Level 14
5G Protocol Testing & Log Analysis
Master 5G protocol testing and log analysis end-to-end — protocol testing fundamentals (conformance vs interoperability, 3GPP TS 38.523, test methodology, protocol layers, UE categories), log analysis tools (QXDM, QCAT, Wireshark 5G dissectors, network-side analyzers, chipset vendor tools), NAS & RRC protocol analysis (registration traces, PDU session traces, RRC reconfiguration, handover traces, authentication traces, timer expiry troubleshooting), and test case design & automation (test methodology, test case writing for registration/PDU/HO, automation frameworks, defect reporting).
0%
0/31 lessons
Protocol Testing Fundamentals
0/7Understand the foundations of 5G protocol testing — conformance, interoperability, and field validation. Learn 3GPP test specifications (TS 38.523), the end-to-end test methodology, protocol layers and their testable aspects, and UE categories and capability testing.
What is protocol testing: conformance, interoperability, field validation
The three pillars of protocol testing — conformance testing (does the UE/gNB implement the protocol exactly as 3GPP specifies), interoperability testing (can devices from different vendors work together correctly), and field validation (does the protocol work under real-world conditions). The testing pyramid from spec compliance to deployment readiness.
lesson3 min
3GPP test specifications: TS 36.523 (LTE), TS 38.523 (NR) conformance
Navigating the 3GPP conformance test specifications — TS 38.523 structure (test cases organized by protocol layer and procedure), how test cases reference normative specs (TS 24.501, TS 38.331), test applicability based on UE capability, and how GCF/PTCRB certification drives conformance testing requirements.
lesson4 min
Test methodology: test plan → test cases → execution → defect → regression
The end-to-end testing lifecycle — creating a test plan from requirements, deriving test cases (positive, negative, boundary), test execution with pass/fail criteria, defect logging and classification, regression testing after fixes, and traceability from requirements through test cases to defect resolution.
lesson3 min
Protocol layers and their testable aspects: NAS, RRC, PDCP, RLC, MAC, PHY
What is testable at each 5G protocol layer — NAS (registration, authentication, session management messages and state machines), RRC (connection setup, reconfiguration, measurement reporting, handover), PDCP (ciphering, integrity, header compression, reordering), RLC (ARQ, segmentation, reassembly), MAC (scheduling, HARQ, random access, BSR/PHR), PHY (modulation, coding, MIMO, beam management). Layer-by-layer test scope.
lesson4 min
UE categories and capability testing: FR1, FR2, CA combinations, feature sets
UE capability framework — UE-NR-Capability IE structure, frequency band combinations (FR1 sub-6 GHz, FR2 mmWave), supported CA/DC combinations, MIMO layers, modulation support, feature groups (VoNR, positioning, sidelink), and how capabilities are signaled in UECapabilityInformation messages. Testing against declared vs actual capabilities.
lesson4 min
Lab: Navigate a 3GPP test spec and identify test case structure
Hands-on lab — guided exercise to navigate TS 38.523 test specification structure, identify a test case for 5G NR registration, understand the test case format (initial conditions, test procedure steps, expected messages), and map test cases back to normative specification requirements.
lab5 min
Quiz: Protocol testing fundamentals
Test your understanding of protocol testing types, 3GPP test specifications, test methodology, protocol layer testability, and UE capability testing.
quiz3 min
Log Analysis Tools
0/7Master the essential tools for 5G protocol analysis — QXDM Professional for real-time UE logging, QCAT for offline analysis, Wireshark for NAS/RRC/NGAP/PFCP dissection, network-side analyzers, and chipset vendor-specific tools from Qualcomm, MediaTek, and Samsung.
QXDM Professional: real-time UE logging, filter configuration, message view
QXDM Professional deep dive — connecting to a Qualcomm-based UE via DIAG port, configuring message filters (NAS, RRC, internal events), real-time message view with decoded IE display, log mask configuration for targeted capture (minimizing data volume while capturing relevant messages), and saving logs for offline analysis in QCAT format.
lesson4 min
QCAT: offline log analysis, message decoding, event filtering
QCAT analysis workflow — loading QXDM logs for offline analysis, message filtering by protocol layer and message type, detailed IE-level decoding with bit-field expansion, event timeline view (attach, HO, call setup events marked on timeline), measurement analysis (RSRP, RSRQ, SINR over time), and exporting decoded messages for reporting.
lesson4 min
Wireshark for 5G: NAS/RRC/NGAP/GTP/PFCP/HTTP2 dissectors and filters
Wireshark 5G protocol analysis — built-in dissectors for NAS-5GS, NR-RRC, NGAP, GTP-U/GTP-C, PFCP, and HTTP/2 (SBI). Key display filters (nas-5gs, nr-rrc, ngap, pfcp), capturing on N2/N4/N11 interfaces, decoding NAS messages from NGAP containers, and following SBI HTTP/2 streams between NFs. Filter cheatsheet and capture setup for common scenarios.
lesson4 min
Network-side protocol analyzers: VIAVI TeraVM, NETSCOUT nGeniusONE
Network-side analysis tools — VIAVI TeraVM for core network protocol simulation and testing, NETSCOUT nGeniusONE for real-time SBI monitoring across 5GC interfaces, Spirent Landslide for load and performance testing, and Keysight UXM/Amarisoft for air interface protocol testing. How network-side tools complement UE-side logging for end-to-end visibility.
lesson3 min
Chipset vendor tools: Qualcomm QXDM/QCAT, MediaTek ELT, Samsung Shannon
Vendor-specific UE logging tools comparison — Qualcomm QXDM/QCAT (industry standard, extensive decode coverage), MediaTek ELT (Engineering Logging Tool for MediaTek Dimensity chipsets), Samsung Shannon Modem Logger (for Exynos modem-based devices), and Apple wireless diagnostics. Common and unique features across vendor tools, and when to use which tool.
lesson3 min
Lab: Decode a 5G NR NAS message in QCAT — Registration Request IE by IE
Hands-on log decoding lab — walk through a real 5G NAS Registration Request message IE by IE: Extended Protocol Discriminator, Security Header Type, Registration Type (initial/mobility/emergency), 5GS Mobile Identity (SUCI with scheme output), NAS Key Set Identifier, 5GMM Capability, UE Security Capability, Requested NSSAI, and Last Visited TAI.
lab5 min
Quiz: Log analysis tools
Test your knowledge of QXDM, QCAT, Wireshark 5G dissectors, network-side analyzers, and chipset vendor tools.
quiz3 min
NAS & RRC Protocol Analysis
0/8Analyze real 5G protocol traces step by step — NAS registration traces with IE decoding, PDU session establishment with PFCP/GTP tunnel tracking, RRC reconfiguration analysis, handover traces, authentication flow analysis, timer expiry troubleshooting, and a hands-on debug challenge with multiple failure scenarios.
NAS Registration trace analysis: step-by-step with IE decoding
Step-by-step 5G NAS registration trace analysis — Registration Request (SUCI, registration type, requested NSSAI), Authentication Request/Response (RAND, AUTN, RES*), Security Mode Command/Complete (ciphering and integrity algorithms), Registration Accept (5G-GUTI, allowed NSSAI, tracking area list, registration result). IE-by-IE decoding of each message with field explanations.
lesson5 min
NAS PDU Session Establishment trace: PFCP, N4, GTP tunnel creation
PDU session establishment trace walkthrough — PDU Session Establishment Request (PDU session type, SSC mode, DNN, S-NSSAI), SMF interaction with PCF (policy fetch) and UPF (N4 PFCP Session Establishment), GTP tunnel creation on N3 (gNB-UPF), PDU Session Establishment Accept (QoS rules, QoS flow descriptions, authorized QoS, PDU address). Tracking TEID and SEID across interfaces.
lesson5 min
RRC Setup and Reconfiguration analysis: SRB/DRB setup, measurement config
RRC message analysis — RRC Setup (SRB1 configuration, initial BWP parameters), RRC Reconfiguration (DRB setup with SDAP/PDCP/RLC configs, measurement configuration with measObjects and reportConfigs, measGapConfig, secondary cell group for CA/DC). How to read measurement IDs, reporting triggers (A1-A6 events), and filter coefficients from RRC traces.
lesson4 min
Handover trace analysis: MeasurementReport → HO Command → HO Complete
End-to-end handover trace walkthrough — MeasurementReport (serving and neighbor RSRP/RSRQ, event A3 trigger), RRC Reconfiguration (HO command with target cell configuration, RACH resources for target, source cell release), RRC Reconfiguration Complete (sent to target cell confirming successful HO). Analyzing HO preparation time, execution time, and interruption time from timestamps.
lesson5 min
Authentication trace: 5G-AKA message flow with AUTN, RES*, SUCI decoding
Security procedure trace analysis — SUCI generation (SUPI → SUCI using ECIES with home network public key), Authentication Request (RAND, AUTN from AUSF/UDM via AMF), UE verification of AUTN (SQN freshness, MAC check), Authentication Response (RES* computed by UE), AUSF verification (HRES* comparison), and NAS Security Mode Command (selected algorithms: NEA1/NEA2/NEA3, NIA1/NIA2/NIA3).
lesson4 min
Common protocol failures: timer expiry (T3510, T3511, T3512), reject causes
Protocol timer analysis — T3510 (Registration Request retry, 15s, max 5 attempts), T3511 (registration failure backoff, starts at 10s), T3512 (periodic registration update, default 54 min), T3502 (registration attempt counter reset), T3346 (congestion backoff from network). How each timer affects UE behavior on expiry, and common reject causes that trigger these timers: #5, #11, #15, #22, #71, #73.
lesson4 min
Lab: Debug a failed registration — find the root cause from UE logs
Hands-on debug lab — 5 independent failure scenarios with UE log traces: (1) SUCI computation failure, (2) authentication failure (MAC mismatch), (3) registration rejected #11 (PLMN not allowed), (4) NAS Security Mode Command failure, (5) T3510 expiry with no response. Analyze each trace, identify the root cause, and explain the fix.
lab6 min
Quiz: NAS & RRC analysis
Comprehensive quiz covering NAS registration trace analysis, PDU session establishment, RRC reconfiguration, handover traces, authentication procedures, and timer-based troubleshooting.
quiz5 min
Test Case Design & Automation
0/9Learn to design comprehensive test cases for 5G procedures — test methodology (positive, negative, boundary, stress), writing test cases for registration/PDU session/handover, test automation frameworks, defect reporting, and a capstone exercise to write a complete test plan.
Test case design methodology: positive, negative, boundary, stress testing
Test case design techniques — positive testing (verify correct behavior with valid inputs), negative testing (verify correct handling of invalid inputs and error conditions), boundary testing (test at the edges of valid ranges — max PDU sessions, max DRBs, max S-NSSAI), and stress testing (high load, rapid state transitions, concurrent procedures). How to derive test cases systematically from specification requirements.
lesson4 min
Writing test cases for 5G Registration (10 test cases with steps & expected)
Registration test case writing — 10 detailed test cases covering: initial registration (new SUPI), mobility registration (TAU), periodic registration (T3512 expiry), emergency registration, registration with requested NSSAI, registration with invalid SUCI, registration reject handling (#3, #11, #22), re-registration after NAS Security Mode failure, concurrent registration attempts, and registration during ongoing PDU session.
lesson5 min
Writing test cases for PDU Session procedures (10 test cases)
PDU session test case writing — 10 test cases: initial PDU session establishment (IPv4, IPv6, IPv4v6), PDU session with specific DNN and S-NSSAI, PDU session modification (QoS update), PDU session release (UE-initiated, network-initiated), max PDU sessions per UE, PDU session with unknown DNN rejection, SSC mode 1/2/3 behavior, always-on PDU session, and PDU session establishment during handover.
lesson5 min
Writing test cases for handover procedures (8 test cases)
Handover test case writing — 8 test cases: intra-gNB handover (inter-cell), Xn-based inter-gNB handover, N2-based inter-gNB handover (no Xn), inter-frequency handover, handover with bearer modification, handover failure and RRC re-establishment, conditional handover (CHO), and inter-RAT handover (5G to LTE fallback).
lesson4 min
Test automation frameworks: Robot Framework, pytest, Spirent iTest
Test automation for telecom — Robot Framework (keyword-driven, widely used in telecom labs, TTCN-3 integration), pytest (Python-based, flexible for custom protocol testing), Spirent iTest (commercial automation for network testing), and TTCN-3 (Testing and Test Control Notation, 3GPP standard language for conformance tests). Framework selection criteria, CI/CD integration, and test reporting.
lesson4 min
Defect reporting: severity classification, reproduction steps, log attachment
Writing effective defect reports — severity classification (Critical: call drop/no service, Major: feature failure/performance degradation, Minor: cosmetic/non-functional, Trivial: documentation/spelling), components of a good defect report (summary, environment, preconditions, steps to reproduce, expected vs actual result, log/trace attachment), defect lifecycle (New → Assigned → Fixed → Verified → Closed), and defect triage process.
lesson3 min
Real-world: A day in the life of a protocol test engineer
Walk through a typical day for a protocol test engineer — morning stand-up with test status, test execution on lab equipment (UXM, CMX500, Amarisoft), log capture and analysis when tests fail, defect triage meeting with development team, test case review and maintenance, regression testing after firmware updates, and IOT (interoperability) testing with operator SIMs.
lesson3 min
Lab: Write a complete test plan for 5G initial attach with 15 test cases
Capstone lab — write a complete test plan for 5G initial attach covering: test plan objectives, scope, test environment (equipment, UE, SIM configuration), 15 test cases (5 positive, 5 negative, 3 boundary, 2 stress) with detailed steps and expected results, pass/fail criteria, and test execution schedule. Evaluated against industry best practices.
lab8 min
Quiz: Test case design & automation
Level gate quiz covering test case design methodology, test case writing for 5G procedures, automation frameworks, defect reporting, and protocol testing workflow.
quiz5 min