Traffic Detection Function User plane function

Description

The Traffic Detection Function User plane function (TDF-U) is a specialized network function within the 5G Core (5GC) Service-Based Architecture (SBA) that operates in the user plane path. Its primary role is to perform application detection and reporting (ADR) by inspecting the data packets of user sessions. Unlike control plane functions, the TDF-U is deployed in the data forwarding path, typically between the UPF (User Plane Function) and the external data network (DN). It examines packet headers and payloads using deep packet inspection (DPI) techniques to identify specific applications, services, or traffic types based on pre-configured detection rules. These rules can be based on signatures, behavioral analysis, or machine learning models.

Architecturally, the TDF-U is controlled by the Session Management Function (SMF) via the N40 reference point, using the Packet Flow Description (PFD) management service. The SMF provisions the TDF-U with application detection rules and policies. When user traffic passes through the TDF-U, it matches the packets against these rules. Upon detecting a matching traffic flow, the TDF-U can take several actions. It reports the detection event to the SMF or a Policy Control Function (PCF) via the N7/N15 interfaces, which can then trigger policy decisions. Alternatively, it can apply local actions such as traffic marking, redirection, or blocking, as per its configured policies.

The TDF-U plays a critical role in enabling service-aware networks. By identifying application traffic, it allows operators to implement differentiated charging (e.g., zero-rating for specific apps), enforce quality of service (QoS) policies tailored to the application's needs (like prioritizing video streaming), and perform traffic optimization (such as video transcoding). It is a key enabler for network slicing, as it can identify and route traffic belonging to a specific slice to the appropriate resources. Its integration within the 5GC SBA ensures it is a scalable, software-defined component that can be deployed flexibly in central or edge cloud locations.

Purpose & Motivation

The TDF-U was introduced to address the growing need for granular, application-aware traffic management and policy enforcement in mobile networks. Traditional policy and charging control (PCC) architectures relied heavily on control plane signaling and static rules, which were inefficient for dynamically identifying the vast array of over-the-top (OTT) applications and services. Operators required a method to inspect user plane traffic in real-time to apply accurate charging, ensure fair usage, and offer service-specific quality guarantees.

Its creation was motivated by the evolution towards 5G and network slicing, where different slices (e.g., for enhanced mobile broadband, IoT, or ultra-reliable low-latency communications) require distinct handling. A generic user plane could not efficiently differentiate traffic without deep inspection. The TDF-U provides a standardized, vendor-neutral function that separates the detection logic from the core UPF, allowing for specialized DPI capabilities and independent scaling. This solves the problem of monolithic UPFs that were difficult to upgrade with new detection capabilities and allowed for more flexible service chaining.

Historically, similar functions existed in 4G EPC as the Traffic Detection Function (TDF), but it was often a standalone node. In 5G, the TDF-U is integrated as a dedicated user plane function within the SBA, offering better orchestration, cloud-native deployment, and seamless interaction with the PCF and SMF. This addresses limitations of previous approaches by providing a more programmable, scalable, and service-oriented architecture for real-time traffic analysis.

Key Features

• Deep Packet Inspection (DPI) for application and service detection
• Integration with 5GC Service-Based Architecture via N40 interface
• Support for application detection and reporting (ADR) to control plane functions
• Traffic steering and redirection capabilities based on detection results
• Policy enforcement at the user plane for charging and QoS actions
• Support for network slicing by identifying slice-specific traffic flows

Evolution Across Releases

Defining Specifications