5G SA Operations & Security Control Center

5G Core Network Functions

11 / 11

Control & User Plane Active

gNodeB (Base Station)

ACTIVE

PLMN 999-70 • TAC 1

User Equipment (UE)

RM-REGISTERED

10.45.0.24 (PDU #1)

Security Alerts (IDS)

63

54 Critical • 9 High

UERANSIM gNodeB (nr-gnb)

Process State / PID

PID: --

Target AMF (N2 Link)

127.0.0.5:38412 (SCTP)

Simulated Radio Link

127.0.0.1:4997 (UDP)

GTP-U User Plane

127.0.0.1:2152 (UDP)

UERANSIM 5G UE (nr-ue)

IMSI / SUPI

999700000000001

Assigned 5G IP

10.45.0.24

5GMM / RM State

RM-REGISTERED

Network Namespace

ueransim-...-psi1

Open5GS 5G Core Network Functions

Service-Based Interface (SBI) HTTP/2 REST Endpoints & Data-Plane UPF

Intrusion Detection System (IDS) Real-Time Alert Log

Captured protocol anomalies and cross-plane security rule violations

ID / Time	Severity	Rule ID & Name	Protocol / Interface	MITRE ATT&CK	Description

Interactive 5G Technical Specification & Runbook

5G Standalone (5G SA) Architecture Deep Dive

This visual guide details every component of this software-defined 5G SA testbed. Learn how user traffic flows through the 5G protocol stack, understand every live parameter on this dashboard, and explore how the IDS intercepts cyber threats.

1. Architecture Map 2. Packet Journey 3. Indicator Dictionary 4. 11 Core NFs 5. Threat Lab & IDS 6. 24/7 Persistence

1 Interactive End-to-End 5G SA Topology

Click on any component below to view its specific interface bindings, IP endpoints, and protocols.

USER EQUIPMENT

UERANSIM nr-ue

Virtual 5G modem with USIM credentials and TUN network interface.

• IP: 10.45.0.24

• NS: ueransim-...-psi1

BASE STATION

UERANSIM nr-gnb

Simulates 5G-NR Radio Access Network, RRC termination, and NGAP relay.

• RF: UDP 127.0.0.1:4997

• PLMN: 999-70 | TAC: 1

CONTROL PLANE

Open5GS AMF

Terminates N1 NAS signaling and N2 NGAP over SCTP association.

• Endpoint: 127.0.0.5:38412

• 5G-AKA Authentication

USER PLANE

Open5GS UPF

Handles GTP-U encapsulation/decapsulation and routes subscriber IP packets.

• N3: UDP 127.0.0.7:2152

• Egress: ogstun 10.45.0.1

WAN INTERNET

Linux NAT Gateway

Translates 10.45.0.0/16 packets through host WAN (enp0s6) to the global web.

• iptables MASQUERADE

• Target: Public Internet

Click any box above to inspect deep protocol parameters, interface bindings, and RFC specifications.

2 Step-by-Step Packet Journey: How 5G Standalone Works

From the moment the phone powers on to surfing the web through the 5G Core:

Radio Synchronization & Cell Selection

When nr-ue boots, it scans for broadcast signals on simulated radio port 127.0.0.1:4997. It detects the cell advertised by nr-gnb with PLMN 999/70 and TAC 1. The UE sends an RRCSetupRequest and enters RRC-CONNECTED.

5G-AKA Cryptographic Authentication & NAS Security

The UE transmits an Initial Registration Request containing its IMSI (999700000000001). The AMF asks the AUSF and UDM to generate an authentication vector (RAND and AUTN). The UE's Milenage algorithm verifies the operator key K and OPc, calculates RES*, and responds. The AMF validates the response, turns on integrity (NIA2), and issues the GUTI (0xc00000ba).

PDU Session Establishment & GTP-U Tunnel Creation

The UE requests a data session for APN 'internet' on slice SST: 1. The SMF allocates an IP (10.45.0.24) and communicates with the UPF using PFCP (N4 : UDP 8805). A bidirectional GTP-U (N3 : UDP 2152) tunnel is established between the gNodeB and UPF. UERANSIM brings up the TUN interface uesimtun0 inside network namespace ueransim-...-psi1.

End-to-End User Data Plane Egress to the Internet

When you execute a ping or curl inside the UE namespace, packets enter uesimtun0, get encapsulated into GTP-U UDP packets by the gNodeB, traverse to the Open5GS UPF, emerge onto the host TUN interface ogstun (10.45.0.1), and get NATed out via iptables MASQUERADE to the public Internet!

3 Complete 3GPP Parameter & Indicator Dictionary

Clear explanations of every metric and term shown on the dashboard:

PLMN (999/70) TS 23.003

Public Land Mobile Network identifier: MCC 999 (ITU test network) + MNC 70. Uniquely identifies this cellular operator.

TAC (Tracking Area Code) TS 23.003

Tracking Area Code = 1. A cellular paging zone broadcast by base stations so the 5G Core knows which gNodeB to page when incoming packets arrive.

IMSI / SUPI TS 23.501

Subscription Permanent Identifier (999700000000001). The 15-digit global identifier permanently stored inside the SIM card.

GUTI & 5G-TMSI TS 23.501

Globally Unique Temporary Identifier and TMSI (0xc00000ba). Dynamic temporary ID issued by AMF to prevent IMSI tracking by eavesdroppers.

RM-State (RM-REGISTERED) TS 24.501

Registration Management State. Indicates the UE has authenticated with AUSF/UDM and is acknowledged by the 5G Core.

CM-State (CM-CONNECTED) TS 24.501

Connection Management State. Transitions to CM-CONNECTED when transmitting packets; sleeps to CM-IDLE to save battery power.

5U-State (5U1-UPDATED) TS 24.501

5GS Update Status. Confirms that registration parameters on the SIM match the active cellular network's Tracking Area.

SST: 1 (Network Slice) TS 23.501

Slice / Service Type. Standardized value 1 represents enhanced Mobile Broadband (eMBB) optimized for high-speed internet data.

Dedicated Linux NetNS Linux Kernel

Network Namespace isolation (ueransim-...-psi1). Prevents kernel routing loops by isolating the UE's IP stack on the same host as the UPF.

4 The 11 Standardized 3GPP Core Network Functions

What each Open5GS microservice does in this 5G Standalone network:

AMF SCTP:38412

Access & Mobility Management

Control plane hub: terminates N1/N2, registers subscribers, orchestrates auth, and manages mobility.

SMF UDP:8805

Session Management Function

Allocates UE IP addresses and uses PFCP (N4) to program forwarding rules into the UPF data plane.

UPF UDP:2152

User Plane Function

Data plane router: encapsulates/decapsulates GTP-U packets and routes traffic between gNB and WAN (ogstun).

AUSF HTTP/2 SBI

Authentication Server Function

Cryptographic engine: derives 5G-AKA authentication vectors (RAND, AUTN, HXRES*) and session keys.

UDM HTTP/2 SBI

Unified Data Management

Manages subscriber identities, subscription permissions, and verifies computed RES* challenge responses.

UDR HTTP/2 SBI

Unified Data Repository

Database gateway: persists subscriber credentials, permanent secret keys (K, OPc), and slice profiles in MongoDB.

NRF HTTP/2 SBI

Network Repository Function

Service Discovery Directory: acts as the DNS/registry for NFs to discover and query each other's endpoints.

NSSF HTTP/2 SBI

Network Slice Selection

Routes subscriber registration requests to the authorized slice instance based on requested SST values.

PCF HTTP/2 SBI

Policy Control Function

Policy engine: enforces Quality of Service (QoS), Aggregate Maximum Bit Rate (AMBR), and charging rules.

SCP HTTP/2 SBI

Service Communication Proxy

Microservice router: load balances and handles indirect communication between control-plane NFs.

BSF HTTP/2 SBI

Binding Support Function

Session tracker: stores bindings between subscriber PDU sessions and PCF instances for policy queries.

5 5G Cybersecurity Threat Lab & IDS Heuristics

Detailed breakdown of the simulated attacks and how the Intrusion Detection System flags them:

RULE 5G-SEC-001 MITRE: T1499

NAS Registration Storm (DoS)

Attack: Injects raw SCTP packets on port 38412 containing crafted Initial UE Registration requests at rates up to 50 req/sec without completing authentication.

Detection: The IDS tracks the request frequency over the N2 control-plane interface. If the burst exceeds 8 req/sec, it logs a CRITICAL alert.

RULE 5G-SEC-003 MITRE: T1055

GTP-U Ghost TEID Injection

Attack: Forges UDP datagrams to UPF port 2152 carrying an arbitrary TEID (0xdeadbeef) and spoofed inner IPv4 headers.

Detection: The IDS performs cross-plane state correlation with PFCP session establishments. Any GTP-U packet with an unmapped TEID triggers a HIGH alert.

RULE 5G-SEC-005 MITRE: T1584

Rogue gNodeB Setup

Attack: Attempts NGSetup to AMF advertising an unauthorized rogue PLMN (666-99) and null ciphering (NEA0) to harvest subscriber IMSIs.

Detection: The IDS verifies gNB IDs and supported PLMNs against the authorized core whitelist, immediately raising a CRITICAL alert.

6 24/7 Self-Healing System Architecture

How all components stay running persistently even after terminal closure or full VM reboots:

Component	Supervision Method	Auto-Recovery Policy	Role
5g-control-center	Docker Container (net:host)	unless-stopped	Hosts the Web UI & REST API engine on port 5000.
bhudrishti_caddy	Docker Container	unless-stopped	Provides public HTTPS reverse proxy & auto Let's Encrypt SSL.
ueransim-gnb.service	Systemd Daemon	Restart=always (3s)	Runs the virtual gNodeB base station (nr-gnb).
ueransim-ue.service	Systemd Daemon	Restart=always (3s)	Runs the virtual UE (nr-ue) and auto-manages the Linux netns.
open5gs-netconf.service	Systemd Boot Oneshot	RemainAfterExit=yes	Provisions ogstun (10.45.0.1) & iptables NAT before UPF boots.
open5gs-*.service (11 NFs)	Systemd Services	multi-user.target	The 11 standardized 3GPP Release 16 Core Network Functions.

5G-SEC CONTROL CENTER

11 / 11

ACTIVE

RM-REGISTERED

63

UERANSIM gNodeB (nr-gnb)

UERANSIM 5G UE (nr-ue)

Open5GS 5G Core Network Functions

nr-cli Actions & Injection

CLI Live Execution Console

5G End-to-End Traffic Tests

Network Namespace Data Plane Output

NAS Registration Storm

GTP-U Ghost TEID Injection

Rogue gNodeB Setup

Attack Simulation Console Output

Intrusion Detection System (IDS) Real-Time Alert Log

5G Standalone (5G SA) Architecture Deep Dive

1 Interactive End-to-End 5G SA Topology

UERANSIM nr-ue

UERANSIM nr-gnb

Open5GS AMF

Open5GS UPF

Linux NAT Gateway

2 Step-by-Step Packet Journey: How 5G Standalone Works

Radio Synchronization & Cell Selection

5G-AKA Cryptographic Authentication & NAS Security

PDU Session Establishment & GTP-U Tunnel Creation

End-to-End User Data Plane Egress to the Internet

3 Complete 3GPP Parameter & Indicator Dictionary

4 The 11 Standardized 3GPP Core Network Functions

5 5G Cybersecurity Threat Lab & IDS Heuristics

NAS Registration Storm (DoS)

GTP-U Ghost TEID Injection

Rogue gNodeB Setup

6 24/7 Self-Healing System Architecture

gNodeB Log (/home/ubuntu/gnb.log)

UE Log (/home/ubuntu/ue.log)