The program is built on the open-source 5G stack — Open5GS (5G Standalone core), UERANSIM (simulated RAN), and a Kamailio + PyHSS IMS subsystem — running together on a single cloud VM. Every procedure is proven with real packet evidence: the habit trained throughout is never claim it works without the signalling to prove it.
Lab Setup
PrerequisiteBuild the whole lab from an empty cloud project — a single VM, a 5G Standalone core, NAT and IP forwarding, the kernel GTP module (with the toolchain pitfall pre-solved so you don't lose an afternoon to it), a simulated RAN and test subscriber, and a three-line smoke test that proves a phone can attach. No prior 5G experience assumed.
You leave able to: You walk away with a working, reproducible 5G lab you own end to end — and the confidence to tear it down and rebuild it from scratch.
5G Core Operations in Practice
5G CoreLive at the console of a running 5G Standalone core. Watch the network functions negotiate over the service-based bus, trace a UE from registration through 5G-AKA authentication to an established PDU session, read the operational dashboard, and — the load-bearing skill — localize a fault to the exact reference point (N1/N2/N3/N4) instead of guessing.
You leave able to: You can look at a broken 5G core and say which function and which interface is at fault, with the signalling to back the claim.
Requires 00 · basic Linux + networking
View course →IMS Core & VoNR Procedures
IMS · VoiceStand up voice on top of the 5G core: a full P/I/S-CSCF call-session chain, an HSS, and a media relay. Drive an IMS-AKA REGISTER, place a VoNR call between two UEs, and decode the SIP and Diameter (Cx: UAR/MAR/SAR/LIR) side by side so the SIP dialog and the subscriber lookups line up. Every step proven with real packet evidence — never "it rang, so it works".
You leave able to: You can bring up IMS voice from nothing and read a VoNR call end to end, separating a signalling problem from a media problem on sight.
Requires 01
View course →Advanced 5G Core Engineering
5G CoreStop watching the network and start changing it. Cut an end-to-end network slice, differentiate QoS with Linux traffic control and prove the shaping in the data plane, harden the core against the TS 33.501 threat model (SUCI/ECIES subscriber-identity protection included), reconstruct signalling from the NF discovery API, and stand up a KPI pipeline that feeds an AI root-cause on-ramp.
You leave able to: You can engineer a differentiated, hardened core to a requirement — and show the packets and KPIs that prove the change did what you claimed.
Requires 01 · 02 recommended
View course →Advanced IMS Scenarios & Service Engineering
IMS · VoiceThe service layer that turns a raw call into a product: initial Filter Criteria routing to Application Servers over ISC, the MMTEL suite (hold, call diversion, barring, identity presentation/restriction), transfer and conference (REFER), emergency (sos) calls, access continuity (T-ADS, SRVCC), interconnect (ENUM, IBCF/TrGW) and Rf/Ro charging. Roughly half is offline reference call-flows that run with no lab attached.
You leave able to: You can reason about why a supplementary service misbehaves — from the iFC that should have triggered to the AS that answered — not just whether.
Requires 02
View course →Data Engineering, Analytics & ML
Data · MLTurn the telemetry every earlier course emits into a full data-science lifecycle — ingestion, a time-aligned feature store, analytics on standardized TS 28.554 KPIs, visualization for two audiences, and machine learning (Isolation-Forest anomaly detection, DTW fault classification, seasonal forecasting). The recurring lesson is honesty: a 0.99 score is usually a leak, and every model ends by asking what would be true on real traffic. Ships two notebooks — a synthetic edition that runs anywhere, and a live-lab edition on real telemetry.
You leave able to: You can build an honest pipeline from packets to predictions — and you trust the lower, leak-free number over the flattering one.
Requires 01 · 02/03 for vocabulary
View course →Deep, Graph & Federated ML
Data · MLThe honest case for deep learning in a telco: when a deep, graph or federated method genuinely beats the classical baseline from Course 05 — and, just as often, when it does not. CNNs/ROCKET for KPI time series, sequence models and self-attention for signalling ladders, graph neural nets that localize a fault on the service-based topology itself, deep anomaly detection, federated learning across sites that never share raw data, and a trust layer — conformal prediction, drift detection and a human in the loop. Offline, no GPU required.
You leave able to: You can pick the right model for a telco problem on evidence, and wrap it in the calibration and drift checks that make it safe to trust.
Requires 05
View course →IMS Roaming & Signalling Security
Security · RoamingCross the operator boundary and learn to defend it. The roaming architecture (home vs visited network, the IPX, the DEA and the SEPP), legacy SS7/MAP and CAMEL flows and why they are dangerous, Diameter roaming over S6a, VoLTE/VoNR roaming (S8HR vs local breakout), 5G roaming secured by the SEPP over N32/PRINS, signalling firewalls built to GSMA guidance (FS.11/FS.19), roaming-fraud detection (IRSF, Wangiri, SIM-box), and the on-call side — incident response and operations. Offline-first.
You leave able to: You can read an inter-operator signalling flow for both correctness and attack, and reason about the firewall rule that should have stopped it.
Requires 02 (+ 01)
View course →The one idea the whole path is built on
Every voice fault forks into the pipe (5G core) versus the application (IMS). Course 01 owns the pipe, Course 02 owns the application, the advanced pair deepens each, and Course 05 teaches the machine to read both. You leave able to answer that fork first — with evidence, not guesswork. Courses 06–07 then extend that reflex to the model layer (deep, graph & federated learning) and to the operator boundary (roaming and signalling security).
What each course ships
A self-contained package, not just a notebook.
- Notebook — the instrument you run, cell by cell
- Guide — a narrative companion, module by module
- Assessments — quizzes, a practice test and a capstone
- Slides — concept decks for the theory
- Resources — quick-reference cards and a glossary
Cell-safety discipline
Every cell is labelled so you always know what it does.
- 🟢 read-only — inspects, never changes the lab
- 🟠 changes state — starts a service, provisions a UE
- 🔴 instructor-guarded — fault injection; never fires on Run All