A method of learning and identifying two unidirectional GTP-U tunnels corresponding to a user equipment (UE) in a device placed in a LTE network, where the device acts as a transparent proxy intercepting user plane and control plane protocols on the S1 interface, is disclosed. Methods of pairing the two unidirectional tunnels that belong to same UE, when there is no control plane information or when there is Control Plane information, but the NAS portions of the S1 Control that contain bearer IP addresses are encrypted, are disclosed. Control plane and user plane methods for associating GTP-U tunnels and the corresponding bearer plane IP addresses are identified. Additionally, methods for detecting mobility of a UE, as it moves from the coverage area of one E-NodeB to another, are disclosed. Methods for constructing an eNodeB topology map are also disclosed.