Security research

Harald Welte laforge at
Thu Jul 11 00:49:56 UTC 2019

Hi Silke,

I'm not entirely sure if I'm getting this right, so please clarify:

You are looking for all of the below:

1) a simulated UE (possibly integrated with eNB) which can perform
   things like attach + PDN connection establishment over S1 to a MME, just
   like a real UE

2) an EPC (MME, S-GW, P-GW, HSS) exposing at least the S8 interface
   between S-GW and P-GW

so that you can then also
a) connect a real eNB to that same MME above
b) operate a second, 3rd party P-GW next to the P-GW above, interfacing
   over S8 (GTP) to the S-GW above

Does that correctly represent your requirement?

I would assume that in general, nextepc would be able to work as your
MME/S-GW/P-GW/HSS. I'm not sure which exact procedures you will need it
to support (quite a number of them are not yet implemented, e.g. the S6
between MME and HSS is quite "rudimentary" AFAICT.

The more interesting question is the "simulated eNB" part.  I know that
srsUE contains all the related NAS logic for the UE, but I'm not aware
of a (public / open source) way to run it e.g. without real hardware
against srsENB so that you have both UE and eNB covered, exposing an S1
interface.  It would probably be best to inquire with SRS about this,
maybe they can make that functoinality available either in their open
source version or you could obtain it under their dual-licensing scheme.

Unrelated to the above: I'm currently working on a TTCN-3 test suite for
the MME, which basically includes the eNB-Side S1 interface, as well as
the basic NAS procedures of a UE, so we can test the [nextepc] MME.  But
it's unfortunately at a development stage where it's not yet doing
anything useful yet - and it's also just a hobby/pet project I'm doing
in my spare time, without any clear timeline or any commercial backing :/

There are of course various proprietary options available on the market
(like the NG4T testers), but I guess you're inquiring here as you're
specifically looking for open source.

- Harald Welte <laforge at> 
"Privacy in residential applications is a desirable marketing option."
                                                  (ETSI EN 300 175-7 Ch. A6)

More information about the nextepc mailing list