drop 5g nas capture · parse registration + pdu session messages · runs locally
flags deregistration bursts · authentication failures · rejected pdu sessions · abnormal cause codes
encrypted nas opaque — plaintext dissection only · heuristic screener · not definitive proof