Step 3: Deploy Open5GS

Open5GS can be easily installed via package managers on Ubuntu:

<CodeBlock language="bash" is-terminal code=" # Add Open5GS repository and install sudo add-apt-repository ppa:open5gs/latest sudo apt update sudo apt install open5gs

Install the web UI for subscriber management

curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - sudo apt install nodejs cd /usr/lib/node_modules/open5gs npm ci npm run build

Start core network services

sudo systemctl start open5gs-mmed # 4G MME sudo systemctl start open5gs-amfd # 5G AMF sudo systemctl start open5gs-smfd # Session Management sudo systemctl start open5gs-upfd # User Plane sudo systemctl start open5gs-nrfd # NRF (Service Discovery)">

Configure the core:

1. Access the Web UI at http://localhost:9999
2. Add a new subscriber using the exact IMSI, Ki, and OPc values programmed onto the SIM
3. Configure the APN to internet with an IPv4 pool (e.g., 10.45.0.0/16)
4. For 5G SA: Configure the S-NSSAI (SST: 1, SD: optional) matching your slice configuration

Step 4: Configure and Run srsRAN

For 5G SA, use the srsRAN Project gNB:

<CodeBlock language="yaml" filename="gnb.yaml" code=" # srsRAN 5G SA gNB Configuration gnb_id: 1 gnb_id_bit_length: 22

amf: addr: 127.0.0.5 # Open5GS AMF address bind_addr: 127.0.0.1

ru_sdr: device_driver: uhd # USRP Hardware Driver device_args: type=b200 # USRP B210 srate: 23.04 # Sample rate (MHz) tx_gain: 50 rx_gain: 40

cell_cfg: dl_arfcn: 632628 # 5G NR ARFCN for n78 (3.5 GHz) band: 78 channel_bandwidth_MHz: 20 common_scs: 30 # Subcarrier spacing (kHz) plmn: '00101' # Test PLMN tac: 7

pdcch: common: ss0_index: 0 coreset0_index: 12 dedicated: ss2_type: common dci_format_0_1_and_1_1: false">

Step 5: The Connection

Start the stack in the correct order:

<CodeBlock language="bash" is-terminal code=" # 1. Start Open5GS services (if not already running) sudo systemctl start open5gs-nrfd open5gs-amfd open5gs-smfd open5gs-upfd

2. Start the gNB (5G SA) — requires sudo for real-time scheduling

sudo gnb -c gnb.yaml

3. Insert programmed SIM into UE and search for networks

Watch the gNB terminal for:

- RRC Setup Request (UE → gNB)

- NAS Registration Request (UE → AMF)

- Authentication (5G-AKA) exchange

- PDU Session Establishment

- DATA FLOW ACTIVE">

Insert your programmed SIM into your Android device and search for networks. On the device, you may need to manually select the 00101 network or lock to Band n78 using engineering mode. Watch the srsRAN terminal output: you should see the UE send an RRC Setup Request, perform 5G-AKA mutual authentication with the AMF/AUSF, and establish a PDU session. Once active, the UE will receive an IP from your configured pool and have internet access through your lab.

IV. Security Research Applications

Once your lab is stable, the real work begins. You own the infrastructure end-to-end, allowing you to execute research scenarios that would be illegal or impossible on production networks.

1. Protocol Analysis and Traffic Capture

Run Wireshark on the compute node to capture and decrypt signaling traffic:

<CodeBlock language="bash" is-terminal code=" # Capture S1AP signaling (4G) or NGAP signaling (5G SA) sudo tshark -i lo -f 'sctp' -w /tmp/5g_signaling.pcap

Decode NAS messages from the PCAP

tshark -r /tmp/5g_signaling.pcap -Y 'ngap || nas-5gs' -T json

Key protocol layers to analyze:

- NGAP: gNB ↔ AMF signaling (RAN-level)

- NAS-5GS: UE ↔ AMF signaling (authentication, registration)

- PFCP: SMF ↔ UPF session control (N4 interface)

- GTP-U: User plane tunneling (N3 interface)">

2. Core Network Fuzzing

Write Python scripts to modify authentication vectors or send malformed NAS packets directly into the Open5GS AMF to look for crashes. Key fuzzing targets:

• NAS Registration Messages: Malformed SUCI, invalid NSSAI, oversized PDU session requests
• NGAP Procedures: Invalid UE context IDs, malformed handover commands
• HTTP/2 SBA APIs: BOLA attacks, mass assignment against the NRF, UDM, and AUSF
• PFCP Session Management: Invalid TEID values, session modification overflows

3. RAN and Baseband Research

Intercept the downlink traffic from srsRAN and modify the ASN.1 encoded messages to trigger buffer overflows in the smartphone's baseband processor:

• RRC Fuzzing: Modify SystemInformationBlock messages to include deeply nested ASN.1 structures
• NAS Pre-Auth Fuzzing: Send malformed messages before mutual authentication completes — the baseband must process these without protection
• Paging Channel Analysis: Test IMSI catchers scenarios by broadcasting paging messages for specific IMSIs
• Downgrade Attacks: Force UEs to fall back from 5G to 4G/3G/2G by manipulating RRC release messages

4. Slice Security Testing

Configure multiple S-NSSAI entries in Open5GS and test 5G network slicing security:

• Register UEs to different slices and attempt cross-slice data access
• Test NSSAI spoofing by modifying the requested NSSAI in the NAS Registration Request
• Verify that QoS isolation holds under load (one slice should not impact another's throughput)

V. Troubleshooting Guide

VI. Dockerized Deployment (Alternative)

For faster iteration and reproducibility, the entire core network can be containerized:

<CodeBlock language="yaml" filename="docker-compose-5gc.yaml" code=" # Minimal Open5GS 5G Core via Docker Compose version: '3.8' services: nrf: image: open5gs/open5gs:latest command: open5gs-nrfd networks: 5gc: ipv4_address: 10.33.33.10

amf: image: open5gs/open5gs:latest command: open5gs-amfd ports: - '38412:38412/sctp' # NGAP (gNB connection) depends_on: nrf networks: 5gc: ipv4_address: 10.33.33.11

smf: image: open5gs/open5gs:latest command: open5gs-smfd depends_on: nrf networks: 5gc: ipv4_address: 10.33.33.12

upf: image: open5gs/open5gs:latest command: open5gs-upfd cap_add: NET_ADMIN devices: '/dev/net/tun' depends_on: smf networks: 5gc: ipv4_address: 10.33.33.13

networks: 5gc: driver: bridge ipam: config: - subnet: 10.33.33.0/24">

This approach is ideal for 5G SBA security where you need to rapidly deploy, modify, and tear down core configurations.

VII. Authoritative References

VIII. Frequently Asked Questions

Conclusion & Next Steps

A private lab is an indispensable tool for serious telecommunications security research. By utilizing open-source cores and accessible SDRs, security teams can safely execute scenarios ranging from simple IMSI catching to complex zero-click baseband exploits, 5G SBA API attacks, and cross-slice isolation testing — all without leaving the confines of their test bench.

The recommended progression for lab-based research:

1. Start with software-only: Deploy Open5GS + srsRAN with ZMQ virtual radios
2. Add SDR hardware: USRP B210 for over-the-air testing in a shielded enclosure
3. Expand scope: Multi-cell configurations, Diameter interconnect testing, baseband fuzzing
4. Automate: CI/CD pipelines for regression testing of core network security patches

Don't have the time to build and maintain a physical lab? TelcoSec provides fully-virtualized, pre-configured 5G simulation environments directly via our Academy. Explore our TelcoSec protocol analysis tools for telecom-specific testing frameworks, or browse the TelcoSec research library for additional attack methodologies.