drop gtp-c / gtp-u capture · parse session create + modify + delete · runs locally
flags rapid create/delete cycles · unknown apn · teid reuse · cause != request accepted
gtp-u payload not decoded — control plane focus · heuristic screener · not definitive proof