Bring up a complete 5G Standalone network — the OCUDU gNB (built on srsRAN Project), a native
Open5GS core, and the srsRAN srsue software UE — entirely in software on one node over a
ZMQ virtual radio. No SDR, no RF, no radio reservation. Register the UE, open a PDU session, reach the
internet, and measure throughput.
This is the fastest way to see 5G SA work end-to-end. The OCUDU gNB and the srsRAN srsue exchange
baseband samples over ZMQ (a software radio transport) instead of a USRP, so the whole stack —
gNB + Open5GS core + UE — runs on a single COSMOS server node. It is license-free and needs no
sb1/grid radio hardware, so it runs on any COSMOS node.
You will image one node with ocudu.ndz, start Open5GS, start the gNB, attach srsue, and pass IP
traffic. For the over-the-air version with a real USRP and a commercial modem, see the companion
OCUDU cross-vendor OTA tutorial.
After completing this tutorial you will be able to:
srsue in software over ZMQ on one node.192.168.100.0/22 pool, and reach the internet.| Difficulty | Beginner–Intermediate |
| Estimated time | 20–30 min |
| Domain / sandbox | any COSMOS server node (no radio needed) |
| Topic group | Cellular (4G/5G/O-RAN) |
| Last verified | 2026-07-15 |
Background knowledge
ssh on Linux.Account & access
Devices / nodes
| Resource | Role | Qty | Notes |
|---|---|---|---|
| any COSMOS server node | gNB + Open5GS + srsue (all-in-one) |
1 | no SDR — pure software |
Disk images
| Image | Load onto | Provides |
|---|---|---|
ocudu.ndz |
your node | OCUDU gnb (/opt/ocudu), srsRAN_4G srsue (/opt/srsran4g), Open5GS (/opt/open5gs), launch scripts |
Software components
| Component | Version | Source |
|---|---|---|
| OCUDU gNB (srsRAN Project) | preinstalled | /opt/ocudu/build/apps/gnb/gnb — no license needed |
srsRAN_4G srsue |
preinstalled | /opt/srsran4g/build/srsue/src/srsue (ZMQ RF plugin built) |
| Open5GS 5GC | build-tree | /opt/open5gs, launcher /root/open5gs/start.sh |
Spectrum / RF / special
Everything on one node; gNB ↔ UE over ZMQ TCP sockets, UE ↔ core over the loopback:
any COSMOS node
┌─────────────────────────────────────────────┐
│ Open5GS 5GC (AMF 127.0.0.5, ogstun │
│ 192.168.100.1/22, NAT→internet) │
│ ▲ N2/N3 (loopback) │
│ OCUDU gnb ──ZMQ tx:2000 / rx:2001──► srsue│
│ (band 3, 10 MHz) (software radio) │
└─────────────────────────────────────────────┘
-r 0):ssh <username>@console.<domain>.cosmos-lab.org
omf load -i ocudu.ndz -t <node> -r 0 -o 1200
omf tell -a on -t <node>
ocudu.ndz is a symlink to the latest OCUDU build.ssh root@<node>
/root/open5gs/start.sh # NFs + ogstun 192.168.100.1/22 + NAT + provisions subscribers
ss -lnp -A sctp | grep 38412 # AMF listening for the gNB
LISTEN 0 0 127.0.0.5:38412 0.0.0.0:* users:(("open5gs-amfd",...))
The launcher provisions the subscriber (001010123456780), sets up ogstun on 192.168.100.1/22, and
adds a MASQUERADE rule so UE traffic reaches the internet.
cd /opt/ocudu/build
setsid bash -c './apps/gnb/gnb -c /root/gnb-zmq.yml' >/tmp/gnb.log 2>&1 &
sleep 10
grep -aE 'Cell pci|N2:' /tmp/gnb.log | tail -2
Cell pci=1, band=3, 10 MHz, SCS 15, ZMQ tx_port=2000 rx_port=2001
N2: Connection to AMF on 127.0.0.5:38412 completed
N2: … completed = NG Setup succeeded and the (virtual) cell is on air. The config carries the
srsUE-match knobs (pdcch.common.coreset0_index: 6, ss0_index: 0, prach.prach_config_index: 1,
tx_gain/rx_gain: 0) — do not change these or srsue won't find the cell. Stop the gNB later with
pkill -x gnb, never pkill -f apps/gnb/gnb (which matches — and kills — your own SSH shell).
cd /opt/srsran4g/build/srsue/src
setsid bash -c './srsue /root/ue-zmq.conf' >/tmp/ue.log 2>&1 &
sleep 8
grep -aiE 'Random Access|RRC Connected|PDU Session|192.168.100' /tmp/ue.log | tail -4
Random Access Transmission: ...
RRC Connected
PDU Session Establishment successful. IP: 192.168.100.2
srsue searches the ZMQ cell, RACHes, registers, and gets an IP in 192.168.100.0/22. (After any UE
detach, restart the gNB too — a stale ZMQ tx stream stops the next UE RACHing.)
ip -br addr show tun_srsue
ping -I tun_srsue -c 4 192.168.100.1 # core gateway
ping -I tun_srsue -c 4 8.8.8.8 # the internet
tun_srsue UNKNOWN 192.168.100.2/22
4 packets transmitted, 4 received, 0% packet loss
Cell pci=1 … band=3 and N2: Connection to AMF … completed.srsue reaches RRC Connected + PDU Session Establishment successful.tun_srsue has an IP in 192.168.100.0/22; ping 192.168.100.1 and ping 8.8.8.8 = 0% loss.Over the ZMQ virtual radio, throughput reflects the configured 10 MHz cell (not a real air link). Use a
netns so the UE traffic doesn't short-circuit via rpfilter:
# in the UE config, set [gw] netns = ue1 and: ip netns add ue1
iperf3 -s -B 192.168.100.1 -D
ip netns exec ue1 iperf3 -c 192.168.100.1 # UL
ip netns exec ue1 iperf3 -c 192.168.100.1 -R # DL
Measured (band 3, 10 MHz, ZMQ): DL ≈ 25.6 / UL ≈ 5.3 Mbit/s, RTT ≈ 28 ms.
pkill -x gnb; pkill -x srsue; /root/open5gs/stop.sh
omf tell -a offh -t <node>
| Symptom | Likely cause | Fix |
|---|---|---|
srsue loops "No cells found" |
missing [rat.nr] carrier knobs / wrong ZMQ ports |
use the shipped /root/ue-zmq.conf verbatim (nof_carriers=1, max_nof_prb=52, srate 11.52e6) |
srsue RF backend <none> |
ZMQ plugin not built | cd /opt/srsran4g; cmake -B build -GNinja -DENABLE_ZMQ=ON -DENABLE_RF_PLUGINS=OFF && ninja -C build srsue |
| gNB relaunch → SSH exit 255, no output | pkill -f apps/gnb/gnb killed your shell |
use pkill -x gnb |
open5gs/start.sh provisions no subscribers |
python3-pymongo missing |
apt-get install -y python3-pymongo (baked into ocudu.ndz) |
SMF crashes on missing freeDiameter/smf.conf |
5G-SA build-tree quirk | comment the freeDiameter: line in /opt/open5gs/etc/smf.yaml |
sb1/grid).omf-ocudu; srsRAN-Project YAML — skill ocudu-gnb (docs.srsran.com).open5gs-core. Upstream: docs.ocudu.org, gitlab.com/ocudu/ocudu_docs.Author(s): COSMOS team · Last verified: 2026-07-15 · Tested image/release: ocudu.ndz (OCUDU srsRAN + srsRAN_4G srsue + Open5GS) · Tags: ocudu, srsran, srsue, open5gs, 5g, sa, zmq, soft, cross-vendor