Roaming & IMS Engineering for 4G/5G: Hands-On Lab

Diameter, SS7, IMS voice, 4G and 5G roaming, SEPP, charging and TAP, read byte by byte in a live multi-network lab

What you’ll learn
Draw the 4G and 5G mobile network from memory and say which identity each network sees
Compute MILENAGE and the 4G/5G key hierarchy, and read a 4G attach and a 5G registration byte by byte
Decode Diameter and SS7/MAP messages and follow them through routing agents between operators
Follow IMS registration, a VoLTE or VoNR call and an SMS, with the policy and QoS behind them
Explain how a call survives a radio change: SRVCC, CS fallback, EPS fallback, emergency calls
Trace a roaming subscriber in 4G (S6a, GTP, home-routed vs local breakout) and in 5G (SEPP, N32, N16)
Follow a roaming call from a charging record to a TAP file, a RAP return and settlement
Troubleshoot any roaming failure by side, interface, message and cause code
Call CAMARA network APIs (SIM Swap, Number Verification, Quality on Demand) with the right OAuth flow

Requirements
Comfort with IP, HTTP and hexadecimal. No telecom background needed.
A computer with a browser and Wireshark (free; installing it is shown). Python 3 for the downloadable scripts.
Docker on Linux or WSL2, only for the optional section that runs an open-source core on your laptop.
Optional hands-on exercises use a free web lab (how to join is in the first lecture). It needs a free account (email or Google sign-in). Students of this course get 30 days of lab access with a personal code from the instructor, counted from the day you redeem it. The lab holds test data only. Every exercise is also shown in the videos.

Description
A phone works perfectly at home. Then it lands in another country, and it doesn’t. Behind that one ticket is a whole world: the home network, the visited network, and the messages that cross between them. Most engineers learn it one escalation at a time. This course teaches it in order, from zero, and lets you drive every step in a working lab.

You follow one subscriber, Alex, across four networks: Home, North, South and East.

You start with pictures only: the phone, the radio and the core, 4G and 5G on one page, and the many identities one person has (IMSI, MSISDN, GUTI, SUPI and SUCI). Then the bytes begin. You compute MILENAGE by hand, derive the 4G and 5G keys, and read a real attach and a real 5G registration.

Next come the signalling languages. Diameter covers peers, realms, routing agents and the applications of a mobile core. SS7 and MAP still carry roaming today. Then voice and messaging: IMS registration, a VoLTE call, VoNR and EPS fallback, SMS, policy and QoS, SRVCC, CS fallback and emergency calls.

The heart of the course is roaming. In 4G that means GTP, DNS, the IPX, the DEA, home-routed versus local breakout, and steering. In 5G it means NRF discovery across a border, tokens, the SEPP over N32, N16 home-routed sessions and slices abroad. You then follow the money (charging, CDRs, TAP, RAP, NRTRDE and fraud patterns) and look at IoT roaming. The course ends with a troubleshooting method, a cause-code atlas, and a capstone week abroad read end to end. You also call the network from outside, through CAMARA network APIs and the NEF, with the right OAuth flow for each. A last section covers today’s hot standards topics: the SCP, NWDAF, the IMS data channel and post-quantum work.

Every lesson follows the same arc: why it exists, the idea in one picture, the mechanism one layer at a time, a worked example from the lab, and what goes wrong. Every flow on screen is a real lab flow that you can download as a capture and open in Wireshark. Everything is based on public standards (3GPP, GSMA, ITU-T, IETF).

How this course was made. I designed and built the lab and ran every example in it. I wrote each script and checked it against the standards in three review passes. The lessons are narrated with a synthetic (text-to-speech) voice, and AI tools helped me draft and review the scripts and slides. The welcome and the wrap-up are in my own voice.

This course contains no promotional content.

Who this course is for
Engineers moving into roaming, IMS, core-network or signalling roles
Support and NOC engineers who read traces and want to know which network said no, and why
Software engineers building services that talk to a mobile core
Telecom professionals who know the boxes and want the bytes