5G Signaling Traffic

Overview

This dataset contains raw network traffic (PCAP) and processed performance metrics (CSV) originating from 5G signaling procedures within Open5GS using UERANSIM. The data captures the interactions between various 5G Network Functions (NFs) during critical procedures such as UE Registration, Authentication, and PDU Session Establishment. It contains two measurement studies: A overall performance analysis of Open5GS and an AMF stability study.

The case study for Open5GS used 1000 UEs with negative-exponential interarrival times (10, 20, 50.100 per second) varying amounts of CPU resources (1, 2, 4, 8 cores) for the NF VMs. The stability study uses 8 CPU cores for all VMs, 10000 UEs and additionally investigates 150 and 200 devices per second.

This dataset is part of the Netsoft2026 publication: Measuring What Matters: Increasing the Observability of Signalling Traffic in the 5G Core

The dataset is organized into three primary formats:

Raw PCAP Files: Contain the full packet captures of the SBI (Service-Based Interface) traffic, typically using HTTP/2 over TCP/TLS and NGAP protocols.

Processed CSV Files after the PCAP parser: The extracted CSVs per UE as a timeline of events per device.

Processed CSV Files after the state-machine filter: Provide a structured timeline of events for easy analysis of processing times and latency.

CSV Column Descriptions after parser:

time: Time in seconds since measurement start.

src: Node identifier which sent the message (resolved hostname or ip).

dst: Node identifier who processes the message (resolved hostname or ip).

message: The signaling message type or API endpoint (e.g., InitialUeMessage, POST-nausf-auth, GET-nudr-dr) or the HTTP response status code (e.g., 200, 201, 204).

ue: The unique identifier for the User Equipment (IMSI) involved in the procedure.

CSV Column Descriptions after State-Machine filter:

node: The specific Network Function processing the signaling event (resolved hostname or ip).

servicetime: The duration (in seconds) taken by the node to process the specific request.

id: The signaling message type or API endpoint (e.g., InitialUeMessage, POST-nausf-auth, GET-nudr-dr) or the HTTP response status code (e.g., 200, 201, 204).

run: The experimental trial or execution ID.

start: The absolute timestamp when the node began processing the message.

end: The absolute timestamp when the node completed the operation.

ue: The unique identifier for the User Equipment (IMSI) involved in the procedure.

Usage Notes

The CSV files are delimited by semicolons (;). The servicetime is calculated as the difference between end and start. To reconstruct a full call flow for a specific user, filters should be applied to the ue and run columns.

Code Base

Please refer to the linked github project, for the framework to extract the presented PCAP files into the CSVs.