INITIALIZING_ACCESS_PROTOCOL...
← Back to Tools Console
[ SYSTEM_NOTICE :: TOP_RESEARCH_NODE ]
System Node · Research Ready · SRSRAN
srsRAN — Open-Source 4G LTE & 5G NR RAN Security Research
Research Overview
TL;DR — srsRAN implements the complete 3GPP LTE (Releases 8–15) and 5G NR (Release 15/16) radio access stack including srsUE (UE simulator), srsENB (4G eNodeB), and srsGNB (5G SA/NSA gNodeB). The stack interfaces with SDR hardware via UHD (USRP), SoapySDR, or ZeroMQ for RF-less simulation. Security researchers use srsRAN paired with Open5GS core to build full 4G/5G testbeds for NAS/RRC protocol fuzzing, Security Mode Command downgrade testing, SUCI handling validation, and controlled rogue base station research against commercial UEs per 3GPP TS 33.401 and TS 33.501.
srsRAN implements the full 3GPP LTE (Releases 8–15) and 5G NR (Release 15/16) radio access stack across three components: srsUE (compliant UE with NAS/RRC/PDCP/RLC/MAC/PHY layers), srsENB (LTE eNodeB), and srsGNB (5G SA/NSA gNodeB). The software radio stack interfaces with SDR front-ends via UHD (USRP), SoapySDR, or ZeroMQ for RF-less simulation, making it the primary open-source platform for protocol-layer RAN security research. All air interface parameters — ARFCN/GSCN, bandwidth, MCC/MNC, TAC, and cell identity — are fully configurable, enabling precise replication of target network radio profiles.
In testbed configurations, srsRAN pairs with Open5GS core via the S1-MME/NG-C interfaces (SCTP/S1AP for 4G, SCTP/NGAP for 5G) to create fully functional end-to-end networks for protocol security testing. Researchers instrument the RRC layer to inject malicious SIB (System Information Block) content targeting UE behaviour per 3GPP TS 36.331 and TS 38.331, or modify NAS messages at the MME/AMF interface to test authentication bypass conditions. The ZeroMQ RF front-end enables multi-UE simulation with QCSuper-equipped Android devices as reference endpoints for ground-truth baseband comparison.
srsRAN's srsUE is used offensively for false base station detection research: by scripting controlled rogue eNB or gNB deployments, researchers can validate whether target UEs enforce NAS Security Mode Command procedures, reject unprotected RRC connections, or silently accept downgrade attacks from NR to LTE to GSM. This directly probes 3GPP TS 33.501 (5G security) and TS 33.401 (EPS security) control-plane integrity requirements. Findings from srsRAN-based experiments are cross-validated at the baseband layer using SCAT or QCSuper diagnostic log captures.
Key Research Applications
- >Deploy controlled 4G LTE eNodeB with Open5GS EPC for NAS/RRC protocol security testing, including SMC downgrade and authentication bypass per 3GPP TS 33.401
- >Simulate 5G SA gNodeB with configurable NGAP/NAS-5G parameters to test AMF implementations for SUCI handling defects, 5G-AKA vector replay, and NSSAI manipulation vulnerabilities
- >Conduct rogue base station detection research by deploying srsRAN cells with forged SIBs and measuring UE attachment behaviour and AS security negotiation
- >Instrument RRC and NAS layers via srsRAN logging and PCAP export for cross-layer correlation with QCSuper or SCAT baseband captures during UE protocol conformance testing
Technical Specifications
Operational Mode
Level 1 certification required. Targeting RAN infrastructure layers.
Compatibility
SDR hardware (USRP/BladeRF) required.
Secure Audit Threat Vectors
A fully controllable RAN stack enables class-breaks in UE security assumptions. Rogue eNB/gNB deployments implemented with srsRAN expose UEs that accept SIBs without integrity protection — mandatory only from NR Release 15 onward — allowing an attacker to broadcast forged TAC/LAC values, manipulate PLMN selection, and force UEs into adversary-controlled cells without triggering AS security procedures. 3GPP TS 36.331 Section 5.3.3 defines integrity-check failure handling, but commercial UE implementations frequently exhibit silent fallback behaviours exploitable via crafted RRCConnectionSetup messages with NULL integrity algorithms.
At the NAS layer, srsRAN exposes the MME/AMF interface for injection of crafted Attach Accept, Identity Request, and Authentication Request messages. Unprotected NAS Identity Requests are prohibited by 3GPP TS 33.401 Section 6.6 outside the initial attach window, but remain exploitable where MME implementations accept cleartext IMSI responses after security establishment. 5G NR partially mitigates this through SUCI (Subscription Concealed Identifier, TS 33.501 Section 6.12), but srsRAN-based testing has demonstrated residual SUPI leakage in NSA deployments where the LTE anchor cell handles initial identity procedures before 5G security context is established.
Frequently Asked Questions
What is srsRAN — Open-Source 4G/5G RAN?
srsRAN — Open-Source 4G/5G RAN is an open-source telecom security utility in the RAN category. srsRAN implements the complete 3GPP LTE (Releases 8–15) and 5G NR (Release 15/16) radio access stack including srsUE (UE simulator), srsENB (4G eNodeB), and srsGNB (5G SA/NSA gNodeB). The stack interfaces with SDR hardware via UHD (USRP), SoapySDR, or ZeroMQ for RF-less simulation. Security researchers use srsRAN paired with Open5GS core to build full 4G/5G testbeds for NAS/RRC protocol fuzzing, Security Mode Command downgrade testing, SUCI handling validation, and controlled rogue base station research against commercial UEs per 3GPP TS 33.401 and TS 33.501.
Which category does srsRAN — Open-Source 4G/5G RAN belong to?
srsRAN — Open-Source 4G/5G RAN is categorized under RAN in the TelcoSec Tools console. This category covers tools used for auditing Radio Access Network air interfaces, base station broadcasts, and SDR-based signal capture.
What SDR hardware is required to run srsRAN over the air?
srsRAN supports Ettus USRP B-series (B200/B210 recommended for single-carrier LTE/NR), X-series for MIMO configurations, and LimeSDR via SoapySDR. For 5G NR, adequate sample rate and phase noise performance are critical — the B210 covers up to 56 MHz bandwidth, supporting LTE 20 MHz and NR FR1 sub-6 GHz with limited carrier aggregation. For RF-less protocol testing without hardware, ZeroMQ transport (--rf.device_name=zmq) runs the full NAS/RRC/PDCP stack over loopback sockets, which is the preferred configuration for CI/CD-integrated protocol fuzzing and reproducible security research.
How does srsRAN differ from OsmocomBB for cellular security research?
srsRAN targets LTE (4G) and 5G NR and implements the full E2E RAN stack with a standards-conformant protocol implementation suitable for controlled testbed research. OsmocomBB targets 2G GSM exclusively, replacing proprietary baseband firmware on Calypso hardware to access Layer-1 GSM on real MS hardware — making it better suited for GSM sniffing, TMSI catching, and A5/1 cipher analysis. The two tools are complementary: srsRAN provides controlled 4G/5G protocol testbeds at the network side while OsmocomBB delivers raw GSM physical-layer UE-side access unavailable in commercial handset stacks.
ADVANCED_TRAININGRAN Security PathRecommended for: srsRAN — Open-Source 4G/5G RAN
Master srsRAN — Open-Source 4G/5G RAN Security at the Academy
Upgrade your skill set from running automated modules to manual exploit engineering. Learn deep protocol auditing, signaling vulnerabilities, and baseband hardware analysis inside our virtual environments.
•Hands-On Virtual Labs
•SDR & RF Sandbox Kits
•Industry-Recognized Certs
Research Credentials
Tool Feedback
Found a bug, have a feature request, or a technical question about srsRAN — Open-Source 4G/5G RAN? Send it directly to the research team.