Pith. sign in

REVIEW 3 major objections 5 minor 33 references

DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR

T0 review · 3 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A passive adversary who decodes only the broadcast 5G scheduling information can infer a victim's application-layer goodput and, by jamming just the victim's allocated resource blocks within the same 1 ms slot, reduce that goodput by 40–50%

desk verdict Solid offline inference and timing measurements, but the claimed closed-loop attack is open-loop and the SSB countermeasure math is wrong. read the letter →

arxiv 2607.16102 v1 pith:T2D5543V submitted 2026-07-17 cs.CR

Mahmudul Hassan Ashik , Moinul Hossain This is my paper · ORCID
classification cs.CR
keywords 5GNRdenialofservicequalityDCIsidechannelPDCCHtargetedjamminggoodputpredictioncross-layerattackSSBhopping
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

5G base stations broadcast their per-slot scheduling decisions — which device gets which physical resource blocks, with what modulation — over an unencrypted control channel. DoSQ's central claim is that this broadcast is a usable side channel into the application layer: per-slot DCI features alone allow a classifier to estimate a victim's goodput state and trend. An adversary who decodes DCI in real time can then inject interference only on the victim's assigned resource blocks within the same 1 ms slot; on the paper's private testbed, this reduced a YouTube Live victim's goodput by 40–50% at slot-level hit rates of 2–10%, while a co-located non-target UE stayed near baseline. The paper further proposes a synchronization-signal hopping defense that raises the attacker's re-synchronization cost by roughly seven orders of magnitude.

What carries the argument

The central object is the per-slot Downlink Control Information (DCI) decoded from the Physical Downlink Control Channel (PDCCH). DCI announces, without encryption, each scheduled UE's radio identifier, resource-block allocation, symbol range, and modulation-and-coding scheme — exactly the information needed to target interference. The action side is a decode-to-transmit pipeline whose four measured stages (DCI decode, inter-process notification, waveform synthesis, timed radio transmission) must close within the 1 ms slot; the paper reports a p99 total of 383.4 µs, leaving about eight of fourteen OFDM symbols jammable. The inference side is a two-headed tree-ensemble classifier that maps pe

What would settle it

Run the same decode-to-jam pipeline against a gNB that schedules PDSCH to start at the second or third OFDM symbol, and measure whether the jamming waveform arrives in time and whether the victim's goodput drops by the claimed 40–50% at 2–10% hit rates. If the measured pipeline latency exceeds the available window, or the goodput drop does not materialize, the central claim collapses.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the broadcast control plane is a quantitative cross-layer side channel. After passively decoding the system information and per-slot DCI, the adversary recovers the victim's radio identifier and extracts its assigned PRBs, symbol ranges, and modulation scheme. A two-headed gradient-boosted classifier, trained only on per-second DCI statistics (PRB counts, MCS values, scheduling rate, symbol counts), estimates the victim's application-layer goodput state and trend; the classifier reaches 0.87 precision at the top 1% of attack-now confidence, a 4.21x lift over the base rate. The same DCI decode drives a four-stage pipeline that synthesizes an OFDM interfer

Load-bearing premise

The attack's 40–50% goodput reduction depends on the measured decode-to-transmit pipeline (p99 383.4 µs) completing early enough within a 1 ms slot in real deployments; if PDSCH starts before the jammable symbols, or if blind DCI decoding slows under load, the window closes.

Editorial extensions

If this is right

  • Because DCI is broadcast in the clear, any passive receiver in coverage — no network access, no UE compromise — can build the same per-slot resource map and run the same attack.
  • The classifier's inputs are application-agnostic DCI statistics; the only application-specific parameter is the goodput threshold, so the inference channel should transfer to other latency-sensitive services, not just streaming.
  • Sparse firing at 2–10% slot-level hit rates keeps radiated energy low and confines damage to the victim, making the attack harder to spot by spectrum monitoring than wideband jamming.
  • The same-slot timing budget is empirically demonstrated on commodity SDR hardware, showing the attack is implementable without specialized military radio equipment.
  • The proposed SSB time-frequency hopping defense raises the attacker's re-synchronization time from milliseconds to roughly 10^5 seconds, but currently requires a UE firmware change that commercial basebands do not yet implement.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The authors assert but do not measure that URLLC-class services would be more exposed; the testable extension is whether one or two corrupted slots can violate a closed-loop control deadline, since such services lack the playback buffer that absorbed this attack's early effect.
  • The same DCI stream that leaks the victim's state could also feed a detector: a network operator could watch whether broadcast grants are being followed by same-slot interference, turning the attack signature into an intrusion-detection feature.
  • The SSB hopping defense assumes a pessimistic per-trial correlation budget; faster correlation or multi-antenna search could erode the claimed seven-orders-of-magnitude increase, so the defense's strength partly depends on attacker hardware assumptions.
  • If the goodput-side channel generalizes, combining DCI scheduling features with radio-layer retransmission timing could expose even finer application behavior, a direction the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes DoSQ, a 5G NR attack combining a passive PDCCH sniffer that decodes per-slot DCI with a same-slot PDSCH jammer, and an ML classifier that infers the victim UE's application-layer goodput state and trend from DCI features alone. The attack is evaluated on a private srsRAN/Open5GS testbed with USRP B210 SDRs against a YouTube Live victim and a co-located non-target UE. The paper reports 40–50% goodput reduction at slot-level hit-rates H=2–10%, classifier precision 0.87 at the top 1% of attack-now confidence (4.21× lift over the base rate), and an SSB frequency-time-hopping countermeasure that increases attacker resynchronization cost to roughly 10^5 seconds. The claimed contribution is the first empirical demonstration of a radio-to-application side channel that a protocol-aware adversary can exploit.

Significance. If the full chain were demonstrated, the paper would be a valuable contribution: it identifies a plausible cross-layer side channel from broadcast DCI to application goodput, and it provides a careful offline classifier evaluation with LOBO/LORO protocols, fixed label thresholds, confusion matrices, and transparent precision-at-k reporting that goes beyond aggregate F1. The per-stage timing instrumentation (N=3,933 slots) is also a useful datapoint for same-slot reactive jamming feasibility on commodity SDRs. However, the headline end-to-end claim—that DCI-based inference enables the low-energy goodput degradation—is not actually supported by the closed-loop experiment as reported. Section V-E2 manually sweeps H and never connects classifier outputs to jamming decisions. As presented, the paper contains two largely independent results: an offline classifier and an open-loop low-rate jammer. The significance of the paper therefore hinges on whether the authors can close that loop experimentally.

major comments (3)
  1. [§V-E2, Fig. 6] The 'Closed-Loop Targeted Jamming' experiment is not closed-loop. The text states 'we drive the jammer at the three hit-rates H∈{2,5,10}%' and provides no description of classifier outputs triggering jamming. The sentence claiming the time-averaged slot-level hit-rate equals the top-k fraction is a theoretical equivalence, not a measured result. Consequently, the observed 40–50% goodput reduction is an open-loop low-rate PRB-confined jamming result; it does not demonstrate that the DCI side-channel inference is load-bearing. The authors should run a classifier-driven policy (e.g., fire only on the top-k% high-confidence attack-now windows) and compare its goodput reduction and energy use against a random low-rate jammer at the same average slot hit-rate.
  2. [§V-E2, Table II] The jamming results appear to come from a single session with no repeated trials or confidence intervals; Fig. 6 shows one representative per-second goodput trace. The 40–50% range and the non-target-UE claim need statistical support across multiple independent runs. In addition, the timing budget is measured on one commodity SDR setup (p99 T_total=383.4 µs). Since this leaves only the last ~8 OFDM symbols jammable, the attack's efficacy depends on PDSCH allocations starting late enough; the paper should report sensitivity to SLIV-derived symbol start positions, scheduler loads, and DCI decode delays.
  3. [§V-D, §V-E2] The mapping from classifier top-k precision to achieved slot-level hit-rate H is not validated. The paper assumes one inference window per second and that 'the jammer engages fully within each fired window,' but it does not measure how many slots within a high-confidence window are actually jammed, nor how many attack-now windows are missed. Without this measurement, the precision@k numbers in Fig. 5 cannot be translated into the H values used in Fig. 6, and the energy-minimality claim for the closed-loop controller remains unsubstantiated.
minor comments (5)
  1. [Fig. 4a/4b] The two confusion-matrix subfigures appear to show the same State and Trend matrices; the captions and layout are confusing. Please ensure each panel is unique and clearly labeled with the protocol (LOBO vs. LORO).
  2. [§V-A] The dataset description says 'more than two hours' but gives no exact duration, number of sessions, or breakdown per regime. Providing exact counts and per-batch statistics would improve reproducibility.
  3. [§IV-B] The feature list, XGBoost hyperparameters, and model-selection procedure are not fully specified. Please include the exact feature set, hyperparameter ranges, and train/validation split used for early stopping.
  4. [§VI-B] The countermeasure section admits that current COTS UE firmware caches k_SSB and fails to re-decode the MIB after the SSB hops. This is an implementation gap, not a 3GPP violation, but the paper should state clearly that the countermeasure is not validated end-to-end and is currently a proposal requiring UE-side firmware changes.
  5. [§V-E1] The sentence about 'the safest starting OFDM symbol to jam is from the sixth' assumes the PDSCH allocation begins at symbol 0. Please state this assumption explicitly and discuss how an allocation starting earlier would reduce the number of jammable symbols.

Circularity Check

0 steps flagged · score 0.0 of 10

No constructional circularity; the central inference claim is empirical and held-out, and the open-loop jammer sweep is a support gap rather than a circular reduction.

full rationale

This paper's derivation chain is not circular. The cross-layer inference claim is an empirical supervised-learning result: DCI-derived features are used to predict Goodput-state/trend labels that come from independently scraped Stats-for-Nerds ground truth, and the classifiers are evaluated under held-out LOBO and LORO protocols against random and majority baselines, so the reported F1 and precision-at-k values are not equal to the training fit by construction. The 40-50% goodput-reduction figure is a separate open-loop measurement at manually set hit-rates H in {2,5,10}%, not a fitted parameter renamed as a prediction; this is a causal-support gap (the classifier's top-k outputs are not actually wired to the jammer in Section V-E2) rather than a self-definitional or fitted-input circularity. The SSB-hopping countermeasure cost (~10^5 s) is arithmetic from 3GPP K and L parameters and an explicitly stated 10 ms trial budget, not an input recycled as a result. No self-citation bears load; all cited frameworks and prior results are external. Hence no circular step meeting the quote-and-reduction standard exists.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central attack rests on 3GPP public control-channel assumptions, the ground-truth reliability of the Stats for Nerds overlay, and the transferability of timing measurements from a USRP testbed to real deployments. The classifier has no free parameters fitted to predict the headline result, but the label thresholds, hit-rate choices, and countermeasure cost parameters are hand-selected. No new physical entities are postulated.

free parameters (5)
  • Goodput State thresholds = 3.5 and 7 Mbps
    Hand-picked bin edges for State labels; the authors say fixed before training, but they define the classification target and therefore the achievable F1 and top-k precision.
  • Evaluation hit-rates H = 2%, 5%, 10%
    Chosen operating points for the closed-loop verification; they map to top-k fractions but are not derived from the classifier.
  • SSB hopping search budget = 10 ms per correlation trial
    Assumed optimistic per-trial correlation cost used to derive the 10^5 s re-synchronization estimate; no measurement supports this figure.
  • Coherent combining coherence assumption = 5 ms half-frame
    Claimed channel coherence over the half-frame yields 9 dB gain; standard for pedestrian UEs but not empirically verified in this testbed.
  • XGBoost hyperparameters = not disclosed
    The model's performance depends on hyperparameters, which are not reported; chosen during development on the same dataset.
assumptions (5)
  • domain assumption PDCCH/DCI is broadcast without authentication or encryption and can be blind-decoded by any receiver in coverage
    3GPP standard fact cited with [25]; required for the passive sniffer stage.
  • domain assumption Stats for Nerds per-second Goodput is accurate ground truth
    Used as labels; no validation against an independent measurement is provided.
  • ad hoc to paper YouTube Live's ABR is representative of latency-sensitive apps and DoSQ generalizes to URLLC/V2X
    Stated in the motivation without supporting measurement; used to elevate practical significance.
  • domain assumption The measured timing budget on the USRP testbed transfers to real deployments
    The same-slot jamming claim depends on T_total p99 = 383.4 µs on commodity SDRs; real base stations with different scheduling/PHY may differ.
  • standard math Channel coherence across 5 ms half-frame for coherent SSB combining
    Standard assumption for low mobility at sub-1 GHz; used in Eq. (2) for the countermeasure gain.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR." pith.science (2026). https://pith.science/paper/T2D5543V

@misc{pith2026260716102,
  author       = {Pith},
  title        = {Pith review of: DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T2D5543V}},
  note         = {Machine review of arXiv:2607.16102}
}
read the original abstract

The 3rd Generation Partnership Project (3GPP)'s Fifth Generation New Radio (5G NR) is critical to supporting mission-critical services. However, 5G systems are vulnerable to smart jamming attacks that can propagate to applications running on top of these networks (i.e., cross-layer). The 5G gNB broadcasts resource scheduling information for the legitimate UEs over the air interface, with a prevailing assumption that this surface alone reveals nothing useful about a user device. However, we show that using the Downlink Control Information (DCI) is sufficient to degrade Application layer service quality, i.e., Denial of Service Quality (DoSQ), by inferring the Application layer Goodput (i.e., via side-channel analysis). Therefore, we present DoSQ, a protocol-aware attack that decodes per-slot DCI to inject interference onto the victim UE's Physical Resource Blocks (PRBs) within the same 1 ms slot, while a cross-layer classifier estimates the victim's Goodput state and trend from DCI features alone, without observing a single encrypted byte. Evaluated on a private 5G NR testbed against YouTube Live, DoSQ drives the target's Goodput down by up to 50% at sparse hit-rates, while a co-located non-target UE remains largely unaffected. Moreover, the classifier achieves a precision of 0.87 at the top 1% of attack-now confidence, a 4.21 times lift over the base rate. Furthermore, we propose an SSB frequency-time-hopping countermeasure that increases the attacker's resynchronization cost. The result is the first empirical measurement of a radio-to-application side channel that any protocol-aware adversary can exploit.

Figures

Figures reproduced from arXiv: 2607.16102 by the authors.

Figure 1
Figure 1. DoSQ architecture. The victim’s C-RNTI is isolated from the pool of active C￾RNTIs by correlating PDCCH observations with the Radio Resource Control (RRC) attach procedure, which is itself passively observable via the same pipeline [8]. Once these steps are complete, the jammer holds a full per-slot resource map scheduled for the victim, without ever having transmitted. Stage 2: Active injection. Once the C-RNTI and… view at source ↗
Figure 2
Figure 2. Testbed implementation. with high confidence. The objective is the minimum H that drives the victim into the setpoint and keeps it there, rather than a fixed worst-case H applied continuously. Therefore, the viability of such a controller turns on how often the inference is correct precisely when the policy fires, which is a different question from how often it is correct on average. A critical property of this comp… view at source ↗
Figure 3
Figure 3. Goodput State (three-class) and Trend (binary) F1. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: shows the precision-at-k curve. The base rate of the joint setpoint cell is 0.207, meaning 20.7% of all inference windows are true at setpoint. At k = 1%, the classifier selects the 62 highest-confidence predictions, of which 54 are true positives, yielding precision 0…
Figure 6
Figure 6. Figure 6: Per-second Goodput of the victim and the co-located [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 3 linked inside Pith

  1. [8]

    Scalable and robust mobile activity fingerprint- ing via over-the-air control channel in 5g networks,

    G. Yoon and B. Hong, “Scalable and robust mobile activity fingerprint- ing via over-the-air control channel in 5g networks,”arXiv preprint arXiv:2409.12572, 2024

    arXiv 2024

  2. [9]

    Passive multi-user traffic analysis based on 5g nr/lte physical layer,

    H. Zhanget al., “Passive multi-user traffic analysis based on 5g nr/lte physical layer,”IEEE Transactions on Information Forensics and Security, 2025

    2025

  3. [1]

    5G wireless technology: A primer,

    K. G. Eze, M. N. Sadiku, and S. M. Musa, “5G wireless technology: A primer,”International Journal of Scientific Engineering and Technology, vol. 7, no. 7, pp. 62–64, 2018

    2018

  4. [2]

    5g is being used to perform remote surgery from thousands of miles away, and it could transform the healthcare industry,

    C. Frost, “5g is being used to perform remote surgery from thousands of miles away, and it could transform the healthcare industry,”Business Insider, 2019

    2019

  5. [3]

    Unprotected 4g/5g control procedures at low layers considered dangerous,

    N. Ludantet al., “Unprotected 4g/5g control procedures at low layers considered dangerous,”arXiv preprint arXiv:2403.06717, 2024

    arXiv 2024

  6. [4]

    Authentication at physical layer in 5g/6g systems,

    R. Zakrzewskiet al., “Authentication at physical layer in 5g/6g systems,” in2024 IEEE 35th International Symposium on Personal, Indoor and Mobile Radio Communications (PIMRC), pp. 1–7, IEEE, 2024

    2024

  7. [5]

    Mobile traffic classification through physical control channel fingerprinting: a deep learning approach,

    H. D. Trinhet al., “Mobile traffic classification through physical control channel fingerprinting: a deep learning approach,”IEEE Transactions on Network and Service Management, vol. 18, no. 2, pp. 1946–1961, 2020

    1946

  8. [6]

    From 5G sniffing to harvesting leakages of privacy- preserving messengers,

    N. Ludantet al., “From 5G sniffing to harvesting leakages of privacy- preserving messengers,” in2023 IEEE Symposium on Security and Privacy (SP), pp. 3146–3161, IEEE, 2023

    2023

Show all 33 references
  1. [7]

    Robust smartphone app identification via encrypted network traffic analysis,

    V . F. Tayloret al., “Robust smartphone app identification via encrypted network traffic analysis,”IEEE Transactions on Information Forensics and Security, vol. 13, no. 1, pp. 63–78, 2017

    2017

  2. [10]

    Smart prach jamming: A serious threat for 5g campus networks,

    J. R. Stegmannet al., “Smart prach jamming: A serious threat for 5g campus networks,”arXiv preprint arXiv:2410.08729, 2024

    2024 arXiv

  3. [11]

    Undercover disruption: Stealth jamming attacks on 5g synchronization stages,

    R. Alaimoet al., “Undercover disruption: Stealth jamming attacks on 5g synchronization stages,” inCEUR WORKSHOP PROCEEDINGS, vol. 3962, https://ceur-ws. org/V ol-3962/, 2025

    2025

  4. [12]

    Sigunder: A stealthy 5g low power attack and defenses,

    N. Ludant and G. Noubir, “Sigunder: A stealthy 5g low power attack and defenses,” inProceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, pp. 250–260, 2021

    2021

  5. [13]

    Breaking 5g on the lower layer,

    S. K. Shanto, I. Karim, and E. Bertino, “Breaking 5g on the lower layer,” arXiv preprint arXiv:2602.10250, 2026

    2026

  6. [14]

    Implementation and evaluation of a smart up- link jamming attack in a public 5g network,

    M. E. Floreset al., “Implementation and evaluation of a smart up- link jamming attack in a public 5g network,”IEEE Access, vol. 11, pp. 75993–76007, 2023

    2023

  7. [15]

    Smart jamming attacks in 5g new radio: A review,

    Y . Arjoune and S. Faruque, “Smart jamming attacks in 5g new radio: A review,” in2020 10th annual computing and communication workshop and conference (CCWC), pp. 1010–1015, IEEE, 2020

    2020

  8. [16]

    A variegated look at 5G in the wild: performance, power, and QoE implications,

    A. Narayananet al., “A variegated look at 5G in the wild: performance, power, and QoE implications,” inProceedings of the 2021 ACM SIG- COMM 2021 Conference, pp. 610–625, 2021

    2021

  9. [17]

    An experimental study of low-latency video streaming over 5G,

    I. Khan, T. X. Tran, M. Hiltunen, T. Karagioules, and D. Koutsonikolas, “An experimental study of low-latency video streaming over 5G,” in 2024 IEEE International Mediterranean Conference on Communications and Networking (MeditCom), pp. 383–388, IEEE, 2024

    2024

  10. [18]

    Dissecting the performance of YouTube video streaming in mobile networks,

    A. Schwindet al., “Dissecting the performance of YouTube video streaming in mobile networks,”International Journal of Network Man- agement, vol. 30, no. 3, p. e2058, 2020

    2020

  11. [19]

    A buffer-based approach to rate adaptation: Evidence from a large video streaming service,

    T.-Y . Huanget al., “A buffer-based approach to rate adaptation: Evidence from a large video streaming service,” inProceedings of the 2014 ACM conference on SIGCOMM, pp. 187–198, 2014

    2014

  12. [20]

    Learning in situ: a randomized experiment in video streaming,

    F. Y . Yanet al., “Learning in situ: a randomized experiment in video streaming,” in17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20), pp. 495–511, 2020

    2020

  13. [21]

    Youtube stats for nerds explained

    A. Spicer, “Youtube stats for nerds explained.” https://alanspicer.com/ youtube-stats-for-nerds-explained/, 2020

    2020

  14. [22]

    YTLive: A Dataset of Real-World YouTube Live Streaming Sessions,

    M. Mozhganfaret al., “YTLive: A Dataset of Real-World YouTube Live Streaming Sessions,”arXiv preprint arXiv:2510.24769, 2025

    2025

  15. [23]

    ReCLive: Real-time classification and QoE inference of live video streaming services,

    S. C. Madanapalliet al., “ReCLive: Real-time classification and QoE inference of live video streaming services,” in2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS), pp. 1–7, IEEE, 2021

    2021

  16. [24]

    Practical trial for low-energy effective jamming on private networks with 5g-nr and nb-iot radio interfaces,

    P. Skokowskiet al., “Practical trial for low-energy effective jamming on private networks with 5g-nr and nb-iot radio interfaces,”IEEE Access, 2024

    2024

  17. [25]

    NR; Radio Resource Control (RRC); Protocol specification,

    3GPP, “NR; Radio Resource Control (RRC); Protocol specification,” Technical Specification (TS) 3GPP TS 38.331 (ETSI TS 138 331), ETSI, July 2025. Release 18

    2025

  18. [26]

    Nr-scope: A practical 5g standalone telemetry tool,

    H. Wanet al., “Nr-scope: A practical 5g standalone telemetry tool,” inProceedings of the 20th International Conference on Emerging Networking EXperiments and Technologies, CoNEXT ’24, (New York, NY , USA), p. 73–80, Association for Computing Machinery, 2024

    2024

  19. [27]

    5G NR physical layer procedures for control (release 18),

    3rd Generation Partnership Project (3GPP), “5G NR physical layer procedures for control (release 18),” Tech. Rep. ETSI TS 138.213, 3GPP, 2025

    2025

  20. [28]

    5G NR physical layer procedures for data (release 18),

    3rd Generation Partnership Project (3GPP), “5G NR physical layer procedures for data (release 18),” Tech. Rep. ETSI TS 138.214, 3GPP, 2025

    2025

  21. [29]

    srsRAN Project: Open source O-RAN 5G CU and DU implementation

    srsRAN Project, “srsRAN Project: Open source O-RAN 5G CU and DU implementation.” https://github.com/srsRAN/srsRAN Project, 2023. Accessed: July 28, 2025

    2023

  22. [30]

    Open5GS: An open-source 5G Core and EPC

    Open5GS Project, “Open5GS: An open-source 5G Core and EPC.” https: //open5gs.org/, 2017

    2017

  23. [31]

    5G NR multiplexing and channel coding (release 18),

    3rd Generation Partnership Project (3GPP), “5G NR multiplexing and channel coding (release 18),” Tech. Rep. ETSI TS 138.212, 3GPP, 2025

    2025

  24. [32]

    Tampermonkey

    J. Biniok, “Tampermonkey.” https://www.tampermonkey.net/index.php, n.d

  25. [33]

    Nr; physical channels and modulation (release 18),

    3rd Generation Partnership Project (3GPP), “Nr; physical channels and modulation (release 18),” Tech. Rep. ETSI TS 138.211, 3GPP, 2025

    2025

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.