You may say 'LTE-BL/CE(LTE-M1) is simpler than legacy LTE'. It is true. But it is true only in terms of Hardware design perspective. In terms of protocol point of view, it is not simpler than the legacy LTE. Actually, based on my experience, it is more complicated than the legacy LTE mainly due to the nature of repeatative transmission and narrowband allocation. Also MPDCCH resource allocation parameter is not as straightforward as legacy LTE PDCCH parameter.
If you are working with protocol stack implementation and verification, you need to go through each and every steps of following sequence and you need to have all the detailed informations for each step both on UE and test equipment.
For the comparison with legacy LTE, I put the step in grey that is required in legacy LTE but not happen in BL / CE. I also put some comments in 'Memo' column for these steps.
- Example 01
- Step 1 : MIB
- Step 2 : SIB1
- Step 3 : SIB2 and others
- Step 14 : RRC Connection Request
- Step 22 : RRC Connection Setup
- Step 40 : RRC Connection Setup Complete + Attach Requeset + PDN Connection Request
- Step 122 : RRC Connection Reconfiguration + Attach Accept + Activate Default EPS Bearer Context Request
- Example 02
Example 01
NOTE : Following sequence is based on the sequence that would be seen in eNB. Of course, you should see the same sequence on UE side except that UE should have its counter part sequence to < NW >. Some people may think I am writing this table just to confuse people :), but this table is what I have been most often for protocol troubleshooting.
|
Step |
Direction |
Message |
Memo |
1 |
UE <--- SS |
|
|
2 |
UE <--- SS |
|
|
3 |
UE <--- SS |
|
|
4 |
UE ---> SS |
|
|
5 |
< NW > |
PHY_PRACH_IND |
|
6 |
< NW > |
MAC_DATA_IND |
|
7 |
UE <--- SS |
RACH Response - Msg2 |
|
8 |
< NW > |
MAC_DATA_REQ |
|
9 |
< NW > |
PHY_PRACH_REQ |
|
10 |
UE <--- SS |
To decode RAR in UE |
|
11 |
< NW > |
PHY_PRACH_IND |
|
12 |
< NW > |
MAC_DATA_IND |
|
13 |
< NW > |
RLC_DATA_IND |
|
14 |
UE ---> SS |
|
|
15 |
< UE > |
UE MAC start mac-ContentionResolutionTimer |
3GPP 36.321 5.1.5 CR Timer value is set in SIB2 |
16 |
UE <--- SS |
ACK (PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
17 |
UE <--- SS |
Contention Resolution - Msg4 |
SS must send CR before CRtimer get expired |
18 |
< UE > |
UE MAC stop mac-ContentionResolutionTimer |
|
19 |
< NW > |
MAC_DATA_REQ |
|
20 |
< NW > |
PHY_PRACH_REQ |
|
21 |
UE <--- SS |
To decode CR in UE |
|
22 |
UE <--- SS |
In some case, this message gets piggybacked to step 8. |
|
23 |
< NW > |
RLC_DATA_REQ |
|
24 |
< NW > |
MAC_DATA_REQ |
|
25 |
< NW > |
PHY_DATA_REQ |
|
26 |
UE <--- SS |
To decode RRC Conn Setup |
|
27 |
UE ---> SS |
HARQ ACK |
|
28 |
UE ---> SS |
Scheduling Request |
To send RLC ACK from UE |
29 |
UE <--- SS |
To send RLC ACK from UE |
|
30 |
< NW > |
PHY_DATA_REQ |
|
31 |
< NW > |
MAC_DATA_REQ |
|
32 |
UE ---> SS |
RLC ACK |
|
33 |
UE <--- SS |
ACK (PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
34 |
UE ---> SS |
Scheduling Request |
To send RRC Conn Setup Complete from UE |
35 |
UE <--- SS |
To send RRC Conn Setup Complete from UE |
|
36 |
< NW > |
PHY_DATA_IND |
|
37 |
< NW > |
MAC_DATA_IND |
|
38 |
< NW > |
RLC_DATA_IND |
|
39 |
< NW > |
PDCP_DATA_IND |
|
40 |
UE ---> SS |
|
|
41 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
42 |
UE <--- SS |
RLC ACK |
|
43 |
< NW > |
MAC_DATA_REQ |
|
44 |
< NW > |
PHY_DATA_REQ |
|
45 |
UE <--- SS |
To decode RLC ACK in UE |
|
46 |
UE <--- SS |
Authentication Request |
|
47 |
< NW > |
PDCP_DATA_REQ |
|
48 |
< NW > |
RLC_DATA_REQ |
|
49 |
< NW > |
MAC_DATA_REQ |
|
50 |
< NW > |
PHY_DATA_REQ |
|
51 |
UE <--- SS |
To decode Authentication Request in UE |
|
52 |
UE ---> SS |
HARQ ACK |
|
53 |
UE ---> SS |
Scheduling Request |
To send RLC ACK from UE |
54 |
UE <--- SS |
UL Grant (DCI 6-0A or 6-0B, MPDCCH) |
To send RLC ACK from UE |
55 |
UE ---> SS |
RLC ACK |
|
56 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
57 |
< NW > |
PHY_DATA_REQ |
|
58 |
< NW > |
MAC_DATA_REQ |
|
59 |
UE ---> SS |
Scheduling Request |
|
60 |
UE <--- SS |
|
|
61 |
< NW > |
PHY_DATA_IND |
|
62 |
< NW > |
MAC_DATA_IND |
|
63 |
< NW > |
RLC_DATA_IND |
|
64 |
< NW > |
PDCP_DATA_IND |
|
65 |
UE ---> SS |
Authentication Response |
|
66 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
67 |
UE <--- SS |
RLC ACK |
|
68 |
< NW > |
MAC_DATA_REQ |
|
69 |
< NW > |
PHY_DATA_REQ |
|
70 |
UE <--- SS |
To decode RLC ACK in UE |
|
71 |
UE <--- SS |
NAS Security Mode Command |
|
72 |
< NW > |
PDCP_DATA_REQ |
|
73 |
< NW > |
RLC_DATA_REQ |
|
74 |
< NW > |
MAC_DATA_REQ |
|
75 |
< NW > |
PHY_DATA_REQ |
|
76 |
UE <--- SS |
To decode NAS Security Mode Command in UE |
|
77 |
UE ---> SS |
HARQ ACK |
|
78 |
UE ---> SS |
Scheduling Request(PUCCH) |
To send RLC ACK from UE |
79 |
UE <--- SS |
To send RLC ACK from UE |
|
80 |
< NW > |
PHY_DATA_IND |
|
81 |
< NW > |
MAC_DATA_IND |
|
82 |
UE ---> SS |
RLC ACK |
|
83 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
84 |
UE ---> SS |
Scheduling Request(PUCCH) |
To Send NAS Security Mode Complete |
85 |
UE <--- SS |
To Send NAS Security Mode Complete |
|
86 |
< NW > |
PHY_DATA_IND |
|
87 |
< NW > |
MAC_DATA_IND |
|
88 |
< NW > |
RLC_DATA_IND |
|
89 |
< NW > |
PDCP_DATA_IND |
|
90 |
UE ---> SS |
NAS Security Mode Complete |
|
91 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
92 |
UE <--- SS |
RLC ACK |
|
93 |
< NW > |
MAC_DATA_REQ |
|
94 |
< NW > |
PHY_DATA_REQ |
|
95 |
UE <--- SS |
To decode RLC ACK in UE |
|
96 |
UE <--- SS |
RRC Security Mode Command |
|
97 |
< NW > |
PDCP_DATA_REQ |
|
98 |
< NW > |
RLC_DATA_REQ |
|
99 |
< NW > |
MAC_DATA_REQ |
|
100 |
< NW > |
PHY_DATA_REQ |
|
101 |
UE <--- SS |
To decode RRC Security Mode Command in UE |
|
102 |
UE ---> SS |
HARQ ACK |
|
103 |
UE ---> SS |
Scheduling Request |
To send RLC ACK from UE |
104 |
UE <--- SS |
To send RLC ACK from UE |
|
105 |
< NW > |
PHY_DATA_IND |
|
106 |
< NW > |
MAC_DATA_IND |
|
107 |
UE ---> SS |
RLC ACK |
|
108 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
109 |
UE ---> SS |
Scheduling Request |
To send RRC Security Mode Complete from UE |
110 |
UE <--- SS |
To send RRC Security Mode Complete from UE |
|
111 |
< NW > |
PHY_DATA_IND |
|
112 |
< NW > |
MAC_DATA_IND |
|
113 |
< NW > |
RLC_DATA_IND |
|
114 |
< NW > |
PDCP_DATA_IND |
|
115 |
UE ---> SS |
RRC Security Mode Complete |
|
116 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
117 |
UE <--- SS |
RLC ACK |
|
118 |
< NW > |
MAC_DATA_REQ |
|
119 |
< NW > |
PHY_DATA_REQ |
|
120 |
UE <--- SS |
To decode RLC ACK in UE |
|
121 |
|
< Many other message can be added here depending on NW > |
|
|
122 |
UE <--- SS |
|
|
123 |
< NW > |
PDCP_DATA_REQ |
|
124 |
< NW > |
RLC_DATA_REQ |
|
125 |
< NW > |
MAC_DATA_REQ |
|
126 |
< NW > |
PHY_DATA_REQ |
|
127 |
UE ---> SS |
HARQ ACK |
|
128 |
UE ---> SS |
Scheduling Request(PUCCH) |
To send RLC ACK from UE |
129 |
UE <--- SS |
To send RLC ACK from UE |
|
130 |
< NW > |
PHY_DATA_IND |
|
131 |
< NW > |
MAC_DATA_IND |
|
132 |
UE ---> SS |
RLC ACK |
|
133 |
UE ---> SS |
Scheduling Request(PUCCH) |
To send RRC Connection Reconfig Complete from UE |
134 |
UE <--- SS |
To send RRC Connection Reconfig Complete from UE |
|
135 |
< NW > |
PHY_DATA_IND |
|
136 |
< NW > |
MAC_DATA_IND |
|
137 |
< NW > |
RLC_DATA_IND |
|
138 |
< NW > |
PDCP_DATA_IND |
|
139 |
UE ---> SS |
RRC Connection Reconfiguration Complete + Attach Complete + Activate Default EPS Bearer Context Accept |
|
140 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
141 |
UE <--- SS |
RLC ACK |
|
142 |
< NW > |
MAC_DATA_REQ |
|
143 |
< NW > |
PHY_DATA_REQ |
|
144 |
UE <--- SS |
To decode RLC ACK in UE |
|
145 |
|
< IP Data Traffic if needed > |
|
146 |
UE <--- SS |
RRC Connection Release |
|
147 |
< NW > |
PDCP_DATA_REQ |
|
148 |
< NW > |
RLC_DATA_REQ |
|
149 |
< NW > |
MAC_DATA_REQ |
|
150 |
< NW > |
PHY_DATA_REQ |
|
151 |
UE <--- SS |
To decode RRC Connection Release in UE |
|
152 |
UE ---> SS |
HARQ ACK |
|
153 |
UE ---> SS |
Scheduling Request(PUCCH) |
To send RLC ACK from UE |
154 |
UE <--- SS |
To send RLC ACK from UE |
|
155 |
< NW > |
PHY_DATA_IND |
|
156 |
< NW > |
MAC_DATA_IND |
|
157 |
UE ---> SS |
RLC ACK |
|
158 |
UE <--- SS |
ACK(PHICH) |
This does not happen since PHICH is not supported in BL/CE See UL HARQ page for this |
159 |
UE |
< Now UE should be in IDLE mode > |
|
The attach of a BL/CE UE step by step, as the network side sees it. Blue entries link to the decoded messages below, and grey rows are legacy LTE steps that do not happen in BL/CE.
No PHICH in BL/CE : every ACK (PHICH) row is grey, because a BL/CE UE has no PHICH and learns the uplink HARQ result from the next DCI on MPDCCH.Every downlink message needs its own DCI : a DCI 6-1A or 6-1B on MPDCCH comes before each downlink RRC or NAS message.Every uplink message needs a grant first : the UE sends a scheduling request, receives a DCI 6-0A or 6-0B, and only then sends the message.RLC ACKs double the exchange : each signalling message is followed by an RLC status in the opposite direction, with its own grant.
Step 1 : MIB
The MIB is the first message the UE decodes, and for a BL UE it carries one extra field. In this capture dl-Bandwidth is n100, a 20 MHz cell, and schedulingInfoSIB1-BR-r13 is 10. The decoder has already expanded that value: SIB1-BR is sent with 4 PDSCH repetitions and a TBS of 504 bits. The SIB page explains both tables.
Decoded message,
BCCH-BCH-Message
message
dl-Bandwidth: n100 (5)
phich-Config
phich-Duration: normal (0)
phich-Resource: oneSixth (0)
systemFrameNumber: 00 [bit length 8, 0000 0000 decimal value 0]
schedulingInfoSIB1-BR-r13: 4 PDSCH repetitions - TBS 504 bits (10)
spare: 00 [bit length 5, 3 LSB pad bits, 0000 0... decimal value 0]
HEX : A0 01 40
Step 2 : SIB1
SIB1-BR tells the UE where and how SIB2 is sent. The red lines are the two fields that place it: si-Narrowband-r13 is 6 and si-TBS-r13 is b504. The capture also sets si-WindowLength-BR-r13 to ms40, si-RepetitionPattern-r13 to everyRF and startSymbolBR-r13 to 2.
Decoded message,
systemInformationBlockType1-BR-r13
cellAccessRelatedInfo
plmn-IdentityList: 1 item
Item 0
PLMN-IdentityInfo
plmn-Identity
mcc: 3 items
Item 0
MCC-MNC-Digit: 0
Item 1
MCC-MNC-Digit: 0
Item 2
MCC-MNC-Digit: 1
mnc: 2 items
Item 0
MCC-MNC-Digit: 0
Item 1
MCC-MNC-Digit: 1
cellReservedForOperatorUse: notReserved (1)
trackingAreaCode: 0001
cellIdentity: 00000010
cellBarred: notBarred (1)
intraFreqReselection: allowed (0)
.... ..0. csg-Indication: False
cellSelectionInfo
q-RxLevMin: -140dBm (-70)
freqBandIndicator: 2
schedulingInfoList: 1 item
Item 0
SchedulingInfo
si-Periodicity: rf8 (0)
sib-MappingInfo: 0 items
si-WindowLength: ms40 (6)
systemInfoValueTag: 1
nonCriticalExtension
nonCriticalExtension
nonCriticalExtension
nonCriticalExtension
cellAccessRelatedInfo-v1250
nonCriticalExtension
cellSelectionInfoCE-r13
q-RxLevMinCE-r13: -140dBm (-70)
bandwidthReducedAccessRelatedInfo-r13
si-WindowLength-BR-r13: ms40 (1)
si-RepetitionPattern-r13: everyRF (0)
schedulingInfoList-BR-r13: 1 item
Item 0
SchedulingInfo-BR-r13
si-Narrowband-r13: 6
si-TBS-r13: b504 (5)
fdd-DownlinkOrTddSubframeBitmapBR-r13: subframePattern40-r13 (1)
subframePattern40-r13: 1c1c1c1c1c
fdd-UplinkSubframeBitmapBR-r13: ffc0
startSymbolBR-r13: 2
si-HoppingConfigCommon-r13: off (1)
HEX : 48 40 04 03 00 01 00 00 00 18 00 10 00 60 A4 91 80 70 80 55 8E 0E 0E 0E 0E 7F EC
Step 3 : SIB2 and others
SIB2 carries the random access configuration that the UE uses in the next steps. The red lines are the BL/CE RACH fields. This cell configures a single CE level, with preambles 0 to 10, a response window of sf20 and a contention resolution timer of sf80. The PRACH uses prach-ConfigIndex-r13 12 with one repetition per attempt.
Decoded message,
sib2
radioResourceConfigCommon
rach-ConfigCommon
preambleInfo
numberOfRA-Preambles: n52 (12)
powerRampingParameters
powerRampingStep: dB2 (1)
preambleInitialReceivedTargetPower: dBm-108 (6)
ra-SupervisionInfo
preambleTransMax: n7 (4)
ra-ResponseWindowSize: sf10 (7)
mac-ContentionResolutionTimer: sf64 (7)
maxHARQ-Msg3Tx: 4
preambleTransMax-CE-r13: n10 (6)
rach-CE-LevelInfoList-r13: 1 item
Item 0
RACH-CE-LevelInfo-r13
preambleMappingInfo-r13
firstPreamble-r13: 0
lastPreamble-r13: 10
ra-ResponseWindowSize-r13: sf20 (0)
mac-ContentionResolutionTimer-r13: sf80 (0)
rar-HoppingConfig-r13: off (1)
bcch-Config
modificationPeriodCoeff: n2 (0)
pcch-Config
defaultPagingCycle: rf64 (1)
nB: oneThirtySecondT (7)
prach-Config
rootSequenceIndex: 123
prach-ConfigInfo
prach-ConfigIndex: 12
..0. .... highSpeedFlag: False
zeroCorrelationZoneConfig: 0
prach-FreqOffset: 0
pdsch-ConfigCommon
referenceSignalPower: 0dBm
p-b: 2
pusch-ConfigCommon
pusch-ConfigBasic
n-SB: 1
hoppingMode: interSubFrame (0)
pusch-HoppingOffset: 0
.0.. .... enable64QAM: False
ul-ReferenceSignalsPUSCH
..0. .... groupHoppingEnabled: False
groupAssignmentPUSCH: 0
0... .... sequenceHoppingEnabled: False
cyclicShift: 0
pucch-ConfigCommon
deltaPUCCH-Shift: ds2 (1)
nRB-CQI: 4
nCS-AN: 6
n1PUCCH-AN: 0
soundingRS-UL-ConfigCommon: release (0)
release: NULL
uplinkPowerControlCommon
p0-NominalPUSCH: -99dBm
alpha: al09 (6)
p0-NominalPUCCH: -96dBm
deltaFList-PUCCH
deltaF-PUCCH-Format1: deltaF-2 (0)
deltaF-PUCCH-Format1b: deltaF1 (0)
deltaF-PUCCH-Format2: deltaF-2 (0)
deltaF-PUCCH-Format2a: deltaF-2 (0)
deltaF-PUCCH-Format2b: deltaF-2 (0)
deltaPreambleMsg3: -2dB (-1)
ul-CyclicPrefixLength: len1 (0)
bcch-Config-v1310
modificationPeriodCoeff-v1310: n64 (0)
pcch-Config-v1310
paging-narrowBands-r13: 1
mpdcch-NumRepetition-Paging-r13: r1 (0)
nB-v1310: one64thT (0)
freqHoppingParameters-r13
pusch-ConfigCommon-v1310
prach-ConfigCommon-v1310
rsrp-ThresholdsPrachInfoList-r13: 1 item
Item 0
RSRP-Range: -68dBm <= RSRP < -67dBm (73)
mpdcch-startSF-CSS-RA-r13: fdd-r13 (0)
fdd-r13: v1 (0)
prach-HoppingOffset-r13: 0
prach-ParametersListCE-r13: 1 item
Item 0
PRACH-ParametersCE-r13
prach-ConfigIndex-r13: 12
prach-FreqOffset-r13: 0
prach-StartingSubframe-r13: sf2 (0)
maxNumPreambleAttemptCE-r13: n3 (0)
numRepetitionPerPreambleAttempt-r13: n1 (0)
mpdcch-NarrowbandsToMonitor-r13: 2 items
Item 0
mpdcch-NarrowbandsToMonitor-r13 item: 2
Item 1
mpdcch-NarrowbandsToMonitor-r13 item: 1
mpdcch-NumRepetition-RA-r13: r1 (0)
prach-HoppingConfig-r13: off (1)
pucch-ConfigCommon-v1310
n1PUCCH-AN-InfoList-r13: 1 item
Item 0
N1PUCCH-AN-InfoList-r13 item: 57
pucch-NumRepetitionCE-Msg4-Level0-r13: n1 (0)
pucch-NumRepetitionCE-Msg4-Level1-r13: n1 (0)
ue-TimersAndConstants
t300: ms400 (3)
t301: ms400 (3)
t310: ms100 (2)
n310: n1 (0)
t311: ms5000 (2)
n311: n1 (0)
t300-v1310: ms2500 (0)
t301-v1310: ms2500 (0)
freqInfo
additionalSpectrumEmission: 1
timeAlignmentTimerCommon: infinity (7)
HEX : 00 00 6C 59 3F 60 20 9B 00 0A 02 03 C7 B3 00 01 E4 00 00 04 26 00 01 BD F0 00 01 88 77 78 00 00 C9 20 00 CC 00 00 88 07 80 39 05 B4 10 01 01 C0 01 C0
Step 14 : RRC Connection Request
Msg3 carries the RRC Connection Request, and it is short. Its establishmentCause is mo-Signalling, which is the cause a UE uses when it starts an attach. In the table above, this is step 14, after the RAR and the MPDCCH that schedules it.
Decoded message,
rrcConnectionRequest
criticalExtensions: rrcConnectionRequest-r8 (0)
rrcConnectionRequest-r8
ue-Identity: randomValue (1)
randomValue: 4dbd31f12f
establishmentCause: mo-Signalling (3)
spare: 00 [bit length 1, 7 LSB pad bits, 0... .... decimal value 0]
HEX : 54 DB D3 1F 12 F6
Step 22 : RRC Connection Setup
The RRC Connection Setup gives the UE its dedicated configuration, and for a BL UE the key part is the MPDCCH. The red lines are the EPDCCH set that carries mpdcch-config-r13: a distributed set of 2 PRB pairs with a maximum repetition of r1. The capture also sets ce-Mode-r13 to ce-ModeA. The RRC page explains these fields.
Decoded message,
rrcConnectionSetup-r8
radioResourceConfigDedicated
srb-ToAddModList: 1 item
Item 0
SRB-ToAddMod
srb-Identity: 1
rlc-Config: defaultValue (1)
defaultValue: NULL
logicalChannelConfig: defaultValue (1)
defaultValue: NULL
mac-MainConfig: explicitValue (0)
explicitValue
timeAlignmentTimerDedicated: infinity (7)
physicalConfigDedicated
pdsch-ConfigDedicated
p-a: dB-3 (2)
pucch-ConfigDedicated
ackNackRepetition: release (0)
release: NULL
uplinkPowerControlDedicated
p0-UE-PUSCH: 0dB
deltaMCS-Enabled: en0 (0)
.... ..1. accumulationEnabled: True
p0-UE-PUCCH: 0dB
pSRS-Offset: 3
filterCoefficient: fc4 (4)
antennaInfo: defaultValue (1)
defaultValue: NULL
schedulingRequestConfig: setup (1)
setup
sr-PUCCH-ResourceIndex: 0
sr-ConfigIndex: 20
[Periodicity: 20]
[Subframe Offset: 5]
dsr-TransMax: n64 (4)
epdcch-Config-r11
config-r11: setup (1)
setup
setConfigToAddModList-r11: 1 item
Item 0
EPDCCH-SetConfig-r11
setConfigId-r11: 0
transmissionType-r11: distributed (1)
resourceBlockAssignment-r11
numberPRB-Pairs-r11: n2 (0)
resourceBlockAssignment-r11: 0380
dmrs-ScramblingSequenceInt-r11: 0
pucch-ResourceStartOffset-r11: 0
mpdcch-config-r13: setup (1)
setup
csi-NumRepetitionCE-r13: sf1 (0)
mpdcch-pdsch-HoppingConfig-r13: off (1)
mpdcch-StartSF-UESS-r13: fdd-r13 (0)
fdd-r13: v1 (0)
mpdcch-NumRepetition-r13: r1 (0)
mpdcch-Narrowband-r13: 1
ce-Mode-r13: setup (1)
setup: ce-ModeA (0)
HEX : 60 12 9B 07 E8 68 C3 06 4C 00 0A 40 E2 41 A1 04 52 0C 07 00 00 00 14 0D 88 00 00 00 40 04 80
Step 40 : RRC Connection Setup Complete + Attach Requeset + PDN Connection Request
The UE answers with RRC Connection Setup Complete, and this message carries the Attach Request in dedicatedInfoNAS. The Attach Request in turn carries a PDN Connectivity Request in its ESM message container. So one uplink RRC message starts both the EMM and the ESM procedures, and the attach type here is a combined EPS/IMSI attach.
Decoded message,
rrcConnectionSetupComplete-r8
selectedPLMN-Identity: 1
registeredMME
mmegi: 8001 [bit length 16, 1000 0000 0000 0001 decimal value 32769]
mmec: 00 [bit length 8, 0000 0000 decimal value 0]
dedicatedInfoNAS: 1760842a7a030741020bf600f1108001000000000105f070...
Non-Access-Stratum (NAS)PDU
0001 .... = Security header type: Integrity protected (1)
.... 0111 = Protocol discriminator: EPS mobility management messages (0x7)
Message authentication code: 0x60842a7a
Sequence number: 3
0000 .... = Security header type: Plain NAS message, not security protected (0)
.... 0111 = Protocol discriminator: EPS mobility management messages (0x7)
NAS EPS Mobility Management Message Type: Attach request (0x41)
0... .... = Type of security context flag (TSC): Native security context (for KSIasme)
.000 .... = NAS key set identifier: (0)
.... 0... = Spare bit(s): 0x00
.... .010 = EPS attach type: Combined EPS/IMSI attach (2)
EPS mobile identity
Length: 11
.... 0... = Odd/even indication: Even number of identity digits
.... .110 = Type of identity: GUTI (6)
Mobile Country Code (MCC): Unknown (1)
Mobile Network Code (MNC): Unknown (01)
MME Group ID: 32769
MME Code: 0
M-TMSI: 0x00000001
UE network capability
Length: 5
1... .... = EEA0: Supported
.1.. .... = 128-EEA1: Supported
..1. .... = 128-EEA2: Supported
...1 .... = 128-EEA3: Supported
.... 0... = EEA4: Not supported
.... .0.. = EEA5: Not supported
.... ..0. = EEA6: Not supported
.... ...0 = EEA7: Not supported
0... .... = EIA0: Not supported
.1.. .... = 128-EIA1: Supported
..1. .... = 128-EIA2: Supported
...1 .... = 128-EIA3: Supported
.... 0... = EIA4: Not supported
.... .0.. = EIA5: Not supported
.... ..0. = EIA6: Not supported
.... ...0 = EIA7: Not supported
0... .... = UEA0: Not supported
.0.. .... = UEA1: Not supported
..0. .... = UEA2: Not supported
...0 .... = UEA3: Not supported
.... 0... = UEA4: Not supported
.... .0.. = UEA5: Not supported
.... ..0. = UEA6: Not supported
.... ...0 = UEA7: Not supported
0... .... = UCS2 support (UCS2): The UE has a preference for the default alphabet
.0.. .... = UMTS integrity algorithm UIA1: Not supported
..0. .... = UMTS integrity algorithm UIA2: Not supported
...0 .... = UMTS integrity algorithm UIA3: Not supported
.... 0... = UMTS integrity algorithm UIA4: Not supported
.... .0.. = UMTS integrity algorithm UIA5: Not supported
.... ..0. = UMTS integrity algorithm UIA6: Not supported
.... ...0 = UMTS integrity algorithm UIA7: Not supported
0... .... = ProSe direct discovery: Not supported
.0.. .... = ProSe: Not supported
..0. .... = H.245 After SRVCC Handover: Not supported
...1 .... = Access class control for CSFB: Supported
.... 0... = LTE Positioning Protocol: Not supported
.... .0.. = Location services (LCS) notification mechanisms: Not supported
.... ..0. = SRVCC from E-UTRAN to cdma2000 1xCS: Not supported
.... ...0 = Notification procedure: Not supported
ESM message container
Length: 42
ESM message container contents: 021ad011d127238080211001000010810600000000830600...
0000 .... = EPS bearer identity: No EPS bearer identity assigned (0)
.... 0010 = Protocol discriminator: EPS session management messages (0x2)
Procedure transaction identity: 26
NAS EPS session management messages: PDN connectivity request (0xd0)
0001 .... = PDN type: IPv4 (1)
.... 0001 = Request type: Initial request (1)
ESM information transfer flag
1101 .... = Element ID: 0xd-
.... 000. = Spare bit(s): 0x00
.... ...1 = EIT (ESM information transfer):
Security protected ESM information transfer required
Protocol Configuration Options
Element ID: 0x27
Length: 35
[Link direction: MS to network (0)]
1... .... = Extension: True
.... .000 = Configuration Protocol: PPP for use with IP PDP type or
IP PDN type (0)
Protocol or Container ID: Internet Protocol Control Protocol (0x8021)
Length: 0x10 (16)
PPP IP Control Protocol
Code: Configuration Request (1)
Identifier: 0 (0x00)
Length: 16
Options: (12 bytes), Primary DNS Server IP Address,
Secondary DNS Server IP Address
Primary DNS Server IP Address
Type: Primary DNS Server IP Address (129)
Length: 6
Primary DNS Address: 0.0.0.0
Secondary DNS Server IP Address
Type: Secondary DNS Server IP Address (131)
Length: 6
Secondary DNS Address: 0.0.0.0
Protocol or Container ID: DNS Server IPv4 Address Request (0x000d)
Length: 0x00 (0)
Protocol or Container ID: IP address allocation via NAS signalling(0x000a)
Length: 0x00 (0)
Protocol or Container ID: MS Support of Network Requested
Bearer Control indicator (0x0005)
Length: 0x00 (0)
Protocol or Container ID: IPv4 Link MTU Request (0x0010)
Length: 0x00 (0)
Protocol or Container ID: MS support of Local address
in TFT indicator (0x0011)
Length: 0x00 (0)
Tracking area identity - Last visited registered TAI
Element ID: 0x52
Mobile Country Code (MCC): Unknown (1)
Mobile Network Code (MNC): Unknown (01)
Tracking area code(TAC): 1
DRX Parameter
Element ID: 0x5c
SPLIT PG CYCLE CODE: 10 (10)
0000 .... = CN Specific DRX cycle length coefficient: CN Specific DRX cycle
length coefficient / value not specified by the MS (0)
.... 0... = SPLIT on CCCH: Split pg cycle on CCCH is not supported
by the mobile station
.... .000 = Non-DRX timer: no non-DRX mode after transfer state (0)
TMSI Status
1001 .... = Element ID: 0x9-
.... 000. = Spare bit(s): 0
.... ...0 = TMSI flag: no valid TMSI available
Mobile station classmark 2
Element ID: 0x11
Length: 3
0... .... = Spare: 0
.10. .... = Revision Level: Used by mobile stations supporting R99
or later versions of the protocol (2)
...0 .... = ES IND: Controlled Early Classmark Sending option is not implemented
in the MS
.... 1... = A5/1 algorithm supported: encryption algorithm A5/1 not available
.... .111 = RF Power Capability: RF Power capability is irrelevant
in this information element (7)
0... .... = Spare: 0
.0.. .... = PS capability (pseudo-synchronization capability):
PS capability not present
..01 .... = SS Screening Indicator: Capability of handling of ellipsis notation
and phase 2 error handling (1)
.... 1... = SM capability (MT SMS pt to pt capability): Mobile station supports
mobile terminated point to point SMS
.... .0.. = VBS notification reception: no VBS capability or
no notifications wanted
.... ..0. = VGCS notification reception: no VGCS capability or
no notifications wanted
.... ...0 = FC Frequency Capability: The MS does not support the E-GSM or
R-GSM band
1... .... = CM3: The MS supports options that are indicated in classmark 3 IE
.0.. .... = Spare: 0
..1. .... = LCS VA capability (LCS value added location request notification
capability): LCS value added location request notification
capability supported
...0 .... = UCS2 treatment: the ME has a preference for the default alphabet
.... 0... = SoLSA: The ME does not support SoLSA
.... .1.. = CMSP: CM Service Prompt: Network initiated MO CM connection request
supported for at least one CM protocol
.... ..1. = A5/3 algorithm supported: encryption algorithm A5/3 available
.... ...0 = A5/2 algorithm supported: encryption algorithm A5/2 not available
Additional update type
1111 .... = Element ID: 0xf-
.... 00.. = Preferred CIoT network behaviour: No additional information (0)
.... ..0. = SAF: Keeping the NAS signalling connection is not required after the
completion of the tracking area updating procedure
.... ...1 = AUTV: SMS only
GUTI type - Old GUTI type
1110 .... = Element ID: 0xe-
.... 000. = Spare bit(s): 0x00
.... ...0 = GUTI type: Native GUTI
MS network feature support
1100 .... = Element ID: 0xc-
.... 000. = Spare bit(s): 0
.... ...1 = Extended periodic timers: MS supports the extended periodic timer
in this domain
nonCriticalExtension
nonCriticalExtension
gummei-Type-r10: native (0)
HEX : 20 30 80 01 00 59 17 60 84 2A 7A 03 07 41 02 0B F6 00 F1 10 80 01 00 00 00 00 01 05 F0 70 00 00 10 00 2A 02 1A D0 11 D1 27 23 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 00 0D 00 00 0A 00 00 05 00 00 10 00 00 11 00 52 00 F1 10 00 01 5C 0A 00 90 11 03 4F 18 A6 F1 E0 C1 60
Step 122 : RRC Connection Reconfiguration + Attach Accept + Activate Default EPS Bearer Context Request
The network completes the attach with one downlink RRC message that carries two NAS messages. RRC Connection Reconfiguration holds the Attach Accept, and the Attach Accept holds Activate Default EPS Bearer Context Request with EPS bearer identity 5. The same RRC message sets up the radio side of that bearer in radioResourceConfigDedicated.
Decoded message,
rrcConnectionReconfiguration-r8
dedicatedInfoNASList: 1 item
Item 0
DedicatedInfoNAS: 272b3022ca02074202e0060000f1100001002d521ac10105...
Non-Access-Stratum (NAS)PDU
0010 .... = Security header type: Integrity protected and ciphered (2)
.... 0111 = Protocol discriminator: EPS mobility management messages (0x7)
Message authentication code: 0x2b3022ca
Sequence number: 2
0000 .... = Security header type: Plain NAS message, not security protected (0)
.... 0111 = Protocol discriminator: EPS mobility management messages (0x7)
NAS EPS Mobility Management Message Type: Attach accept (0x42)
0000 .... = Spare half octet: 0
.... 0... = Spare bit(s): 0x00
.... .010 = Attach result: Combined EPS/IMSI attach (2)
GPRS Timer - T3412 value
GPRS Timer: timer is deactivated
111. .... = Unit: value indicates that the timer is deactivated (7)
...0 0000 = Timer value: 0
Tracking area identity list - TAI list
Length: 6
0... .... = Spare bit(s): 0x00
.00. .... = Type of list: list of TACs belonging to one PLMN,
with non-consecutive TAC values (0)
...0 0000 = Number of elements: 0 [+1 = 1 element(s)]
Mobile Country Code (MCC): Unknown (1)
Mobile Network Code (MNC): Unknown (01)
Tracking area code(TAC): 1
ESM message container
Length: 45
ESM message container contents: 521ac101050403...
0101 .... = EPS bearer identity: EPS bearer identity value 5 (5)
.... 0010 = Protocol discriminator:
EPS session management messages (0x2)
Procedure transaction identity: 26
NAS EPS session management messages: Activate default EPS bearer
context request (0xc1)
EPS quality of service
Length: 1
Quality of Service Class Identifier (QCI): QCI 5 (5)
Access Point Name
Length: 4
APN: APN
PDN address
Length: 5
0000 0... = Spare bit(s): 0x00
PDN type: IPv4 (1)
PDN IPv4: 192.168.1.1
Protocol Configuration Options
Element ID: 0x27
Length: 27
[Link direction: Network to MS (1)]
1... .... = Extension: True
.... .000 = Configuration Protocol: PPP for use with IP PDP type
or IP PDN type (0)
Protocol or Container ID: Internet Protocol Control Protocol
(0x8021)
Length: 0x10 (16)
PPP IP Control Protocol
Code: Configuration Nak (3)
Identifier: 0 (0x00)
Length: 16
Options: (12 bytes), Primary DNS Server IP Address,
Secondary DNS Server IP Address
Primary DNS Server IP Address
Type: Primary DNS Server IP Address (129)
Length: 6
Primary DNS Address: 100.168.1.101
Secondary DNS Server IP Address
Type: Secondary DNS Server IP Address (131)
Length: 6
Secondary DNS Address: 100.168.1.101
Protocol or Container ID: DNS Server IPv4 Address (0x000d)
Length: 0x04 (4)
IPv4: 192.168.1.2
EPS mobile identity - GUTI
Element ID: 0x50
Length: 11
.... 0... = Odd/even indication: Even number of identity digits
.... .110 = Type of identity: GUTI (6)
Mobile Country Code (MCC): Unknown (1)
Mobile Network Code (MNC): Unknown (01)
MME Group ID: 32769
MME Code: 0
M-TMSI: 0x00000001
GPRS Timer - T3402 value
Element ID: 0x17
GPRS Timer: timer is deactivated
111. .... = Unit: value indicates that the timer is deactivated (7)
...0 0000 = Timer value: 0
GPRS Timer - T3423 value
Element ID: 0x59
GPRS Timer: timer is deactivated
111. .... = Unit: value indicates that the timer is deactivated (7)
...0 0000 = Timer value: 0
EPS network feature support
Element ID: 0x64
Length: 1
0... .... = Control plane CIoT EPS optimization: Not supported
.0.. .... = EMM-REGISTERED w/o PDN connectivity: Not supported
..0. .... = Support of EXTENDED SERVICE REQUEST for packet services:
Not supported
...0 0... = CS-LCS: no information about support of location services
via CS domain is available (0)
.... .0.. = Location services via EPC: Not supported
.... ..1. = Emergency bearer services in S1 mode: Supported
.... ...1 = IMS voice over PS session in S1 mode: Supported
Additional update result
1111 .... = Element ID: 0xf-
.... 00.. = Spare bit(s): 0x00
.... ..10 = AURV: SMS only (2)
radioResourceConfigDedicated
srb-ToAddModList: 1 item
Item 0
SRB-ToAddMod
srb-Identity: 2
rlc-Config: defaultValue (1)
defaultValue: NULL
logicalChannelConfig: defaultValue (1)
defaultValue: NULL
drb-ToAddModList: 1 item
Item 0
DRB-ToAddMod
eps-BearerIdentity: 5
drb-Identity: 1
pdcp-Config
discardTimer: infinity (7)
rlc-AM
.... .1.. statusReportRequired: True
headerCompression: notUsed (0)
notUsed: NULL
rlc-Config: am (0)
am
ul-AM-RLC
t-PollRetransmit: ms200 (39)
pollPDU: p4 (0)
pollByte: kB125 (4)
maxRetxThreshold: t32 (7)
dl-AM-RLC
t-Reordering: ms200 (30)
t-StatusProhibit: ms200 (40)
logicalChannelIdentity: 3
logicalChannelConfig
ul-SpecificParameters
priority: 6
prioritisedBitRate: infinity (7)
bucketSizeDuration: ms100 (1)
logicalChannelGroup: 1
physicalConfigDedicated
HEX : 22 06 02 A9 39 59 81 16 50 10 3A 10 17 00 30 00 07 88 80 00 08 01 6A 90 D6 08 08 28 20 1A 0A 82 70 28 0E 05 40 08 09 38 DC 04 01 08 80 18 00 00 84 08 33 25 40 0B 2C 18 33 25 40 0B 28 00 68 26 05 40 08 12 80 5F B0 07 88 84 00 08 00 00 00 00 08 BF 02 CF 03 20 08 1F 93 13 E0 FA 81 BC 27 09 FD 40 6A E5 00 00
Example 02
The second example follows the same attach, but from a live log instead of a planned sequence. The log shows every channel event with its SFN and subframe. So you can see the timing between MPDCCH, PDSCH, PUCCH and PUSCH that the table in Example 01 only lists.
This is an example from a log tested with Amarisoft Callbox and Amarisoft UE Sim
The screenshots below show the log in the order it was recorded, from the system information at SFN 488 to the last PUCCH at SFN 608. Each row names the layer on the left, the SFN and subframe in the middle and the decoded content on the right. The phases after the screenshots expand the rows one by one.
One complete attach in the Amarisoft log. Random access starts at SFN 577.4, and the Attach Complete leaves the UE at SFN 600.8, about 234 ms later.
The layers are colour coded : the first column marks PHY, MAC, RLC, PDCP, RRC and NAS rows with different colours.MPDCCH is logged as EPDCCH : the MPDCCH is configured as an EPDCCH set, and the log uses that name.The RNTI column follows the procedure : 0xffff for system information, 0x401 for the RAR and 0x961 after random access.NAS rows appear twice : once on the UE side, and once on the network side with the IMSI 001010123456789.
System information
Before random access, the UE reads SIB1 and SIB2/3 from the cell. The red lines in SIB1 are the BL/CE scheduling fields. In this capture, si-WindowLength-BR-r13 is ms40, si-RepetitionPattern-r13 is every4thRF, si-Narrowband-r13 is 1, si-TBS-r13 is b504 and startSymbolBR-r13 is 3.
SIB1
Decoded RRC message,
{
message c1: systemInformationBlockType1: {
cellAccessRelatedInfo {
plmn-IdentityList {
{
plmn-Identity {
mcc {
0,
0,
1
},
mnc {
0,
1
}
},
cellReservedForOperatorUse notReserved
}
},
trackingAreaCode '0001'H,
cellIdentity '1A2D001'H,
cellBarred notBarred,
intraFreqReselection allowed,
csg-Indication FALSE
},
cellSelectionInfo {
q-RxLevMin -70
},
p-Max 10,
freqBandIndicator 7,
schedulingInfoList {
{
si-Periodicity rf16,
sib-MappingInfo {
sibType3
}
}
},
si-WindowLength ms40,
systemInfoValueTag 0,
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
cellAccessRelatedInfo-v1250 {
},
nonCriticalExtension {
hyperSFN-r13 '0000010010'B,
eDRX-Allowed-r13 true,
bandwidthReducedAccessRelatedInfo-r13 {
si-WindowLength-BR-r13 ms40,
si-RepetitionPattern-r13 every4thRF,
schedulingInfoList-BR-r13 {
{
si-Narrowband-r13 1,
si-TBS-r13 b504
}
},
startSymbolBR-r13 3,
si-HoppingConfigCommon-r13 off
}
}
}
}
}
}
}
}
SIB2/3
Decoded RRC message,
{
message c1: systemInformation: {
criticalExtensions systemInformation-r8: {
sib-TypeAndInfo {
sib2: {
radioResourceConfigCommon {
rach-ConfigCommon {
preambleInfo {
numberOfRA-Preambles n52
},
powerRampingParameters {
powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104
},
ra-SupervisionInfo {
preambleTransMax n10,
ra-ResponseWindowSize sf10,
mac-ContentionResolutionTimer sf40
},
maxHARQ-Msg3Tx 5
},
bcch-Config {
modificationPeriodCoeff n4
},
pcch-Config {
defaultPagingCycle rf128,
nB oneT
},
prach-Config {
rootSequenceIndex 204,
prach-ConfigInfo {
prach-ConfigIndex 4,
highSpeedFlag FALSE,
zeroCorrelationZoneConfig 11,
prach-FreqOffset 4
}
},
pdsch-ConfigCommon {
referenceSignalPower -21,
p-b 0
},
pusch-ConfigCommon {
pusch-ConfigBasic {
n-SB 1,
hoppingMode interSubFrame,
pusch-HoppingOffset 8,
enable64QAM TRUE
},
ul-ReferenceSignalsPUSCH {
groupHoppingEnabled FALSE,
groupAssignmentPUSCH 0,
sequenceHoppingEnabled FALSE,
cyclicShift 0
}
},
pucch-ConfigCommon {
deltaPUCCH-Shift ds2,
nRB-CQI 4,
nCS-AN 0,
n1PUCCH-AN 11
},
soundingRS-UL-ConfigCommon setup: {
srs-BandwidthConfig bw3,
srs-SubframeConfig sc3,
ackNackSRS-SimultaneousTransmission TRUE
},
uplinkPowerControlCommon {
p0-NominalPUSCH -85,
alpha al1,
p0-NominalPUCCH -117,
deltaFList-PUCCH {
deltaF-PUCCH-Format1 deltaF0,
deltaF-PUCCH-Format1b deltaF3,
deltaF-PUCCH-Format2 deltaF1,
deltaF-PUCCH-Format2a deltaF2,
deltaF-PUCCH-Format2b deltaF2
},
deltaPreambleMsg3 4
},
ul-CyclicPrefixLength len1,
pusch-ConfigCommon-v1270 {
enable64QAM-v1270 true
}
},
ue-TimersAndConstants {
t300 ms200,
t301 ms200,
t310 ms200,
n310 n6,
t311 ms10000,
n311 n5
},
freqInfo {
additionalSpectrumEmission 1
},
timeAlignmentTimerCommon infinity
},
sib3: {
cellReselectionInfoCommon {
q-Hyst dB2
},
cellReselectionServingFreqInfo {
s-NonIntraSearch 3,
threshServingLow 2,
cellReselectionPriority 6
},
intraFreqCellReselectionInfo {
q-RxLevMin -61,
p-Max 23,
s-IntraSearch 5,
presenceAntennaPort1 TRUE,
neighCellConfig '01'B,
t-ReselectionEUTRA 1
}
}
}
}
}
}
Random access
Random access starts with the PRACH at SFN 577.4, and msg3 arrives 13 subframes later. The MPDCCH for the RAR uses DCI 6-1A at SFN 577.9, and the RAR PDSCH follows at 578.1. The UE sends msg3 on PUSCH at 578.7, and msg3 carries the RrcConnectionRequest.
PRACH
Captured log entry,
Message: sequence_index=10 ta=4 prb=4:6 snr=28.4 cfg_id=1
RAR
Captured log entry,
Message: RAR: rapid=10
Data:
rapid=10
ta=4
ul_grant:
nb_idx=0
riv=0x4
n_rep=0
mcs=5
tpc_command=3
csi_request=0
ul_delay=0
msg3_nb_idx=0
tc-rnti=0x0961
MPDCCH (for RAR) @ SFN = 577.9
Captured log entry,
Message: prb=0,1,2,3,4,5 ecce_index=0/24 L=24 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x6a
mcs1=0
repetition_number=0
harq=0
new_data_indicator1=0
rv_idx1=0
tpc_command=1
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
PDSCH (for RAR) @ SFN = 578.1
Captured log entry,
Message: harq=si prb=23:2 CW0: tb_len=7 mod=2 rv_idx=0
PUSCH (for msg3) @ SFN = 578.7
Captured log entry,
Message: harq=0 prb=4 symb=0:14 CW0: tb_len=9 mod=2 rv_idx=0 retx=0 crc=OK snr=32.9 epre=-71.8 ta=-0.0
RrcConnectionRequest
Decoded RRC message,
{
message c1: rrcConnectionRequest: {
criticalExtensions rrcConnectionRequest-r8: {
ue-Identity randomValue: 'AB92FED9A4'H,
establishmentCause mo-Signalling,
spare '0'B
}
}
}
RRC connection setup and attach request
The RrcConnectionSetup reaches the UE with the MPDCCH at 579.2 and the PDSCH at 579.4, and the UE acknowledges it on PUCCH at 579.8. The UE then sends a scheduling request and receives a DCI 6-0A grant at 580.4. It sends RrcConnectionSetupComplete with the Attach Request on PUSCH at 580.8.
RrcConnectionSetup
Decoded RRC message,
{
message c1: rrcConnectionSetup: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetup-r8: {
radioResourceConfigDedicated {
srb-ToAddModList {
{
srb-Identity 1,
rlc-Config explicitValue: am: {
ul-AM-RLC {
t-PollRetransmit ms60,
pollPDU pInfinity,
pollByte kBinfinity,
maxRetxThreshold t32
},
dl-AM-RLC {
t-Reordering ms45,
t-StatusProhibit ms0
}
},
logicalChannelConfig defaultValue: NULL
}
},
mac-MainConfig explicitValue: {
ul-SCH-Config {
maxHARQ-Tx n5,
periodicBSR-Timer sf20,
retxBSR-Timer sf320,
ttiBundling FALSE
},
drx-Config release: NULL,
timeAlignmentTimerDedicated infinity,
phr-Config setup: {
periodicPHR-Timer sf500,
prohibitPHR-Timer sf200,
dl-PathlossChange dB3
}
},
physicalConfigDedicated {
pdsch-ConfigDedicated {
p-a dB0
},
pucch-ConfigDedicated {
ackNackRepetition release: NULL
},
pusch-ConfigDedicated {
betaOffset-ACK-Index 9,
betaOffset-RI-Index 6,
betaOffset-CQI-Index 6
},
uplinkPowerControlDedicated {
p0-UE-PUSCH 0,
deltaMCS-Enabled en0,
accumulationEnabled TRUE,
p0-UE-PUCCH 0,
pSRS-Offset 3
},
cqi-ReportConfig {
nomPDSCH-RS-EPRE-Offset 0,
cqi-ReportPeriodic setup: {
cqi-PUCCH-ResourceIndex 24,
cqi-pmi-ConfigIndex 78,
cqi-FormatIndicatorPeriodic widebandCQI: NULL,
simultaneousAckNackAndCQI FALSE
}
},
soundingRS-UL-ConfigDedicated release: NULL,
schedulingRequestConfig setup: {
sr-PUCCH-ResourceIndex 56,
sr-ConfigIndex 35,
dsr-TransMax n64
},
epdcch-Config-r11 {
config-r11 setup: {
setConfigToAddModList-r11 {
{
setConfigId-r11 0,
transmissionType-r11 distributed,
resourceBlockAssignment-r11 {
numberPRB-Pairs-r11 n2,
resourceBlockAssignment-r11 'E'H
},
dmrs-ScramblingSequenceInt-r11 1,
pucch-ResourceStartOffset-r11 0,
mpdcch-config-r13 setup: {
csi-NumRepetitionCE-r13 sf1,
mpdcch-pdsch-HoppingConfig-r13 off,
mpdcch-StartSF-UESS-r13 fdd-r13: v1,
mpdcch-NumRepetition-r13 r1,
mpdcch-Narrowband-r13 1
}
}
}
}
},
ce-Mode-r13 setup: ce-ModeA
}
}
}
}
}
MPDCCH (for RrcConnectionSetup) @ SFN = 579.2
Captured log entry,
Message: prb=0,1,2,3,4,5 ecce_index=0/24 L=24 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x6b
mcs1=4
repetition_number=0
harq=0
new_data_indicator1=1
rv_idx1=0
tpc_command=3
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
PDSCH for RrcConnectionSetup @ SFN = 579.4
Captured log entry,
Message: harq=0 k1=4 prb=19:6 CW0: tb_len=51 mod=2 rv_idx=0
PUCCH - HARQ for RrcConnectionSetup @ SFN = 579.8
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=49.1 epre=-72.1
EPDCCH @ SFN = 580.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-0a
Data:
hopping_flag=0
riv=0x2b
mcs1=7
repetition_number=0
harq=0
new_data_indicator1=1
rv_idx1=0
tpc_command=0
csi_request=0
srs_request=0
dci_sf_repetition_number=0
PUSCH @ SFN = 580.8
Captured log entry,
Message: harq=0 prb=6:6 symb=0:14 CW0: tb_len=89 mod=2 rv_idx=0 retx=0 crc=OK snr=23.5 epre=-77.3 ta=-0.1
MAC
Captured log entry,
Message: SBSR: lcg=0 b=0 PHR: ph=63 LCID:1 len=76 PAD: len=6
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=0
PDCP SRB1
Captured log entry,
Message: SN=0
RrcConnectionSetupComplete
Decoded RRC message,
{
message c1: rrcConnectionSetupComplete: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetupComplete-r8: {
selectedPLMN-Identity 1,
dedicatedInfoNAS '07417108091010103254769806E0E00000008000290201D031272
38080211001000010810600000000830600000000000100000300
000A00000C00000D005D0105C1'H
}
}
}
AttachRequest
Decoded NAS message,
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x41 (Attach request)
EPS attach type = 1 (EPS attach)
NAS key set identifier:
TSC = 0
NAS key set identifier = 7
Old GUTI or IMSI:
IMSI = 001010123456789
UE network capability:
0xe0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=0, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0xe0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=0, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
0x00 (UCS2=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
0x00 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=0)
0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 0
Procedure transaction identity = 1
Message type = 0xd0 (PDN connectivity request)
Request type = 1 (initial request)
PDN type = 3 (IPv4v6)
Protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00
Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)
Data =
Protocol ID = 0x0003 (DNS Server IPv6 Address Request)
Data =
Protocol ID = 0x000a (IP address allocation via NAS signalling)
Data =
Protocol ID = 0x000c (P-CSCF IPv4 Address Request)
Data =
Protocol ID = 0x000d (DNS Server IPv4 Address Request)
Data =
Voice domain preference and UE's usage setting = 0x05 (IMS PS Voice only, Data centric)
MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=1
MAC
Captured log entry,
Message: PAD: len=0 PAD: len=0 LCID:1 len=2
EPDCCH @ SFN = 581.2
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x5
mcs1=3
repetition_number=0
harq=0
new_data_indicator1=0
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
Authentication
Authentication shows the pattern that every downlink NAS message follows in this log. A DCI 6-1A on MPDCCH at 581.2 schedules the PDSCH at 581.4, which carries DLInformationTransfer with the Authentication Request. The UE acknowledges on PUCCH, sends a scheduling request at 584.0 and returns the Authentication Response on PUSCH at 584.8.
AuthenticationRequest
Decoded NAS message,
Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x0 (Plain NAS message, not security protected) Message type = 0x52 (Authentication request) NAS key set identifier: TSC = 0 NAS key set identifier = 0 Authentication parameter RAND: Data = 33 f7 17 6e 8d 9a 1e 1a cd 13 7a 2c 8a da 27 fb Authentication parameter AUTN: Length = 16 Data = 5d c9 cf 78 6d 64 90 01 33 e6 35 5d c9 ee e8 6c
DLInformationTransfer
Decoded RRC message,
{
message c1: dlInformationTransfer: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: dlInformationTransfer-r8: {
dedicatedInfoType dedicatedInfoNAS: '07520033F7176E8D9A1E1ACD137A2C8ADA27FB105DC9CF786D64900133E6355DC9EEE86C'H
}
}
}
PDSCH @ SFN = 581.4
Captured log entry,
Message: harq=0 k1=4 prb=5:1 CW0: tb_len=5 mod=2 rv_idx=0
PDCP SRB1
Captured log entry,
Message: SN=0
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=0
MAC
Captured log entry,
Message: LCID:1 len=46 PAD: len=2
EPDCCH @ SFN = 581.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0xb
mcs1=4
repetition_number=0
harq=1
new_data_indicator1=1
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
PDSCH @ SFN = 581.6
Captured log entry,
Message: harq=1 k1=4 prb=0:6 CW0: tb_len=51 mod=2 rv_idx=0
PUCCH @ SFN = 581.8
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=48.8 epre=-72.1
PUCCH @ SFN = 582.0
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=48.9 epre=-72.1
PUCCH @ SFN = 584.0
Captured log entry,
Message: format=1 n=56 br=1 sr=1 snr=49.5 epre=-72.2
PUCCH @ SFN = 584.1
Captured log entry,
Message: format=2 n=24 br=1 cqi=1010 epre=-72.7
EPDCCH @ SFN = 584.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-0a
Data:
hopping_flag=0
riv=0x32
mcs1=14
repetition_number=0
harq=0
new_data_indicator1=0
rv_idx1=0
tpc_command=1
csi_request=0
srs_request=0
dci_sf_repetition_number=0
PUSCH @ SFN = 584.8
Captured log entry,
Message: harq=0 prb=6:4 symb=0:14 CW0: tb_len=125 mod=4 rv_idx=0 retx=0 crc=OK snr=22.1 epre=-76.0 ta=-0.1
MAC
Captured log entry,
Message: SBSR: lcg=0 b=0 LCID:1 len=2 LCID:1 len=21 PAD: len=95
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=1
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=1
PDCP SRB1
Captured log entry,
Message: SN=1
ULinformationtransfer
Decoded RRC message,
{
message c1: ulInformationTransfer: {
criticalExtensions c1: ulInformationTransfer-r8: {
dedicatedInfoType dedicatedInfoNAS: '07530833E6355DC9CF786D'H
}
}
}
AuthenticationResponse
Decoded NAS message,
Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x0 (Plain NAS message, not security protected) Message type = 0x53 (Authentication response) Authentication response parameter: Length = 8 Data = 33 e6 35 5d c9 cf 78 6d
NAS and RRC security
Security takes two exchanges, one for NAS and one for RRC. The NAS Security Mode Command uses security header 0x3, integrity protected with a new EPS security context, and the NAS Security Mode Complete returns with header 0x4. The RRC SecurityModeCommand follows at SFN 589.4, and the UE answers with SecurityModeComplete on PUSCH at 593.5.
Security mode command
Decoded NAS message,
Data: Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x3 (Integrity protected with new EPS security context) Auth code = 0x30172065 Sequence number = 0x00 Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x0 (Plain NAS message, not security protected) Message type = 0x5d (Security mode command) Selected NAS security algorithms = 0x02 (EEA0, EIA2) NAS key set identifier: TSC = 0 NAS key set identifier = 0 Replayed UE security capabilities: 0xe0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=0, EEA4=0, EEA5=0, EEA6=0, EEA7=0) 0xe0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=0, EIA4=0, EIA5=0, EIA6=0, EIA7=0) 0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0) 0x00 (Spare=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0) IMEISV request = 1 Hash MME: Length = 8 Data = 2b d4 47 64 54 ba 12 73
DL Information Transfer
Decoded RRC message,
{
message c1: dlInformationTransfer: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: dlInformationTransfer-r8: {
dedicatedInfoType dedicatedInfoNAS: '373017206500075D020004E0E00000C14F082BD4476454BA1273'H
}
}
}
PDSCH @ SFN = 585.4
Captured log entry,
Message: harq=0 k1=4 prb=5:1 CW0: tb_len=32 mod=4 rv_idx=0
PDCP SRB1
Captured log entry,
Message: SN=1
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=1
MAC
Captured log entry,
Message: LCID:1 len=36 PAD: len=30
EPDCCH @ SFN = 585.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0xa
mcs1=15
repetition_number=0
harq=1
new_data_indicator1=0
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
PDSCH @ SFN = 585.6
Captured log entry,
Message: harq=1 k1=4 prb=4:2 CW0: tb_len=69 mod=4 rv_idx=0
PUCCH @ SFN = 585.8
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=48.5 epre=-72.1
PUCCH @ SFN = 586.0
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=49.7 epre=-72.1
PUCCH @ SFN = 588.0
Captured log entry,
Message: format=1 n=56 br=1 sr=1 snr=49.3 epre=-72.2
EPDCCH @ SFN = 588.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-0a
Data:
hopping_flag=0
riv=0x52
mcs1=14
repetition_number=0
harq=0
new_data_indicator1=1
rv_idx1=0
tpc_command=2
csi_request=0
srs_request=0
dci_sf_repetition_number=0
PUSCH @ SFN = 588.8
Captured log entry,
Message: harq=0 prb=13:4 symb=0:14 CW0: tb_len=125 mod=4 rv_idx=0 retx=0 crc=OK snr=21.9 epre=-75.9 ta=-0.1
MAC
Captured log entry,
Message: SBSR: lcg=0 b=0 LCID:1 len=2 LCID:1 len=29 PAD: len=87
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=2
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=2
PDCP
Captured log entry,
Message: SN=2
ULinformationtransfer
Decoded RRC message,
{
message c1: ulInformationTransfer: {
criticalExtensions c1: ulInformationTransfer-r8: {
dedicatedInfoType dedicatedInfoNAS: '47C2C06D0C00075E23090321436507000001F1'H
}
}
}
SecurityModeComplete
Decoded NAS message,
... Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x4 (Integrity protected and ciphered with new EPS security context) Auth code = 0xc2c06d0c Sequence number = 0x00 Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x0 (Plain NAS message, not security protected) Message type = 0x5e (Security mode complete) IMEISV: IMEISV = 0123456700000101
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=3
MAC
Captured log entry,
Message: LCID:1 len=2 PAD: len=27
EPDCCH @ SFN = 589.2
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x5
mcs1=15
repetition_number=0
harq=0
new_data_indicator1=0
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
SecurityModeCommand
Decoded RRC message,
{
message c1: securityModeCommand: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: securityModeCommand-r8: {
securityConfigSMC {
securityAlgorithmConfig {
cipheringAlgorithm eea0,
integrityProtAlgorithm eia2
}
}
}
}
}
PDSCH @ SFN = 589.4
Captured log entry,
Message: harq=0 k1=4 prb=5:1 CW0: tb_len=32 mod=4 rv_idx=0
PDCP SRB1
Captured log entry,
Message: SN=2
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=2
MAC
Captured log entry,
Message: LCID:1 len=10 PAD: len=19
EPDCCH @ SFN = 589.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x5
mcs1=15
repetition_number=0
harq=1
new_data_indicator1=1
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
PDSCH @ SFN = 589.6
Captured log entry,
Message: harq=1 k1=4 prb=5:1 CW0: tb_len=32 mod=4 rv_idx=0
PUCCH @ SFN = 589.8
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=48.0 epre=-72.0
PUCCH @ SFN = 590.0
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=49.0 epre=-72.1
PUCCH @ SFN = 592.0
Captured log entry,
Message: format=1 n=56 br=1 sr=1 snr=47.1 epre=-72.5
PUCCH @ SFN = 592.1
Captured log entry,
Message: format=2 n=24 br=1 cqi=1010 epre=-72.9
EPDCCH @ SFN = 593.1
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-0a
Data:
hopping_flag=0
riv=0x32
mcs1=14
repetition_number=0
harq=0
new_data_indicator1=0
rv_idx1=0
tpc_command=2
csi_request=0
srs_request=0
dci_sf_repetition_number=0
PUSCH @ SFN = 593.5
Captured log entry,
Message: harq=0 prb=6:4 symb=0:13 CW0: tb_len=125 mod=4 rv_idx=0 retx=0 crc=OK snr=21.9 epre=-76.0 ta=-0.1
MAC
Captured log entry,
Message: SBSR: lcg=0 b=0 LCID:1 len=2 LCID:1 len=9 PAD: len=107
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=3
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=3
PDCP SRB1
Captured log entry,
Message: SN=3
SecurityModeComplete
Decoded RRC message,
{
message c1: securityModeComplete: {
rrc-TransactionIdentifier 0,
criticalExtensions securityModeComplete-r8: {
}
}
}
UE capability
The network then asks for the UE capability. UeCapabilityEnquiry goes down on PDSCH at SFN 594.1, and UeCapabilityInformation comes back on PUSCH at 596.8. The UE Capability page explains which fields in that message mark the UE as Cat M1.
UeCapabilityEnquiry
Decoded RRC message,
{
message c1: ueCapabilityEnquiry: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: ueCapabilityEnquiry-r8: {
ue-CapabilityRequest {
eutra
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
rrc-SegAllowed-r16 enabled
}
}
}
}
}
}
}
}
}
}
}
}
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=4
PDCP SRB1
Captured log entry,
SN=3
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=3
MAC
Captured log entry,
Message: LCID:1 len=2 LCID:1 len=13 PAD: len=12
EPDCCH @ SFN = 593.9
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x5
mcs1=15
repetition_number=0
harq=0
new_data_indicator1=1
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
PDSCH @ SFN = 594.1
Captured log entry,
Message: harq=0 k1=4 prb=5:1 CW0: tb_len=32 mod=4 rv_idx=0
PUCCH @ SFN = 594.5
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=49.1 epre=-72.2
PUCCH @ SFN = 596.0
Captured log entry,
Message: format=1 n=56 br=1 sr=1 snr=48.9 epre=-72.1
EPDCCH @ SFN = 596.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-0a
Data:
hopping_flag=0
riv=0x32
mcs1=14
repetition_number=0
harq=0
new_data_indicator1=1
rv_idx1=0
tpc_command=2
csi_request=0
srs_request=0
dci_sf_repetition_number=0
PUSCH @ SFN = 596.8
Captured log entry,
Message: harq=0 prb=6:4 symb=0:14 CW0: tb_len=125 mod=4 rv_idx=0 retx=0 crc=OK snr=21.6 epre=-76.0 ta=-0.1
MAC
Captured log entry,
Message: SBSR: lcg=0 b=0 LCID:1 len=2 LCID:1 len=46 PAD: len=70
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=4
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=4
PDCP SRB1
Captured log entry,
Message: SN=4
UeCapabilityInformation
Decoded RRC message,
{
message c1: ueCapabilityInformation: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: ueCapabilityInformation-r8: {
ue-CapabilityRAT-ContainerList {
{
rat-Type eutra,
ueCapabilityRAT-Container {
accessStratumRelease rel13,
ue-Category 1,
pdcp-Parameters {
supportedROHC-Profiles {
profile0x0001-r15 TRUE,
profile0x0002-r15 TRUE,
profile0x0003-r15 FALSE,
profile0x0004-r15 TRUE,
profile0x0006-r15 FALSE,
profile0x0101-r15 FALSE,
profile0x0102-r15 FALSE,
profile0x0103-r15 FALSE,
profile0x0104-r15 FALSE
}
},
phyLayerParameters {
ue-TxAntennaSelectionSupported FALSE,
ue-SpecificRefSigsSupported TRUE
},
rf-Parameters {
supportedBandListEUTRA {
{
bandEUTRA 7,
halfDuplex FALSE
}
}
},
measParameters {
bandListEUTRA {
{
interFreqBandList {
{
interFreqNeedForGaps TRUE
}
}
}
}
},
featureGroupIndicators '4E001002'H /*
2: PUCCH 2a/2b, abs TPC, RB alloc type 1 for PDSCH, Periodic CQI/PMI/RI reporting
on PUCCH: Modes 2-0 and 2-1
5: Long DRX cycle, DRX Mac CE
6: Prioritized bit rate
7: RLC UM
20: SRB1 and SRB2 for DCCH + 8x DRB
31: MFBI
*/,
interRAT-Parameters {
},
nonCriticalExtension {
phyLayerParameters-v920 {
},
interRAT-ParametersGERAN-v920 {
},
csg-ProximityIndicationParameters-r9 {
},
neighCellSI-AcquisitionParameters-r9 {
},
son-Parameters-r9 {
},
nonCriticalExtension {
lateNonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
ce-Parameters-v1370 {
tm9-CE-ModeA-r13 supported
},
nonCriticalExtension {
ce-Parameters-v1380 {
tm6-CE-ModeA-r13 supported
},
fdd-Add-UE-EUTRA-Capabilities-v1380 {
ce-Parameters-v1380 {
}
},
tdd-Add-UE-EUTRA-Capabilities-v1380 {
ce-Parameters-v1380 {
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
pdcp-Parameters-v1130 {
},
phyLayerParameters-v1130 {
tdd-SpecialSubframe-r11 supported
},
rf-Parameters-v1130 {
},
measParameters-v1130 {
},
interRAT-ParametersCDMA2000-v1130 {
},
otherParameters-r11 {
},
nonCriticalExtension {
nonCriticalExtension {
rf-Parameters-v1180 {
freqBandRetrieval-r11 supported
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
ue-CategoryDL-v1310 m1,
ue-CategoryUL-v1310 m1,
pdcp-Parameters-v1310 {
},
rlc-Parameters-v1310 {
},
mac-Parameters-v1310 {
extendedLongDRX-r13 supported
},
ce-Parameters-r13 {
ce-ModeA-r13 supported
},
interRAT-ParametersWLAN-r13 {
},
wlan-IW-Parameters-v1310 {
},
lwip-Parameters-r13 {
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
},
nonCriticalExtension {
nonCriticalExtension {
ue-RadioPagingInfo-r12 {
ue-CategoryDL-v1310 m1,
ce-ModeA-r13 true
}
}
}
}
}
}
Attach accept and default bearer
The attach completes with one downlink RRCConnectionReconfiguration that carries the Attach Accept. Its size shows in the lower layers. The MAC PDU carries 120 bytes for SRB1, and RLC splits the message into two segments. The UE answers on PUSCH at 600.8 with RrcConnectionReconfigurationComplete, and with the Attach Complete on SRB2.
AttachAccept
Decoded NAS message,
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x63483d18
Sequence number = 0x01
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 1 (EPS only)
T3412 value:
Value = 30
Unit = 1 (1 minute)
TAI list:
Length = 6
Data = 00 00 f1 10 00 01
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 5
Procedure transaction identity = 1
Message type = 0xc1 (Activate default EPS bearer context request)
EPS QoS:
QCI = 9
Access point name = "default.mnc001.mcc001.gprs"
PDN address:
PDN type = 1 (IPv4)
IPv4 = 192.168.2.2
ESM cause = 0x32 (PDN type IPv4 only allowed)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 03 00 00 0a 81 06 08 08 08 08
Protocol ID = 0x000d (DNS Server IPv4 Address)
Data = 8.8.8.8
GUTI:
MCC = 001
MNC = 01
MME Group ID = 32769
MME Code = 1
M-TMSI = 0x275be002
Emergency number list:
Length = 8
Data = 03 1f 19 f1 03 1f 11 f2
EPS network feature support:
0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)
0x08 (15 bearers=0, IWK N26=0, RestrictDCNR=0, RestrictEC=0, ePCO=1, HC-CP CIoT=0, S1-U data=0, UP CIoT=0)
RRCConnectionReconfiguration
Decoded RRC message,
{
message c1: rrcConnectionReconfiguration: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionReconfiguration-r8: {
dedicatedInfoNASList {
'2763483D18010742013E060000F110000100415201C101091B0764656661756C74...'H
},
radioResourceConfigDedicated {
srb-ToAddModList {
{
srb-Identity 2,
rlc-Config explicitValue: am: {
ul-AM-RLC {
t-PollRetransmit ms60,
pollPDU pInfinity,
pollByte kBinfinity,
maxRetxThreshold t32
},
dl-AM-RLC {
t-Reordering ms45,
t-StatusProhibit ms0
}
},
logicalChannelConfig defaultValue: NULL
}
},
drb-ToAddModList {
{
eps-BearerIdentity 5,
drb-Identity 1,
pdcp-Config {
discardTimer infinity,
rlc-AM {
statusReportRequired TRUE
},
headerCompression notUsed: NULL
},
rlc-Config am: {
ul-AM-RLC {
t-PollRetransmit ms80,
pollPDU p64,
pollByte kB125,
maxRetxThreshold t32
},
dl-AM-RLC {
t-Reordering ms35,
t-StatusProhibit ms10
}
},
logicalChannelIdentity 3,
logicalChannelConfig {
ul-SpecificParameters {
priority 15,
prioritisedBitRate kBps8,
bucketSizeDuration ms100,
logicalChannelGroup 3
}
}
}
},
physicalConfigDedicated {
cqi-ReportConfig-r10 {
nomPDSCH-RS-EPRE-Offset 0,
cqi-ReportPeriodic-r10 setup: {
cqi-PUCCH-ResourceIndex-r10 24,
cqi-pmi-ConfigIndex 78,
cqi-FormatIndicatorPeriodic-r10 widebandCQI-r10: {
},
simultaneousAckNackAndCQI TRUE
}
}
}
}
}
}
}
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=5
PDCP SRB1
Captured log entry,
Message: SN=4
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=0 FI=01 E=0 SN=4
MAC
Captured log entry,
Message: LCID:1 len=2 LCID:1 len=120
EPDCCH @ SFN = 597.2
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x14
mcs1=14
repetition_number=0
harq=0
new_data_indicator1=0
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=10 E=0 SN=5
MAC
Captured log entry,
Message: PAD: len=0 LCID:1 len=30
EPDCCH @ SFN = 597.3
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x5
mcs1=15
repetition_number=0
harq=1
new_data_indicator1=0
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
PDSCH @ SFN = 597.4
Captured log entry,
Message: harq=0 k1=4 prb=2:4 CW0: tb_len=125 mod=4 rv_idx=0
PDSCH @ SFN = 597.5
Captured log entry,
Message: harq=1 k1=4 prb=5:1 CW0: tb_len=32 mod=4 rv_idx=0
PUCCH @ SFN = 597.8
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=48.2 epre=-72.0
PUCCH @ SFN = 597.9
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=48.1 epre=-72.1
PUCCH @ SFN = 600.0
Captured log entry,
Message: format=1 n=56 br=1 sr=1 snr=48.9 epre=-72.1
EPDCCH @ SFN = 600.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-0a
Data:
hopping_flag=0
riv=0x32
mcs1=14
repetition_number=0
harq=0
new_data_indicator1=0
rv_idx1=0
tpc_command=2
csi_request=0
srs_request=0
dci_sf_repetition_number=0
PUCCH @ SFN = 600.1
Captured log entry,
Message: format=2 n=24 br=1 cqi=1010 epre=-72.7
PUSCH @ SFN = 600.8
Captured log entry,
Message: harq=0 prb=6:4 symb=0:14 CW0: tb_len=125 mod=4 rv_idx=0 retx=0 crc=OK snr=21.7 epre=-76.0 ta=-0.1
MAC
Captured log entry,
Message: SBSR: lcg=0 b=0 LCID:1 len=2 LCID:1 len=9 LCID:2 len=23 PAD: len=82
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=6
RLC SRB1
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=5
PDCP SRB1
Captured log entry,
Message: SN=5
RrcConnectionReconfigurationComplete
Decoded RRC message,
{
message c1: rrcConnectionReconfigurationComplete: {
rrc-TransactionIdentifier 0,
criticalExtensions rrcConnectionReconfigurationComplete-r8: {
}
}
}
RLC SRB2
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=0
PDCP SRB2
Captured log entry,
Message: SN=0
UlInformationTransfer
Decoded RRC message,
{
message c1: ulInformationTransfer: {
criticalExtensions c1: ulInformationTransfer-r8: {
dedicatedInfoType dedicatedInfoNAS: '272A7DF20701074300035200C2'H
}
}
}
AttachComplete
Decoded NAS message,
Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x2 (Integrity protected and ciphered) Auth code = 0x2a7df207 Sequence number = 0x01 Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x0 (Plain NAS message, not security protected) Message type = 0x43 (Attach complete) ESM message container: Protocol discriminator = 0x2 (EPS Session Management) EPS bearer identity = 5 Procedure transaction identity = 0 Message type = 0xc2 (Activate default EPS bearer context accept)
RLC SRB1
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=6
RLC SRB2
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=1
MAC
Captured log entry,
Message: LCID:1 len=2 LCID:2 len=2 PAD: len=23
EPDCCH @ SFN = 601.2
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0x5
mcs1=15
repetition_number=0
harq=0
new_data_indicator1=1
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
EMM information
The last NAS message is EMM Information, sent on SRB2 after the attach. It uses the same downlink pattern: MPDCCH, then PDSCH at 601.4, then a HARQ-ACK on PUCCH at 601.8. The log ends with a PUSCH at 604.8 that carries an RLC status for SRB2.
EmmInformation
Decoded NAS message,
.. Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x2 (Integrity protected and ciphered) Auth code = 0x3ed52f66 Sequence number = 0x02 Protocol discriminator = 0x7 (EPS Mobility Management) Security header = 0x0 (Plain NAS message, not security protected) Message type = 0x61 (EMM information) Full name for network: Length = 16 Data = 81 c1 76 58 9e 9e bf cd 74 90 b3 4c bf bf e5 6b Short name for network: Length = 9 Data = 81 c1 76 58 9e 9e bf cd 74 Local time zone = 10 Universal time and local time zone: Data = 12 21 11 12 55 73 0a Network daylight saving time: Length = 1 Data = 00
DlInformationTransfer
Decoded RRC message,
{
message c1: dlInformationTransfer: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: dlInformationTransfer-r8: {
dedicatedInfoType dedicatedInfoNAS: '273ED52F66020761431081C176589E9EBFCD7490B34CBFBFE56B450...'H
}
}
}
PDSCH @ SFN = 601.4
Captured log entry,
Message: harq=0 k1=4 prb=5:1 CW0: tb_len=32 mod=4 rv_idx=
PDCP SRB2
Captured log entry,
Message: SN=0
RLC SRB2
Captured log entry,
Message: D/C=1 RF=0 P=1 FI=00 E=0 SN=0
MAC
Captured log entry,
Message: LCID:2 len=60 PAD: len=6
EPDCCH @ SFN = 601.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-1a
Data:
frequency_hopping=0
rb_alloc_bitmap=0xa
mcs1=15
repetition_number=0
harq=1
new_data_indicator1=1
rv_idx1=0
tpc_command=0
srs_request=0
harq_ack_offset=0
dci_sf_repetition_number=0
PDSCH @ SFN = 601.6
Captured log entry,
Message: harq=1 k1=4 prb=4:2 CW0: tb_len=69 mod=4 rv_idx=0
PUCCH @ SFN = 601.8
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=47.6 epre=-72.0
PUCCH @ SFN = 602.0
Captured log entry,
Message: format=1A n=38 br=1 ack=1 snr=48.6 epre=-72.0
PUCCH @ SFN = 604.0
Captured log entry,
Message: format=1 n=56 br=1 sr=1 snr=48.5 epre=-72.1
EPDCCH @ SFN = 604.4
Captured log entry,
Message: prb=0,1 ecce_index=0/8 L=4 n_rep=1 dci=6-0a
Data:
hopping_flag=0
riv=0x32
mcs1=14
repetition_number=0
harq=0
new_data_indicator1=1
rv_idx1=0
tpc_command=2
csi_request=0
srs_request=0
dci_sf_repetition_number=0
PUSCH @ SFN = 604.8
Captured log entry,
Message: harq=0 prb=6:4 symb=0:14 CW0: tb_len=125 mod=4 rv_idx=0 retx=0 crc=OK snr=21.3 epre=-76.0 ta=-0.4
MAC
Captured log entry,
Message: SBSR: lcg=0 b=0 LCID:2 len=2 PAD: len=118
RLC SRB2
Captured log entry,
Message: D/C=0 CPT=0 ACK_SN=1
The downlink pattern repeats : DCI 6-1A on MPDCCH, PDSCH two subframes later, and a HARQ-ACK on PUCCH four subframes after the PDSCH.The uplink pattern repeats : a scheduling request on PUCCH format 1, a DCI 6-0A on MPDCCH, and PUSCH four subframes after the grant.No repetition in this log : every MPDCCH shows n_rep=1, so the UE runs in good coverage.NAS rides on RRC information transfer : after the connection setup, DLInformationTransfer and ULInformationTransfer carry every NAS message.