PFCP session model, GTP-U on N3/N9, PDR/FAR/URR/QER in detail, buffering for idle UE, traffic accounting, QoS enforcement
1. What Is the UPF — The Simple Version
The UPF (User Plane Function) is the only NF in 5GC that touches actual subscriber data. Every other NF — AMF, SMF, PCF, UDM — processes signalling. The UPF forwards the packets. It receives GTP-U tunnelled traffic from gNBs on N3, strips the tunnel, applies policy (QoS, charging, security), and routes the inner IP packet out to the internet or enterprise network on N6. It also handles downlink buffering when UEs are in idle mode.
The UPF is the most performance-critical NF in 5GC. An AMF processing 1 million registrations per day handles ~12 requests per second — manageable on any modern server. A UPF forwarding 100 Gbps of GTP-U traffic handles ~8 million 1500-byte packets per second — requiring DPDK, hugepages, SR-IOV, and CPU pinning to achieve this on COTS hardware.
| 3GPP Reference |
| 3GPP TS 23.501 Section 5.7 — User Plane Architecture and Functions |
| 3GPP TS 29.244 — Interface between SMF and UPF (N4/PFCP specification) |
| 3GPP TS 38.415 — NG-RAN — PDU Session User Plane Protocol (GTP-U QFI extension header) |
2. Architecture — UPF Interfaces
| Interface | Protocol | Direction | Function |
| N3 | GTP-U over UDP/IP | gNB ↔ UPF | User plane uplink/downlink per PDU session and QoS flow. Each session identified by TEID. |
| N4 | PFCP over UDP 8805 | SMF ↔ UPF | Control plane: SMF programs session rules (PDR/FAR/URR/QER), reads usage reports. |
| N6 | IP (any) | UPF ↔ Data Network | Internet or enterprise breakout. Unencapsulated IP. N6 is the UPF’s external facing interface. |
| N9 | GTP-U over UDP/IP | UPF ↔ UPF | Inter-UPF tunnels: UL CL to anchor UPF, or between distributed UPF instances. |
| N19 (Rel-16+) | GTP-U | UPF ↔ UPF | Redundancy path for MA-PDU sessions (multi-access PDU sessions). |
Table 1 — UPF interfaces. N3 and N6 carry all subscriber data. N4 (PFCP) is the control path. N4 failure = no new sessions can be created, but existing sessions continue forwarding.
3. The PFCP Rule Set — How SMF Programs the UPF
Every PDU session on the UPF is represented as a PFCP Session containing a set of rules. These rules define exactly what the UPF does with every packet in that session.
PDR — Packet Detection Rule
A PDR matches incoming packets to a specific session. The UPF evaluates all PDRs in precedence order (lowest number = highest priority). The first matching PDR determines which FAR, URR, and QER to apply. A typical session has two default PDRs: uplink (matches by source interface=Access and the UPF’s F-TEID on N3) and downlink (matches by source interface=Core and the UE’s IP address on N6).
| PDR Field | Purpose | Typical Value |
| PDR ID | Unique within session | 1=uplink default, 2=downlink default, 3+ for per-flow PDRs |
| Precedence | Match priority: lower = checked first | 100 for app-specific flows, 65535 for default catch-all |
| Source Interface | Which network interface to match on | Access (N3 uplink), Core (N6/N9 downlink) |
| F-TEID (uplink PDR) | Match on this GTP-U TEID on N3 | Allocated by UPF in PFCP Session Establishment Response. gNB sends to this TEID. |
| UE IP Address (downlink) | Match downlink packets destined to this UE IP | Allocated by SMF during session setup. All downlink to this IP hits this PDR. |
| SDF Filter | IP 5-tuple filter for application-specific PDRs | permit out ip from 203.0.113.0/24 to assigned (CDN IP range for premium QoS) |
| FAR ID | Which Forwarding Action Rule to apply | Points to the FAR that determines where to send matched packets |
| URR ID list | Which Usage Reporting Rules to increment | URR-1 for session charging, URR-2 for app-specific reporting |
Table 2 — PDR fields. The SDF filter enables per-application QoS differentiation — matching specific traffic to different FARs/QERs for premium services.
FAR — Forwarding Action Rule
A FAR defines what to do with PDR-matched packets. Three actions: FORWARD (send to output interface), BUFFER (hold packets for idle UE — send Downlink Data Notification to SMF), DROP. A session has at minimum two FARs: uplink FAR (Action=FORWARD, interface=N6) and downlink FAR (initially Action=BUFFER until gNB TEID known, then updated to Action=FORWARD with Outer Header Creation pointing to gNB N3 TEID).
URR — Usage Reporting Rule
A URR measures traffic for charging. Methods: VOLUM (count octets), DURAT (count seconds), EVENT (detect application start/stop). Triggers: volume threshold hit (prepaid quota depletion), periodic timer (offline CDR), inactivity timeout (end-of-session CDR), flow start/stop.
| Pro Tip |
| 32-bit URR volume counters wrap at ~4 GB. A video streaming user can exceed 4 GB in one session. |
| Counter wraparound = SMF receives zero-byte usage report = free usage in CDR = revenue loss. |
| Verify UPF vendor uses 64-bit URR counters. 3GPP TS 29.244 mandates 64-bit. Some implementations have bugs. |
QER — QoS Enforcement Rule
A QER enforces bitrate limits and marks packets with QFI (QoS Flow Identifier). Gate Status (OPEN/CLOSED) controls whether traffic is allowed. Session-level QER enforces Session-AMBR. Flow-level QERs enforce GBR/MBR for individual QoS flows (VoNR GBR, enterprise guaranteed bitrate).
4. Key Parameters and Technical Terms
| Term | Definition | Operational Significance |
| F-TEID | Fully Qualified TEID = IP + 32-bit TEID. One end of a GTP-U tunnel. | UPF allocates F-TEID for N3 uplink. SMF provides to gNB in N2 PDU Session setup. Mismatch = tunnel blackhole. |
| GTP-U QFI Extension Header | 6-bit QoS Flow Identifier carried in GTP-U extension header (3GPP TS 38.415). | gNB marks each GTP-U packet with QFI matching the PDU session QoS flow. UPF uses QFI to apply correct QER. |
| PFCP Heartbeat | SMF-UPF PFCP heartbeat every 60s (default). 3 missed = Association failure declared. | Association failure: SMF marks UPF as unavailable. No new sessions. Existing sessions: continue until TEID times out on gNB. |
| Downlink Data Notification | UPF sends DDN to SMF when first downlink packet arrives for a buffered (idle UE) session. | Triggers AMF paging. DDN must reach SMF quickly — delay increases paging latency and user-perceived reconnect time. |
| N9 GTP-U Tunnel | GTP-U tunnel between UPF instances (UL CL to anchor, or inter-site). | Adds overhead (outer IP+UDP+GTP header = ~36 bytes) to each packet on N9 path. Plan MTU accordingly. |
| PFCP Session SEID | Session Endpoint Identifier — 64-bit value identifying a PFCP session on each side. | SMF F-SEID and UPF F-SEID exchanged during PFCP Session Establishment. Used in all subsequent PFCP messages for that session. |
| Linked URR | Multiple URRs linked together — when one triggers, all linked URRs report simultaneously. | Used for converged charging: volume URR and time URR both linked — when quota exhausted, both close the CDR record. |
| Apply Action: NOCP | No CP (Control Plane) — UPF sends DDN to SMF but does NOT buffer packets (drops them after notification). | Used for low-priority IoT: notify but do not buffer. Saves UPF buffer memory for sessions that actually need buffering. |
Table 3 — UPF key parameters. GTP-U QFI and URR counter width are two commonly overlooked details that cause production issues.
5. Common Issues in the Field
| Field Note: GTP-U MTU Fragmentation — Looks Like Radio Problem |
| Operator deployed SA with standard MTU 1500 bytes on all transport links. |
| GTP-U overhead: outer IP (20) + UDP (8) + GTP (8) = 36 bytes. Inner IP + payload must fit in 1500-36=1464 bytes. |
| Large packets from internet (1500 byte TCP segments) fragmented at UPF on N3 output. |
| Fragmentation: increased latency, high retransmission counter on gNB. RAN team blamed coverage. |
| Fix: set MTU=9000 (jumbo frames) on all N3, N6, N9 transport links. Configure N6 MSS clamping on UPF. |
| Throughput improved 15%. Retransmission counter dropped to baseline. |
| Field Note: UPF Buffer Overflow — IoT Mass Idle Entry |
| Smart meter deployment: 500,000 meters simultaneously enter idle mode at end of hourly reporting window. |
| All 500,000 downlink URR reports arrive at UPF simultaneously triggering buffer allocation. |
| UPF packet buffer (default 64 MB per UPF instance) filled in 3 seconds. Buffer overflow: packets dropped. |
| Meters could not page and reconnect. Data collection failed for 15 minutes. |
| Fix: set NOCP action for IoT DNN FAR (DDN without buffering). IoT devices reconnect on next cycle anyway. |
| Also: stagger IoT device reporting intervals with ±10% jitter to prevent synchronised idle entry. |
6. Troubleshooting
| Symptom | Root Cause | Check | Fix |
| High throughput but high retransmissions | GTP-U MTU fragmentation on N3 transport | Capture N3 packets: look for IP fragmentation (fragment offset > 0); check interface MTU | Set jumbo frames (MTU 9000) on N3/N6/N9 links; configure MSS clamping on UPF N6 |
| Idle UE downlink delay > 3s | DDN slow to reach SMF — N4 congestion or SMF busy | UPF: DDN send timestamp vs SMF receive timestamp; N4 queue depth | Tune N4 processing threads; prioritise DDN messages over URR reports |
| Charging CDR shows zero bytes for high-usage user | URR 32-bit counter wraparound at ~4 GB | Check UPF vendor release notes for URR counter width; test session > 4 GB | Upgrade UPF to version with 64-bit URR counters; verify with vendor |
| All UPF N3 sessions drop after UPF restart | PFCP sessions not recovered — UPF restarted fresh | UPF: PFCP session recovery procedure; SMF: recovery after UPF restart | Configure PFCP Session Recovery: SMF re-establishes all sessions after UPF restart notification |
| Traffic stops for specific flow mid-session | QER Gate closed — PCF pushed policy with gate=CLOSED | SMF: PCF N7 policy update containing gate closed rule; PCF: policy decision log | Check PCF charging policy — quota exhaustion or subscriber block; restore QER gate |
Table 4 — UPF troubleshooting. MTU and URR counter issues are the two most commonly missed in acceptance testing.
7. Summary — Key Takeaways
| Topic | Key Takeaway |
| PFCP rules | PDR (match) → FAR (action) → URR (measure) → QER (enforce). Four rule types per session. Downlink FAR starts as BUFFER, updated with gNB TEID after gNB reports its N3 endpoint. |
| URR counter width | Verify 64-bit URR counters in UPF vendor release. 32-bit = wraparound at 4 GB = CDR revenue loss for high-usage subscribers. |
| MTU | Set jumbo frames (MTU=9000) on all N3, N6, N9 transport links. GTP-U adds 36 bytes overhead. Fragmentation looks like RF problems. |
| Buffering | UPF buffers downlink for idle UEs. Buffer is finite. For IoT: use NOCP action (notify without buffering) to prevent buffer overflow during mass idle entry. |
| PFCP Association | Heartbeat every 60s. 3 misses = association failure. Existing sessions continue. No new sessions. Recovery: SMF re-establishes all sessions. |
| N4 priority | PFCP DDN messages must be prioritised over bulk URR reports on N4. Delayed DDN = delayed paging = user-perceived reconnect latency. |
Table 5 — Post 11 summary. UPF is the only 5GC NF where hardware configuration (hugepages, SR-IOV, MTU) directly determines functional correctness, not just performance.
Next: Post 12 — 5GC Transport & Interconnect