This page takes one LTE attach apart step by step and lists 161 of them, from the first MIB the UE reads to the moment it returns to idle. It is the companion to Basic Call Processing, which shows the same call as decoded messages. Here the interest is the order of events rather than the contents of any one message.
The view is the network's, and that shapes everything in the table. Every row is something an eNB or a test system would log, so the table holds three kinds of entry rather than one. Some rows cross the air interface. Many more are primitives handed between layers inside a single node. A few are state changes that nothing transmits at all. The sections after the table sort those apart, and name the block that repeats around every message.
Followings are the topics :
- Typical Packet Call (Details)
- What do the Direction values mean ?
- What is the pattern that keeps repeating ?
- What do the internal primitives mean ?
- Reference
Typical Packet Call (Details)
Now the next step is to describe each of the steps in as much detail as possible. The more in detail you can describe, the easier the development, testing, troubleshooting will be. There are many steps I couldn't describe here because the most of steps not described here would be related to company confidentials (Of course, you can say "Every details are in 3GPP specification".Yes, that's true, but 3GPP says only about "What to do", it doesn't say much about "How to do". In real implementation, this "How to do" part is as important as "What to do") You can take this as a minimum of possible-detailed description. Going through this table, think about how much additional comments you think you can put in 'Memo' column. (If you want to see what's really happening in real network, see the live air example in Full Stack page and Call Processing in Detail with Amarisoft page)
NOTE : Following sequence is based on the sequence that would be seen in eNB. Of course, you should see the same sequence on UE side except that UE should have its counter part sequence to < NW >. Some people may think I am writing this table just to confuse people :), but this table is what I have been most often for protocol troubleshooting.
|
Step |
Direction |
Message |
Memo |
|
1 |
UE <--- SS |
|
|
|
2 |
UE <--- SS |
|
|
|
3 |
UE <--- SS |
|
|
|
4 |
UE ---> SS |
PRACH (RACH Preamble)-Msg1 |
|
|
5 |
< NW > |
PHY_PRACH_IND |
|
|
6 |
< NW > |
MAC_DATA_IND |
|
|
7 |
UE <--- SS |
RACH Response - Msg2 |
|
|
8 |
< NW > |
MAC_DATA_REQ |
|
|
9 |
< NW > |
PHY_PRACH_REQ |
|
|
10 |
UE <--- SS |
To decode RAR in UE |
|
|
11 |
< NW > |
PHY_PRACH_IND |
|
|
12 |
< NW > |
MAC_DATA_IND |
|
|
13 |
< NW > |
RLC_DATA_IND |
|
|
14 |
UE ---> SS |
RRC Connection Request - Msg3 |
|
|
15 |
< UE > |
UE MAC start mac-ContentionResolutionTimer |
3GPP 36.321 5.1.5 CR Timer value is set in SIB2 |
|
16 |
UE <--- SS |
|
To confirm Msg3 Reception |
|
17 |
UE <--- SS |
To decode CR in UE |
|
|
18 |
UE <--- SS |
Contention Resolution - Msg4 |
SS must send CR before CRtimer get expired |
|
19 |
UE ---> SS |
|
To Confirm CR Reception at PHY |
|
20 |
< UE > |
UE MAC stop mac-ContentionResolutionTimer |
|
|
21 |
< NW > |
MAC_DATA_REQ |
|
|
22 |
< NW > |
PHY_PRACH_REQ |
|
|
23 |
UE <--- SS |
To decode RRC Conn Setup in UE |
|
|
24 |
UE <--- SS |
RRC Connection Setup |
In some case, this message gets piggybacked to step 18. |
|
25 |
< NW > |
RLC_DATA_REQ |
RLC Carrying step 24 |
|
26 |
< NW > |
MAC_DATA_REQ |
MAC Carrying step 24 |
|
27 |
UE <--- SS |
To decode RRC Conn Setup |
|
|
28 |
< NW > |
PHY_DATA_REQ |
PHY Carrying step 24 |
|
29 |
UE ---> SS |
|
Response to step 28 |
|
30 |
UE ---> SS |
|
To send RLC ACK from UE |
|
31 |
UE <--- SS |
DCI 0 ( |
To send RLC ACK from UE |
|
32 |
< NW > |
PHY_DATA_REQ |
|
|
33 |
< NW > |
MAC_DATA_REQ |
|
|
34 |
UE <--- SS |
|
|
|
35 |
UE ---> SS |
|
|
|
36 |
UE ---> SS |
|
To send RRC Conn Setup Complete from UE |
|
37 |
UE <--- SS |
DCI 0 ( |
To send RRC Conn Setup Complete from UE |
|
38 |
< NW > |
PHY_DATA_IND |
|
|
39 |
< NW > |
MAC_DATA_IND |
|
|
40 |
< NW > |
RLC_DATA_IND |
|
|
41 |
< NW > |
PDCP_DATA_IND |
|
|
42 |
UE ---> SS |
RRC Connection Setup Complete + Attach Requeset + (PDN Conn Request) |
|
|
43 |
UE <--- SS |
|
|
|
44 |
UE <--- SS |
|
|
|
45 |
< NW > |
MAC_DATA_REQ |
|
|
46 |
< NW > |
PHY_DATA_REQ |
|
|
47 |
UE <--- SS |
To decode RLC ACK in UE |
|
|
48 |
UE <--- SS |
Authentication Request |
|
|
49 |
< NW > |
PDCP_DATA_REQ |
|
|
50 |
< NW > |
RLC_DATA_REQ |
|
|
51 |
< NW > |
MAC_DATA_REQ |
|
|
52 |
< NW > |
PHY_DATA_REQ |
|
|
53 |
UE <--- SS |
DCI 0 ( |
To decode Authentication Request in UE |
|
54 |
UE ---> SS |
|
|
|
55 |
UE ---> SS |
|
To send RLC ACK from UE |
|
56 |
UE <--- SS |
DCI 0 ( |
To send RLC ACK from UE |
|
57 |
UE ---> SS |
|
|
|
58 |
UE <--- SS |
|
|
|
59 |
< NW > |
PHY_DATA_REQ |
|
|
60 |
< NW > |
MAC_DATA_REQ |
|
|
61 |
UE ---> SS |
|
|
|
62 |
UE <--- SS |
DCI 0 ( |
|
|
63 |
< NW > |
PHY_DATA_IND |
|
|
64 |
< NW > |
MAC_DATA_IND |
|
|
65 |
< NW > |
RLC_DATA_IND |
|
|
66 |
< NW > |
PDCP_DATA_IND |
|
|
67 |
UE ---> SS |
Authentication Response |
|
|
68 |
UE <--- SS |
|
|
|
69 |
UE <--- SS |
|
|
|
70 |
< NW > |
MAC_DATA_REQ |
|
|
71 |
< NW > |
PHY_DATA_REQ |
|
|
72 |
UE <--- SS |
To decode RLC ACK in UE |
|
|
73 |
UE <--- SS |
NAS Security Mode Command |
|
|
74 |
< NW > |
PDCP_DATA_REQ |
|
|
75 |
< NW > |
RLC_DATA_REQ |
|
|
76 |
< NW > |
MAC_DATA_REQ |
|
|
77 |
< NW > |
PHY_DATA_REQ |
|
|
78 |
UE <--- SS |
To decode NAS Security Mode Command in UE |
|
|
79 |
UE ---> SS |
|
|
|
80 |
UE ---> SS |
|
To send RLC ACK from UE |
|
81 |
UE <--- SS |
DCI 0 ( |
To send RLC ACK from UE |
|
82 |
< NW > |
PHY_DATA_IND |
|
|
83 |
< NW > |
MAC_DATA_IND |
|
|
84 |
UE ---> SS |
|
|
|
85 |
UE <--- SS |
|
|
|
86 |
UE ---> SS |
|
To Send NAS Security Mode Complete |
|
87 |
UE <--- SS |
DCI 0 ( |
To Send NAS Security Mode Complete |
|
88 |
< NW > |
PHY_DATA_IND |
|
|
89 |
< NW > |
MAC_DATA_IND |
|
|
90 |
< NW > |
RLC_DATA_IND |
|
|
91 |
< NW > |
PDCP_DATA_IND |
|
|
92 |
UE ---> SS |
NAS Security Mode Complete |
|
|
93 |
UE <--- SS |
HARQ ACK (PHICH) |
|
|
94 |
UE <--- SS |
|
|
|
95 |
< NW > |
MAC_DATA_REQ |
|
|
96 |
< NW > |
PHY_DATA_REQ |
|
|
97 |
UE <--- SS |
To decode RLC ACK in UE |
|
|
98 |
UE <--- SS |
RRC Security Mode Command |
|
|
99 |
< NW > |
PDCP_DATA_REQ |
|
|
100 |
< NW > |
RLC_DATA_REQ |
|
|
101 |
< NW > |
MAC_DATA_REQ |
|
|
102 |
< NW > |
PHY_DATA_REQ |
|
|
103 |
UE <--- SS |
To decode RRC Security Mode Command in UE |
|
|
104 |
UE ---> SS |
|
|
|
105 |
UE ---> SS |
|
To send RLC ACK from UE |
|
106 |
UE <--- SS |
DCI 0 ( |
To send RLC ACK from UE |
|
107 |
< NW > |
PHY_DATA_IND |
|
|
108 |
< NW > |
MAC_DATA_IND |
|
|
109 |
UE ---> SS |
|
|
|
110 |
UE <--- SS |
|
|
|
111 |
UE ---> SS |
|
To send RRC Security Mode Complete from UE |
|
112 |
UE <--- SS |
DCI 0 ( |
To send RRC Security Mode Complete from UE |
|
113 |
< NW > |
PHY_DATA_IND |
|
|
114 |
< NW > |
MAC_DATA_IND |
|
|
115 |
< NW > |
RLC_DATA_IND |
|
|
116 |
< NW > |
PDCP_DATA_IND |
|
|
117 |
UE ---> SS |
RRC Security Mode Complete |
|
|
118 |
UE <--- SS |
|
|
|
119 |
UE <--- SS |
|
|
|
120 |
< NW > |
MAC_DATA_REQ |
|
|
121 |
< NW > |
PHY_DATA_REQ |
|
|
122 |
UE <--- SS |
To decode RLC ACK in UE |
|
|
123 |
|
< Many other message can be added here depending on NW > |
|
|
124 |
UE <--- SS |
RRC Connection Reconfiguration + Attach Accept + Activate Default EPS Bearer Context Request |
|
|
125 |
< NW > |
PDCP_DATA_REQ |
|
|
126 |
< NW > |
RLC_DATA_REQ |
|
|
127 |
< NW > |
MAC_DATA_REQ |
|
|
128 |
< NW > |
PHY_DATA_REQ |
|
|
129 |
UE ---> SS |
|
|
|
130 |
UE ---> SS |
|
To send RLC ACK from UE |
|
131 |
UE <--- SS |
DCI 0 ( |
To send RLC ACK from UE |
|
132 |
< NW > |
PHY_DATA_IND |
|
|
133 |
< NW > |
MAC_DATA_IND |
|
|
134 |
UE ---> SS |
|
|
|
135 |
UE ---> SS |
|
To send RRC Connection Reconfig Complete from UE |
|
136 |
UE <--- SS |
DCI 0 ( |
To send RRC Connection Reconfig Complete from UE |
|
137 |
< NW > |
PHY_DATA_IND |
|
|
138 |
< NW > |
MAC_DATA_IND |
|
|
139 |
< NW > |
RLC_DATA_IND |
|
|
140 |
< NW > |
PDCP_DATA_IND |
|
|
141 |
UE ---> SS |
RRC Connection Reconfiguration Complete + Attach Complete + Activate Default EPS Bearer Context Accept |
|
|
142 |
UE <--- SS |
|
|
|
143 |
UE <--- SS |
|
|
|
144 |
< NW > |
MAC_DATA_REQ |
|
|
145 |
< NW > |
PHY_DATA_REQ |
|
|
146 |
UE <--- SS |
To decode RLC ACK in UE |
|
|
147 |
|
< IP Data Traffic if needed > |
|
|
148 |
UE <--- SS |
RRC Connection Release |
|
|
149 |
< NW > |
PDCP_DATA_REQ |
|
|
150 |
< NW > |
RLC_DATA_REQ |
|
|
151 |
< NW > |
MAC_DATA_REQ |
|
|
152 |
< NW > |
PHY_DATA_REQ |
|
|
153 |
UE <--- SS |
To decode RRC Connection Release in UE |
|
|
154 |
UE ---> SS |
|
|
|
155 |
UE ---> SS |
|
To send RLC ACK from UE |
|
156 |
UE <--- SS |
DCI 0 ( |
To send RLC ACK from UE |
|
157 |
< NW > |
PHY_DATA_IND |
|
|
158 |
< NW > |
MAC_DATA_IND |
|
|
159 |
UE ---> SS |
|
|
|
160 |
UE <--- SS |
|
|
|
161 |
UE |
< Now UE should be in IDLE mode > |
|
What do the Direction values mean ?
The Direction column takes four different values, and only two of them describe something that is actually transmitted. Reading every row as an air interface message is the quickest way to misread the table, so it is worth fixing the four in mind before working down the rows.
The counts are the surprise. Of the 161 steps, 51 are downlink and 31 are uplink. The other 79 never reach the air at all. Nearly half the table is the network talking to itself, and that is deliberate. Those rows are there because an eNB log prints them, and because a missing one tells you which layer the chain stopped at.
Direction |
Rows |
What it means |
UE <--- SS |
51 |
Downlink. The network transmits and the UE receives. |
UE ---> SS |
31 |
Uplink. The UE transmits and the network receives. |
< NW > |
74 |
Nothing is transmitted. A primitive has passed between two layers inside the network. |
< UE > |
2 |
Nothing is transmitted. A state change inside the UE, such as a timer starting or stopping. |
UE, or blank |
3 |
A note rather than a step. The table uses these for its bracketed comments and for the closing line. |
SS is the system simulator, and it is the network side throughout this table. Two rows work the other way. Steps 15 and 20 describe what the UE's own MAC is doing, because a test system can see both ends, and those are the only two places the table uses that.
The memo on step 15 is worth checking against the specification, because it is the one row that names a parameter. It reads that the contention resolution timer is set in SIB2, and that is right. 36.331 puts mac-ContentionResolutionTimer inside RACH-ConfigCommon, under ra-SupervisionInfo, with values from sf8 to sf64, and SIB2 is what carries RACH-ConfigCommon to the UE.
Only 82 of the 161 rows reach the air : 51 downlink and 31 uplink, with everything else internal to one node or the other.Angle brackets mean nothing was transmitted : < NW > is a primitive inside the network and < UE > is a state change inside the UE.A missing internal row is a diagnosis : the chain stops at the layer that never logged its primitive.
What is the pattern that keeps repeating ?
Most of this table is one block repeated. Once you can see the block, 161 rows collapse into a handful of RRC and NAS messages with the same machinery around each of them. The steps below are the NAS Security Mode Command exchange, taken from the table exactly as it stands.
Steps |
What happens |
Why it is there |
73 |
The NAS message itself |
The event the whole block exists for. |
74 - 77 |
PDCP_DATA_REQ, RLC_DATA_REQ, MAC_DATA_REQ, PHY_DATA_REQ |
The message handed down the stack, one layer at a time. |
78 |
DCI 1A |
Tells the UE where to find the message on PDSCH. |
79 |
HARQ ACK from the UE |
Confirms the transport block arrived. |
80 - 85 |
Scheduling Request, DCI 0, PHY and MAC_DATA_IND, RLC ACK, HARQ ACK |
The UE asks for a grant, then returns the RLC acknowledgement. |
86 - 92 |
Scheduling Request, DCI 0, the four IND primitives, the reply |
The UE asks for a second grant, then sends its own message back. |
93 - 97 |
HARQ ACK, RLC ACK, MAC and PHY_DATA_REQ, DCI 1A |
The network acknowledges the reply the same way the UE acknowledged its own. |
Two things about the order look wrong at first, and both are worth understanding rather than correcting.
The message is listed before the DCI that schedules it, and before the primitives that carry it down the stack. The row order follows the network's own sequence. The decision to send comes first, then the handover down the layers, then the transmission. A sniffer watching the air sees the DCI first instead, because nothing on PDSCH can be decoded without it.
The second is the cost of every uplink message. The UE has no standing grant, so it cannot simply transmit. It asks with a Scheduling Request and waits for a DCI 0 carrying the grant. That pair appears eleven and twelve times in the table, which makes it the most repeated thing in the whole sequence. An RLC acknowledgement pays the same price as a full RRC message, because it is a transmission like any other.
A few real messages carry the whole table : the rest is the same block of scheduling, acknowledgement and inter-layer handover repeated around each one.The row order is the network's, not the air's : the message is listed before the DCI that schedules it, because that is the order the eNB does things in.Every uplink message costs a request and a grant : the UE has no standing allocation, so a Scheduling Request and a DCI 0 come before each one.An RLC ACK is a transmission in its own right : it needs its own grant, its own transmission and its own HARQ acknowledgement.
What do the internal primitives mean ?
Seventy-four rows carry a name such as MAC_DATA_REQ or PHY_DATA_IND, and not one of them is a 3GPP message. They are the primitives that one layer passes to the next inside a single node, printed because the log prints them. The naming is regular enough to read at a glance once the two suffixes are clear.
REQ is a request travelling downward. A layer is handing something to the layer beneath it and asking for it to be sent. IND is an indication travelling upward. A layer has received something and is telling the layer above.
The order of the names therefore gives you the direction without reading the Direction column at all. A downlink message shows PDCP_DATA_REQ, RLC_DATA_REQ, MAC_DATA_REQ and PHY_DATA_REQ in that order, from the top of the stack to the bottom. An uplink message shows PHY_DATA_IND, MAC_DATA_IND, RLC_DATA_IND and PDCP_DATA_IND, from the bottom back up. Steps 74 to 77 and steps 88 to 91 are those two halves side by side.
Primitive |
Meaning |
Rows |
PDCP_DATA_REQ |
PDCP is asked to send |
5 |
RLC_DATA_REQ |
RLC is asked to send |
6 |
MAC_DATA_REQ |
MAC is asked to send |
15 |
PHY_DATA_REQ |
PHY is asked to send |
13 |
PHY_DATA_IND |
PHY reports data received |
9 |
MAC_DATA_IND |
MAC reports data received |
11 |
RLC_DATA_IND |
RLC reports data received |
6 |
PDCP_DATA_IND |
PDCP reports data received |
5 |
PHY_PRACH_REQ |
The random access pair on the transmit side, at steps 9 and 22 |
2 |
PHY_PRACH_IND |
The random access pair on the receive side, at steps 5 and 11 |
2 |
One caution goes with these names. They are the primitives this particular log prints, not terms a 3GPP specification defines, and another vendor's eNB will show the same events under different labels. What carries across is the shape rather than the spelling: a request chain going down for anything transmitted, and an indication chain coming up for anything received.
REQ goes down and IND comes up : a request asks the layer below to send, and an indication tells the layer above that something arrived.The order of the names gives the direction : PDCP first means downlink, and PHY first means uplink.None of these rows reaches the air : they are internal to one node, and they appear because a log prints them.The names are the vendor's, not 3GPP's : another eNB logs the same events differently, but the request-down and indicate-up shape is the same.
Reference
Only one row of the table names a specification parameter, and both entries below were read for that row and for the contention resolution step it belongs to.
- 36.331 - Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC) protocol specification. RACH-ConfigCommon carries ra-SupervisionInfo, which holds mac-ContentionResolutionTimer with values sf8 to sf64, and SIB2 carries RACH-ConfigCommon to the UE.
- 36.321 - Evolved Universal Terrestrial Radio Access (E-UTRA); Medium Access Control (MAC) protocol specification. Clause 5.1.5 is contention resolution, which the memo on step 15 cites.