The lab is the standard open-source 5G reference stack on a single low-cost cloud instance. All planes run on the VM's loopback and a GTP tunnel interface, so one machine hosts the whole end-to-end path. Project identifiers, the VM name, host IP addresses and authentication keys are intentionally omitted here — this page teaches the architecture, not a specific deployment.
Access · UERANSIMSimulated gNB + two UEs, each isolated in its own Linux network namespace
nr-gNB
simulated 5G base station; NGAP to the AMF
SCTP · N2
nr-UE 1
own network namespace; dual PDU sessions
nr-UE 2
own network namespace; dual PDU sessions
pjsua (AKA)
SIM-capable SIP client — the softphone
N2 NGAP/SCTP · N3 GTP-U (user plane) · Uu radio (simulated)
5G Core · Open5GSStandalone control & user plane; service-based architecture over the SBI
AMF
access & mobility; registration, NAS
SMF
session mgmt; PDU sessions, QoS
N4 → UPF
UPF
user-plane forwarding
GTP-U
NRF
NF discovery / registry
PCF
policy; QoS, Rx to IMS
UDM · UDR · AUSF
subscriber data & 5G-AKA auth
SCP
service communication proxy
MongoDB
subscriber database (5GC side)
IMS rides an ims PDU session (5QI 5 signalling / 5QI 1 voice) · Rx P-CSCF↔PCF
IMS · Kamailio + PyHSSOne Kamailio binary, three configs = the CSCF chain; PyHSS is HSS+AuC; a media relay carries the audio
P-CSCF
UE's edge proxy; QoS anchor (Gm)
SIP :5060
I-CSCF
home entry; finds the S-CSCF
SIP
S-CSCF
registrar · authenticator · service brain
SIP
PyHSS
subscriber DB + AKA vector factory (HSS/AuC)
Diameter :3868 · REST
RTPEngine
media relay — the actual voice (Mb)
RTP
bind9
3GPP naming; NAPTR / SRV / A
DNS :53
Gm UE↔P-CSCF · Mw CSCF↔CSCF · Cx CSCF↔HSS · Mb RTP media
Telemetry · Data & AIWhat Course 05 ingests — the network's own exhaust, plus optional analytics functions
tshark pcaps
SIP · Diameter · RTP/RTCP captures
journald
per-NF structured logs
kamcmd · REST
Kamailio RPC stats · IMS reg state
KPI collector
the daemon Course 05 deploys → a time series
NWDAF
analytics; Isolation-Forest anomaly (optional)
Digital-Twin RCA
DTW + LLM root-cause agent (optional)
Reference points & where the evidence lives
Every interface maps to a protocol and a capture file — the spine of fault localization.
| Interface | Between | Protocol | Evidence |
|---|---|---|---|
| N2 | gNB ↔ AMF | NGAP / SCTP | control plane |
| N3 | gNB ↔ UPF | GTP-U | user plane |
| Gm | UE ↔ P-CSCF | SIP | sip.pcap |
| Mw | P ↔ I ↔ S-CSCF | SIP | sip.pcap |
| Cx | I/S-CSCF ↔ HSS | Diameter | diameter.pcap |
| Rx | P-CSCF ↔ PCF | Diameter | QoS (lab: off) |
| Mb | UE ↔ media relay ↔ UE | RTP / RTCP | rtp.pcap |
| ISC · Sh | S-CSCF ↔ AS ↔ HSS | SIP · Diameter | Course 04 (ref) |
Identities & addressing
Kept generic — the lab uses reserved test values, not production identities.
- PLMN — a reserved test network code (never a live operator)
- IMS home domain — ims.mnc<xxx>.mcc<xxx>.3gppnetwork.org (derived from the test PLMN)
- Subscribers — two test IMSIs on the reserved PLMN
- Credentials — shared Milenage test vectors (K / OPc / AMF), the same for 5G-AKA and IMS-AKA
- Data network — internet DNN · 5QI 9
- Voice network — ims DNN · 5QI 5/1
- UE isolation — each UE a real host via its own network namespace + routes
Host IPs, the cloud project, the VM name and key material are not published.