Set up and test a 4G/5G cellular network in the weeks.cosmos domain using Amarisoft software on a USRP-2974 (eNB/gNB + MME) and a COSMOS node with a Waveshare SIM8200 modem as the UE.
This tutorial walks through deploying an end-to-end 4G LTE or 5G NR SA cellular network entirely within the COSMOS Weeks Hall domain. The Amarisoft software stack runs the LTE eNodeB (or 5G NR gNodeB) and the Evolved Packet Core (EPC / MME) on a USRP-2974 integrated SDR. A COSMOS server node (srv1-in1) with a USB-attached Waveshare SIM8200 M.2 modem serves as the User Equipment (UE).
After imaging both nodes, you start the MME, then the base station (choosing LTE or 5G SA by selecting the appropriate configuration file), and observe the UE attach. You then configure the wwan interface on the UE node and verify end-to-end IP connectivity with ping and iperf3.
After completing this tutorial you will be able to:
| Difficulty | Intermediate |
| Estimated time | 60 min |
| Domain / sandbox | weeks.cosmos-lab.org (Weeks Hall) |
| Topic group | cellular-4g5g-oran |
| Last verified | Not re-tested (migrated 2026-06-20) |
Background knowledge
Account & access
Devices / nodes
| Resource | Role | Qty | Notes |
|---|---|---|---|
| sdr2-s1-lg1 | Base station (eNB/gNB) + MME | 1 | USRP-2974 integrated SDR; Amarisoft stack runs here |
| srv1-in1 | UE (User Equipment) | 1 | COSMOS server node with Waveshare SIM8200 M.2 modem attached over USB |
Disk images
| Image | Load onto | Provides |
|---|---|---|
| amarisoft-2974.ndz | sdr2-s1-lg1 | Amarisoft LTE/5G base station + MME software, UHD drivers for USRP-2974 |
| waveshare-sim8200.ndz | srv1-in1 | Drivers and configuration for the Waveshare SIM8200 modem |
Software components
| Component | Version | Source |
|---|---|---|
| Amarisoft lteenb / ltemme | 2021-09-18 | preinstalled in amarisoft-2974.ndz (/opt/amarisoft/) |
| UHD | 3.15.0.0 | preinstalled in amarisoft-2974.ndz |
| Waveshare SIM8200 modem driver | TODO: verify | preinstalled in waveshare-sim8200.ndz |
| iperf3 | TODO: verify | preinstalled in images |
Spectrum / RF
The USRP-2974 (sdr2-s1-lg1) acts as both the base station (eNB or gNB) and the core network (MME/EPC or 5GC). It communicates with the internal X310 USRP via PCIe (RIO0). The UE node srv1-in1 connects to the network over the air through the Waveshare SIM8200 modem (USB-attached, appearing as wwan interface wwp0s20u3i5). Both nodes are managed from console.weeks.cosmos-lab.org.
The MME allocates IP address 192.168.2.2 to the modem; the base station PDN gateway is at 192.168.2.1.
Reserve Weeks Hall resources and open two SSH sessions to the console:
ssh <username>@console.weeks.cosmos-lab.org
Make sure all resources are off before imaging:
omf tell -a offh -t system:topo:allres
Load the Amarisoft image onto the USRP-2974:
omf load -i amarisoft-2974.ndz -t sdr2-s1-lg1
Load the SIM8200 modem image onto the UE node:
omf load -i waveshare-sim8200.ndz -t srv1-in1
Turn the nodes on and check their status:
omf tell -a on -t srv1-in1,sdr2-s1-lg1
omf stat -t system:topo:allres
SSH to both nodes. Use -Y if you need GUI forwarding (not required for this tutorial):
ssh root@sdr2-s1-lg1
ssh root@srv1-in1
On sdr2-s1-lg1, confirm UHD can see the internal X310 via PCIe (RIO0):
root@sdr2-s1-lg1:~# uhd_find_devices --args="resource=RIO0"
[INFO] [UHD] linux; GNU C++ version 7.5.0; Boost_106501; UHD_3.15.0.0-release
--------------------------------------------------
-- UHD Device 0
--------------------------------------------------
Device Address:
serial: 318F215
fpga: XG
name:
product: X310
resource: RIO0
type: x300
If the device is not found, the NI-RIO kernel modules may not be loaded. Reboot the node and retry.
On sdr2-s1-lg1, in the first SSH session, start the Amarisoft MME:
root@sdr2-s1-lg1:~# cd /opt/amarisoft/ltemme-linux-2021-09-18
root@sdr2-s1-lg1:/opt/amarisoft/ltemme-linux-2021-09-18# ./ltemme config/mme.cfg
Core version 2021-09-18, Copyright (C) 2012-2021 Amarisoft
This software is licensed to Rutgers University (The State University of New Jersey).
License server: license.orbit-lab.org (0b-b4-46-dc-2f-83-58-cb)
Support and software update available until 2022-08-18.
(mme)
The (mme) prompt indicates the MME is running and waiting for base station connections.
Open a second SSH session to sdr2-s1-lg1. Choose one of the two configurations below.
root@sdr2-s1-lg1:~# cd /opt/amarisoft/lteenb-linux-2021-09-18
root@sdr2-s1-lg1:/opt/amarisoft/lteenb-linux-2021-09-18# ./lteenb config/enb-2974.cfg
Base Station version 2021-09-18, Copyright (C) 2012-2021 Amarisoft
This software is licensed to Rutgers University (The State University of New Jersey).
License server: license.orbit-lab.org (0b-b4-46-dc-2f-83-58-cb)
Support and software update available until 2021-12-02.
[INFO] [UHD] linux; GNU C++ version 7.5.0; Boost_106501; UHD_3.15.0.0-release
[INFO] [MPMD FIND] Found MPM devices, but none are reachable for a UHD session. Specify find_all to find all devices.
[INFO] [X300] X300 initialization sequence...
[INFO] [X300] Connecting to niusrpriorpc at localhost:5444...
[INFO] [X300] Using LVBITX bitfile /usr/share/uhd/images/usrp_x310_fpga_XG.lvbitx
[INFO] [X300] Radio 1x clock: 184.32 MHz
[INFO] [GPS] Found an internal GPSDO: LC_XO, Firmware Rev 0.929b
[INFO] [0/DmaFIFO_0] Initializing block control (NOC ID: 0xF1F0D00000000000)
[INFO] [0/DmaFIFO_0] BIST passed (Throughput: 1312 MB/s)
[INFO] [0/DmaFIFO_0] BIST passed (Throughput: 1318 MB/s)
[INFO] [0/Radio_0] Initializing block control (NOC ID: 0x12AD100000000001)
[INFO] [0/Radio_1] Initializing block control (NOC ID: 0x12AD100000000001)
[INFO] [0/DDC_0] Initializing block control (NOC ID: 0xDDC0000000000000)
[INFO] [0/DDC_1] Initializing block control (NOC ID: 0xDDC0000000000000)
[INFO] [0/DUC_0] Initializing block control (NOC ID: 0xD0C0000000000000)
[INFO] [0/DUC_1] Initializing block control (NOC ID: 0xD0C0000000000000)
RF0: sample_rate=11.520 MHz dl_freq=2140.000 MHz ul_freq=1950.000 MHz (band 1) dl_ant=1 ul_ant=1
(enb) WARNING: The GPS is not locked. If you need time synchronization, you should restart the program when the GPS is locked.
Chan Gain(dB) Freq(MHz)
TX1 30.0 2140.000000
RX1 30.0 1950.000000
(enb) t
Press [return] to stop the trace
root@sdr2-s1-lg1:~# cd /opt/amarisoft/lteenb-linux-2021-09-18
root@sdr2-s1-lg1:/opt/amarisoft/lteenb-linux-2021-09-18# ./lteenb config/gnb-sa-2974.cfg
Base Station version 2021-09-18, Copyright (C) 2012-2021 Amarisoft
This software is licensed to Rutgers University (The State University of New Jersey).
License server: license.orbit-lab.org (0b-b4-46-dc-2f-83-58-cb)
Support and software update available until 2022-08-18.
[INFO] [UHD] linux; GNU C++ version 7.5.0; Boost_106501; UHD_3.15.0.0-release
[INFO] [MPMD FIND] Found MPM devices, but none are reachable for a UHD session. Specify find_all to find all devices.
[INFO] [X300] X300 initialization sequence...
[INFO] [X300] Connecting to niusrpriorpc at localhost:5444...
[INFO] [X300] Using LVBITX bitfile /usr/share/uhd/images/usrp_x310_fpga_XG.lvbitx
[INFO] [X300] Radio 1x clock: 184.32 MHz
[INFO] [GPS] Found an internal GPSDO: LC_XO, Firmware Rev 0.929b
[WARNING] [GPS] update_cache: Malformed GPSDO string: EEPROM Write Failed!
[WARNING] [GPS] update_cache: Malformed GPSDO string: EEPROM Write Failed!
[INFO] [0/DmaFIFO_0] Initializing block control (NOC ID: 0xF1F0D00000000000)
[INFO] [0/DmaFIFO_0] BIST passed (Throughput: 1302 MB/s)
[INFO] [0/DmaFIFO_0] BIST passed (Throughput: 1294 MB/s)
[INFO] [0/Radio_0] Initializing block control (NOC ID: 0x12AD100000000001)
[INFO] [0/Radio_1] Initializing block control (NOC ID: 0x12AD100000000001)
[INFO] [0/DDC_0] Initializing block control (NOC ID: 0xDDC0000000000000)
[INFO] [0/DDC_1] Initializing block control (NOC ID: 0xDDC0000000000000)
[INFO] [0/DUC_0] Initializing block control (NOC ID: 0xD0C0000000000000)
[INFO] [0/DUC_1] Initializing block control (NOC ID: 0xD0C0000000000000)
RF0: sample_rate=23.040 MHz dl_freq=3489.420 MHz ul_freq=3489.420 MHz (band n78) dl_ant=2 ul_ant=1
(enb) Chan Gain(dB) Freq(MHz)
TX1 25.0 3489.420000
TX2 25.0 3489.420000
RX1 30.0 3489.420000
As the SIM8200 modem on srv1-in1 powers up and registers, the eNB/gNB trace shows PRACH activity and scheduler entries for the UE (RNTI 003d in the example below):
(enb) t
Press [return] to stop the trace
PRACH: cell=01 seq=20 ta=11 snr=16.0 dB
----DL----------------------- --UL------------------------------------------------
UE_ID CL RNTI C cqi ri mcs retx txok brate snr puc1 mcs rxko rxok brate #its phr pl ta
1 001 003d 1 7 1 6.8 0 5 708 16.1 -1.0 10.0 12 7 2.55k 1/4.5/6 0 24 -0.3
1 001 003d 1 9 1 13.8 1 23 6.46k 11.7 2.9 17.2 19 21 18.7k 1/4.1/6 5 24 -0.2
1 001 003d 1 7 1 15.4 0 5 960 11.4 14.7 9.0 0 1 628 1/1.0/1 2 25 -0.4
1 001 003d 1 7 1 11.0 0 4 312 7.2 -8.9 16.0 0 1 612 2/2.0/2 5 24 -0.1
1 001 003d 1 7 1 11.8 0 4 336 9.2 11.4 - 0 0 0 - 5 24 -1.0
1 001 003d 1 5 1 11.8 0 4 336 12.5 18.2 11.0 0 1 516 1/1.0/1 3 24 -0.4
1 001 003d 1 8 1 11.8 0 4 372 4.3 16.8 - 0 0 0 - 3 24 -0.4
In the MME session, check the registered eNB/gNB and UE. The SIM card IMSI is 310014000000017 and the MME allocates IP 192.168.2.2.
LTE / EPC view:
(mme) enb
PLMN eNB_ID IP:Port #UEctx TACs
310014 0x1a2d0 127.0.1.1:47633 0 0x1
(mme) ue
SUPI IMEISV CN M-TMSI/5G-TMSI REG TAC #BEARER IP_ADDR
310014000000017 8642840402500300 EPC 0xa592c726 Y 310014. 0x1 2 192.168.2.2 192.168.4.2 2001:468:3000:1::
(mme)
5G NR SA / 5GC view:
(mme) gnb
PLMN RAN_ID IP:Port #UEctx TACs
310014 0x12345 127.0.1.1:38071 0 0x64
(mme) ue
SUPI IMEISV CN M-TMSI/5G-TMSI REG TAC #BEARER IP_ADDR
310014000000017 8642840402500300 5GC 0x525b2ca7 Y 310014. 0x64 2 192.168.4.2 2001:468:3000:1:: 192.168.2.2
(mme)
On srv1-in1, confirm the modem appears as wwp0s20u3i5:
root@srv1-in1:~# ifconfig -a
CTRL: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.44.1.5 netmask 255.255.0.0 broadcast 10.44.255.255
inet6 fe80::da50:e6ff:fed4:f80e prefixlen 64 scopeid 0x20<link>
ether d8:50:e6:d4:f8:0e txqueuelen 1000 (Ethernet)
RX packets 53 bytes 7687 (7.6 KB)
RX errors 0 dropped 7 overruns 0 frame 0
TX packets 39 bytes 5910 (5.9 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 20 memory 0xf7d00000-f7d20000
DATA1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::da50:e6ff:fed4:f60a prefixlen 64 scopeid 0x20<link>
ether d8:50:e6:d4:f6:0a txqueuelen 1000 (Ethernet)
RX packets 5 bytes 300 (300.0 B)
RX errors 0 dropped 5 overruns 0 frame 0
TX packets 11 bytes 1874 (1.8 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 148 bytes 10311 (10.3 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 148 bytes 10311 (10.3 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wwp0s20u3i5: flags=4291<UP,BROADCAST,RUNNING,NOARP,MULTICAST> mtu 1500
inet6 fe80::7cab:29ff:fe84:1b18 prefixlen 64 scopeid 0x20<link>
ether 7e:ab:29:84:1b:18 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Assign the IP address allocated by the MME (192.168.2.2) to the wwan interface:
root@srv1-in1:~# ifconfig wwp0s20u3i5 192.168.2.2
Ping the base station PDN gateway (192.168.2.1):
root@srv1-in1:~# ifconfig wwp0s20u3i5 192.168.2.2
root@srv1-in1:~# ping 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=146 ms
64 bytes from 192.168.2.1: icmp_seq=2 ttl=64 time=25.0 ms
64 bytes from 192.168.2.1: icmp_seq=3 ttl=64 time=23.9 ms
64 bytes from 192.168.2.1: icmp_seq=4 ttl=64 time=21.9 ms
64 bytes from 192.168.2.1: icmp_seq=5 ttl=64 time=39.9 ms
64 bytes from 192.168.2.1: icmp_seq=6 ttl=64 time=37.9 ms
64 bytes from 192.168.2.1: icmp_seq=7 ttl=64 time=35.9 ms
^C
--- 192.168.2.1 ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6010ms
rtt min/avg/max/mdev = 21.920/47.296/146.430/41.032 ms
iperf3 throughput test — start the server on sdr2-s1-lg1:
root@sdr2-s1-lg1:~# iperf3 -s -i 1
-----------------------------------------------------------
Server listening on 5201
-----------------------------------------------------------
Run the client on srv1-in1 (10 Mbps target, 60 second run):
root@srv1-in1:~# iperf3 -c 192.168.2.1 -b 10M -i 1 -t 60
Connecting to host 192.168.2.1, port 5201
[ 4] local 192.168.2.2 port 34278 connected to 192.168.2.1 port 5201
[ ID] Interval Transfer Bandwidth Retr Cwnd
[ 4] 0.00-1.00 sec 451 KBytes 3.70 Mbits/sec 0 45.2 KBytes
[ 4] 1.00-2.00 sec 469 KBytes 3.85 Mbits/sec 0 63.6 KBytes
[ 4] 2.00-3.00 sec 708 KBytes 5.80 Mbits/sec 0 84.8 KBytes
[ 4] 3.00-4.00 sec 635 KBytes 5.20 Mbits/sec 0 109 KBytes
[ 4] 4.00-5.00 sec 638 KBytes 5.22 Mbits/sec 0 129 KBytes
[ 4] 5.00-6.00 sec 798 KBytes 6.53 Mbits/sec 0 158 KBytes
[ 4] 6.00-7.00 sec 667 KBytes 5.47 Mbits/sec 0 198 KBytes
[ 4] 7.00-8.00 sec 643 KBytes 5.27 Mbits/sec 0 260 KBytes
[ 4] 8.00-9.00 sec 590 KBytes 4.83 Mbits/sec 0 315 KBytes
[ 4] 9.00-10.00 sec 761 KBytes 6.23 Mbits/sec 0 427 KBytes
[ 4] 10.00-11.00 sec 908 KBytes 7.44 Mbits/sec 0 581 KBytes
uhd_find_devices --args="resource=RIO0" returns the X310 device with serial 318F215.(mme) prompt appears and the eNB/gNB connects (visible with (mme) enb or (mme) gnb).003d.(mme) ue shows IMSI 310014000000017 with REG=Y and an allocated IP address.ping 192.168.2.1 from srv1-in1 returns replies with 0% packet loss.omf tell -a offh -t system:topo:allres
No omf save needed unless you modified the images.
| Symptom | Likely cause | Fix |
|---|---|---|
uhd_find_devices --args="resource=RIO0" returns nothing |
NI-RIO kernel modules not loaded | Reboot sdr2-s1-lg1 and retry |
| MME exits immediately after start | License server unreachable | Confirm network connectivity to license.orbit-lab.org; verify the license has not expired |
| eNB/gNB exits with "resource=RIO0 not found" | UHD/FPGA image mismatch | Check that usrp_x310_fpga_XG.lvbitx exists in /usr/share/uhd/images/; re-download with uhd_images_downloader if missing |
| GPS not locked warning at startup | No GPS signal indoors | Normal for indoor operation; the base station runs without GPS lock (no precise timing) |
(mme) ue shows no registered UE |
Modem not attached | Check that srv1-in1's wwan interface is up (ifconfig -a); confirm SIM card is seated; restart the modem if wwp0s20u3i5 does not appear |
wwp0s20u3i5 missing from ifconfig -a |
Modem driver not loaded or USB not detected | Check dmesg for USB enumeration errors; confirm the SIM8200 is physically seated in the M.2 slot |
ping 192.168.2.1 fails |
wwan IP not set | Re-run ifconfig wwp0s20u3i5 192.168.2.2; confirm the MME allocated this IP in (mme) ue output |
Author(s): COSMOS team · Last verified: Not re-tested (migrated 2026-06-20) · Tested image/release: amarisoft-2974.ndz / waveshare-sim8200.ndz · Tags: amarisoft, 4g, lte, 5g, nr-sa, usrp-2974, sim8200, weeks