# GTP Traffic Logging & Counting

You can enable GTP traffic logging and counting on this page.

With the GTP traffic logging feature, you can configure the security device to log GTP packets based on their status and you can also specify how much information you want about each packet. You can use the console, Syslog, and the WebUI to view traffic logs. GTP traffic logging is disabled by default on the security device.

When you enable GTP traffic logging, you can specify one of the following forms of logging:

- Basic Each log entry in its basic form contains the following information:
  - Timestamp
  - Source IP address
  - Destination IP address
  - TID or TEID
  - Message type
  - Packet status: forwarded, prohibited, state-invalid, rate or tunnel-limited
  - Interface, vsys or vrouter name if applicable
  - PLMN or zone name

- Extended Each log entry in its extended form contains the following information in addition to the “basic” information:
  - IMSI
  - MSISDN
  - APN
  - Selection Mode
  - SGSN address for signaling
  - SGSN address for user data
  - GGSN address for signaling
  - GGSN address for user data

With the GTP traffic counting feature, you can configure the security device to tally the number of user data and control messages (or bytes of data) that it forwards to the GGSNs and SGSNs that it protects. The security device counts traffic for each GTP tunnel separately. When a tunnel is deleted, the security device counts and logs the total number of messages it received from and forwarded to the SGSN or GGSN.

The log entry for the deletion of a tunnel contains the following information:

- Timestamp

- Interface name (if applicable)

- SGSN IP address

- GGSN IP address

- TID (Tunnel Identifier)

- Tunnel duration time in seconds

- Number of messages sent to the SGSN

- Number of messages sent to the GGSN

### To Enable GTP Traffic Logging and Counting

1. Enter the following information:

GTP Traffic Counters: Select On or Off to enable or disable the security device to count traffic.

Enable traffic logging by selecting Basic or Extended for one or more of the following packet statuses:

Packet Forwarded: A packet that the security device transmits because the GTP policy allows it.

Packet Prohibited: A packet that the security device drops because the GTP policy denies it.

Packet State-Invalid: A packet that the security device drops because it failed stateful inspection.

Packet Tunnel-Limited: A packet that the security device drops because the maximum limit of GTP tunnels for the destination GSN is reached.

Packet Rate-Limited: A packet that the security device drops because it exceeds the maximum rate limit of the destination GSN.

When Packet Rate Limit is exceeded, log every other _ messages: Specify a logging frequency to control the interval at which the security device logs messages with the Packet Rate-Limited status. For example, if you set the frequency value to 10, the security device only logs every tenth message above the set rate limit.

2. Click Apply to save your settings.