4G Core And

RAN
Network
Emulator
Emulate 4G LTE network nodes and generate realistic traffic between network devices,
including VoLTE IMS, SMS, HTTP data.
4G Core And RAN Network Emulator

OVERVIEW
The Valid8 4G Network Emulator provides an all-in-one, cost-effective and ultra-portable 4G
network for demonstration, testing and training purposes.

WHAT IT CAN DO FOR YOU WHY IT’S DIFFERENT

The 4G Network Emulator solution is capable of simulating and Scalable software-based architecture can run on a range of hardware

testing several devices individually or in parallel. There are options from COTS and high-end customer provided hardware to Virtual
Machines and the Cloud (e.g. Amazon AWS) for maximum versatility and
available to include a real eNodeB OTA if you need to use real UEs
performance
or IoT devices with traffic generation, or our simulated eNodeB if
Web-based UI is easy to learn
you don’t need the RF interface. Subsystems can be switched on HTTP API enable integration with automation test systems and other
or off depending on how much of the network you need equipment
simulated. Stateful modeling provides accurate emulation of network elements

Example: A network service provider would want to test how

their network would function in a real deployment.

Will it properly handle Control plane and User plane traffic?

Will it conform to 3GPP standards?
How will it perform under load?

Example: A UE device manufacturer wants to test performance

and security in a cost-effective way

Verify connections to specific PLMNs in a deterministic network

environment
What happens when invalid messages are sent to it?
How will it perform under load?

FEATURES
Realistic network emulation of up to 1,000s of devices and calls (scalable) LTE-M:
Emulates some or all of core network, exposing all internal interfaces
Conformance tests available for each interface (S1, S5, S6a, S7, S11, Rx, Gx, Release 14 compliant
Gy, Ro) Category M1 UE support
Emulators available per subsystem (MME Emulator, PCRF Emulator, etc.)
TM6 and TM9 support
OTA connection available for UEs and IoT devices
FDD only (FDD and HD-FDD UEs are supported)
True stateful simulation
Handover support on X2 and S1 Support of multiple CE levels (only CE-Mode A is supported)
Signaling request/response messages for call handling, mobility Support of message repetition for MPDCCH, PDSCH and PUSCH in full
management, authentication, QoS duplex (only MPDCCH, PDSCH and PUSCH supported)
Report on media received, call connect time, call duration, jitter, packet Support of localized MPDCCH transmission
loss
EPDCCH support for Category M1
Generate valid and invalid/negative messages and call-scenarios (fully
editable scenarios) No frequency hopping

Supports sending invalid messages including malformed, dropped, and Bandwidth must be >= 5 MHz for cells that also need to support Category
misordered packets 0 and above UEs
Check parameters in messages from SUT and flag errors
Diameter CER/A, DWR/A, CCR-I/A, CCR-U/A, CCR-T/A, RAR/A NB-IOT:
request/response messages
Release 14 compliant
3GPP-compliant interfaces
Alerts and notifications Single-tone and multi-tone category NB1 and NB2 UE support
Core network 5G ready 15 kHz and 3.75 kHz subcarrier spacing are supported
All operation modes (in-band, guard band and standalone) are supported
Multiple NB-IoT and LTE cells can be used at the same time in the same
eNodeB
Support of multiple coverage levels
Support of all NPDCCH, NPDSCH, NPUSCH and NPRACH configurations

Support of control plane CIoT optimization

Support of multi-DRB mode
4G Core And RAN Network Emulator

eNodeB (femto, pico, or emulated)

SUBSYSTEMS
MME
The Valid8 4G Network Emulator is compromised of multiple subsystems that are available SGW
individually or in parallel, and are scalable to fit your needs. The individual emulators are PGW
controllable through their call controllers, and the traffic can be captured through use of a OCS
HSS
remote capture tool such as Wireshark.
PCRF
ePDG
SGSN
CSCF
PCEF
SMSC
GMSC
4G Core And RAN Network Emulator

KPIs Configurable Parameters

S1 Attach Requests/Successes/Fails Mobile Country Code
S1 Detach Requests/Successes/Fails Mobile Network Code
S1 Dedicated Bearer Requests/Successes/Fails eNodeB Type
Current Active Sessions/ Bearers IP Addres S1 Interface
Number of Sessions/ Bearers Created IP Address eNodeB
S1 Attach Request Response Time Primary DNS Address
S1 Dedicated Bearer Setup Request Response Time Secondary DNS Adress
S1 Detach Request Response Time MAC Address Public Gateway
S1 Authentication Request Response Time GTP Tunnel IP Address and Port
S6a Authentication Request Response Time GTP Tunnel eNodeB IP Address
S1 Tracking Area Update Request Response Time Integrity Algorithm
IP Address to assign UEs on LAN

AUTOMATION API
User commands can be fully automated using REST API. This includes performing all test
control functions as well as collecting results and metrics. It can be integrated into virtually any
CI system via the HTTP API, including Jenkins, CircleCI, Gitlab and others.
4G Core And RAN Network Emulator

SCRIPTING
The application’s subsystems can be edited directly in the browser using TDL or by using the
graphical tools. The Message Workshop allows for creating of test scenarios directly from the
hex stream of a remote capture, while the Graphical Editor (on the feature roadmap for 2019) will
allow for creating customized call scenarios by dragging and dropping the call flow to meet
your test needs.
4G Core And RAN Network Emulator

USE CASES
ENODEB UNDER TEST

In the scenario where the eNodeB is to be tested, it can be tested by

the Valid8 4G Network Emulator emulating the core network.
Additionally, load and conformance tests are available for interfaces
S1-MME and S1-U. In the case where the eNodeB needs to be tested
on the RF side, it can be tested by the Valid8 4G UE Emulator.

Supported Scenarios:

Power on / Start up
Emulates MME (for S1-MME) and SGW (for S1-U) along with all other
Attach
needed core network elements, exposing all internal interfaces
TAU
Conformance tests available for S1-MME, S1-U, and X2
Attach
eRAB Setup
Detach
X2 handover

UE UNDER TEST

For testing UE or IoT devices, the 5G, 4G or 3G Network Emulators can

provide the entire core network as well as an emulated or real base
station depending on your test needs.

Supported Scenarios:

Power on
Attach
End to end VoLTE test capability
Detach
Includes real femto, pico, or microcell eNodeB
TAU
Emulates all core network nodes and allows for data connection to
Data Connection
external networks
VoLTE Call

PGW UNDER TEST

For testing the PGW, the 4G Network Emulator can wrap around the
node using the S5/8, S7, Sxx and SGi interfaces. Traffic can be
originated from real or emulated UE and IoT devices.

Supported Scenarios:

Create Session
Delete Session
Create Bearer
Modify Bearer
Emulates all required nodes for wrapping around, including MME
Delete Bearer
and PCRF for testing over interfaces S5/8, S7, Sxx nd SGi
Echo

Exposes all internal interfaces

Conformance tests available for each interface (S5/8, S7, Sxx, SGi)

PCRF UNDER TEST

For testing the PCRF, the 4G Network Emulator can wrap around the
PCRF with the core network and IMS.

Supported Scenarios:
4G Core And RAN Network Emulator

SUMMARY OF SPECIFICATIONS
The Valid8 4G Network Emulator is capable of simulating and testing several devices
individually or in parallel and is scalable to fit your needs.

SPECIFICATIONS

Protocols 3GPP TS 23.401 (EUTRAN)

3GPP TS 24.301 (NAS)
3GPP TS 29.060 (GTPv1)
3GPP TS 29.272 (S6a)
3GPP TS 29.212 (Gx)
3GPP TS 29.214 (Rx)
3GPP TS 29.274 (GTPv2-C)
3GPP TS 29.281 (GTPv1-U)
3GPP TS 32.299 (Gy)
3GPP TS 36.413 (S1AP)
3GPP TS 36.414 (S1-U)
3GPP TS 29.338 (Gdd/Sgd)
IETF RFC6733 - Diameter
IETF RFC4006 - Ro
IETF RFC5246 - TLS, Protocol
(1.0,1.1,1.2)
IETF RFC6101 - SSL, Protocol Version
3.0
IETF RFC793 - TCP
IETF RFC768 - UDP
IETF RFC4960 - SCTP
IETF RFC791 - IPv4
IETF RFC2460 - IPv6
IETF RFC3550 - RTP / RTCP
IETF RFC3711 - SRTP
IETF RFC1035 - DNS
IETF RFC2131 - DHCP

Mobile Management Entity NAS

SAE Bearer Management

UE Location, Subscriber Data
Handling
Authentication
Fault Recovery
Notification
Mix of PDN types, IPv4, IPv6
Up to 2 sessions per IMSI
Interface S1-MME to eNodeB: S1-AP
Interface S6a to HSS: Diameter over
SCTP
Interface S11 to SGW: eGTP-C/GTPv2-
C
Supports up to 4 eNodeBs (scalable)

Serving Gateway SGW Packet Routing and Transfer

Functions
IP Address Allocation

Interface S1-U to eNodeB: GTP-U

Interface S4 to SGSN: GTP-U, eGTP-
C/GTPv2-C
Interface S5 to PGW: GTP-U, eGTP-
C/GTPv2-C
Interface S11 to MME: eGTP-C/GTPv2-
C

PDN Gateway Packet Routing and Transfer

Functions

IP Address Allocation
Interface S5 to SGW: GTP-U, eGTP-
C/GTPv2-C
Interface S7 to PCRF: Diameter over
SCTP

HSS Subscriber profiles

UE Location
Subscriber Data Handling
Authentication (AuC)
Fault Recovery
Notification

ePDG
4G Core And RAN Network Emulator

eNodeB GTP (S2a/b) to PGW

IKEv2 and ESP Encryption: DES-CBC,
DES-CBC,128 bit AES-CBC, 192 bit
AES-CBC, 256 bit AES, Null, 128 bit
AES-CTR, 192 bit AES-CTR, 256 bit
AES-CTR, 168 bit 3DES-EDE-CBC
IKEv2 and ESP Integrity Algorithms:
96 bit AES XCBC, 96 bit MD5 HMAC,
96 bit SHA1 HMAC

PCRF Operational Frequency Bands:

Internal femtocell: 400 - 6000 Mhz

(includes unlicensed 5Ghz bands)
External picocell: Bands 2, 3, 4, 7, 9, 10,
12, 17, 20, 25, 38, 40, 41, 42, 43
(includes CBRS band)
Duplex: FDD & TDD
Synchronization: GPS
Modulations from QPSK to 256QAM
(Rel 12)
Connector type - Femtocell: SMA
female
Connector type - Picocell: N-type
female
Interface S1-MME to MME: S1-AP
Interface S1-U to SGW: GTP-U
Interface X2 to eNodeB: X2-AP
Interface Uu to UE
Interface M1 to eMBMS
Supports up to 32 UEs with 4 bearers
each
* = roadmap

SMSC Policy Control Functions

QoS Authorization

GMSC Diameter

IP CER/A, DWR/A, CCR-I/A, CCR-U/A,

CCR-T/A, RAR/A request/response
messages

Test Scenarios 1,000 Mbps total throughput

Network Emulation Attach and Default EPS Bearer

Context Activation

Attach / Reject
Detach
Tracking Area Update
E-UTRA Handover
PDN Connectivity Request
HTTP Browsing

Quality Testing Simulated network delays and packet

loss

VoLTE Voice Quality Analysis

QoE
4G Core And RAN Network Emulator

PRODUCT DETAILS

Hardware Intel-based; scalable to meet

performance needs

Options P5088/01 includes base kit

(simulated eNB)
P5089/01 includes LTE pico eNB
(single band)
P8110/02 includes LTE femto eNB
(multi band)
Conformance tests available for each
interface (S1, S5, S6a, S7, S11, Rx, Gx,
Gy, Ro)

Operating System Protocol Engine (Linux-based)

User Interface Browser-based, touch-optimized

graphical user interface

Automation HTTP API

Max output power 31 mW (femto RF module option)

1000 mW per Tx (exernal picocell
option)

Connector types Femtocell: SMA female

Picocell: N-type female

Hardware dimensions M3: 19” x 15.75” x 3.5”; appx. 16.7lb

Power supply M3: 520W AC to DC, 100 - 240v