Out of the Box Test - UEsim LTE

The purpose of this tutorial is to show you how to do basic LTE connectivity test between a UEsim and Amari Callbox and show you basic operation of Amari UEsim. It is assumed that you don't have any previous experience with Amari callbox. Basically this is same as the tutorial LTE Attach. The only difference is that I uses UE Sim instead of a commercial UE.

UEsim stands for UE simulator and it is the product that can function as UE (User Equipment). It can simulates one or more UEs with a single box (single PC). It can simulator maximum over 1000 UEs in a single box. It supports full radio protocol stack from PHY to RRC/NAS and IP of UE, so that you can test eNB / gNB in full protocol stack from PHY to IP throughput.

UE sim support USIM parameters in purely software way meaning that you don't need any USIM card and you can configure USIM parameters for each and every UEs just by setting USIM parameters in configuration file. Regarding Authentication Algorithm, it support both 3GPP XOR algorithm and Milenage algorithm.

In terms of frequency and bands, Amarisoft UE sim support all the frequencies and bands defined in 3gpp. In terms of MIMO, it can support upto 4x4 MIMO. (NOTE : The max MIMO configuration varies depending on the UEsim product type and the number of SDR cards). Regarding the transmission mode, it support all the TMs from TM1 through TM10.  If you are interested in testing transmission mode, refer to this tutorial.

NOTE : The purpose of this tutorial is to show how to operate UEsim for LTE testing, not explain on the LTE technology itself. If you are interested in LTE technology itself with a commercial device, refer to this tutorial.

Table of Contents

• Out of the Box Test - UEsim LTE
• Introduction
• Summary of the Tutorial
• Test Setup
• Key Configuration Parameters
• Configuration
• Check if LTE service is Running
• Getting into Screen Mode
• Attach UE
• Log Analysis
• RRC / NAS Signaling
• SIB1
• SIB2
• RrcConnectionSetup
• AttachRequest
• AttachAccept
• RrcConnectionReconfiguration

Introduction

Amarisoft UE Sim (UEsim) is a powerful and flexible User Equipment simulator designed to emulate one or more LTE UEs (User Equipments) for comprehensive wireless network testing. It provides a scalable platform capable of simulating hundreds or even thousands of UEs within a single hardware unit or PC, allowing users to validate and stress-test LTE eNB (eNodeB) or gNB (next-generation NodeB) components across the entire radio protocol stack, from the Physical (PHY) layer through RRC (Radio Resource Control), NAS (Non-Access Stratum), and up to the IP layer. UEsim achieves this by implementing a full software-based radio protocol stack, eliminating the need for physical USIM cards by supporting configurable USIM parameters and authentication algorithms such as 3GPP XOR and Milenage. It supports all 3GPP-defined frequency bands and advanced radio features like up to 4x4 MIMO and all LTE transmission modes (TM1–TM10), making it suitable for a wide range of interoperability, performance, and conformance tests. This tutorial is focused on guiding users through basic LTE connectivity testing between UEsim and the Amari Callbox, especially for those new to the platform, and will demonstrate core UEsim operations for out-of-the-box LTE attach scenarios. By abstracting the complexity of real-world devices and enabling rich configuration and automation, UEsim plays a significant role in modern wireless network development, verification, and research environments.

• Context and Background
  • UEsim serves as a comprehensive LTE User Equipment simulator, enabling the emulation of multiple UEs for network testing and validation.
  • Amari Callbox is an all-in-one test system that provides LTE network emulation, allowing users to assess the performance and interoperability of simulated UEs in realistic scenarios.
  • The integration of UEsim with the Amari Callbox allows for end-to-end, protocol stack-level testing from the physical layer up to the IP layer, supporting advanced wireless features and configurations.
• Relevance and Importance of the Tutorial
  • This tutorial enables users to perform out-of-the-box LTE connectivity tests using UEsim in conjunction with the Amari Callbox, a crucial step in validating eNB/gNB implementations and wireless network deployments.
  • By focusing on UE simulation rather than commercial devices, users gain granular control over UE configuration, authentication, and network interaction, which is essential for reproducible and scalable test scenarios.
  • Understanding UEsim operation is vital for researchers, developers, and testers involved in LTE network development, optimization, and troubleshooting.
• Learning Outcomes
  • Acquire practical skills in configuring and operating Amarisoft UEsim for basic LTE attach and connectivity procedures.
  • Understand how to use software-configurable USIM parameters and select authentication algorithms for simulated UEs.
  • Gain familiarity with network emulation concepts and how to leverage UEsim and Amari Callbox for protocol stack-level testing and validation.
  • Develop the ability to troubleshoot connectivity issues and interpret simulation results within a controlled test environment.
• Prerequisite Knowledge and Skills
  • Basic familiarity with LTE network architecture and terminology (e.g., UE, eNB/gNB, protocol stack layers).
  • Understanding of IP networking fundamentals and general wireless communication concepts.
  • Comfort with using configuration files and command-line interfaces is beneficial, though not mandatory for beginners.
  • No previous experience with Amarisoft Callbox or UEsim is required; the tutorial is designed for first-time users.

Summary of the Tutorial

This tutorial details the procedure for setting up and executing a basic LTE attach test using Amarisoft Callbox and UEsim. The test focuses on verifying proper configuration, establishing connectivity, and analyzing signaling logs to ensure successful UE registration. Below is a summary of the key test procedures and methodologies described:

• Test Setup
  • Amarisoft Callbox is used as the network for UEsim connection. Alternatively, live networks or other test eNB/gNB setups can be used.
  • The physical connection and component arrangement are depicted in the provided setup diagram.
• Key Configuration Parameters
  • Critical parameters include cell_groups, multi_ue, cells (with band, dl_arfcn, bandwidth, n_antenna_dl, n_antenna_ul), and ue_list (imsi, opc, amf, sqn, K, as_release, ue_category, tun_setup_script).
• Configuration Steps
  • Ensure matching configuration between UEsim and Callbox.
  • Use default configuration files (ue.default.cfg for UE and enb.default.cfg for eNB) unless otherwise required.
  • On the core network, use mme-ims.cfg and ims.default.cfg for MME and IMS, and ensure subscriber info (ue_db-ims.cfg) matches UE configuration (especially IMSI and K value).
  • Confirm LTE duplex mode (FDD), channel bandwidth (5 MHz), and SISO antenna configuration on both ends.
• Checking LTE Service Status
  • Verify that the LTE service is running on both UEsim and Callbox by executing service lte status.
  • If not active, restart the service with service lte restart.
  • This is a pre-requisite for further testing.
• Getting into Screen Mode
  • Launch screen -r on both UEsim and Callbox to access the command line interfaces for all components (MME, ENB, IMS, MBMSGW).
  • Use Ctrl+A plus the corresponding number to switch between component windows for command input and monitoring.
  • The initial screen provides RF configuration information for verification.
• UE Attach Procedure
  • Start trace logging on Callbox to capture attach sequence and PRACH attempts (helpful for troubleshooting).
  • Power on the UE via UEsim and observe detection of the cell and SIB decoding.
  • Monitor the attach process through traces: successful PRACH and RACH completion indicate likely attach success.
  • After attach, use cells command on UEsim to verify cell registration, and ue command on Callbox (enb and mme screens) to check active UE connections.
  • Any issues in registration or missing information require troubleshooting of configuration and SIM parameters.
• Log Analysis Methodology
  • Access UE logs (e.g., /tmp/ue0.log) to confirm successful attach or diagnose failures.
  • Critical steps to check in log:
    • Proper receipt and decoding of SIB1 and SIB2 (mandatory for attach to proceed).
    • NAS layer triggers attach request; RRC Connection Request follows.
    • Verify RRC Connection Setup and Setup Complete messages.
    • Authentication process: ensure Authentication Response is sent; failure often indicates SIM parameter mismatch (e.g., K value).
    • Security mode completion for both NAS and RRC layers.
    • UE Capability Enquiry and Information exchange.
    • RRC Connection Reconfiguration and completion thereof.
  • For advanced analysis, use WebGUI for lower layer signaling details.

Overall, the tutorial provides a step-by-step methodology to configure the UEsim and Callbox, verify operational status, perform the attach sequence, and analyze logs to ensure successful LTE registration and identify points of failure for troubleshooting. Each stage emphasizes the importance of matched configuration parameters and offers guidance for interpreting trace outputs and log files.

Test Setup

Test setup for this tutorial is as shown below.  In this setup, I used Amarisoft Callbox as the network for the UEsim to get connected. But for most UEsim users live network or their own test eNB/gNB would be used for the network.

Key Configuration Parameters

Followings are important configuration parameters for this tutorial. You may click on the items for the descriptions from Amarisoft documents.

• cell_groups
• multi_ue
• cells
• band
• dl_arfcn
• bandwidth
• n_antenna_dl
• n_antenna_ul
• ue_list : In this link, you will get the descriptions for all the items listed below
• sim_algo
• imsi
• opc
• amf
• sqn
• K
• as_release
• ue_category
• tun_setup_script

Configuration

An important thing in using UE sim is to do proper matching between UE sim configuration and Call box configuration In this tutorial, I used the ue.default.cfg and and enb.default.cfg without any change

If you use other Network (e.g, other network simulator or real network), you have to make it sure to configure UE sim according to the settings on network side. ue.default.cfg is used as ue configuration (ue.cfg).

On eNB side, enb.default.cfg is used as eNB configuration (enb.cfg).

On eNB core network side, mme-ims.cfg is used for core network configuration (mme.cfg) and ims.default.cfg is used for ims configuration (ims.cfg). ue_db-ims.cfg is the file that carries UE database (subscriber information) on network side. This file is usually included within mme.cfg

You would see following in /root/mme/config/ims-ims.cfg file on Callbox

In this tutorial, following SIM information will be used. Make it sure to configure the same parameters on UE side as well. (NOTE : this is the contents of ue_db-ims.cfg)

NOTE : If you use your own network (not Amrisoft callbox), you should configure the same information on your core network that handles subscriber information.

Make it sure that imsi and K value in this file matches the value on enb side shown in previous slide (NOTE : this is the contents of ue.default.cfg)

Following is the configuration on Callbox (enb.default.cfg). In this tutorial, Duplex type of LTE is set to FDD (i.e, TDD 0) and the channel bandwidth ise set to 5 Mhz(i.e, N_RB_DL 25). And antenna configuration is set to be SISO(N_ANTENNA_DL 1).

Following is the configuration on UEsim (ue.default.cfg). Same as eNB, Duplex type of LTE on UEsim is set to FDD (i.e, TDD 0) and the channel bandwidth ise set to 5 Mhz(i.e, CELL_BANDWIDTH 5). And antenna configuration is set to be SISO(N_ANTENNA_DL 1).

Check if LTE service is Running

Whatever you want to test, the first thing you need to do is that call box program (LTE Service) is running. You can check on the execution status of the call box program by running following command and you should get the result as shown below

# service lte status

Make it sure that Active is indicated as acitive (running) on UEsim when you run "service lte status". If you don't get this status, try 'service lte restart' and then check the status again.

Same as in UEsim, make it sure that Active is indicated as acitive (running) on UEsim when you run "service lte status". If you don't get this status, try 'service lte restart' and then check the status again.

NOTE : Getting this result is pre-requisite for Call Box Operation, but this result itself does not guarantee the normal operation. If you see some unexpected issues. You may restart the call box with following command

# service lte restart

Getting into Screen Mode

If it is confirmed that the lte service is running, go to screen mode by running 'screen -r' and follow through the steps as shown below. The steps shown here is the procedure that you would use for almost every test and it is highly recommended to get familiar with these steps. For further commands you can use in this screen mode, refer to the tutorial : Command Line Command

Run the command "screen -r" on UE sim

You will get the screen as shown below. there are some important information provided without running any specific command. It provides RF information showing the sample_rate, dl_freq, ul_freq, band, dl_ant, ul_ant that gives you very fundamental RF information. Check out the details of these info and see if the RF is configured as you intended.

Run the command "screen -r" on Callbox

You will get the screen as shown below.  This screen shows all the network components installed in the callbox. In this tutorial, it indicates MME, ENB, IMS, MBMSGW are installed in the callbox.

You would see a number before each component name. With Ctrl+A and the number before the component name, you can switch to command line window for the specific component. For example, if you press Ctrl+A+1, the command line window switches to ENB and if you press Ctrl+A+0, the command line window switches to MME and so on.

Attach UE

Now perform UE attach procedure. This would be a little bit busy process since you need to switch back and forth between Callbox screen and UEsim screen.

Start tracing on Callbox

power_on UE on UE sim.

You will see following message once UE detect the cell and decoded SIBs.

Once UE completed SIB decoding and perform initial attach, you will see following trace on Callbox screen. If you started 't' command before you powe on UE, you will get the traces for PRACH attempt. The presence of PRACH trace can be a good troubleshooting indicator for initial attach problem.  If PRACH is properly received and the entire RACH process is completed, it is highly likely that the initial attach gets completed and start getting traffic log. Regarding the details on the meaning of each column of this log and how to use the information for troubleshoot, refer to this tutorial.

When the initial attach completed, you can check on the cell information to which the UE sim is registered to with 'cells' command.  

Once UE gets registered to network, you can get the ue information that is in connection with gNB on Callbox with 'ue' command in (enb) screen.

You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (mme) screen.

NOTE : You should get least one item is assigned. If you don't see any of this kind of information, it may indicates there is some problems with the initial registration or IP allocation process and you need to troubleshoot until you get the result like this.

Log Analysis

In this section, you will see how to confirm if UE registration is complete from trace log. You can use the same method to find any issues (e.g, registration failure) for troubleshooting. When UE registration fails, you may use this tutorial to figure out the point of the failure and troubleshoot

NOTE : This section is just to check quickly some important points in the log, but it may be a little bit tricky to do the detailed log analysis (especially for lower layer log analysis). In that case, I strongly recommend you to use WebGUI for the log analysis. You may refer to WebGUI Tutorial

Open /tmp/ue0.log on UEsim using any text editor. I am using nano in this tutorial. (NOTE : In the same way, you can check eNB log by opening /tmp/enb0.log on Callbox, but I will not show the UE log in this tutorial. Refer to the tutorial LTE Attach if you are interested in eNB log).

Since this is UE side log, it would be good to check if SIBs are received and decoded properly. In LTE, SIB1 and SIB2 are mandatory to be received otherwise UE would not try attach.

Once SIB is properly received and decoded, UE side attach is started first from NAS layer by triggering EMM:Attach request. If you look into eNB log, this message will be received after RRC setup, but in UE side log you would see this message before RRC process start.

Once triggered by NAS layer, UE triggers RRC Connection Request and network is supposed to send RRC connection setup. Make it sure that UE successfully received RRC Connection Setup.

Next step you need to check is to see whether the UE send RRC Connection Setup Complete or not. If you see this message, it mean that RrcSetup is completed on UE side.  If UE fails with RrcSetup, it usually triggers RACH procedure again and send RrcConnectionRequest.

Once RRC Setup Procedure is complete, eNB initiate the Authentication process. If the authentication is confirmed on UE side, UE send Authentication Response message.  If you see the Authentication Failure instead of Authentication Response, it usually implies that there is SIM parameter mismatch between USIM and eNB SIM parameter setting. In most case, K value mismatch would be the culprit of the failure. Check ue_db.cfg or ue_db-ims.cfg and make it sure it has authentication parameter that matches DUT's USIM parameter.

Once Authentication process is complete, eNB/4G Core starts Security checkup. There are two different level of security checkup. The first one is NAS Security and the second one is RRC Security.

If you see EMM:Security mode complete message recieved, it indicates that NAS Security is complete.

If you see DCCH:Security mode complete message recieved, it indicates that RRC Security is complete.

Then Network (eNB) send UE capability enquiry message to check on various features supported by the UE. This is an optional step, but every live network would go through this procedure.

Once UE recieves UE capability information, it is supposed to notify about the featurs it supports via UE capability information message.

Once Authentication and Security checkup is done, eNB initiate RRC Connection Reconfiguration.

If the Rrc Connection Reconfiguration is properly processed on UE side, UE send RRC Connection Reconfiguration Complete.

RRC / NAS Signaling

: This section is to show you the overall structure of important Rrc messages and Information IE (IE) that are related to this tutorial.  It is not intended to describe the details on every RRC/NAS Information elements. With the overall structure and key IEs shown here, it hope it would be easier / clearer to go through the sample log provided in this tutorial or any logs that you captured from your own test setup or live network.

NOTE : The purpose of this section is to show you the overall structure of the related Rrc messages and some key information elements. It is not to show the every details of the IE which is too much to be covered.  I would suggest you to go through the sample log for further details of signaling flow and the contents of each message.

SIB1

: This is the SIB1 message sent by eNB  to configure LTE. (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

{

  message c1: systemInformationBlockType1: {

    cellAccessRelatedInfo {

      plmn-IdentityList {

        {

          plmn-Identity {

            ...

          },

          cellReservedForOperatorUse notReserved

        }

      },

      trackingAreaCode '0001'H,

      cellIdentity '1A2D001'H,

      cellBarred notBarred,

      intraFreqReselection allowed,

      csg-Indication FALSE

    },

    cellSelectionInfo {

      q-RxLevMin -70

    },

    p-Max 10,

    freqBandIndicator 7,

    schedulingInfoList {

      ...

    },

    si-WindowLength ms40,

    systemInfoValueTag 0

  }

}

SIB2

: This is the SIB2 message sent by eNB  to configure LTE. (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

{

  message c1: systemInformation: {

    criticalExtensions systemInformation-r8: {

      sib-TypeAndInfo {

        sib2: {

          radioResourceConfigCommon {

            rach-ConfigCommon {

              ...

            },

            bcch-Config {

              ...

            },

            pcch-Config {

              ...

            },

            prach-Config {

              ...

            },

            pdsch-ConfigCommon {

              ...

            },

            pusch-ConfigCommon {

              ...

            },

            pucch-ConfigCommon {

              ...

            },

            soundingRS-UL-ConfigCommon setup: {

              ...

            },

            uplinkPowerControlCommon {

              ...

            },

            ul-CyclicPrefixLength len1,

            pusch-ConfigCommon-v1270 {

              ...

            }

          },

          ue-TimersAndConstants {

            ...

          },

          freqInfo {

            ...

          },

          ...

        },

RrcConnectionSetup

: This is the RrcConnectionSetup message sent by eNB  (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

{

  message c1: rrcConnectionSetup: {

    rrc-TransactionIdentifier 0,

    criticalExtensions c1: rrcConnectionSetup-r8: {

      radioResourceConfigDedicated {

        srb-ToAddModList {

          ...

        },

        mac-MainConfig explicitValue: {

          ...

        },

        physicalConfigDedicated {

          pdsch-ConfigDedicated {

            ...

          },

          pucch-ConfigDedicated {

            ...

          },

          pusch-ConfigDedicated {

            ...

          },

          uplinkPowerControlDedicated {

            ...

          },

          cqi-ReportConfig {

            ...

          },

          soundingRS-UL-ConfigDedicated setup: {

            ...

          },

          schedulingRequestConfig setup: {

            ...

          }

AttachRequest

: This is the AttachRequest message sent by UE  (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x1 (Integrity protected)

Auth code = 0x410496cc

Sequence number = 0x09

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x0 (Plain NAS message, not security protected)

Message type = 0x41 (Attach request)

EPS attach type = 2 (combined EPS/IMSI attach)

NAS key set identifier:

  ...

Old GUTI or IMSI:

  ...

UE network capability:

  ...

ESM message container:

  ...

Last visited registered TAI:

  ...

DRX parameter:

  ...

MS network capability:

  ...

Old location area identification:

  ...

Mobile station classmark 2:

  ...

Mobile station classmark 3:

  ...

Supported codecs:

  ...

Voice domain preference and UE's usage setting = 0x07 (IMS PS voice preferred, CS Voice as secondary, Data centric)

Old GUTI type = 0

MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)

UE additional security capability:

  ...

AttachAccept

: This is the AttachAccept message sent by Core Network  (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

 

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0x6bb083ed

Sequence number = 0x02

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x0 (Plain NAS message, not security protected)

Message type = 0x42 (Attach accept)

EPS attach result = 2 (combined EPS/IMSI attach)

T3412 value:

  ...

TAI list:

  ...

ESM message container:

  ...

GUTI:

  ...

Location area identification:

  ...

MS identity:

  ...

Emergency number list:

  ...

EPS network feature support:

  ...

RrcConnectionReconfiguration

: This is the RrcConnectionReconfiguration message sent by eNB  (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

{

  message c1: rrcConnectionReconfiguration: {

    rrc-TransactionIdentifier 0,

    criticalExtensions c1: rrcConnectionReconfiguration-r8: {

      dedicatedInfoNASList {

        ',,,

      },

      radioResourceConfigDedicated {

        srb-ToAddModList {

          ,,,

        },

        physicalConfigDedicated {

          antennaInfo-r10 explicitValue-r10: {

            ,,,

          },

          cqi-ReportConfig-r10 {

            ,,,

          },

          pucch-ConfigDedicated-v1020 {

            ,,,

          },

          cqi-ReportConfigPCell-v1250 {

            ,,,

          }

        },

        drb-ToAddModList-r15 {

          ,,,

        }

      },