Bring up a complete Amarisoft 5G Standalone network — lteenb (gNB), ltemme (5G core), and
lteue (soft UE) — transmitting over the air through USRP SDRs on the COSMOS sb1 or grid
domains, then register the UE, open a PDU session, reach the internet, and measure real DL/UL
throughput.
This tutorial builds a self-contained 5G SA cell using the commercial Amarisoft stack driving
USRP radios (NI N310 / X310) over the air. One node runs the gNB (lteenb) plus the unified 5G
core (ltemme) on one USRP; a second node runs Amarisoft's software UE (lteue) on a second USRP. The
two radios are RF-coupled on the rig, so the link is a genuine n41 (2.6 GHz) air interface — not a
software loopback. A commercial Quectel modem attaches to the same cell as a variation.
You will image the two official images (amarisoft.ndz for the gNB, lte5gue.ndz for the UE), start
the cell, attach the UE, and run UDP throughput. The stack is standardized with the other COSMOS 5G
platforms: PLMN 00101 and UE pool 192.168.100.0/22 with internet access. The takeaway is a
reproducible OTA 5G SA reference, plus the two Amarisoft-specific gotchas that trip everyone up the
first time: the floating license seat and the fact that lteue does not auto-attach.
Amarisoft has no radio-less software loopback, so there is no soft-only Amarisoft tutorial — see the
5G SA platforms overview for the OCUDU and
Duranta soft-only options.
After completing this tutorial you will be able to:
lteenb + ltemme) OTA on a COSMOS USRP.lteue) to that cell, including the required power_on API trigger.| Difficulty | Advanced |
| Estimated time | 60–90 min |
| Domain / sandbox | sb1 or grid (USRP radios) |
| Topic group | Cellular (4G/5G/O-RAN) |
| Last verified | 2026-07-15 |
Background knowledge
ssh/ip/iperf3 on Linux.Account & access
sb1 (or grid) — see Make a reservation.Devices / nodes (example node names are from sb1; the same applies on grid)
| Resource | Role | Qty | Notes |
|---|---|---|---|
| a compute node with a USRP | gNB (lteenb) + 5G core (ltemme) |
1 | drives the gNB N310 (e.g. 10.39.3.1) |
| a second node with a USRP | soft UE (lteue) |
1 | drives a second USRP over UHD |
| NI N310 | gNB radio | 1 | band n41, 100 MHz, 1T1R |
| NI N310 or X310 | UE radio | 1 | N310 for 40/100 MHz; X310 for 40 MHz |
Disk images
| Image | Load onto | Provides |
|---|---|---|
amarisoft.ndz |
gNB node | Amarisoft lteenb + ltemme, UHD 4.9, start.sh, jumbo/SDR net setup, UE-pool NAT |
lte5gue.ndz |
UE node | Amarisoft lteue, UHD 4.9 + trx_uhd, SDR50 driver, amari_cmd.py, UE configs |
(amarisoft.ndz / lte5gue.ndz are symlinks to the latest dated builds.)
Software components
| Component | Version | Source |
|---|---|---|
| Amarisoft lteenb / ltemme / lteue | 2026-06-12 | preinstalled in the images (/opt/amarisoft/) |
| UHD | 4.9.0.0+ds1-1~noble2 | preinstalled (from the ppa:gnuradio/gnuradio-releases PPA) |
| Amarisoft floating license | — | network server 10.50.0.8:9006 (tags gNB, 5gC, ue) |
Spectrum / RF / special
dl_nr_arfcn 518670), 100 MHz or 40 MHz channel,00101; IMSI 001010123456780 (lteue) and 001010000000032 (Quectel modem),ue_db. UE pool 192.168.100.0/22, gateway 192.168.100.1, internet-NAT'd.Two nodes on the same domain (sb1 or grid), each with its own USRP, RF-coupled on the rig:
gNB node UE node
┌────────────────────────┐ ┌────────────────────────┐
│ lteenb (gNB) + ltemme │ n41 2.6 GHz │ lteue (soft UE) │
│ 5G core │ OTA air link │ │
│ USRP N310 (gNB RU) │◄────────────────►│ USRP N310 (or X310) │
└────────────────────────┘ (RF coupled) └────────────────────────┘
│ license
▼ 10.50.0.8:9006 (floating seats: gNB / 5gC / ue)
The gNB and UE reach their USRPs over the domain's DATA network with jumbo frames (MTU 9000). Both
images pull one floating license seat each from the network license server.
ssh <username>@console.<domain>.cosmos-lab.org # e.g. console.sb1... or console.grid...
omf tell -a offh -t <gnb-node>,<ue-node>
-r 0):omf load -i amarisoft.ndz -t <gnb-node> -r 0 -o 1200
omf load -i lte5gue.ndz -t <ue-node> -r 0 -o 1200
omf tell -a on -t <gnb-node>,<ue-node>
omf stat -t <gnb-node>,<ue-node>
License seat — read this first. Amarisoft refuses to run any component without a license, and
there is one seat per tag (gNB,5gC,ue) across the whole testbed. If anotherltemme
anywhere holds the5gCseat, your core segfaults on start with no banner. Make sure no other
Amarisoft instance is running before you begin:pkill -9 -x lteenb-avx2 ltemme lteue-avx2on any node
that might be holding a seat.
Log into the gNB node and launch the stack with the helper script. It configures the jumbo SDR network,
applies the UE-pool NAT, starts the core (ltemme), then the gNB (lteenb):
ssh root@<gnb-node>
/root/amarisoft/start.sh 100 # bandwidth in MHz: 20 | 40 | 100 (100 needs the N310)
Confirm the radio came up — look for the RF0 line in the gNB log:
grep -aE 'RF0:|License server' /tmp/lteenb.log | tail -3
License server: 10.50.0.8 (0b-b4-46-dc-2f-83-58-cb)
RF0: sample_rate=122.880 MHz dl_freq=2593.350 MHz ul_freq=2593.350 MHz (band n41) dl_ant=1 ul_ant=1
sample_rate=122.880 MHz = a 100 MHz cell on the N310. (start.sh 40 gives 61.440 MHz.) Verify the
gNB associated with the core over NGAP (SCTP port 38412):
ss -np -A sctp | grep -E 'ESTAB.*38412'
ESTAB 0 0 127.0.1.100:38412 127.0.1.1:44246 users:(("ltemme",...))
An established association = NG setup succeeded (the gNB stdout does not print an obvious "NG setup"
line, so check the socket). Confirm the tuns are on the standard pool: ip -4 -br addr show | grep tun
should show 192.168.100.1 (the internet APN) and 192.168.101.1 (the default APN).
Log into the UE node and start lteue with the UHD/USRP config for the matching bandwidth. The UE
image ships pre-built configs: ue-uhd-100.cfg (N310, 100 MHz), ue-uhd-40.cfg (N310, 40 MHz),
ue-uhd-40-x310.cfg (X310, 40 MHz) — all on PLMN 00101 / IMSI 001010123456780:
ssh root@<ue-node>
cd /opt/amarisoft/lteue-linux-2026-06-12
ip link set DATA2 mtu 9000 # jumbo frames to the UE's USRP
setsid bash -c "tail -f /dev/null | ./lteue-avx2 config/ue-uhd-100.cfg" >/tmp/ue_run.log 2>&1 &
sleep 12
grep -aE 'RF0:' /tmp/ue_run.log | tail -1
RF0: sample_rate=122.880 MHz dl_freq=2593.350 MHz ul_freq=2593.350 MHz (band n41) dl_ant=1 ul_ant=1
The SDR is streaming — but the UE is not yet attached. This is the #1 Amarisoft-UE surprise:
lteue boots into 5GMM-NULL CM-IDLE and does nothing until you power it on.
Send power_on to the UE's remote API (WebSocket on com_addr [::]:9002). The image bundles a
self-contained raw-WebSocket client, amari_cmd.py:
python3 /opt/amarisoft/lteue-linux-2026-06-12/amari_cmd.py 9002 '{"message":"power_on","ue_id":1}'
Read the live per-UE PHY metrics from the UE API:
python3 /opt/amarisoft/lteue-linux-2026-06-12/amari_cmd.py 9002 '{"message":"ue_get"}'
"ue_list":[{"imsi":"001010123456780", ... "dl_mcs":22.5,"ul_mcs":24,"rrc_state":"idle"}]
Healthy DL/UL MCS = a good OTA link. (rrc_state returns to idle between traffic — that is normal.)
If power_on doesn't take the first time (the API can race just after launch), send it again.
ue-ifup puts the UE's PDU interface (pdn0) into a network namespace named ue1 — always test
the data plane from inside that namespace. The lteue uses the default APN, so it lands on
192.168.101.x (gateway 192.168.101.1):
ip netns exec ue1 ip -br addr show pdn0
ip netns exec ue1 ping -c 4 192.168.101.1 # core gateway
ip netns exec ue1 ping -c 4 8.8.8.8 # the internet
pdn0 UNKNOWN 192.168.101.2/24
4 packets transmitted, 4 received, 0% packet loss
The UE has an IP in 192.168.100.0/22, reaches the core gateway, and reaches the internet (ltemme
does not NAT on its own — the image's start.sh adds the MASQUERADE rule for 192.168.100.0/22).
Success criteria:
RF0: sample_rate=… (band n41) and an established SCTP association on port 38412.ue_get reports 5GMM-REGISTERED and non-zero dl_mcs / ul_mcs.ip netns exec ue1 ping 192.168.101.1 and ping 8.8.8.8 return 0% packet loss.Measure air-interface capacity with UDP (TCP is RTT-limited here). Run an iperf3 server on the
core gateway and drive it from inside the UE namespace. Keep a background keepalive ping running
during the test — otherwise the UE drops to RRC-idle and iperf3's control socket breaks:
# on the gNB/core node:
iperf3 -s -B 192.168.101.1 -D
# on the UE node, inside netns ue1:
ip netns exec ue1 ping -i 0.3 192.168.101.1 >/dev/null 2>&1 & # keepalive
ip netns exec ue1 iperf3 -c 192.168.101.1 -u -b 150M -R -t 15 -i 5 # DL (reverse)
ip netns exec ue1 iperf3 -c 192.168.101.1 -u -b 30M -t 12 -i 4 # UL
Measured on this rig (band n41, DDDSU TDD, 30 kHz SCS):
| UE radio | Bandwidth | DL (UDP) | UL (UDP) | Notes |
|---|---|---|---|---|
| N310 | 100 MHz | ≈132 Mbit/s | ≈24 Mbit/s | dl_mcs 20 / ul_mcs 14 |
| X310 | 40 MHz | ≈56 Mbit/s | ≥8 Mbit/s | dl_mcs 25 — full-rate for 40 MHz |
| N310 | 40 MHz | ≈16–57 Mbit/s | ≥8 Mbit/s | link/SINR of the specific USRP is the limit, not config |
UL is bounded by the TDD pattern (one UL slot per 2.5 ms DDDSU period), so it is much lower than DL by
design.
Stop the Amarisoft processes (this frees the license seats — important for the next experimenter)
and power the nodes off:
ssh root@<gnb-node> 'pkill -9 -x lteenb-avx2 ltemme'
ssh root@<ue-node> 'pkill -9 -x lteue-avx2'
omf tell -a offh -t <gnb-node>,<ue-node>
Only run omf save -n <node> if you deliberately modified an image and want to keep it.
| Symptom | Likely cause | Fix |
|---|---|---|
ltemme segfaults immediately, no banner |
another ltemme holds the single 5gC license seat |
pkill -9 -x ltemme on the node holding it, then restart |
lteenb prints License error: no license found |
license server unreachable / missing license_server block |
check bash -c '</dev/tcp/10.50.0.8/9006' && echo ok |
UE stuck in 5GMM-NULL CM-IDLE, SDR streaming |
lteue not powered on (it does not auto-attach) |
send power_on via the API (Step 3) |
lteue exits: Unsupported bandwidth… |
X310 (184.32 MHz clock) can't auto-pick a 40 MHz rate | put sample_rate: 46.08 inside the cell block; X310 is 40 MHz-max |
PDU accepts but pdn0 DOWN / no ping |
net-tools (ifconfig) missing → ue-ifup can't configure the tun |
apt-get install -y net-tools, restart the UE |
| tuns show old IPs (192.168.3/4) after a re-run | ltemme reused stale tuns | ip link del tun0 tun1 then restart ltemme (recreates them at the pool .1) |
gNB log: [MPM.RPCServer] A timeout event occured!, gNB exits |
N310 MPM wedged by rapid lteenb restarts |
omf tell -a reset -t <N310-host>, then one clean start.sh — do not rapid-cycle the N310 |
UE ping 8.8.8.8 fails but gateway pings |
UE-pool NAT missing | ensure start.sh ran (it adds MASQUERADE -s 192.168.100.0/22) + ip_forward=1 |
lteue. A Quectel RM520N-GL on the UE node attaches to theinternet APN → 192.168.100.x: AT+QNWPREFCFG="mode_pref",NR5G,AT+CGDCONT=1,"IP","internet", AT+COPS=1,2,"00101",12, then bring up wwan0 with qmicli. See thequectel-5g-modem reference. It reaches the same air capacity (UDP DL well above 100 Mbit/s at 100 MHz).recv/send_frame_size to 7900gnb-amari-*-l3.cfg configs, and pin the SDR subnet to the dataip route replace 10.39.0.0/16 via <data-gw> dev <data-iface>) so it never falls back to theomf-amarisoft (license server, images, bring-up, lteue UE).amarisoft-ran (ra_response_window, USRP wmem_max, sample rates).Author(s): COSMOS team · Last verified: 2026-07-15 · Tested image/release: amarisoft.ndz (gNB) + lte5gue.ndz (UE), Amarisoft 2026-06-12, PLMN 00101, pool 192.168.100.0/22 · Tags: amarisoft, 5g, sa, sdr, usrp, gnb, lteue