Mobile UE Tester

Emulates 3G NodeB, 4G eNodeB, 5G gNodeB RAN and mobile core to test UE devices including CPE router, phone, modem & IoT devices
Public Safety
Mobile UE Tester

Emulates 3G NodeB, 4G eNodeB, 5G gNodeB RAN and mobile core to test UE devices including CPE router, phone, modem & IoT devices


Valid8's Mobile UE Tester is a hardware-based solution that mimics 3G, 4G & 5G RAN along with a customizable core network emulator to test user equipment (UE) devices

What It Can Do For You

Lower Cost Per Test: Valid8 has continued to add automation and simplicity to their technology, driving down the cost per test.

Increased Test Environment Flexibility: By allowing the ability to configure the simulated environment to meet specific testing needs, users can safely perform penetration tests and other security tests that could not typically be performed on a public network.

Comprehensive Test Menu: Enables testing of a variety of data-centric cellular devices including: IoT,embedded, modems, routers & hotspots.

Actionable/Collaborative Reports : From a user-friendly interface screen users can quickly see test results, uncover any issues, and drill-down as needed.Historical tracking allows for trend analysis and reports. Reports can be easily shared with the rest of the team, or integrated into a 3rd party reporting tool.

Why It’s Different

  • Software based solution can be run on high-end Valid8 or customer hardware/VM to achieve better performance, or in the Cloud (e.g. Amazon AWS) for maximum versatility 
  • Web-based Graphical User Interface provides customer with intuitive, easy access via browser 
  • API’s used (REST, HTTP) enable automated testing using test tools. 
  • Emulated nodes behave exactly as true real nodes, due to Finite State Machine architecture 
  • Testing is scalable across multiple cores and multiple systems


  • Emulates the RAN with OTA connection available for UEs and IoT devices 
  • Emulates some or all of the core network, exposing all internal interfaces 
  • Emulators available per subsystem (MME, AMF, HSS, PCRF, MSC, SGSN, SGW, PGW, etc.) 
  • True stateful simulation 
  • Handover support on X2 and S1 (requires 2 eNodeB option)
  • Signaling request/response messages for call handling, mobility management, authentication, QoS 
  • Report on media received, call connect time, call duration, jitter, packet loss 
  • Generate valid and invalid/negative messages and call-scenarios (fully editable scenarios) 
  • Supports sending invalid messages including malformed, dropped, and misordered packets 
  • Check parameters in messages from SUT and flag errors
  • 3GPP-compliant interfaces 


  • Release 14 compliant
  • Category M1 UE support
  • TM6 and TM9 support
  • FDD only (FDD and HD-FDD UEs are supported)
  • Support of multiple CE levels (only CE-Mode A is supported)
  • Support of message repetition for MPDCCH, PDSCH and PUSCH in full duplex (only MPDCCH, PDSCH and PUSCH supported)
  • Support of localized MPDCCH transmission
  • EPDCCH support for Category M1
  • No frequency hopping
  • Bandwidth must be >= 5 MHz for cells that also need to support Category 0 and above UEs


  • Release 14 compliant
  • Single-tone and multi-tone category NB1 and NB2 UE support
  • 15 kHz and 3.75 kHz subcarrier spacing are supported
  • All operation modes (in-band, guard band and standalone) are supported
  • Multiple NB-IoT and LTE cells can be used at the same time in the same eNodeB
  • Support of multiple coverage levels
  • Support of all NPDCCH, NPDSCH, NPUSCH and NPRACH configurations
  • Support of control plane CIoT optimization
  • Support of multi-DRB mode


  • Attach Requests/Successes/Fails 
  • Detach Requests/Successes/Fails 
  • Dedicated Bearer Requests/Successes/Fails 
  • Current Active Sessions/ Bearers 
  • Number of Sessions/ Bearers Created 
  • Attach Request Response Time 
  • Dedicated Bearer Setup Request Response Time 
  • Detach Request Response Time
  • Authentication Request Response Time
  • S6a Authentication Request Response Time 
  • Tracking Area Update Request Response Time
  • Protocol Errors
  • Message Timeouts
  • iPerf OTT QoS measurements
Configurable Parameters
  • Frequency Band
  • Channel Bandwidth 1.4, 3, 5, 10, 15, 20
  • Includes CBRS band
  • Carrier Aggregation
  • PLMN Mobile Country Code (MCC), Mobile Network Code (MNC)
  • eNodeB Type IP Address S1 Interface 
  • IP Address eNodeB 
  • Primary DNS Address 
  • Secondary DNS Adress 
  • MAC Address Public Gateway 
  • GTP Tunnel IP Address and Port 
  • GTP Tunnel eNodeB IP Address 
  • Integrity Algorithm 
  • IP Address to assign UEs on LAN

Automation API

User commands can be fully automated using REST API. This includes performing all test control functions as well as collecting results and metrics. It can be integrated into virtually any CI system via the HTTP API, including Jenkins, CircleCI, Gitlab and others


The application’s subsystems can be edited directly in the browser using TDL or by using the graphical tools. The Message Workshop allows for creating of test scenarios directly from the hex stream of a remote capture, while the Graphical Editor (on the feature roadmap for 2019) will allow for creating customized call scenarios by dragging and dropping the call flow to meet your test needs.

This is some text inside of a div block.

Use Cases

UE Under Test

For testing UE or IoT devices, the 5G, 4G or 3G Network Emulators can provide the entire core network as well as an emulated or real base station depending on your test needs.

Supported Scenarios:
  • ‍Power on
  • Attach
  • Detach
  • TAU
  • Data Connection
  • VoLTE Call
  • ‍End to end VoLTE test capability
  • Includes real femto, pico, or microcell eNodeB
  • Emulates all core network nodes and allows for data connection to external networks

CPE Router UE Under Test

For testing CPE Router UE devices that have WiFi and cellular data capability, the 5G 4G 3G Base Station Emulators can provide OTA testing capability through its built-in base station and core network emulator. It enables end-to-end testing from WiFi to cellular.

Supported Scenarios:

Supports scenarios:

  • Power on
  • Attach
  • Detach
  • TAU
  • Data Connection

Some of the key capabilities introduced with the M5 Mobile UE Tester Include:

  • Lower Cost Per Test
  • Increased Test Environment Flexibility
  • Comprehensive Test Menu
  • Actionable/Collaborative Reports

  • End-to-end Over-the-Air performance test capability
  • Includes RF base station
  • Emulates all core network nodes and allows for data connection to external networks
Mobile UE Tester
Mobile UE Tester

Summary of Specifications


  • LTE release 14 compliant
  • FDD and TDD configurations
  • Supported bandwidths: 1.4, 3, 5, 10, 15 and 20 MHz
  • Handle several cells in intra-band or inter-band configurations
  • Transmission modes: 1 (single antenna) and 2x2 MIMO
  • Carrier Aggregation support with cross carrier scheduling up to 3 DL channels
  • 256QAM DL support for PDSCH and MBMS
  • Support of release 11 TDD special subframe configurations 7 and 9

Product Details

Emulates base station and core to test the UE

Actual throughput levels over radio may vary based on the 3rd party device manufacturer and software versions. Valid8 product specifications are subject to change at any time without notice.

All Solutions

Valid8 exports its products strictly in accordance with all US Export Control laws and regulations which shall apply to any purchase or order. Specifications are subject to change without notice.

500 West Cummings Park, Suite 6550 Woburn, MA 01801
p: +1-855-482-5438
f: +1-781-996-3708

Ordering Information

M3 Mobile UE Tester

Emulation options:
lte-core-network-emulator-enodeb-mimo-m5-1-pkg : 1 M5, 1 eNB (up to 2x2 MIMO and up to 4 CA), 1 EPC (MME, HSS, PGW, SGW, OCS, PCRF), supporting 1 UE, basic call
5g-core-network-emulator-gnodeb-m5-1-pkg : 1 M5, 1 eGNB, 1 5GC (AMF, SMF, UDR, AUSF, NRF), supporting 1 UE, basic call
(others on request)(others on request)

Protocol interface options:
(on request)

Miscellaneous options:
Security, fuzzing, penetration test

Licensing options:
wireless-UE-upgrade-licenses-10 : 10 UEs
wireless-UE-upgrade-licenses-20 : 20 UEs
(others on request)
2x2 MIMO
Multiple eNodeBs on request
Multiple EPC network elements on request


Depending on the 3rd party device manufacturer and software versions, you may experience different throughput levels over the radio. Specifications are subject to change at any time without notice.

Datasheet Page

Related Video

Related Solutions

5G Core and RAN Network Emulator
  • Product Name: 5G Network Emulator 
  • Product Code: 5g-network-emulator
Datasheet Page
4G UE Emulator
  • Product Name: 4G UE Emulator 
  • Product Code: 4g-ue-emulator

Datasheet Page
MCX Load Tester

Product Name: MCPTT Load Tester 

Product Code: mcptt-load-tester

Datasheet Page
LTE EPC Emulator

Product Name: LTE Core Network Emulator 

Product Code: lte-core-network-emulator

Datasheet Page
  • Product Name: SIP Conformance
  • Product Code: sip-conformance-base-suite, sip-conformance-protos-suite, sip-conformance-torture-suite, sip-conformance-extensions-suite
Datasheet Page

Navigate through All Solutions