3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol)

Q: What does the Scope section cover in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol)?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the PFCP Overview section cover in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol)?

The PFCP Overview section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the PFCP Header Format section cover in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol)?

The PFCP Header Format section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Key Information Elements section cover in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol)?

The Key Information Elements section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the PFCP Session Procedures section cover in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol)?

The PFCP Session Procedures section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.244 V18 — PFCP (Packet Forwarding Control Protocol). This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TS 29.244

Interface between the Control Plane and the User Plane — Packet Forwarding Control Protocol (PFCP)

V18.7.0 (2024-12) — Release 18 Protocol Specification

1. Scope

▶

Defines the Packet Forwarding Control Protocol (PFCP) used between the control plane function (CP — SMF in 5G, PGW-C/SGW-C in EPC) and the user plane function (UP — UPF in 5G, PGW-U/SGW-U in EPC) over the N4/Sx interface.

PFCP is the protocol that tells the UPF what to do with GTP-U tunnels. It programs forwarding rules (PDRs/FARs), QoS enforcement (QERs), and usage reporting (URRs) into the user plane. Without PFCP, the UPF is an empty packet forwarder.

Security Criticality: PFCP controls the data path. A compromised PFCP session can redirect user traffic, bypass QoS policies, disable charging, or create unauthorized tunnels. This is why TS 33.513 and TS 33.518 include PFCP-specific security tests.

4. PFCP Overview

▶

4.1 CUPS Architecture

▶

Control Plane ┌──────────────────────────────┐ │ SMF / PGW-C │ │ (PDU session management, │ │ QoS policy, charging) │ └──────────┬───────────────────┘ │ N4 / Sx (PFCP) │ UDP port 8805 │ ┌──────────▼───────────────────┐ │ UPF / PGW-U │ │ (Packet forwarding, │ │ GTP-U encap/decap, │ User Plane │ QoS enforcement, │ │ usage measurement) │ └──┬──────────────────────┬────┘ │ N3 (GTP-U) │ N6 (native IP) │ │ gNB DN (Internet) CUPS = Control and User Plane Separation

Key Design Principle: PFCP enables independent scaling of control and user planes. Multiple UPFs can be controlled by a single SMF, and UPFs can be placed at the network edge (MEC) while the SMF remains centralized.

4.2 Protocol Stack

▶

┌──────────────────────────────────────────────────┐ │ PFCP Messages (grouped IEs) │ ├──────────────────────────────────────────────────┤ │ PFCP Header (16 bytes) │ ├──────────────────────────────────────────────────┤ │ UDP (port 8805) │ ├──────────────────────────────────────────────────┤ │ IP (v4 or v6) │ └──────────────────────────────────────────────────┘

Port: PFCP runs on UDP port 8805. Unlike GTP (2123/2152), PFCP uses a single port for both node-level and session-level messages.

5. PFCP Header Format

▶

0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Ver |Spare|FO|MP|S| Message Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Message Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | SEID (if S=1, 8 bytes) | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Sequence Number | Spare/Priority | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Field	Description
Version	Must be 1
S flag	1 = SEID present (session-related msg); 0 = node-level msg
MP flag	Message Priority (Rel-16+)
FO flag	Follow On — more messages to follow
Message Type	Identifies the procedure (see §7)
SEID	Session Endpoint Identifier — 64 bits (vs GTP's 32-bit TEID)
Sequence Number	24-bit — transaction matching

SEID vs TEID: PFCP uses 64-bit SEIDs (Session EIDs) — double the GTP TEID space. Each PFCP session between SMF and UPF gets a unique SEID pair, distinct from the GTP-U TEIDs used on N3/N9.

6. Key Information Elements

▶

PFCP uses a rule-based model with four primary rule types that program the UPF's forwarding behavior:

6.1 PDR — Packet Detection Rule

▶

Defines what traffic to match. The UPF evaluates incoming packets against all PDRs and applies the associated FAR/QER/URR.

IE	Content
PDR ID	Unique identifier for this rule
Precedence	Priority (lower = higher priority)
PDI (Pkt Detection Info)	Match criteria: Source Interface, F-TEID (local), UE IP, SDF Filter, Application ID
FAR ID	Associated Forwarding Action Rule
QER ID	Associated QoS Enforcement Rule
URR ID	Associated Usage Reporting Rule

PDI Source Interface values: Access (N3 from gNB), Core (N6 from DN), CP-Function (from SMF), SGi-LAN / N6-LAN.

6.2 FAR — Forwarding Action Rule

▶

Defines what to do with matched traffic. This is where GTP-U tunnel parameters are programmed.

IE	Content
FAR ID	Unique identifier
Apply Action	FORW (forward), DROP, BUFF (buffer), NOCP (notify CP), DUPL (duplicate)
Forwarding Parameters	Destination Interface, Outer Header Creation (GTP-U TEID + IP), Redirect Info

Outer Header Creation is where the remote GTP-U tunnel endpoint (TEID + peer IP) is programmed. This directly controls where user packets are sent after GTP-U encapsulation.

6.3 QER — QoS Enforcement Rule

▶

Defines rate limiting and QoS treatment at the UPF:

IE	Content
MBR (UL/DL)	Maximum Bit Rate
GBR (UL/DL)	Guaranteed Bit Rate
QFI	QoS Flow Identifier (for N3 PDU Session Container)
Gate Status	OPEN / CLOSED — per direction gating
Reflective QoS	Enable/disable RQI in DL

6.4 URR — Usage Reporting Rule

▶

Controls traffic measurement for charging and reporting:

Measurement Method: Volume, Duration, Event
Reporting Triggers: Periodic, threshold, start/stop, linked URR
Volume Threshold/Quota: Byte counts for UL/DL/Total

Security: Manipulating URR rules can disable charging, leading to billing fraud. PFCP session integrity is essential for accurate usage measurement.

PFCP Rule Chain (per PDU session): Incoming ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ Packet ────►│ PDR │────►│ QER │────►│ URR │────►│ FAR │────► Outgoing │(match) │ │(police) │ │(measure)│ │(forward)│ Packet └─────────┘ └─────────┘ └─────────┘ └─────────┘ Multiple PDRs per session, each with own FAR/QER/URR references. Priority resolved by PDR Precedence value.

7. PFCP Session Procedures

▶

7.1 Session Establishment

▶

SMF sends PFCP Session Establishment Request to UPF to create a new PFCP session for a PDU session. Contains:

SMF UPF │ │ │─── PFCP Session Establishment Req ────────►│ │ CP F-SEID (SMF SEID + IP) │ │ Create PDR (PDI: Access, F-TEID=alloc) │ │ Create PDR (PDI: Core, UE-IP) │ │ Create FAR (FORW: to Access, GTP-U) │ │ Create FAR (FORW: to Core, N6) │ │ Create QER (MBR, GBR, QFI) │ │ Create URR (Volume, Periodic) │ │ │ │◄── PFCP Session Establishment Rsp ────────│ │ UP F-SEID (UPF SEID + IP) │ │ Created PDR (F-TEID allocated by UPF) │ │ │

F-TEID Allocation: The UPF allocates the local GTP-U F-TEID (TEID + IP) in the Created PDR response. The SMF then communicates this to the gNB via N2/NGAP so the gNB knows where to send uplink GTP-U packets.

7.2 Session Modification

▶

Updates existing PFCP session. Common triggers:

Handover: Update FAR with new gNB GTP-U F-TEID
QoS change: Update QER with new MBR/GBR or QFI
New QoS flow: Create additional PDR/FAR/QER
Buffering: Change FAR action from FORW to BUFF during idle mode

7.3 Session Deletion

▶

Removes PFCP session and all associated rules. The UPF releases allocated F-TEIDs and reports final usage in the response.

All PDRs, FARs, QERs, URRs deleted
Final Usage Report included in response
GTP-U tunnels become invalid → packets for old TEIDs trigger Error Indication

8. Security Considerations

▶

N4/PFCP is the most security-critical internal interface in 5G. It directly programs the user plane — forwarding destinations, QoS enforcement, and charging. Compromise of PFCP = complete control over subscriber data flows.

TR 33.926 §5.3.5 Unauthorized access to PFCP ▶

TR 33.926 §5.3.3 Man-in-the-middle on N4 ▶

TR 33.926 §5.3.6.15 PFCP rule manipulation for traffic redirect ▶

PFCP Attack Vectors

Attack	Technique	Impact	Mitigation
Session Hijacking	Spoofed Session Modification with attacker FAR (Outer Header Creation pointing to attacker)	All user traffic redirected	TLS on N4, source authentication, SEID validation
Rule Injection	Inject new PDR/FAR to match and forward specific subscriber traffic	Selective traffic interception	Mutual authentication, authorization checks
Charging Bypass	Delete or modify URR rules to stop usage reporting	Billing fraud, revenue loss	Audit logging, URR integrity validation
QoS Manipulation	Modify QER to remove rate limits or change QFI	Unauthorized QoS, resource exhaustion	Policy cross-check, QER change alerting
Session Deletion DoS	Spoofed Session Deletion Request	Service interruption for targeted subscribers	TLS, sequence validation, SEID unpredictability

Required Security Measures

Measure	Spec Reference	Details
TLS or DTLS on N4	TS 33.501 §9.9	Mandatory for PFCP confidentiality and integrity
Mutual authentication	TS 33.513, TS 33.518	SMF and UPF must mutually authenticate
PFCP node authentication	TS 33.117	PFCP Association Setup must validate peer identity
Source IP filtering on N4	Operator policy	UPF should only accept PFCP from known SMF IPs
SEID randomization	Best practice	Prevent SEID prediction attacks