Open5GS + srsRAN on Kali

Scope

This gets you to a cell that real handsets attach to, and a core that registers them. It does not cover the project's NGAP proxy, feature extraction or ML pipeline.

The order below is load-bearing. Step 3 must complete before Step 4 or the Open5GS build fails at the first #include; Step 5 must complete before anything registers at all.

Hardware

Step 00UHD firmware and B210 detection

One-time per machine:

uhd_images_downloader        # FPGA images → /usr/lib/uhd/images/
uhd_find_devices             # expect: type=b200, plus your board serial

lsusb -t   # the B210 line must end in 5000M (USB 3.0), not 480M (USB 2.0)

Step 01System dependencies

sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
  meson ninja-build build-essential flex bison \
  cmake libsctp-dev libgnutls28-dev libgcrypt-dev \
  libssl-dev libidn11-dev libbson-dev libmicrohttpd-dev \
  libcurl4-gnutls-dev libnghttp2-dev libyaml-dev \
  libtalloc-dev libpcsclite-dev pcscd libtins-dev \
  libfftw3-dev libmbedtls-dev libboost-all-dev \
  libconfig++-dev libyaml-cpp-dev libzmq3-dev cppzmq-dev \
  libuhd-dev uhd-host python3-pip

Step 02MongoDB 8.0

Kali has no MongoDB package of its own — use the upstream Debian repository.

curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \
  sudo gpg --dearmor -o /usr/share/keyrings/mongodb-server-8.0.gpg

echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] \
  https://repo.mongodb.org/apt/debian bookworm/mongodb-org/8.0 main" | \
  sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list

sudo apt-get update && sudo apt-get install -y mongodb-org
sudo mkdir -p /var/lib/mongodb /var/log/mongodb
sudo mongod --dbpath /var/lib/mongodb --logpath /var/log/mongodb/mongod.log --fork

mongosh --quiet --eval "db.adminCommand('ping')"

Step 03Kali libmongoc fixups

This is what makes a Kali install differ from the upstream Open5GS instructions, and the step most likely to break again later.

Debian and Kali ship libmongoc 2.x under the mongoc2 name, with headers in a versioned directory and a pkg-config file that does not use the upstream name. Open5GS 2.7.7 expects the 1.x layout — a libmongoc-1.0.pc and a top-level <mongoc.h>. Three distinct failures follow.

Fix 1 — pkg-config name symlinks

PC=/usr/lib/x86_64-linux-gnu/pkgconfig
sudo ln -sf $PC/mongoc2.pc        $PC/libmongoc-1.0.pc
sudo ln -sf $PC/mongoc2-static.pc $PC/libmongoc-static-1.0.pc
sudo ln -sf $PC/bson2.pc          $PC/libbson-1.0.pc
sudo ln -sf $PC/bson2-static.pc   $PC/libbson-static-1.0.pc

Fix 2 — header shims

Kali installs headers at /usr/include/mongoc-<version>/mongoc/mongoc.h, but Open5GS does #include <mongoc.h>. Create a one-line shim at the top of each versioned include directory.

MONGOC_INC="$(pkg-config --variable=prefix libmongoc-1.0)/include/mongoc-$(pkg-config --modversion libmongoc-1.0)"
BSON_INC="$(pkg-config --variable=prefix libbson-1.0)/include/bson-$(pkg-config --modversion libbson-1.0)"

echo '#include "mongoc/mongoc.h"' | sudo tee "$MONGOC_INC/mongoc.h"
echo '#include "bson/bson.h"'     | sudo tee "$BSON_INC/bson.h"

Verify the shim resolves before building anything:

printf '#include <mongoc.h>\n#include <bson.h>\nint main(void){return 0;}\n' > /tmp/probe.c
gcc $(pkg-config --cflags libmongoc-1.0) -c /tmp/probe.c -o /dev/null && echo "shim OK"

Step 04Build Open5GS 2.7.7

git clone --depth 1 --branch v2.7.7 https://github.com/open5gs/open5gs.git
cd open5gs

Fix 3 — disable the bundled test suite

tests/common/context.c calls mongoc_collection_count(), removed in libmongoc 2.x. The tests fail to compile even though the daemons build fine.

sed -i 's/^if build_tests/if false # build_tests/' meson.build

A build-only change: it disables Open5GS's own unit tests and touches no core functionality, which is why the repository ships no patch file for it.

Build and install

meson setup build --prefix=/usr/local
ninja -C build -j"$(nproc)"
sudo ninja -C build install
sudo ldconfig

/usr/local/bin/open5gs-amfd -v     # Open5GS v2.7.7

Step 05Configure Open5GS for PLMN 001/01

1 — NRF must allow the test PLMN

nrf.yaml defaults to mcc: 999, mnc: 70 and rejects every NF registering as anything else: PLMN-ID[MCC:001,MNC:01] is not allowed.

nrf:
  serving:
    - plmn_id:
        mcc: 001
        mnc: 01
  sbi:
    server:
      - address: 127.0.0.10
        port: 7777

2 — Every NF needs an explicit serving section

ausf, udm, udr, pcf, nssf and bsf ship without one, so they register under the default PLMN 999/70 and the AMF cannot discover them for 001/01.

<nf>:
  serving:
    - plmn_id:
        mcc: 001
        mnc: 01

3 — Route through the NRF, not the SCP

Every NF config defaults to client.scp: http://127.0.0.200:7777. The SCP expects a SEPP for inter-PLMN routing, which a single-PLMN private network does not have, so discovery fails with No SEPP configured. Change client.scp to client.nrf in every NF config.

  sbi:
    client:
      nrf:
        - uri: http://127.0.0.10:7777

4 — SBI address map

AMF — NGAP, GUAMI, TAI and network name

amf:
  sbi:
    server:
      - address: 127.0.0.5
        port: 7777
    client:
      nrf:
        - uri: http://127.0.0.10:7777
  ngap:
    server:
      - address: 127.0.0.5
  guami:
    - plmn_id: { mcc: 001, mnc: 01 }
      amf_id: { region: 2, set: 1 }
  tai:
    - plmn_id: { mcc: 001, mnc: 01 }
      tac: 1
  plmn_support:
    - plmn_id: { mcc: 001, mnc: 01 }
      s_nssai:
        - sst: 1
  security:
    integrity_order: [NIA2, NIA1, NIA0]
    ciphering_order: [NEA0, NEA1, NEA2]
  network_name:
    full: srsRAN 5G Test
    short: srsTest
  amf_name: open5gs-amf0
  time:
    t3512:
      value: 540

SMF and UPF — UE subnet

  session:
    - subnet: 10.45.0.0/16
      gateway: 10.45.0.1
      dnn: internet

smf.yaml additionally takes DNS (8.8.8.8, 8.8.4.4) and mtu: 1400. The gtpc/gtpu and freeDiameter entries in the installed file are 4G EPC legacy, unused in 5G SA — leave them alone.

sudo ip link set ogstun up
sudo ip addr add 10.45.0.1/16 dev ogstun

UDM home-network keys

udm.yaml references six SUCI concealment keys under /usr/local/etc/open5gs/hnet/, installed by ninja install. UDM will not start if they are missing. Test USIMs using the SUCI null-scheme never exercise them, but they must still be present.

Step 06Provision subscribers

Subscribers go directly into MongoDB. The full profile set — five physical USIMs and three UERANSIM software profiles — is in COMP997_srsRAN_subscribers.md, with a ready-to-paste insertMany block.

{
  imsi: "001010000000001",
  msisdn: [], imeisv: [],
  security: { k: "REDACTED", op: null, opc: "REDACTED",
              amf: "8000", sqn: NumberLong("0") },
  ambr: { downlink: { value: 1, unit: 3 }, uplink: { value: 1, unit: 3 } },
  slice: [{ sst: 1, default_indicator: true,
            session: [{ name: "internet", type: 3,
                        ambr: { downlink: { value: 1, unit: 3 },
                                uplink:   { value: 1, unit: 3 } },
                        qos: { index: 9, arp: { priority_level: 8,
                               pre_emption_capability: 1,
                               pre_emption_vulnerability: 1 } } }] }],
  access_restriction_data: 32, network_access_mode: 0,
  subscriber_status: 0, operator_determined_barring: 0, __v: 0
}

mongosh open5gs --eval 'db.subscribers.find({}, {imsi:1, _id:0}).sort({imsi:1})'

Step 07Build srsRAN Project 25.10

git clone --depth 1 --branch release_25_10 https://github.com/srsran/srsRAN_Project.git
mkdir -p srsRAN_Project/build && cd srsRAN_Project/build

cmake .. \
  -DCMAKE_BUILD_TYPE=Release \
  -DENABLE_EXPORT=ON \
  -DENABLE_UHD=ON \
  -DENABLE_ZEROMQ=ON \
  -DBUILD_TESTING=OFF

make -j"$(nproc)" gnb

Binary lands at build/apps/gnb/gnb. srsRAN builds cleanly under GCC 15 — unlike Open5GS, it needs no patches. It also declares cmake_minimum_required(VERSION 3.14), comfortably above the 3.5 floor CMake 4.x enforces, so no CMAKE_POLICY_VERSION_MINIMUM workaround is needed.

gNB configuration

cu_cp:
  amf:
    addr: 127.0.0.5
    port: 38412
    bind_addr: 127.0.0.1
    supported_tracking_areas:
      - tac: 1
        plmn_list:
          - plmn: "00101"
            tai_slice_support_list:
              - sst: 1

ru_sdr:
  device_driver: uhd
  device_args: type=b200,serial=YOUR_B210_SERIAL,num_recv_frames=64,num_send_frames=64
  srate: 23.04
  otw_format: sc12
  tx_gain: 89
  rx_gain: 50

cell_cfg:
  dl_arfcn: 632628
  band: 78
  channel_bandwidth_MHz: 20
  common_scs: 30
  plmn: "00101"
  tac: 1
  pci: 1

log:
  filename: /tmp/gnb.log
  all_level: info

Two settings are not optional:

• num_recv_frames=64,num_send_frames=64 — without these the B210 underruns regardless of USB generation.
• tx_gain: 89 (the B210 maximum) and rx_gain: 50. At tx_gain: 80 some handsets never saw the cell while others attached fine — a confusing failure, because the cell is genuinely on-air throughout.

Step 08UERANSIM v3.2.6 — optional

Only needed for the SW-Std / SW-Ext / SW-Min software UE profiles. Skip if you are working with physical handsets only.

Kali / GCC 15 build fixups

UERANSIM's 2022-era code relies on standard-library headers that older GCC pulled in transitively; GCC 15 does not. Two changes:

1. src/ext/yaml-cpp/emitterutils.cpp — add #include <cstdint>.
2. Top-level CMakeLists.txt — force-include globally, which is cheaper than patching every offending file:

set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -include cstdint -include cstring -include cstdio -include string")

Capability-enquiry patch

git apply /path/to/ueransim.patch
cp /path/to/ueransim-config/gnb.yaml config/gnb.yaml
make build      # produces build/nr-gnb, build/nr-ue, build/nr-cli

Bring-up and verification

Start order matters: MongoDB, then NRF and SCP, then the remaining NFs, then AMF and SMF, then UPF, then the gNB.

sudo mongod --dbpath /var/lib/mongodb --logpath /var/log/mongodb/mongod.log --fork

for nf in nrf scp ausf udm udr pcf nssf bsf amf smf upf; do
  sudo /usr/local/bin/open5gs-${nf}d > /tmp/${nf}.log 2>&1 &
  sleep 1
done

sudo ip link set ogstun up
sudo ip addr add 10.45.0.1/16 dev ogstun 2>/dev/null || true
sudo sysctl -w net.ipv4.ip_forward=1

UPLINK=$(ip route show default | awk '{print $5; exit}')
sudo iptables -t nat -A POSTROUTING -s 10.45.0.0/16 -o "$UPLINK" -j MASQUERADE

sudo /path/to/srsRAN_Project/build/apps/gnb/gnb \
  -c /root/.config/open5gs/gnb.yml > /tmp/gnb.log 2>&1 &

Verification checklist

Open5GS logs carry ANSI colour codes; strip them with sed 's/\x1b\[[0-9;]*m//g' before grepping if matches look oddly absent.

Confirming the cell is actually transmitting

Protocol-level evidence is the primary check: PRACH detection in /tmp/gnb.log, NG Setup, and a successful registration. For an independent RF-layer confirmation, a wideband hackrf_sweep is not reliable — it produces noisy readings with no stable peak. Use GQRX narrowband instead.

The carrier appears as a sharp spike around −35 to −40 dBFS against a −85 to −90 dBFS noise floor, with visible TDD burst structure in the waterfall.

Troubleshooting

Install-time and bring-up failures encountered on this testbed, with root causes.

Network parameters

Legal and safety

Band n78 is licensed spectrum. Transmit only inside a Faraday enclosure or shielded room, or under a licence that permits it. The PLMN 001/01 used throughout is the 3GPP test network, assigned to no real operator, which keeps a stray UE from mistaking this cell for a commercial one — but that is not a substitute for RF containment.

This testbed exists to study attacks against capability negotiation on a private network with subscribers you control. Do not point it at devices or subscribers that are not yours.