Description
Internet Protocol Packet Reporting (IPPR) is a standardized function within the 3GPP Lawful Interception (LI) architecture, defined to facilitate the interception and reporting of Internet Protocol (IP) packet-based communications. It operates as a specific type of Intercept Related Information (IRI) and Content of Communication (CC) reporting, focusing on the granular details of IP data flows associated with a target of interception. The IPPR function is implemented within network nodes that handle user plane traffic, such as the Packet Data Network Gateway (PGW), User Plane Function (UPF), or dedicated mediation devices. When activated by a lawful authorization, these nodes are configured to identify the IP traffic belonging to the specified target—using identifiers like IP address, subscription identifier, or other packet filters—and to duplicate and forward this traffic along with rich metadata to the Law Enforcement Monitoring Facility (LEMF).
The technical operation of IPPR involves several key components and interfaces. First, the Administration Function (ADMF) receives the lawful authorization and target identity from the LEA and distributes the interception commands securely to the relevant Intercepting Control Elements (ICEs) in the network, such as the gateway handling the target's session. The ICE, upon activation, performs deep packet inspection and filtering on the user plane to isolate the target's IP packets. For each intercepted flow, IPPR generates structured reports that include both the CC (the actual payload of the IP packets) and associated IRI, which contains metadata like source and destination IP addresses, port numbers, protocol type (TCP/UDP), timestamps, and packet sizes. This data is formatted according to 3GPP-specified encoding standards (e.g., using IPDR or ETSI HI standards) and is transported over secure, dedicated interfaces (the HI2 and HI3 interfaces) to the Mediation Function (MF), which adapts and delivers it to the LEMF.
IPPR's role is critical in modern networks where virtually all communication is IP-based. It provides law enforcement with the technical capability to monitor targeted internet activities, including web browsing, email, messaging over IP, and Voice over IP (VoIP) calls, in a standardized and reliable manner. The specification ensures that the interception is performed without degrading the quality of service for the target or other users and maintains strict access controls and logging to prevent abuse. The detailed packet-level reporting allows investigators to reconstruct communication sessions, analyze data exchange patterns, and gather digital evidence, making it a powerful tool for lawful surveillance in the digital age.
Purpose & Motivation
IPPR was developed to address the evolving requirements for lawful interception in all-IP telecommunications networks. As mobile networks transitioned from circuit-switched voice to packet-switched data services (culminating in 4G LTE and 5G which are fully IP-based), traditional interception methods designed for voice calls became inadequate. Law Enforcement Agencies (LEAs) worldwide have legal mandates requiring telecommunications operators to provide access to targeted communications for criminal investigations and national security. The purpose of IPPR is to fulfill these legal obligations by providing a standardized, scalable, and technically robust mechanism to intercept and report IP packet flows.
Its creation was motivated by the need for a consistent, vendor-interoperable standard that could handle the complexity and volume of IP traffic. Prior to such standardization, interception capabilities were often proprietary, making it difficult for operators to deploy multi-vendor networks and for LEAs to interface with different operators. IPPR, as part of the broader 3GPP LI framework (TS 33.107 series), defines the precise procedures, interfaces, and data formats for IP packet reporting, ensuring that evidence collected is admissible and that operator implementations comply with regional regulations. It solves the critical problem of how to efficiently filter, capture, and report specific data streams from the high-speed, multiplexed IP traffic in modern core networks without compromising network performance or user privacy for non-targeted individuals.
Classification
Detected Changes Across Releases
from 3GPP Change RequestsSpecific changes extracted from the „Change history“ tables of 3GPP specifications (54 CRs across 5 releases). Complements the general historical overview above with the evidence-based evolution of this function.
In Release 15, the IPPR function was enhanced to include reporting for Secondary Cell Group cells and the PSCell, as well as Media Bearer information for the S8HR interface. Furthermore, it introduced the capability to report the start of interception using a SUCI. These additions provided more granular network and bearer context within lawful interception reporting.
In Release 16, the IPPR function was enhanced to include reporting for Dual Connectivity scenarios for both EPS and 5GC location updates, and to report the DNAI (Data Network Access Identifier) for SA PDU Sessions. It also introduced reporting for unsuccessful registration attempts including the SUPI, for unsupported MA PDU Session requests, and for SMS over NAS within the EPC. Furthermore, corrections and clarifications were made for procedures including GUTI allocation and event reporting at the AMF, LMF, and GMLC.
- Enhanced EPS Location Update Reporting with Dual Connectivity TS 33.108CR0419
- ADMF descriptive details TS 33.127CR0060
- ADMF LI Function Targeting TS 33.127CR0094
- Enhanced AMF Location Update Reporting with Dual Connectivity TS 33.128CR0083
- Addition of DNAI to SA PDU Reporting TS 33.127CR0089
- Clarification of LMF and GMLC Event Reporting at the AMF TS 33.127CR0091
+ 7 more changes
In Release 17, the enhancements to the IP Packet Reporting (IPPR) function included the capability for separated location reporting and the introduction of reporting for a non-IMEISV PEI (such as a manufacturer-assigned identifier) at the AMF. Furthermore, updates were made to clarify reporting for Non-3GPP access, improve the reporting for edge-unaware UEs, and refine the stage 2 and stage 3 specifications for packet header information reporting.
- Separated Location Reporting TS 33.128CR0273
- LI for Edge-unaware UE, and SMF reporting updates TS 33.128CR0355
- Clarification of Non-3GPP access reporting TS 33.127CR0139
- Addition of non-IMEISV PEI reporting at the AMF TS 33.128CR0221
- Reporting MT-SM UE address in alphanumeric format TS 33.108CR0431
- Update of stage 2 language for packet header information reporting TS 33.127CR0144
+ 2 more changes
In Release 18, the IPPR function was enhanced by the introduction of a next generation IP Packet Report format and the addition of reporting for ProSe (Proximity Services) LI at the UDM. It also expanded location reporting capabilities, including a new location type for reporting IMS location information and clarified procedures for reporting cell site information, where all cell IDs from the S1AP are reported to the LEMF. Furthermore, it enabled the reporting of encapsulated information and added parameters for 5GS-EPS reporting within MAPDU messages.
- IRI Events for reporting PDN Connection events from the combined SMF+PGW-C TS 33.128CR0373
- Location Reporting for Identity Association Record TS 33.128CR0376
- Location Only Reporting Provisioning Details TS 33.128CR0422
- Location Only reporting for EPS TS 33.128CR0540
- Addition of Start of Interception Records for RCS reporting TS 33.128CR0610
- Alignment of Cell Site Information reporting Stage 2 TS 33.127CR0205
+ 15 more changes
In Release 19, the IPPR (Internet Protocol Packet Reporting) function was enhanced by formally specifying its support in the TS 33.108 and TS 33.128 lawful interception protocol documents. New capabilities introduced include support for reporting when a target uses non-interworked EPS and for reporting Alternative NSSAI, expanding the scope of intercept-related information that can be delivered. Furthermore, the release integrated location acquisition procedures based on measurement reporting, ensuring that all available cell IDs are reported to the Law Enforcement Monitoring Facility (LEMF) when triggered.
- Support for IPPR mechanism in TS 33.108 TS 33.108CR0434
- Location acquisition based on measurement reporting TS 33.127CR0241
- Location acquisition based on measurement reporting TS 33.128CR0664
- Support for IPPR mechanism in TS 33.128 TS 33.128CR0665
- Support for reporting non-interworked EPS TS 33.127CR0275
- Messages for reporting non-interworked EPS TS 33.128CR0716
+ 1 more changes
Explore further
Broader topics and technologies where IPPR plays a role.
Defining Specifications
3GPP specifications that define or reference IPPR, with the latest known release. Sourced from the 3GPP document catalog — see methodology.
| Specification | Title | Release |
|---|---|---|
| TS 33.108 vj00 | LI Handover Interface Specification | Rel-19 |
| TS 33.127 vj50 | Lawful Interception Architecture and Functions | Rel-19 |
| TS 33.128 vj50 | 3GPP TS 33.128: Lawful Interception Protocols | Rel-19 |