Analyzing 5G SA Attach with srsUE and Open5GS

A Guide to Our Network's Logs

Before we start, it's important to know where to look for information. Our distributed system generates logs in several places. The following resource is an excellent guide to making sense of them.

To summarize, we will be looking at three main sources of information:

1. Open5GS Logs: Located in /var/log/open5gs/. The amf.log is the most important for today's lesson, as the AMF orchestrates the UE's connection.
2. srsRAN gNB Console: The gNB will print live status updates to the terminal where it's running. This shows its connection to the core and interactions with the UE.
3. srsUE Console: The UE also prints its status to the terminal, showing its search for a cell, the connection progress, and the final IP address assignment.

Step 1: Launch the 5G Core Network (Open5GS)

First, we need to start the core network. In the previous lesson, we used docker-compose to deploy Open5GS.

1. Navigate to the Open5GS-srsRAN/docker directory from the guide we used last time.
2. Start the core network services:

   docker-compose up -d
   

3. Now, let's watch the AMF log in a new terminal window. The -f flag will "follow" the log, showing new entries as they appear.

   sudo tail -f /var/log/open5gs/amf.log
   

You should see initialization messages as the AMF starts up and prepares its interfaces. As described in the "5GC Network Function Startup" section of the log analysis guide, the AMF creates an NGAP server, and the other core components (SMF, UPF) establish their own connections. For now, the logs will be quiet, waiting for a base station to connect.

Step 2: Launch the gNB and Connect to the Core

Next, we'll start our srsRAN gNB. It will connect to the AMF in the core network.

1. In a new terminal, navigate to the directory where you built the srsRAN Project (srsRAN_Project/build/).
2. Start the gNB using the configuration file we prepared in the last lesson.

   sudo ./apps/gnb/gnb -c ../../gnb_zmq.yaml
   

   (Note: Adjust the path to your gnb_zmq.yaml file if you placed it elsewhere.)

Now, observe both the gNB's terminal and the AMF log you are tailing.

• In the gNB terminal: You should see a series of initialization steps, followed by a crucial message confirming its connection to the core. The srsRAN documentation we reviewed previously shows what to look for:

  NG connection successful
  ==== gNodeB started ====
  

• In the amf.log terminal: You will see a flurry of new activity. The AMF log will show that it has accepted an incoming N2 connection from the gNB's IP address and completed the NG Setup procedure. This establishes the control plane link between the radio network and the core.

This two-way confirmation tells us the gNB is operational and successfully registered with the core network. It is now broadcasting its cell information (MIB and SIB1), waiting for a UE.

Step 3: Launch the UE and Verify the Attach Procedure

This is the main event. We will now start the srsUE and trace its entire registration and connection process through the logs.

To help visualize the process, refer to this sequence diagram. It shows the standard messages exchanged between the UE, gNB, and AMF during a 5G SA registration. We will look for evidence of these steps in our logs.

1. In a final terminal window, navigate to your srsRAN 4G build directory (srsRAN/build/).
2. Start the UE, pointing it to its configuration file:

   sudo ./srsue/src/srsue -c ../ue_zmq.conf
   

   (Note: Adjust the path to ue_zmq.conf as needed.)

Keep an eye on all three terminals (UE, gNB, and AMF log). Here is the sequence of events you should observe, corresponding to the attach procedure:

The "Open5GS and srsRAN 5G Network Log Analysis" resource you read earlier details what many of these log entries look like in its "UE Connect to 5G Network" section. It's a great reference to have open as you watch the process unfold.

Your background with Wireshark will be useful here. The srsRAN and Open5GS components can generate .pcap files. If you were to open the gtpu.pcap or ngap.pcap from the gNB, you would see these protocol messages directly. For example, a successful PDU session setup would look something like this in Wireshark, showing the IP address allocated to the UE.

Step 4: Confirm End-to-End Data Connectivity

The UE console shows an IP address, but let's prove the connection works. Because the UE is running in a dedicated network namespace, we need to use the ip netns exec command to run commands from its perspective.

In a new terminal, ping the UPF's gateway address (10.45.0.1 in our default setup) from the UE's namespace (srsue):

sudo ip netns exec srsue ping 10.45.0.1

If you see successful ping replies, you have definitively verified a complete, end-to-end 5G SA connection!

Conclusion

Excellent work. You have successfully launched a 5G Standalone network and, more importantly, traced the entire attach procedure through the system's logs. This is a critical skill for both troubleshooting and security analysis.

Key Takeaways:

• The 5G SA attach procedure is a multi-stage process involving the UE, gNB, and several core network functions, primarily orchestrated by the AMF.
• We can verify each stage by observing console outputs and log files, particularly amf.log.
• Key milestones to look for are: NG connection (gNB-AMF), RRC setup (UE-gNB), NAS Registration Accept (AMF-UE), and PDU Session Establishment (IP address assignment).
• Confirming a successful attach with a simple ping from the UE's network namespace provides end-to-end validation.

Preview of the Next Lesson:

Now that we have a stable, working 5G network and know what a normal connection looks like, we can start exploring how to disrupt it. In the next lesson, we will perform our first active attack: "Demonstrate a bidding-down attack by broadcasting a stronger, malicious 4G cell alongside a legitimate 5G cell." This will force our 5G-capable UE onto a less secure 4G network, a common objective for attackers.