TP-00 — Resources & Step-by-Step Setup Guide

Version: 1.0 | Date: 2026-03-28
Prerequisite for: All test domains TP-01 through TP-10

1. Hardware Requirements

Single-Node Lab (minimum viable)

Critical: MongoDB requires AVX CPU instructions. Intel Celeron and old Atom CPUs will fail at MongoDB startup.

Multi-Node Kubernetes Lab

2. Software Requirements

Core Stack

Analysis Tools

3. Lab Architecture Overview

graph TB
    subgraph HOST["Host Machine (Ubuntu 22.04)"]
        subgraph DC["Docker Compose"]
            subgraph SBI["SBI Network 172.22.0.0/24"]
                NRF["NRF :7777"]
                SCP["SCP :7777"]
                AMF["AMF :38412 (SCTP)"]
                SMF["SMF :8805 (PFCP)"]
                AUSF["AUSF"]
                UDM["UDM"]
                UDR["UDR"]
                PCF["PCF"]
                NSSF["NSSF"]
                BSF["BSF"]
                MongoDB["MongoDB :27017"]
            end
            subgraph RAN["RAN Network 172.23.0.0/24"]
                UPF["UPF :2152 (GTP-U)"]
                GNB["UERANSIM gNB"]
                UE["UERANSIM UE"]
            end
        end
        subgraph TOOLS["Analysis Tools"]
            WS["Wireshark 4.4+"]
            PROM["Prometheus"]
        end
    end

    GNB -->|N2 NGAP/SCTP| AMF
    GNB -->|N3 GTP-U/UDP| UPF
    UE -->|NAS over N1| AMF
    AMF -->|N11 HTTP/2 SBI| SMF
    AMF -->|Nnrf HTTP/2| NRF
    SMF -->|N4 PFCP| UPF
    AMF -->|Nausf| AUSF
    AUSF -->|Nudm| UDM
    UDM -->|Nudr| UDR
    AMF -->|Npcf| PCF
    AMF -->|Nnssf| NSSF

    style HOST fill:#1a1a2e,color:#e0e0e0
    style SBI fill:#16213e,color:#e0e0e0
    style RAN fill:#0f3460,color:#e0e0e0
    style TOOLS fill:#533483,color:#e0e0e0

4. Step-by-Step Setup

Step 1 — Prepare the Host

# Update system
sudo apt update && sudo apt upgrade -y

# Install Docker
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
newgrp docker

# Install tools
sudo apt install -y \
  wireshark tshark tcpdump \
  curl jq git python3 python3-pip \
  hping3 nmap freediameter \
  iproute2 net-tools

# Install Python libraries
pip3 install pycrate scapy

Step 2 — Create Lab Directory Structure

mkdir -p ~/open5gs-lab/{4g,5g,k8s,captures,tools}
cd ~/open5gs-lab

Step 3 — Set Up the 4G EPC Lab

cd ~/open5gs-lab/4g

# Create docker-compose.yml for 4G EPC (gradiant monolithic image)
cat > docker-compose.yml << 'EOF'
version: "3.8"
services:
  mongodb:
    image: mongo:6.0
    container_name: open5gs-mongodb
    networks:
      control: { ipv4_address: 172.22.0.2 }

  webui:
    image: gradiant/open5gs-webui:2.7.7
    container_name: open5gs-webui
    ports: ["9999:9999"]
    environment:
      - DB_URI=mongodb://172.22.0.2/open5gs
    networks:
      control: { ipv4_address: 172.22.0.3 }

  open5gs:
    image: gradiant/open5gs:2.7.7
    container_name: open5gs-epc
    cap_add: [NET_ADMIN]
    sysctls:
      - net.ipv4.ip_forward=1
    networks:
      control: { ipv4_address: 172.22.0.4 }
      userplane: { ipv4_address: 172.23.0.4 }
    environment:
      - DB_URI=mongodb://172.22.0.2/open5gs

networks:
  control:
    ipam:
      config: [{ subnet: 172.22.0.0/24 }]
  userplane:
    ipam:
      config: [{ subnet: 172.23.0.0/24 }]
EOF

docker compose up -d
docker compose ps   # verify all healthy

Step 4 — Register a Test Subscriber (4G)

# Open WebUI at http://localhost:9999
# Default login: admin / 1423
# Add subscriber:
#   IMSI: 001010000000001
#   Key:  465B5CE8B199B49FAA5F0A2EE238A6BC
#   OPc:  E8ED289DEBA952E4283B54E88E6183CA

# Or via mongo shell:
docker exec -it open5gs-mongodb mongosh open5gs --eval '
db.subscribers.insertOne({
  imsi: "001010000000001",
  msisdn: ["0000000001"],
  imeisv: "4301816125816151",
  security: {
    k: "465B5CE8B199B49FAA5F0A2EE238A6BC",
    op: null,
    opc: "E8ED289DEBA952E4283B54E88E6183CA",
    amf: "8000",
    sqn: NumberLong(0)
  },
  ambr: { downlink: { value: 1, unit: 3 }, uplink: { value: 1, unit: 3 } },
  slice: [{ sst: 1, default_indicator: true,
    session: [{ name: "internet", type: 3,
      ambr: { downlink: { value: 1, unit: 3 }, uplink: { value: 1, unit: 3 } },
      qos: { index: 9, arp: { priority_level: 8, pre_emption_capability: 1, pre_emption_vulnerability: 1 } }
    }]
  }]
})'

Step 5 — Set Up the 5G SA Lab

cd ~/open5gs-lab/5g

# Download the per-NF docker-compose from the lab guide (Part 6)
# Key services: nrf, scp, amf, smf, upf, ausf, udm, udr, pcf, nssf, bsf, mongodb, webui
# Plus UERANSIM gNB and UE

# Minimal structure:
cat > docker-compose.yml << 'EOF'
version: "3.8"
services:
  mongodb:
    image: mongo:6.0
    networks:
      sbi: { ipv4_address: 172.22.0.2 }

  nrf:
    image: borieher/open5gs-nrf:v2.7.7
    volumes: [./config/nrf.yaml:/etc/open5gs/nrf.yaml]
    networks:
      sbi: { ipv4_address: 172.22.0.10 }

  amf:
    image: borieher/open5gs-amf:v2.7.7
    volumes: [./config/amf.yaml:/etc/open5gs/amf.yaml]
    networks:
      sbi: { ipv4_address: 172.22.0.20 }

  smf:
    image: borieher/open5gs-smf:v2.7.7
    volumes: [./config/smf.yaml:/etc/open5gs/smf.yaml]
    networks:
      sbi: { ipv4_address: 172.22.0.21 }
      ran: { ipv4_address: 172.23.0.21 }

  upf:
    image: borieher/open5gs-upf:v2.7.7
    cap_add: [NET_ADMIN]
    volumes: [./config/upf.yaml:/etc/open5gs/upf.yaml]
    networks:
      ran: { ipv4_address: 172.23.0.30 }

  gnb:
    image: louisroyer/ueransim-gnb:latest
    cap_add: [NET_ADMIN]
    volumes: [./config/gnb.yaml:/etc/ueransim/gnb.yaml]
    networks:
      sbi: { ipv4_address: 172.22.0.50 }
      ran: { ipv4_address: 172.23.0.50 }

  ue:
    image: louisroyer/ueransim-ue:latest
    cap_add: [NET_ADMIN]
    volumes: [./config/ue.yaml:/etc/ueransim/ue.yaml]
    networks:
      ran: { ipv4_address: 172.23.0.51 }
    depends_on: [gnb]

networks:
  sbi:
    ipam:
      config: [{ subnet: 172.22.0.0/24 }]
  ran:
    ipam:
      config: [{ subnet: 172.23.0.0/24 }]
EOF

docker compose up -d

Step 6 — Verify 5G SA Lab Health

# Check all NFs running
docker compose ps

# Verify NRF has registered NFs
curl -s http://172.22.0.10:7777/nnrf-nfm/v1/nf-instances | jq '.[] | {nfType, nfStatus}'

# Check AMF has gNB registered
docker logs open5gs-amf 2>&1 | grep "gNB-ID"

# Verify UE has PDU session (should see uesimtun0)
docker exec ueransim-ue ip addr show uesimtun0

# Test end-to-end connectivity
docker exec ueransim-ue ping -c 3 -I uesimtun0 8.8.8.8

Step 7 — Register Multiple Test Subscribers (5G)

# Register 10 subscribers for scalability tests
for i in $(seq 1 10); do
  IMSI="00101000000000${i}"
  docker exec open5gs-mongodb mongosh open5gs --eval "
    db.subscribers.insertOne({
      imsi: '${IMSI}',
      security: {
        k: '465B5CE8B199B49FAA5F0A2EE238A6BC',
        opc: 'E8ED289DEBA952E4283B54E88E6183CA',
        amf: '8000', sqn: NumberLong(0)
      },
      slice: [{ sst: 1, default_indicator: true,
        session: [{ name: 'internet', type: 3,
          qos: { index: 9, arp: { priority_level: 8,
            pre_emption_capability: 1, pre_emption_vulnerability: 1 }}
        }]
      }]
    })"
done

Step 8 — Set Up Packet Capture Baseline

# Capture SBI (HTTP/2) and NGAP traffic
sudo tshark -i br-$(docker network ls | grep sbi | awk '{print $1}') \
  -w ~/open5gs-lab/captures/baseline_sbi.pcap &

# Capture GTP-U (N3) traffic
sudo tshark -i br-$(docker network ls | grep ran | awk '{print $1}') \
  -w ~/open5gs-lab/captures/baseline_gtp.pcap &

echo "Captures started. PIDs: $(pgrep tshark)"

Step 9 — Set Up Monitoring (Prometheus + Grafana)

cd ~/open5gs-lab

cat > monitoring-compose.yml << 'EOF'
version: "3.8"
services:
  prometheus:
    image: prom/prometheus:latest
    volumes: [./prometheus.yml:/etc/prometheus/prometheus.yml]
    ports: ["9090:9090"]
    networks: [monitoring]

  grafana:
    image: grafana/grafana:latest
    ports: ["3000:3000"]
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
    networks: [monitoring]

networks:
  monitoring:
    driver: bridge
EOF

cat > prometheus.yml << 'EOF'
global:
  scrape_interval: 15s
scrape_configs:
  - job_name: open5gs
    static_configs:
      - targets:
          - "172.22.0.20:9090"   # AMF metrics
          - "172.22.0.21:9090"   # SMF metrics
          - "172.23.0.30:9090"   # UPF metrics
EOF

docker compose -f monitoring-compose.yml up -d
# Prometheus: http://localhost:9090
# Grafana:    http://localhost:3000  (admin/admin)

Step 10 — Clone Attack Tools

cd ~/open5gs-lab/tools

# 5G trace visualizer
git clone https://github.com/telekom/5g-trace-visualizer
cd 5g-trace-visualizer && pip3 install -r requirements.txt && cd ..

# 5G NAS decipher
git clone https://github.com/jimtangshfx/5G_ciphered_NAS_decipher_tool

# SigPloit (SS7/Diameter/GTP)
git clone https://github.com/SigPloiter/SigPloit
# Note: requires Python 2.7 virtualenv
virtualenv2 sigploit-env
source sigploit-env/bin/activate
cd SigPloit && pip install -r requirements.txt && cd ..
deactivate

echo "All tools ready."

Step 11 — Set Up Kubernetes Lab (Optional, for TP-09)

# Install kind
go install sigs.k8s.io/kind@latest
export PATH=$PATH:$(go env GOPATH)/bin

# Create multi-node cluster
cat > kind-config.yaml << 'EOF'
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
  - role: worker
    labels:
      open5gs/node-type: core
  - role: worker
    labels:
      open5gs/node-type: ran
EOF

kind create cluster --config kind-config.yaml --name open5gs-lab

# Verify
kubectl get nodes

# Install Helm charts (Gradiant 5G charts)
helm repo add gradiant https://gradiant.github.io/5g-charts/
helm repo update
helm install open5gs gradiant/open5gs --namespace open5gs --create-namespace

Step 12 — Test Execution Order

Run domains in this sequence to build on previous results:

TP-01 Registration & Mobility     ← Run first; establishes baseline
TP-02 Authentication              ← Depends on working lab from TP-01
TP-03 SBI Security                ← 5G only; needs NRF/AMF/UDM running
TP-04 GTP & User Plane            ← Needs active PDU sessions from TP-01
TP-05 SS7 / Diameter              ← 4G lab; independent of 5G
TP-06 Network Slice Isolation     ← Needs multi-slice config
TP-07 DoS & Robustness            ← Run last; may destabilize lab
TP-08 STRIDE Threat Emulation     ← Can run after TP-01 baseline
TP-09 Container / K8s             ← Requires Kubernetes lab (Step 11)
TP-10 Monitoring & Detection      ← Requires Prometheus (Step 9)

5. Quick Reference — Key Ports

6. Common Troubleshooting