4G/LTE - OTA Message Structure

 

 

 

 

Message Correlation

 

When I first tried creating WCDMA protocol test cases several years ago, I was struggled a lot due to the dependencies between different messages in RRC/NAS protocol sequences. But with LTE, I struggled even more. At least in WCDMA, UE send back explicit complaining message (e.g, Reject or Failure messages) but in LTE UE does not explicitely complain.. just stop doing anything and stay stucked there. So it is far more difficult to troubleshoot those issues in LTE if the root cause is from these message correlation.

If you are not the RRC/NAS protocol stack developer or test case developer, you would not see many of these issues on your daily life.. but once it happens, it is extremely difficult to find the root cause. One tip is to list up all the possible correlations and check through one-by-one until you are sure that there is no problem with these correlation issues.

The correlations in this page is not the full least and I will keep updating as I find more (as I come across more problems in my life -:))

 

 

 

EPS attach type value

Source Message

RRC Connection Setup Complete + EMM:Attach Request + PDN Connectivity Request

IE

Attach request.EPS attach type.EPS attach type value

Target Message

RRC Connection Reconfiguration + EMM: Attach Accept + Activate Default EPS Bearer Request

IE

Attach accept.EPS attach result.EPS attach result value

 

Length of UE network capability contents

Source Message

RRC Connection Setup Complete + EMM:Attach Request + PDN Connectivity Request

IE

Attach request.UE network capability.Octet1.Length of UE network capability contents

Target Message

RRC Connection Reconfiguration + EMM: Attach Accept + Activate Default EPS Bearer Request

IE

Security mode command.Replayed UE security capabilities.Octet1.Length of UE security capability contents

 

EEA

Source Message RRC Connection Setup Complete + EMM: Attach Request + PDN Connectivity Request
IE

Attach request.UE network capability.Octet2

Target Message dlInformationTransfer + EMM : Security Mode Command
IE

Security mode command.Replayed UE security capabilities.Octet2

 

EIA

Source Message RRC Connection Setup Complete + EMM: Attach Request + PDN Connectivity Request
IE

Attach request.UE network capability.Octet3

Target Message dlInformationTransfer + EMM : Security Mode Command
IE

Security mode command.Replayed UE security capabilities.Octet3

 

UEA

Source Message RRC Connection Setup Complete + EMM: Attach Request + PDN Connectivity Request
IE

Attach request.UE network capability.Octet4

Target Message dlInformationTransfer + EMM : Security Mode Command
IE

Security mode command.Replayed UE security capabilities.Octet4

 

UIA

Source Message RRC Connection Setup Complete + EMM: Attach Request + PDN Connectivity Request
IE

Attach request.UE network capability.Octet5

Target Message dlInformationTransfer + EMM : Security Mode Command
IE

Security mode command.Replayed UE security capabilities.Octet5

 

PDN type value

Source Message

RRC Connection Setup Complete + EMM:Attach Request + ESM : PDN Connectivity Request

IE

PDN connectivity request.PDN type.PDN type value

Target Message

RRC Connection Reconfiguration + EMM: Attach Accept + ESM : Activate Default EPS Bearer Request

IE

Activate default EPS bearer context request.PDN address.Octet2.PDN type value

 

APN1

Source Message

RRC Connection Setup Complete + EMM:Attach Request + ESM : PDN Connectivity Request

IE

PDN connectivity request.Access point name

Target Message

RRC Connection Reconfiguration + EMM: Attach Accept + ESM : Activate Default EPS Bearer Request

IE

Activate default EPS bearer context request.Access point name.Octet2-Octet101.Access point name value

 

APN2

Source Message

ulInformationTransfer + ESM : PDN Connectivity Request

IE

PDN connectivity request.Access point name

Target Message

RRC Connection Reconfiguration + ESM : Activate Default EPS Bearer Request

IE

Activate default EPS bearer context request.Access point name.Octet2-Octet101.Access point name value

 

GUTI or IMSI

Source Message

ulInformationTransfer + EMM:Attach Request + ESM : PDN Connectivity Request

IE

i) Attach request.Old GUTI or IMSI.Octet1.Length of EPS mobile identity contents

ii) Attach request.Old GUTI or IMSI.Octet2.Type of identity

iii) Attach request.Old GUTI or IMSI.Octet3~Octet 12

Target Message

RRC Connection Reconfiguration + EMM: Attach Accept + ESM : Activate Default EPS Bearer Request

IE

i) Attach accept.GUTI.Octet2.Length of EPS mobile identity contents

ii) Attach accept.GUTI.Octet3.Type of identity

iii) Attach accept.GUTI.Octet4~13