LTE and NR Core Network

Table of Contents

1 Introduction

LTEMME is a LTE EPC (Evolved Packet Core) implementation. It has a built-in MME (Mobility Management Entity), SGW (Serving Gateway), PGW (Packet Data Network Gateway), PCRF (Policy and Charging Rule Function), HSS (Home Subscriber Server), EIR (Equipment Identity Register) and ePDG (evolved Packet Data Gateway). It can easily be used with the Amarisoft LTE eNodeB to build a highly configurable LTE test network.
Depending on your software license, it also includes a NR 5GC (5G Core Network). It has build-in AMF (Access and Mobility Management Function), AUSF (Authentication Server Function), SMF (Session Management Function), UPF (User Plane Function), UDM (Unified Data Management) and 5G-EIR (5G Equipment Identity Register).

2 Features

2.1 EPC

• LTE release 17 compliant.
• Implements one EPC with built-in MME, SGW, PGW, PCRF, HSS and EIR.
• Supports several eNodeBs with standard S1 interface (S1AP and GTP-U protocols).
• NAS integrity check and encryption using the AES, Snow3G and ZUC algorithms. Ciphering support is now subject to export rules for your country.
• Support of USIM cards using the XOR, Milenage or TUAK authentication algorithm.
• Handling of UE procedures: attach, authentication, security configuration, detach, tracking area update, service access, radio bearer establishment, paging.
• Multi-PDN support and built-in dynamic ERAB setup for easy VoLTE/IMS testing.
• Transparent access to the IP network (no external Serving Gateway or PDN Gateway is necessary).
• Configurable access point name, IP range, DNS and E-RAB QoS.
• Support sending of Public Warning System messages (ETWS/CMAS).
• IPv6 support.
• Configurable logging system for all channels with built-in text decoders.
• Remote API using WebSocket.
• Command line monitor.
• PSM and eDRX support.
• Group WUS support.
• Supports several IMS servers with Rx interface.
• Support of NB-IoT RAT.
• Support of control plane CIoT EPS optimization.
• Non-IP data delivery CIoT feature.
• Attach without PDN connectivity CIoT feature.
• User management via internal database without any external HSS.
• Support of optional S6a interface with external HSS.
• Support of optional S13 interface with external EIR.
• Support of optional SGsAP interface with external VLR/MSC.
• Support of optional SBcAP interface with external CBC.
• Support of broadcast and multicast PDN options.
• Support of DCNR UEs.
• Support of LCS-AP.
• Support of Ethernet PDN connectivity.

2.2 5GC

• NR release 17 compliant.
• Implements one 5GC with built-in AMF, AUSF, SMF, UPF, UDM and 5G-EIR.
• Supports several gNodeBs, ng-eNBs or N3IWFs with standard NG interface (NGAP and GTP-U protocols).
• NAS integrity check and encryption using the AES, Snow3G and ZUC algorithms. Ciphering support is now subject to export rules for your country.
• Support of USIM cards using the XOR, Milenage or TUAK 5G-AKA authentication algorithm.
• Handling of UE procedures: registration, authentication, security configuration, deregistration, service access, radio bearer establishment, paging.
• Multi PDU sessions support and built-in dynamic QoS flow setup for easy VoNR/IMS testing.
• Transparent access to the IP network (no external UPF is necessary).
• Configurable access point name, IP range, DNS and QoS flows.
• IPv4, IPv4v6, IPv6 and unstructured PDUs support.
• Configurable logging system for all channels with built-in text decoders.
• Remote API using WebSocket.
• Command line monitor.
• MICO, active time and eDRX support.
• Supports several IMS servers with Rx interface.
• Support of NB-IoT, LTE and non-3GPP RAT.
• User management via internal database without any external HSS.
• Support of broadcast and multicast PDU session options.
• Support sending of Public Warning System messages (ETWS/CMAS).
• Support of N12 interface with external AUSF.
• Support of N8 and N13 interface with external UDM.
• Support of N17 interface with external 5G-EIR.
• Support of N20 interface with external SMSF.
• Support of N50 interface with external CBC.
• Support of N62 interface with external AF.
• Support of network slicing.
• Support of control plane CIoT 5GS optimization.
• Non-IP data delivery CIoT feature.
• Support of NL1 interface.
• Support of N5 interface with the following restriction: IMS_SBI feature is declared by the PCF but credit management is not supported.
• Support of Ethernet PDU sessions.

3 Requirements

3.1 Hardware requirements

• LTEMME can run on the same PC as the Amarisoft eNodeB/gNodeB if a simple and compact solution is needed. Otherwise, any reasonnably recent PC with at least one Gigabit Ethernet port is acceptable.
• A test USIM card should be plugged into the UE. Test USIM cards from Anritsu are supported by the default configuration. Other test USIM cards should work as well provided they implement the dummy XOR authentication algorithm and that their IMSI and secret key are known. USIM cards using the Milenage or TUAK algorithm are also supported.

3.2 Software requirements

• A 64 bit Linux distribution. Fedora 39 is the officially supported distribution.
  The following distributions are known as compatible:
  • Fedora 22 to 39
  • Cent OS 7
  • Ubuntu 14 to 22

  Your system requires at least GLIBC 2.17.

4 Installation

[Quick installation instructions are also given in the Amarisoft eNodeB/gNodeB documentation in case LTEMME is installed on the same PC as the eNodeB/gNodeB].

The network access thru the Gigabit Ethernet port must be correctly configured.

LTEMME can be run directly from the directory when it was unpacked. No need for explicit installation.

4.1 Local network configuration

LTEMME will set up a new virtual network interface tun0 where each UE has a specific IP address. If you want them to connect to your local network (and Internet), you need to set up IP forwarding and masquerading.

An example is found in the lte_init.sh:
Syntax:

sudo ./lte_init.sh [-6] <ifname>

sudo ./lte_init.sh default
sudo ./lte_init.sh -6 eth1

4.2 Linux setup

4.2.1 Packages

LTEMME uses the SCTP protocol for which the necessary packages are not usually installed. In order to install them, do as root user:

• Fedora

  dnf install lksctp-tools kernel-modules-extra
  

• Ubuntu

  sudo apt-get install lksctp-tools linux-image-extra-3.13.0-24-generic
  

  Note that linux-image-extra package name may differ depending on your kernel version.

To verify that SCTP kernel module is running, do as root user:

checksctp

If it reports that the protocol is not supported,

• check if you have a /etc/modprobe.d/sctp-blacklist.conf file
• edit it to comment the ’blacklist sctp’ line

Then reboot the PC in case the Linux kernel was upgraded too.

4.2.2 OpenSSL

LTEMME has been compiled against openssl version 1.1.1w.
If your system does not have compatible version installed you may have this error message at startup:

error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

To overcome this problem, you may:

• Copy libssl.so.1.1 and libcrypto.so.1.1 from libs subdirectory of your release tarball.
  If you have installed software with automatic install script, this should have been done automatically.
• Compile and install proper openssl version yourself

In case of persisting issue, raise a ticket from our support site at https://support.amarisoft.com/ with the information provided by below commands executed in LTEMME directory:

uname -a
ls -l
ldd ./ltemme
openssl version

4.2.3 NGHTTP2

LTEMME has been compiled against nghttp2 version 1.41.0.
If your system does not have compatible version installed you may have this error message at startup:

error while loading shared libraries: libnghttp2.so.14: cannot open shared object file: No such file or directory

To overcome this problem, you may:

• Copy nghttp2.so.14 from libs subdirectory of your release tarball.
  If you have installed software with automatic install script, this should have been done automatically.
• Install libnghttp2 with your package manager
• Compile and install proper nghttp2 version yourself

In case of persisting issue, raise a ticket from our support site at https://support.amarisoft.com/ with the information provided by below commands executed in LTEMME directory:

uname -a
ls -l
ldd ./ltemme

4.3 License key installation

LTEMME needs a license key file to run. It is associated to your PC, so if you replace it or change its hardware configuration you must contact Amarisoft to get a new license key.

The following steps are needed to get this license file:

• Run LTEMME:

  ./ltemme config/mme.cfg
  

  It says that the license key is not present and prints a 16 digit hexadecimal code.

• Send by mail to delivery@amarisoft.com this hexadecimal code to your contact at Amarisoft. You will get back the ltemme.key license key file.
• Copy the ltemme.key file to the ${HOME}/.amarisoft/ directory (${HOME} is the home directory of the root user). You can use the shell variable AMARISOFT_PATH to change this path.

Once the license key is installed, ltemme should start normally.

4.4 Initial testing

• Edit the file config/mme.cfg to set the bind address of the GTP-U interface. Normally it is the address of the default Ethernet of the PC (you can see it with ifconfig). You can also set the address of the DNS (dns_addr property). You don’t need to change the other parameters for an initial test.
• LTEMME creates one virtual network interface where the UE traffic is redirected. A modification of the default routing rules and iptables is usually needed if you want to redirect the UE traffic to the local network and Internet. The script lte_init.sh in the Amarisoft LTEMME package gives an example of setup to configure a NAT to access the Internet.
• Start the program as root with:

  ./ltemme config/mme.cfg
  

  [The root access is only needed to set up the Linux virtual interface.]

• The command line interface is used to monitor the operation of LTEMME and to change the logging options. Use help to get the list of commands and quit to stop the program.
• Use enb to list the connected eNodeBs and gnb to list the connected gNodeBs.
• In addition to using the log file, you can monitor the traffic between LTEMME and the eNodeBs or gNodeBs with Wireshark. The LTE specific traffic is filtered by putting s1ap || gtp in the filter input area. The NR specific traffic is filtered by putting ngap || gtp in the filter input area.
• For optimal performance, it is better to avoid fragmenting the GTP-U packets. So the Ethernet interfaces used between the eNodeBs or gNodeBs and LTEMME should be configured to have a MTU of at least 1564 (assuming the UEs use the standard MTU of 1500). You can verify with Wireshark whether the GTP-U packets are fragmented.

5 Configuration reference

5.1 Configuration file syntax

The main configuration file uses a syntax very similar to the Javascript Object Notation (JSON) with few extensions.

1. Supported types:
   • - Numbers (64 bit floating point). Notation: 13.4
   • - Complex numbers. Notation: 1.2+3*I
   • - Strings. Notation: "string"
   • - Booleans. Notation: true or false.
   • - Objects. Notation: { field1: value1, field2: value2, .... }
   • - Arrays. Notation: [ value1, value2, .... ]
2. The basic operations +, -, * and / are supported with numbers and complex numbers. + also concatenates strings. The operators !, ||, &&, ==, !=, <, <=, >=, > are supported too.
3. The numbers 0 and 1 are accepted as synonyms for the boolean values false and true.
4. {} at top level are optional.
5. " for property names are optional, unless the name starts with a number.
6. Properties can be duplicated.
   If properties are duplicated, they will be merged following JSON merge rules with overriding occuring in reading direction (last overrides previous).
   Ex:

   {
       value: "foo",
       value: "bar",
       sub: {
           value: "foo"
       },
       sub: {
           value: "bar"
       }
   }
   

   Will be equivalent to:

   {
       value: "bar",
       sub: {
           value: "bar"
       }
   }
   

7. Files can be included using include keyword (must not be quoted) followed by a string (without :) representing the file to include (path is relative to current file) and terminating by a comma.
   Arrays can’t be included.
   Merge will be done as for duplicate properties.
   If file1.cfg is:

       value: "foo",
       include "file2.cfg",
       foo: "foo"
   

   And file2.cfg is:

       value: "bar",
       foo: "bar"
   

   Final config will be:

   {
       value: "bar",
       foo: "foo"
   }
   

8. A C like preprocessor is supported. The following preprocessor commands are available:

   #define var expr

   Define a new variable with value expr. expr must be a valid JSON expression. Note that unlike the standard C preprocessor, expr is evaluated by the preprocessor.

   #undef var

   Undefine the variable var.

   #include expr

   Include the file whose filename is the evaluation of the string expression expr.

   #if expr

   Consider the following text if expr is true.

   #else

   Alternative of #if block.

   #elif

   Composition of #else and #if.

   #endif

   End of #if block.

   #ifdef var

   Shortcut for #if defined(var)

   #ifndef var

   Shortcut for #if !defined(var)

   In the JSON source, every occurrence of a defined preprocessor variable is replaced by its value.

9. Backquote strings: JSON expression can be inserted in backquote delimited strings with the ${expr} syntax. Example: `abc${1+2}d` is evaluated as the string "abc3d". Preprocessor variables can be used inside the expression. Backquote strings may span several lines.

5.1.1 JSON merge rules

Merge overriding direction depends on context, i.e source may override destination or the opposite.
JSON merge is recursive for Objects and Arrays.

Example, merging

{
    foo: { value: "bar" },
    same: "one",
    one: 1
}

with

{
    foo: { value: "none", second: true },
    same: "two",
    two: 1
}

Will become:

{
    foo: { value: "bar", second: true },
    same: "one",
    one: 1
    two: 1
}

assuming first object overrides second one.

In case of Array merging, the final array length will be the maximum length of all merged arrays.
For each element of the final array, merge will be done considering defined elements only.
Ex:

{
    array: [0, 1, 2, { foo: "bar" } ],
    array: [3, 4],
    array: [5, 6, 7, { bar: "foo" }, 8 ]
}

Will be merged to:

{
    array: [5, 6, 7, { foo: "bar", bar: "foo" }, 8 ],
}

5.2 Properties

log_filename

String. Set the log filename. If no leading /, it is relative to the configuration file path. See Log file format.

log_options

String. Set the logging options as a comma separated list of assignments.

• layer.level=verbosity. For each layer, the log verbosity can be set to none, error, info or debug. In debug level, the content of the transmitted data is logged.
• layer.max_size=n. When dumping data content, at most n bytes are shown in hexa. For ASN.1, NAS or Diameter content, show the full content of the message if n > 0.
• layer.payload=[0|1]. Dump ASN.1, NAS, SGsAP or Diameter payload in hexadecimal.
• layer.key=[0|1]. Dump security keys (NAS and RRC layers).
• layer.crypto=[0|1]. Dump plain and ciphered data (NAS and PCDP layers).
• layer.verbose=[0|1]. If layer is ipsec, dump all packets filtering informations.
• time=[sec|short|full]. Display the time as seconds, time only or full date and time (default = time only).
• time.us=[0|1]. Dump time with microseconds precision.
• file=cut. Close current file log and open a new one.
• file.rotate=now. Rename current log with timestamp and open new one.
• file.rotate=size. Rename current log every time it reaches size bytes open new one. Size is an integer and can be followed by K, M or G.
• file.path=path. When log rotation is enabled, move current log to this path instead of initial log path.
• append=[0|1]. (default=0). If 0, truncate the log file when opening it. Otherwise, append to it.

Available layers are: nas, ip, s1ap, ngap, gtpu, rx, s6, cx, s13, sgsap, sbcap, lcsap, lppa, n12, n13, n8, n17, n50, n5, nl1, nrppa, epdg, ikev2, ipsec, n20, n62

log_sync

Optional boolean (default = false). If true, logs will be synchronously dumped to file.
Warning, this may lead to performances decrease.

gtp_addr

String. Set the IP address (and an optional port) on which the GTP-U packets are received. The default port is 2152. It is normally the IP address of the network interface connected to the core network.

Syntax:

• - "1.2.3.4" (use default port)
• - "1.2.3.4:5678" (use explicit port)
• - "2001:db8:0:85a3::ac1f:8001" (IPv6 address and default port)
• - "[2001:db8:0:85a3::ac1f:8001]:5678" (IPv6 address and explicit port)

gtp_ext_addr

Optional string. Set the IP address on which the eNodeB should transmit the GTP-U packets. It is the same as gtp_addr by default. It can be different if LTEMME is behind a NAT.

gtp_payload_mtu

Optional integer (range 68 to 16384, default = 1500). MTU in bytes for the GTP-U payload. Do not forget to update the network interface MTU accordingly for optimal performance. See Initial testing. If you want to use another value than the default one, you likely want to change the mtu_ipv4 and/or ipv6_mtu parameters also.

gtp_use_packet_bundling

Optional boolean (default = false). Concatenate multiple GTP-U PDUs within a single UDP datagram. Be careful, this is a non-standard option that must not be activated if the peer is not an Amarisoft eNodeB/gNodeB/N3IWF with this option activated.

s1ap_bind_addr

Optional string. IP address and optional port on which the S1AP SCTP connection is bound.

ngap_bind_addr

Optional string. IP address and optional port on which the NGAP SCTP connection is bound.

plmn

String. PLMN identity of the MME (5 or 6 digits). It should match one of the PLMN identities broadcasted by the eNodeB or gNodeB.

cag_support

Optional boolean (default = false). Applicable to 5GC only. Indicates if the AMF supports the CAG feature. CAG feature cannot be declared as supported in a SNPN (ie when nid item is present).

nid

Applicable to 5GC only in case of Stand-Alone Non-Public Network (SNPN). The NID (as defined in 3GPP TS 23.003 12.7 Stand-Alone Non-Public Network Identifier) associated with the AMF PLMN identifies the SNPN. It contains the following objects defining the NID:

nid_value

10 digits NID value.

assignment_mode

Optional enumeration: self, coordinated_1, coordinated_2, according to 3GPP TS 23.003 clause 12.7

mme_group_id

Optional integer, range: 0 to 65535. Set the MME group ID.

mme_code

Optional integer, range: 0 to 255. Set the MME code.

mme_name

Optional string. MME name used for S1AP signalling. If absent no MME name is used.

amf_region_id

Optional integer, range: 0 to 255. Set the AMF region ID. If not present, the value is derived from the mme_group_id value. If present, it must match the value derived from the mme_group_id value if it is present, using the rules defined in 3GPP TS 23.003 chapter 2.10.2.2.2.

amf_set_id

Optional integer, range: 0 to 1023. Set the AMF Set ID. If not present, the value is derived from the mme_group_id and mme_code values. If present, it must match the value derived from the and mme_code values if they are present, using the rules defined in 3GPP TS 23.003 chapter 2.10.2.2.2.

amf_pointer

Optional integer, range: 0 to 63. Set the AMF Pointer. If not present, the value is derived from the mme_code value. If present, it must match the value derived from the mme_code value if it is present, using the rules defined in 3GPP TS 23.003 chapter 2.10.2.2.2.

truncated_amf_set_id

Optional integer, range: 0 to 7. Set the truncated AMF Set ID length for Control Plane CIoT 5GS optimization reestablishment procedure.

truncated_amf_pointer

Optional integer, range: 0 to 5. Set the truncated AMF Pointer length for Control Plane CIoT 5GS optimization reestablishment procedure.

amf_name

Optional string. AMF name used for NGAP signalling. Default is set to amarisoft.amf.5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org.

amf_nf_instance_id

Optional 16 bytes hexadecimal string.
Defines the random number to use to create the AMF NF instance id.
Allows to keep the same value of AMF NF instance id even after a restart of the AMF.
If not present, the AMF instance id will be generated as described in IETF RFC 4122 paragraph 4.4.

eps_5gs_interworking

Optional enumeration: none, without_n26, with_n26 (default = none). Defines whether inter RAT mobility between EPS and 5GS is supported or not, and whether N26 interface is supported or not. Note that interworking with N26 is required to perform handover between EPS and 5GS.

eplmn_list

Optional array of strings (1 to 15). List of equivalent PLMNs used for NAS, S1AP and NGAP messages.

relative_capacity

Optional integer. Range: 0 to 255. Default : 50. Set the MME or AMF relative capacity value used for MME or AMF load balancing in S1AP S1 Setup Response, S1AP MME Configuration Update, NGAP NG Setup Response and NGAP AMF Configuration Update messages.

nas_cipher_algo_pref

Array of integers. Set the preferred algorithms for NAS encryption in decreasing order of preference. If none match the UE capabilities, then EEA0/5G-EA0 (no encryption) is selected.

List of supported algorithms:

Value	Algorithm
1	EEA1/5G-EA1 (Snow 3G)
2	EEA2/5G-EA2 (128 bit AES)
3	EEA3/5G-EA3 (ZUC)

If encryption is necessary, for best performance use AES (EEA2/5G-EA2) as first choice if your CPU supports the AES NI Intel instruction set (available starting from Sandy bridge CPUs). Otherwise use Snow3G (EEA1/5G-EA1) or ZUC (EEA3/5G-EA3).
Note that ciphering is subject to export rules depending on your country.

nas_cipher_algo_null_allowed

Optional boolean (default = true). If set to false, the use of NULL ciphering algorithm (EEA0/5G-EA0) is forbidden unless the UE performs an emergency registration.

nas_integ_algo_pref

Array of integers. Set the preferred algorithms for NAS integrity check in decreasing order of preference. If none match the UE capabilities, then EIA0/5G-IA0 (no integrity check) is selected.

List of supported algorithms:

Value	Algorithm
1	EIA1/5G-EA1 (Snow 3G)
2	EIA2/5G-EA2 (128 bit AES)
3	EIA3/5G-EA3 (ZUC)

For best performance, use AES (EIA2/5G-IA2) as first choice if your CPU supports the AES NI Intel instruction set (available starting from Sandy bridge CPUs). Otherwise use Snow3G (EIA1/5G-IA1) or ZUC (EIA3/5G-IA3).

nas_integ_algo_null_allowed

Optional boolean (default = true). If set to false, the use of NULL integrity algorithm (EIA0/5G-IA0) is forbidden unless the UE performs an emergency registration.

tun_setup_script

String. Set the path of the shell script to set up the virtual network interface. Script is called for each PDN connectivity or PDU session with following parameters:

1. Interface name
2. PDN or PDU session index
3. Access Point Name
4. Type: ’ipv4’, ’ipv6’ or ’ethernet’

If type is ’ipv4’, the next parameters are:

1. IP address: interface address
2. First IP address
3. Last IP address
4. Subnet mask

If type is ’ipv6’, the next parameters are:

1. Link local address
2. Interface IP address
3. First IPv6 prefix
4. Last IPv6 prefix
5. Subnet mask

If type if ’ethernet’, there are no extra parameters

t3402

Optional integer (default = -1). Value in seconds of the T3402 or T3502 timer. -1 means that the timer value is not transmitted in attach accept or TAU or registration accept so that the UE uses the default value (12 minutes).

t3412

Optional integer (default = 1800). Value in seconds of the T3412 (TAU update) timer. -1 means that the timer is deactivated. This is the value sent to the UE in NAS signalling, unless the UE is requesting the use of a longer timeout with T3412 extended value information element.

t3412_low_priority

Optional integer (default = t3412 value). Value in seconds of the T3412 (TAU update) timer if the UE indicates NAS signalling low priority. -1 means that the timer is deactivated. This is the value sent to the UE in NAS signalling, unless the UE is requesting the use of a longer timeout with T3412 extended value information element.

t3512

Optional integer (default = 1800). Value in seconds of the T3512 (periodic registration) timer. -1 means that the timer is deactivated. This is the value sent to the UE in NAS signalling, unless the UE is requesting the use of a longer timeout with requested T3512 value information element.

t3501

Optional integer in range 1-30 (default = 5). Value in seconds of the MANAGE UE POLICY COMMAND timer in the PCF.

n3gpp_dereg_timer

Optional integer (default = 3240). Value in seconds of the non-3GPP de-registration timer. This is the value sent to the UE in NAS signalling.

purge_timer

Optional integer (default = -1). Value in seconds of the purge timer started when the UE gets deregistered. When it expires, the UE context is deleted. -1 means that the timer is deactivated.

psm

Optional boolean (default = true). If set to false, MME will ignore the PSM request sent by the UE.

mico_support

Optional boolean (default = true). If set to false, AMF will ignore the MICO request sent by the UE.

registration_area_alloc_ind

Optional ingeger (default = 0). Sets the Registration Area Allocation Indication bit in the 5GMM MICO indication IE. 0 means ’all PLMN registration area not allocated’ and 1 means ’all PLMN registration area allocated’.

sprt_support

Optional boolean (default = false). If set to true and if mico_support is set to true, the AMF will accept the use of the strictly periodic registration timer.

t3412_extended_forced

Optional integer (default = -1). Value in seconds of the T3412 extended timer if UE uses PSM. If different from -1, the MME will ignore the value requested by the UE and will send this one instead.

force_t3412_extended_ie

Optional boolean (default = false). If set to false, the MME selects the greatest T3412 value between the one configured in the MME and the one requested by the UE for PSM (unless t3412_extended_forced is set), and it does not send the T3412 extended IE if the value can be encoded as a GPRS timer IE. If set to true, the MME accepts a T3412 value requested by the UE smaller than the configured one, and the T3412 extended IE is always sent.

requested_t3512_forced

Optional integer (default = -1). Value in seconds of the T3512 timer if UE uses MICO. If greater than -1, the AMF will ignore the value requested by the UE and will send this one instead. If set to -2, the AMF will accept a T3512 value requested by the UE smaller than the configured one.

t3324_forced

Optional integer (default = -1). Value in seconds of the T3324 timer if UE uses PSM or MICO. If different from -1, the MME or AMF will ignore the value requested by the UE and will send this one instead. -2 means that the timer is deactivated.

t3346

Optional integer (default = -1). Value in seconds of the T3346 timer. The timer is transmitted in the reject messages if the EMM or 5GMM cause is #22 (congestion) and the value is not -1.

t3442

Optional integer (default = 0). Value in seconds of the T3442 timer.

t3448

Optional integer (default = -1). Value in seconds of the T3448 timer. The timer is transmitted if the value is different from -1 and the UE indicates its support in the UE network capability information element.

t3460

Optional integer (default = 6). Value in seconds of the T3460 or T3560 timer.

t3460_wb_ce

Optional integer (default = 24). Value in seconds of the T3460 or T3560 timer for UE operating in WB-S1/CE or WB-N1/CE mode.

t3560_ng_ran_sat

Optional integer (default = 11). Value in seconds of the T3560 timer for UE operating in NR(MEO) or NR(GEO) satellite RAT.

5gmm_backoff_timer

Optional integer (default = -1). Value in seconds of the 5GMM DL NAS transport back-off timer. The timer is transmitted if the value is not -1. -2 means that the timer is deactivated.

edrx

Optional boolean (default = true). If set to false, the core network will ignore the eDRX request sent by the UE.

edrx_ptw_wb_s1

Optional integer (0 to 15, default = 3). 4 bits Paging Time Window length for WB-S1 and WB-N1 UEs as defined in 3GPP TS 24.008 chapter 10.5.5.32.

edrx_ptw_nb_s1

Optional integer (0 to 15, default = 3). 4 bits Paging Time Window length for NB-S1 and NB-N1 UEs as defined in 3GPP TS 24.008 chapter 10.5.5.32.

edrx_ptw_nr

Optional integer (0 to 31, default = 3). 8 bits Paging Time Window length for NR connected to 5GCN UEs as defined in 3GPP TS 24.008 chapter 10.5.5.32.

edrx_cycle_forced

Optional integer (-1 to 15, default = -1). 4 bits E-UTRAN or NR eDRX cycle length duration as defined in 3GPP TS 24.008 chapter 10.5.5.32. If different from -1, the core network will ignore the value requested by the UE and will send this one instead.

gwus_support

Optional boolean (default = true). Group WUS support.

gwus_prob_forced

Optional enumeration: -1, 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, 100 (default = -1: paging probability not forced). Force group WUS paging probability for all the UEs. The MME will ignore the value requested by the UE and will send this one instead.

ims_list

Optional array. Each entry is an object defining connection to Amarisoft IMS server. This is useful for SMS over SG or 3GPP mode of IMS server when Rx interface is not used.
Each entry has following members:

ims_addr

IP address of Amarisoft IMS server.

bind_addr

IP address of network interface to use for IMS connection.

ims_vops_eps

Optional boolean (default = false). Set the IMS voice over PS session in S1 mode supported bit of the EPS network feature support field in the NAS attach accept message (VoLTE).

ims_vops_5gs_3gpp

Optional boolean (default = false). Set the IMS voice over PS session over 3GPP access indicator of the 5GS network feature support IE of the NAS registration access message. See 3GPP TS 24.501 table 9.11.3.5.1.

ims_vops_5gs_n3gpp

Optional boolean (default = false). Set the IMS voice over PS session over non-3GPP access indicator of the 5GS network feature support IE of the NAS registration access message. See 3GPP TS 24.501 table 9.11.3.5.1.

emc_bs

Optional boolean (default = false). Set the emergency bearer services in S1 mode supported bit of the EPS network feature support field in the NAS attach accept message (VoLTE, Release 9).

emc

Optional integer (default = 0). Set the emergency service support indicator for 3GPP access bits of the 5GS network feature support IE in the NAS registration accept message. See 3GPP TS 24.501 table 9.11.3.5.1.

emc_n3gpp

Optional boolean (default = false). Set the emergency service support indicator for non-3GPP access bits of the 5GS network feature support IE in the NAS registration accept message. See 3GPP TS 24.501 table 9.11.3.5.1.

emf

Optional integer (default = 0). Set the emergency service fallback indicator for 3GPP access bits of the 5GS network feature support IE in the NAS registration accept message. See 3GPP TS 24.501 table 9.11.3.5.1.

epc_lcs

Optional boolean (default = false). Set the Location services indicator via EPC supported bit of the EPS network feature support field in the NAS attach accept message.

5gs_sms_over_nas

Optional boolean (default = true). Defines if 5GC should indicate the support of SMS over NAS in the 5GMM registration accept message, if the UE indicated its support in the 5GMM registration request message.

emergency_number_list

Optional array of objects. Defines a list of emergency numbers to be sent to the UE in the NAS Attach Accept, Tracking Area Update Accept or Registration Accept messages.
Each object must contain the following parameters:

category

Integer. Bitmask of the category bits as defined in 3GPP TS 24.008 table 10.5.135d (bit 1: police, bit 2: ambulance, bit 3: fire brigade, bit 4: marine guard, bit 5: mountain rescue).

digits

String. Emergency number.

extended_emergency_number_list

Optional object. Defines a list of extended emergency numbers to be sent to the UE in the NAS Attach Accept, Tracking Area Update Accept or Registration Accept messages.
The object must contain the following parameters:

validity

Enumeration (country or plmn).
Validity of the extended emergency number list.

emergency_numbers

Array of objects. Each object must contain the following parameters:

digits

String. Emergency number.

sub_services

Optional string. Emergency number sub-services.

cp_ciot_opt

Optional boolean (default = false). If true, enable control plane CIoT optimization (if supported by the UE).

attach_without_pdn

Optional boolean (default = false). If true, enable attach without PDN functionality (if supported by the UE).

fifteen_bearers

Optional boolean (default = false). If true, enable the use of 15 EPS radio bearers (if supported by the UE).

apn_oi

Optional string (default = mncABC.mccXYZ.gprs where ABC is the PLMN MNC and XYZ the PLMN MCC). Defines the APN/DNN Operator Identifier. An empty string removes the APN OI from the APN.

network_name

Optional string (default = empty). Set the network name in the EMM information or configuration update command message.

network_short_name

Optional string (default = empty). Set the network short name in the EMM information or configuration update command message.

emm_information_time_enable

Optional boolean (default = true). Include the time and time zone in the EMM information or 5GMM configuration update command message.

emm_information_enable

Optional boolean. Default = true if network_name or network_short_name are not empty. If true, send the EMM information message after the NAS attach complete message or the 5GMM configuration update command message after the 5GS registration accept message.

ext_emm_cause

Optional integer (range -1 to 15). If EMM cause is 15 in attach reject or tracking area update reject message and the value is different from -1, extended EMM cause IE is sent. The values 0 to 15 correspond to the bits specified in 3GPP TS 24.301 chapter 9.9.3.26A.

attach_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of EMM reject cause in NAS attach reject message.

tracking_area_update_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of EMM reject cause in NAS tracking area update reject message.

service_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of EMM reject cause in NAS service reject message.

pdn_connect_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of ESM reject cause in NAS PDN connectivity reject message.

pdn_disconnect_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of ESM reject cause in NAS PDN disconnect reject message.

bearer_resource_allocation_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of ESM reject cause in NAS bearer resource allocation reject message.

bearer_resource_modification_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of ESM reject cause in NAS bearer resource modification reject message.

registration_initial_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of 5GMM reject cause in NAS registration reject message (for 5GS registration type 1 or 4).

registration_mobility_periodic_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of 5GMM reject cause in NAS registration reject message (for 5GS registration type 2 or 3).

5gs_service_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of 5GMM reject cause in NAS service reject message.

pdu_session_establishment_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of 5GSM reject cause in NAS PDU session establishment reject message.

pdu_session_release_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of 5GSM reject cause in NAS PDU session release reject message.

pdu_session_modification_reject_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of 5GSM reject cause in NAS PDU session modification reject message.

5gmm_dl_nas_transport_error

Optional integer (range 0 to 255, default depending on scenario).
Force value of 5GMM reject cause in NAS DL NAS transport message.

eps_user_unknown_reject_cause

Optional integer (range 0 to 255, default = 8).
EMM cause sent in the NAS attach reject message when the IMSI is unknown in the HSS.

5gs_user_unknown_reject_cause

Optional integer (range 0 to 255, default = 3 or 75 if SNPN).
5GMM cause sent in the NAS registration reject message when the SUPI is unknown in the UDM.

attach_result_mode

Optional string (default = auto). Set attach result of attach accept message.
Can be:

auto

This is standard LTE behavior.

eps_only

If set and UE is sending combined EPS/IMSI attach, the MME will answer with EPS only in attach accept message (EMM cause will be CS domain not available).

combined

If set and UE is sending EPS only attach, the MME will answer with combined in attach accept message.

additional_update_result

Optional integer (default = 2). Set the value of additional update result in NAS attach accept and tracking area update accept messages.
If set to -1, the additional update result won’t be set.

network_policy

Optional integer (range -1 to 15, default = -1). Set the value of the network policy information element described in 3GPP TS 24.301 chapter 9.9.3.52. The value -1 means that the IE is not transmitted.

imeisv_request_in_smc

Optional boolean (default = true). Ask for the UE IMEISV in the NAS security mode command message. Must be enabled if multi_sim is set to true. IMEISV will always be requested if a S13 or N17 connection is defined, or if me_db object is defined.

authentication_mode

Optional string (default = auto). Set NAS authentication procedure behavior.
Can be:

auto

The MME or AMF performs authentication procedure unless the UE is already successfully authentified.

force

The MME or AMF forces a new NAS authentication procedure even if the Attach Request or Registration Request was already successfully authentified

skip

The MME or AMF skips the NAS authentication procedure and uses EIA0/EEA0 or 5G-IA0/5G-EA0 algorithms. This needs to be supported on UE side also.

dummy_authentication_autn_mac

Optional boolean (default = false). If set to true, the network will send an invalid AUTN MAC value in the NAS authentication request message.

authenticate_known_emergency_supi

Optional boolean (default = false). If set to true, the network will authenticate known IMSI/SUPI during an emergency registration procedure and reject the UE if it fails.

skip_smc_proc

Optional boolean (default = false). If set to true, the MME or AMF will not perform a NAS security mode control procedure and will send all messages as plain. This needs to be supported on UE side also.

force_identity_request

Optional boolen (default = false). If set to true, the network will perform a NAS identity request procedure even if the GUTI in the attach request or the 5G-GUTI in the initial registration request is already known.

force_guti_in_tau

Optional boolean (default = false). If set to true, GUTI IE will be systematically present in Tracking Area Update Accept message.

attach_reject_filter

Optional nullable object. Represent UE to reject when trying to attach to EPS.
Each property name represent IMSI. Use of wildcard "*" with an IMSI prefix is allowed to match IMSI range (Ex: 0010112456*). If multiple filters are matching, the one with the longest prefix will be used.
Each property value is an integer defining the redirection type as described in rrc_redirect eNB configuration.
The configuration may be removed using:
attach_reject_filter: null

Example:

attach_reject_filter: {
    "*": 0,
    "0010112345678": 1
    "00101123456*": 2
}

Will reject UE with IMSI 0010112345678 using redirection configuration 1 and all other UEs using redirection configuration 0.

emm_procedure_filter

Optional object. Allows to define the MME behavior for a list of EMM procedures.
Each property name represents an EMM procedure. The ones currently supported are attach, attach_with_security_protection, tracking_area_updating, detach, service_request, identity, authentication, security_mode_control and nas_transport.
Each property value is an object containing the following fields:

action

Enumeration (treat (UE message is processed), ignore (UE message is ignored) or reject (UE message is rejected))

ttl

Optional integer. If set, the reject of ignore filter is applied ttl times. If not set, the filter is applied until it is modified.

By default all procedures are treated.

Example:

emm_procedure_filter: {
    attach: {
        action: "treat"
    },
    service_request: {
        action: "reject",
        ttl: 1
    }
}

5gmm_procedure_filter

Optional object. Allows to define the AMF behavior for a list of 5GMM procedures.
Each property name represents a 5GMM procedure. The ones currently supported are registration_initial, registration_initial_with_security_protection, registration_mobility_periodic, service_request, identity, authentication, security_mode_control, generic_ue_update_command, nas_transport_n1_sm, nas_transport_sms, deregistration, control_plane_service_request, network_slice_specific_authentication and nas_transport_lpp.
Each property value is an object containing the following fields:

action

Enumeration (treat (UE message is processed), ignore (UE message is ignored) or reject (UE message is rejected))

ttl

Optional integer. If set, the reject of ignore filter is applied ttl times. If not set, the filter is applied until it is modified.

By default all procedures are treated.
Note that nas_transport_n1_sm filter must be used together with the apply_nas_transport_n1_sm_filter DNN parameter.

Example:

"5gmm_procedure_filter": {
    registration_initial: {
        action: "treat"
    },
    service_request: {
        action: "reject",
        ttl: 1
    }
}

qci_dscp_mapping

Optional array of objects. Allows to define a specific IP differentiated services code point for a given QCI/5QI. QCI/5QI not explicitly configured use the default DSCP value 0.
Each object must contain the following properties:

qci

Integer (range 1 to 254). QCI or 5QI value.

dscp

Integer (range 0 to 63). DSCP value.

rate_bucket_duration

Optional. Range 500 to 5000 (default = 2000). Duration in ms for the average bit rate estimation. It is used to enforce the APN and Session Aggregate Maximum Bit Rate.

dcnr_support

Optional boolean (default = false). Set it to true to enable Dual Connectivity with NR support.

dcnr_implicit_support

Optional boolean (default = false). If set to true, the MME will not send the 2nd byte of the EPS network feature support IE because of DCNR. Can be useful to test the UE behavior.

cpu_core_list

Optional array of integers. Defines the list of CPU cores indexes on which LTEMME will run.
If not set, LTEMME may use all cores.
Note that the number of cores depends on Linux scheduler and LTEMME configuration.

cn_assistance_info_support

Optional boolean (default = false), applicable to 5GC only. If set to true, the AMF will send a Core Network Assistance Information in the Initial Context Setup message.
This is mandatory to have a functional RRC Inactive support in the RAN.

ecc_params

Optional object. Set the ECC network configuration for the SUPI protection and de-concealment of the SUCI. Applicable to 5GC only. It contains the following objects:

A

Optional array of objects. Set the home network private key for profile A protection scheme.

home_nw_private_key

String. Set the home network private key;

home_nw_key_id

Optional integer in range 0 to 255 (default = 1). Set the home network key identifier.

B

Optional array of objects. Set the home network private key for profile B protection scheme.

home_nw_private_key

String. Set the home network private key;

home_nw_key_id

Optional integer in range 0 to 255 (default = 2). Set the home network key identifier.

Here is the procedure to generate a private/public key-pair:

    Profile A:
    openssl genpkey -algorithm x25519 -out key.pem
    openssl pkey -in key.pem  -text

    Profile B:
    openssl ecparam -genkey -name secp256r1 -out key.pem
    openssl ec -in key.pem  -noout -text -conv_form compressed

nf_ssl_certificate

Optional string. Applicable to 5GC only. If set, forces SSL for NF interfaces. Defines CA certificate filename.

nf_ssl_key

Optional string. Applicable to 5GC only. Mandatory if nf_ssl_certificate is set. Defines CA private key filename.

Here is the procedure to generate the private key file key.pem and the certicate file cert.pem:

openssl req -new > cert.csr
openssl rsa -in privkey.pem -out key.pem
openssl x509 -in cert.csr -out cert.pem -req -signkey key.pem --days 365

nssai

Applicable to 5GC only. Optional array. List of S-NSSAIs served by the AMF.
Default content is sst: 1 (eMBB).
Each entry will set a S-NSSAI value as defined below:

sst

Integer (range 0-255). Slice Service Type.

sd

Optional integer (range 0-0xFFFFFE). Slice Differentiator.

default_nssai

Applicable to 5GC only. Optional array. List of default S-NSSAIs served by the AMF.
Can only take S-NSSAIs contained in the non-default list above. If not present, takes the same content as the non-default list. See nssai.

nssai_inclusion_mode

Applicable to 5GC only. Optional enumeration (none, A, B, C, D, default = none). NSSAI inclusion mode value to send in message Registration accept.

nssai_subject_to_nsac

Applicable to 5GC only.
Optional array. List of the S-NSSAIs subject to NSAC. Can only take S-NSSAIs contained in the list of S-NSSAIs served by the AMF. Each entry of the array contains the following objects:

snssai

S-NSSAI value.

sst

Integer (range 0-255). Slice Service Type.

sd

Optional integer (range 0-0xFFFFFE). Slice Differentiator.

access_type

Optional array of enumeration: 3gpp, non-3gpp (default value 3gpp).

eps_counting

Optional boolean (default = false). If set to false, indicates that the network slice is subject to NSAC only in 5GS. If set to true, indicates that the network slice is subject to NSAC in EPS and 5GS.

ue_max_count

Optional integer (range: 1 to MAX_INT). If present, the control of the number of UEs registered to the S-NSSAI is activated.

pdu_session_max_count

Optional integer (range: 1 to MAX_INT). If present, the control of the number of PDU sessions registered to the S-SNNAI is activated.

backoff_timer

Optional integer (default = -1). Value in seconds of the S-NSSAI backoff timer. If present and not set to -1, this value is transmitted in the IE Extended rejected NSSAI.

eap_tls

Optional object applicable to 5GC only. Shall be present if EAP-TLS method is used in the UE database.
It contains the following objects:

certificate

Define the server certificate filename.

private_key

Define the server private key filename.

ca_certificate

Define the CA certificate filename. It contains a list of root certificates to authenticate the user.

tai_lists

Optional array of objects (up to 65535). Applicable to EPC only. Defines an array of TAI lists.
When the UE initiates registration in a tracking area, the TAI list containing this tracking area,
if available, is provided to the UE in the NAS Attach Accept and Tracking Area Update Accept messages.
Each object must contain the following parameters:

plmn

String (5 or 6 digits). Must match the PLMN identity of the MME See plmn, or an equivalent PLMN See eplmn_list.

tacs

Array of up to 16 integers in range 0 to 0xFFFF. Each element defines a 2 bytes long tracking area code.

tai_lists_5gs

Optional array of objects (up to 65535). Applicable to 5GC only. Defines an array of TAI lists.
When the UE initiates registration in a tracking area, the TAI list containing this tracking area, if available, is provided to the UE in the Registration Accept message.
Each object must contain the following parameters:

plmn

String (5 or 6 digits). Must match the PLMN identity of the MME See plmn, or an equivalent PLMN See eplmn_list.

tacs

Array of up to 16 integers in range 0 to 0xFFFFFF. Each element defines a 3 bytes long tracking area code.

forbidden_eps_tacs

Array of up to 16 integers in range 0 to 0xFFFF. Applicable to EPS only. Forbidden tracking areas codes in the MME PLMN (See plmn) or an equivalent PLMN (See eplmn_list).

areas_list_5gs

Optional array of objects. (up to 65535). Applicable to 5GC only. Describes the areas used in the interface AMF-UDM (See allowed_5gs_tais, See forbidden_5gs_tais). Each object must contain the following parameters:

code

Integer in range 0 to 0xFFFF defining the area code (operator specific).

tacs

Array of integers in range 0 to 0xFFFFFF. List of the tracking areas codes in the area.

operator_defined_access_categories

Optional array of objects. Operator-defined access categories as defined in 3GPP TS 24.501 paragraph 9.11.3.38. Applicable to 5GC only. Each object contains the following parameters:

precedence

Integer in range 0 to 255. Precedence value.

access_category

Integer in range 32 to 63. Operator defined access category value.

nssai

Optional array of S-NSSAIs. See nssai.

dnn_list

Optional array of strings.

standard_access_category

Optional integer (possible values 0, 1, 2, 3, 4, 5, 6, 7, 10). Access category number of the related standardized access category.

akma_kaf_lifetime

Optional integer in range: 1 to 3650 (default = 365). Applicable to 5GC only. AKMA Application Keys lifetime in days as defined in 3GPP 33.535 paragraph 5.2 AKMA key lifetimes.

com_addr

Optional string. Address of the WebSocket server remote API. See Remote API.
If set, the WebSocket server for remote API will be enabled and bound to this address.
Default port is 9000.
Setting IP address to [::] will make remote API reachable through all network interfaces.

com_name

Optional string. Sets server name. MME by default

com_ssl_certificate

Optional string. If set, forces SSL for WebSockets. Defines CA certificate filename.

com_ssl_key

Optional string. Mandatory if com_ssl_certificate is set. Defines CA private key filename.

com_ssl_peer_verify

Optional boolean (default is false). If true, server will check client certificate.

com_ssl_ca

Optional string. Set CA certificate. In case of peer verification with self signed certificate, you should use the client certificate.

com_log_lock

Optional boolean (default is false). If true, logs configuration can’t be changed via config_set remote API.

com_log_us

Optional boolean (default is false). If true, logs sent by log_get remote API response will have a timestamp_us parameters instead of timestamp

com_auth

Optional object. If set, remote API access will require authentication.
Authentication mechanism is describe in Remote API Startup section.

passfile

Optional string. Defines filename where password is stored (plaintext).
If not set, password must be set

password

Optional string. Defines password.
If not set, passfile must be set.

unsecure

Optional boolean (default false). If set, allow password to be sent plaintext.
NB: you should set it to true if you access it from a Web Browser (Ex: Amarisoft GUI) without SSL (https) as your Web Browser may prevent secure access to work.

com_log_count

Optional number (Default = 8192). Defines number of logs to keep in memory before dropping them.
Must be between 4096 and 2097152).

sim_events

Array of object. Each element gives an event configuration to execute for this UE.
Event configuration is exactly the same as for Remote API messages except that message field must be event.

sim_events_loop_count

If set, will define loop_count for each event of sim_events, See loop_count.

sim_events_loop_delay

If set, will define loop_delay for each event of sim_events, See loop_delay.

license_server

Configuration of the Amarisoft license server to use.
Object with following properties:

server_addr

String. IP address of the license server.

name

Optional string. Text to be displayed inside server monitor or remote API.

tag

Optional string. If set, server will only allow license with same tag.

Example:

license_server: {
    server_addr: "192.168.0.20",
    name: "My license"
}

5.2.1 PDN options

Note that the options are also applicable to 5GS DNN.

ignore_initial_apn

Optional boolean (default = false). If false, UE will be rejected if its desired APN is unknown. Any unknown APN requested outside of the initial PDN connectivity request sent during the EPS NAS attach request procedure will be rejected. This parameter does not apply to 5GS.

explicit_apn_required

Optional boolean (default = false). If true, the UE must explicitly request an APN/DNN otherwise the PDN/PDU session establishment request will be rejected.

allow_apn_in_attach_req

Optional boolean (default = false). If true, the EPC accepts an attach request containing an APN even if it is strictly forbidden in 3GPP requirement. This is required for some specific operator requirement.

pdn_list

Array of objects. Configure the available EPS Packet Data Networks and 5GS Data Network Names. The first entry of each type (IP, unstructured, ethernet) is the default APN or DNN used in case the UE does not explicitly request it.

Each object contains the following properties:

access_point_name

String. Set the Access Point Name or Data Network Name network identifier. Use dots (.) to separate the APN or DNN elements.
Array of string. You can use array to define aliases.

pdn_type

Optional enumeration: ipv4, ipv6, ipv4v6, unstructured, ethernet (default = ipv4). Select the PDN or PDU session type.

first_ip_addr

String. First available IPv4 address.

last_ip_addr

String. Last available IPv4 address.

ipv4_auto_increment

Optional boolean (default = false). If set to false, the same IPv4 address is allocated for successive activation / deactivation of the PDN or PDU session. If set to true, the IPv4 address is incremented for successive activation / deactivation of the PDN or PDU session.

gateway

Optional string. If set, forces the address of the gateway used for this PDN or PDU session and sent to mme-ifup script. With default config, it will be used to provide a IP address to the tun interface.
If not set, the first IP of the subnet will be used.

ip_addr_shift

Optional integer (default = 0). The allocated IPv4 addresses are allocated starting from first_ip_addr with a difference of 2^ip_addr_shift. Hence last_ip_addr - first_ip_addr must be a multiple of 2^ip_addr_shift. This option can be useful in case of inter-UE communication to ensure that the IPv4 address of a given UE is the only one in its netmask.

first_ipv6_prefix

String. First available global IPv6 prefix used in Router Advertisement message sent to the UE (only the high 8 bytes of the IPv6 address are meaningful). Note that the selected prefix will also be used as the interface identifier sent in NAS signalling.

last_ipv6_prefix

String. Last available global IPv6 prefix used in Router Advertisement message sent to the UE (only the high 8 bytes of the IPv6 address are meaningful). Note that the selected prefix will also be used as the interface identifier sent in NAS signalling.

ipv6_auto_increment

Optional boolean (default = false). If set to false, the same IPv6 prefix is allocated for successive activation / deactivation of the PDN or PDU session. If set to true, the IPv6 prefix is incremented for successive activation / deactivation of the PDN or PDU session.

ipv6_interface_identifier

Optional string. IPv6 link local address interface identifier for the MME network interface of this PDN or PDU session (only the low 8 bytes of the IPv6 address are meaningful).

ipv6_interface_addr

Optional string. IPv6 global address for the MME network interface of this PDN or PDU session. If not present, the address is first_ipv6_prefix with a ::0 interface identifier.

ipv6_router_lifetime

Optional integer (range 0 to 65535, default is 65535). IPv6 Router Advertisement router lifetime in seconds.

ipv6_valid_lifetime

Optional integer (default is infinity - 0xffffffff). IPv6 Router Advertisement valid lifetime in seconds.

ipv6_pref_lifetime

Optional integer (default is ipv6_valid_lifetime value). IPv6 Router Advertisement preferred lifetime in seconds.
Must not be greater than ipv6_valid_lifetime.

ipv6_onlink_flag

Optional boolean (default is true). Defines IPv6 Router Advertisement on-link flag state.

ipv6_managed_addr_config_flag

Optional boolean (default is false). Defines IPv6 Router Advertisement managed address configuration flag state.

ipv6_other_config_flag

Optional boolean (default is false). Defines IPv6 Router Advertisement other configuration flag state.

ipv6_mtu

Optional integer (default is 0). Defines the MTU sent in the IPv6 Router Advertisement message. If set to 0, the MTU option is not sent.

ipv6_ra_transmission_interval

Optional integer (range -1 to 1800, default is 0). Time in seconds between 2 periodical multicast Router Advertisement transmission, once the initial 3 transmissions have been performed after opening the PDN or PDU session. The value -1 means that no multicast transmission is done at all (including the 3 initial ones). The value 0 means that periodical transmission is deactivated.

ipv6_drop_rs

Optional boolean (default is false). Defines whether the incoming Router Solicitation messages should be dropped by the MME and UPF or not.

ipv6_send_dns_in_ra

Optional boolean (default is false). Defines whether Router Advertisement message should contain the configured IPv6 DNS servers address or not.

ipv6_prefix_delegation_count

Optional integer (2, 4, 8, 16, 32). Defines the number of prefixes delegated by DHCPv6-PD (including the one allocated by the Router Advertisement message). Only the first IA_PD option in the DHCPv6 Solicit message is considered.

dhcpv6_t1

Optional integer (default = 0xffffffff). DHCPv6 T1 option in seconds (Cf rfc3633) used for prefix delegation replies.

dhcpv6_t2

Optional integer (default = 0xffffffff). DHCPv6 T2 option in seconds (Cf rfc3633) used for prefix delegation replies.

dns_addr

String or array of strings. IPv4 or IPv6 addresses of the DNS servers.

p_cscf_addr

Optional string or array of strings. IPv4 or IPv6 addresses of the P-CSCF servers (VoLTE).

mtu_ipv4

Optional integer. Set MTU size (0 means disabled).

mtu_non_ip

Optional integer. Set MTU size for non-IP PDN (0 means disabled, the minimum valid value is 128).

mtu_unstructured_link

Optional integer (default value set to mtu_non_ip value). Set MTU size for unstructured PDU session (0 means disabled).

mtu_ethernet_frame_payload

Optional integer. Set MTU size for ethernet PDN or PDU session (0 means disabled).

ip_addr_config

Optional string. If set, this parameter defines the Access Point Name of a PDN or PDU session that will be used for IPv4 allocation. In such case, both PDNs or PDU sessions will share the same IPv4 range and thus, first_ip_addr, last_ip_addr, ipv4_auto_increment, gateway, mtu_ipv4 and ip_addr_shift will be skipped.

ipv6_prefix_config

Optional string. If set, this parameter defines the Access Point Name of a PDN or PDU session that will be used for IPv6 prefixes allocation. In such case, both PDNs or PDU sessions will share the same IPv6 prefix range and thus, first_ipv6_prefix, last_ipv6_prefix, ipv6_auto_increment, ipv6_interface_identifier, ipv6_prefix_delegation_count and ipv6_mtu will be skipped.

operator

Optional array of objects. Each element defines an operator reserved container in protocol configuration.

Properties of each element:

id

Integer. Container identifier, must be between 0xff00 and 0xffff as defined in 3GPP TS 24.008.

plmn

String. PLMN info of container.

value

String. Value to send in hexadecimal string format.

force

Optional boolean. If true, container will be sent event without request (false by default).

5gs_authentication

Optional enumeration: none, pap, chap, eap-md5, eap-tls or eap-aka (default set to authentication). Defines the authentication mechanism used for this DNN in 5GS.

authentication

Optional enumeration: none, pap or chap (default set to none). Defines the authentication mechanism used for this APN in EPS.

username

Optional string (up to 100 characters) containing the user name used for pap, chap or eap-md5 authentication.

password

Optional string (up to 100 characters) containing the password used for pap, chap or eap-md5 authentication.

apn_aggregate_max_bitrate_dl

Optional integer (default = -1). EPS APN or 5GS PDU session aggregate maximum bitrate for downlink (in bits/s). If set to -1, no APN-AMBR or PDU session AMBR is configured and UE-AMBR is used instead.

apn_aggregate_max_bitrate_ul

Optional integer (default = -1). EPS APN or 5GS PDU session aggregate maximum bitrate for uplink (in bits/s). If set to -1, no APN-AMBR or PDU session AMBR is configured and UE-AMBR is used instead.

emergency

Optional boolean (default = false). If set, PDN will be selected for emergency calls.

serving_plmn_rate_control

Optional integer (range 0 to 65535, default = 0). Defines the serving PLMN rate control IE content when PDN is used with control plane CIoT optimization only. If the value configured is less than 10, the IE is not transmitted.

apn_rate_control_params

Optional object. If defined, and if the UE indicates APN rate control parameters support in its protocol configuration options, the following parameters will be sent in Core Network protocol configuration options:

additional_exception_report

Boolean. Indicates if exception reports are allowed once the limit is reached.

ul_time_unit

Enumeration: unrestricted, minute, hour, day or week.

max_ul_rate

Integer (range from 0 to 16777215). Number of messages allowed to be sent per ul_time_unit.

additional_apn_rate_control_exception_data_params

Optional object. If defined, and if the UE indicates additional APN rate control for exception data parameters support in its protocol configuration options, the following parameters will be sent in Core Network protocol configuration options:

ul_time_unit

Enumeration: unrestricted, minute, hour, day or week.

max_ul_rate

Integer (range from 0 to 65535). Number of messages allowed to be sent per ul_time_unit.

backoff_timer

Optional integer (default = -1). Value in seconds of the T3396/T3584/T3585 timers. The timer is transmitted in the ESM and 5GSM reject messages if the value is not -1. -2 means that the timer is deactivated.

re_attempt_ind

Optional integer (range -1 to 255, default = -1). Value of octet 3 of the Re-attempt indicator information element, as specified in 3GPP TS 24.301 chapter 9.9.4.13A and 3GPP TS 24.501 chapter 9.11.4.17. The value -1 means that the information element is not sent.

automatic_release

Optional boolean (default = false). If set, when the last associated dedicated EPS bearer is released the MME releases the default EPS bearer. With 5GS, when the last non default QoS flow is released, the SMF releases the PDU session.

allow_multiple_pdn_connections

Optional boolean (default = false). If set, a UE can create multiple PDN connections to this APN, or multiple PDU sessions to this DNN for the same slice.

single_address_bearers_only

Optional boolean (default = false). Only applicable when pdn_type is set to "ipv4v6". If set to true, a UE trying to connect to the APN/DNN with IPv4v6 will only have a single_address_bearers_first_address address allocated and will receive the indication to create a new PDN connectivity/PDU session for the other IP address type.

single_address_bearers_first_address

Optional enumeration (ipv4, ipv6, default = ipv4). Only applicable when single_address_bearers_only is set to true. Defines the address type allocated when the UE tries to connect to the APN/DNN with IPv4v6.

ue_initiated_modification

Optional boolean (default = false). If set, the UE can request the modification of a bearer, otherwise the request is rejected.

ip_src_violation_limit

Optional integer (default = -1). If greater than -1, the MME or UPF checks the IP source address of uplink packets. When ip_src_violation_limit packets are received, the PDN or PDU session is released. The value 0 means that the packets are dropped without triggering a release.

integrity_protection

Optional enumeration (disabled, preferred, required, default = disabled). Defines whether integrity should be used for the PDN connection / PDU session or not.
For EPC, if the value is set to preferred, the EPC will activate integrity protection based on the UE capabilities. If set to required, and if the UE does not support integrity protection, the request will be rejected with ESM cause 30.
For 5GC, if the value is set to preferred, the 5GC will activate integrity protection based on the UE capabilities and the configured PDU session AMBR. If set to required, and if the UE does not support integrity protection for the bitrate configured in the PDU session AMBR, the request will be rejected with 5GSM error cause #82.

tun_setup_script

Overrides tun_setup_script for this PDN or PDU session.

tun_ifname

Optional string. If set, use this tun device instead of creating it.
Usefull when LTEMME has no root privileges.

erabs

Array of objects. Each element defines an E-RAB (E-UTRAN Radio Access Bearer) associated to the PDN or a QoS flow associated to the PDU session. The first E-RAB or QoS flow is the default radio bearer and must always be present. The additional E-RABs and QoS flows are dedicated radio bearers and must include a Traffic Flow Template (TFT) unless they are defined as UE initiated.

Property of each element:

qci

Range: 1 to 255. QoS Class Identifier of the E-RAB or 5G QoS Identifier of the QOS flow.

priority_level

Range: 1 to 15. ARP priority level.

pre_emption_capability

Enumeration: shall_not_trigger_pre_emption or may_trigger_pre_emption.

pre_emption_vulnerability

Enumeration: not_pre_emptable or pre_emptable.

setup_type

Optional enumeration: automatic, on_demand, ue_initiated (default = automatic).

• If set to automatic, the dedicated bearer is created with the default bearer.
• If set to on_demand, the dedicated bearer is created when there is downlink traffic matching the TFT filters. This option is useful to automatically create a dedicated bearer for IMS RTP voice traffic.
• If set to ue_initiated, the dedicated bearer is created when receiving a ESM bearer resource allocation request or PDU session modification request message. In that case, the gbr object defines the maximum values allowed (MME will use the minimum between configured values and the ones sent by the UE) and tft object is not required (the core network will use the filters sent by the UE).

5qi_qos

Optional object. 5QI QoS characteristics. List of properties:

priority_level

Optional integer (range 0 to 127). 0 means that the field is absent. Its presence is mandatory if packet_delay_budget is present.

packet_delay_budget

Optional integer (range -1 to 1023) in 0.5 ms unit. -1 means that the field is absent.

extended_packet_delay_budget

Optional integer (range -1 to 109999) in 0.01 ms unit. -1 means that the field is absent.

packet_error_rate

Optional string. It should be set to "xE-y" where x is the scalar value (0 to 9) and y is the exponent value (0 to 9). Its presence is mandatory if packet_delay_budget is present.

averaging_window

Optional integer (range -1 to 4095) in ms unit. Only applicable to GBR bearers. -1 means that the field is absent.

maximum_data_burst_volume

Optional integer (range -1 to 2000000) in byte unit. Only applicable to delay critical GBR bearers. -1 means that the field is absent.

cn_packet_delay_budget_dl

Optional integer (range -1 to 1099990) in 0.01 ms unit. Only applicable to delay critical GBR bearers. -1 means that the field is absent.

cn_packet_delay_budget_ul

Optional integer (range -1 to 1099990) in 0.01 ms unit. Only applicable to delay critical GBR bearers. -1 means that the field is absent.

gbr

Optional object. Guaranted Bitrate information. List of properties:

maximum_bitrate_dl

Integer. Bearer maximum bitrate for downlink (in bits/s).

maximum_bitrate_ul

Integer. Bearer maximum bitrate for uplink (in bits/s).

guaranteed_bitrate_dl

Integer. Bearer guaranteed bitrate for downlink (in bits/s).

guaranteed_bitrate_ul

Integer. Bearer guaranteed bitrate for uplink (in bits/s).

filters

Optional array of objects. List of TFT filters or QoS rules. Required for dedicated bearers with setup_type different from ue_initiated. Each filter has the following properties:

direction

Enumeration: dl, ul or both. Set the filter direction.

id

Range: 0 to 14. Set the filter identifier.

precedence

Range: 0 to 254. Set the filter precedence. All the filters must have different precedence. 0 is the highest precedence. Note that precedence 80 is reserved for derived QOS rules in 5GS and thus will be rejected if configured.

reflective_qos

Optional integer (default = false). If set to true, this QoS rule in 5GS can use reflective QoS if supported by the UE. Is it only applicable if direction is set to dl.

components

Array of objects. Each component contains one of the following properties as described in 3GPP TS 23.060 chapter 15.3.2:

ipv4_remote_addr

String. Match a remote (external network entity) IPv4 address with the additional mask property.

ipv4_local_addr

String. Match a local IPv4 address with the additional mask property. Note that not all UEs support it (they must indicate the support of the Local address in TFT in PCO/ePCO).

ipv6_remote_addr

String. Match a remote (external network entity) IPv6 address with the additional mask property.

ipv6_remote_addr_prefix

String. Match a remote (external network entity) IPv6 address with the additional prefix_len property. Note that not all UEs support it (they must indicate the support of the Local address in TFT in PCO/ePCO).

ipv6_local_addr_prefix

String. Match a local IPv6 address with the additional prefix_len property. Note that not all UEs support it (they must indicate the support of the Local address in TFT in PCO/ePCO).

proto_id

Range: 0 to 255. Match against the IP protocol identifier.

local_port

Range: 0 to 65536. Match against the local (UE) port.

local_port_range

Array of 2 integers. Match against a local (UE) port range.

remote_port

Range: 0 to 65536. Match against the remote (external network entity) port.

remote_port_range

Array of 2 integers. Match against a remote (external network entity) port range.

security_parameter_index

32 bit integer. Match the ESP or AH security parameter index.

type_of_service

Range: 0 to 255. Match the type of service (IPv4) or the traffic class (IPv6) field. The additional mask property is the corresponding mask.

mask

Depends on TFT component.
If ipv4_remote_addr is set, string representing IPv4 address used as a mask to apply on packet remote address.
If ipv6_remote_addr is set, string representing IPv6 address used as a mask to apply on packet remote address.
If type_of_service is set, integer between 0 and 255 used as a mask to apply on packet tos.

flow_label

20 bit integer. Match the IPv6 flow label.

prefix_len

Range: 1 to 128. IPv6 address prefix length.

destination_mac_addr

String. Match the destination MAC address.

source_mac_addr

String. Match the source MAC address.

802.1q_ctag_vid

Range: 0 to 4095. Match the 802.1Q C-TAG VID.

802.1q_stag_vid

Range: 0 to 4095. Match the 802.1Q S-TAG VID.

802.1q_ctag_pcp_dei

Range: 0 to 15. Match the 802.1Q C-TAG PCP and DEI.

802.1q_stag_pcp_dei

Range: 0 to 15. Match the 802.1Q S-TAG PCP and DEI.

ethertype

Range: 0 to 65535. Match the ethertype.

destination_mac_addr_range

Array of 2 strings. Match the destination MAC address range. Only applicable to 5GC.

source_mac_addr_range

Array of 2 strings. Match the source MAC address range. Only applicable to 5GC.

on_demand_timeout

Optional integer. When setup_type is on_demand, set the duration (in ms) after which the dedicated bearer is released when there is no downlink or uplink traffic.

on_demand_ul_trigger

Optional boolean (default = false). When setup_type is on_demand, if set to true an UL packet matching one of the TFT filters triggers the dedicated E-RAB or QoS flow establishment.

transaction_identifier

Optional integer (range 0 to 127). If present, the transaction identifier IE is put in the EPS bearer activation message.

llc_sapi

Optional integer (range 0 to 15). If present, the LLC service access point identifier IE is put in the EPS bearer activation message.

radio_priority

Optional integer (range 0 to 7). If present, the radio priority IE is put in the EPS bearer activation message.

packet_flow_identifier

Optional integer (range 0 to 127). If present, the packet flow identifier IE is put in the EPS bearer activation message.

sm_qos

Optional string. If present, the quality of service IE is put in the EPS bearer activation message. The string must contain the hexadecimal representation of the IE without its IEI and length.

The following parameters are applicable to EPC only:

esm_procedure_filter

Optional object. Allows to define the MME behavior for a list of ESM procedures.
Each property name represents an ESM procedure. The ones currently supported are pdn_connectivity, pdn_disconnect, bearer_resource_allocation and bearer_resource_modification.
Each property value is an object containing the following fields:

action

Enumeration (treat (UE message is processed), ignore (UE message is ignored) or reject (UE message is rejected))

ttl

Optional integer. If set, the reject of ignore filter is applied ttl times. If not set, the filter is applied until it is modified.

ignore does not apply to procedure pdn_connectivity performed during the attach procedure.
By default all procedures are treated.

Example:

  esm_procedure_filter: {
      pdn_connectivity: {
          action: "treat"
      },
      bearer_resource_allocation: {
          action: "reject",
          ttl: 1
      }
  }

The following parameters are applicable to 5GC only:

5gsm_procedure_filter

Optional object. Allows to define the SMF behavior for a list of 5GSM procedures.
Each property name represents a 5GSM procedure. The ones currently supported are pdu_session_establishment, pdu_session_release and pdu_session_modification.
Each property value is an object containing the following fields:

action

Enumeration (treat (UE message is processed), ignore (UE message is ignored) or reject (UE message is rejected))

ttl

Optional integer. If set, the reject of ignore filter is applied ttl times. If not set, the filter is applied until it is modified.

By default all procedures are treated.

Example:

  "5gsm_procedure_filter": {
      pdu_session_establishment: {
          action: "treat"
      },
      pdu_session_modification: {
          action: "reject",
          ttl: 1
      }
  }

always_on

Optional enumeration (auto, required, not_allowed, default = auto). Defines the always-on behavior for the PDU session. If the value is set to auto, the 5GC will follow whatever is requested by the UE. If the value is set to required, the 5GC will always set the PDU session as always-on required. If the value is set to not_allowed, the 5GC will always set the PDU session as always-on not allowed.

confidentiality_protection

Optional enumeration (disabled, preferred, required, default = required). Defines if confidentiality must be used for the PDU session or not.

apply_nas_transport_n1_sm_filter

Optional boolean (default = true). Indicates whether the 5GMM procedure filter nas_transport_n1_sm should apply to this DNN or not.

eps_5gs_interworking

Optional boolean (default = true). If set to true, interworking between EPS and 5GS is allowed for this APN/DNN. Otherwise it is forbidden.

5gsm_congestion_re_attempt_ind

Optional integer (range -1 to 255, default = -1). Value of octet 3 of the Re-attempt indicator information element, as specified in 3GPP TS 24.501 chapter 9.11.4.21. The value -1 means that the information element is not sent.

rq_timer

Optional integer (default = -1). Value in seconds of the RQ timer for the PDU session, sent to the UE if it supports reflective QoS feature. -2 means that the timer is deactivated.

slices

Optional array. Defines the QoS flows by S-NSSAI.
If a supported S-NSSAI is not present in the array, the QoS flows defined in erabs applies.
Each entry will set specific QoS flows for a slice as defined below:

snssai

S-NSSAI value.

sst

Integer (range 0-255). Slice Service Type.

sd

Optional integer (range 0-0xFFFFFE). Slice Differentiator.

qos_flows

Array of QoS flows. Each element of the array has the same structure as an element in erabs
except that "5qi" shall be used instead of "qci".

5.2.2 User database options

ue_db

Array of objects. Configure the user database. Each element is an entry for one user. The following properties are available:

imsi

Optional string. Shall be present if nai is absent. Set the IMSI.

nai

Optional string applicable to 5G only.
Shall be present if imsi is not set. Set the Network specific identifier-based SUPI.

sim_algo

Optional enumeration. xor, milenage or tuak (default = xor). Set the USIM authentication algorithm. Note: test USIM cards use the XOR algorithm.

sqn

Optional String (6 byte hexadecimal string). Default = "000000000000". Set the initial sequence number. For the XOR algorithm, the actual value does not matter. For the Milenage or TUAK algorithm, a sequence number resynchronization is initiated if the sequence number does not match the one stored in the USIM.

K

String. Set the user secret key (as a 16 bytes hexadecimal string, or eventually 32 bytes hexadecimal string for TUAK).

op

Optional string. Operator key (as a 16 byte hexadecimal string). When the Milenage authentication algorithm is used, either op or opc must be set.

opc

Optional string. Operator key preprocessed with the user secret key (as a 16 byte hexadecimal string). When the Milenage authentication algorithm is used, either op or opc must be set.

r

Optional array of 5 integers (range: 0 to 127). Allows to customize the r1 to r5 parameters when Milenage authentication algorithm is used. If the array is not present, the default values (as defined in 3GPP TS 35.206) are used.

c

Optional array of 5 strings. Each value contains a 16 byte hexadecimal string. Allows to customize the c1 to c5 parameters when Milenage authentication algorithm is used. If the array is not present, the default values (as defined in 3GPP TS 35.206) are used.

top

Optional string. Operator key (as a 32 byte hexadecimal string). When the TUAK authentication algorithm is used, either top or topc must be set.

topc

Optional string. Operator key preprocessed with the user secret key (as a 32 byte hexadecimal string). When the TUAK authentication algorithm is used, either top or topc must be set.

keccak_iter

Optional integer (range: 1 to MAX_INT). Allows to customize the number of Keccak permutations performed when using the TUAK authentication algorithm. If the item is not present, the default value 1 (as defined in 3GPP TS 35.231) is used.

cag_info_list

Optional array. Subscribed CAG information list. Each element of the array contains:

plmn

String (5 or 6 digits).

cag_id_list

Array of 1 to 12 integers (range 0 to 4294967295) giving the list of the allowed CAG-Identifiers.

cag_only_ind

Optional boolean (default = FALSE). Indication that the UE is only allowed to access 5GS via CAG cells.

csg_info_list

Optional array of objects. Subscribed CSG information. Each element of the array contains:

plmn

String (5 or 6 digits).

csg_id_list

Array of integers in range 0 to 0x7FFFFFF. Allowed CSG id list in the PLMN.

amf

Range: 0 to 65535. Set the Authentication Management Field.

5gs_auth_type

Applicable to 5GC only.
Optional enumeration: 5g_aka, eap_aka_prime, eap_tls (default = 5g_aka).
5GMM authentication method.

at_result_ind

Applicable to 5GC only.
Optional boolean (default = false).
Indicates if the AUSF shall include the AT_RESULT_IND attribute
in message EAP-request/AKA’-Challenge.

res_len

Optional integer (default = 8). Defines length of response in bytes during authentication. For TUAK authentication algorithm, the value must be 4, 8 or 16 bytes long.

multi_sim

Optional boolean (default = false). If true, allow several UEs to have the same IMSI (useful when using several identifical test SIM cards in different UEs at the same time). They are distinguished with their IMEI. Note: it is only allowed with the XOR authentication algorithm.

isim_auth

Optional object. If present, the object allows to configure some specific authentication parameters for the ISIM. Otherwise it uses the same parameters as those defined for the USIM. It contains the following configuration parameters: sim_algo, K, op, opc, r, c, top, topc, keccak_iter and res_len.

msisdn

Optional string. Sets the UE MSISDN (that will be sent in the NAS PCO message if requested by the UE for example).

ue_aggregate_max_bitrate_dl

Optional integer (default = 5e9). UE aggregate maximum bitrate for downlink (in bits/s).

ue_aggregate_max_bitrate_ul

Optional integer (default = 2e9). UE aggregate maximum bitrate for uplink (in bits/s).

t3412

Optional integer. Value in seconds of the T3412 (TAU update) ot T3512 timer for this IMSI. If not present, the MME or AMF will use the value coming from HSS or configured locally. It is sent to the UE in NAS signalling, unless the UE is requesting the use of a longer timeout with T3412 extended value or requested T3512 value information element.

n3gpp_dereg_timer

Optional integer. Applicable to 5GC only. Value in seconds of the non-3GPP de-registration timer.

count

Optional integer (default = 1). Create n user entries by incrementing the IMSI and K.

restrict_nr_as_2nd_rat

Optional boolean (default = false). If set to true, the user is not allowed to use NR as secondary RAT (no DCNR).

restrict_5gc_access

Optional boolean (default = false). If set to true, the user is not allowed to access 5GC when coming from EPC (no handover or cell redirection).

restrict_epc_access

Optional boolean (default = false). If set to true, the user is not allowed to access EPC when coming from 5GC (no handover or cell redirection).

restrict_pdn_list

Optional boolean (default = false). If set to true, only the PDNs or PDU sessions listed in the pdn_list object are allowed for the user.

pdn_list

Optional array. Each entry will set specific parameters for a PDN or PDU session as defined below:

access_point_name

String. Used to define what PDN or PDU session to configure.

default

Optional boolean (default = false). If true and UE does not specify the APN or DNN it wants to connect to, this PDN or PDU session will be used.

pdn_type

Optional enumeration: ipv4, ipv6, ipv4v6. Restrict the PDN type for this specific IMSI. The PDN or PDU session must be configured with a matching IP version.

ipv4_addr

Optional string. If set, the UE will always use this IPv4 address.

ipv6_prefix

Optional string. If set, the UE will always use this IPv6 prefix.

imei

Optional string (14 or 15 digits). If set, this configuration only applies to UE with matching IMEI. Only supported for EPS, not 5GS.

multicast

Optional boolean (default = false). If set, IPv4 multicast traffic will be forwarded to this PDN or PDU session.

ipv6_multicast

Optional boolean (default = false). If set, IPv6 multicast traffic will be forwarded to this PDN or PDU session.

broadcast

Optional boolean (default = false). If set, IPv4 broadcast traffic will be forwarded to this PDN or PDU session.

routes

Optional array. Each entry of array represent a list of filters.
See TFT components for filters syntax except that remote refers to UE and local to network.
When a packet enters MME of UPF, if it matches one of the filter list, it will be sent to associated UE.

Ex:

routes: [
          [
            {
              ipv4_remote_addr: "10.0.0.0",
              mask: "255.255.255.0"
            }
          ]
        ]

Means that all packets addressed to 10.0.0.0/24 network will be sent to UE.

nssai

Applicable to 5GC only.
Optional array. List of subscribed S-NSSAIs per DNN.
If not present, the list of the S-NSSAIs served by the AMF applies.
See nssai.

nssai_subject_to_nssaa

Applicable to 5GC only.
Optional array. List of the subscribed S-NSSAIs subject to NSSAA. Each entry of the array contains the following objects:

snssai

S-NSSAI subject to NSSAA.

sst

Integer (range 0-255). Slice Service Type.

sd

Optional integer (range 0-0xFFFFFE). Slice Differentiator.

auth_type

Optional enumeration: eap_md5, eap_tls or eap_aka (default set to eap-md5). Defines the authentication mechanism used for this S-NSSAI.

username

String (up to 100 characters) containing the user name used for algo eap_md5.

password

String (up to 100 characters) containing the password used for algo eap_md5.

ue_slice_max_bitrate

Applicable to 5GC only.
Optional array. Each entry of the array gives the UE maximum bitrate for uplink and downlink in a slice subject to NSAC and contains the following objects:

snssai

S-NSSAI value. The S-NSSAI shall be contained in the list of the S-NSSAIs subject to NSAC given by nssai_subject_to_nsac.

sst

Integer (range 0-255). Slice Service Type.

sd

Optional integer (range 0-0xFFFFFE). Slice Differentiator.

ue_slice_max_bitrate_ul

Integer. UE maximum bitrate in the S-NSSAI for uplink (in bits/s).

ue_slice_max_bitrate_dl

Integer. UE maximum bitrate in the S-NSSAI for downlink (in bits/s).

sms_over_nas_allowed

Optional boolean (default = true). Indicates if the subscription of the UE allows SMS over NAS.

allowed_5gs_tais

Optional object. Allowed or not allowed TAIs in 5GS as defined in 3GPP TS 29.571 chapter 5.4.4.18. If not present, all TAs in the registration area are allowed. Each object must contain the following parameters:

restriction_type

Optional enumeration: allowed, not_allowed. Default value is allowed. Only applicable to 5GS. Gives the type of the service area restriction. If set to allowed, the areas defined in tais are allowed.

tais

Array of objects (up to 65535). Only applicable to 5GS. Each object must contain the following parameters:

plmn

String (5 or 6 digits).

areas

Array of objects (up to 65535). Each object decribes an area defined by a specific operator code or a list of tracking areas codes as defined in 3GPP TS 29.571 chapter 5.4.4.17.
The same areas list must be configured for equivalent PLMNs. Each object contains the following parameters:

code

Integer in range 0 to 0xFFFF. Area code as defined by the operator (See areas_list_5gs). Must be present only if tacs is absent.

tacs

Array of up to 16 integers in range 0 to 0xFFFFFF. Each element defines a 3 bytes long tracking area code. Must be present only if code is absent.

forbidden_5gs_tais

Optional array of objects. Forbidden areas in 5GS. See tais.

mps_priority

Optional boolean (default = false). Indicates whether the UE is subscribed to multimedia priority service.

mcs_priority

Optional boolean (default = false). Indicates whether the UE is subscribed to mission critical service.

routing_indicator

Optional string (default = "0"). Routing Indicator consisting of 1 to 4 decimal digits assigned by the home network operator as defined in 3GPP 23.003 2.2B Subscription Concealed Identifier (SUCI)).

akma

Optional boolean (default = false). Indicates if AKMA keys need to be generated for the UE.

5.2.3 Public Warning System (ETWS/CMAS) options

pws_msgs

Optional array of objects. Define a list of ETWS/CMAS messages which can be sent to the connected eNodeBs with the pws_write monitor command. Check 3GPP TS 23.041 to have the exact definition of each field. Each message contains the following properties:

local_identifier

Range: 0 to 65535. Local message identifier. Used as argument to the monitor commands pws_write or pws_kill.

message_identifier

Range: 0 to 65535. Message Identifier.

serial_number

Range: 0 to 65535. Serial Number.

repetition_period

Optional integer, range: 0 to 4095 for EPC, 131071 for 5GC (default = 10). Periodicity of the warning message to be broadcast.

number_of_broadcasts_requested

Optional integer, range: 0 to 65535 (default = 65535). Number of times a message is to be broadcast.

warning_type

Optional integer. Range: 0 to 65535. Warning type (ETWS only).

warning_security_info

Optional 50 byte hexadecimal string. Warning security information (ETWS optional).

warning_message

Optional array of string. Message content (ETWS: optional, CMAS: mandatory). Each string is a message page and contains at most 93 GSM 7 bit or 41 UCS2 characters. At most 15 pages are allowed.

warning_message_hex

Optional array of hexadecimal string. Message content (ETWS: optional, CMAS: mandatory). Each hexadecimal string is a message page and contains at most 164 characters. At most 15 pages are allowed. May be present only if warning_message is absent.

data_coding_scheme

Optional integer. Range 0 to 255. Data coding scheme. Must be present if warning_message_hex is present. If warning_message is used, its default value is set to 0x0f for GSM 7 bit encoding and 0x48 for UCS2 encoding.

concurrent_warning_message_ind

Optional boolean (default = false). Indicates that the warning message is a new message to be scheduled for concurrent broadcast with any other ongoing broadcast of warning messages.

send_warning_indication

Optional boolean (default = false). SBCAP interface: Gives the presence of Send Write Replace Warning Indication IE in the SBCAP message WRITE-REPLACE WARNING REQUEST. N50 interface: Gives the presence of sendRanResponse attribute the N50 message POST ../non-ue-n2-messages/transfer(N2InformationTransferReqData.

warning_area_list

Optional object. If present, the Warning Area List IE will be sent in the message WRITE-REPLACE WARNING REQUEST. It should contain one of the following objects:

cell_id_list

Optional array of objects (up to 65535). Each object must contain the following parameters:

plmn

String (5 or 6 digits).

cell_id

Integer. 28 bits long LTE cell identifier.

tai_list

Optional array of objects (up to 65535). Each object must contain the following parameters:

plmn

String (5 or 6 digits).

tac

Integer. 2 bytes long tracking area code.

emergency_area_id_list

Optional array of integers (up to 65535). 3 bytes long emergency area identifier.

warning_area_coordinates

Optional hexadecimal string. Maximum length 1024 bytes. Warning Area Coordinates octet string (CMAS only).

omc_id

Optional string. Maximum length 20 bytes. Identity of an Operation and Maintenance Centre.

enb

Optional object. Global eNB ID to send in the message WRITE-REPLACE WARNING REQUEST.

plmn

String (5 or 6 digits).

enb_type

Optional string (macro, home, short_macro or long_macro). Default value is "macro". Type of the global eNB ID.

enb_id

Integer. eNB ID.

tai_list

Optional array of objects (up to 65535). TAI List to sent in the message WRITE-REPLACE WARNING REQUEST. See tai_list.

warning_area_list_5gs

Optional object. 5GS Warning Area List to send in the message WRITE-REPLACE WARNING REQUEST. It should contain one of the following objects:

nr_cell_id_list

Optional array of objects (up to 65535). Each object must contain the following parameters:

plmn

String (5 or 6 digits).

cell_id

Integer. 36 bits long NR cell identifier.

tai_list

Optional array of objects (up to 65535). See tai_list_5gs.

emergency_area_id_list

Optional array of integers (up to 65535). 3 bytes long emergency area identifier.

tai_list_5gs

Optional array of objects (up to 65535). List of 5GS TAIs to send in the SBCAP message WRITE-REPLACE WARNING REQUEST or the N50 message POST ../non-ue-n2-messages/transfer(N2InformationTransferReqData). Each object must contain the following parameters:

tai_list_5gs

Array of objects. Each object must contain the following parameters:

plmn

String (5 or 6 digits).

tac

Integer. 3 bytes long tracking area code.

ran_node_id

Optional integer. Applicable to SBCAP interface only. Value of the global RAN node ID to send in the SBCAP message WRITE-REPLACE WARNING REQUEST. It should contain one of the following objects:

gnb

gNB identifier.

plmn

String (5 or 6 digits).

gnb_id_bits

Integer. Range 22 to 32. gNB ID length in bits.

gnb_id

Integer. The gNB global identifier.

ng_enb

ngENB identifier. See enb.

rat_selector_5gs

Optional boolean. Default value is false. Applicable to SBCAP interface only. Indicates the presence of RAT Selector 5GS IE in the message WRITE-REPLACE WARNING REQUEST.

n50_rat_selector

Optional enumeration: nr, eutra, both. Default value is both. Applicable to N50 interface only. Gives the value of ratSelector attribute in N2InformationTransferReqDataTransfer.

n50_ran_node_id_list

Optional array of objects. Applicable to N50 interface only. See ran_node_id. List of the global RAN node ID to send in the N50 message POST ../non-ue-n2-messages/transfer(N2InformationTransferReqData).

5.2.4 NAS special conformance testing options

The MME or AMF can automatically activate UE test mode during attachment and configure test loop mode A, B or G (see 3GPP TS 36.509 and 38.509 for details). Once the loop is closed, the user can transmit downlink IP packets to the UE that will be loopbacked in UL.

nas_test_procedure

Optional object allowing to configure the test procedure. It must contain the following objects:

test_loop_mode

Enumeration: none, a, b, g. Defines which test loop will be activated.

lb_setup_list

Optional array used for test loop mode A if UL PDCP SDU scaling is required. Each element of the array must contain the following 2 objects:

ul_pdcp_sdu_size

Integer (range 0 to 1520). UL PDCP SDU size in bytes.

drb_id

Integer (range 1 to 32). Data Radio Bearer identity on which the UL PDCP SDU scaling is applied.

ip_pdu_delay

Integer (range 0 to 255). Transmission delay in seconds of the EUTRA UL PDCP SDUs or NR UL SDAP SDUs when operating in test loop mode B.

operation_mode

Enumeration (upper or rlc). upper means that data is returned in uplink at the EMM entity. rlc means that data is returned in uplink at the RLC AM-SAP of SRB1bis for NB-IoT UE or at the RLC AM-SAP of SRB2 for E-UTRA UE. Used in test loop mode G.

repetitions

Integer (0 to 127). Number of repetitions of received content of received user data in downlink in uplink. Used in test loop mode G.

ul_data_delay

Integer (0 to 255). Uplink data delay in seconds. Used in test loop mode G.

5.2.5 Rx options

rx

Optional object allowing to configure the Rx options. It can contain the following objects:

bind_addr

Optional string. IP address and optional port on which the Rx SCTP connection is bound. The default address is the same as the S1AP SCTP connection and the default port is 3868.

qos

Optional object. It can contain 7 object properties: audio, video, application, data, control, text and message. Default QCI/5QI is 1 for audio, 2 for video and application, 6 for data and control, 8 for text and message. Each property contains the following fields:

qci

Integer (range 1 to 255). QoS Class Identifier of the E-RAB, or 5QI of the QoS flow.

5qi_qos

Optional object. See 5QI QoS.

origin_realm

Optional string. Defines the string sent in the Origin-Realm AVP for Rx messages. Default is set to mnc<MNC>.mcc<MCC>.3gppnetwork.org.

origin_host

Optional string. Defines the string sent in the Origin-Host AVP for Rx messages. Default is set to epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org.

reservation_priority

Optional array of 16 elements defining the S1AP ARP (Allocation and Retention Priority) parameters to be used for each Rx reservation priority level. If not present, priority_level is set to 15 (no priority), pre_emption_capability is set to shall_not_trigger_pre_emption and pre_emption_vulnerability is set to not_pre_emptable. If present the array must be ordered by increasing Rx priority level (from 0 to 15) and must contain the following fields:

priority_level

Range: 1 to 15. ARP priority level.

pre_emption_capability

Enumeration: shall_not_trigger_pre_emption or may_trigger_pre_emption.

pre_emption_vulnerability

Enumeration: not_pre_emptable or pre_emptable.

emergency

Optional object defining the QCI and ARP parameters to be used for the emergency dedicated EPS bearer context. If not present, qci is set to 1, priority_level is set to 1 (highest priority), pre_emption_capability is set to may_trigger_pre_emption and pre_emption_vulnerability is set to not_pre_emptable.

qci

Range: 1 to 255.

5qi_qos

Optional object. See 5QI QoS.

priority_level

Range: 1 to 15. ARP priority level.

pre_emption_capability

Enumeration: shall_not_trigger_pre_emption or may_trigger_pre_emption.

pre_emption_vulnerability

Enumeration: not_pre_emptable or pre_emptable.

5.2.6 S6a options

s6

Optional object allowing to configure the S6a options. It can contain the following objects:

server_addr

String. IP address and optional port of the HSS used for S6a interface. The default port is 3868.

bind_addr

Optional string. IP address and optional port on which the S6a SCTP connection is bound. The default address is the same as the S1AP SCTP connection.

origin_realm

Optional string. Defines the string sent in the Origin-Realm AVP for S6 messages. Default is set to mnc<MNC>.mcc<MCC>.3gppnetwork.org.

origin_host

Optional string. Defines the string sent in the Origin-Host AVP for S6 messages. Default is set to epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org.

transaction_timeout

Optional integer (range 1 to 15000, default = 2000). Defines the timeout in milliseconds for a transaction with the HSS.

watchdog_duration

Optional integer (range 0 to 36000000, default = 30000). Tw watchdog timer in milliseconds to send the Diameter Device Watchdog Request message. The value 0 deactives the watchdog.

5.2.7 EIR/S13 options

me_db

Optional object allowing to define a list of IMEI (14 digits without the last Check Digit one) or IMEISV (16 digits), and their status (whitelisted, blacklisted, greylisted). If not present, all devices are considered as whitelisted.
It can contain the following objects:

default_status

Enumeration (whitelisted, blacklisted, greylisted). Defines the default status for devices not explicitly defined in the next objects.

whitelist

Optional array. It contains a list of IMEI or IMEISV whitelisted.

blacklist

Optional array. It contains a list of IMEI or IMEISV blacklisted.

greylist

Optional array. It contains a list of IMEI or IMEISV greylisted.

Example:

  me_db: {
    default_status: "blacklisted",
    whitelist: [
      "01234567100000",
      "0123456700000001"
    ]
  }

s13

Optional object allowing to configure the S13 options. It can contain the following objects:

server_addr

String. IP address and optional port of the EIR used for S13 interface. The default port is 3868.

bind_addr

Optional string. IP address and optional port on which the S13 SCTP connection is bound. The default address is the same as the S1AP SCTP connection.

origin_realm

Optional string. Defines the string sent in the Origin-Realm AVP for S13 messages. Default is set to mnc<MNC>.mcc<MCC>.3gppnetwork.org.

origin_host

Optional string. Defines the string sent in the Origin-Host AVP for S13 messages. Default is set to epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org.

transaction_timeout

Optional integer (range 1 to 15000, default = 2000). Defines the timeout in milliseconds for a transaction with the EIR.

watchdog_duration

Optional integer (range 0 to 36000000, default = 30000). Tw watchdog timer in milliseconds to send the Diameter Device Watchdog Request message. The value 0 deactives the watchdog.

5.2.8 SGs options

sgs

Optional object allowing to configure the SGs options. It can contain the following objects:

csfb_allowed

Optional boolean (default = false). If set to true, Circuit Switched Fall back procedures are accepted, otherwise they are rejected.

lac

Optional integer (default = 0x001). Defines the Location Area Identifier of the MSC/VLR to connect to.

server_addr

String. IP address and optional port of the MSC/VLR used for SGs interface. The default port is 29118.

bind_addr

Optional string. IP address and optional port on which the SGs SCTP connection is bound. The default address is the same as the S1AP SCTP connection.

5.2.9 SBc options

sbcap_bind_addr

Optional string. IP address and optional port on which the SBc SCTP connection is bound. The default address is the same as the S1AP SCTP connection.

5.2.10 LCS options

lcs

Optional object allowing to configure the LCSAP interface options. It can contain the following objects:

server_addr

Optional string. IP address and optional port of the e-SMLC location server. The default port is 9082. If not present, the test e-SMLC located in the MME will be used.

bind_addr

Optional string. IP address and optional port on which the LCSAP SCTP connection is bound. The default address is the same as the S1AP SCTP connection.

local_e_smlc

Optional object used to configure an internal test e-SMLC located in the MME. The internal e-SMLC is not a real location server. It provides some apis useful for testing. It can contain the following objects:

lpp_test

Optional boolean (default = false). If set to true, the e-SMLC will use the LPP protocol. Otherwise, LPPa protocol will be used.

e_smlc_id

Optional integer in range 0 to 255 (default = 0). e-SMLC identifier.

transaction_id

Optional integer in range 0 to 32767 (default = 0). Transation identifier to use in the message LPPA E-CIDMeasurementInitiationRequest.

periodic_meas

Optional boolean (default = false). Indicates if periodic measurements will be requested in the message LPPA E-CIDMeasurementInitiationRequest.

meas_period

Optional integer in range 0 to 12 (default = 0), corresponding to [ms120, ms240, ms480, ms640, ms1024, ms2048, ms5120, ms10240, min1, min6, min12, min30, min60] according to the definition of MeasurementPeriodicity in 3GPP TS 36.455 MeasurementPeriodicity. Gives the measurement period to set in the message LPPA E-CIDMeasurementInitiationRequest in case of periodic measurements.

meas_id

Optional integer in range 1 to 15 (default = 1). Gives the value to use in the parameter E-SMLC-UE-Measurement-ID in the message LPPA E-CIDMeasurementInitiationRequest.

otdoa_assistance_data

Optional object. Gives the OTDOA assistance data needed to build the IE otdoa-ProvideAssistanceData in the message LPP Provide Assistance Data. See 3GPP TS 37.355 chapter 6.5.1.1 OTDOA Assistance Data. Note that prsInfo, expectedRSTD and tpId are not configurable for now and are hardcoded in the IE otdoa-ProvideAssistanceData.

ref_pci

Optional integer (default = 0). Gives the value of physCellId in otdoa-ReferenceCellInfo.

ref_earfcn

Optional integer (default = 0). Gives the value of earfcnRef in otdoa-ReferenceCellInfo.

neighbour

Optional array. Gives the description of the neighbour cells needed to build otdoa-NeighbourCellInfo. Each element of the array contains:

earfcn

Optional integer (default = 0). EARFCN of the neighbour cell.

pci

Optional integer (default = 0). PCI of the neighbour cell.

nr_tdoa_assistance_data

Optional array. Gives the NR-OTDOA assistance data needed to build the IE nr-DL-TDOA-ProvideAssistanceData-r16 in the message LPP Provide Assistance Data. See 3GPP TS 37.355 chapter 6.5.10.1 NR DL-TDOA Assistance Data. Note that the prs information is not configurable for now and is hardcoded in the IE nr-DL-TDOA-ProvideAssistanceData-r16. Each element of the array contains:

pointA_arfcn

Optional integer (default = 0). pointA-arfcn value in nr-DL-PRS-PositioningFrequencyLayer-r16.

cells

Optional array.

arfcn

Optional integer (default = 0). nr-ARFCN-r16 in nr-DL-PRS-AssistanceDataPerFreq-r16.

pci

Optional integer (default = 0). nr-PhysCellID-r16 in nr-DL-PRS-AssistanceDataPerFreq-r16.

5.2.11 N12 options

n12

Optional object allowing to configure the N12 interface options. It can contain the following objects:

api_root

Optional string. According to the definition in 3GPP TS 29.501, api_root is in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https". This field shall be present if an external AUSF is used.

transaction_timeout

Optional integer (range 1 to 15000, default = 3000). Defines the timeout in milliseconds for a transaction with the AUSF.

bind_addr

Optional string. IP address and optional port on which the N12 TCP connection is bound. The default address is the same as the GTP-U connection.

5.2.12 N13 options

n13

Optional object allowing to configure the N13 interface options. It can contain the following objects:

api_root

Optional string. According to the definition in 3GPP TS 29.501, api_root is in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https". This field shall be present if an internal AUSF is used with an external UDM.

transaction_timeout

Optional integer (range 1 to 15000, default = 3000). Defines the timeout in milliseconds for a transaction between the AUSF and UDM.

bind_addr

Optional string. IP address and optional port on which the N13 TCP connection is bound. The default address is the same as the GTP-U connection.

5.2.13 N8 options

n8

Optional object allowing to configure the N8 interface options. It can contain the following objects:

api_root

Optional string. According to the definition in 3GPP TS 29.501, api_root is in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https". This field shall be present if an external UDM is used.

transaction_timeout

Optional integer (range 1 to 15000, default = 3000). Defines the timeout in milliseconds for a transaction with the UDM.

bind_addr

Optional string. IP address and optional port on which the N8 TCP connection is bound. The default address is the same as the GTP-U connection.

5.2.14 N17 options

n17

Optional object allowing to configure the N17 interface options. It can contain the following objects:

api_root

Optional string. According to the definition in 3GPP TS 29.501, api_root is in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https". This field shall be present if an external 5G-EIR is used.

transaction_timeout

Optional integer (range 1 to 15000, default = 3000). Defines the timeout in milliseconds for a transaction with the 5G-EIR.

bind_addr

Optional string. IP address and optional port on which the N17 TCP connection is bound. The default address is the same as the GTP-U connection.

5.2.15 N20 options

n20

Optional object allowing to configure the N20 interface options. It can contain the following objects:

api_root

Optional string. According to the definition in 3GPP TS 29.501, api_root is in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https". This field shall be present if an external SMSF is used.

transaction_timeout

Optional integer (range 1 to 15000, default = 3000). Defines the timeout in milliseconds for a transaction with the SMSF.

bind_addr

Optional string. IP address and optional port on which the N20 TCP connection is bound. The default address is the same as the GTP-U connection.

5.2.16 N50 options

n50

Optional object allowing to configure the N50 interface options. It can contain the following objects:

transaction_timeout

Optional integer (range 1 to 15000, default = 3000). Defines the timeout in milliseconds for a transaction with the CBC.

server_bind_addr

Optional string. IP address and optional port on which the N50 TCP connection is bound. The default address is the same as the GTP-U connection and the default TCP port is 5558.

5.2.17 NL1 options

nl1

Optional object allowing to configure the NL1 interface options. It can contain the following objects:

api_root

Optional string. According to the definition in 3GPP TS 29.501, api_root is in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https". This field shall be present if an external LMF is used.

transaction_timeout

Optional integer (range 1 to 1800000, default = 20000). Defines the timeout in milliseconds for a transaction with the LMF.

server_bind_addr

Optional string. IP address and optional port on which the NL1 TCP connection is bound. The default address is the same as the GTP-U connection and the default TCP port is 5560.

lmf_cfg

Optional object used to configure an internal test LMF located in the AMF. The internal LMF is not a real location server. It provides some apis useful for testing. It can contain the following objects:

lpp_test

Optional boolean (default = false). If set to true, the LMF will use the LPP protocol. Otherwise, NRPPa protocol will be used.

transaction_id

Optional integer in range 0 to 32767 (default = 0). Transation identifier to use in the message NRPPa E-CIDMeasurementInitiationRequest.

periodic_meas

Optional boolean (default = false). Indicates if periodic measurements will be requested in the message NRPPa E-CIDMeasurementInitiationRequest.

meas_period

Optional integer in range 0 to 14 (default = 0), corresponding to [ms120, ms240, ms480, ms640, ms1024, ms2048, ms5120, ms10240, min1, min6, min12, min30, min60, ms20480, ms40960] according to the definition on MeasurementPeriodicity in 3GPP TS 38.455.

meas_id

Optional integer in range 1 to 256 (default = 1). LMF-UE-Measurement-ID in the message NRPPa E-CIDMeasurementInitiationRequest.

otdoa_assistance_data

See otdoa_assistance_data

nr_tdoa_assistance_data

See nr_tdoa_assistance_data

5.2.18 N5 options

The 5QI QoS settings are configured in the Rx options.

n5

Optional object allowing to configure the address and port of the PCF server. It can contain the following objects:

server_bind_addr

Optional string. IP address and optional port on which the N5 TCP connection is bound. The default address is the same as the GTP-U connection and the default TCP port is 5561.

5.2.19 N62 options

n62

Optional object allowing to configure the address and port of the AAnF server. It can contain the following objects:

server_bind_addr

Optional string. IP address and optional port on which the N62 TCP connection is bound. The default address is the same as the GTP-U connection and the default TCP port is 5563.

5.2.20 CP-EDT options

cp_edt

Optional object allowing to configure CP-EDT options. It can contain the following objects:

mode

Optional enumeration: disabled, forced, automatic. Default value is automatic. If disabled is set: CP-EDT feature is disabled in the core network. If forced is set: CP-EDT is processed by the core network whatever the NAS RAI received with UL data. If automatic is set: if NAS RAI indicates that downlink data is expected, CP-EDT is processed by the core network. Otherwise connection establishment is requested by the core network.

max_dl_len_nb

Optional integer. Default value is 85. Largest DL transport block (including user payload and MAC/RLC/RRC/NAS overhead) allowed without fallback to RRC connection establishment in NB-IoT.

5.2.21 ePDG options

epdg

Optional object allowing to configure ePDG options. It shall contain the following objects:

bind_addr

IP address on which the SWu connection is bound.

private_key

String. Defines the ePDG private key filename.

certificate

String. Defines the ePDG certificate filename. The default files epdg_private_key.pem and epdg_cert.pem are built for ePDG FQDN "epdg.epc.mnc001.mcc001.pub.3gppnetwork.org" following the procedure decribed below. For another ePDG FQDN, these files shall be re-built by setting the FQDN in subjectAltName field. Procedure to generate and check the private key file epdg_private_key.pem and the certificate file epdg_cert.pem:

      openssl genrsa -out ca.key 2048
      openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
      openssl req -newkey rsa:2048 -nodes -keyout epdg_private_key.pem -out epdg_cert.pem
      openssl x509 -req -extfile <(printf "subjectAltName=DNS:epdg.epc.mnc001.mcc001.pub.3gppnetwork.org") -days 3650 -in epdg_cert.pem -CA ca.crt -CAkey ca.key -CAcreateserial -out epdg_cert.pem
      openssl x509 -in epdg_cert.pem -text
      openssl rsa -in epdg_private_key.pem -text

esp_duration

Optional integer in range 10 to 5*3600 (default = 300). Gives the duration in seconds of the ESP-Sa.

ike_duration

Optional integer in range 20 to 48*3600 (default = 24*3600). Gives the duration in seconds of the IKE-Sa.

omit_auth_in_first_auth_rsp

Optional boolean (default = false). If set, configures the EPDG to not send the AUTH payload in the first IKE_AUTH exchange.

ike_encryption_algo_list

Optional list of IKE-Sa supported encryption algorithms "aes-cbc-128" (AES CBC 128 bits key length), "aes-cbc-192" (AES CBC 192 bits key length), "aes-cbc-256" (AES CBC 256 bits key length), "aes-gcm-128-16" (AES GCM 128 bits key length and 16 bytes ICV), "aes-gcm-256-16" (AES GCM 256 bits key length and 16 bytes ICV), "des", "3des", "blowfish", "aes-ctr-128" (AES CTR 128 bits key length), "aes-ctr-192" (AES CTR 192 bits key length), and aes-ctr-256 (AES CTR 256 bits key length) ordered from most preferred to least preferred.
Default value is ["aes-cbc-128", "aes-cbc-192", "aes-cbc-256", "aes-gcm-128-16", "aes-gcm-256-16", "des", "3des", "blowfish", "aes-ctr-128", "aes-ctr-192", "aes-ctr-256"].

ike_integrity_algo_list

Optional list of IKE-Sa supported integrity algorithms "hmac-sha-1-96", "hmac-sha-1-160", "hmac-sha-256-128", "hmac-sha-384-192, "hmac-sha-512-256", "hmac-md5-96", "hmac-md5-128" and "aes-cmac-96" ordered from most preferred to least preferred.
Default value is ["hmac-sha-1-96", "hmac-sha-1-160", "hmac-sha-256-128", "hmac-sha-384-192", "hmac-sha-512-256", "hmac-md5-96", "hmac-md5-128", "aes-cmac-96"];

ike_prf_list

Optional list of IKE-Sa supported pseudo-random functions "prf-hmac-sha1", "prf-hmac-sha2-256", "prf-hmac-sha2-384", "prf-hmac-sha2-512" and "prf-hmac-md5" ordered from most preferred to least preferred.
Default value is ["prf-hmac-sha1", "prf-hmac-sha2-256", "prf-hmac-sha2-384, "prf-hmac-sha2-512", "prf-hmac-md5"].

ike_dh_group_list

Optional list of IKE-Sa supported Diffie-Hellman groups "group_1", "group_2", "group_5", "group_14", "group_15", "group_16", "group_17", "group_18", "group_19", "group_22", "group_23" and "group_24" ordered from most preferred to least preferred.
Default value is ["group_5", "group_14", "group_15", "group_16", "group_17", "group_18", "group_19", "group_22", "group_23" and "group_24"].

esp_encryption_algo_list

Optional list of ESP-Sa supported encryption algorithms "null", "aes-cbc-128" (AES CBC 128 bits key length), "aes-cbc-192" (AES CBC 192 bits key length), "aes-cbc-256" (AES CBC 256 bits key length), "aes-gcm-128-16" (AES GCM 128 bits key length and 16 bytes ICV), "aes-gcm-192-16" (AES GCM 192 bits key length and 16 bytes ICV), "aes-gcm-256-16" (AES GCM 256 bits key length and 16 bytes ICV),"des", "3des", "blowfish", "aes-ctr-128" (AES CTR 128 bits key length), "aes-ctr-192" (AES CTR 192 bits key length), aes-ctr-256 (AES CTR 256 bits key length), "encr-null-auth-aes-gmac-128" (ENCR_NULL_AUTH_AES_GMAC 128 bits key length), "encr-null-auth-aes-gmac-192" (ENCR_NULL_AUTH_AES_GMAC 192 bits key length) and "encr-null-auth-aes-gmac-256" (ENCR_NULL_AUTH_AES_GMAC 256 bits key length) ordered from most preferred to least preferred.
Default value is ["null", "aes-cbc-128", "aes-cbc-192", "aes-cbc-256", "aes-gcm-128-16", "aes-gcm-192-16", "aes-gcm-256-16", "des", "3des", "blowfish", "aes-ctr-128", "aes-ctr-192", "aes-ctr-256", "encr-null-auth-aes-gmac-128", "encr-null-auth-aes-gmac-192", "encr-null-auth-aes-gmac-256"].

esp_integrity_algo_list

Optional list of ESP-Sa supported integrity algorithms "null", "hmac-sha-1-96", "hmac-sha-1-160", "hmac-sha-256-128", "hmac-sha-384-192, "hmac-sha-512-256", "hmac-md5-96", "hmac-md5-128" and "aes-cmac-96" ordered from most preferred to least preferred.
Default value is ["null", "hmac-sha-1-96", "hmac-sha-1-160", "hmac-sha-256-128", "hmac-sha-384-192", "hmac-sha-512-256", "hmac-md5-96", "hmac-md5-128", "aes-cmac-96"].

esp_dh_group_list

Optional list of ESP-Sa supported Diffie-Hellman groups "none", "group_1", "group_2", "group_5", "group_14", "group_15", "group_16", "group_17", "group_18", "group_19", "group_22", "group_23" and "group_24"ordered from most preferred to least preferred.
This list is used for rekeying ESP-Sa. Default value is ["none", "group_5", "group_14", "group_15", "group_16", "group_17", "group_18", "group_19", "group_22", "group_23" and "group_24"].

dpd_timer_value

Optional integer in range 5 to 300 (default = 300). Gives the "dead peer detection" timer value in seconds.

mobike

Optional boolean (default = true). Indicates MOBIKE support.

ike_generate_error

Optional object. Allows to ignore a message or generate an error during the initial exchanges.
It contains the following objects:

exchange

String. Gives the exchange to ignore or on which the error must be sent. Possible values are "none", "ike_sa_init", "ike_auth_step1", "ike_auth_step2", "ike_auth_step3", "dpd", "mobike".

error

Optional integer. Gives the value of ’Notify Message Type’ to send in the Notify payload rejecting the exchange.
It present, the message received during the exchange will be rejected.
If absent, the message received during the exchange will be ignored.

data

Optional hexadecimal string. May be present if error is present.
Gives the Notification Data to send in the Notify payload.
Applicable only to the following exchanges: "ike_sa_init", "ike_auth_step1", "ike_auth_step2" and "ike_auth_step3".

ttl

Optional integer. If set, ike_generate_error is applied ttl times. If not set, ike_generate_error is applied until it is modified.

Example:

  ike_generate_error: {
  error: 9002,
  data: "1234",
  ttl: 1,
  exchange: "ike_auth_step1"
  }

idr_for_emergency

Optional string (default = "EMERGENCY"). Name of the APN for emergency.

dont_fragment

Optional boolean (default = true) used to enable/disable the fragmentation of the ESP packets.

additional_ue_auth_type

Optional enumeration: none, pap, chap (default = none). Defines the authentication mechanism used for the additionnal UE authentication as described in 3GPP 33.402 chapters 6.5.2 and 6.5.3.
If present and not set to none:
MULTIPLE_AUTH_SUPPORTED notify payload will be sent by the ePDG in the message IKE_SA_INIT response (see 3GPP 33.402 chapter 6.5), and username (See username) and password (See password) must be configured in pdn_list to perform the authentication and authorization for a given APN.

6 Remote API

You can access LTEMME via a remote API.
Protocol used is WebSocket as defined in RFC 6455 (https://tools.ietf.org/html/rfc6455).

Note that Origin header is mandatory for the server to accept connections.
This behavior is determined by the use of nopoll library.
Any value will be accepted.

6.1 Messages

Messages exchanged between client and LTEMME server are in strict JSON format.

Each message is represented by an object. Multiple message can be sent to server using an array of message objects.

Time and delay values are floating number in seconds.

There are 3 types of messages:

• Request

  Message sent by client.
  Common definition:

  message

  String. Represent type of message. This parameter is mandatory and depending on its value, other parameters will apply.
  

  message_id

  Optional any type. If set, response sent by the server to this message will have same message_id. This is used to identify response as WebSocket does not provide such a concept.

  start_time

  Optional float. Represent the delay before executing the message.
  If not set, the message is executed when received.
  

  absolute_time

  Optional boolean (default = false). If set, start_time is interpreted as absolute.
  You can get current clock of system using time member of any response.

  standalone

  Optional boolean (default = false). If set, message will survive WebSocket disconnection, else, if socket is disconnected before end of processing, the message will be cancelled.

  loop_count

  Optional integer (default = 0, max = 1000000). If set, message will be repeated loop_count time(s) after loop_delay (From message beginning of event).
  Response will have a loop_index to indicate iteration number.

  loop_delay

  Optional number (min = 0.1, max = 86400). Delay in seconds to repeat message from its start_time. Mandatory when loop_count is set > 0.

• Response

  Message sent by server after any request message as been processed.
  Common definition:

  message

  String. Same as request.

  message_id

  Optional any type. Same as in request.

  time

  Number representing time in seconds since start of the process.
  Usefull to send command with absolute time.

  utc

  Number representing UTC seconds.

• Events

  Message sent by server on its own initiative.
  Common definition:

  message

  String. Event name.

  time

  Number representing time in seconds.
  Usefull to send command with absolute time.

6.2 Startup

When WebSocket connections is setup, LTEMME will send a first message with name set to com_name and type set to MME.

If authentication is not set, message will be ready:

{
    "message": "ready",
    "type": "MME",
    "name": <com_name>,
    "version": <software version>,
    "product": <Amarisoft product name (optional)>
}

If authentication is set, message will be authenticate :

{
    "message": "authenticate",
    "type": "MME",
    "name": <com_name>,
    "challenge": <random challenge>
}

To authenticate, the client must answer with a authenticate message and a res parameter where:

res = HMAC-SHA256( "<type>:<password>:<name>", "<challenge>" )

res is a string and HMAC-SHA256 refers to the standard algorithm (https://en.wikipedia.org/wiki/HMAC)

If the authentication succeeds, the response will have a ready field set to true.

{
    "message": "authenticate",
    "message_id": <message id>,
    "ready": true
}

If authentication fails, the response will have an error field and will provide a new challenge.

{
    "message": "authenticate",
    "message_id": <message id>,
    "error": <error message>,
    "type": "MME",
    "name: <name>,
    "challenge": <new random challenge>
}

If any other message is sent before authentication succeeds, the error "Authentication not done" will be sent as a response.

6.3 Errors

If a message produces an error, response will have an error string field representing the error.

6.4 Sample nodejs program

You will find in this documentation a sample program: ws.js.
It is located in doc subdirectory.
This is a nodejs program that allow to send message to LTEMME.
It requires nodejs to be installed:

dnf install nodejs npm
npm install nodejs-websocket

Use relevant package manager instead of NPM depending on your Linux distribution.

Then simply start it with server name and message you want to send:

./ws.js 127.0.0.1:9000 '{"message": "config_get"}'

6.5 Common messages

config_get

Retrieve current config.

Response definition:

type

Always "MME"

name

String representing server name.

logs

Object representing log configuration.
With following elements:

layers

Object. Each member of the object represent a log layer configuration:

layer name

Object. The member name represent log layer name and parameters are:

level

See log_options

max_size

See log_options

key

See log_options

crypto

See log_options

payload

See log_options

verbose

Optional boolean. See log_options

count

Number. Number of bufferizer logs.

rotate

Optional number. Max log file size before rotation.

path

Optional string. Log rotation path.

bcch

Boolean. True if BCCH dump is enabled (eNB only).

mib

Boolean. True if MIB dump is enabled (eNB only).

locked

Optional boolean. If true, logs configuration can’t be changed with config_set API.

config_set

Change current config.
Each member is optional.
Message definition:

logs

Optional object. Represent logs configuration. Same structure as config_get (See config_get logs member).
All elements are optional.
Layer name can be set to all to set same configuration for all layers.
If set and logs are locked, response will have logs property set to locked.

relative_capacity

Optional integer (range 0 to 255). Set the MME or AMF relative capacity value used for MME or AMF load balancing in S1AP S1 Setup Response, MME Configuration Update, NGAP NG Setup Response and NGAP AMF Configuration Update messages.

attach_reject_error

Optional integer (range 0 to 255).
Force value of EMM reject cause in NAS attach reject message.

tracking_area_update_reject_error

Optional integer (range 0 to 255).
Force value of EMM reject cause in NAS tracking area update reject message.

service_reject_error

Optional integer (range 0 to 255).
Force value of EMM reject cause in NAS service reject message.

pdn_connect_reject_error

Optional integer (range 0 to 255).
Force value of ESM reject cause in NAS PDN connectivity reject message.

pdn_disconnect_reject_error

Optional integer (range 0 to 255).
Force value of ESM reject cause in NAS PDN disconnect reject message.

bearer_resource_allocation_reject_error

Optional integer (range 0 to 255).
Force value of ESM reject cause in NAS bearer resource allocation reject message.

bearer_resource_modification_reject_error

Optional integer (range 0 to 255).
Force value of ESM reject cause in NAS bearer resource modification reject message.

registration_initial_reject_error

Optional integer (range 0 to 255).
Force value of 5GMM reject cause in NAS registration reject message (for 5GS registration type 1 or 4).

registration_mobility_periodic_error

Optional integer (range 0 to 255).
Force value of 5GMM reject cause in NAS registration reject message (for 5GS registration type 2 or 3).

5gs_service_reject_error

Optional integer (range 0 to 255).
Force value of 5GMM reject cause in NAS service reject message.

pdu_session_establishment_reject_error

Optional integer (range 0 to 255).
Force value of 5GSM reject cause in NAS PDU session establishment reject message.

pdu_session_release_reject_error

Optional integer (range 0 to 255).
Force value of 5GSM reject cause in NAS PDU session release reject message.

pdu_session_modification_reject_error

Optional integer (range 0 to 255).
Force value of 5GSM reject cause in NAS PDU session modification reject message.

5gmm_dl_nas_transport_error

Optional integer (range 0 to 255).
Force value of 5GMM reject cause in NAS DL NAS transport message.

eps_user_unknown_reject_cause

Optional integer (range 0 to 255).
EMM cause sent in the NAS attach reject message when the IMSI is unknown in the HSS.

5gs_user_unknown_reject_cause

Optional integer (range 0 to 255).
5GMM cause sent in the NAS registration reject message when the SUPI is unknown in the UDM.

attach_reject_filter

Optional object. Represent UE to reject when trying to attach.
Each property name represent IMSI. Use of wildcard "*" with an IMSI prefix is allowed to match IMSI range (Ex: 0010112456*). If multiple filters are matching, the one with the longest prefix will be used.
Each property value may be:

null

Removes redirection matching IMSI

integer

Defines redirection type as described in rrc_redirect eNB configuration.

string

Defines PLMN to redirect to

t3402

Optional integer. Value in seconds of the T3402 or T3502 timer. -1 means that the timer value is not transmitted in attach accept or TAU accept or registration accept so that the UE uses the default value (12 minutes).

t3412

Optional integer. Value in seconds of the T3412 (TAU update) timer. -1 means that the timer is deactivated.

t3412_low_priority

Optional integer. Value in seconds of the T3412 (TAU update) timer if the UE indicates NAS signalling low priority. -1 means that the timer is deactivated.

t3512

Optional integer. Value in seconds of the T3512 (periodic registration) timer. -1 means that the timer is deactivated. This is the value sent to the UE in NAS signalling, unless the UE is requesting the use of a longer timeout with requested T3512 value information element.

t3501

Optional integer in range 1-30 (default = 5). Value in seconds of the MANAGE UE POLICY COMMAND timer in the PCF.

n3gpp_dereg_timer

Optional integer. Value in seconds of the non-3GPP de-registration timer. This is the value sent to the UE in NAS signalling.

psm

Option boolean. If set to false, MME will ignore the PSM request sent by the UE.

mico_support

Optional boolean. If set to false, AMF will ignore the MICO request sent by the UE.

registration_area_alloc_ind

Optional ingeger. Sets the Registration Area Allocation Indication bit in the 5GMM MICO indication IE. 0 means ’all PLMN registration area not allocated’ and 1 means ’all PLMN registration area allocated’.

sprt_support

Optional boolean. If set to true and if mico_support is set to true, the AMF will accept the use of the strictly periodic registration timer.

t3412_extended_forced

Optional integer. Value in seconds of the T3412 extended timer if UE uses PSM. If different from -1, the MME will ignore the value requested by the UE and will send this one instead.

force_t3412_extended_ie

Optional boolean. If set to false, the MME selects the greatest T3412 value between the one configured in the MME and the one requested by the UE for PSM (unless t3412_extended_forced is set), and it does not send the T3412 extended IE if the value can be encoded as a GPRS timer IE. If set to true, the MME accepts a T3412 value requested by the UE smaller than the configured one, and the T3412 extended IE is always sent.

requested_t3512_forced

Optional integer. Value in seconds of the T3512 timer if UE uses MICO. If greater than -1, the AMF will ignore the value requested by the UE and will send this one instead. If set to -2, the AMF will accept a T3512 value requested by the UE smaller than the configured one.

t3324_forced

Optional integer. Value in seconds of the T3324 timer if UE uses PSM. If different from -1, the MME will ignore the value requested by the UE and will send this one instead. -2 means that the timer is deactivated.

t3346

Optional integer. Value in seconds of the T3346 timer. The timer is transmitted in the reject messages if the EMM of 5GSM cause is #22 (congestion) and the value is not -1.

t3442

Optional integer. Value in seconds of the T3442 timer.

t3448

Optional integer. Value in seconds of the T3448 timer. The timer is transmitted if the value is different from -1 and the UE indicates its support in the UE network capability information element.

t3460

Optional integer. Value in seconds of the T3460 or T3560 timer.

t3460_wb_s1_ce

Optional integer. Value in seconds of the T3460 timer for UE operating in WB-S1/CE mode.

5gmm_backoff_timer

Optional integer. Value in seconds of the 5GMM DL NAS transport back-off timer. The timer is transmitted if the value is not -1. -2 means that the timer is deactivated.

edrx

Option boolean. If set to false, MME will ignore the eDRX request sent by the UE.

edrx_ptw_wb_s1

Optional integer. 4 bits Paging Time Window length for WB-S1 UEs as defined in 3GPP TS 24.008 chapter 10.5.5.32.

edrx_ptw_nb_s1

Optional integer. 4 bits Paging Time Window length for NB-S1 UEs as defined in 3GPP TS 24.008 chapter 10.5.5.32.

edrx_ptw_nr

Optional integer (0 to 31, default = 3). 8 bits Paging Time Window length for NR connected to 5GCN UEs as defined in 3GPP TS 24.008 chapter 10.5.5.32.

edrx_cycle_forced

Optional integer. 4 bits E-UTRAN eDRX cycle length duration as defined in 3GPP TS 24.008 chapter 10.5.5.32. If different from -1, the MME will ignore the value requested by the UE and will send this one instead.

gwus_support

Optional boolean. Group WUS support.

gwus_prob_forced

Optional enumeration: -1, 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, 100. Force group WUS paging probability for all the UEs. The MME will ignore the value requested by the UE and will send this one instead.

ims_vops_eps

Optional boolean. Set the IMS voice over PS session in S1 mode supported bit of the EPS network feature support field in the NAS attach accept message (VoLTE).

ims_vops_5gs_3gpp

Optional boolean. Set the IMS voice over PS session over 3GPP access indicator of the 5GS network feature support IE of the NAS registration access message. See 3GPP TS 24.501 table 9.11.3.5.1.

ims_vops_5gs_n3gpp

Optional boolean. Set the IMS voice over PS session over non-3GPP access indicator of the 5GS network feature support IE of the NAS registration access message. See 3GPP TS 24.501 table 9.11.3.5.1.

emc_bs

Optional boolean. Set the emergency bearer services in S1 mode supported bit of the EPS network feature support field in the NAS attach accept message (VoLTE, Release 9).

emc

Optional integer. Set the emergency service support indicator for 3GPP access bits of the 5GS network feature support IE in the NAS registration accept message.

emc_n3gpp

Optional boolean. Set the emergency service support indicator for non-3GPP access bits of the 5GS network feature support IE in the NAS registration accept message. See 3GPP TS 24.501 table 9.11.3.5.1.

emf

Optional integer. Set the emergency service fallback indicator for 3GPP access bits of the 5GS network feature support IE in the NAS registration accept message.

epc_lcs

Optional boolean. Set the Location services indicator via EPC supported bit of the EPS network feature support field in the NAS attach accept message.

5gs_sms_over_nas

Optional boolean. Defines if 5GC should indicate the support of SMS over NAS in the 5GMM registration accept message, if the UE indicated its support in the 5GMM registration request message.

emergency_number_list

Optional array of objects. Defines a list of emergency numbers to be sent to the UE in the NAS Attach Accept, Tracking Area Update Accept or Registration Accept messages.
To clear the current emergency number list, the array must be empty.
To configure an emergency number list, each object must contain the following parameters:

category

Integer. Bitmask of the category bits as defined in 3GPP TS 24.008 table 10.5.135d (bit 1: police, bit 2: ambulance, bit 3: fire brigade, bit 4: marine guard, bit 5: mountain rescue).

digits

String. Emergency number.

extended_emergency_number_list

Optional object. Defines a list of extended emergency numbers to be sent to the UE in the NAS Attach Accept, Tracking Area Update Accept or Registration Accept messages.
The object must contain the following parameters:

validity

Optional enumeration (country or plmn).
Validity of the extended emergency number list.
Must be present if emergency_numbers is not empty.

emergency_numbers

Array of objects. To clear the current extended emergency number list, the array must be empty.
To configure an extended emergency number list, each object must contain the following parameters:

digits

String. Emergency number.

sub_services

Optional string. Emergency number sub-services.

cp_ciot_opt

Optional boolean. If true, enable control plane CIoT optimization (if supported by the UE).

attach_without_pdn

Optional boolean. If true, enable attach without PDN functionality (if supported by the UE).

fifteen_bearers

Optional boolean. If true, enable the use of 15 EPS radio bearers (if supported by the UE).

attach_result_mode

Optional string. Set attach result of attach accept message.
Can be:

auto

This is standard LTE behavior.

eps_only

If set and UE is sending combined EPS/IMSI attach, the MME will answer with EPS only in attach accept message (EMM cause will be CS domain not available).

combined

If set and UE is sending EPS only attach, the MME will answer with combined in attach accept message.

additional_update_result

Optional integer. Set the value of additional update result in NAS attach accept and tracking area update accept messages.
If set to -1, the additional update result won’t be set.

network_policy

Optional integer (range -1 to 15). Set the value of the network policy information element described in 3GPP TS 24.301 chapter 9.9.3.52. The value -1 means that the IE is not transmitted.

authentication_mode

Optional string. Set NAS authentication procedure behavior.
Can be:

auto

The MME or AMF performs authentication procedure unless the UE is already successfully authentified.

force

The MME or AMF forces a new NAS authentication procedure even if the Attach Request or Registration Request was already successfully authentified

skip

The MME or AMF skips the NAS authentication procedure and uses EIA0/EEA0 or 5G-IA0/5G-EA0 algorithms. This needs to be supported on UE side also.

dummy_authentication_autn_mac

Optional boolean. If set to true, the network will send an invalid AUTN MAC value in the NAS authentication request message.

authenticate_known_emergency_supi

Optional boolean. If set to true, the network will authenticate known IMSI/SUPI during an emergency registration procedure and reject the UE if it fails.

skip_smc_proc

Optional boolean. If set to true, the MME or AMF will not perform a NAS security mode control procedure and will send all messages as plain. This needs to be supported on UE side also.

force_identity_request

Optional boolen. If set to true, the network will perform a NAS identity request procedure even if the GUTI in the attach request or the 5G-GUTI in the initial registration request is already known.

force_guti_in_tau

Optional boolean. If set to true, GUTI IE will be systematically present in Tracking Area Update Accept message.

emm_procedure_filter

Optional object. Allows to define the MME behavior for a list of EMM procedures.
Each property name represents an EMM procedure. The ones currently supported are attach, tracking_area_updating, detach, service_request, identity, authentication, security_mode_control and nas_transport.
Each property value is an object containing the following fields:

action

Enumeration (treat (UE message is processed), ignore (UE message is ignored) or reject (UE message is rejected))

ttl

Optional integer. If set, the reject of ignore filter is applied ttl times. If not set, the filter is applied until it is modified.

Example:

emm_procedure_filter: {
    attach: {
        action: "treat"
    },
    service_request: {
        action: "reject",
        ttl: 1
    }
}

5gmm_procedure_filter

Optional object. Allows to define the AMF behavior for a list of 5GMM procedures.
Each property name represents a 5GMM procedure. The ones currently supported are registration_initial, registration_initial_with_security_protection, registration_mobility_periodic, service_request, identity, authentication, security_mode_control, generic_ue_update_command, nas_transport_n1_sm, nas_transport_sms and deregistration.
Each property value is an object containing the following fields:

action

Enumeration (treat (UE message is processed), ignore (UE message is ignored) or reject (UE message is rejected))

ttl

Optional integer. If set, the reject of ignore filter is applied ttl times. If not set, the filter is applied until it is modified.

Note that nas_transport_n1_sm filter must be used together with the apply_nas_transport_n1_sm_filter DNN parameter.

Example:

"5gmm_procedure_filter": {
    registration_initial: {
        action: "treat"
    },
    service_request: {
        action: "reject",
        ttl: 1
    }
}

nr_support

Optional boolean. Set it to true to enable Dual Connectivity with NR support.

dcnr_implicit_support

Optional boolean. If set to true, the MME will not send the 2nd byte of the EPS network feature support IE because of DCNR. Can be useful to test the UE behavior.

ecc_params

Optional object. Set the ECC network configuration for the SUPI protection and de-concealment of the SUCI. Applicable to 5GC only. It contains the following objects:

A

Optional array of objects. Set the home network private key for profile A protection scheme.

home_nw_private_key

String. Set the home network private key;

home_nw_key_id

Optional integer in range 0 to 255 (default = 1). Set the home network key identifier.

B

Optional array of objects. Set the home network private key for profile B protection scheme.

home_nw_private_key

String. Set the home network private key;

home_nw_key_id

Optional integer in range 0 to 255 (default = 2). Set the home network key identifier.

nssai_inclusion_mode

Applicable to 5GC only. Optional enumeration (none, A, B, C, D). NSSAI inclusion mode value to send in message Registration accept.

cp_edt

Optional object allowing to configure CP-EDT options. It can contain the following objects:

mode

Optional enumeration: disabled, forced, automatic. Default value is automatic. If disabled is set: CP-EDT feature is disabled in the core network. If forced is set: CP-EDT is processed by the core network whatever the NAS RAI received with UL data. If automatic is set: if NAS RAI indicates that downlink data is expected, CP-EDT is processed by the core network. Otherwise connection establishment is requested by the core network.

max_dl_len_nb

Optional integer. Default value is 85. Largest DL transport block (including user payload and MAC/RLC/RRC/NAS overhead) allowed without fallback to RRC connection establishment in NB-IoT.

epdg

Applicable to EPC only. Optional object allowing to configure ePDG options. It may contain the following object:

esp_duration

Optional integer in range 10 to 5*3600). Gives the duration in seconds of the ESP-Sa.

ike_duration

Optional integer in range 20 to 48*3600. Gives the duration in seconds of the IKE-Sa.

ike_generate_error

Optional object. Allows to ignore a message or generate an error during the initial exchanges.
It contains the following objects:

exchange

String. Gives the exchange to ignore or on which the error must be sent. Possible values are "none", "ike_sa_init", "ike_auth_step1", "ike_auth_step2", "ike_auth_step3".

error

Optional integer. Gives the value of ’Notify Message Type’ to send in the Notify payload rejecting the exchange.
It present, the message received during the exchange will be rejected.
If absent, the message received during the exchange will be ignored.

mobike

Optional boolean. Indicates MOBIKE support.

dont_fragment

Optional boolean (default = TRUE) used to enable/disable the fragmentation of the ESP packets.

additional_ue_auth_type

Optional enumeration: none, pap, chap. Defines the authentication mechanism used for the additional UE authentication as described in 3GPP 33.402 chapters 6.5.2 and 6.5.3.

pdn_list

Optional array of object. Each object can contain the following properties:

apn

String. APN allowing to identify the PDN or PDU session to be modified.

operator

Optional array of objects. Each element defines an operator reserved container in protocol configuration.

Properties of each element:

id

Integer. Container identifier, must be between 0xff00 and 0xffff as defined in 3GPP TS 24.008.

plmn

String. PLMN info of container.

value

String. Value to send in hexadecimal string format.

force

Optional boolean. If true, container will be sent event without request (false by default).

serving_plmn_rate_control

Optional integer (range 0 to 65535). Defines the serving PLMN rate control IE content when PDN is used with control plane CIoT optimization only. If the value configured is less than 10, the IE is not transmitted.

apn_rate_control_params

Optional object. If defined, and if the UE indicates APN rate control parameters support in its protocol configuration options, the following parameters will be sent in Core Network protocol configuration options:

additional_exception_report

Boolean. Indicates if exception reports are allowed once the limit is reached.

ul_time_unit

Enumeration: unrestricted, minute, hour, day or week.

max_ul_rate

Integer (range from 0 to 16777215). Number of messages allowed to be sent per ul_time_unit.

additional_apn_rate_control_exception_data_params

Optional object. If defined, and if the UE indicates additional APN rate control for exception data parameters support in its protocol configuration options, the following parameters will be sent in Core Network protocol configuration options:

ul_time_unit

Enumeration: unrestricted, minute, hour, day or week.

max_ul_rate

Integer (range from 0 to 65535). Number of messages allowed to be sent per ul_time_unit.

backoff_timer

Optional integer. Value in seconds of the T3396/T3584/T3585 timers. The timer is transmitted in the ESM and 5GSM reject messages if the value is not -1. -2 means that the timer is deactivated.

re_attempt_ind

Optional integer (range -1 to 255). Value of octet 3 of the Re-attempt indicator information element, as specified in 3GPP TS 24.301 chapter 9.9.4.13A and 3GPP TS 24.501 chapter 9.11.4.17. The value -1 means that the information element is not sent.

ipv6_router_lifetime

Optional integer (range 0 to 65535). IPv6 Router Advertisement router lifetime in seconds.

ipv6_valid_lifetime

Optional integer. IPv6 Router Advertisement valid lifetime in seconds.

ipv6_pref_lifetime

Optional integer (default is ipv6_valid_lifetime value). IPv6 Router Advertisement preferred lifetime in seconds.
Must not be greater than ipv6_valid_lifetime.

ipv6_onlink_flag

Optional boolean. Defines IPv6 Router Advertisement on-link flag state.

ipv6_managed_addr_config_flag

Optional boolean. Defines IPv6 Router Advertisement managed address configuration flag state.

ipv6_other_config_flag

Optional boolean. Defines IPv6 Router Advertisement other configuration flag state.

ipv6_ra_transmission_interval

Optional integer (range -1 to 1800). Time in seconds between 2 periodical multicast Router Advertisement transmission, once the initial 3 transmissions have been performed after opening the PDN or PDU session. The value -1 means that no multicast transmission is done at all (including the 3 initial ones). The value 0 means that periodical transmission is deactivated.

ipv6_send_dns_in_ra

Optional boolean. Defines whether Router Advertisement message should contain the configured IPv6 DNS servers address or not.

ipv6_drop_rs

Optional boolean. Defines whether the incoming Router Solicitation messages should be dropped by the MME and UPF or not.

automatic_release

Optional boolean. If set, when the last associated dedicated EPS bearer is released the MME releases the default EPS bearer. With 5GS, when the last non default QoS flow is released, the SMF releases the PDU session.

allow_multiple_pdn_connections

Optional boolean. If set, a UE can create multile PDN connections to this APN.

ue_initiated_modification

Optional boolean. If set, the UE can request the modification of a bearer, otherwise the request is rejected.

ip_src_violation_limit

Optional integer. If greater than -1, the MME or UPF checks the IP source address of uplink packets. When ip_src_violation_limit packets are received, the PDN or PDU session is released. The value 0 means that the packets are dropped without triggering a release.

integrity_protection

Optional enumeration (disabled, preferred, required, default = disabled). Defines whether integrity should be used for the PDN connection / PDU session or not.
For EPC, if the value is set to preferred, the EPC will activate integrity protection based on the UE capabilities. If set to required, and if the UE does not support integrity protection, the request will be rejected with ESM cause 30.
For 5GC, if the value is set to preferred, the 5GC will activate integrity protection based on the UE capabilities and the configured PDU session AMBR. If set to required, and if the UE does not support integrity protection for the bitrate configured in the PDU session AMBR, the request will be rejected with 5GSM error cause #82.

dns_addr

Optional string or array of strings. IPv4 or IPv6 addresses of the DNS servers. Use an empty array to remove any previously configured DNS servers.

p_cscf_addr

Optional string or array of strings. IPv4 or IPv6 addresses of the P-CSCF servers (VoLTE). Use an empty array to remove any previously configured P-CSCF servers.

The following parameters are applicable to EPC only:

esm_procedure_filter

Optional object. Allows to define the MME behavior for a list of ESM procedures.
Each property name represents an ESM procedure. The ones currently supported are pdn_connectivity, pdn_disconnect, bearer_resource_allocation and bearer_resource_modification.
Each property value is an object containing the following fields:

action

Enumeration (treat (UE message is processed), ignore (UE message is ignored) or reject (UE message is rejected))

ttl

Optional integer. If set, the reject of ignore filter is applied ttl times. If not set, the filter is applied until it is modified.

ignore does not apply to procedure pdn_connectivity performed during the attach procedure.

Example:

  esm_procedure_filter: {
      pdn_connectivity: {
          action: "treat"
      },
      bearer_resource_allocation: {
          action: "reject",
          ttl: 1
      }
  }

The following parameters are applicable to 5GC only:

5gsm_procedure_filter

Optional object. Allows to define the SMF behavior for a list of 5GSM procedures.
Each property name represents a 5GSM procedure. The ones currently supported are pdu_session_establishment, pdu_session_release and pdu_session_modification.
Each property value is an object containing the following fields:

action

Enumeration (treat (UE message is processed), ignore (UE message is ignored) or reject (UE message is rejected))

ttl

Optional integer. If set, the reject of ignore filter is applied ttl times. If not set, the filter is applied until it is modified.

Example:

  "5gsm_procedure_filter": {
      pdu_session_establishment: {
          action: "treat"
      },
      pdu_session_modification: {
          action: "reject",
          ttl: 1
      }
  }

always_on

Optional enumeration (auto, required, not_allowed, default = auto). Defines the always-on behavior for the PDU session. If the value is set to auto, the 5GC will follow whatever is requested by the UE. If the value is set to required, the 5GC will always set the PDU session as always-on required. If the value is set to not_allowed, the 5GC will always set the PDU session as always-on not allowed.

confidentiality_protection

Optional enumeration (disabled, required). Defines if confidentiality must be used for the PDU session or not.

apply_nas_transport_n1_sm_filter

Optional boolean. Indicates whether the 5GMM procedure filter nas_transport_n1_sm should apply to this DNN or not.

eps_5gs_interworking

Optional boolean. If set to true, interworking between EPS and 5GS is allowed for this APN/DNN. Otherwise it is forbidden.

5gsm_congestion_re_attempt_ind

Optional integer (range -1 to 255). Value of octet 3 of the Re-attempt indicator information element, as specified in 3GPP TS 24.501 chapter 9.11.4.21. The value -1 means that the information element is not sent.

rq_timer

Optional integer. Value in seconds of the RQ timer for the PDU session, sent to the UE if it supports reflective QoS feature. -2 means that the timer is deactivated.

log_get

Get logs.
This API has a per connection behavior. This means that the response will depend on previous calls to this API within the same WebSocket connection.
In practice, logs that have been provided in a response won’t be part of subsequent request unless connection is reestablished. To keep on receiving logs, client should send a new log_get request as soon as the previous response has been received.
If a request is sent before previous request has been replied, previous request will be replied right now without considering specific min/max/timeout conditions.

Message definition:

min

Optional number (default = 1). Minimum amount of logs to retrieve.
Response won’t be sent until this limit is reached (Unless timeout occurs).

max

Optional number (default = 4096). Maximum logs sent in a response.

timeout

Optional number (default = 1). If at least 1 log is available and no more logs have been generated for this time, response will be sent.

allow_empty

Optional boolean (default = false). If set, response will be sent after timeout, event if no logs are available.

rnti

Optional number. If set, send only logs matching rnti.

ue_id

Optional number. If set, send only logs with matching ue_id.

layers

Optional Object. Each member name represents a log layer and values must be string representing maximum level. See log_options.
If layers is not set, all layers level will be set to debug, else it will be set to none.
Note also the logs is also limited by general log level. See log_options.

short

Optional boolean (default = false). If set, only first line of logs will be dumped.

headers

Optional boolean. If set, send log file headers.

start_timestamp

Optional number. Is set, filter logs older than this value in milliseconds.

end_timestamp

Optional number. Is set, filter logs more recent than this value in milliseconds.

max_size

Optional number (default = 1048576, i.e. 1MB). Maximum size in bytes of the generated JSON message. If the response exceeds this size, the sending of logs will be forced independently from other parameters.

Response definition:

logs

Array. List of logs. Each item is a an object with following members:

data

Array. Each item is a string representing a line of log.

timestamp

Number. Milliseconds since January 1st 1970. Not present if com_log_us is set in configuration.

timestamp_us

Number. Microseconds since January 1st 1970. Only present if com_log_us is set in configuration.

layer

String. Log layer.

level

String. Log level: error, warn, info or debug.

dir

Optional string. Log direction: UL, DL, FROM or TO.

ue_id

Optional number. UE_ID.

cell

Optional number (only for PHY layer logs). Cell ID.

rnti

Optional number (only for PHY layer logs). RNTI.

frame

Optional number (only for PHY layer logs). Frame number (Subframe is decimal part).

channel

Optional string (only for PHY layer logs). Channel name.

src

String. Server name.

idx

Integer. Log index.

headers

Optional array. Array of strings.

discontinuity

Optional number. If set, this means some logs have been discarded due to log buffer overflow.

microseconds

Optional boolean. Present and set to true if com_log_us is set in configuration file.

log_set

Add log.
Message definition:

log

Optional string. Log message to add. If set, layer and level are mandatory.

layer

String. Layer name. Only mandatory if log is set.

level

String. Log level: error, warn, info or debug. Only mandatory if log is set.

dir

Optional string. Log direction: UL, DL, FROM or TO.

ue_id

Optional number. UE_ID.

flush

Optional boolean (default = false). If set, flushes fog file.

rotate

Optional boolean (default = false). If set, forces log file rotation.

cut

Optional boolean (default = false). If set, forces log file reset.

log_reset

Resets logs buffer.

license

Retrieves license file information.

quit

Terminates ltemme.

help

Provides list of available messages in messages array of strings and events to register in events array of strings.

stats

Report statistics for LTEMME.
Every time this message is received by server, statistics are reset.
Warning, calling this message from multiple connections simultaneously will modify the statistics sampling time.

Response definition:

cpu

Object. Each member name defines a type and its value cpu load in % of one core.

instance_id

Number. Constant over process lifetime. Changes on process restart.

counters

Object. List of counters, with following sub members:

messages

Object. Each member name is the message name and its value is its occurence.
To get list of message, type cevent help msg in LTEMME monitor.

errors

Object. Each member name is the error name and its value is its occurence.
To get list of message, type cevent help error in LTEMME monitor.

emm_registered_ue_count

Integer. Number of UEs in EMM-REGISTERED or 5GMM-REGISTERED state.

s1_connections

Array of objects. List of S1AP connection betweens eNBs and MME. Each object contains the following fields:

plmn

String. PLMN of the Global eNB ID.

enb_id_type

String (macro, home, short_macro or long_macro). Type of identifier of the Global eNB ID.

enb_id

Integer. Identifier of the Global eNB ID.

ip_addr

String. IP address and port of the eNB.

ta_list

Array of objects. List of the Tracking Areas served by the eNB. Each object contains the following fields:

plmn

String. PLMN of Tracking Area.

tac

Integer. Tracking Area Code.

emm_connected_ue_count

Integer. Number of UEs in EMM-CONNECTED state for this S1AP connection.

ng_connections

Array of objects. List of NGAP connection betweens RANs and AMF. Each object contains the following fields:

plmn

String. PLMN of the Global RAN ID.

ran_id_type

String (gNB, ng-eNB or N3IWF). Type of identifier of the Global RAN ID.

ran_id

Integer. Identifier of the Global RAN ID.

ip_addr

String. IP address and port of the RAN.

ta_list

Array of objects. List of the Tracking Areas served by the RAN. Each object contains the following fields:

plmn

String. PLMN of Tracking Area.

tac

Integer. Tracking Area Code.

cn_connected_ue_count

Integer. Number of UEs in 5GMM-CONNECTED state for this NGAP connection.

gtp_tx_bitrate

Optional number. This field will be filled when multiple calls on the same socket are done and represents the GTP payload bitrate (bits/seconds) sent to RAN and is equivalent to IP traffic.
The bitrate is computed using the delay between two calls.

gtp_rx_bitrate

Optional number. This field will be filled when multiple calls on the same socket are done and represents the GTP payload bitrate (bits/seconds) received from RAN and is equivalent to IP traffic.
The bitrate is computed using the delay between two calls.

ip_rx_bitrate

Optional number. This field will be filled when multiple calls on the same socket are done and represents the IP payload bitrate (bits/seconds) sent to tun interfaces.
The bitrate is computed using the delay between two calls.

ip_rx_bitrate

Optional number. This field will be filled when multiple calls on the same socket are done and represents the IP payload bitrate (bits/seconds) received from tun interfaces.
The bitrate is computed using the delay between two calls.

register

Register client to message generated by server. Message definition:

register

String or array of string. List of message to register to.
Can be registration, registration_reject, non_ip_data, generic_nas_transport, 5gs_nas_transport, eps_bearer_notification, qos_flow_notification

unregister

String or array of string. List of message to unregister.
Can be registration, registration_reject, non_ip_data, generic_nas_transport, 5gs_nas_transport, eps_bearer_notification, qos_flow_notification

ipsec

Report ipsec SAs.
For ePDG

Response definition:

SAs

Array. List of object representing a security association witth following definition:

type

String. IP version, can be IPv4 or IPv6.

dir

String. Direction, can be in or out.

spi

Number. SPI.

ue_id

Number. Associated ue_id.

mode

String. ESP type, can be tunnel or transport

src

String. Source IP address.

dst

String. Destination IP address.

tun_src

Optional string. Tunnel source IP address.

tun_dst

Optional string. Tunnel destination IP address.

src_prefix

Number. Source network prefix.

dst_prefix

Number. Destination network prefix.

authent_key

String. Authentication key in hexadecimal form (Empty string authentication is disabled).

cipher_key

String. Ciphering key in hexadecimal form (Empty string ciphering is disabled).

6.6 LTE messages

ue_get

Get UE informations.
Message definition:

imsi

Optional string. If set, retrieve only information from UE with matching IMSI.

nai

Optional string. Not applicable to 4G UEs.
May be present only if imsi is absent.
If set, retrieve only information from UE with matching NAI.

imei

Optional string (14 or 15 digits). If set, retrieve only information from UE with matching IMEI.

type

Optional enumeration (3gpp, n3gpp, both). Default value is both. Only display a UE connected to a RAN with matching type.

radio_capabilities

Optional boolean. If set, provides radio_capabilities in response.

Response definition:

ue_list

Array of current UEs.
Each element has the following definition:

rat_type

Enumeration (LTE, NBIOT, NR or NON_3GPP). RAT currently used by the UE.

imsi

Optional string. IMSI.

nai

Optional string. Network specific identifier-based SUPI.

imeisv

String. IMEISV.

m_tmsi

Optional string. M-TMSI. Present for UEs connected to EPC.

5g_tmsi

Optional string. 5G-TMSI. Present for UEs connected to 5GC.

tac

Integer. Current tracking area code.

tac_plmn

String. Current tracking area PLMN.

ue_aggregate_max_bitrate_dl

Number. UE aggregate maximum bitrate for downlink.

ue_aggregate_max_bitrate_ul

Number. UE aggregate maximum bitrate for uplink.

registered

Boolean. True if UE is currently registered to the network.

t3412

Optional integer. T3412 timer in seconds. Only present if the UE connected to EPC is registered to the network.

t3324

Optional integer. T3324 timer in seconds. Only present if the UE connected to EPC is registered to the network and PSM is activated, or if the UE connected to 5GC is registered to the network and MICO is activated.

edrx

Optional object. eDRX configuration. Only present if the UE is registered to the network and eDRX is activated. The object has the following definition:

paging_time_window

Integer. 4 bits or 8 bits Paging Time Window length as defined in 3GPP TS 24.008 chapter 10.5.5.32

cycle

Integer. 4 bits E-UTRAN or NR eDRX cycle length duration as defined in 3GPP TS 24.008 chapter 10.5.5.32.

t3512

Optional integer. T3512 timer in seconds. Only present if the UE connected to 5GC is registered to the network.

enb_plmn

Optional string. eNB PLMN. This field would only be present if the UE connected to EPC is still in connected mode.

enb_id

Optional integer. eNB id. This field would only be present if the UE connected to EPC is still in connected mode.

enb_ue_id

Optional integer. eNB UE id. This field would only be present if the UE connected to EPC is still in connected mode.

mme_ue_id

Optional integer. MME UE id. This field would only be present if the UE connected to EPC is still in connected mode.

ran_plmn

Optional string. RAN PLMN. This field would only be present if the UE connected to 5GC is still in connected mode.

ran_id

Optional integer. RAN id. This field would only be present if the UE connected to 5GC is still in connected mode.

ran_ue_id

Optional integer. RAN UE id. This field would only be present if the UE connected to 5GC is still in connected mode.

amf_ue_id

Optional integer. AMF UE id. This field would only be present if the UE connected to 5GC is still in connected mode.

bearers

Array. List of connected default bearers or PDU sessions. Each object has the following definition:

erab_id

Optional integer. EPS Bearer ID. Present UEs connected to EPC.

pdu_session_id

Optional integer. 5GS PDU session ID. Present for UEs connected to 5GC.

sst

Optional integer. Slice Service Type. Present for UEs connected to 5GC.

sd

Optional integer. Slice Differentiator. Can be present for UEs connected to 5GC.

qos_flow_id

Optional integer. 5GS QoS flow ID. Present for UEs connected to 5GC.

ip

String. IPv4 address.

ipv6

String. Global IPv6 prefix.

ul_total_bytes

Number. Total uplink transferred bytes.

dl_total_bytes

Number. Total downlink transferred bytes.

apn

String. Access point name.

dedicated

Array of object. Each object represents a dedicated bearer or non default QoS flow defined as follow:

erab_id

Optional integer. EPS Bearer ID. Present for UEs connected to EPC.

qos_flow_id

Optional integer. 5GS QoS flow ID. Present for UEs conencted ot 5GC.

ul_total_bytes

Number. Total uplink transferred bytes.

dl_total_bytes

Number. Total downlink transferred bytes.

radio_capabilities

GSER string. UE radio access capabilities. Only present if radio_capabilities is set to true in request.

ue_set

Modify the UE configuration in database.

imsi

Optional string.

nai

Optional string. Not applicable to 4G UEs.
May be present only if imsi is absent.

pdn_list

Array. Each entry will set specific parameters for a PDN or PDU session as defined below:

access_point_name

String. Used to define what PDN or PDU session to configure.

routes

Array of filters. See routes.

ue_add

Add UE to UE database.
Message definition:

ue_db

Array. List of UE configuration. See ue_db.

ue_del

Remove UE from the UE database and performs a detach if necessary.
Message definition:

imsi

Optional string. IMSI of the UE to delete.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

local

Optional boolean (default = false). If set to true, the UE is locally detached without any NAS signalling.

ue_detach

Force a detach from network.
Message definition:

imsi

Optional string. IMSI of the UE to detach.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

n3gpp

Optional boolean (default = false). Set it to true for a non 3GPP UE connected to 5GC.

type

Optional number (EPS default = 2 / re-attach not required; 5GS default = 1 / re-registration not required, 3GPP access). Set NAS detach request type (according to 3GPP TS 24.301 9.9.3.7 Detach type) or de-registration type (according to 3GPP TS 24.501 9.11.3.20 De-registration type).

cause

Optional number (default = 3 / illegal UE). Set EMM or 5GMM cause. The value -1 means that the EMM cause IE is not sent in the NAS Detach Request message or the 5GMM cause is not sent in the NAS Deregistration Request message.

local

Optional boolean (default = false). If set to true, the UE is locally detached without any NAS signalling.

ue_identity_request

Force an identification procedure.
Message definition:

imsi

Optional string. IMSI of the UE.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

n3gpp

Optional boolean (default = false). Set it to true for a non 3GPP UE connected to 5GC.

type

Integer (range 1 to 5). Identity type.

me_add

Add or update one or several devices in ME database.
Message definition:

default_status

Optional enumeration (whitelisted, blacklisted, greylisted). Defines the default status for devices not explicitly defined in the next objects.

whitelist

Optional array. It contains a list of IMEI (14 digits) or IMEISV (16 digits) whitelisted.

blacklist

Optional array. It contains a list of IMEI (14 digits) or IMEISV (16 digits) blacklisted.

greylist

Optional array. It contains a list of IMEI (14 digits) or IMEISV (16 digits) greylisted.

me_del

Remove one or several devices in ME database.
Message definition:

list

Array of strings. Each entry must be an IMEI (14 digits) or IMEISV (16 digits).

pws_write

Start broadcasting Public Warning System message.
Message definition:

local_id

Number. ID of the message as defined by local_identifier in MME configuration file

nf

Optional boolean (default = false). If not set, SBC interface is used. If set, N50 interface is used.

increment_serial_number

Optional boolean (default = true). If set to false, the serial_number is not incremented.

pws_kill

Stop broadcasting Public Warning System message.
Message definition:

local_id

Number. ID of the message as defined by local_identifier in MME configuration file

stop_all

Optional boolean. Gives the presence of Stop-All-Indicator IE in the message STOP-WARNING-REQUEST.

send_warning_indication

Optional boolean. Default value is 0. Gives the presence of Send-Stop-Warning-Indication IE in the message STOP WARNING REQUEST.

nf

Optional boolean (default = false). If not set, SBC interface is used. If set, N50 interface is used.

cbc_notif_subscribe

CBC subscription to notification.
Applicable to N50 interface only. Message definition:

notify_cbk_uri

String. Callback URI on which the N2 information shall be notified.

info_class

Optional enumeration: write-cancel, restart-failure (default = write-cancel). Class of N2 information to which the CBC wants to subscribe.

cbc_notif_unsubscribe

CBC unsubscription to notification.
Applicable to N50 interface only. Message definition:

info_class

Optional enumeration: write-cancel, restart-failure (default = write-cancel). Class of N2 information to which the CBC wants to unsubscribe.

enb

Get list of eNB connections.
Response definition:

enb_list

Array of object. Each object represents an eNB connection:

plmn

String. PLMN.

eNB_ID_type

String (macro, home, short_macro or long_macro). eNB type.

eNB_ID

Integer. eNB ID.

name

Optional string. eNB name.

address

String. eNB IP address and port.

ue_ctx

Number. Number of UE contexts.

ng_ran

Get list of NG-RAN node connections.
Response definition:

ng_ran_list

Array of object. Each object represents a RAN connection:

plmn

String. PLMN.

RAN_ID_type

String (gNB, ng-eNB or N3IWF). RAN type.

RAN_ID

Integer. RAN ID.

name

Optional string. RAN node name.

address

String. RAN IP address and port.

ue_ctx

Number. Number of UE contexts.

s6

Get information regarding the S6a connection.
Response definition:

state

String. S6a connection state (disconnected, connecting, connected or inactive).

address

String. HSS address and port.

host

Optional string. HSS Diameter host identifier retrieved during Capabilities Exchange procedure.

realm

Optional string. HSS Diameter realm identifier retrieved during Capabilities Exchange procedure.

s6connect

Force S6a connection establishment.
Message definition:

addr

Optional string. If not set, the MME will try to connect to the previously configured address

s6disconnect

Force S6a connection release.

s13

Get information regarding the S13 connection.
Response definition:

state

String. S13 connection state (disconnected, connecting, connected or inactive).

address

String. EIR address and port.

host

Optional string. EIR Diameter host identifier retrieved during Capabilities Exchange procedure.

realm

Optional string. EIR Diameter realm identifier retrieved during Capabilities Exchange procedure.

s13connect

Force S13 connection establishment.
Message definition:

addr

Optional string. If not set, the MME will try to connect to the previously configured address

s13disconnect

Force S13 connection release.

sgs

Get information regarding the SGs connection.
Response definition:

state

String. SGs connection state (disconnected, connecting, connected or inactive).

address

String. MSC/VLR address and port.

sgsconnect

Force SGs connection establishment.
Message definition:

addr

Optional string. If not set, the MME will try to connect to the previously configured address

sgsdisconnect

Force SGs connection release.

sbc

Get list of CBC connections.
Response definition:

cbc_list

Array of object. Each object represents a CBC connection:

address

String. CBC address and port.

lcs

Get information regarding the LCS connection.
Response definition:

state

String. LCS connection state (disconnected, connecting, connected or inactive).

address

String. E-SMLC address and port.

lcsconnect

Force LCS connection establishment.
Message definition:

addr

Optional string. If not set, the MME will try to connect to the previously configured address

n8

Get information regarding the N8 interface.
Response definition:

server_address

String. UDM address and port.

n8connect

Force N8 connections establishment.
Message definition:

api_root

Optional string. api_root of the UDM server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If not set, the AMF will try to connect to the previously configured address

n8disconnect

Disconnect the AMF client on the interface N8 from the UDM.

n12

Get information regarding the N12 interface.
Response definition:

server_address

String. AUSF address and port.

client_address

String. Address of the AMF client connected to the AUSF.

n12connect

Connect or reconnect the AMF client on the interface N12 to the AUSF.
Message definition:

api_root

Optional string. api_root of the AUSF server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If not set, the AMF will try to connect to the previously configured address

n12disconnect

Disconnect the AMF client on the interface N12 from the AUSF.

n13

Available only in case of internal AUSF.
Get information regarding the N13 interface.
Response definition:

server_address

String. UDM address and port.

client_address

String. Address of the AUSF client connected to the UDM.

n13connect

Available only in case of internal AUSF.
Connect or reconnect the AUSF client on the interface N13 to the UDM.
Message definition:

addr

api_root

Optional string. api_root of the UDM server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If not set, the AUSF will try to connect to the previously configured address.

n13disconnect

Available only in case of internal AUSF.
Disconnect the AUSF client on the interface N13 from the UDM.

n17

Get information regarding the N17 interface.
Response definition:

server_address

String. EIR address and port.

client_address

String. Address of the AMF client connected to the EIR.

n17connect

Connect or reconnect the AMF client on the interface N17 to the EIR.
Message definition:

api_root

Optional string. api_root of the EIR server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If not set, the AMF will try to connect to the previously configured address.

n17disconnect

Disconnect the AMF client on the interface N17 from the EIR.

nl1

Get information regarding the NL1 interface.
Response definition:

server_address

String. LMF address and port.

client_address

String. Address of the AMF client connected to the LMF.

nl1connect

Connect or reconnect the AMF client on the interface NL1 to the LMF.
Message definition:

api_root

Optional string. api_root of the LMF server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If not set, the AMF will try to connect to the previously configured address.

nl1disconnect

Disconnect the AMF client on the interface NL1 from the LMF.

ue_activate_dedicated_bearer

Trigger a network initiated dedicated EPS bearer activation or a 5GS QoS flow activation.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

apn

Optional string. APN of the default EPS bearer associated to the dedicated one. Must be present if pdu_session_id or linked_erab_id are not present.

sst

Optional integer. SST of the PDU session. Used for UEs connected to 5GC.

sd

Optional integer. SD of the PDU session. Used for UEs connected to 5GC.

linked_erab_id

Optional integer. Identity of the default EPS bearer associated to the dedicated one. Used for UEs connected to EPC.

pdu_session_id

Optional integer. PDU session identity of the PDU session to select. Used for UEs connected to 5GC.

qci

Integer (range 1 to 255). QoS Class Identifier of the E-RAB, or 5QI of the QoS flow.

5qi_qos

Optional object. See 5QI QoS.

priority_level

Optional integer (1 to 15, default 15). ARP priority level.

pre_emption_capability

Optional enumeration (shall_not_trigger_pre_emption or may_trigger_pre_emption, default shall_not_trigger_pre_emption).

pre_emption_vulnerability

Optional enumeration (not_pre_emptable or pre_emptable, default not_pre_emptable).

filters

Array. See TFT.

gbr

Optional object. See GBR.

transaction_identifier

Optional integer (range 0 to 127). If present, the transaction identifier IE is put in the EPS bearer activation message.

llc_sapi

Optional integer (range 0 to 15). If present, the LLC service access point identifier IE is put in the EPS bearer activation message.

radio_priority

Optional integer (range 0 to 7). If present, the radio priority IE is put in the EPS bearer activation message.

packet_flow_identifier

Optional integer (range 0 to 127). If present, the packet flow identifier IE is put in the EPS bearer activation message.

sm_qos

Optional string. If present, the quality of service IE is put in the EPS bearer activation message. The string must contain the hexadecimal representation of the IE without its IEI and length.

Response definition:

erab_id

Integer. Allocated ERAB identity for this dedicated EPS bearer. Sent if the procedure if for EPS.

pdu_session_id

Integer. PDU session identifier associated to the QoS flow identifier. Sent if the procedure if for 5GS.

qos_flow_id

Integer. Allocated QoS flow identifier for this bearer. Sent if the procedure if for 5GS.

ue_modify_bearer

Trigger a network initiated EPS bearer modification.
Message definition:

imsi

String. UE IMSI.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

erab_id

Integer. ERAB identity of the bearer to be modified.

qos

Optional objet. If present a QoS modification is done. It should contain the following objects:

qci

Integer (range 1 to 255). QoS Class Identifier of the E-RAB.

priority_level

Optional integer (1 to 15, default 15). ARP priority level.

pre_emption_capability

Optional enumeration (shall_not_trigger_pre_emption or may_trigger_pre_emption, default shall_not_trigger_pre_emption).

pre_emption_vulnerability

Optional enumeration (not_pre_emptable or pre_emptable, default not_pre_emptable).

gbr

Optional object. See GBR.

filters

Array. Contains the new TFT after modification. See TFT.

llc_sapi

Optional integer (range 0 to 15). If present, the LLC service access point identifier IE is put in the EPS bearer activation message.

radio_priority

Optional integer (range 0 to 7). If present, the radio priority IE is put in the EPS bearer activation message.

packet_flow_identifier

Optional integer (range 0 to 127). If present, the packet flow identifier IE is put in the EPS bearer activation message.

sm_qos

Optional string. If present, the quality of service IE is put in the EPS bearer activation message. The string must contain the hexadecimal representation of the IE without its IEI and length.

p_cscf

Optional boolean. Adds the P-CSCF addresses to the PCO information element of the modify EPS bearer context request message.

dns

Optional boolean. Adds the DNS addresses to the PCO information element of the modify EPS bearer context request message.

Response definition:

erab_id

Integer. ERAB identity of the EPS bearer.

ue_modify_pdu_session

Trigger a network initiated PDU session modification.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

n3gpp

Optional boolean (default = false). Set it to true for a non 3GPP UE connected to 5GC.

pdu_session_id

Integer. PDU session identity of the PDU session to be modified.

qos_rules

Optional array. List of the QoS rules after modification other than the default one. Each element of the array contains the followings properties:

id

QoS rule identifier.

qfi

Range: 0 to 63. QoS flow identifier.

filters

Array of packet filters. See TFT.

qos_flow

Optional array. List of the QoS flows after modification other than the QoS flow associated to the default QoS rule. Each element of the array contains the following properties:

qfi

Integer. Range: 0 to 63. QoS flow identifier.

5qi

Integer. Range: 1 to 254. 5QI of the QoS flow.

5qi_qos

Optional object. See 5QI QoS.

priority_level

Range: 1 to 15. ARP priority level.

pre_emption_capability

Enumeration: shall_not_trigger_pre_emption or may_trigger_pre_emption.

pre_emption_vulnerability

Enumeration: not_pre_emptable or pre_emptable.

gbr

Optional object. See GBR. Must be present for a GBR 5QI.

p_cscf

Optional boolean. Adds the P-CSCF addresses to the ePCO information element of the PDU session modification command message.

dns

Optional boolean. Adds the DNS addresses to the ePCO information element of the PDU session modification command message.

ue_modify_reflective_qos

Modify the reflective QoS indicator bit for an existing UE packet filter.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

n3gpp

Optional boolean (default = false). Set it to true for a non 3GPP UE connected to 5GC.

pdu_session_id

Integer. PDU session identity of the QoS flow to be modified.

qos_flow_id

Integer. QoS flow identity of the QoS flow to be modified.

filter_id

Integer. Packet filter identity of the DL only filter to be modified.

reflective_qos

Boolean. Reflective QoS indicator for this packet filter.

ue_deactivate_bearer

Trigger a network initiated default or dedicated EPS bearer deactivation, or a 5GS QoS flow deactivation. It the UE is in RRC idle state, the bearer will be locally released without any NAS signalling.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

n3gpp

Optional boolean (default = false). Set it to true for a non 3GPP UE connected to 5GC.

erab_id

Optional integer. ERAB identity of the bearer to be released. Must be present for an EPS procedure.

esm_cause

Optional integer (default = 36). ESM cause for the message. Can be present for an EPS procedure.

pdu_session_id

Optional integer. PDU session identifier of the QoS flow to release. Must be present for a 5GS procedure.

qos_flow_id

Optional integer. QoS flow identifier to release. Must be present for a 5GS procedure.

5gsm_cause

Optional integer (default = 36). 5GSM cause for the message. Can be present for a 5GS procedure.

non_ip_data

Send data over a non IP PDN or unstructured PDU session.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

apn

Optional string. APN of the non IP bearer. Used for UEs connected to EPC. Shall be present if erab_id is absent.

erab_id

Optional integer. ERAB identity of the non IP default bearer. Used for UEs connected to EPC. Shall be present if apn is absent.

dnn

Optional string. DNN of the non IP bearer. Used for UEs connected to 5GC. Shall be present if pdu_session_id is absent.

sst

Optional integer. SST of the non IP bearer. Used for UEs connected to 5GC. May be present if dnn is present.

sd

Optional integer. Optional SD of the non IP bearer. Used for UEs connected to 5GC. May be present if dnn is present.

pdu_session_id

Optional integer. PDU session ID of the non IP bearer. Used for UEs connected to 5GC. Shall be present if dnn is absent.

data

String. ASCII representation of the data hexadecimal dump.

generic_nas_transport

Send an EPS downlink generic NAS transport message.
Message definition:

imsi

String. UE IMSI.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

type

Integer (range: 0 to 255). Generic message container type information element.

payload

String. ASCII representation of the generic message container hexadecimal dump.

add_info

Optional string. ASCII representation of the additional information hexadecimal dump.

5gs_nas_transport

Send an 5GS downlink NAS transport message for LPP, SOR, UE policy, UE parameters update or location services.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

n3gpp

Optional boolean (default = false). Set it to true for a non 3GPP UE connected to 5GC.

type

Integer (range: 3 to 6). Payload container type information element.

payload

String. ASCII representation of the payload container hexadecimal dump.

add_info

Optional string. ASCII representation of the additional information hexadecimal dump for LPP or location services.

ursp_rules

Send URSP rules to the UE. Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

n3gpp

Optional boolean (default = false). Set it to true for a non 3GPP UE connected to 5GC.

ue_policy_section_management_list

Array of objects. Contains the description of the UE policy section management list as defined in 3GPP TS 24.501 chapter D.6.2. Each element of the array has the following properties:

plmn

String. PLMN identity of the MME (5 or 6 digits).

instruction_list

Array of objects. Each element describes an instruction as defined in 3GPP TS 24.501 chapter D.6.2. Each element has the following definition:

upsc

Integer (range: 0 to 65 535). UE Policy Section Code.

ue_policy_part_list

Optional array. UE policy section contents as defined in 3GPP TS 24.501 chapter D.6.2 Figure D.6.2.6. Each element of the array contains a UE policy part and has the following properties:

ursp_rules

Optional array of objects. Each element describes a URSP rule as defined in 3GPP TS 24.526 chapter 5.2 Figure 5.2.2 and has the following properties:

precedence

Integer (range: 0 to 255). Precedence value of URSP rule.

traffic_descriptor_components

Array describing the Traffic descriptor as defined in 3GPP TS 24.526 chapter 5.2. Each element of the array contains one of the following properties:

match_all

Optional boolean (default = false). Indicates the presence of match_all descriptor component type.

os_id_os_app_id

Object. Match the OS Id and the OS application Id. Contains the following properties:

os_id

String. Hexadecimal representation of the OS Id.

os_app_id

String.

ipv4_remote_addr

String. Match a remote (external network entity) IPv4 address with the additional mask property.

ipv6_remote_addr_prefix

String. Match a remote (external network entity) IPv6 address with the additional prefix_len property.

proto_id

Range: 0 to 255. Match against the IP protocol identifier.

remote_port

Range: 0 to 65536. Match against the remote (external network entity) port.

remote_port_range

Array of 2 integers. Match against a remote (external network entity) port range.

security_parameter_index

32 bit integer. Match the ESP or AH security parameter index.

type_of_service

Range: 0 to 255. Match the type of service (IPv4) or the traffic class (IPv6) field. The additional mask property is the corresponding mask.

flow_label

20 bit integer. Match the IPv6 flow label.

dnn

String. Match a DNN value.

connection_capabilities

Array of enumeration: ims, mms, supl, internet. Match a connection capability identifier given in the array.

destination_fqdn

String. Match the destination FQDN.

os_app_id

String. Match the OS app id.

route_list

Array of objects describing the Route selection descriptor list as defined in 3GPP TS 24.526 Figure 5.2.3. Each element contains a Route selection descriptor as defined in 3GPP TS 24.526 Figure 5.2.4 and contains a variable number (at least one) of route selection descriptor components as described below:

precedence

Integer (range 0-255). Precedence value of route selection descriptor.

components

Array of objects. Contains a variable number (at least one) of route selection descriptor components as defined below:

snssai

Indicates the S-NSSAI value.

sst

Integer (range 0-255). Slice Service Type.

sd

Optional integer (range 0-0xFFFFFE). Slice Differentiator.

dnn

String. Indicates the DNN value.

pdu_session_type

Enumeration: ipv4, ipv6, ipv4v6, unstructured, ethernet. Indicates the PDU session type.

preferred_access_type

Enumeration: 3gpp, non-3gpp. Indicates the preferred access type.

multi_access_preference

Boolean (default = false). If set to true, indicates the multi-access preference.

reset_ue_pos_stored_info

Send a test procedure reset UE positioning stored information message.
Message definition:

imsi

String. UE IMSI.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

techno

Integer (range: 0 to 255). UE positioning technology as specified in 3GPP TS 36.509 chapter 6.9.

mt_cs_paging

Trigger a CS paging for a UE connected to EPC.
Message definition:

imsi

String. UE IMSI.

guti_realloc

Initiate a LTE procedure GUTI reallocation. Message definition:

imsi

String. UE IMSI.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

load_balancing_tau

Initiate a LTE load balancing TAU procedure. Message definition:

imsi

String. UE IMSI.

imei

Optional string (14 or 15 digits). UE IMEI (with or without check digit), required if multi_sim is set to true.

6.7 Positioning messages

The messages in this section are related to the positioning procedures. The messages that are initiated by the location server are used when the test e-SMLC or test LMF is used. See lcs to configure the test e-SMLC. See nl1 to configure the test LMF.

6.7.1 LCSAP

The messages in this section are applicable to EPC only. They are sent on the LCSAP interface between the LCS client located in the MME and the e-SMLC.

location_req

Start a location procedure by sending LCSAP Location-Request from the LCS client to the e-SMLC.
When the e-SMLC receives the message LCSAP Location-Request:

if the e-SMLC is configured to use the LPP protocol (See lpp_test), the e-SMLC will send the message LPP RequestCapability message to the UE. The command lpp_request_location (See lpp_request_location) can then be used to trigger a LPP RequestLocationInformation message in the e-SMLC.
If the UE answers with a LPP RequestAssistanceData message, the e-SMLC will use the assistance data in the e-SMLC configuration (See otdoa_assistance_data and See nr_tdoa_assistance_data) to provide the OTDOA and NR-TDOA assistance data in LPP ProvideAssistanceData. Note that GNSS assistance data is not implemented.

if the e-SMLC is configured to use the LPPa protocol (See lpp_test), the e-SMLC will send the message LPPa E-CIDMeasurementInitiationRequest to the eNB using the measurement configuration in the e-SMLC (See local_e_smlc).
The following commands can then be used in the e-SMLC:
ecid_periodic_meas_termination to send LPPa e-CIDMeasurementTermination (See ecid_periodic_meas_termination.
otdoa_information_req to send LPPa OTDOAInformationRequest (otdoa_information_req).
Message definition:

plmn

String (5 or 6 digits).

cell_id

Integer. 28 bits long LTE cell identifier.

session_id

Optional integer in range 0 to 255. Location session identifier.

type

Enumeration: geographic, assistance_info, last_known. Location type geographic information.

imsi

String. IMSI of the UE.

imei

Optional string (14 digits). IMEI of the UE.

Response definition:

correlation_id

Integer in range 0 to 0xFFFFFF. Identifier of the created location context. This value shall be used in the command lpp_request_location.

lcsap_reset_req

Send LCSAP Reset-Request from the test e-SMLC to the LCS client both located in the MME.

6.7.2 LPPa

The messages in this section are applicable to EPC only. They are sent by the test e-SMLC to the eNB via the MME. LCSAP interface is used between the e-SMLC and the MME.

ecid_periodic_meas_termination

Send LPPa e-CIDMeasurementTermination from the test e-SMLC.
Message definition:

session_id

Integer in range 0 to 255. Location session identifier.

transaction_id

Optional integer in range 0 to 32767 (default = 0). Transaction identifier in LPPa e-CIDMeasurementTermination.

e_smlc_meas_id

Integer in range 1 to 15. E-SMLC-UE-Measurement_ID in LPPa e-CIDMeasurementTermination.

enb_meas_id

Integer in range 1 to 15. eNB_UE_Measurement_ID in LPPa e-CIDMeasurementTermination.

otdoa_information_req

Send LPPa OTDOAInformationRequest from the test e-SMLC.
Message definition:

transaction_id

Optional integer in range 0 to 32767 (default = 0). Transaction identifier in LPPa OTDOAInformationRequest.

enb_plmn

String (5 or 6 digits). eNB PLMN.

enb_id

Integer. eNodeB global identifier. enb_plmn and enb_id are used to identify the eNB to which the message LPPa OTDOAInformationRequest will be sent.

6.7.3 LPP

The messages in this section are applicable to EPC and 5GC. They are sent by the test e-SMLC in EPC or the test LMF in 5GC to the UE.

lpp_request_location

Send LPP RequestLocationInformation from the test e-SMLC or the test LMF.
Message definition:

is_5gs

Optional boolean (default = false). If set to true, send the LPP message from the test LMF using the NL1 interface. Otherwise send the LPP message from the test e-SMLC using the LCSAP interface.

supi

String in the form "imsi-" or "nai-" followed by the value of the IMSI or the NAI.

imei

Optional string. IMEI (14 digits).

correlation_id

Integer in range 0 to 0xFFFFFF in EPC and to 0xFFFFFFFFFFFFFFFF in 5GC. Correlation ID as defined in 3GPP TS 29.171 and 3GPP TS 29.518.

lpp_methods

Optional array (default = ["ecid"]). An element of the array is an enumeration: "ecid", "otdoa", "nr_ecid", "nr_tdoa", "gnss". Gives the list of the LPP methods to request in the message LPP RequestLocationInformation. Note that "gnss" cannot be requested together with any other method, because only locationEstimate is supported for GNSS, and only locationMeasurements is supported for the other methods.

report_type

Enumeration: "once", "periodic", "triggered". Reporting configuration in the message LPP RequestLocationInformation.

6.7.4 NRPPa

The messages in this section are applicable to 5GC only. They are used to subcribe the LMF to N1/N2 notifications, trigger UE location, cancel UE location, and send NRPPa PDUs from the test LMF to the gNB via the AMF. The NL1 interface is used between the LMF and the AMF.

lmf_non_ue_n2_subscribe

LMF server subscription to the reception of non-UE NRPPa PDUs. See 3GPP TS 29.518 chapter 5.2.2.4.2 NonUeN2InfoSubscribe.
Message definition:

notify_cbk_uri

String. n2NotifyCallbackUri as defined in 3GPP TS 29.518 chapter 6.1.6.2.10 Type: NonUeN2InfoSubscriptionCreateData.

lmf_non_ue_n2_unsubscribe

LMF server unsubscription to the reception of non-UE NRPPa PDUs. See 3GPP TS 29.518 chapter 5.2.2.4.3 NonUeN2InfoUnSubscribe.
Message definition:

subscription_id

n2NotifySubscriptionId as defined in 3GPP TS 29.518 chapter 6.1.3.9 Resource: Non UE N2 Messages Subscriptions Collection.

nr_location_req

Start location procedure for a target UE in the AMF. The AMF will send to the LMF on the NL1 interface an HTTP POST request to the resource URI associated with the "determine-location" operation as specified in 3GPP TS 29.572 chapter 5.2.2.2.2 Retrieve UE Location.
Message definition:

supi

String in the form "imsi-" or "nai-" followed by the value of the IMSI or the NAI.

pei

Optional string in the form "imei-" or "imeisv-" followed by the value of the IMEI or the IMEISV.

Response definition:

correlation_id

Integer in range 0 to 0xFFFFFFFFFFFFFFFF. Identifier of the created location context. This value shall be used in the commands lpp_request_location and nr_cancel_location.

nr_cancel_location

Cancel periodic or triggered location procedure for a target UE.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI. Shall be present if imsi is absent.

imei

Optional string. IMEI (14 digits).

correlation_id

Integer in range 0 to 0xFFFFFF in EPC and to 0xFFFFFFFFFFFFFFFF in 5GC. Correlation ID as defined in 3GPP TS 29.171 and 29.518.

nr_otdoa_information_req

Send an HTTP POST request for "NonUeN2MessageTransfer" operation containing a NRPPa OTDOAInformationRequest PDU from the test LMF to the AMF.
See 3GPP TS 38.455 chapter 8.2.5 OTDOA Information Exchange.
See 3GPP TS 29.518 chapter 5.2.2.4.1 NonUeN2MessageTransfer.
Message definition:

transaction_id

Optional integer in range 0 to 32767 (default = 0) as defined in 3GPP TS 38.455 chapter 9.1.1.7. All other fields in the message NPRRa OTDOAInformationRequest are hardcoded.

ran_node_id_list

Array of objects. List of the global RAN node ID to send in the HTTP POST request as defined in 3GPP TS 29.518 chapter 6.1.6.2.9. See ran_node_id.

tai_list_5gs

Optional array of objects (up to 65535). 5GS TAI List to set in the parameter taiList as defined in 3GPP TS 29.518 chapter 6.1.6.2.9. See tai_list_5gs.

tai_list

Optional array of objects (up to 65535). TAI List to set in the parameter taiList as defined in 3GPP TS 29.518 chapter 6.1.6.2.9. See tai_list.

rat_selector

Optional enumeration: nr, eutra, both (default = both). Value of the parameter ratSelector as defined in 3GPP TS 29.518 chapter 6.1.6.2.9.

trp_information_req

Send an HTTP POST request for "NonUeN2MessageTransfer" operation containing a NRPPa TRPInformationRequest PDU from the test LMF to the AMF.
See 3GPP TS 38.455 chapter 8.2.8 TRP Information Exchange.
See 3GPP TS 29.518 chapter 5.2.2.4.1 NonUeN2MessageTransfer.
Message definition:

ran_node_id_list

Array of objects. List of the global RAN node ID to send in the HTTP POST request as defined in 3GPP TS 29.518 chapter 6.1.6.2.9. See ran_node_id.

tai_list_5gs

Optional array of objects (up to 65535). 5GS TAI List to set in the parameter taiList as defined in 3GPP TS 29.518 chapter 6.1.6.2.9. See tai_list_5gs.

tai_list

Optional array of objects (up to 65535). TAI List to set in the parameter taiList as defined in 3GPP TS 29.518 chapter 6.1.6.2.9. See tai_list.

rat_selector

Optional enumeration: nr, eutra, both (default = both). Value of the parameter ratSelector as defined in 3GPP TS 29.518 chapter 6.1.6.2.9.

nr_ecid_periodic_meas_termination_req

Send an HTTP POST request for "N1N2MessageTransfer" operation containing a NRPPa E-CID Measurement Termination PDU from the test LMF to the AMF.
See 3GPP TS 38.455 chapter 8.2.4 E-CID Measurement Termination.
See 3GPP TS 29.518 chapter 5.2.2.3.1 N1N2MessageTransfer.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI. Shall be present if imsi is absent.

imei

Optional string. IMEI (14 digits).

correlation_id

Integer in range 0 to 0xFFFFFFFFFFFFFFFF. Correlation ID as defined in 3GPP TS 29.518.

transaction_id

Integer in range 0 to 32767 as defined in 3GPP TS 38.455 chapter 9.1.1.7.

lmf_meas_id

Integer in range 1 to 256. Value of LMF-UE-Measurement-ID in the message NRPPa E-CID Measurement Termination.

ran_meas_id

Integer in range 1 to 256. Value of RAN-UE-Measurement-ID in the message NRPPa E-CID Measurement Termination.

6.7.5 NRPPa/LPP common

The messages in this section are common to LPP and NRPPa and are applicable to 5GC only. They are used to connect and configure the LMF on the NL1 interface.

lmf_client_connect

Connect an LMF client to the AMF server on the NL1 interface.

lmf_ue_n1_n2_subscribe

LMF server subscription to the reception of LPP messages and/or UE NRPPa PDUs. See 3GPP TS 29.518 chapter 5.2.2.3.3 N1N2MessageSubscribe.
Message definition:

supi

String in the form "imsi-" or "nai-" followed by the value of the IMSI or the NAI.

imei.

Optional string. IMEI (14 digits).

n1_notify_cbk_uri

String. n1NotifyCallbackUri as defined in 3GPP TS 29.518 chapter 6.1.6.2.12 Type: UeN1N2InfoSubscriptionCreateData. This parameter shall be present if the LMF subscribes for LPP message notification. This IE represents the callback URI on which the N1 message shall be notified.

n2_notify_cbk_uri

String. n2NotifyCallbackUri as defined in 3GPP TS 29.518 chapter 6.1.6.2.12 Type: UeN1N2InfoSubscriptionCreateData. This parameter shall be present if the LMF subscribes for a UE NRPPa information notification. This IE represents the callback URI on which the N2 information shall be notified.

lmf_ue_n1_n2_unsubscribe

LMF server unsubscription to the reception of LPP messages and/or UE NRPPa PDUs. See 3GPP TS 29.518 chapter 5.2.2.3.4 N1N2MessageUnSubscribe.
Message definition:

supi

String in the form "imsi-" or "nai-" followed by the value of the IMSI or the NAI.

imei.

Optional string. IMEI (14 digits).

subscription_id

String. subscriptionId as defined in 3GPP TS 29.518 chapter 6.1.3.3 Resource: N1N2 Subscriptions Collection for Individual UE Contexts.

6.8 LTE events

Following events are sent by MME if they have been registered on WebSocket.

registration

Generated when the UE registers or deregisters from the network, or when its M-TMSI or 5G-TMSI changes.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. UE network specific identifier-based SUPI.
Not applicable to UEs connected to EPC.

imei

Optional string. UE IMEI, sent if available.

m_tmsi

Optional string. M-TMSI. Present for UEs connected to EPC.

5g_tmsi

Optional string. 5G-TMSI. Present for UEs connected to 5GC.

registered

Boolean. True if UE is currently registered to the network.

registration_reject

Generated when an initial registration attempt is rejected.
Message definition:

imsi

Optional string. UE IMSI, sent if available.

nai

Optional string. UE network specific identifier-based SUPI, sent if available.
Not applicable to UEs connected to EPC.

imei

Optional string. UE IMEI, sent if available.

emm_cause

Integer. EMM reject cause. Present for UEs connected to EPC.

5gmm_cause

Integer. 5GMM reject cause. Present for UEs connected to 5GC.

non_ip_data

Generated by data reception over a non IP PDN or unstructured PDU session.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI.
Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string. UE IMEI, sent if multi_sim is set to true.

apn

Optional string. APN of the non IP bearer. Used for UEs connected to EPC.

erab_id

Optional integer. ERAB identity of the non IP default bearer. Used for UEs connected to EPC.

dnn

Optional string. DNN of the non IP bearer. Used for UEs connected to 5GC.

sst

Optional integer. SST of the non IP bearer. Used for UEs connected to 5GC.

sd

Optional integer. Optional SD of the non IP bearer. Used for UEs connected to 5GC.

pdu_session_id

Optional integer. PDU session ID of the non IP bearer. Used for UEs connected to 5GC.

data

String. ASCII representation of the data hexadecimal dump.

generic_nas_transport

Generated when receiving an EPS uplink generic NAS transport message.
Message definition:

imsi

String. UE IMSI.

imei

Optional string. UE IMEI, sent if multi_sim is set to true.

type

Integer. Generic message container type information element.

payload

String. ASCII representation of the generic message container hexadecimal dump.

add_info

Optional string. ASCII representation of the additional information hexadecimal dump.

5gs_nas_transport

Generated when receiving a 5GS uplink NAS transport message for LPP, SOR, UE policy or UE parameters update.
Message definition:

imsi

Optional string. UE IMSI.
Shall be present if nai is absent.

nai

Optional string. Network specific identifier-based SUPI. Not applicable to 4G UEs.
Shall be present if imsi is absent.

imei

Optional string. UE IMEI, sent if multi_sim is set to true.

type

Integer (range: 3 to 6). Payload container type information element.

payload

String. ASCII representation of the payload container hexadecimal dump.

add_info

Optional string. ASCII representation of the additional information hexadecimal dump for LPP.

eps_bearer_notification

Generated when an EPS bearer is opened or released.
Message definition:

imsi

Optional string. UE IMSI. Might not be present in case of emergency call.

imei

Optional string. UE IMEI, sent if multi_sim is set to true.

apn

String. Access point name.

pdn_type

Enumeration (ipv4, ipv6, ipv4v6, non-ip). PDN type.

activated

Boolean. True on EPS bearer establishment, false on EPS bearer release.

ipv4_address

Optional string. IPv4 address allocated to the UE.

ipv6_prefix

Optional string. IPv6 prefix allocated to the UE.

erab_id

Integer. ERAB identity.

linked_erab_id

Optional integer. ERAB identity of the default EPS bearer. Present when the EPS bearer opened is a dedicated bearer.

dl_bytes

Optional integer. Number of dowlink bytes sent to the UE. Present when activated is set to false.

ul_bytes

Optional integer. Number of uplink bytes received from the UE. Present when activated is set to false.

start_date

Integer. Start date in seconds since 1970-01-01 00:00:00

duration

Optional number. Duration in seconds of bearer lifetime. Present when activated is set to false.

qos_flow_notification

Generated when a QoS flow is opened or released.
Message definition:

imsi

Optional string. UE IMSI. Might not be present in case of emergency call.

nai

Optional string. Network specific identifier-based SUPI.

imei

Optional string. UE IMEI, sent if multi_sim is set to true.

dnn

String. Data network name.

pdn_type

Enumeration (ipv4, ipv6, ipv4v6, unstructured, ethernet). PDN type.

activated

Boolean. True on EPS bearer establishment, false on EPS bearer release.

ipv4_address

Optional string. IPv4 address allocated to the UE.

ipv6_prefix

Optional string. IPv6 prefix allocated to the UE.

pdu_session_id

Integer. PDU session identity.

qos_flow_id

Integer. QoS flow identity;

dl_bytes

Optional integer. Number of dowlink bytes sent to the UE. Present when activated is set to false.

ul_bytes

Optional integer. Number of uplink bytes received from the UE. Present when activated is set to false.

start_date

Integer. Start date in seconds since 1970-01-01 00:00:00

duration

Optional number. Duration in seconds of bearer lifetime. Present when activated is set to false.

6.9 Examples

1. Config
   1. Client sends

      {
          "message": "config_get",
          "message_id": "foo"
      }
      

   2. Server replies

      {
          "message_id": "foo",
          "message": "config_get",
          "name": "UE",
          "logs": {
              "phy": {
                  "level": "error",
                  "max_size": 0
              },
              ...
              "rrc": {
                  "level": "debug",
                  "max_size": 1
              }
          }
      }
      

2. Error
   1. Client sends

      {
          "message": "bar",
          "message_id": "foo"
      }
      

   2. Server replies

      {
          "message_id": "foo",
          "message": "bar",
          "error": "Unknown message: bar"
      }
      

7 Command line monitor reference

The following commands are available:

help

Display the help. Use help command to have a more detailed help about a command.

log [log_options]

Display the current log state. If log_options are given, change the log options. The syntax is the same as the log_options configuration property.

enb

List the connected eNodeBs.

ng_ran

List the connected NG-RAN nodes.

ue [reg]

List all the UE contexts (the UEs can be connected or not). If used with parameter reg, only registered UEs will be displayed.

uectx

List all the active S1 or NG UE contexts.

apn

List the configured APN/DNNs.

pws_write local_id

Start broadcasting the ETWS/CMAS message identified by local_id on all connected eNodeBs.

pws_kill local_id

Stop broadcasting the ETWS/CMAS message identified by local_id on all connected eNodeBs.

n8

List the addresses of the AMF client and server and the UDM client and server on the N8 interface.

n8disconnect

Disconnect the AMF client from the UDM on the N8 interface.

n8connect api_root

Connect the AMF client to the UDM server on the N8 interface.
api_root is the api_root of the UDM server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If api_root is not provided, the AMF will try to connect to the previously configured address.

n12

List the AMF client address and the AUSF server address on the N12 interface.

n12disconnect

Disconnect the AMF client from the AUSF on the N12 interface.

n12connect api_root

Connect the AMF client to the AUSF server on the N12 interface.
api_root is the api_root of the AUSF server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If api_root is not provided, the AMF will try to connect to the previously configured address.

n17

List the AMF client address and the EIR server address on the N17 interface.

n17disconnect

Disconnect the AMF client from the EIR on the N17 interface.

n17connect api_root

Connect the AMF client to the EIR server on the N17 interface.
api_root is the api_root of the EIR server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If api_root is not provided, the AMF will try to connect to the previously configured address.

nl1

List the AMF client and server addresses and the LMF client and server addresses on the NL1 interface.

nl1disconnect

Disconnect the AMF client from the LMF on the NL1 interface.

nl1connect api_root

Connect the AMF client to the LMF server on the NL1 interface.
api_root is the api_root of the LMF server in the form: <scheme>://<host>:<port>, where <scheme> is "http" or "https".
If api_root is not provided, the AMF will try to connect to the previously configured address.

lmf_client_connect

Connect an LMF client to the AMF server on the NL1 interface.

lmf_non_ue_n2_unsubscribe n2_callback_uri

LMF server unsubscription to the reception of non-UE NRPPa PDUs.
See 3GPP TS 29.518 chapter 5.2.2.4.3 NonUeN2InfoUnSubscribe. n2_callback_uri: string. Non-UE N2 callback uri.

lmf_ue_n1_n2_subscribe supi imei n1_callback_uri n2_callback_uri

LMF server subscription to the reception of LPP messages and UE NRPPa PDUs.
See 3GPP TS 29.518 chapter 5.2.2.3.3 N1N2MessageSubscribe.
supi: string in the form "imsi-" or "nai-" followed followed by the value of the IMSI or the NAI.
imei: optional string. IMEI (14 digits).
n1_callback_uri: string. N1 callback uri.
n2_callback_uri: string. N2 callback uri.

quit

Stop the program and exit.

8 Log file format

8.1 NAS layer

When a NAS message is dumped, the format is:

time layer - message

When a NAS data PDU is dumped (debug level), the format is:

time layer dir MME_UE_ID message_type
        long_content

time

Time using the selected format

layer

Indicate the layer ([NAS] here).

dir

UL (uplink) or DL (downlink).

MME_UE_ID

MME S1AP UE identifier (hexadecimal).

message_type

NAS message type.

long_content

Full content of the NAS message if nas.max_size > 0.

8.2 IP layer

When a IP data PDU is dumped (debug level), the format is:

time layer dir short_content
        long_content

time

Time using the selected format

layer

Indicate the layer ([IP] here).

dir

UL (uplink) or DL (downlink).

short_content

Single line content (at least the IP protocol and the source and destination address).

long_content

Optional hexadecimal dump of the PDU if ip.max_size > 0.

8.3 S1AP, NGAP, SBcAP, LCSAP and GTP-U layers

When a message is dumped, the format is:

time layer - message

When a data PDU is dumped (debug level), the format is:

time layer dir ip_address short_content
        long_content

time

Time using the selected format.

layer

Indicate the layer ([S1AP], [NGAP], [SBCAP], [LCSAP], or [GTPU] here).

dir

Direction: TO or FROM.

ip_address

source or destination IP address, depending on the dir field.

short_content

Single line content.

long_content

• S1AP, NGAP, SBCAP, LCSAP: full ASN.1 content of the message if layer.max_size > 0.
• GTPU: hexadecimal dump of the message if layer.max_size > 0.

9 FAQ

9.1 Traffic control

I want to generate errors, limit bandwidth, introduce latency...

Easiest and most powerful way is to do this at IP level using the tc Linux command.
There are various tutorials on the internet but it is not a piece of cake so here are some common commands to handle simple case.

First, tc will operate at Linux interface level, which means that for LTE we will control the tun0 interface created by MME.
Note that this configuration will be dropped each time you restart the MME so if you want to set it automatically and keep it we recommand to place the commands inside config/mme-ifup (See tun_setup_script).

• To limit overall bandwidth to 2mbps:

  tc qdisc add dev tun0 root handle 1:0 htb default 1
  tc class add dev tun0 parent 1:0 classid 1:1 htb rate 2000kbit
  

• To simulate 10% packet loss:

  tc qdisc add dev tun0 root handle 1: netem loss 10%
  

• To change previous packet loss to 20%:

  tc qdisc change dev tun0 root handle 1: netem loss 10%
  

• To add 100ms latency with more or less 10ms:

  tc qdisc add dev tun0 root handle 1: netem delay 100ms 10ms
  

• Same as previous but with a normal distribution:

  tc qdisc add dev tun0 root handle 1: netem delay 100ms 10ms distribution normal
  

tc is very powerful and you may also chain filters (qdisc), apply them on specific traffic...

10 Known limitations

We present here the known limitations of LTEMME:

• A single equivalent PLMNs list is supported.
• No interface with external SGW/SMF/UPF is implemented.

11 Change history

11.1 Version 2024-12-13

• S1AP ASN.1 is updated to v18.2.0
• NGAP ASN.1 is updated to v18.3.0
• additional_ue_auth_type parameter is added to epdg configuration object and config_set remote API
• 5gs_authentication parameter is added
• ttl parameter is added to emm_procedure_filter, 5gmm_procedure_filter, esm_procedure_filter and 5gsm_procedure_filter configuration objects. The previous syntax is still supported for backward compatibility
• amf_nf_instance_id parameter is added
• data and ttl parameters are added to ike_generate_error configuration object
• local parameter is added to ue_detach and ue_del remote APIs
• authenticate_known_emergency_supi parameter is added

11.2 Version 2024-09-13

• N62 interface is added
• eap is now deprecated and eap-md5, eap-tls and eap-aka are added to authentication in pdn_list
• auth_type is added to nssai_subject_to_nssaa
• 5gmm_backoff_timer parameter now accepts the value -2
• akma and routing_indicator are added to ue_db
• akma_kaf_lifetime parameter is added
• ipv6_multicast parameter is added in UE database
• rq_timer parameter is added to pdn_list array and config_set remote API
• reflective_qos parameter is added to filters array
• ue_modify_reflective_qos remote API is added
• license remote API is added
• linked_erab_id and pdu_session_id parameters are added to the ue_activate_dedicated_bearer remote API
• mobike parameter is added in epdg object and config_set remote API
• ue_set remote API is added
• use ARP priority 1 for emergency default bearer in mme-ims.cfg configuration file, like our default value for emergency dedicated bearers
• dont_fragment parameter is added to epdg configuration object and config_set remote API
• nas_cipher_algo_null_allowed and nas_integ_algo_null_allowed parameters are added
• mobike value is added to parameter exchange in ike_generate_error
• com_logs_lock parameter is renamed to com_log_lock. com_logs_lock is still supported for backward compatibility
• com_log_us parameter is added
• encr-null-auth-aes-gmac-128, encr-null-auth-aes-gmac-192 and encr-null-auth-aes-gmac-256 values are added to esp_encryption_algo_list

11.3 Version 2024-06-14

• OpenSSL library is upgraded to 1.1.1w
• nghttp2 library is upgraded to 1.61.0
• added indirect data forwarding support during intra RAT handover
• correlation_id parameter is added to remote APIs location_req and nr_location_req response message
• mps_priority and mcs_priority are added to ue_db
• operator_defined_access_categories is added
• idr_for_emergency parameter description is added
• nr_ecid_periodic_meas_termination_req remote API is added
• t3324_forced parameter now accepts the value -2
• added apn monitor command
• added registration_reject remote API event

11.4 Version 2024-03-15

• default APN or DNN is defined per type (IP, unstructured, ethernet)
• added MOBIKE support
• emergency_number_list and extended_emergency_number_list parameters can be changed with config_set remote API
• 5qi_qos parameter is added to erabs array, rx object and ue_activate_dedicated_bearer and ue_modify_pdu_session remote APIs
• qci object in rx object is replaced by qos object. The old syntax is still supported for backward compatibility
• type input parameter and rat_type output parameter are added to ue_get remote API
• local_e_smlc and lmf_cfg parameters are added
• LPPa related location_req, lcsap_reset_req, ecid_periodic_meas_termination and otdoa_information_req remote apis are added
• NRPPa related lmf_non_ue_n2_subscribe, lmf_non_ue_n2_unsubscribe, nr_location_req, nr_cancel_location, nr_otdoa_information_req and trp_information_req remote apis are added
• LPP related lpp_request_location remote api is added
• common LPP/NRPPa lmf_client_connect, lmf_ue_n1_n2_subscribe and lmf_ue_n1_n2_unsubscribe remote apis are added
• load_balancing_tau remote API is added
• sprt_support parameter is added
• mme_name parameter is added
• name parameter is added to s1 and ng_ran remote APIs

11.5 Version 2023-12-15

• EPS user plane integrity protection is added
• registration_mobility_periodic_error parameter is renamed to registration_mobility_periodic_reject_error. registration_mobility_periodic_error is still supported for backward compatibility
• value preferred is added to confidentiality_protection parameter
• loop_count and loop_delay are added to remote API messages
• sim_events, sim_events_loop_count and sim_events_loop_delay parameters are added
• t3442 parameter is added
• tai_lists and tai_lists_5gs parameters are added
• forbidden_eps_tacs parameters is added
• areas_list_5gs, allowed_5gs_tais and forbidden_5gs_tais parameters are added
• csg_info_list is added to ue_db
• com_ssl_ca parameter is added for SSL verification
• backoff_timer parameter now accepts the value -2
• always_on parameter is added to pdn_list
• registration_initial_with_security_protection parameter is added to 5gmm_procedure_filter

11.6 Version 2023-09-08

• NGAP ASN.1 is updated to v17.5.0
• N20 interface support is added
• ursp_rules remote API is added
• t3501 parameter is added
• attach_with_security_protection parameter is added to emm_procedure_filter object
• gtp_use_packet_bundling parameter is added for GTP-U PDUs bundling support
• ipsec remote API added
• ipv6_mtu parameter can no longer be changed using the config_set remote API
• ethernet value is added to pdn_type parameter
• mtu_ethernet_frame_payload parameter is added
• destination_mac_addr, source_mac_addr, 802.1q_ctag_vid, 802.1q_stag_vid, 802.1q_ctag_pcp_dei, 802.1q_stag_pcp_dei, ethertype, destination_mac_addr_range and source_mac_addr_range parameters are added to components object
• nssai_subject_to_nsac parameter is added
• ue_slice_max_bitrate parameter is added