in the European Patent Bulletin, any person may give notice to the European Patent Office of opposition to that patent, in accordance with the Implementing Regulations. Notice of opposition shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention). Printed by Jouve, 7001 PARIS (FR)

2 1 EP B1 2 Description BACKGROUND OF THE INVENTION Field of the Invention [0001] The invention relates generally to management of mobile telecommunications traffic. In particular, the invention relates to methods, computer programs and apparatuses for managing mobile telecommunications packet data service traffic. Description of the Related Art [0002] Today, various kinds of traffic measurements are routinely performed on packet switched telecommunication networks as well as on circuit switched telecommunication networks. In the case of packet switched networks, these traffic measurements may contain e.g. packet headers, signaling messages, and authorization log-files. These traffic measurements may be utilized in examining the status and performance of a network, and in order to ensure the correct operation of the network. In addition, traffic analysis based on these measurements provides valuable data about user behavior and trends in application and network usage. [0003] A prior art network management system typically comprises fault management and performance management. Fault management refers to monitoring notifications and alarms indicating status changes and detected faults, as well as evaluating their importance and effects, and initiating actions such as repairs. These notifications and alarms are generated by various network elements, operation and maintenance units, and the network management system itself. Performance management refers to collecting performance measurements from various network elements, operation and maintenance units, etc. to the network management system, and subsequently analyzing the collected data. Thus, e.g. trends and problems in the network can be detected. [0004] The collected performance measurements typically relate to parameters which can be used to indicate the performance of the network or a network element, or a service provided by the network. The performance measurements are typically transmitted to the network management system sequentially, e.g. every 1, or 60 minutes or every 12 or 24 hours, depending on the network, e.g. the network size, the amount of different kind of measurements to be collected, and the capacity of the network management system. Having received the collected performance measurements, the network management system analyzes them. Typically the analysis is performed by batch processing in which the received data is analyzed e.g. once every 24 hours. [000] As current networks continue to grow, faster network management including monitoring of network resources, network services and services provided over the network is needed. In particular, analysis of the collected performance measurements has proven problematic. Firstly, the current implementations typically perform the analysis as an off-line procedure, for example once every 24 hours. In other words, the analysis is not performed in real-time which may seriously degrade the performance of the network or the quality of service since performance problems may remain unattended to until the next batch processing of collected performance measurements. Furthermore, the present algorithm based analysis methods do not allow real-time decision making and monitoring either. [0006] Prior art further includes US 03/11364 A1 that discloses camouflage of network traffic to resist attack, wherein an apparatus for transmitting a file through a network includes a file-splitting processor that splits the file into a plurality of message segments and addresses the plurality of message segments to a plurality of addresses assigned to a receiving host. The apparatus includes a message segment transmitter for transmitting the plurality of message segments to the receiving host. [0007] Prior art further includes US B1 that discloses an information security analysis system that is a collection, configuration and integration of software programs that reside on multiple interconnected computer platforms. This collection and integration of software and the migration to a single computer platform results in an approach to LAM/WAM monitoring in either a passive and/or active mode. The architecture permits digital data input from external sensors for analysis, display and correlation with data and displays derived from four major software concept groups. [0008] Therefore, an object of the present invention is to alleviate the problems described above and to introduce a solution that allows analysis and monitoring for a communications network, network resources, network services and services provided over the network in realtime. SUMMARY OF THE INVENTION [0009] A first aspect of the present invention is a method of managing mobile telecommunications packet data service traffic. Packet data traffic related to one or more services of a mobile telecommunications network is received from one or more data collectors. At least a portion of the received packet data traffic is stored in a traffic file. The stored traffic file is split into capture files, wherein each of the capture files is specific to one service of the one or more services of the mobile telecommunications network. The service specific capture files are stored, wherein each capture file is assigned an index. Predetermined key information is extracted from the stored service specific capture files for entry points of the one or more services of the mobile telecommunications network by utilizing one or more filters configured for searching one or more strings related to the predetermined key information, wherein the key information includes at least 2

3 3 EP B1 4 the index assigned to the associated service specific capture file, at least one user identification, and time data. The extracted key information is stored in entry point specific tables. [00] A second aspect of the present invention is an apparatus for managing mobile telecommunications packet data service traffic. The apparatus comprises a receiver configured to receive packet data traffic related to one or more services of a mobile telecommunications network from one or more data collectors. The apparatus further comprises a first storage configured to store at least a portion of the received packet data traffic in a traffic file. The apparatus further comprises a a splitter configured to split the stored traffic file into capture files, wherein each of the capture files is specific to one service of said one or more services. The apparatus further comprises a second storage configured to store the service specific capture files, wherein each capture file is assigned an index. The apparatus further comprises an extractor configured to extract predetermined key information from the stored service specific capture files for entry points of the one or more services of the mobile telecommunications network by utilizing one or more filters configured for searching one or more strings related to the predetermined key information, wherein the key information includes at least the index assigned to the associated service specific capture file, at least one user identification, and time data. The apparatus further comprises a third storage configured to store the extracted key information in entry point specific tables. [0011] A third aspect of the present invention is a computer program embodied on a computer readable medium. The computer program controls a data-processing device to perform the steps of: receiving, from one or more data collectors, packet data traffic related to one or more services of a mobile telecommunications network; storing at least a portion of the received packet data traffic in a traffic file; splitting the stored traffic file into capture files, each of the capture files specific to one service of said one or more services; storing the service specific capture files, with each capture file assigned an index; extracting predetermined key information from the stored service specific capture files for entry points of the one or more services by utilizing one or more filters configured for searching one or more strings related to the predetermined key information, said key information including at least the index assigned to the associated service specific capture file, at least one user identification, and time data; and storing the extracted key information in entry point specific tables. [0012] In an embodiment of the invention, a traffic analysis is performed utilizing at least a portion of at least one of the stored key information and the stored service specific capture files. [0013] In an embodiment of the invention, the performing the traffic analysis comprises executing an end-toend search on a given user identification, wherein the stored key information is searched for the given user identification and given time data, and the search results are used to select one or more entry point transactions to pass on to further analysis. [0014] In an embodiment of the invention, the performing the traffic analysis further comprises collecting traffic statistics, wherein the number of transactions in a given service specific capture file matching a statistics filter is counted and stored for further processing. [001] In an embodiment of the invention, the performing the traffic analysis further comprises monitoring a given service, wherein the number of transactions in a given service specific capture file matching a first monitoring filter is counted, the number of transactions in the given service specific capture file matching a second monitoring filter is counted, and a predetermined ratio of the both numbers is compared to a predetermined threshold value to determine if sufficient network operability has been reached. [0016] In an embodiment of the invention, the performing the traffic analysis further comprises tracking users fulfilling a given criteria, wherein the user identifications in the transactions in a given service specific capture file matching a tracking criteria filter are extracted, and a list of the extracted user identifications is generated for further processing. [0017] In an embodiment of the invention, the services include at least one of a multimedia messaging service, a wireless application protocol related service, a short message service, an service, a remote authentication dial in user service, and a session initiation protocol related service. [0018] In an embodiment of the invention, the entry points include at least one of a remote authentication dial in user service entry point, a multimedia messaging service interface between the first multimedia messaging service relay/server and an external messaging system, a short message service entry point, a multimedia messaging service interface between the first multimedia messaging service relay/server and a second multimedia messaging service relay/server, a multimedia messaging service interface between the first multimedia messaging service relay/server and a value added service application of the multimedia messaging service, a Gn interface of a gateway GPRS support node, and a Gi interface of the gateway GPRS support node. [0019] In an embodiment of the invention, the packet data service traffic is received via one or more bonded interfaces. [00] It is to be understood that the aspects and embodiments of the invention described above may be used in any combination with each other. Several of the aspects and embodiments may be combined together to 3

4 EP B1 6 form a further embodiment of the invention. A method, an apparatus, or a computer program which is an aspect of the invention may comprise at least one of the embodiments of the invention described above. [0021] The invention allows analysis and monitoring for a communications network, network resources, network services and services provided over the network in real-time. BRIEF DESCRIPTION OF THE DRAWINGS [0022] The accompanying drawings, which are included to provide a further understanding of the invention and constitute a part of this specification, illustrate embodiments of the invention and together with the description help to explain the principles of the invention. In the drawings: Fig. 1a is a block diagram illustrating an apparatus according to an embodiment of the invention as deployed in a mobile telecommunications network; Fig. 1b is a block diagram illustrating an apparatus according to an embodiment of the invention in more detail; Fig. 2 is a flow diagram illustrating a method according to an embodiment of the invention; Fig. 3a is a flow diagram illustrating a method according to another embodiment of the invention; Fig. 3b is a flow diagram illustrating a method according to yet another embodiment of the invention; Fig. 3c is a flow diagram illustrating a method according to a further embodiment of the invention; and Fig. 3d is a flow diagram illustrating a method according to another further embodiment of the invention. DETAILED DESCRIPTION OF THE PREFERRED EM- BODIMENTS [0023] Reference will now be made in detail to the embodiments of the invention, examples of which are illustrated in the accompanying drawings. [0024] Figure 1a is a block diagram illustrating an apparatus 10 according to an embodiment of the invention as deployed in a mobile telecommunications network 00. Figure 1b is a block diagram illustrating the apparatus 10 of Figure 1a in more detail. [002] The mobile telecommunications network 00 provides various services which may include both circuit switched services and packet switched services. The circuit switched services may include e.g. conventional wireless telephony services. The packet switched services or packet data services may be implemented using e.g. General Packet Radio Service (GPRS) techniques, packet data techniques of Third Generation Partnership Project (3GPP) mobile telecommunications networks, or packet data service (CPDS) techniques of code division multiple access 00 (CDMA00; also known as IS ) mobile telecommunications networks, and the packet data services may include e.g. a multimedia messaging service (MMS) 11, a wireless application protocol (WAP) related service 12, a short message service (SMS) 13 (when implemented with packet data techniques), an service 1, a remote authentication dial in user service (RADIUS) 14, and/or a session initiation protocol (SIP) related service 16 (e.g. a push-to-talk over cellular (PoC) service, a voice-over-internet protocol (VoIP) service, a video-on-demand service). Obviously, the packet data services are not limited to the above examples. [0026] The mobile telecommunications network 00 includes entry points. Herein, the term "entry point" is used to refer to locations in the mobile telecommunications network 00 in which a subscriber (not illustrated in Figure 1a) may first enter the mobile telecommunications network 00 to use its packet data services with his/her terminal device (not illustrated in Figure 1a). The entry points may include e.g. a remote authentication dial in user service entry point 11 (e.g. a RADIUS request from a gateway GPRS support node (GGSN, not illustrated in Figure 1a), from a packet data serving node (PDSN, not illustrated in Figure 1a), from a Network Access Server (NAS) towards service network, or from an external RADIUS proxy server), a multimedia messaging service interface 12 (also known as MM3 interface in the art of multimedia messaging service) between the first multimedia messaging service relay/server and an external messaging system (not illustrated in Figure 1a), a short message service entry point 13, a multimedia messaging service interface 14 (also known as MM4 interface in the art of multimedia messaging service) between the first multimedia messaging service relay/server and a second multimedia messaging service relay/ server (not illustrated in Figure 1a), a multimedia messaging service interface 1 (also known as MM7 interface in the art of multimedia messaging service) between the first multimedia messaging service relay/server and a value added service (VAS) application (not illustrated in Figure 1a) of the multimedia messaging service, a Gn interface 16 of a gateway GPRS support node, and/or a Gi interface 17 of the gateway GPRS support node. Obviously, the entry points are not limited to the above examples. For example, in place of the MM7 interface, an external application interface (EAIF) may used. [0027] The RADIUS entry point 11 may be used for e.g. MMS MM1 traffic and WAP browsing traffic. The Gn interface 16 of the GGSN may be used for e.g. mobile internet browsing. For SIP services, e.g. the Gn interface 16 of the GGSN or the Gi interface 17 of the GGSN may be used. The MM3 interface 12 may be used e.g. by the MMS Relay/Server to send multimedia messages to and retrieve multimedia messages from servers of external messaging systems that are connected to the service provider s MMS Relay/Server. The MM4 interface 14 between MMS Relay/Servers belonging to different multimedia messaging service environments (MMSE) 4

5 7 EP B1 8 may be used e.g. to transfer messages between them. The MM7 interface 1 may be used e.g. to transfer multimedia messages from MMS Relay/Server to MMS VAS applications and to transfer multimedia messages from MMS VAS applications to MMS Relay/Server. [0028] The mobile telecommunications network 00 further includes a data collector 10. In an embodiment of the invention, the data collector 10 may comprise a network node 10 that is capable of port monitoring. In the embodiment of Figure 1a, the network node 10 is a network switch capable of port monitoring. However, the network node 10 may also be e.g. a router, a load balancer, a network tap, or a service node capable of port monitoring. The port monitoring capability may be implemented e.g. as a port mirroring capability. Since both port mirroring and port monitoring are concepts known in the art, they are not described in more detail herein. Furthermore, even though only one network node 10 capable of port monitoring is illustrated in Figure 1a for the sake of clarity, it is to be understood that multiple network nodes capable of port monitoring may be used for the purposes of the present invention. [0029] The apparatus 10 is connected to the network node 10. In the embodiment of Figure 1a, the apparatus 10 is connected to the network node 10 via bonded interfaces 14, 14. In the art, bonded interfaces are also known as IP-multipathing and interface aggregates. Again, since the bonded interface is a concept known in the art, it is not described in more detail herein. In an embodiment, no internet protocol (IP) addresses are configured for the bonded interfaces 14, 14. Furthermore, even though only two bonded interfaces 14, 14 are illustrated in Figure 1a for the sake of clarity, it is to be understood that any number of bonded interfaces may be used per each apparatus 10 for the purposes of the present invention. Similarly, any number of network nodes capable of port monitoring may be connected to each apparatus 10 for the purposes of the present invention. Finally, any number of apparatuses 10 may be used for the purposes of the present invention. [00] Using bonded interfaces has several advantages. For example, monitored traffic data can be received from multiple locations at the same time and be captured by a single capturing process. Furthermore, time stamps of the traffic don t need synchronization because only one capturing process is running to capture traffic data from multiple locations, and local system time is used as a time value for captured traffic. Therefore, all the captured packets are stored in chronological order by default. Furthermore, when network nodes are redundant (doubled), it is possible to receive traffic from a primary and a secondary node at the same time with interface bonding. On the other hand, if all the monitored service data is received from a single non-redundant node, interface bonding is not needed. [0031] Alternatively, instead of implementing the data collector 10 in a network node remote from the packet data services as illustrated in Figure 1a, the data collector 10 may also be arranged locally, i.e. in connection with (not illustrated in Figure 1a) one or more of the packet data services Again, there may be multiple data collectors 10, each of which may be arranged e.g. in connection with one of the packet data services In this embodiment, the data collector(s) 10 may be e.g. software module(s), each of which may be installed in connection with one of the packet data services and each of which may collect packet data traffic related to its respective packet data service [0032] The apparatus 10 comprises a receiver 14 that is configured to receive (typically via the bonded interfaces 14, 14, as described above) packet data traffic related to one or more of the services of the mobile telecommunications network 00 from the data collector 10. In the above embodiment in which the data collector 10 is arranged locally in connection with one of the packet data services 11-16, the receiver 14 may be configured to receive the packet data traffic related to one or more of the services e.g. via file transfer protocol (FTP) or via volume mounting, both of which are techniques well known to a person skilled in the art and therefore do not need to be described in further detail herein. [0033] The apparatus 10 further comprises a first storage 14 that is configured to store at least a portion of the received packet data traffic in a traffic file In an embodiment, the traffic files 1441 may be created using a ring buffer (not illustrated in Figure 1b). Furthermore, the traffic files 1441 may be created based on e.g. duration, file size, and/or the number of files. [0034] The apparatus 10 further comprises a splitter 1 that is configured to split the stored traffic file into capture files 1461, wherein each of the capture files 1461 is specific to one service of the one or more services [003] The apparatus 10 further comprises a second storage 1460 that is configured to store the service specific capture files Each capture file may be assigned an index. The index may be e.g. an incremental file index number. As a result, the traffic file 1441 is split into small logical pieces (i.e. the capture files 1461) specific to the packet data services [0036] The apparatus 10 further comprises an extractor 1470 that is configured to extract predetermined key information from the stored service specific capture files 1461 for entry points by utilizing one or more filters configured for searching one or more strings (e.g. character strings) related to the predetermined key information. The key information may include the index assigned to the associated service specific capture file, user identifications, and/or time data. The apparatus 10 further comprises a third storage 1480 (e.g. a database) that is configured to store the extracted key information in tables 1481 each of which may be specific to one of the entry points 11-1.

6 9 EP B1 [0037] It is to be understood that in the context of the present invention, the term "user" is used to refer to an entity using a packet data service(s). That is, the term "user" refers to at least one of a subscriber and a terminal device using the packet data service(s). Accordingly, the "user identification" may comprise at least one of a subscriber identification and a terminal device identification, such as at least one of a mobile subscriber integrated services digital network number (MSISDN), a mobile identification number (MIN), an international mobile subscriber identity (IMSI), an electronic serial number (ESN) of the terminal device, and an internet protocol (IP) address. [0038] It is to be understood that the first storage 14, the second storage 1460 and the third storage 1480 may be implemented separately from each other (as illustrated in Figure 1b) or in any combination with each other. [0039] The apparatus 10 further comprises an analyzer 1490 that is configured to perform a traffic analysis utilizing information stored in the entry point specific tables 1481 and/or the capture files Various examples of this traffic analysis will be described in more detail in connection with Figures 3a-3d. [00] Figure 2 is a flow diagram illustrating a method according to an embodiment of the invention. At step 20, packet data traffic related to one or more services of a mobile telecommunications network is received from one or more data collectors. The received packet data traffic is stored in a traffic file, step 20. At step 20, the stored traffic file is split into capture files, wherein each of the capture files is specific to one service of the one or more services of the mobile telecommunications network. At step 20, the service specific capture files are stored, wherein each capture file is assigned an index. At step 200, predetermined key information is extracted from the stored service specific capture files for entry points of the one or more services of the mobile telecommunications network by utilizing one or more filters configured for searching one or more strings related to the predetermined key information, wherein the key information includes at least the index assigned to the associated service specific capture file, at least one user identification, and time data. The extracted key information is stored in entry point specific tables, step At optional step 2700, a traffic analysis is performed utilizing at least a portion of at least one of the stored key information and the stored service specific capture files. [0041] Figures 3a-3d are flow diagrams illustrating embodiments of the analysis step 2700 of the method of Figure 2. Figure 3a illustrates a case in which the at least one user identification may comprise e.g. a mobile subscriber integrated services digital network number (MSISDN), and the performing the traffic analysis comprises executing an end-to-end search on a given MSIS- DN (i.e. executing a trace). Key information stored in the table 1481 specific to a desired one of the entry points 11-1 is searched for the given MSISDN and given time data, step Search results are returned, step At step 2713, the returned search results are used to select one or more entry point transactions for detailed further analysis. At step 2714, the selected entry point transactions are passed on to the detailed further analysis. The detailed further analysis may be performed using known traffic analysis techniques. Furthermore, the embodiment of Figure 3a may also be used to enable lawful authorities to effectively run various tasks required for data monitoring and surveillance. It is to be understood that the embodiment of Figure 3a is not limited to mobile subscriber integrated services digital network numbers (MSISDNs). For example, the at least one user identification may comprise one of mobile identification numbers (MINs), international mobile subscriber identities (IMSIs), electronic serial numbers (ESNs), and IPaddresses instead of mobile subscriber integrated services digital network numbers. [0042] Figure 3b illustrates a case in which the performing the traffic analysis further comprises collecting traffic statistics. A respective capture file is read with a statistics filter, step At step 2722, the number of transactions in the respective capture file matching the used statistics filter is counted. The counted number is then stored for further processing, step The traffic statistics collected in this manner may include e.g. service related statistics (e.g. number of requests, number of responses, and/or number of successful transactions), terminal type statistics, content size statistics, and/or network related statistics (e.g. round trip time, packet count, and/or number of broadcasts). [0043] Figure 3c illustrates a case in which the performing the traffic analysis further comprises monitoring a given service 11, 12, 13, 14, 1 or 16 (for example, to find out if the given service is operating sufficiently). A respective capture file (that is, a capture file related to the given service 11, 12, 13, 14, 1 or 16) is read with a first monitoring filter, step The number of transactions in the respective capture file matching the first monitoring filter is counted, step The respective capture file is read with a second monitoring filter, step In another embodiment, another capture file may be read with the second monitoring filter. The number of transactions in the respective capture file matching the second monitoring filter is counted, step At step 273, a predetermined ratio of the both numbers counted at steps 2732 and 2734 is compared to a predetermined threshold value to determine if sufficient network operability has been reached. If it is determined at step 273 that the threshold value is not reached, it may be determined that sufficient network operability has not been reached, and e.g. an alarm may be given, step If it is determined at step 273 that the threshold value is reached, it may be determined that sufficient network operability has been reached, and the numbers may e.g. be stored for further processing, step [0044] In an example of the embodiment of Figure 3c, the first monitoring filter may be used to count the number 6

7 11 EP B1 12 of profile requests, and the second monitoring filter may be used to count the number of successfully executed profile responses. In other words, the invention allows performing service monitoring on the seventh layer (i.e. application layer) of the Open Systems Interconnection (OSI) reference model thereby allowing viewing application layer information rather than merely the number of transactions. The threshold value may be e.g. 90%. The predetermined ratio of the counted numbers may be e.g. the ratio of the number of profile requests to the number of profile responses. Therefore, it may be determined e.g. that if the number of profile requests / the number of profile responses equals or exceeds 90%, then sufficient network operability has been reached. Otherwise, sufficient network operability has not been reached. [004] Figure 3d illustrates a case in which the performing the traffic analysis further comprises tracking users fulfilling a given criteria. A respective capture file is read with a tracking criteria filter, step The user identifications (e.g. MSISDNs, MINs, IMSIs, ESNs, or IPaddresses) in the transactions in the respective capture file matching the tracking criteria filter are extracted, step At optional step 2743 it may be checked whether the user identifications include subscriber identifications, such as e.g. MSISDNs or MINs. If the user identifications do not include subscriber identifications, they may include e.g. IP addresses which will allow retrieving the subscriber identifications matching the IP addresses from the entry point specific tables, step At step 274, a list of the extracted (or retrieved) user identifications is generated for further processing of step Examples of tracking criteria include subscribers who do not have credit on their prepaid account, subscribers who tried to use a given service and succeeded/failed, subscribers who have used a given service, subscribers who have a given virus in their mobile terminal device, subscribers who are using a mobile terminal device provided by a specific vendor and/or with a specific software version, subscribers who are using the telecommunications network at a given time, and/or subscribers who are sending messages to a recipient or recipients under a given network operator. [0046] Furthermore, the embodiment of Figure 3d may be utilized for personalized advertising targeting in realtime that is based on actual subscriber activities and therefore significantly more accurate than prior art advertising targeting. Information used in such advertising targeting may include e.g. time (used to trigger delivery), subscriber status (currently active or passive), keywords (content containing one or more specified keywords), activity (browsing destination and multimedia message characteristics), profile (available profile information, such as terminal type, terminal capability, subscriber profile), and location of the subscribers. [0047] The apparatus 10 as well as the methods of Figures 2 and 3a-3d may be implemented as software, firmware, hardware, or any combination thereof. Furthermore, they may be implemented as one or more separate entities, or they may be integrated with other entities of the mobile telecommunications network 00. [0048] The exemplary embodiments can include, for example, any suitable servers, workstations, PCs, laptop computers, personal digital assistants (PDAs), Internet appliances, handheld devices, cellular telephones, smart phones, wireless devices, other devices, and the like, capable of performing the processes of the exemplary embodiments. The devices and subsystems of the exemplary embodiments can communicate with each other using any suitable protocol and can be implemented using one or more programmed computer systems or devices. [0049] One or more interface mechanisms can be used with the exemplary embodiments, including, for example, Internet access, telecommunications in any suitable form (e.g., voice, modem, and the like), wireless communications media, and the like. For example, employed communications networks or links can include one or more wireless communications networks, cellular communications networks, 3G communications networks, Public Switched Telephone Network (PSTNs), Packet Data Networks (PDNs), the Internet, intranets, a combination thereof, and the like. [000] It is to be understood that the exemplary embodiments are for exemplary purposes, as many variations of the specific hardware used to implement the exemplary embodiments are possible, as will be appreciated by those skilled in the hardware and/or software art (s). For example, the functionality of one or more of the components of the exemplary embodiments can be implemented via one or more hardware and/or software devices. [001] The exemplary embodiments can store information relating to various processes described herein. This information can be stored in one or more memories, such as a hard disk, optical disk, magnetooptical disk, RAM, and the like. One or more databases can store the information used to implement the exemplary embodiments of the present inventions. The databases can be organized using data structures (e.g., records, tables, arrays, fields, graphs, trees, lists, and the like) included in one or more memories or storage devices listed herein. The processes described with respect to the exemplary embodiments can include appropriate data structures for storing data collected and/or generated by the processes of the devices and subsystems of the exemplary embodiments in one or more databases. [002] All or a portion of the exemplary embodiments can be conveniently implemented using one or more general purpose processors, microprocessors, digital signal processors, micro-controllers, and the like, programmed according to the teachings of the exemplary embodiments of the present inventions, as will be appreciated by those skilled in the computer and/or software art(s). Appropriate software can be readily prepared by programmers of ordinary skill based on the teachings of the exemplary embodiments, as will be appreciated by those 7

8 13 EP B1 14 skilled in the software art. In addition, the exemplary embodiments can be implemented by the preparation of application-specific integrated circuits or by interconnecting an appropriate network of conventional component circuits, as will be appreciated by those skilled in the electrical art(s). Thus, the exemplary embodiments are not limited to any specific combination of hardware and/or software. [003] Stored on any one or on a combination of computer readable media, the exemplary embodiments of the present inventions can include software for controlling the components of the exemplary embodiments, for driving the components of the exemplary embodiments, for enabling the components of the exemplary embodiments to interact with a human user, and the like. Such software can include, but is not limited to, device drivers, firmware, operating systems, development tools, applications software, and the like. Such computer readable media further can include the computer program product of an embodiment of the present inventions for performing all or a portion (if processing is distributed) of the processing performed in implementing the inventions. Computer code devices of the exemplary embodiments of the present inventions can include any suitable interpretable or executable code mechanism, including but not limited to scripts, interpretable programs, dynamic link libraries (DLLs), Java classes and applets, complete executable programs, Common Object Request Broker Architecture (CORBA) objects, and the like. Moreover, parts of the processing of the exemplary embodiments of the present inventions can be distributed for better performance, reliability, cost, and the like. [004] As stated above, the components of the exemplary embodiments can include computer readable medium or memories for holding instructions programmed according to the teachings of the present inventions and for holding data structures, tables, records, and/or other data described herein. Computer readable medium can include any suitable medium that participates in providing instructions to a processor for execution. Such a medium can take many forms, including but not limited to, nonvolatile media, volatile media, transmission media, and the like. Non-volatile media can include, for example, optical or magnetic disks, magneto-optical disks, and the like. Volatile media can include dynamic memories, and the like. Transmission media can include coaxial cables, copper wire, fiber optics, and the like. Transmission media also can take the form of acoustic, optical, electromagnetic waves, and the like, such as those generated during radio frequency (RF) communications, infrared (IR) data communications, and the like. Common forms of computer-readable media can include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, any other suitable magnetic medium, a CD-ROM, CDR, CD- RW, DVD, DVD-ROM, DVD RW, DVD R, any other suitable optical medium, punch cards, paper tape, optical mark sheets, any other suitable physical medium with patterns of holes or other optically recognizable indicia, a RAM, a PROM, an EPROM, a FLASH-EPROM, any other suitable memory chip or cartridge, a carrier wave or any other suitable medium from which a computer can read. [00] While the present inventions have been described in connection with a number of exemplary embodiments, and implementations, the present inventions are not so limited, but rather cover various modifications, and equivalent arrangements, which fall within the purview of prospective claims. Claims 1. A method of managing mobile telecommunications packet data service traffic, comprising: receiving (20), from one or more data collectors, packet data traffic related to one or more services of a mobile telecommunications network; storing (20) at least a portion of the received packet data traffic in a traffic file; splitting (20) the stored traffic file into capture files, each of the capture files specific to one service of said one or more services; characterized in that the method further comprises: storing (20) the service specific capture files, with each capture file assigned an index; extracting (200) predetermined key information from the stored service specific capture files for entry points of said one or more services by utilizing one or more filters configured for searching one or more strings related to said predetermined key information, said key information including at least the index assigned to the associated service specific capture file, at least one user identification, and time data; and storing (2600) the extracted key information in entry point specific tables. 2. The method according to claim 1, characterized in that the method further comprises performing (2700) a traffic analysis utilizing at least a portion of at least one of the stored key information and the stored service specific capture files. 3. The method according to claim 2, characterized in that the performing the traffic analysis (2700) further comprises executing an end-to-end search on a given user identification, wherein the stored key information is searched (2711) for the given user identification and given time data, and the search results are used to select (2713) one or more entry point 8

9 1 EP B1 16 transactions to pass on to further analysis (2714). 4. The method according to claim 2 or 3, characterized in that the performing the traffic analysis (2700) further comprises collecting traffic statistics, wherein the number of transactions in a given service specific capture file matching a statistics filter is counted (2722) and stored (2723) for further processing.. The method according to any of the claims 2-4, characterized in that the performing the traffic analysis (2700) further comprises monitoring a given service, wherein the number of transactions in a given service specific capture file matching a first monitoring filter is counted (2732), the number of transactions in the given service specific capture file matching a second monitoring filter is counted (2734), and a predetermined ratio of the both numbers is compared (273) to a predetermined threshold value to determine if sufficient network operability has been reached. 6. The method according to any of the claims 2 -, characterized in that the performing the traffic analysis (2700) further comprises tracking users fulfilling a given criteria, wherein user identifications in the transactions in a given service specific capture file matching a tracking criteria filter are extracted (2742), and a list of the extracted user identifications is generated (274) for further processing (2746). 7. The method according to any of the claims 1-6, characterized in that the services include at least one of a multimedia messaging service (11), a wireless application protocol related service (12), a short message service (13), a remote authentication dial in user service (14), an service (1), and a session initiation protocol related service The method according to any of the claims 1-7, characterized in that the entry points include at least one of a remote authentication dial in user service entry point (11), a multimedia messaging service interface (12) between the first multimedia messaging service relay/server and an external messaging system, a short message service entry point (13), a multimedia messaging service interface (14) between the first multimedia messaging service relay/server and a second multimedia messaging service relay/server, a multimedia messaging service interface (1) between the first multimedia messaging service relay/server and a value added service application of the multimedia messaging service, a Gn interface (16) of a gateway GPRS support node, and a Gi interface (17) of the gateway GPRS support node An apparatus (10) for managing mobile telecommunications packet data service traffic, comprising: a receiver (14) configured to receive, from one or more data collectors (10), packet data traffic related to one or more services (11-16) of a mobile telecommunications network (00); a first storage (14) configured to store at least a portion of the received packet data traffic in a traffic file (1441); a splitter (1) configured to split the stored traffic file into capture files (1461), each of the capture files (1461) specific to one service of said one or more services (11-16); characterized in that the apparatus (10) further comprises: a second storage (1460) configured to store the service specific capture files (1461), with each capture file (1461) assigned an index; an extractor (1470) configured to extract predetermined key information from the stored service specific capture files (1461) for entry points (11-17) of said one or more services (11-16) by utilizing one or more filters configured for searching one or more strings related to said predetermined key information, said key information including at least the index assigned to the associated service specific capture file (1461), at least one user identification, and time data; and a third storage (1480) configured to store the extracted key information in entry point (11-17) specific tables (1481).. The apparatus according to claim 9, characterized in that the apparatus (10) further comprises an analyzer (1490) configured to perform a traffic analysis utilizing at least a portion of at least one of the stored key information and the stored service specific capture files. 11. The apparatus according to claim, characterized in that the analyzer (1490) is further configured to perform the traffic analysis by executing an end-toend search on a given user identification, wherein the stored key information is searched for the given user identification and given time data, and the search results are used to select one or more entry point (11-17) transactions to pass on to further analysis. 12. The apparatus according to claim or 11, characterized in that the analyzer (1490) is further configured to perform the traffic analysis by collecting traffic statistics, wherein the number of transactions in a 9

10 17 EP B1 18 given service specific capture file matching a statistics filter is counted and stored for further processing. 13. The apparatus according to any of the claims - 12, characterized in that the analyzer (1490) is further configured to perform the traffic analysis by monitoring a given service (11-16), wherein the number of transactions in a given service specific capture file matching a first monitoring filter is counted, the number of transactions in the given service specific capture file matching a second monitoring filter is counted, and a predetermined ratio of the both numbers is compared to a predetermined threshold value to determine if sufficient network operability has been reached. 14. The apparatus according to any of the claims - 13, characterized in that the analyzer (1490) is further configured to perform the traffic analysis by tracking users fulfilling a given criteria, wherein the user identifications in the transactions in a given service specific capture file matching a tracking criteria filter are extracted, and a list of the extracted user identifications is generated for further processing. 1. The apparatus according to any of the claims 9-14, characterized in that the apparatus (10) further comprises one or more bonded interfaces (14, 14) via which the packet data service (11-16) traffic is received. 16. A computer program embodied on a computer readable medium, the computer program controlling a data-processing device to perform the step of: receiving (20), from one or more data collectors, packet data traffic related to one or more services of a mobile telecommunications network; storing (20) at least a portion of the received packet data traffic in a traffic file; splitting (20) the stored traffic file into capture files, each of the capture files specific to one service of said one or more services; characterized in that the computer program further controls the data-processing device to perform the steps of: Patentansprüche storing (20) the service specific capture files, with each capture file assigned an index; extracting (200) predetermined key information from the stored service specific capture files for entry points of said one or more services by utilizing one or more filters configured for searching one or more strings related to said predetermined key information, said key information including at least the index assigned to the associated service specific capture file, at least one user identification, and time data; and storing (2600) the extracted key information in entry point specific tables. 1. Verfahren für das Management von Mobiltelekommunikations-Paketdatendienst-Verkehr, das umfasst: Empfangen (20) von Paketdatenverkehr, der mit einem oder mehreren Diensten eines Mobiltelekommunikationsnetzes in Beziehung steht, von einem oder mehreren Datensammeleinrichtungen; Speichern (20) wenigstens eines Teils des empfangenen Paketdatenverkehrs in einer Verkehrsdatei; Aufteilen (20) der gespeicherten Verkehrsdatei in Einfangdateien, wobei jede der Einfangdateien für einen Dienst des einen oder der mehreren Dienste spezifisch ist; dadurch gekennzeichnet, dass das Verfahren ferner umfasst: Speichern (20) der dienstspezifischen Einfangdateien, wobei jeder Einfangdatei ein Index zugewiesen ist; Extrahieren (200) vorgegebener Schlüsselinformationen aus den gespeicherten dienstspezifischen Einfangdateien für Eintrittspunkte des einen oder der mehreren Dienste unter Verwendung eines oder mehrerer Filter, die konfiguriert sind, um einen oder mehrere Strings zu suchen, die mit den vorgegebenen Schlüsselinformationen in Beziehung stehen, wobei die Schlüsselinformationen zumindest den der zugeordneten dienstspezifischen Einfangdatei zugewiesenen Index, wenigstens eine Anwenderkennung und Zeitdaten enthalten; und Speichern (2600) der extrahierten Schlüsselinformationen in eintrittspunktspezifischen Tabellen Verfahren nach Anspruch 1, dadurch gekennzeichnet, dass das Verfahren ferner das Ausführen (2700) einer Verkehrsanalyse unter Verwendung wenigstens eines Teils der gespeicherten Schlüsselinformationen und/oder der gespeicherten dienstspezifischen Einfangdateien umfasst. 3. Verfahren nach Anspruch 2, dadurch gekennzeichnet, dass das Ausführen der Verkehrsanalyse

11 19 EP B1 (2700) ferner das Ausführen einer Suche von Ende zu Ende in einer gegebenen Anwenderkennung umfasst, wobei die gespeicherten Schlüsselinformationen auf die gegebene Anwenderkennung und gegebene Zeitdaten durchsucht werden (2711) und wobei die Suchergebnisse verwendet werden, um eine oder mehrere Eintrittspunkttransaktionen auszuwählen (2713), um eine weitere Analyse fortzusetzen (2714). 4. Verfahren nach Anspruch 2 oder 3, dadurch gekennzeichnet, dass das Ausführen der Verkehrsanalyse (2700) ferner das Sammeln von Verkehrsstatistiken umfasst, wobei die Anzahl von Transaktionen in einer gegebenen dienstspezifischen Einfangdatei, die mit einem Statistikfilter übereinstimmt, gezählt (2722) und für eine weitere Verarbeitung gespeichert (2723) wird.. Verfahren nach einem der Ansprüche 2-4, dadurch gekennzeichnet, dass das Ausführen der Verkehrsanalyse (2700) ferner das Überwachen eines gegebenen Diensts umfasst, wobei die Anzahl von Transaktionen in einer gegebenen dienstspezifischen Einfangdatei, die mit einem ersten Überwachungsfilter übereinstimmt, gezählt (2732) wird, die Anzahl von Transaktionen in der gegebenen dienstspezifischen Einfangdatei, die mit einem zweiten Überwachungsfilter übereinstimmt, gezählt (2734) wird und ein vorgegebenes Verhältnis der beiden Zahlen mit einem vorgegebenen Schwellenwert verglichen (273) wird, um zu bestimmen, ob eine ausreichende Netzbetriebsfähigkeit erreicht worden ist. 6. Verfahren nach einem der Ansprüche 2-, dadurch gekennzeichnet, dass das Ausführen der Verkehrsanalyse (2700) ferner das Verfolgen von Anwendern, die gegebene Kriterien erfüllen, umfasst, wobei Anwenderkennungen in den Transaktionen in einer gegebenen dienstspezifischen Einfangdatei, die mit einem Verfolgungskriteriumfilter übereinstimmt, extrahiert (2742) werden und wobei eine Liste der extrahierten Anwenderkennungen für eine weitere Verarbeitung (2746) erzeugt (274) wird. 7. Verfahren nach einem der Ansprüche 1-6, dadurch gekennzeichnet, dass die Dienste einen MultimediaNachrichtendienst (11), einen drahtlosen, anwendungsprotokollbezogenen Dienst (12), einen Kurznachrichtendienst (13), eine Fernauthentifizierungseinwahl in einen Anwenderdienst (14), einen -Dienst (1) und einen auf ein Sitzungsinitiierungsprotokoll bezogenen Dienst (16) enthalten Verfahren nach einem der Ansprüche 1-7, dadurch gekennzeichnet, dass die Eintrittspunkte eine Fernauthentifizierungseinwahl in einen Anwenderdienst-Eintrittspunkt (11) und/oder eine Multimedianachrichtendienst-Schnittstelle (12) zwischen dem ersten Multimedianachrichtendienst-Verstärker/Server und einem externen Nachrichtensystem, einen Kurznachrichtendienst-Eintrittspunkt (13), eine Multimedianachrichtendienst-Schnittstelle (14) zwischen dem ersten Multimedianachrichtendienst-Verstärker/Server und einem zweiten Multimedianachrichtendienst-Verstärker/Server, eine Multimedianachrichtendienst-Schnittstelle (1) zwischen dem ersten Multimedianachrichtendienst- Verstärker/Server und einer Dienstanwendung des Multimedianachrichtendiensts, zu der ein Wert hinzugefügt ist, eine Gn-Schnittstelle (16) eines Gateway-GPRS-Unterstützungsknotens und eine Gi- Schnittstelle (17) des Gateway-GPRS-Unterstützungsknotens enthalten. 9. Vorrichtung (10) für das Management von Mobiltelekommunikations- Paketdatendienst- Verkehr, mit: einem Empfänger (14), der konfiguriert ist, um von einer oder mehreren Datensammeleinrichtungen (10) Paketdatenverkehr, der mit einem oder mehreren Diensten (11-16) eines Mobiltelekommunikationsnetzes (00) in Beziehung steht, zu empfangen; einem ersten Speicher (14), der konfiguriert ist, um wenigstens einen Anteil des empfangenen Paketdatenverkehrs in einer Verkehrsdatei (1441) zu speichern; einem Teiler (1), der konfiguriert ist, um die gespeicherte Verkehrsdatei in Einfangdateien (1461) zu teilen, wobei jede der Einfangdateien (1461) für einen Dienst des einen oder der mehreren Dienste (11-16) spezifisch ist; dadurch gekennzeichnet, dass die Vorrichtung (10) ferner enthält: einen zweiten Speicher (1460), der konfiguriert ist, um die dienstspezifischen Einfangdateien (1461) zu speichern, wobei jeder Einfangdatei (1461) ein Index zugewiesen ist; eine Extraktionseinrichtung (1470), die konfiguriert ist, um vorgegebene Schlüsselinformationen aus den gespeicherten dienstspezifischen Einfangdateien (1461) für Eintrittspunkte (11-17) des einen oder der mehreren Dienste (11-16) unter Verwendung eines oder mehrerer Filter zu extrahieren, die konfiguriert sind, um nach einem oder mehreren Strings zu suchen, die mit den vorgegebenen Schlüsselinformationen in Beziehung stehen, wobei die Schlüsselinformationen wenigstens den der zugeordneten dienstspezifischen Ein- 11

12 21 EP B1 22 fangdatei (1461) zugewiesenen Index, wenigstens eine Anwenderkennung und Zeitdaten enthalten; und einen dritten Speicher (1480), der konfiguriert ist, um die extrahierten Schlüsselinformationen in eintrittspunktspezifischen Tabellen (1481) zu speichern.. Vorrichtung nach Anspruch 9, dadurch gekennzeichnet, dass die Vorrichtung (10) ferner einen Analysator (1490) enthält, der konfiguriert ist, um eine Verkehrsanalyse unter Verwendung wenigstens eines Teils der gespeicherten Schlüsselinformationen und/oder der gespeicherten dienstspezifischen Einfangdateien auszuführen. 11. Vorrichtung nach Anspruch, dadurch gekennzeichnet, dass der Analysator (1490) ferner konfiguriert ist, um die Verkehrsanalyse durch Ausführen einer Suche von Ende zu Ende in einer gegebenen Anwenderkennung auszuführen, wobei die gespeicherten Schlüsselinformationen auf die gegebene Anwenderkennung und auf gegebene Zeitdaten durchsucht werden und die Suchergebnisse verwendet werden, um eine oder mehrere Eintrittspunkttransaktionen (11-17) zu wählen, um eine weitere Analyse fortzusetzen. 12. Vorrichtung nach Anspruch oder 11, dadurch gekennzeichnet, dass der Analysator (1490) ferner konfiguriert ist, um die Verkehrsanalyse durch Sammeln von Verkehrsstatistiken auszuführen, wobei die Anzahl von Transaktionen in einer gegebenen dienstspezifischen Einfangdatei, die mit einem Statistikfilter übereinstimmt, gezählt und für eine weitere Verarbeitung gespeichert wird. 13. Vorrichtung nach einem der Ansprüche -12, dadurch gekennzeichnet, dass der Analysator (1490) ferner konfiguriert ist, um die Verkehrsanalyse durch Überwachen eines gegebenen Diensts (11-16) auszuführen, wobei die Anzahl von Transaktionen in einer gegebenen dienstspezifischen Einfangdatei, die mit einem ersten Überwachungsfilter übereinstimmt, gezählt wird, die Anzahl von Transaktionen in der gegebenen dienstspezifischen Einfangdatei, die mit einem zweiten Überwachungsfilter übereinstimmt, gezählt wird und ein vorgegebenes Verhältnis der beiden Zahlen mit einem vorgegebenen Schwellenwert verglichen wird, um zu bestimmen, ob eine ausreichende Netzbetriebsfähigkeit erreicht worden ist Vorrichtung nach einem der Ansprüche -13, dadurch gekennzeichnet, dass der Analysator (1490) ferner konfiguriert ist, um die Verkehrsanalyse durch Verfolgen von Anwendern, die ein gegebenes Kriterium erfüllen, auszuführen, wobei die Anwenderkennungen in den Transaktionen in einer gegebenen dienstspezifischen Einfangdatei, die mit einem Verfolgungskriteriumfilter übereinstimmt, extrahiert werden und eine Liste der extrahierten Anwenderkennungen für eine weitere Verarbeitung erzeugt wird. 1. Vorrichtung nach einem der Ansprüche 9-14, dadurch gekennzeichnet, dass die Vorrichtung (10) ferner eine oder mehrere gebundene Schnittstellen (14, 14) enthält, über die der Paketdatendienst-Verkehr (11-16) empfangen wird. 16. Computerprogramm, das in einem computerlesbaren Medium verkörpert ist, wobei das Computerprogramm eine Datenverarbeitungsvorrichtung steuert, um den folgenden Schritt auszuführen: Empfangen (20) von Paketdatenverkehr, der mit einem oder mehreren Diensten eines Mobiltelekommunikationsnetzes in Beziehung steht, von einer oder mehreren Datensammeleinrichtungen; Speichern (20) wenigstens eines Anteils des empfangenen Paketdatenverkehrs in einer Verkehrsdatei; Teilen (20) der gespeicherten Verkehrsdatei in Einfangdateien, wobei jede der Einfangdateien für einen Dienst des einen oder der mehreren Dienste spezifisch ist; dadurch gekennzeichnet, dass das Computerprogramm ferner die Datenverarbeitungsvorrichtung steuert, um die folgenden Schritte auszuführen: Speichern (20) der dienstspezifischen Einfangdateien, wobei jeder Einfangdatei ein Index zugewiesen ist; Extrahieren (200) vorgegebener Schlüsselinformationen aus den gespeicherten dienstspezifischen Einfangdateien für Eintrittspunkte des einen oder der mehreren Dienste unter Verwendung eines oder mehrerer Filter, die konfiguriert sind, um nach einem oder mehreren Strings zu suchen, die mit den vorgegebenen Schlüsselinformationen in Beziehung stehen, wobei die Schlüsselinformationen wenigstens den Index, der der zugeordneten dienstspezifischen Einfangdatei zugewiesen ist, wenigstens eine Anwenderkennung und Zeitdaten enthalten; und Speichern (2600) der extrahierten Schlüsselinformationen in eintrittspunktspezifischen Tabellen. 12

13 23 EP B1 24 Revendications 1. Procédé de gestion du trafic de services de données par paquets de télécommunication mobiles, comprenant le fait : de recevoir (20), d un ou de plusieurs collecteurs de données, un trafic de données par paquets associé à un ou à plusieurs services d un réseau de télécommunication mobile; de stocker (20) au moins une partie du trafic de données par paquets reçu dans un fichier de trafic ; de diviser (20) le fichier de trafic stocké dans des fichiers de capture, chacun des fichiers de capture étant spécifique à un service desdits un ou plusieurs services ; caractérisé en ce que le procédé comprend en outre le fait : de stocker (20) les fichiers de capture spécifiques aux services, à chaque fichier de capture étant attribué un indice ; d extraire (200) des informations importantes prédéterminées des fichiers de capture spécifiques aux services stockés pour des points d entrée desdits un ou plusieurs services en utilisant un ou plusieurs filtres configurés pour rechercher une ou plusieurs chaînes associées auxdites informations importantes prédéterminées, lesdites informations importantes comprenant au moins l indice attribué au fichier de capture spécifique à un service associé, au moins une identification d utilisateur, et des données temporelles ; et de stocker (2600) les informations importantes extraites dans des tableaux spécifiques aux points d entrée. 2. Procédé selon la revendication 1, caractérisé en ce que le procédé comprend en outre le fait de réaliser (2700) une analyse du trafic en utilisant au moins une partie d au moins l une des informations importantes stockées et des fichiers de capture spécifiques aux services stockés. 3. Procédé selon la revendication 2, caractérisé en ce que la réalisation de l analyse du trafic (2700) comprend en outre le fait d exécuter une recherche de bout en bout sur une identification d utilisateur donnée, dans lequel on recherche (2711) dans l information importante stockée l identification d utilisateur donnée et les données temporelles données, et les résultats de la recherche sont utilisés pour sélectionner (2713) une ou plusieurs transactions de points d entrée pour passer à une autre analyse (2714) Procédé selon la revendication 2 ou 3, caractérisé en ce que la réalisation de l analyse du trafic (2700) comprend en outre le fait de collecter des statistiques concernant le trafic, dans lequel le nombre de transactions dans un fichier de capture spécifique à un service donné correspondant à un filtre statistique est compté (2722) et stocké (2723) pour un traitement ultérieur.. Procédé selon l une des revendications 2-4, caractérisé en ce que la réalisation de l analyse du trafic (2700) comprend en outre le fait de surveiller un service donné, dans lequel le nombre de transactions dans un fichier de capture spécifique au service donné correspondant à un premier filtre de surveillance est compté (2732), le nombre de transactions dans le fichier de capture spécifique à un service donné correspondant à un deuxième filtre de surveillance est compté (2734), et un rapport prédéterminé entre les deux nombres est comparé (273) à une valeur seuil prédéterminée pour déterminer si l opérabilité suffisante du réseau a été atteinte. 6. Procédé selon l une des revendications 2-, caractérisé en ce que la réalisation de l analyse du trafic (2700) comprend en outre le fait de suivre des utilisateurs remplissant un critère donné, dans lequel les identifications des utilisateurs dans les transactions dans un fichier de capture spécifique à un service donné correspondant à un filtre de critères de suivi sont extraites (2742), et une liste des identifications des utilisateurs extraite est générée (274) pour un traitement ultérieur (2746). 7. Procédé selon l une des revendications 1-6, caractérisé en ce que les services comprennent au moins l un d un service de messagerie multimédia (11), d un service associé à un protocole d application sans fil (12), d un service de messages courts (13), d un service (14) d entrée en communication d un utilisateur distant avec authentification, d un service de messageries (1), et d un service associé à un protocole d initiation de session (16). 8. Procédé selon l une des revendications 1-7, caractérisé en ce que les points d entrée comprennent au moins l un d un point d entrée (11) de service d entrée en communication d un utilisateur distant avec authentification, d une interface de service de messageries multimédia (12) entre le premier relais/serveur de service de messageries multimédia et un système de messageries externe, d un point d entrée de service de messages courts (13), d une interface de service de messageries multimédia (14) entre le premier relais/serveur de services de messageries multimédia et un deuxième relais/ serveur de services de messageries multimédia, d une interface de service de messageries multimé- 13

14 2 EP B1 26 dia (1) entre le premier relais/serveur de services de messageries multimédia et une application de services à valeur ajoutée du service de messageries multimédia, d une interface Gn (16) d un noeud de support de passerelle GPRS, et d une interface Gi (17) du noeud de support de passerelle GPRS. 9. Appareil (10) de gestion du trafic de services de données par paquets de télécommunications mobiles, comprenant : 11. Appareil selon la revendication, caractérisé en ce que l analyseur (1490) est en outre configuré pour réaliser l analyse du trafic en exécutant une recherche de bout en bout sur une identification d utilisateur donnée, dans lequel on recherche dans l information importante stockée l identification d utilisateur donnée et les données temporelles données, et les résultats de la recherche sont utilisés pour sélectionner une ou plusieurs transactions de points d entrée (11-17) pour passer à une autre analyse. un récepteur (14) configuré pour recevoir, à partir d un ou de plusieurs collecteurs de données (10), un trafic de données par paquets associé à un ou à plusieurs services (11-16) d un réseau de télécommunications mobiles (00) ; un premier stockage (14) configuré pour stocker au moins une partie du trafic de données par paquets reçu dans un fichier de trafic (1441) ; un diviseur (1) configuré pour diviser le fichier de trafic stocké dans des fichiers de capture (1461), chacun des fichiers de capture (1461) étant spécifique à un service desdits un ou plusieurs services (11-16) ; caractérisé en ce que l appareil (10) comprend en outre : un deuxième stockage (1460) configuré pour stocker les fichiers de capture (1461) spécifiques aux services, à chaque fichier de capture (1461) étant attribué un indice ; un extracteur (1470) configuré pour extraire des informations importantes prédéterminées des fichiers de capture spécifiques aux services stockés (1461) pour des points d entrée (11-17) desdits un ou plusieurs services (11-16) en utilisant un ou plusieurs filtres configurés pour rechercher une ou plusieurs chaînes associées auxdites informations importantes prédéterminées, lesdites informations importantes comprenant au moins l indice attribué au fichier de capture (1461) spécifique au service associé, au moins une identification d utilisateur, et des données temporelles ; et un troisième stockage (1480) configuré pour stocker les informations importantes extraites dans des tableaux spécifiques (1481) aux points d entrée (11-17).. Appareil selon la revendication 9, caractérisé en ce que l appareil (10) comprend en outre un analyseur (1490) configuré pour réaliser une analyse du trafic en utilisant au moins une partie d au moins l une des informations importantes stockées et des fichiers de capture spécifiques aux services stockés Appareil selon la revendication ou 11, caractérisé en ce que l analyseur (1490) est en outre configuré pour réaliser l analyse du trafic en collectant des statistiques concernant le trafic, dans lequel le nombre de transactions dans un fichier de capture spécifique à un service donné correspondant à un filtre statistique est compté et stocké pour un traitement ultérieur. 13. Appareil selon l une des revendications -12, caractérisé en ce que l analyseur (1490) est en outre configuré pour réaliser l analyse du trafic en surveillant un service donné (11-16), dans lequel le nombre de transactions dans un fichier de capture spécifique au service donné correspondant à un premier filtre de surveillance est compté, le nombre de transactions dans le fichier de capture spécifique au service donné correspondant à un deuxième filtre de surveillance est compté, et un rapport prédéterminé entre les deux nombres est comparé à une valeur seuil prédéterminée pour déterminer si l opérabilité suffisante du réseau a été atteinte. 14. Appareil selon l une des revendications -13, caractérisé en ce que l analyseur (1490) est en outre configuré pour réaliser l analyse du trafic en suivant des utilisateurs satisfaisant un critère donné, dans lequel les identifications des utilisateurs dans les transactions dans un fichier de capture spécifique à un service donné correspondant à un filtre de critères de suivi sont extraites, et une liste des identifications des utilisateurs extraite est générée pour un traitement ultérieur. 1. Appareil selon l une des revendications 9-14, caractérisé en ce que l appareil (10) comprend en outre une ou plusieurs interfaces liées (14, 14) par lesquelles le trafic de service de données par paquets (11-16) est reçu. 16. Programme informatique incorporé sur un support lisible par ordinateur, le programme informatique commandant un dispositif de traitement de données pour réaliser les étapes qui consistent : à recevoir (20), à partir d un ou de plusieurs collecteurs de données, un trafic de données 14

15 27 EP B1 28 par paquets associé à un ou à plusieurs services d un réseau de télécommunications mobiles ; à stocker (20) au moins une partie du trafic de données par paquets reçu dans un fichier de trafic ; à diviser (20) le fichier de trafic stocké dans des fichiers de capture, chacun des fichiers de capture étant spécifique à un service desdits un ou plusieurs services ; caractérisé en ce que le programme informatique commande en outre le dispositif de traitement de données pour réaliser les étapes qui consistent : à stocker (20) les fichiers de capture spécifiques aux services, à chaque fichier de capture étant attribué un indice ; à extraire (200) des informations importantes prédéterminées à partir des fichiers de capture spécifiques aux services stockés pour des points d entrée desdits un ou plusieurs services en utilisant un ou plusieurs filtres configurés pour rechercher une ou plusieurs chaînes associées auxdites informations importantes prédéterminées, lesdites informations importantes comprenant au moins l indice attribué au fichier de capture spécifique à un service associé, au moins une identification d utilisateur, et des données temporelles ; et à stocker (2600) les informations importantes extraites dans des tableaux spécifiques aux points d entrée

16 EP B1 16

17 EP B1 17

18 EP B1 18

19 EP B1 19

20 EP B1