Skip to content

Test Environment and Tooling⚓︎

This page defines the environment every procedure in the acceptance test catalog assumes: the reference topology and its capture points, the tools a tester needs, what the devices and SIMs must be able to do, and how evidence is named and kept. Read it once before planning a campaign; the procedures refer to it rather than repeating it.

Reference topology⚓︎

The platform is exercised on two access paths that share one Mobile Asset, one xControl and one enterprise network. On the local-radio path, customer-controlled radios attach directly to an Expeto Edge (xCore) instance at the site; authentication is performed by the subscriber database inside that xCore and nothing leaves the site. On the public-radio path, the same SIM attaches to the mobile operator's macro network; the operator's core reaches Expeto Gateway (xRouter), which authenticates the subscriber and forwards user-plane traffic over a secure link to the xCore instance dedicated to that customer in its public configuration. Both xCores and the xRouter are managed by Expeto Management (xControl and xView) through an agent that connects outbound from each site.

3GPP interface User plane Management nCapture point ENTERPRISE SITE · LOCAL RADIO MOBILE OPERATOR NETWORK · PUBLIC RADIO MNO DATA CENTER · MANAGEMENT UE private SIM eNodeB / gNodeB customer radio Expeto Edge (xCore) · local radio MME / AMF SGW-C, PGW-C / SMF HSS / UDM (local) PGW-U / UPF Agent S1-U / N3 S1-MME / N2 S11 · N4 Enterprise LAN applications, test host SGi / N6 UE same SIM Public RAN MNO macro network MNO core MME / AMF, SGW / SMF Expeto Gateway (xRouter) GTP proxy HSS / UDM Expeto Edge (xCore) · public SMF UPF S8 / N9 (GTP) S6a / N8 secure link · GTP-U Enterprise LAN applications, test host SGi / N6 Expeto Management xControl xView TLS 443, outbound 1 2 3 4 5 6

Reference test topology. Both paths end on the same enterprise network; the yellow chips are the functions that hold subscriber credentials, and the numbered badges are the capture points listed below.

Capture points⚓︎

Every procedure that ends with "inspect the signalling capture" expects a capture at one or more of these points. Capture on the host interface that carries the traffic (with tcpdump on the node, or a port mirror on the switch) or on the radio itself.

# Interface Where Wireshark display filter What to look for
1 S1-MME (4G) / N2 (5G) Between the radio and the MME or AMF, on the node interface facing the radio s1ap \|\| nas-eps / ngap \|\| nas-5gs Attach or Registration, Authentication, Security Mode, Initial Context Setup, Detach or Deregistration, Paging, UE Context Release
2 S1-U (4G) / N3 (5G) Between the radio and the user plane (PGW-U / UPF) gtp GTP-U tunnels carrying the UE's traffic; TEIDs match the session setup
3 S11 (4G) / N4 (PFCP) Inside the xCore, between control-plane and user-plane pods gtpv2 / pfcp Create Session, Modify Bearer, Delete Session; PFCP Session Establishment, Modification, Deletion
4 S6a (4G) / N8 and N12 (5G) Between the mobile operator's core and the HSS or UDM inside xRouter (public radio); inside the xCore on the local-radio path diameter / http2 Authentication Information and Update Location; Cancel Location on a network-initiated detach; Capabilities-Exchange (CER/CEA) and Device-Watchdog (DWR/DWA) with each Diameter peer
5 Secure link Between xRouter and the public-configuration xCore gtp User-plane traffic only; no signalling traverses the link
6 Management path From the xCore agent to xControl tls && tcp.port == 443 The connection is initiated from the xCore; no inbound connection is required
7 SMS over MAP Between the operator's signalling network and the SMSC in xRouter (SIGTRAN) gsm_map \|\| tcap MO-ForwardSM, SendRoutingInfoForSM, MT-ForwardSM, ReportSMDeliveryStatus, ReadyForSM, AlertServiceCentre
8 SMS over SGd Between the operator's MME (or SMS router) and the SMSC in xRouter diameter.applicationId == 16777313 MO-Forward-Short-Message (OFR/OFA), MT-Forward-Short-Message (TFR/TFA), Alert-Service-Centre (ALR/ALA)
9 SMPP Between an application server and the SMSC in xRouter (port 2775) smpp bind, submit_sm, deliver_sm, delivery receipts
10 Gp (3G) Between the operator's SGSN and the GTP proxy in xRouter (GTPv1-C on port 2123, GTPv1-U on 2152) gtp && gtp.flags.version == 1 Create PDP Context, Update PDP Context, Delete PDP Context; the GTPv1-U tunnel that follows
11 MAP (HLR) Between the operator's SGSN or VLR and the HLR in xRouter (SIGTRAN, M3UA) gsm_map \|\| tcap SendAuthenticationInfo, UpdateGprsLocation, UpdateLocation, InsertSubscriberData, CancelLocation

Tools⚓︎

Tool Used for Notes
Signalling capture Evidence for every procedure with a 3GPP flow tcpdump or an equivalent at the capture points above; save as .pcapng
xControl Mobile Asset status, session Event Log, Sites, Systems, Reports Log in with the role the procedure names. Bulk actions, Cancel Session and CSV export require ADMIN
xControl API Scripted provisioning and verification The REST API documented under API in this guide; use an API token for the Customer under test
Expeto CLI Reading the state of a network function (MME/AMF context, HSS/UDR record, sessions) and forcing a subscriber synchronization kubectl exec -it <release>-xfabric-agent-0 -c agent-cli -- cli on xCore, kubectl exec -it <release>-agent-0 -c cli -- cli on xRouter and xControl; the commands the procedures use are listed below, and the CLI guide under xCore explains navigation
kubectl Node, pod and service status for resilience tests; log collection Read-only access to the xCore, xRouter and xControl namespaces is sufficient
Throughput measurement AMBR, throughput and failover tests An iperf3 or OpenSpeedTest server on the enterprise LAN, which gives a measurement inside the enterprise network with no internet dependency
Network-side test host Paging and reachability tests A host on the enterprise LAN (SGi / N6 side) that can send ICMP or TCP traffic toward a UE address
xView Metrics and alerts as evidence for operations tests Prometheus metrics such as xcore_clients, xcore_upload_bytes_total, xcore_download_bytes_total and xcore_sync_*, filtered by the site and customer labels
3GPP peer simulator Capacity, stability and signalling-storm tests that exceed what devices can produce Expeto's simulator plays the radio and peer-core side of the protocols (eNodeB over S1AP with UE lifecycles, the S11 peer, gNodeB and UE). Tests that offer a simulator variant say so in their resources
SMPP test client SMS tests An external short message entity (ESME) that binds to the SMSC in xRouter with a system id from the SMSC configuration, sends submit_sm and receives deliver_sm, including delivery receipts

CLI commands used by the procedures⚓︎

Open the CLI with kubectl exec -it <release>-xfabric-agent-0 -c agent-cli -- cli on xCore, or kubectl exec -it <release>-agent-0 -c cli -- cli on xRouter and xControl. Commands are folder-scoped: cd to the folder first. Options are key=value; list filters are -f key=value; -s <n> sets the page size. A one-shot form for scripts is cli "cd /debug/ops && cmd sync-sub-check mode=FULL".

Need Command What the output shows
Subscriber record cd /lte, read hss <imsi>; 5G: cd /nr, read udr <imsi> The subscriber's record on the Site, or "not found"
MME or AMF context, idle or connected, serving cell read mme -f imsi=<imsi> (4G list), read mme <imsi> (full context); read amf <imsi> (5G) Columns imsi, enodeb, state, bearers; 5G Status (CM-IDLE or CM-CONNECTED), PLMN-CellId, TAC, gNodeB
Sessions with the UE address read pgw -f imsi=<imsi>, read sgw -f imsi=<imsi> (4G); read smf -f imsi=<imsi> (5G) Instance, IMSI, Bearer/PDU ID, Ip Address, SessionState, last download and upload bytes, Uptime
Connected radios cd /lte, read enodeb; 5G: cd /nr, read ran id, address, plmn, tais; 5G RanNode ID, IP:PORT, PLMN(s), TAC(s)
PFCP associations read associations -f type=pfcp Instance, type, nodeId, peerIp, heartbeatSeqNum
Full subscriber synchronization check cd /debug/ops, then cmd cache-clear type=SUBSCRIBER_CHECK_ERRORS, cmd sync-sub-check mode=FULL (repeat the command until it no longer answers "already running"), then read sync-sub-error One row per discrepancy (IMSI, Error, Node); an empty table means the Site matches xControl
Repair a discrepancy cmd sync-sub siteWide=true type=RECREATE, or cmd sync-sub id=<imsi> type=UPDATE Confirmation
Cancel Location, detach cd /lte, cmd hss-cancel imsi=<imsi>; delete mme <imsi>; 5G: cd /nr, delete amf <imsi> Confirmation
MME timers cd /lte/debug/ashmme, show timer; update timer t3412=<s> mobileReachableTimer=<s> valimplicitDetachTimerval=<s> The periodic update, mobile reachable and implicit detach timers
SUCI home-network keys (5G) cd /nr, add suci pkId=<1..255> plmn=<mccmnc> (prompts for the private key), read suci, delete suci pkId=<n> Private-Key-Id, PLMN, key fingerprint
Stored short messages cd /lte, read smsc; show smsc Sender, Receiver, Retries, Route, SMPP
Versions and network-function health read agent-versions at the root; cd /debug/nf, read node Site, Agent Version, Last Seen; Name, Vendor, Health

show pgw and show sgw are not implemented and are never cited.

Devices and SIMs⚓︎

  • At least two UEs with SIMs provisioned as Mobile Assets on a System of the Site under test. Capacity tests state their own counts.
  • Each UE supports the radio access technology under test (LTE, and 5G Standalone where 5G is tested), has the APN of its System Profile configured, and can browse the web or run a terminal application that sends ICMP echo requests.
  • A UE application that shows the registration and radio connection state (for example the phone's field-test menu) is needed for the idle-mode procedures.
  • For transitions between the public and the private radio, the UE must be able to select the private network's PLMN: either automatically, because the SIM's MNO-controlled PLMN list or the MNO's steering configuration lists it, or manually through the device's network selection menu. State which method the campaign uses in the results sheet.
  • Speed and byte-count procedures assume the UE generates no background traffic during the measurement; disable automatic updates and cloud synchronization on the test devices, or use a data-only device.

Evidence⚓︎

Name every evidence file <test ID>_<YYYYMMDD>_<item>.<ext>, for example EXP-SES-001_20260917_s1mme.pcapng or EXP-POL-001_20260917_speedtest-after.png. Keep the files with the completed results sheet for the campaign. Expeto keeps the evidence of its own release-candidate runs with the acceptance test report for that release.

Evidence type Capture as
3GPP signalling capture .pcapng from the capture point the procedure names, trimmed to the procedure
xControl session event log, Mobile Asset status, Site status Screenshot showing the IMSI, the timestamp and the field the expected result names
UE connectivity Screenshot of the browser page or terminal output, with the device clock visible
Throughput Screenshot or export of the speed test or iperf3 result, before and after where the procedure compares them
Kubernetes or service status Output of kubectl get pods -o wide (and kubectl get nodes) before, during and after the fault, as text
CLI output Terminal output of the command, as text

The results template has one row per published test with columns for the result, tester, date, evidence reference and deviation.