TeleRAN: Bridging the Telemetry Gap in OpenRAN via eBPF

TeleRAN is a vendor-agnostic data plane agent designed to bridge the "telemetry gap" in 6G Open RAN architectures. By utilizing the Extended Berkeley Packet Filter (eBPF), it provides fine-grained, protocol-level visibility into virtual RAN nodes without requiring any modifications to the underlying RAN source code.

The primary benefit of TeleRAN is its ability to enable universal security and performance analytics across heterogeneous, multi-vendor environments. While traditional telemetry solutions are often tied to specific vendors or require intrusive software changes, TeleRAN operates independently at the OS kernel level. This ensures low-latency packet processing—maintaining less than 1ms of control-plane latency—while allowing operators to customize and program telemetry for critical use cases like rogue base station detection and protocol-based attack monitoring.

Key technical advantages include:

• Vendor Agnosticism: It relies strictly on 3GPP standards and ASN.1 specifications rather than proprietary APIs, making it a "one-size-fits-all" solution for any compliant network.

• Non-Intrusive Deployment: It functions as an external observer, requiring zero recompilation or rebooting of the RAN software.

• High Efficiency: Leveraging eBPF allows for high-performance filtering and mirroring of selected traffic directly within the kernel, minimizing system overhead and resource consumption.

This research was recently presented at the Workshop on Security and Privacy of Next-Generation Networks (FutureG) 2026, co-located with NDSS 2026.

The full paper is available here: https://www.ndss-symposium.org/wp-content/uploads/futureg26-40.pdf