I'm noticing an anomaly in the behavior of a Cisco SCE platform: a subscriber is performing traffic above the threshold configured for his package id.
The average downstream bitrate is around 100 kbps, while the threshold is set to 16 kbps).
The SCE reporter marks this traffic as "behavioral upload / download", and from a tcpdump we noticed that the packets are fragments of pure IP traffic (layer 4 header is missing: there is just the IP header and the data).
It looks like this traffic belongs to an IPinIP tunnel: maybe we should enable the IPinIP skip mode in order to let the SCE inspect the internal header and properly handle the flow?
I attach a small capture of traffic; the CPE ( a router) IP is 18.104.22.168;
thanks you in advance for your help, any hints will be appreciated.