A high-performance 5G User Plane Function must do more than forward packets. In a commercial or private 5G network the user plane must also understand subscriber sessions, measure consumption, report usage events, enforce policy and respond to instructions from the control plane. We integrated Aether SD-Core with eUPF, an eBPF/XDP-based User Plane Function, and completed PFCP Usage Reporting Rule support for subscriber-level metering, threshold reporting and quota enforcement.
The completed integration allows the SD-Core Session Management Function to configure subscriber data limits through PFCP. eUPF then measures each subscriber's traffic and enforces the configured quota directly inside the Linux kernel's XDP fast path.
During live validation we configured an early-warning threshold of 900 MiB (943,718,400 bytes) and a hard subscriber quota of 1 GiB (1,073,741,824 bytes). The resulting behaviour was deterministic and visible across the complete control and user-plane workflow:
- subscriber usage was measured continuously inside the eUPF datapath;
- a PFCP usage report was generated when the threshold was crossed;
- traffic was blocked when the configured quota was reached;
- forwarding resumed after the quota state was reset;
- multiple UEs were measured and enforced independently; and
- final usage information was reported when a session was deleted.
This work brings together standards-based PFCP signalling, programmable 5G session control, high-performance kernel networking, subscriber policy enforcement and real-time operational visibility.
Why subscriber usage control matters
Forwarding subscriber traffic is only one part of the user-plane responsibility. Operators and enterprises also need to measure usage per subscriber, apply differentiated data policies, generate threshold notifications, enforce hard consumption limits and expose subscriber state to operational systems.
Without Usage Reporting Rules a UPF may establish sessions and forward packets successfully, but the network cannot fully account for or control subscriber consumption through the standard PFCP model.
The objective was therefore not simply to add a traffic counter. The goal was to complete a full control-to-datapath lifecycle: the SMF defines the usage policy, PFCP carries the policy, eUPF installs it into the datapath, XDP measures every applicable packet, the UPF reports usage events, and the kernel fast path enforces the quota.
Understanding the SMF–UPF relationship
A 5G Standalone core follows the principle of Control and User Plane Separation, commonly called CUPS. The Session Management Function, or SMF, acts as the session-control authority: it establishes subscriber sessions, manages session policies and instructs the user plane how traffic should be treated.
The User Plane Function, or UPF, executes those instructions. It carries subscriber traffic between N3, where GTP-U traffic arrives from the radio access network, and N6, which connects the mobile network to external data networks. The SMF and UPF communicate over the N4 interface using the Packet Forwarding Control Protocol defined in 3GPP TS 29.244.
For each subscriber session the SMF programs the UPF using four primary rule categories:
- PDR — Packet Detection Rule: identifies traffic using attributes such as TEID, UE IP address, direction or SDF filters.
- FAR — Forwarding Action Rule: defines whether matching traffic should be forwarded, dropped, buffered or processed through another action.
- QER — QoS Enforcement Rule: applies controls such as gate status, rate limits and QoS policy.
- URR — Usage Reporting Rule: measures traffic volume or duration, generates usage reports and supports consumption-based control.
PDRs identify traffic. FARs determine what happens to it. QERs enforce service quality. URRs provide the accounting and usage-control layer. This integration focused on completing that URR lifecycle across SD-Core and eUPF.
Why eBPF and XDP for the 5G user plane
Traditional UPF implementations commonly use userspace packet-processing frameworks such as DPDK or VPP, or dedicated kernel modules such as gtp5g. eUPF follows a different architectural model: its fast path is implemented through eBPF programs attached at XDP, allowing packets to be processed near the network-driver layer before they traverse the conventional Linux networking stack.
This creates a programmable kernel datapath capable of classifying traffic close to ingress, maintaining session state through eBPF maps, applying forwarding and policy decisions in the kernel, and updating datapath behaviour without maintaining an external kernel module.
For this integration the key advantage was not only efficient forwarding. It was the ability to perform subscriber metering and quota enforcement inline, within the same fast path responsible for forwarding the packet. The quota decision therefore does not depend on exporting every packet to a separate userspace enforcement process.
The SD-Core and eUPF integration architecture
SD-Core's SMF generates the session rules required by the user plane. In this integration PFCP signalling passes through a lightweight component called the upf-adapter: the SMF sends its PFCP instructions over HTTP to the adapter, and the adapter converts them into PFCP messages on the wire.
The control-plane path is SD-Core SMF → HTTP → upf-adapter → N4/PFCP → eUPF. The user-plane path remains independent: RAN/N3 → eUPF XDP datapath → N6/external network.
eUPF terminates the N4 PFCP association and translates the received session rules into entries stored in eBPF maps. Once the rules are installed, subscriber packets remain inside the kernel fast path for classification, metering, quota evaluation and forwarding.
Inside the XDP datapath
When a subscriber packet reaches eUPF, the XDP program looks up the relevant session state from its eBPF maps. The datapath then performs the following operations:
- identifies the subscriber session and packet direction;
- matches the applicable Packet Detection Rule;
- resolves the corresponding forwarding and policy rules;
- updates the associated Usage Reporting Rule counters;
- evaluates the configured threshold and quota; and
- forwards or drops the packet according to the resulting policy state.
URR processing occurs inline. For each applicable packet eUPF updates the usage state associated with the subscriber's URR. The quota is checked before forwarding is completed, allowing traffic beyond the configured allowance to be blocked immediately within the datapath. The enforcement decision is therefore part of packet processing itself — not an action applied later by an external monitoring system.
Closing the URR capability gap
eUPF already had the technical foundation required to support Usage Reporting Rules, but the SD-Core SMF was not installing URRs for subscriber sessions. The SMF's URR path was incomplete. As a result, even when SD-Core was connected to a URR-capable UPF, the control plane did not instruct the datapath to measure subscriber traffic or enforce a quota.
Completing the feature therefore required changes on both sides of the N4 interface. The SMF needed to create the correct PFCP objects, associate them with the relevant PDR and provide the measurement, reporting, threshold and quota parameters required by eUPF. At the same time eUPF needed to link the received URR information to the correct live subscriber session and apply the policy against actual traffic. A datapath implementation alone would not have completed the end-to-end lifecycle.
Control-plane implementation in SD-Core
The SD-Core SMF now creates and attaches a CreateURR rule to the session's downlink PDR during PDU-session establishment. The rule contains the measurement method, reporting triggers, the configured volume threshold, the configured volume quota, and the URR identifier linking subscriber traffic with the correct usage state.
The policy is configurable through smfcfg, separating policy configuration from the datapath implementation:
urr:
enable: true
volumeThresholdBytes: 943718400
volumeQuotaBytes: 1073741824The early-warning threshold is configured at 900 MiB, while the hard quota is configured at 1 GiB. These values represent two separate operational events: a threshold event, indicating that the subscriber is approaching the configured limit, and a quota event, indicating that additional subscriber traffic must be blocked. The SMF defines the policy; the UPF performs the actual measurement and enforcement.
Datapath implementation in eUPF
On the user-plane side eUPF performs per-URR measurement directly inside the XDP program. The implementation measures transferred data volume, packet counts, session duration for the final report, and quota state for the associated subscriber session.
When subscriber usage crosses the configured threshold, eUPF generates a PFCP Session Report Request containing the relevant Usage Report for the SMF. This provides the standards-based early-warning notification. When usage reaches the configured quota, eUPF:
- updates the URR state;
- generates the relevant usage report;
- marks the subscriber session as capped; and
- drops subsequent traffic for that session inside the XDP datapath.
The quota is therefore not merely displayed or reported. It is actively enforced.
The implementation also links URR identifiers to the corresponding entries in the eBPF PDR map, ensuring that the rule installed by the SMF is applied to the correct subscriber traffic. URR metering was additionally extended to operate with SDF-filtered PDRs, allowing rules installed by a real SMF to work against actual packet-detection conditions rather than only isolated test cases.
The complete URR lifecycle
The completed integration supports the full lifecycle of a subscriber usage policy:
- Session establishment. The UE establishes a PDU session. The SMF generates the required PDR, FAR, QER and URR information and sends it to eUPF over PFCP.
- Rule installation. eUPF receives the PFCP Session Establishment Request and installs the subscriber session state into its eBPF maps.
- Inline measurement. As subscriber packets pass through XDP, eUPF updates the corresponding byte and packet counters.
- Threshold notification. When usage reaches the configured threshold, eUPF sends a PFCP Session Report Request to the SMF.
- Quota enforcement. When usage reaches the configured quota, further traffic for that subscriber session is blocked directly inside the kernel datapath.
- Session reset or policy update. When the quota state is reset, subscriber traffic can resume according to the updated session state.
- Final usage reporting. When the session is deleted, eUPF generates an enriched final Usage Report containing measured volume, packet counts and session duration.
Independent enforcement across multiple subscribers
Subscriber-level enforcement must remain isolated: a quota reached by one UE must not affect another UE using the same UPF instance. The integration was therefore validated with multiple subscriber sessions, each UE maintaining its own IMSI and UE IP address, PFCP session, PDR association, URR identifier, volume counter, threshold state, quota state and forwarding decision.
During testing one subscriber could enter the threshold state or become capped while other subscribers continued forwarding traffic according to their own usage values. This confirmed that URR state is associated with the individual PFCP session and corresponding datapath rules, rather than being maintained as a global UPF-level counter.
PFCP Association Release support
The PFCP Association represents the long-lived N4 relationship between the SMF and UPF. It provides the control-plane context through which the SMF manages user-plane sessions. As part of this work, support was added for PFCP Association Release, as defined in 3GPP TS 29.244 §6.2.8. This allows the N4 association to be terminated explicitly and cleanly.
When the association is released, the UPF can remove the peer state and stop accepting sessions from that association instead of depending only on timeout-based cleanup. Although smaller in scope than the URR implementation, this capability improves support for controlled reconfiguration, planned SMF or UPF restarts, peer-state cleanup, graceful operational transitions and failover-related workflows.
Real-time subscriber observability
Usage enforcement becomes more operationally useful when administrators can see what the datapath is doing. eUPF stores subscriber and URR state inside eBPF maps and exposes that information through lightweight REST endpoints, including /api/v1/pfcp_sessions and /api/v1/urr_map.
Using these interfaces a lightweight monitoring dashboard was developed to present subscriber usage without modifying the packet-processing path. The monitoring layer remains separate from enforcement: XDP continues to meter and enforce traffic inside the kernel, while the dashboard reads the resulting state for visualization. This provides operational visibility without inserting a monitoring component into the critical forwarding path.
The dashboard presents subscriber state through both a web interface and a terminal-based table. Each subscriber progresses through three visible policy states:
- OK — usage remains below the configured threshold;
- THRESHOLD — usage has crossed the early-warning level; and
- CAPPED — usage has reached the quota and further traffic is blocked.
The console also calculates instantaneous throughput from successive usage samples, allowing operators to correlate current traffic rate, cumulative consumption, threshold events and quota enforcement. The subscriber table includes the IMSI, UE IP address, policy state, usage trend, live uplink and downlink rates, and the used-versus-quota indicator.
Live end-to-end validation
The complete system was validated using live UE traffic. The validation demonstrated that:
- the SMF installed the URR during PDU-session establishment;
- eUPF associated the URR with the correct subscriber PDR;
- XDP continuously measured subscriber traffic;
- a threshold event was raised at the configured level;
- the subscriber reached the configured 1 GiB quota;
- subsequent traffic was blocked at the limit;
- other subscribers continued operating independently;
- traffic resumed after the quota state was reset; and
- final usage information was generated during session deletion.
The significance of this validation is that every stage operated together. This was not only an SMF configuration test, a PFCP message test, an eBPF counter test or a dashboard demonstration. It was an end-to-end validation of the complete control, enforcement, reporting and observability chain.
What this integration delivers
- PFCP-driven URR creation from the SD-Core SMF;
- configurable subscriber volume thresholds and quotas;
- per-subscriber volume and packet measurement inside XDP;
- threshold-based PFCP usage reporting;
- hard quota enforcement inside the kernel datapath;
- correct URR linkage through the eBPF PDR map;
- URR support for SDF-filtered PDRs;
- enriched final reports containing volume, packets and duration;
- independent quota state across multiple UEs;
- PFCP Association Release support;
- live subscriber state through REST APIs;
- terminal-based operational monitoring; and
- a web-based NMS-style dashboard.
Why this work is important
This integration demonstrates that an eBPF/XDP-based UPF can provide more than high-speed packet forwarding. It can participate in the policy and usage-control model expected from a 5G core — measuring subscriber consumption, reporting usage events over standards-based PFCP signalling, and enforcing quotas in the kernel fast path, per subscriber, without a separate userspace enforcement stage.