6Reference points
10+Diameter commands
30+Call-flow ladders
8Fault cases
3ML model families
01 5G Core
02 IMS
03 Adv. Core
04 Adv. IMS
05 Data & ML
Procedures & signalling
Registration and call setup, decoded message by message.
5G registration & PDU sessionsNAS, 5G-AKA, dual data networks01
IMS-AKA registrationREGISTER → 401 → REGISTER → 200 OK02
VoNR call between two UEsINVITE / 100 / 180 / 200 / ACK / BYE + SDP02
Cx command setUAR · MAR · SAR · LIR — plus RTR / PPR0204
Registration deep divereg-event, de-registration, restoration04
Session modification100rel/PRACK, UPDATE, preconditions, early media04
SIP & Diameter forensicstshark field extraction, auto-ladder from pcap0203
MMTEL & the service layer
The services that live above the base procedures.
iFC · Application Servers · ISC · ShDefaultHandling, session cases, third-party REGISTER04
Hold / resume & call waitingthe SDP direction change, driven live04
Diversion — CFU / CFB / CFNR / CFNLHistory-Info, loop prevention04
Barring & identityOCB/ICB/ACR · CLIP/CLIR, P-Asserted-Identity, Privacy04
Transfer & conferenceREFER, Replaces, isfocus, the MRF04
Emergency callsservice URN, E-CSCF/LRF, 380 Alternative Service04
Continuity & interconnectT-ADS · EPS fallback · SRVCC · ENUM · IBCF/TrGW04
Media & chargingcodecs · DTMF · RTCP/MOS · Rf/Ro · ICID0204
Core engineering
Deliberately reconfiguring a live core.
Network slicingS-NSSAI → DNN → subnet03
QoS differentiationtc TBF/PFIFO · AMBR · PCC03
Security TS 33.501NIA/NEA order · SUCI/ECIES03
Signalling forensicsNF discovery · TRACE · audit03
Mobility & resiliencehandover, orphan-state drift03
KPI pipelinemetrics exporter · TS 28.55403
Data engineering & ML
The data-science lifecycle on real telemetry.
Ingestion & feature storepcap · logs · metrics · DB05
Sessionizationmessages → calls by Call-ID05
Data qualitymissingness · clock skew · dedup05
Analytics & vizp50/p95/p99 · dashboards · timelines05
Anomaly detectionIsolation Forest — the NWDAF model05
Fault classificationRandomForest + DTW — the RCA agent05
Forecastingseasonal-naive · backtest · skill05
MLOpseval campaigns · drift · serving05
Fault cases you learn to localize
Each is injected for real (Course 05, live edition) or walked as a clinic case (Courses 02–04). The skill is the same: read the symptom, name the interface, prove it.
HSS down
Registrations fail — and no 401 ever comes (no AKA vector).
tell: RSR → 0, no MAR/MAA on Cx · 02 05
S-CSCF overload / down
REGISTER timeout, 480/504; setup latency spikes.
tell: PDD/RTT up, CSSR down, CPU pinned · 02 05
Media relay down
Signalling perfect, the call is silent.
tell: all SIP KPIs green, zero RTP streams · 02 05
DNS failure
Breaks at the next resolution, not instantly.
tell: NXDOMAIN on NAPTR/SRV; 404/480 · 04 05
Registration storm
Attempts spike, success dips — a rogue-UE pattern.
tell: attempts ↑↑, RSR ↓, CPU ↑ · 05
401 → 403 loop
Challenge worked, but RES ≠ XRES.
tell: key material / sequence number vs AuC · 02
412 Precondition
INVITE rejected — QoS reservation unconfirmed.
tell: Rx/PCF binding absent · 04
AS DefaultHandling
One Application Server restarts and every matching call fails.
tell: SESSION_TERMINATED trigger · 04
SIP response codes decoded across the courses
380 Alt Service (emergency)
401 AKA challenge
403 auth / RES≠XRES
404 ENUM / routing
412 precondition / Rx
420 100rel mismatch
433 ACR + Privacy:id
480 diversion loop / T-ADS
486 busy → CFB
488 codec intersection
503 overload
603 barring