Hybrid Monitoring for Early Fault Detection in Cloud-Native 5G Systems - NetMon: A network monitoring tool designed to detect signs of faults in Ericsson’s AMF clusters

Abstract

This thesis presents the design, implementation, and evaluation of a hybrid network monitoring system for Kubernetes-based 5G packet core deployments. The system combines eBPF-based passive kernel-level traffic observation with active TCP probing and centralized correlation to detect and localize network degradation within seconds. The evaluation results demonstrate that the system detects faults as subtle as 10ms of added latency or 5% packet loss, correctly attributes them to the affected infrastructure component, and maintains this capability under application loads up to 50% of the cluster’s capacity. The total resource overhead of 3.4 millicores CPU and 4.5 MiB memory per pod confirms that the approach is viable for production deployment without impacting the monitored workload. The hybrid approach addresses a gap in existing monitoring tools: standard health checks cannot detect partial degradation, scrape-based systems introduce detection delays measured in tens of seconds, and purely passive tools cannot verify idle network paths. By combining these complementary techniques and centralizing the analysis, the system provides the early detection and fault localization capabilities required for maintaining service quality in cloud-native 5G infrastructure.