N9 — UPF ⇔ UPF (GTP-U / inter-UPF user plane)¶

Learning objectives¶

After reading this page, you will be able to:

• Explain that N9 is a user-plane interface connecting multiple UPFs, and that it is not an SBI.
• State N9's Protocol (GTP-U) and its lower Transport (UDP/IP, port 2152).
• List the chained-UPF configurations in which N9 is used (I-UPF↔PSA-UPF, home-routed roaming, UL CL/Branching Point).
• Explain that N9 uses the same GTP-U · TEID · QFI as N3, and that control is done by the SMF over N4 (PFCP).
• Explain the correspondence with 4G (EPC) S5/S8 (the GTP-U between SGW⇔PGW).

Prerequisites¶

Understanding the following first will make things smoother.

• The positioning of GTP-U and UDP/IP → Protocol dictionary
• The NF that terminates N9 → UPF
• The paired control plane (UPF configuration) → N4
• The user plane connecting the base station and the UPF → N3
• The concept of interfaces → Interface dictionary

Why — why it is needed¶

Most explanations depict user data flowing straight through "gNB → one UPF → data network." In real networks, however, it is common for multiple UPFs to be chained (in series). For example, even if a UE moves far away from its base station, you may not want to move the session's exit (anchor). Or you may want to route traffic back from a roaming network to your home network. In such cases, you need to set up separate intermediate and exit UPFs and a path connecting them.

This "path connecting UPF to UPF with a tunnel of actual user data" is N9. Without N9, the very configuration of splitting UPFs into multiple stages cannot hold.

To use an analogy: if we liken the UPF that carries user data to a pipe, then whereas N3 is "the pipe connecting the base station and the pipe," N9 is the connecting pipe joining pipe to pipe. Where one pipe suffices, N9 does not appear; but where many pipes are connected in series, N9 always appears as the joint.

Note that N9 is neither a control-purpose interface like N4, nor an SBI (service-based) like N11. It is a user-plane reference point that merely carries actual data.

Overview¶

N9 is the user-plane interface connecting UPF ⇔ UPF. The Protocol flowing on top is GTP-U (GPRS Tunneling Protocol - User plane), and beneath it is UDP over IP — the exact same mechanism as N3.

Representative configurations where N9 appears are as follows.

In all cases, UPF is connected to UPF by a GTP-U tunnel, using the same two identifiers as N3.

Basic Concept — explanation for beginners¶

We liken N9 to the transport service connecting relay stations that carry parcels in a courier network.

The UE's data (the original IP packet) is, by the time it arrives at the first UPF over N3, already wrapped in an envelope (GTP-U) for carriage. At N9, that envelope is relayed further to the next UPF.

• Envelope (GTP-U tunnel) = the outer wrapping enclosing the entire original packet. The contents (the user's IP packet) remain as-is.
• Address label (TEID) = the number stuck on the front of the envelope. The receiving UPF looks at this label to decide "which tunnel's parcel this is = which session it is."
• Priority sticker (QFI) = the distinction of "express" vs. "ordinary." So that the QoS distinction can be preserved across UPFs, it stays stuck to the envelope as it is relayed.

The path has two directions, uplink and downlink. UE→gNB→I-UPF→PSA-UPF→data network is uplink, and the reverse is downlink. As with N3, uplink and downlink are assigned separate labels (TEIDs), and each UPF endpoint holds "the number it uses when it receives." Who assigns these numbers and how is set not by the UPF itself but by the controlling SMF via N4 (PFCP) into both UPFs (described below).

Protocol / Transport¶

Architecture¶

This shows how N9 connects the I-UPF (intermediate UPF) and the PSA-UPF (anchor UPF), and how the SMF controls both over N4.

flowchart LR
  gNB["gNB (base station)"]
  IUPF["I-UPF (intermediate)"]
  PSA["PSA-UPF (anchor)"]
  DN["DN (data network)"]
  SMF["SMF"]

  gNB =="N3 (GTP-U)"==> IUPF
  IUPF =="N9 (GTP-U)"==> PSA
  PSA =="N6"==> DN
  SMF -."N4 (PFCP)".-> IUPF
  SMF -."N4 (PFCP)".-> PSA

How to read the diagram: user data flows gNB → I-UPF → (N9) → PSA-UPF → DN. The thick solid lines (==>) are the user plane (GTP-U tunnels), with N3 · N9 · N6 lined up on the same flow. The dotted lines (-.->) of N4 (PFCP) are a separate control line, whose role is that the SMF distributes configuration to both UPFs (I-UPF and PSA-UPF). N9 corresponds to this "joint between pipe and pipe."

The data-transfer flow¶

The N9 tunnel is established within PDU Session establishment (and its modification) when a chained-UPF configuration becomes necessary.

1. UPF configuration: the SMF sets PDR (Packet Detection Rule) / FAR (Forwarding Action Rule) / TEID into each of the I-UPF and PSA-UPF over N4 (PFCP). This creates two N9 GTP-U tunnels, uplink and downlink.
2. Uplink packets: the user data arriving from the gNB over N3 is transferred by the I-UPF onto the N9 GTP-U tunnel to the PSA-UPF. The PSA-UPF removes the capsule and sends it out to the data network over N6.
3. Downlink packets: packets entering from the data network over N6 are relayed by the PSA-UPF to the I-UPF over N9, and by the I-UPF to the gNB over N3.
4. QoS identification: each packet's QoS Flow is identified by the QFI in the GTP-U extension header (PDU Session Container), so the priority treatment is preserved across UPFs.

To avoid duplication, refer to PDU Session establishment for the procedure details. Here it is enough to grasp the positioning of "N9 = the pipe of user data connecting UPFs when they are chained in series."

Main Messages¶

What flows on N9 are the same GTP-U messages as on N3. Since it is a protocol devoted to being a pipe, there are relatively few control messages, and most are G-PDUs carrying actual data.

The exact types and detailed purposes of each message are to be confirmed; refer to the Message dictionary.

Packet Analysis (Wireshark)¶

N9 is observed as GTP-U, with UDP beneath it. It looks the same as N3; the difference is that it appears between the IP addresses of the UPFs themselves.

Decode highlights:

• By the TEID in the GTP-U header, you can identify which tunnel (≒ which UE's which session) it is. As with N3, uplink and downlink have different TEIDs.
• By the QFI carried in the extension header (PDU Session Container, TS 38.415), you can tell which QoS Flow the packet belongs to.
• In a G-PDU, the enclosed user IP packet inside the GTP-U header is further decoded.
• Since N9 is user plane, SCTP and HTTP/2 do not appear in the capture. If you see them, that is not N9 but N2 (NGAP) or SBI communication.

Comparison with EPC¶

• In 4G: GTP-U (TS 29.281) flowed over S5/S8 connecting SGW and PGW, tunneling user data with TEID (S5 within the same operator, S8 when roaming).
• In 5G: due to UPF splitting, the section corresponding to that user plane between SGW⇔PGW (S5/S8-U) became N9 (UPF ⇔ UPF). The Protocol is the same GTP-U (TS 29.281), with the addition that QoS identification became QFI-based (the correspondence between S5/S8-U and N9 is to be confirmed).

3GPP Specification¶

• 3GPP TS 29.281 — GTP-U (GPRS Tunneling Protocol - User plane, common with N3). Individual clause numbers are to be confirmed
• 3GPP TS 38.415 — PDU Session User Plane Protocol (carrying the QFI via the PDU Session Container). Individual clause numbers are to be confirmed
• 3GPP TS 23.501 §5.6 / §5.8 — UPF and user-plane functions. Individual clause numbers are to be confirmed
• 3GPP TS 23.501 §4 — system architecture and reference points (the definition of N9). Individual clause numbers are to be confirmed

Summary¶

• N9 is the user-plane interface connecting UPF ⇔ UPF, and its Protocol is GTP-U (TS 29.281). It is not an SBI.
• The lower Transport is UDP over IP, and the port is 2152 (common with N3).
• In chained-UPF configurations such as I-UPF↔PSA-UPF, home-routed roaming, and UL CL/Branching Point, it tunnels between UPFs.
• It uses the same TEID (tunnel identification) and QFI (QoS Flow identification, PDU Session Container / TS 38.415) as N3, and the control is set by the SMF into both UPFs over N4 (PFCP).
• It corresponds to 4G S5/S8 (the GTP-U part between SGW⇔PGW) (the correspondence is to be confirmed).

Next Step¶

• UPF — the NF that terminates N9
• N3 — the same GTP-U user plane as N9, connecting the base station and the UPF
• N4 — the control plane (PFCP) that controls both UPFs
• N6 — the reference point connecting the PSA-UPF and the data network
• Interface dictionary — checking each reference point