Reotina: an eBPF-Driven Observability Framework for 5G Networks

Fifth-generation ($\mathbf{5 G}$) mobile networks increasingly rely on containerized microservices and multi-interface configurations to meet the stringent performance, scalability, and flexibility demands of modern digital infrastructures. While these architectures support modular, high-performance deployments, they pose significant challenges for end-to-end observability, particularly in capturing control- and user-plane protocols such as NGAP, PFCP, and GTP-U. Existing monitoring solutions, predominantly optimized for HTTP traffic and dependent on sidecar-based service meshes, are ill-equipped for multi-cluster environments where traffic traverses secondary virtual interfaces provisioned by Multus CNI. We introduce Reotina, an eBPFbased observability framework that enables protocol-aware visibility in cloud-native 5 G environments. Reotina performs inkernel, interface-level traffic introspection and enriches packet data with Kubernetes context, operating transparently across multiple interfaces and clusters. By correlating protocol events with workload identity, it supports structured telemetry for performance analysis and operational insight. We evaluate Reotina in a Kubernetes-based, multi-cluster free5GC testbed, where it achieves full coverage of NGAP, PFCP, and GTP-U transactions with under 2% CPU overhead and sub-millisecond latency in cross-cluster session reconstruction. These results demonstrate that Reotina enables scalable, low-overhead observability for production-grade 5 G systems, effectively addressing key limitations of existing monitoring solutions.