srsRAN 4G with LimeSDR Mini - Samsung S25 not seeing the network (Rogue Cell blocking?)

Projects LimeSDR
1

Body:

Hi everyone,

I am currently running an experimental LTE network using srsRAN 4G (EPC + eNodeB) on a Raspberry Pi 5 with a LimeSDR Mini 2.0.

The hardware and software initialization is successful:

  • The EUTRA stack starts without any “No samples or timeout” errors.

  • I validated the RF transmission using an Over-The-Air Loopback test in LimeSuite GUI (FFT Viewer shows a strong Tx peak and the Rx LPF is correctly calibrated at 5 MHz / 25 PRBs).

The issue: > My Samsung Galaxy S25 completely fails to see the network during a manual PLMN network scan.

What I’ve tried so far:

  • I set the PLMN to standard test values (001 01).

  • I tried spoofing my local carrier’s PLMN (208 10 for SFR).

  • I did airplane mode toggles to clear the Android radio cache.

  • Note: I currently only have a commercial SFR eSIM in the phone, not a programmable test SIM yet.

My question for the community: > My hypothesis is that the S25’s baseband processor is aggressively filtering and hiding the network (Rogue Cell protection) because it detects an authentication failure (missing Ki on my side).

Has anyone here experienced this with modern Samsung devices? Do they completely hide the PLMN in the scan list in this scenario, or is there a specific LimeSDR/srsRAN RF parameter (like specific gain settings, or forcing a specific EARFCN) I might have missed to at least make the network ID pop up on the screen?

Thank you for your time and insights!