Level 14

5G Protocol Testing & Log Analysis

Master 5G protocol testing and log analysis end-to-end — protocol testing fundamentals (conformance vs interoperability, 3GPP TS 38.523, test methodology, protocol layers, UE categories), log analysis tools (QXDM, QCAT, Wireshark 5G dissectors, network-side analyzers, chipset vendor tools), NAS & RRC protocol analysis (registration traces, PDU session traces, RRC reconfiguration, handover traces, authentication traces, timer expiry troubleshooting), and test case design & automation (test methodology, test case writing for registration/PDU/HO, automation frameworks, defect reporting).

11 interactive2 simulation14 labs4 quizzes

0/31 lessons

This level requires a Pro subscription

Unlock all 26 advanced levels — 732 lessons, labs, and interactives by TELCOMA Global.

Protocol Testing Fundamentals

0/7

Understand the foundations of 5G protocol testing — conformance, interoperability, and field validation. Learn 3GPP test specifications (TS 38.523), the end-to-end test methodology, protocol layers and their testable aspects, and UE categories and capability testing.

What is protocol testing: conformance, interoperability, field validation

The three pillars of protocol testing — conformance testing (does the UE/gNB implement the protocol exactly as 3GPP specifies), interoperability testing (can devices from different vendors work together correctly), and field validation (does the protocol work under real-world conditions). The testing pyramid from spec compliance to deployment readiness.

interactive3 min

3GPP test specifications: TS 36.523 (LTE), TS 38.523 (NR) conformance

Navigating the 3GPP conformance test specifications — TS 38.523 structure (test cases organized by protocol layer and procedure), how test cases reference normative specs (TS 24.501, TS 38.331), test applicability based on UE capability, and how GCF/PTCRB certification drives conformance testing requirements.

interactive4 min

Test methodology: test plan → test cases → execution → defect → regression

The end-to-end testing lifecycle — creating a test plan from requirements, deriving test cases (positive, negative, boundary), test execution with pass/fail criteria, defect logging and classification, regression testing after fixes, and traceability from requirements through test cases to defect resolution.

interactive3 min

Protocol layers and their testable aspects: NAS, RRC, PDCP, RLC, MAC, PHY

What is testable at each 5G protocol layer — NAS (registration, authentication, session management messages and state machines), RRC (connection setup, reconfiguration, measurement reporting, handover), PDCP (ciphering, integrity, header compression, reordering), RLC (ARQ, segmentation, reassembly), MAC (scheduling, HARQ, random access, BSR/PHR), PHY (modulation, coding, MIMO, beam management). Layer-by-layer test scope.

interactive4 min

UE categories and capability testing: FR1, FR2, CA combinations, feature sets

UE capability framework — UE-NR-Capability IE structure, frequency band combinations (FR1 sub-6 GHz, FR2 mmWave), supported CA/DC combinations, MIMO layers, modulation support, feature groups (VoNR, positioning, sidelink), and how capabilities are signaled in UECapabilityInformation messages. Testing against declared vs actual capabilities.

lab4 min

Lab: Navigate a 3GPP test spec and identify test case structure

Hands-on lab — guided exercise to navigate TS 38.523 test specification structure, identify a test case for 5G NR registration, understand the test case format (initial conditions, test procedure steps, expected messages), and map test cases back to normative specification requirements.

lab5 min

Quiz: Protocol testing fundamentals

Test your understanding of protocol testing types, 3GPP test specifications, test methodology, protocol layer testability, and UE capability testing.

quiz3 min

Log Analysis Tools

0/7

Master the essential tools for 5G protocol analysis — QXDM Professional for real-time UE logging, QCAT for offline analysis, Wireshark for NAS/RRC/NGAP/PFCP dissection, network-side analyzers, and chipset vendor-specific tools from Qualcomm, MediaTek, and Samsung.

QXDM Professional: real-time UE logging, filter configuration, message view

QXDM Professional deep dive — connecting to a Qualcomm-based UE via DIAG port, configuring message filters (NAS, RRC, internal events), real-time message view with decoded IE display, log mask configuration for targeted capture (minimizing data volume while capturing relevant messages), and saving logs for offline analysis in QCAT format.

interactive4 min

QCAT: offline log analysis, message decoding, event filtering

QCAT analysis workflow — loading QXDM logs for offline analysis, message filtering by protocol layer and message type, detailed IE-level decoding with bit-field expansion, event timeline view (attach, HO, call setup events marked on timeline), measurement analysis (RSRP, RSRQ, SINR over time), and exporting decoded messages for reporting.

interactive4 min

Wireshark for 5G: NAS/RRC/NGAP/GTP/PFCP/HTTP2 dissectors and filters

Wireshark 5G protocol analysis — built-in dissectors for NAS-5GS, NR-RRC, NGAP, GTP-U/GTP-C, PFCP, and HTTP/2 (SBI). Key display filters (nas-5gs, nr-rrc, ngap, pfcp), capturing on N2/N4/N11 interfaces, decoding NAS messages from NGAP containers, and following SBI HTTP/2 streams between NFs. Filter cheatsheet and capture setup for common scenarios.

lab4 min

Network-side protocol analyzers: VIAVI TeraVM, NETSCOUT nGeniusONE

Network-side analysis tools — VIAVI TeraVM for core network protocol simulation and testing, NETSCOUT nGeniusONE for real-time SBI monitoring across 5GC interfaces, Spirent Landslide for load and performance testing, and Keysight UXM/Amarisoft for air interface protocol testing. How network-side tools complement UE-side logging for end-to-end visibility.

interactive3 min

Chipset vendor tools: Qualcomm QXDM/QCAT, MediaTek ELT, Samsung Shannon

Vendor-specific UE logging tools comparison — Qualcomm QXDM/QCAT (industry standard, extensive decode coverage), MediaTek ELT (Engineering Logging Tool for MediaTek Dimensity chipsets), Samsung Shannon Modem Logger (for Exynos modem-based devices), and Apple wireless diagnostics. Common and unique features across vendor tools, and when to use which tool.

interactive3 min

Lab: Decode a 5G NR NAS message in QCAT — Registration Request IE by IE

Hands-on log decoding lab — walk through a real 5G NAS Registration Request message IE by IE: Extended Protocol Discriminator, Security Header Type, Registration Type (initial/mobility/emergency), 5GS Mobile Identity (SUCI with scheme output), NAS Key Set Identifier, 5GMM Capability, UE Security Capability, Requested NSSAI, and Last Visited TAI.

lab5 min

Quiz: Log analysis tools

Test your knowledge of QXDM, QCAT, Wireshark 5G dissectors, network-side analyzers, and chipset vendor tools.

quiz3 min

NAS & RRC Protocol Analysis

0/8

Analyze real 5G protocol traces step by step — NAS registration traces with IE decoding, PDU session establishment with PFCP/GTP tunnel tracking, RRC reconfiguration analysis, handover traces, authentication flow analysis, timer expiry troubleshooting, and a hands-on debug challenge with multiple failure scenarios.

NAS Registration trace analysis: step-by-step with IE decoding

Step-by-step 5G NAS registration trace analysis — Registration Request (SUCI, registration type, requested NSSAI), Authentication Request/Response (RAND, AUTN, RES*), Security Mode Command/Complete (ciphering and integrity algorithms), Registration Accept (5G-GUTI, allowed NSSAI, tracking area list, registration result). IE-by-IE decoding of each message with field explanations.

lab5 min

NAS PDU Session Establishment trace: PFCP, N4, GTP tunnel creation

PDU session establishment trace walkthrough — PDU Session Establishment Request (PDU session type, SSC mode, DNN, S-NSSAI), SMF interaction with PCF (policy fetch) and UPF (N4 PFCP Session Establishment), GTP tunnel creation on N3 (gNB-UPF), PDU Session Establishment Accept (QoS rules, QoS flow descriptions, authorized QoS, PDU address). Tracking TEID and SEID across interfaces.

simulation5 min

RRC Setup and Reconfiguration analysis: SRB/DRB setup, measurement config

RRC message analysis — RRC Setup (SRB1 configuration, initial BWP parameters), RRC Reconfiguration (DRB setup with SDAP/PDCP/RLC configs, measurement configuration with measObjects and reportConfigs, measGapConfig, secondary cell group for CA/DC). How to read measurement IDs, reporting triggers (A1-A6 events), and filter coefficients from RRC traces.

lab4 min

Handover trace analysis: MeasurementReport → HO Command → HO Complete

End-to-end handover trace walkthrough — MeasurementReport (serving and neighbor RSRP/RSRQ, event A3 trigger), RRC Reconfiguration (HO command with target cell configuration, RACH resources for target, source cell release), RRC Reconfiguration Complete (sent to target cell confirming successful HO). Analyzing HO preparation time, execution time, and interruption time from timestamps.

interactive5 min

Authentication trace: 5G-AKA message flow with AUTN, RES*, SUCI decoding

Security procedure trace analysis — SUCI generation (SUPI → SUCI using ECIES with home network public key), Authentication Request (RAND, AUTN from AUSF/UDM via AMF), UE verification of AUTN (SQN freshness, MAC check), Authentication Response (RES* computed by UE), AUSF verification (HRES* comparison), and NAS Security Mode Command (selected algorithms: NEA1/NEA2/NEA3, NIA1/NIA2/NIA3).

lab4 min

Common protocol failures: timer expiry (T3510, T3511, T3512), reject causes

Protocol timer analysis — T3510 (Registration Request retry, 15s, max 5 attempts), T3511 (registration failure backoff, starts at 10s), T3512 (periodic registration update, default 54 min), T3502 (registration attempt counter reset), T3346 (congestion backoff from network). How each timer affects UE behavior on expiry, and common reject causes that trigger these timers: #5, #11, #15, #22, #71, #73.

simulation4 min

Lab: Debug a failed registration — find the root cause from UE logs

Hands-on debug lab — 5 independent failure scenarios with UE log traces: (1) SUCI computation failure, (2) authentication failure (MAC mismatch), (3) registration rejected #11 (PLMN not allowed), (4) NAS Security Mode Command failure, (5) T3510 expiry with no response. Analyze each trace, identify the root cause, and explain the fix.

lab6 min

Quiz: NAS & RRC analysis

Comprehensive quiz covering NAS registration trace analysis, PDU session establishment, RRC reconfiguration, handover traces, authentication procedures, and timer-based troubleshooting.

quiz5 min

Test Case Design & Automation

0/9

Learn to design comprehensive test cases for 5G procedures — test methodology (positive, negative, boundary, stress), writing test cases for registration/PDU session/handover, test automation frameworks, defect reporting, and a capstone exercise to write a complete test plan.

Test case design methodology: positive, negative, boundary, stress testing

Test case design techniques — positive testing (verify correct behavior with valid inputs), negative testing (verify correct handling of invalid inputs and error conditions), boundary testing (test at the edges of valid ranges — max PDU sessions, max DRBs, max S-NSSAI), and stress testing (high load, rapid state transitions, concurrent procedures). How to derive test cases systematically from specification requirements.

interactive4 min

Writing test cases for 5G Registration (10 test cases with steps & expected)

Registration test case writing — 10 detailed test cases covering: initial registration (new SUPI), mobility registration (TAU), periodic registration (T3512 expiry), emergency registration, registration with requested NSSAI, registration with invalid SUCI, registration reject handling (#3, #11, #22), re-registration after NAS Security Mode failure, concurrent registration attempts, and registration during ongoing PDU session.

lab5 min

Writing test cases for PDU Session procedures (10 test cases)

PDU session test case writing — 10 test cases: initial PDU session establishment (IPv4, IPv6, IPv4v6), PDU session with specific DNN and S-NSSAI, PDU session modification (QoS update), PDU session release (UE-initiated, network-initiated), max PDU sessions per UE, PDU session with unknown DNN rejection, SSC mode 1/2/3 behavior, always-on PDU session, and PDU session establishment during handover.

lab5 min

Writing test cases for handover procedures (8 test cases)

Handover test case writing — 8 test cases: intra-gNB handover (inter-cell), Xn-based inter-gNB handover, N2-based inter-gNB handover (no Xn), inter-frequency handover, handover with bearer modification, handover failure and RRC re-establishment, conditional handover (CHO), and inter-RAT handover (5G to LTE fallback).

lab4 min

Test automation frameworks: Robot Framework, pytest, Spirent iTest

Test automation for telecom — Robot Framework (keyword-driven, widely used in telecom labs, TTCN-3 integration), pytest (Python-based, flexible for custom protocol testing), Spirent iTest (commercial automation for network testing), and TTCN-3 (Testing and Test Control Notation, 3GPP standard language for conformance tests). Framework selection criteria, CI/CD integration, and test reporting.

interactive4 min

Defect reporting: severity classification, reproduction steps, log attachment

Writing effective defect reports — severity classification (Critical: call drop/no service, Major: feature failure/performance degradation, Minor: cosmetic/non-functional, Trivial: documentation/spelling), components of a good defect report (summary, environment, preconditions, steps to reproduce, expected vs actual result, log/trace attachment), defect lifecycle (New → Assigned → Fixed → Verified → Closed), and defect triage process.

lab3 min

Real-world: A day in the life of a protocol test engineer

Walk through a typical day for a protocol test engineer — morning stand-up with test status, test execution on lab equipment (UXM, CMX500, Amarisoft), log capture and analysis when tests fail, defect triage meeting with development team, test case review and maintenance, regression testing after firmware updates, and IOT (interoperability) testing with operator SIMs.

lab3 min

Lab: Write a complete test plan for 5G initial attach with 15 test cases

Capstone lab — write a complete test plan for 5G initial attach covering: test plan objectives, scope, test environment (equipment, UE, SIM configuration), 15 test cases (5 positive, 5 negative, 3 boundary, 2 stress) with detailed steps and expected results, pass/fail criteria, and test execution schedule. Evaluated against industry best practices.

lab8 min

Quiz: Test case design & automation

Level gate quiz covering test case design methodology, test case writing for 5G procedures, automation frameworks, defect reporting, and protocol testing workflow.

quiz5 min

5G Protocol Testing & Log Analysis

11 interactive2 simulation14 labs4 quizzes