# RF-301 Anchor Reading Guide *VCA-RF-301 cross-chapter reading-guide handout. Companion to the catalog page at `https://virtuscyberacademy.org/vca-rf-301`. Audience: Belt-5 RF-track students arriving from the catalog's distilled "What Belt-5 RF Graduates Recognize" register. * *The catalog page tells you WHAT the course covers. This guide tells you HOW to read the canonical anchors that build the Belt-5: which books, which chapters, in which order, what to extract on each pass, and how the anchors compose into a coherent argument about RF at carrier, satellite, cellular, and adversary scale.* --- ## §0. What this guide is for RF-301 is the academy's RF-track terminal course. Four anchors carry the Belt-5: Mitola's *Cognitive Radio Architecture* for the dynamic-spectrum-access vision that earns SDR its place over hardware radios, Wyglinski et al.'s *SDR for Engineers* for the practitioner's receiver-chain budgeting toolkit, and two coupled sections of Kurose-Ross *Computer Networking: A Top-Down Approach* (9th edition) for the 5G New Radio plus 5G Core architecture and the 5G mobility plus 5G-AKA exchange. The four anchors do not compose a textbook tour. Each is opinionated about what matters at this level, each speaks to specific Belt-5 capstone moves, and the set has been chosen so that the anchors talk to each other across the course's Twelve-Module spine. By the end of RF-301 a student should be able to (a) deploy specific factual content from each anchor in a protocol-RE engagement conversation about modern wireless, (b) recognize when a peer wireless or signals-intelligence program made different anchor choices and what those choices commit them to, and (c) write a defensible Belt-5 capstone whose arguments cite these anchors at chapter and section depth. The RF-301 reading list shares two of its four anchors with the NET-301 companion handout. This is by design: the cellular core and the cellular authentication exchange are anchors both networking and RF tracks need at Belt-5, but the framing differs. The networking student reads 5G as a control-plane decomposition story; the RF student reads 5G as a radio-resource-management plus radio-authentication story. The same anchor; two different lenses; one composition. This guide is opinionated by design. It is not a comprehensive bibliography; it is the academy's argument for these specific reads in this specific order at this specific depth. Anchors that other peer programs lean on (Proakis's *Digital Communications*; Pozar's *Microwave Engineering* in full; the 3GPP specifications read directly) are deliberately not the primary anchors at this level because they are encyclopedic rather than opinionated. RF-301 graduates know the comprehensive material; they were trained on the opinionated material. --- ## §1. The anchor reading register Four anchors. Read in this order on first pass; revisit per the per-anchor walks below for capstone preparation. ### Anchor 1: Mitola, *Cognitive Radio Architecture*, introduction **Edition / pointer:** Joseph Mitola III, *Cognitive Radio Architecture: The Engineering Foundations of Radio XML*, Wiley-Interscience, 2006. The introduction plus the framing chapters (Ch 1-2) carry the foundational argument; later chapters specify the architectural details. Mitola's earlier 2000 dissertation (*Cognitive Radio: An Integrated Agent Architecture for Software Defined Radio*) is the historical primary source and an acceptable substitute for students who can locate it; the 2006 book is the canonical citation. **Why this matters at Belt-5:** Mitola's opening framing in *Cognitive Radio Architecture* is that "software radio" (a term Mitola coined in the early 1990s) and "cognitive radio" (a term Mitola coined in 1999) are not two different ideas; they are the same architectural insight at two different stages. Software radio asks: what if the radio's behavior were defined by software, not by hardware filter banks? Cognitive radio asks: what if that software could observe the spectrum, decide what behavior the situation requires, and adapt accordingly? Both questions move the radio's decision-making locus toward the software layer; cognitive radio just adds an autonomy axis on top. The pedagogical move at RF-301 register is to show that this is not academic philosophy. It is the architectural premise underlying everything from FCC TV-white-space rules to DARPA's Spectrum Collaboration Challenge to the dynamic-frequency-selection logic in every modern WiFi chipset. **Suggested reading order:** First. Read Mitola before any other anchor. Mitola's framing is the prerequisite for reading Wyglinski as a cognitive-radio practitioner rather than as a generic SDR engineer, and the prerequisite for reading the 5G anchors as a wireless-architecture argument rather than as a vendor brochure. **Cross-link to academy artifacts:** RF-301 Lab 2 (implement a basic spectrum-sensing-and-opportunistic-access cognitive radio in GNU Radio against this Mitola framing); RF-301 Ch 4 cognitive-radio module; RF-201 closes the first-introduction at a lighter register and RF-301 picks up at the practitioner register. ### Anchor 2: Wyglinski et al., *SDR for Engineers*, Ch 4-5 (advanced receiver-chain chapters) **Edition / pointer:** Alexander M. Wyglinski, Robin Getz, Travis F. Collins, and Di Pu, *Software-Defined Radio for Engineers*, Artech House, 2018. Chapters 4 and 5 carry the receiver-chain content. The book is freely available through Analog Devices's developer site (the book was sponsored by ADI for the PlutoSDR community); the academy can also access it via library subscription. **Why this matters at Belt-5:** Wyglinski and colleagues argue, in the receiver-chain chapters, that designing a software-defined receiver is fundamentally about budgeting noise and dynamic range across the analogue front-end and the digital back-end. The analogue side contributes thermal noise, intermodulation products, and phase-noise spurs; the digital side contributes quantization noise, ADC-clip distortion, and digital-filter ripple. The pedagogical consequence at RF-301 is that a student who has internalized the Wyglinski budget framework reads a cellular-stack failure (e.g., a LTE attach-procedure timeout under poor SNR) as a multi-component system failure, not as a mysterious one-off. Why did the LTE primary synchronization signal fail to be detected? Because the analogue front-end's noise figure plus the ADC's effective number of bits plus the digital filter's passband ripple together exceeded the synchronization channel's processing-gain budget. That decomposition is unreadable without the Wyglinski framework. **Suggested reading order:** Second. Read Wyglinski after Mitola because Wyglinski's budget framework is most useful when read against the cognitive-radio backdrop. The receiver-chain budget is what makes a cognitive radio's spectrum-sensing claims tractable; without the budget framework, spectrum-sensing reads like aspiration rather than engineering. **Cross-link to academy artifacts:** RF-301 Lab 5 (instrument a working LTE attach procedure against an OAI eNB and measure each contribution to the SNR budget); RF-301 Ch 6 advanced-DSP module; the Wyglinski framework appears in every Belt-5 RF capstone defense as the analytical primitive students invoke when explaining receiver-chain failures. ### Anchor 3: Kurose-Ross 9e, §7.3.3 plus §7.4 (5G New Radio plus 5G Core) **Edition / pointer:** James Kurose and Keith Ross, *Computer Networking: A Top-Down Approach*, 9th edition (2024), Pearson. Sections 7.3.3 ("5G New Radio") and 7.4 ("Cellular Networks: 4G LTE and 5G"). The 9th edition is the canonical academy reference because the 9e treatment of 5G is substantially more architecturally serious than the 8e treatment was; per academy edition discipline (D7 net-track edition uplift), 9e is the only edition cited. **Why this matters at Belt-5:** Kurose-Ross 9e §7.3.3 plus §7.4 frames the radio side and the core network as two distinct architectural moves that have to be read together. On the radio side (§7.3.3), 5G New Radio replaces 4G LTE's sub-6 GHz-only OFDMA assumption with a flexible numerology that operates across sub-6 GHz and mmWave bands, leans on massive-MIMO antenna arrays with dozens to hundreds of elements, and exposes beamforming as a first-class radio-resource-management decision rather than an antenna-design afterthought. On the core side (§7.4), the 5G Core replaces the 4G EPC's monolithic-ish gateway model with a set of named Network Functions: AMF (mobility), SMF (session), UDM (subscriber data), AUSF (authentication), UPF (user-plane forwarding). They speak HTTP/2 plus JSON over a service-bus and explicitly decouple the control plane from the user plane (CUPS). For an RF-track student running an OpenAirInterface gNB for the first time, the combined effect is that a 5G attach procedure is no longer one radio-side conversation; it is a radio-side beam-establishment plus a control-plane traversal across multiple NFs that the OAI logs surface by name. **Suggested reading order:** Third. Read after Mitola and Wyglinski. The 5G architecture is most legible as an engineering argument when you have the cognitive-radio mindset (Mitola) and the receiver-chain budget framework (Wyglinski) already installed. Without those, the 5G NR numerology and 5G Core NF taxonomy read like specification material. **Cross-link to academy artifacts:** The cross-chapter handout `handouts/cross-chapter-control-plane-architectures.md` (shared with vca-net-301) walks the three-way comparison of 5G Core vs SDN vs Mobile-IP along three explicit axes (control-plane decomposition, routing model, state-management strategy). RF-301 Lab 5 instruments the OAI gNB across both planes and reads the radio-side primary-synchronization procedure and the core-side NF-to-NF service calls as two halves of one attach event. ### Anchor 4: Kurose-Ross 9e, §7.5.3 plus §8.8.2 (5G mobility plus 5G-AKA authentication) **Edition / pointer:** Kurose-Ross 9e, §7.5.3 ("5G Mobility") plus §8.8.2 ("5G-AKA Authentication"). Read as a coupled pair; the two sections compose one argument. **Why this matters at Belt-5:** Kurose-Ross 9e treatment of 5G mobility and 5G-AKA reads as two coupled stories. The mobility story (§7.5.3) is that 5G handover splits into intra-RAN handover (between gNBs attached to the same AMF), inter-AMF mobility (the AMF context migrates between control-plane instances), and inter-RAT mobility (between 4G and 5G access). The crucial RF-side observation is that handover decisions are made on radio measurements the UE reports up to the gNB; the measurement reports are themselves a side-channel into UE behavior observable on the air interface. The authentication story (§8.8.2) is that 5G-AKA closes a long-standing 4G/3G/2G weakness: earlier generations transmitted the IMSI in cleartext during initial attach, which the IMSI-catcher attack class (rogue base stations announcing themselves to nearby UEs) trivially harvested. 5G-AKA replaces the cleartext IMSI with the SUCI (Subscription Concealed Identifier), an ECIES-encrypted form of the SUPI (Subscription Permanent Identifier) that only the home network's AUSF can decrypt. The pedagogical move at RF-301 register is to hold these two together: the radio-side handover-measurement pipeline produces a behavioral fingerprint, and the 5G-AKA SUCI computation is the cryptographic side-channel where a misimplemented baseband leaks state across the air interface. **Suggested reading order:** Fourth. Read immediately after Anchor 3; the two are coupled. Treat them as one ~50-page Kurose-Ross block rather than two separate reads. **Cross-link to academy artifacts:** The cross-chapter handout `handouts/cross-chapter-wireless-aka-progression.md` (shared with vca-wir-101 + vca-net-301 + vca-net-201 + vca-sec-101) walks the wireless-AKA progression from 802.11i (2004) through WPA3 / Dragonfly (2018) to 5G-AKA (3GPP Rel-15, 2018) along three axes (trust-anchor model, long-term-identity privacy, forward-secrecy + replay-protection mechanism). KRACK, Dragonblood, and IMSI-catcher are named as the attack classes driving each redesign. RF-301 Lab 10 (cellular-stack RE cross-cut) takes a partial-reverse of an LTE PHY layer; the analogous 5G work is the natural forward-stretch. --- ## §2. Mitola deep walk: cognitive-radio architecture Mitola's *Cognitive Radio Architecture* opens with the software-radio-as-foundation framing and closes with the cognitive-radio-as-autonomy-overlay claim. Read for the architectural insight as the chapter's central operational primitive. ### What to extract A Belt-5 graduate should carry the following five facts from Mitola's introduction and framing chapters into engagement conversation: 1. **"Software radio" was Mitola's term, coined in the early 1990s.** The term names the architectural choice to define radio behavior in software rather than in hardware filter banks. Belt-5 graduates should be precise about the historical lineage: Mitola coined the term; the wider community adopted it; the term predates the GNU Radio project by several years. 2. **"Cognitive radio" was Mitola's term, coined in 1999.** Cognitive radio extends software radio with an autonomy axis: the software observes the spectrum, decides what behavior the situation requires, and adapts. The autonomy is the differentiator. 3. **The architectural premise is decision-locus relocation.** Both software radio and cognitive radio move the radio's decision-making locus toward the software layer. Hardware-defined radios have decisions baked into the silicon; software-defined radios have decisions in code; cognitive radios have decisions in code that observes its own environment and changes itself. 4. **The premise underlies modern spectrum policy.** FCC TV-white-space rules (the Spectrum Sharing Database approach), DARPA's Spectrum Collaboration Challenge (SC2), and the dynamic-frequency-selection logic in every modern WiFi chipset all instantiate Mitola's argument. The premise is in production; Belt-5 graduates should be able to name the deployments. 5. **The premise is not without limits.** Mitola is explicit that cognitive radio's autonomy axis presumes adequate spectrum sensing, which presumes adequate receiver-chain performance. The Wyglinski framework (anchor 2) is the engineering primitive that makes Mitola's premise tractable; without the budget framework, cognitive-radio claims read like aspiration. ### What is out-of-scope at Belt-5 Mitola's later chapters (the Radio Knowledge Representation Language; the deep cognitive-cycle architectural details) are graduate-research material. Belt-5 RF-301 students should know that Mitola specifies a complete architectural framework and not be expected to implement it; the academy's Lab 2 exercises a basic cognitive-radio pattern at a calibrated entry depth. Mitola's 2000 dissertation is interesting historical reading and out-of-scope for the engagement register. ### Cross-anchor connections Mitola's decision-locus-relocation argument lands directly on Wyglinski's receiver-chain framework: the locus relocation only matters if the receiver chain is good enough to make the relocated decisions tractable. Mitola's spectrum-sensing premise lands on the 5G NR anchor (§7.3.3): 5G's flexible numerology and beamforming are an instance of cognitive-radio-style adaptation at the cellular tier, even though 5G NR's specific decisions are made by the network rather than by the UE. Mitola's autonomy axis lands on the 5G mobility anchor (§7.5.3): 5G handover is a network-driven adaptation, not a UE-driven one, and Belt-5 graduates should be able to articulate the difference. --- ## §3. Wyglinski deep walk: receiver-chain budgeting Wyglinski et al.'s receiver-chain chapters are the canonical practitioner anchor for SDR engineering at Belt-5. Read for the budget framework as the analytical primitive. ### What to extract A Belt-5 graduate should carry the following six facts from Ch 4-5: 1. **The receiver chain is a noise-and-dynamic-range budget.** The budget allocates contributions to each component (LNA, mixer, ADC, digital filter) and sums them to a system-level noise figure and dynamic range. A failed reception is a failed budget; the budget is the diagnostic primitive. 2. **The analogue side contributes thermal noise, intermodulation products, and phase-noise spurs.** Thermal noise sets the noise floor; IM products (third-order intercept; IIP3) determine the linearity ceiling; phase-noise spurs corrupt the frequency reference. Each is an independent line item in the budget. 3. **The digital side contributes quantization noise, ADC-clip distortion, and digital-filter ripple.** Quantization noise is set by the ADC's effective number of bits; clip distortion is the consequence of inadequate input headroom; filter ripple is the passband non-flatness that degrades signal quality. Each is an independent line item. 4. **System-level sensitivity is the budget's headline output.** The receiver's sensitivity (the minimum signal level at which a target SNR is achievable) follows from the budget; design changes that improve sensitivity show up as line-item improvements in the budget. 5. **Dynamic range is the budget's secondary headline.** Dynamic range is the ratio of the largest signal the receiver can handle without clipping to the smallest signal it can detect. The two ends of the range are set by independent components (clip ceiling at the ADC; sensitivity floor at the analogue front-end), and the budget tracks both. 6. **A budget failure is multi-component.** The Belt-5 lesson is that no single component sets the receiver's performance; the budget's total is the sum, and any single component's improvement is bounded by the others. A practitioner who thinks "I'll just add a better LNA" without checking the budget is making a register-1 mistake; a Belt-5 graduate checks the budget first. ### What is out-of-scope at Belt-5 Wyglinski's introductory chapters on basic communications theory are RF-201 register material; Belt-5 students should arrive familiar with them. The book's later chapters on specific PlutoSDR exercises are useful for hands-on lab work and out-of-scope for the engagement register. The detailed mathematical derivations of quantization noise and intermodulation products are graduate-research material. ### Cross-anchor connections Wyglinski's budget framework lands directly on Mitola's spectrum-sensing premise: spectrum sensing is a sensitivity-bound problem, and the sensitivity is set by the budget. Wyglinski's framework lands on the 5G NR anchor (§7.3.3): 5G's primary-synchronization-signal detection is a budget problem, and Lab 5 instruments the budget against an actual OAI eNB. Wyglinski's framework lands on the 5G mobility anchor (§7.5.3): handover-decision robustness depends on the measurement-report SNR, which depends on the receiver chain, which depends on the budget. --- ## §4. Kurose-Ross 9e §7.3.3 plus §7.4 deep walk: 5G New Radio plus 5G Core The 5G New Radio plus 5G Core treatment in Kurose-Ross 9e is the academy's canonical anchor for understanding the cellular substrate at Belt-5. Read with attention to the radio-side flexibility and the core-side decomposition; both are architectural choices the student should be able to explain. ### What to extract A Belt-5 graduate should carry the following seven facts from §7.3.3 plus §7.4: 1. **5G NR uses flexible numerology across sub-6 GHz and mmWave bands.** 4G LTE was sub-6 GHz only; 5G NR extends to mmWave and parameterizes the OFDM numerology (subcarrier spacing, symbol duration, slot structure) so the same physical-layer machinery serves both regimes. The flexibility is the architectural primitive. 2. **Massive-MIMO is first-class at the radio layer.** 5G NR specifies massive-MIMO antenna arrays with dozens to hundreds of elements as part of the standard, not as an antenna-design afterthought. The arrays are what make beamforming tractable. 3. **Beamforming is a radio-resource-management primitive.** 5G NR exposes beamforming decisions to the gNB scheduler; beams are managed across UEs and across time on the same scheduling axis as frequency-and-time resource blocks. Belt-5 graduates should be able to articulate why beamforming-as-RRM is different from beamforming-as-antenna-engineering. 4. **The 5G Core decomposes into named NFs: AMF, SMF, UDM, AUSF, UPF.** Plus NRF (NF Repository) and NSSF (Network Slice Selection) helpers. Each NF owns one slice of connection-lifecycle responsibility; NFs discover each other through the NRF. 5. **The service-based interface speaks HTTP/2 plus JSON.** The 5G Core NFs talk to each other over a standard web-services protocol stack rather than over the bespoke Diameter and GTP protocols that 4G EPC inherited. The choice has operational consequences (logs are HTTP-shape; observability tooling extends naturally) and security consequences (the attack surface includes HTTP/2 framing bugs and JSON parser bugs). 6. **Control-plane and user-plane are explicitly separated (CUPS).** The user-plane (UPF) carries packet forwarding; the control-plane NFs carry signaling. The separation lets user-plane and control-plane scale independently. 7. **The 5G attach procedure is two halves: radio-side and core-side.** A 5G attach is no longer one radio-side conversation; it is a radio-side beam-establishment plus a control-plane traversal across multiple NFs. The OAI logs surface both halves; reading them together is the Belt-5 move. ### What is out-of-scope at Belt-5 The full 3GPP TS 38.211 (5G NR physical channels) and TS 23.501 (5G system architecture) specifications are the authoritative references for engineers implementing the protocols; Belt-5 graduates should know they exist. The 4G LTE physical-layer details (turbo coding, fractional frequency reuse) are RF-201 register material; Belt-5 students should arrive familiar with them but not expect to walk them in detail. Detailed beamforming algorithm choices (codebook-based vs reciprocity-based; analog vs digital vs hybrid) are graduate-research material. ### Cross-anchor connections The 5G NR flexible numerology lands on Mitola's cognitive-radio premise: numerology adaptation is a network-driven cognitive-radio behavior, even though 5G NR does not market itself as cognitive. The 5G NR primary-synchronization-signal detection lands on Wyglinski's budget framework: Lab 5 instruments the SNR budget for PSS detection. The 5G Core's HTTP/2-plus-JSON service bus reads against the NET-301 companion handout's Bejtlich anchor: the SBI is a telemetry surface that an NSM-mindset graduate instruments first. The 5G-AKA exchange (anchor 4) is the authentication primitive that the AUSF NF actually executes; reading anchor 4 immediately after anchor 3 is the right pedagogical sequence. --- ## §5. Kurose-Ross 9e §7.5.3 plus §8.8.2 deep walk: 5G mobility plus 5G-AKA The §7.5.3 plus §8.8.2 pair is the academy's coupled treatment of cellular handover and the cellular authentication exchange. Read as one block; the radio-side mobility story and the cryptographic-side authentication story compose into the Belt-5 RF track's load on cellular security. ### What to extract A Belt-5 graduate should carry the following seven facts: 1. **5G handover splits into three classes.** Intra-RAN handover (between gNBs attached to the same AMF); inter-AMF mobility (the AMF context migrates between control-plane instances); inter-RAT mobility (between 4G and 5G access). Each is its own observability surface. 2. **Handover decisions are made on UE-reported radio measurements.** The UE reports measurements up to the gNB during normal operation; the measurements are themselves observable on the air interface. The measurement-report pipeline is a side-channel into UE behavior. 3. **The IMSI-catcher attack class is what 5G-AKA exists to close.** Pre-5G AKA generations transmitted the IMSI in cleartext during initial attach; rogue base stations harvested it without the legitimate network's involvement. The legacy AKA design had no structural fix. 4. **The SUCI is the cryptographic primitive.** The Subscription Concealed Identifier is an ECIES (Elliptic-Curve Integrated Encryption Scheme) encryption of the SUPI under the home network's public key. The home network's AUSF is the only entity that can decrypt back to the SUPI. 5. **The radio-side measurement pipeline is a behavioral fingerprint.** The UE's measurement reports reveal patterns of UE behavior (which beams it sees; how it ranks them; how often it reports). A Belt-5 RF-track graduate reads this as a side-channel that is in scope for engagement work even when the cryptographic side-channel (SUCI computation) is not. 6. **5G-AKA SUCI computation is a baseband-side surface.** The SUCI is computed on the UE's baseband modem before it is transmitted on the air interface. A misimplemented baseband can leak state through this computation: timing variations, error-handling paths, fault-injection responses. The cryptographic side-channel is in scope for advanced RE engagements. 7. **The radio-side and cryptographic-side observabilities are independent.** A Belt-5 graduate should be able to instrument either or both. The independence is the chapter's central operational claim; the two side-channels are not the same channel viewed twice. ### What is out-of-scope at Belt-5 The full 3GPP TS 33.501 specification of 5G-AKA is the authoritative reference for an engineer implementing the protocol; Belt-5 graduates should know it exists. The pre-5G AKA generations (3G UMTS-AKA; 4G EPS-AKA) are sufficient context for the comparison; reading them in detail is out-of-scope. The cryptanalytic literature on the underlying primitives (ECIES; the specific elliptic curve choices; the KDF construction) is graduate-research material rather than Belt-5. ### Cross-anchor connections The 5G-AKA discussion lands on the 5G Core anchor (§7.4): the AUSF is the NF that executes 5G-AKA; the UDM holds the long-term keys; the AMF orchestrates the exchange. Reading anchor 4 cements anchor 3's NF taxonomy. The radio-side measurement-pipeline observation lands on Wyglinski's budget framework: the measurement reports' SNR budget determines whether the side-channel is read-clean or noise-corrupted. The wireless-AKA-progression handout (`cross-chapter-wireless-aka-progression.md`) walks the comparison against WPA2-SAE and WPA3-SAE; reading the handout after anchor 4 closes the wireless-authentication arc. --- ## §6. The synthesis Four anchors compose the RF-301 Belt-5. The composition is opinionated by design; each anchor is opinionated, the order is opinionated, and the cross-anchor connections are the academy's argument for why this specific reading list earns the credential. The argument: a Belt-5 RF-track graduate should be able to read any wireless protocol through four lenses simultaneously. Mitola gives the cognitive-radio architectural lens (the radio's decision-making locus is in software; software-defined receivers and transmitters are the substrate; cognitive autonomy is the modern overlay). Wyglinski gives the receiver-chain-budget lens (sensitivity and dynamic range are a noise-and-dynamic-range budget; failures decompose to component contributions). The two Kurose-Ross sections give the cellular-architectural lens (5G NR's flexible numerology and beamforming-as-RRM; 5G Core's NF decomposition; 5G mobility's handover-class taxonomy; 5G-AKA's IMSI-to-SUCI redistribution of trust and its baseband-side observability surface). The four lenses do not produce four separate readings; they produce one integrated reading where the anchors talk to each other. What would change if a peer wireless or signals-intelligence program made different anchor choices? A program that anchored on Proakis's *Digital Communications* would produce graduates with deeper modulation-theory literacy and weaker cognitive-radio framing; the modulation depth is useful for waveform-design work and crowds out the cognitive-autonomy register that protocol-RE engagement work needs. A program that anchored on Pozar's *Microwave Engineering* in full would produce graduates with deeper RF-circuit literacy and weaker software-radio framing; the circuit depth is useful for hardware-radio engineering and out of scope for the SDR-first practitioner discipline. A program that anchored on the 3GPP specifications directly would produce graduates with deep cellular-protocol literacy and no cognitive-radio framework; the cellular depth is useful in standards-development environments and weak in the wider wireless-RE engagement register the academy targets. The academy's choice is to anchor on opinionated primary sources at the engagement register, accept the cost in encyclopedic coverage, and cover the gaps via the academy's own lab-and-handout corpus. RF-301 graduates know they are not encyclopedically trained; they are practitioner-trained against canonical anchors. The four anchors compose. Read them in order; revisit them as capstone preparation; cite them at chapter-and-section depth in your engagement memos. The Belt-5 credential is what the composition produces. --- ## §7. Cross-references | Artifact | Path | Relationship | |---|---|---| | Catalog page (the page you arrived from) | `/vca-rf-301` | Distilled register; this guide is its forward-pointer destination | | Companion handout: control-plane architectures | `/handouts/cross-chapter-control-plane-architectures.md` | 5G Core vs SDN vs Mobile-IP comparison; closes anchor 3 | | Companion handout: wireless AKA progression | `/handouts/cross-chapter-wireless-aka-progression.md` | 802.11i / WPA3 / 5G-AKA progression; closes anchor 4 | | Companion handout: NET-301 anchor reading guide | `/handouts/cross-chapter-net-301-anchor-reading-guide.md` | Companion handout; shares Kurose-Ross 9e §7.4 / §8.8.2 anchors at the networking track | | NET-301 catalog page | `/vca-net-301` | Cross-track Belt-5 capstone; reads the same 5G material from the networking side | | WIR-101 catalog page | `/vca-wir-101` | Belt-1 wireless intro; the 802.11 substrate WPA-AKA introduces | | RF-201 catalog page | `/vca-rf-201` | Belt-3 RF-track; sub-GHz protocol-RE capstone that RF-301 advances from | | RE-201 catalog page | `/vca-re-201` | Belt-5 RE-track; burst-radio protocol RE; cross-cuts RF-301's waveform-RE module | ---