Rootworks lab product

Osmo Observer

See every attach.
Control every packet.

Turn a private Osmocom network into a usable security testing environment with live device evidence, repeatable configuration, APN policy and radio control in one local-first interface.

Arrange a demo View the project

12managed lab services

3radio backends

1durable evidence stream

Osmo Observer mission control showing subscriber activity and stack health — Mission control Live subscriber and stack evidence

From radio to evidence

Mobile testing is difficult enough. The control plane should not be.

Stop tailing ten log files to reconstruct a device session. Observer correlates joins, authentication, assigned addresses and disconnects while keeping the underlying Osmocom configuration available when you need it.

Watch the full lifecycle

Move from live activity to an IMSI timeline with APN, IP address, source component and timestamp preserved.

Configure repeatable networks

Model multiple BTS profiles and APNs as structured controls, with validated raw VTY access for advanced work.

Operate without a shell

Start, stop and inspect an allow-listed process set. Begin with virtual radio, then move to nanoBTS or UHD hardware.

APN traffic security

Make insecure TLS behaviour visible

Give each APN its own egress, DNS, portal and interception policy. In detection mode, a completed HTTPS request without the lab CA is raised as a certificate-validation bypass candidate.

Per-APN nftables isolation and internet masquerading
Dedicated dnsmasq policy with query metadata
Captive acceptance with resettable client sessions
Metadata-only TLS evidence and downloadable lab CA

Traffic security dashboard with APN policy, DNS evidence and a TLS bypass candidate — **01 / Traffic**One view from policy to evidence

Configuration that scales

Text files underneath. A proper model above.

Repeating APNs stay first-class. Every policy is explicit, validated and rendered back to the correct Osmocom component. Raw component files remain available and survive later structured saves.

View the APN editor

Structured APN configuration showing internet, DNS, captive portal and TLS controls — **02 / Configure**Repeatable, guarded and reviewable

Choose the right radio

Choose your radio interface

Develop deterministic local scenarios first, then onboard the hardware appropriate to your authorised lab.

Virtual Um

Protocol work without RF

OsmoBTS Virtual and OsmocomBB virtphy support repeatable local scenarios.

ip.access

nanoBTS onboarding

Discover, preview and provision a nanoBTS with an explicit confirmation boundary.

Ettus UHD

USRP-backed local BTS

Discover UHD hardware, select clock and antenna paths, then plan by ARFCN or frequency.

Osmo Observer radio hardware setup for virtual, nanoBTS and Ettus USRP backends — **03 / Hardware**Guarded discovery and provisioning

Authorised labs only

Built with boundaries, not bravado

The UI binds to loopback, hardware writes require confirmation, service actions are allow-listed, and APN egress and interception begin disabled. Use shielded or licensed RF environments and only assess devices and traffic you are authorised to test.

Launch your private mobile lab

Find the event.
Prove the weakness.

Arrange a guided walkthrough of Osmo Observer and discuss how it fits your Osmocom security lab.

Talk to Rootworks 01744 776167