4G Network Emulator

Emulate 4G LTE network nodes and generate realistic traffic between network devices
MME Emulator
4G Conformance
4G Network Emulator

Emulate 4G LTE network nodes and generate realistic traffic between network devices


The Valid8 4G Network Emulator provides an all-in-one, cost-effective and ultra-portable 4G network for demonstration, testing and training purposes.

What It Can Do For You

The 4G Network Emulator solution is capable of simulating and testing several devices individually or in parallel. There are options available to include a real eNodeB OTA if you need to use real UEs or IoT devices with traffic generation, or our simulated eNodeB if you don’t need the RF interface. Subsystems can be switched on or off depending on how much of the network you need simulated.

Example: A network service provider would want to test how their network would function in a real deployment.

  • Will it properly handle Control plane and User plane traffic?
  • Will it conform to 3GPP standards?
  • How will it perform under load?

Example: A UE device manufacturer wants to test performance and security in a cost-effective way

  • Verify connections to specific PLMNs in a deterministic network environment
  • What happens when invalid messages are sent to it?
  • How will it perform under load?

Why It’s Different

  • Software based solution can be run on high-end customer hardware/VM to achieve better performance, or in the Cloud (e.g. Amazon AWS) for maximum versatility
  • Web-based Graphical User Interface provides customer with intuitive, easy access via browser
  • API’s used (REST, HTTP)  enable automated testing using test tools.
  • Emulated nodes behave exactly as true real nodes, due to Finite State Machine architecture
  • Testing is scalable across multiple cores and multiple systems


  • Realistic network emulation of up to 1,000s of devices and calls (scalable)
  • Emulates some or all of core network, exposing all internal interfaces
  • Conformance tests available for each interface (S1, S5, S6a, S7, S11, Rx, Gx, Gy, Ro)
  • Emulators available per subsystem (MME Emulator, PCRF Emulator, etc.)
  • OTA connection available for UEs and IoT devices
  • True stateful simulation
  • Handover support on X2 and S1
  • Signaling request/response messages for call handling, mobility management, authentication, QoS
  • Report on media received, call connect time, call duration, jitter, packet loss
  • Generate valid and invalid/negative messages and call-scenarios (fully editable scenarios)
  • Supports sending invalid messages including malformed, dropped, and misordered packets
  • Check parameters in messages from SUT and flag errors
  • ‍Diameter CER/A, DWR/A, CCR-I/A, CCR-U/A, CCR-T/A, RAR/A request/response messages
  • 3GPP-compliant interfaces
  • ‍Alerts and notifications
  • Core network 5G ready


The Valid8 4G Network Emulator is compromised of multiple subsystems that are available individually or in parallel, and are scalable to fit your needs. The individual emulators are controllable through their call controllers, and the traffic can be captured through use of a remote capture tool such as Wireshark.

  • ‍eNodeB (femto, pico, or emulated)
  • MME
  • SGW
  • PGW
  • OCS
  • HSS
  • PCRF
  • ePDG
  • SGSN
  • CSCF
  • PCEF
  • ‍S1 Attach Requests/Successes/Fails
  • S1 Detach Requests/Successes/Fails
  • S1 Dedicated Bearer Requests/Successes/Fails
  • Current Active Sessions/ Bearers
  • Number of Sessions/ Bearers Created
  • S1 Attach Request Response Time
  • S1 Dedicated Bearer Setup Request Response Time
  • S1 Detach Request Response Time
  • S1 Authentication Request Response Time
  • S6a Authentication Request Response Time
  • S1 Tracking Area Update Request Response Time 
Configurable Parameters
  • Mobile Country Code
  • Mobile Network Code
  • eNodeB Type
  • IP Addres S1 Interface
  • IP Address eNodeB
  • Primary DNS Address
  • Secondary DNS Adress
  • MAC Address Public Gateway
  • GTP Tunnel IP Address and Port
  • GTP Tunnel eNodeB IP Address
  • Integrity Algorithm
  • IP Address to assign UEs on LAN

Automation API

User commands can be fully automated using REST API. This includes performing all test control functions as well as collecting results and metrics.


The application’s subsystems can be edited directly in the browser using Javascript or by using the graphical tools seen below. The Message Workshop allows for creating of test scenarios directly from the hex stream of a remote capture, while the Graphical Editor allows for creating customized call scenarios by dragging and dropping the call flow to meet your test needs.

This is some text inside of a div block.

Use Cases

eNodeB Under Test

In the scenario where the eNodeB is to be tested, it can be tested by the Valid8 4G Network Emulator emulating the core network. Additionally, load and conformance tests are available for interfaces S1-MME and S1-U. In the case where the eNodeB needs to be tested on the RF side, it can be tested by the Valid8 4G UE Emulator.

Supported Scenarios:
  • ‍Power on / Start up
  • 4 Attach
  • 4 TAU
  • 4 Attach
  • 4 eRAB Setup
  • 4 Detach
  • UE Under 
  • Emulates MME (for S1-MME) and SGW (for S1-U) along with all other needed core network elements, exposing all internal interfaces
  • Conformance tests available for S1-MME, S1-U, and X2

UE Under Test

For testing UE or IoT devices, the 4G Network Emulator can provide the entire 4G core network as well as an emulated or real eNodeB depending on your test needs.

Supported Scenarios:
  • ‍Power on
  • 4 Attach
  • 4 Detach
  • 4 TAU
  • 4 Data Connection
  • 4 VoLTE Call
  • ‍End to end VoLTE test capability
  • Includes real femto, pico, or microcell eNodeB
  • Emulates all core network nodes and allows for data connection to external networks

PGW Under Test

For testing the PGW, the 4G Network Emulator can wrap around the node using the S5/8, S7, and SGi interfaces. Traffic can be originated from real or emulated UE and IoT devices.

Supported Scenarios:
  • ‍Create Session
  • 4 Delete Session
  • 4 Create Bearer
  • 4 Modify Bearer
  • 4 Delete Bearer
  • 4 Echo
  • ‍Emulates all required nodes for wrapping around, including MME and PCRF for testing over interfaces S5/8, S7, and SGi
  • Exposes all internal interfaces
  • Conformance tests available for each interface (S5/8, S7, SGi)

PCRF Under Test

For testing the PCRF, the 4G Network Emulator can wrap around the PCRF with the core network and IMS.

Supported Scenarios:
  • ‍CC-Request / Answer (CCR / CCA)
  • 4 Re-Auth-Request / Answer (RAR / RAA)
  • 4 Capability-Exchange-Request / Answer (CER / CEA)
  • 4 Session-Termination-Request / Answer (STR / STA)
  • 4 Abort-Termination-Request / Answer (ASR / ASA)
  • 4 Device-Watchdog-Request / Answer (DWR / DWA)
  • 4 Disconnect-Peer-Request / Answer (DPR / DPA)
  • ‍Emulates core network, Diameter, and IMS nodes as needed for testing the PCRF, exposing all internal interfaces
  • Conformance tests available for each interface (S7, S9, Rx, Gx)
4G Network Emulator
4G Network Emulator

Summary of Specifications

The Valid8 4G Network Emulator is capable of simulating and testing several devices individually or in parallel and is scalable to fit your needs.



  • 3GPP TS 23.401 v10.13.0 (EUTRAN) 
  • 3GPP TS 24.301 v10.15.0 (NAS) 
  • 3GPP TS 29.060 v10.12.0 (GTPv1) 
  • 3GPP TS 29.272 v10.9.0 (S6a) 
  • 3GPP TS 29.212 v10.16.0 (Gx) 
  • 3GPP TS 29.214 v10.14.0 (Rx) 
  • 3GPP TS 29.274 v10.14.0 (GTPv2-C) 
  • 3GPP TS 29.281 v10.3.0 (GTPv1-U) 
  • 3GPP TS 32.299 v10.16.0 (Gy) 
  • 3GPP TS 36.413 v10.9.0 (S1AP) 
  • 3GPP TS 36.414 v10.1.0 (S1-U) 
  • IETF RFC6733 - Diameter 
  • IETF RFC4006 - Ro 
  • IETF RFC5246 - TLS, Protocol (1.0,1.1,1.2) 
  • IETF RFC6101 - SSL, Protocol Version 3.0 
  • IETF RFC793 - TCP 
  • IETF RFC768 - UDP 
  • IETF RFC4960 - SCTP 
  • IETF RFC791 - IPv4 
  • IETF RFC2460 - IPv6 
  • IETF RFC3550 - RTP / RTCP 
  • IETF RFC3711 - SRTP 
  • IETF RFC1035 - DNS 
  • IETF RFC2131 - DHCP 

Mobile Management Entity

  • ‍NAS 
  • SAE Bearer Management 
  • UE Location, Subscriber Data Handling 
  • Authentication 
  • Fault Recovery 
  • Notification 
  • Mix of PDN types, IPv4, IPv6 
  • Up to 2 sessions per IMSI 
  • Interface S1-MME to eNodeB: S1-AP 
  • Interface S6a to HSS: Diameter over SCTP 
  • Interface S11 to SGW: eGTP-C/GTPv2-C 
  • Supports up to 4 eNodeBs (scalable) 

Serving Gateway SGW

  • Packet Routing and Transfer Functions 
  • IP Address Allocation 
  • Interface S1-U to eNodeB: GTP-U 
  • Interface S4 to SGSN: GTP-U, eGTP-C/GTPv2-C 
  • Interface S5 to PGW: GTP-U, eGTP-C/GTPv2-C 
  • Interface S11 to MME: eGTP-C/GTPv2-C 

PDN Gateway

  • ‍Packet Routing and Transfer Functions 
  • IP Address Allocation 
  • Interface S5 to SGW: GTP-U, eGTP-C/GTPv2-C 
  • Interface S7 to PCRF: Diameter over SCTP 


  • ‍Subscriber profiles 
  • UE Location 
  • Subscriber Data Handling 
  • Authentication (AuC) 
  • Fault Recovery 
  • Notification 


  • ‍GTP (S2a/b) to PGW 
  • ‍IKEv2 and ESP Encryption: DES-CBC, DES-CBC,128 bit AES-CBC, 192 bit AES-CBC,  256 bit AES, Null, 128 bit  AES-CTR, 192 bit AES-CTR, 256 bit AES-CTR, 168 bit 3DES-EDE-CBC
  • ‍IKEv2 and ESP Integrity Algorithms: 96 bit AES XCBC, 96 bit MD5 HMAC, 96 bit SHA1 HMAC


  • ‍Operational Frequency Bands: 
  • Internal femtocell: 400 - 6000 Mhz (includes unlicensed 5Ghz bands) 
  • External picocell: Bands 2, 3, 4, 7, 9, 10, 12, 17, 20, 25, 38, 40, 41, 42, 43 (includes CBRS band)
  • Duplex: FDD & TDD 
  • Synchronization: GPS 
  • Modulations from QPSK to 256QAM (Rel 12) 
  • Connector type - Femtocell: SMA female 
  • Connector type - Picocell: N-type female 
  • Interface S1-MME to MME: S1-AP 
  • Interface S1-U to SGW: GTP-U 
  • Interface X2 to eNodeB: X2-AP 
  • Interface Uu to UE 
  • Interface M1 to eMBMS 
  • Supports up to 32 UEs with 4 bearers each 
  • * = roadmap 


  • ‍Policy Control Functions 
  • QoS Authorization 


  • ‍CER/A, DWR/A, CCR-I/A, CCR-U/A, CCR-T/A, RAR/A request/response messages 


  • ‍1,000 Mbps total throughput 

Test Scenarios

  • ‍Attach and Default EPS Bearer Context Activation 
  • Attach / Reject 
  • Detach 
  • Tracking Area Update 
  • E-UTRA Handover 
  • PDN Connectivity Request 
  • HTTP Browsing 

Network Emulation

  • ‍Simulated network delays and packet loss 

Quality Testing

  • ‍VoLTE Voice Quality Analysis 
  • QoE 

Product Details


  • ‍Intel-based; scalable to meet performance needs 


  • ‍P5088/01 includes base kit (simulated eNB) 
  • P5089/01 includes LTE pico eNB (single band) 
  • P8110/02 includes LTE femto eNB (multi band) 
  • Conformance tests available for each interface (S1, S5, S6a, S7, S11, Rx, Gx, Gy, Ro) 

Operating System 

  • ‍Protocol Engine (Linux-based) 

User Interface 

  • ‍Browser-based, touch-optimized graphical user interface 


  • ‍HTTP API 

Max output power 

  • ‍31 mW (femto RF module option) 
  • 1000 mW per Tx (exernal picocell option) 

Connector types

  • ‍Femtocell: SMA female 
  • Picocell: N-type female 

Hardware dimensions 

  • M3: 19” x 15.75” x 3.5”; appx. 16.7lb 

Power supply 

  • ‍M3: 520W AC to DC, 100 - 240v 
All Solutions

Valid8 exports its products strictly in accordance with all US Export Control laws and regulations which shall apply to any purchase or order. Specifications are subject to change without notice.

500 West Cummings Park, Suite 6550 Woburn, MA 01801
p: +1-855-482-5438
f: +1-781-996-3708

Ordering Information

  • Product Name: 4G Network Emulator
  • Product Code: 4g-network-emulator
Datasheet Page

Related Video

Related Solutions

2G Network Emulator
  • Product Name: 2G Network Emulator
  • Product Code: 2G-sw-core-network-emulator
Datasheet Page
SIP Load Tester
  • Product Name: SIP Load Tester 
  • Product Code: sip-load-tester
Datasheet Page
4G UE Emulator
  • Product Name: 4G UE Emulator 
  • Product Code: 4g-ue-emulator
Datasheet Page
5G Network Emulator
  • Product Name: 5G Network Emulator 
  • Product Code: 5g-network-emulator
Datasheet Page
LTE eNodeB EPC Emulator

Product Name: LTE Core Network Emulator

Product Code: lte-core-network-emulator

Datasheet Page
MCPTT Load Tester

Product Name: MCPTT Load Tester 

Product Code: mcptt-load-tester

Datasheet Page
LTE EPC Emulator

Product Name: LTE Core Network Emulator 

Product Code: lte-core-network-emulator

Datasheet Page
  • Product Name: SIP Conformance
  • Product Code: sip-conformance-base-suite
Datasheet Page