Prowid logo — programming courses PROWIDIT Education Academy

LTE/4G and the EPC Core

The LTE/4G and the EPC Core course — OFDMA, E-UTRAN (eNodeB), EPC (MME, S-GW, P-GW, HSS, PCRF), GTPv2, Diameter, EPS bearers, CSFB and Open5GS + srsRAN
140 lessons · 12 labs · project
5 practicums · 31 troubleshooting cases
After the 2G/3G Mobile Networks: GSM, UMTS, MAP and SMS course
Individual
Per month 200 AZN
Group
Per month 150 AZN
Paying for the full course in a group
15% discount
Installments
50/50
Subscription
from 30 AZN a month
How does a fourth-generation mobile network deliver gigabit speeds, sub-10 ms radio latency, voice calls and global roaming after completely abolishing the circuit-switched (CS) domain? This course covers the complete architecture and protocols of the 3GPP Release 8+ Evolved Packet System (EPS = E-UTRAN + EPC): the engineering drivers behind LTE (throughput, latency and cost per megabyte), LTE vs LTE-Advanced vs LTE-Advanced Pro and IMT-Advanced requirements, the flat All-IP architecture without BSC/RNC controllers, EPC core nodes (MME, S-GW, P-GW, HSS, PCRF), S1-MME, S1-U, S11, S5/S8, S6a, Gx/Gy, SGi, X2, S10, S13 and SGs interfaces, and Huawei EPC products (USN9810, UGW9811, UPCC, plus UNC and UDG in the convergent core). The LTE air interface: orthogonal OFDM subcarriers, downlink OFDMA and uplink SC-FDMA, the 10 ms frame / 1 ms subframe / slot hierarchy, the resource grid (Resource Block = 12 × 15 kHz and Resource Elements), 1.4–20 MHz channel bandwidths and frequency bands (Bands 3, 7, 20, etc.), physical channels (PDSCH, PDCCH, PUSCH, PUCCH, PBCH, PRACH) and reference signals, MIMO modes and Carrier Aggregation (CA), cell search (PSS/SSS) and Random Access (RACH), eNodeB baseline configuration (PLMN, TAC, Cell ID), idle/connected measurements and DRX battery saving. The protocol stack: Control Plane and User Plane stacks, RRC states and messages, PDCP/RLC/MAC layers, NAS (EMM and ESM), S1AP (including S1 Setup) and X2AP, SCTP transport, GTPv2-C and GTP-U tunneling (TEID, Echo path management, MTU and TCP MSS clamping), Diameter base protocol (RFC 6733: CER/CEA, DWR/DWA, AVPs, realm/host routing, result codes, DRA/DEA agents and Huawei USC), S6a (AIR/AIA, ULR/ULA, CLR, IDR, PUR) and Gx/Gy (CCR/CCA, RAR). Identities, node selection and QoS: GUTI, S-TMSI, TAI/TAC, ECGI, APN structure, DNS S-NAPTR node selection (3GPP TS 29.303), MME Pool (S1-flex), IPv4 and IPv6 /64 allocation, end-to-end EPS Bearers (Default vs Dedicated), the QCI table (GBR vs non-GBR), ARP, APN-AMBR/UE-AMBR, TFT packet filters and QCI-to-DSCP transport mapping. End-to-end procedures: the 6 phases of Initial Attach, additional PDN connectivity, Detach, EMM/ECM state machines, S1 Release, Service Request, Paging, Tracking Area Update (TAU), X2 and S1 handovers, Dedicated Bearer activation, Policy and Charging Control (PCC, Gy online quota management and Gz offline CDRs), CSFB voice and SMS over SGs, IRAT mobility (LTE ↔ 2G/3G), S8 roaming (Home Routed vs Local Breakout, IPX, DEA), CUPS split architecture, NB-IoT/LTE-M, Huawei USN9810/UGW9811 operations, 12 hands-on Open5GS + srsRAN (ZMQ) labs and 31 real-world outage investigations.

Enrollment for a new group is open — send a request to reserve your seat

Lessons are taught live in Azerbaijani and Russian.

Enroll in the course Free trial lesson

Or study on your own in your personal account → with a subscription from 30 AZN a month

Before you start

Complete IP Networks for Telecom Engineers and 2G/3G Mobile Networks: GSM, UMTS, MAP and SMS first: VLAN tagging, IPv4/IPv6 addressing, UDP/TCP/SCTP, DNS NAPTR/SRV records, DSCP/QoS marking, Wireshark packet analysis, as well as IMSI/IMEI/MSISDN identities, USIM AKA mutual authentication, and 2G/3G packet core fundamentals (SGSN, GGSN, PDP context and GTPv1) are used here without repeating the basics.

How the course works

One topic, one lesson: interactive slides, signaling ladder diagrams, radio/GTP tunnel animations, exercises with automated answer checking, and study notes in three languages (az, ru, en). Every lesson includes a worked example, a “What can go wrong and how to find it” section, practice tasks and a self-check. Hands-on labs run on the track Docker testbed: Open5GS (EPC) + srsRAN 4G (in ZMQ virtual radio mode, no SDR hardware required) + Wireshark.

Course outline

01

Introduction to LTE and EPS

  • why LTE was created (throughput, latency and cost-per-MB targets)
  • comparing LTE, LTE-Advanced
  • LTE-Advanced Pro and IMT-Advanced
  • EPS = E-UTRAN + EPC overview (All-IP, no CS domain)
  • EPC core nodes (MME, S-GW, P-GW, HSS, PCRF)
  • EPC interface map (S1-MME, S1-U, S11, S5/S8, S6a, Gx, SGi, X2, S10, S13, SGs) and Huawei EPC product mapping (USN9810, UGW9811, UPCC, plus UNC and UDG in the convergent core)
02

LTE air interface

  • OFDM fundamentals (orthogonal subcarriers and cyclic prefix)
  • OFDMA in the downlink vs SC-FDMA in the uplink
  • frame structure (10 ms frame, 1 ms subframe, slot)
  • resource grid (Resource Block = 12 × 15 kHz and Resource Elements)
  • 1.4–20 MHz channel bandwidths and frequency bands (Bands 3, 7, 20, etc.)
  • physical channels (PDSCH, PDCCH, PUSCH, PUCCH, PBCH, PRACH) and reference signals
  • MIMO spatial multiplexing and transmit diversity
  • Carrier Aggregation (CA)
  • cell search (PSS/SSS) and Random Access (RACH)
  • basic eNodeB parameters (PLMN, TAC, Cell ID, frequency, power)
  • cell reselection in idle and measurements in connected mode
  • DRX battery saving and practicum
03

E-UTRAN and EPC protocols

  • Control Plane and User Plane protocol stacks
  • RRC states and messages
  • RRC Connection Reconfiguration and Measurement Reports
  • PDCP (ROHC header compression and ciphering)
  • RLC (TM/UM/AM modes) and the MAC scheduler
  • NAS signaling (EMM and ESM)
  • S1AP procedures and S1 Setup
  • X2AP, SCTP transport on S1-MME and Diameter
  • GTPv2-C control messages
  • GTP-U user plane tunneling and TEIDs
  • GTP path management (Echo Request/Response and Recovery counter)
  • GTP tunnel MTU math and TCP MSS clamping
  • Diameter base protocol (CER/CEA, DWR/DWA, AVP format)
  • Diameter realm and host routing
  • Diameter result codes (2xxx–5xxx)
  • Diameter agents (DRA, DEA and Huawei USC)
  • S6a interface (AIR/AIA, ULR/ULA, CLR, IDR, PUR) and Gx/Gy interfaces (CCR/CCA, RAR)
04

Identities and node selection

  • temporary identities GUTI
  • S-TMSI and M-TMSI, tracking area identities TAI and TAC and global cell ID ECGI
  • APN structure (Network Identifier and Operator Identifier)
  • selecting MME, S-GW and P-GW via DNS S-NAPTR (3GPP TS 29.303)
  • MME Pool architecture (S1-flex, MMEGI and MMEC)
  • PDN Connection and IPv4 address allocation
  • IPv6 in LTE (PDN type IPv4v6, /64 prefix allocation, Router Advertisement) and an identity trace decoding practicum
05

EPS Bearers and QoS

  • the end-to-end EPS Bearer concept (Radio + S1 + S5/S8 bearers)
  • Default vs Dedicated Bearers
  • the standardized QCI table (GBR and non-GBR classes, delay and loss budgets)
  • Allocation and Retention Priority (ARP)
  • APN-AMBR and UE-AMBR rate limits
  • Traffic Flow Templates (TFT) and packet filters
  • mapping QCI to transport-layer DSCP markings
  • APN subscription profiles in the HSS and a bearer design practicum
06

LTE/EPC signaling procedures

  • overview of the 6 phases of Initial Attach
  • Phase 1 (RRC Connection and Attach Request)
  • Phase 2 (identification and mutual authentication via AIR/AIA and EPS-AKA)
  • Phase 3 (NAS Security Mode Command)
  • Phase 4 (location update ULR/ULA over S6a)
  • Phase 5 (Create Session Request/Response over S11 and S5/S8)
  • Phase 6 (Initial Context Setup, RRC Reconfiguration, Attach Complete and Modify Bearer)
  • UE-requested additional PDN connectivity
  • Detach initiated by UE
  • MME or HSS, EMM and ECM state machines
  • S1 Release and transition to ECM-IDLE
  • Service Request and Paging
  • Tracking Area Update (TAU)
  • X2-based and S1-based handovers
  • Dedicated Bearer activation and a call-flow trace practicum
07

EPC laboratory with Open5GS and srsRAN

  • testbed architecture (Open5GS EPC + srsRAN 4G in ZMQ virtual radio mode)
  • bringing up the EPC, eNodeB and UE containers
  • provisioning a subscriber in the HSS (IMSI, secret key K, OPc, APN, QoS profile)
  • capturing a full Attach flow (S1AP, NAS, GTPv2-C, Diameter) in Wireshark
  • inspecting cleartext NAS with EEA0 ciphering
  • verifying UE user-plane traffic inside GTP-U tunnels
  • establishing a second PDN connection to a separate APN
  • modifying AMBR and QCI dynamically
  • dissecting Diameter S6a exchanges
  • testing GTP Echo path failure when stopping the S-GW
  • diagnosing and fixing GTP tunnel MTU blackholes
  • and reproducing Attach Reject scenarios (wrong K, unknown IMSI, unsubscribed APN)
08

Policy and Charging Control (PCC)

  • PCC architecture (PCRF, PCEF, AF, OCS online charging and OFCS offline charging)
  • predefined vs dynamic PCC rules
  • commercial policy use cases (Fair Usage tiering, Zero-Rating, bandwidth throttling)
  • online charging over Diameter Gy
  • quota management (CCR-Initial/Update/Termination and Final Unit Indication FUI)
  • offline charging over Gz/Rf (S-GW/P-GW CDR generation and CGF)
  • a hands-on Open5GS PCRF rule lab and a tariff design practicum
09

Pre-VoLTE voice, inter-RAT mobility and roaming

  • Circuit Switched Fallback (CSFB) architecture (the SGs interface between MME and MSC/VLR)
  • end-to-end MO and MT voice call flows via CSFB
  • SMS over SGs without leaving LTE radio
  • inter-RAT mobility (LTE ↔ 3G UMTS / 2G GSM handovers and reselection)
  • LTE international roaming architecture (S8 Home Routed vs Local Breakout) and inter-carrier IPX transport
  • Diameter Edge Agents (DEA) and S6a roaming
10

EPC evolution

Control and User Plane Separation (CUPS) in the EPC (SGW-C/SGW-U and PGW-C/PGW-U split, PFCP over the Sx interface) and Cellular IoT in the EPC (NB-IoT and LTE-M / Cat-M1, Data over NAS, PSM and eDRX power saving)

11

Huawei practice and network operations

  • core MME configuration objects on Huawei USN9810
  • configuring APNs and IP address pools on Huawei UGW9811
  • handling alarms and subscriber signaling traces in Huawei EPC
  • Wireshark display filters for LTE/EPC (s1ap, nas-eps, gtpv2, diameter and NAS decryption)
  • comprehensive reference to EMM and ESM Cause Codes
  • and calculating key LTE/EPC KPIs (Attach Success Rate, E-RAB Setup SR, Drop Rate and Throughput)
12

Problems, solutions and final project

  • 31 real-world outage investigations (Attach Reject #3 Illegal UE, #7 EPS services not allowed, #8, #11 PLMN not allowed, #12 Tracking area not allowed, #13 Roaming not allowed in this TA, #15 No suitable cells, #19 ESM failure, #22 Congestion and #111 Protocol error; ESM rejects #26 Insufficient resources, #27 Missing or unknown APN and #33 Service option not subscribed; EPS-AKA Synch failure on SQN/AUTS desynchronization and MAC failure on mismatched K/OPc; S1 Setup Failure and SCTP association down; Diameter peer down on CER/CEA and S6a errors 5001 User Unknown and 5420 Unknown EPS Subscription; Create Session Reject, GTP path failure mass drops, P-GW IP pool exhaustion, websites stalling due to GTP tunnel MTU, DNS APN resolution failure, Dedicated Bearer creation failure on TFT/QCI/ARP mismatch, X2 handover failure at Path Switch, roaming TAU reject, CSFB call failure when SGs is down, paging no-response, and low throughput due to AMBR/QCI/radio)
  • systematic EPC troubleshooting workflow and the end-to-end capstone project from handset power-on to loading the first web page
How do we teach?

Learning stages

01

Webinar

Students join the lesson live. At the end of each lesson, students are sent a video recording of the class.

02

Homework

Every assignment is based on the topic covered in the webinar. Homework helps you reinforce the material and understand it better.

03

Working with a mentor

The teacher stays in touch with the group both during the course and outside class. Any questions get answered right away.

04

Portfolio

During the course you'll complete several projects on different topics — they'll show employers what you can do.

Self-paced learning

The full curriculum in your personal account

141 topics with theory, examples and practice. The first 4 are free, the rest come with a subscription. Interactive lessons with slides and coding trainers: 140.

Start for free Subscription from 30 AZN a month
Section 1. Introduction to LTE and EPS6 topics
  1. Why LTE Was Created: Throughput, Latency, and Cost Requirements
  2. LTE, LTE-Advanced, LTE-Advanced Pro, and IMT-Advanced Evolution
  3. EPS Overview: E-UTRAN + EPC, All-IP Core, and No CS Domain
  4. EPC Core Nodes: MME, S-GW, P-GW, HSS, and PCRF
  5. EPC Reference Points: S1-MME, S1-U, S11, S5/S8, S6a, Gx, SGi, X2, S10, S13, SGs
  6. Huawei EPC Products: USN9810, UGW9811, UPCC, and Converged UNC/UDG Core
Section 2. LTE Radio Interface (E-UTRA)13 topics
  1. OFDM Principles: Subcarriers, Orthogonality, and Cyclic Prefix (CP)
  2. OFDMA in Downlink and SC-FDMA in Uplink: Solving the PAPR Problem
  3. LTE Frame Structure: 10 ms Frame, 1 ms Subframe, and Slot (FDD and TDD)
  4. Resource Grid: Resource Element (RE) and Resource Block (RB = 12 × 15 kHz)
  5. LTE Channel Bandwidths (1.4–20 MHz) and Frequency Bands (Band 1, 3, 7, 8, 20, 38)
  6. Physical Channels and Reference Signals: PDSCH, PDCCH, PUSCH, PUCCH, PBCH, PRACH, RS
  7. MIMO: Transmit Diversity and Spatial Multiplexing
  8. Carrier Aggregation: PCell, SCell, and Band Combinations
  9. Cell Search (PSS/SSS, MIB/SIB) and Random Access Procedure (RACH)
  10. eNodeB Basic Parameters: PLMN, TAC, Cell ID, PCI, EARFCN, and Power
  11. Cell Reselection in Idle and Measurements in Connected (RSRP, RSRQ, SINR, Events A1–A5)
  12. Discontinuous Reception (DRX): Battery Saving in Idle and Connected Modes
  13. Practicum: Calculating Radio Resources, Bandwidths, and Cell Parameters
Section 3. LTE and EPC Protocol Stack20 topics
  1. Control Plane Protocol Stack: UE — eNodeB — MME
  2. User Plane Protocol Stack: UE — eNodeB — S-GW — P-GW
  3. RRC Protocol: RRC_IDLE and RRC_CONNECTED States, SRB0/SRB1/SRB2, and Core Messages
  4. RRC Connection Reconfiguration and Measurement Report Messages
  5. PDCP (ROHC Compression, Ciphering), RLC (TM, UM, AM Modes), and MAC (Scheduler and HARQ)
  6. NAS Protocol: EMM (Mobility and Security) and ESM (Bearers and PDN Sessions)
  7. S1AP Protocol: Elementary Procedures and eNB-UE-S1AP-ID / MME-UE-S1AP-ID Identifiers
  8. S1 Setup Procedure: Connecting an eNodeB to the MME
  9. X2AP Protocol: Direct Signaling Between Neighboring eNodeB Base Stations
  10. SCTP in LTE Networks: Multi-Streaming and Multi-Homing for S1-MME, X2, and Diameter
  11. GTPv2-C Protocol: Control Plane Tunnel Signaling on S11, S5/S8, and S10
  12. GTP-U Protocol and TEID: User Plane Packet Tunneling
  13. GTP Path Management: Echo Request / Response and Recovery Counter
  14. GTP Tunnel MTU Calculation, IP Fragmentation, and TCP MSS Clamping
  15. Diameter Base Protocol (RFC 6733): Nodes, CER/CEA, DWR/DWA, and AVP Structure
  16. Diameter Routing: Origin-Host, Origin-Realm, Destination-Realm, and Peer/Realm Tables
  17. Diameter Result Codes: Result-Code and Experimental-Result-Code (2xxx, 3xxx, 4xxx, 5xxx)
  18. Diameter Agents: Relay, Proxy, Redirect, Translation, and DRA / DEA Architecture
  19. S6a Interface (TS 29.272): AIR/AIA, ULR/ULA, CLR/CLA, IDR/IDA, and PUR/PUA Exchanges
  20. Gx and Gy Interfaces: CCR/CCA (Initial, Update, Termination), RAR/RAA, and Online Charging
Section 4. Identifiers, DNS, and Node Selection8 topics
  1. Subscriber Identifiers: IMSI, GUTI, GUMMEI, S-TMSI, and M-TMSI Structure
  2. Location and Cell Identifiers: TAI, TAC, TAI List, eNB ID, and ECGI
  3. Access Point Name (APN): Network Identifier and Operator Identifier Structure
  4. Selecting MME, S-GW, and P-GW via DNS (S-NAPTR, 3GPP TS 29.303)
  5. MME Pool and S1-flex Architecture: MMEGI, MMEC, and Load Balancing
  6. PDN Connection, Subscriber IP Allocation, and Protocol Configuration Options (PCO)
  7. IPv6 in LTE Networks: PDN Type IPv4v6, /64 Prefix Allocation, Router Advertisement, and 464XLAT
  8. Practicum: Decoding LTE Identifiers and DNS Queries from a Signaling Trace
Section 5. EPS Bearers and QoS Architecture8 topics
  1. EPS Bearer Concept: End-to-End Virtual Pipe (Radio Bearer + S1 Bearer + S5/S8 Bearer)
  2. Default vs. Dedicated EPS Bearers: Differences, IP Binding, and Lifecycle
  3. QCI (QoS Class Identifier) Table: GBR and Non-GBR Classes (QCI 1–9)
  4. ARP (Allocation and Retention Priority) and Rate Limits: GBR/MBR, APN-AMBR, and UE-AMBR
  5. Traffic Flow Template (TFT) and Packet Filters: Uplink and Downlink Classification
  6. Mapping QCI Classes to DSCP and 802.1p (CoS) Markings in the Transport Network
  7. APN Subscription Profile in the HSS: Default APN, Context-Identifier, Subscribed-QoS, and AMBR
  8. Practicum: Designing EPS Bearer, QCI, ARP, AMBR, and TFT Profiles for Real Services
Section 6. LTE and EPC Signaling Procedures18 topics
  1. Initial Attach Procedure: End-to-End Overview of the Six Phases (TS 23.401)
  2. Attach — Phase 1: RRC Connection Setup and S1AP Initial UE Message (Attach Request + PDN Connectivity)
  3. Attach — Phase 2: Subscriber Identification and EPS-AKA Mutual Authentication (AIR/AIA, RAND, AUTN, RES, KASME)
  4. Attach — Phase 3: NAS Security Mode Activation, Key Hierarchy from KASME, and ESM Information Exchange
  5. Attach — Phase 4: Location Registration in the HSS (S6a ULR/ULA, CLR/CLA) and Subscription Profile Download
  6. Attach — Phase 5: Create Session Request/Response on S11 and S5/S8 and Gx CCR-Initial Policy Exchange
  7. Attach — Phase 6: Initial Context Setup, RRC Reconfiguration, Attach Complete, and S1-U Closure via Modify Bearer
  8. Additional PDN Connection by UE Request (UE-Requested PDN Connectivity, e.g., IMS APN)
  9. Detach Procedure: UE-Initiated, MME-Initiated, and HSS-Initiated Session Teardown
  10. EMM (EMM-DEREGISTERED / EMM-REGISTERED) and ECM (ECM-IDLE / ECM-CONNECTED) State Machines
  11. S1 Release Procedure: User Inactivity Timer, Transition to ECM-IDLE, and S-GW Buffering
  12. UE-Triggered Service Request: Rapid Wake-Up from Idle and S1-U Tunnel Restoration (< 100 ms)
  13. Paging in LTE (Network-Triggered Service Request): S-GW Buffering, Downlink Data Notification (DDN), and TAI List Paging
  14. Tracking Area Update (TAU): Intra-MME and Inter-MME/S-GW Mobility and GUTI Reallocation
  15. X2-Based Handover: Preparation, Execution, X2-U Data Forwarding, and S1AP Path Switch
  16. S1-Based Handover: Handover Without X2 or With MME/S-GW Relocation over S10
  17. Dedicated EPS Bearer Activation: From IMS Call Setup (Rx/Gx) to Create Bearer Request (QCI 1)
  18. Practicum: Reconstructing an End-to-End LTE Procedure from S1AP, NAS, GTPv2-C, and Diameter Traces
Section 7. EPC Hands-On Laboratory (Open5GS + srsRAN + Wireshark)13 topics
  1. Track testbeds: how they work, how to start them, where to capture container traffic
  2. Open5GS and srsRAN 4G (ZMQ Mode): Lab Testbed Architecture and Capabilities
  3. Installing Open5GS and WebUI, Structure of /etc/open5gs/*.yaml
  4. Configuring PLMN, TAC, GUTI, S1-MME/S1-U/S11/S5 Addresses, and the ogstun Pool in Open5GS
  5. Provisioning a Subscriber in the HSS: IMSI, K, OPc, APN, QCI, and AMBR
  6. Running a Virtual eNodeB and UE Without Radio Hardware (ZeroMQ)
  7. Lab: Verifying S1 Setup and SCTP Association in Wireshark
  8. Lab: Live UE Registration (Initial Attach) and Step-by-Step PCAP Analysis
  9. Lab: Pinging from the UE Through ogstun and Inspecting GTP-U Encapsulation
  10. Lab: Transitioning the UE to Idle, Sending Downlink Traffic, and Observing DDN + Paging
  11. Lab: Creating a PCRF Rule and Activating a Dedicated Bearer over Gx
  12. Lab: Triggering a Cell Change on the Testbed and Analyzing X2/S1 Handover in PCAP
  13. Practicum: Deliberately Breaking OPc, TAC, and APN and Diagnosing Reject Codes
Section 8. Policy, Charging, and DPI (PCC)8 topics
  1. PCC Architecture (3GPP TS 23.203): PCRF, PCEF (in P-GW), TDF, SPR, OCS, and OFCS
  2. PCC Rules: Static and Dynamic Rules, Precedence, and QCI/ARP Binding
  3. Gx Scenarios: Speed Throttling, Tariff Switching, and VoLTE Triggered by P-CSCF (Rx → Gx)
  4. Prepaid Online Charging on Gy: Quota Reservation (USU/GSU/RSU) and FUI (Redirect / Terminate)
  5. Offline Charging and CDR Generation (SGW-CDR, PGW-CDR) over Rf and Gz
  6. Rating Groups, Service IDs, Sponsored Data, and Zero-Rating
  7. Deep Packet Inspection (DPI) on P-GW / TDF: Sd and Gx Interfaces and Application Detection
  8. Practicum: End-to-End Walkthrough of a Subscriber Session with Gx Policies and Gy Quotas
Section 9. Voice in LTE (Pre-IMS), Roaming, and 2G/3G Interworking6 topics
  1. CSFB: SGs Interface (MME–MSC/VLR), Combined Attach, Fallback to 2G/3G, and Fast Return
  2. SMS over SGs: Sending and Receiving SMS Without Leaving LTE
  3. Fallback to 3G/2G When Losing LTE Coverage: Inter-RAT Mobility and S3/S4 vs. Gn/Gp Interfaces
  4. LTE Roaming Architecture: Home Routed (S8HR) vs. Local Breakout (LBO)
  5. IPX and GRX Networks, Roaming DNS (.3gppnetwork.org), and Diameter Edge Agents (DEA)
  6. Practicum: Analyzing CSFB Call Flows and S8 Home-Routed Roaming Attach Traces
Section 10. EPC Evolution: CUPS, NB-IoT, and LTE-M2 topics
  1. CUPS in EPC (3GPP Rel-14): SGW-C/U and PGW-C/U Split, Sxa/Sxb Interfaces, and PFCP Protocol
  2. NB-IoT and LTE-M in the EPC: 180 kHz Radio, CIoT Optimizations (Data over NAS, S11-U), PSM, and eDRX
Section 11. Huawei EPC Practice and Network Operations (O&M, Wireshark, KPIs)6 topics
  1. Huawei USN9810 (MME): Core MML Configuration Objects (PLMN, GUMMEI, S1-MME, S6a, S11, and DNS)
  2. Huawei UGW9811 (S-GW/P-GW): Configuring APNs, Subscriber IP Pools, and S1-U/S5/Gx/Gy Interfaces
  3. Huawei EPC Operations: Alarms, IMSI/GUTI Subscriber Signaling Traces, and CHR Logs
  4. LTE/EPC Analysis in Wireshark: Professional Filters for s1ap, nas-eps, gtpv2, gtp, diameter, and Decryption
  5. EMM and ESM Cause Codes (3GPP TS 24.301): Classification, Meaning, and UE Retry Behavior
  6. LTE and EPC Key Performance Indicators (KPIs): Attach SR, E-RAB Setup SR, Drop Rate, Latency, and Throughput
Section 12. Troubleshooting Cases and Capstone Project33 topics
  1. Case Study: Attach Reject with EMM Cause #3 Illegal UE
  2. Case Study: Attach Reject with EMM Cause #7 EPS Services Not Allowed
  3. Case Study: Attach Reject with EMM Cause #8 EPS and Non-EPS Services Not Allowed
  4. Case Study: Attach Reject with EMM Cause #11 PLMN Not Allowed
  5. Case Study: Attach or TAU Reject with EMM Cause #12 Tracking Area Not Allowed
  6. Case Study: Attach or TAU Reject with EMM Cause #13 Roaming Not Allowed in This Tracking Area
  7. Case Study: Attach or TAU Reject with EMM Cause #15 No Suitable Cells in Tracking Area
  8. Case Study: Attach Reject with EMM Cause #19 ESM Failure (Default Bearer Creation Failure)
  9. Case Study: Mass Rejections with EMM Cause #22 Congestion and Back-Off Timer T3346
  10. Case Study: Attach Reject with EMM Cause #111 Protocol Error, Unspecified
  11. Case Study: Session Creation Failure with ESM Cause #27 Missing or Unknown APN
  12. Case Study: Session Reject with ESM Cause #33 Requested Service Option Not Subscribed
  13. Case Study: Session Reject with ESM Cause #26 Insufficient Resources
  14. Case Study: EPS-AKA Synch Failure (EMM Cause #21): SQN Desynchronization and AUTS Resynchronization
  15. Case Study: EPS-AKA MAC Failure (EMM Cause #20): Key K or OPc Mismatch Between USIM and HSS
  16. Case Study: New eNodeB Fails to Come Online — S1 Setup Failure Due to PLMN or TAC Mismatch
  17. Case Study: S1-MME SCTP Association Fails to Establish Between eNodeB and MME
  18. Case Study: Diameter Peer Down — CER/CEA Handshake Failure Between MME/P-GW and HSS/PCRF/DRA
  19. Case Study: Diameter 5001 (DIAMETER_ERROR_USER_UNKNOWN) on S6a AIR/ULR
  20. Case Study: Diameter 5420 (DIAMETER_ERROR_UNKNOWN_EPS_SUBSCRIPTION) During LTE Registration
  21. Case Study: GTPv2-C Create Session Request Rejected on S11 and S5/S8
  22. Case Study: GTP Path Failure — Missed Echo Responses and Mass Subscriber Session Drops
  23. Case Study: Subscriber IP Pool Exhaustion on the P-GW
  24. Case Study: Ping Works, But HTTPS Websites Stall — GTP-U Tunnel MTU and TCP MSS Blackhole
  25. Case Study: MME Fails to Select S-GW or P-GW via DNS (S-NAPTR Resolution Errors)
  26. Case Study: Dedicated Bearer (QCI 1) Creation Fails: TFT, QCI, ARP, or Radio Admission Rejection
  27. Case Study: X2 Handover Failures and S1AP Path Switch Request Rejections
  28. Case Study: Inter-Region Mobility Drop — Inter-MME TAU Failure Due to S10 or DNS Misconfiguration
  29. Case Study: Voice Calls Fail over CSFB — SGs Interface Outage and TA-to-LA Misalignment
  30. Case Study: Idle Subscriber Does Not Respond to Paging (Paging No Response)
  31. Case Study: Low Data Throughput in LTE — Step-by-Step Isolation Across Radio, Transport, and EPC
  32. General Engineering Methodology for Troubleshooting LTE and EPC Networks
  33. Capstone Project: From Powering On the Phone to Loading the First Web Page — Full E-UTRAN + EPC Walkthrough

Group and individual classes include a teacher, homework review and a certificate. The subscription gives you materials, exercises and progress tracking at your own pace, without teacher feedback.

LTE/4G and the EPC Core: how to enroll

Fill in the form and we will tell you the start date of the next group, the schedule and payment terms. Or come to a free trial lesson first.

+994 77 333 38 36 Or message us on WhatsApp right away info@prowid.com

By submitting the form, you agree that your data will be used only to contact you.

WhatsApp