NAS Protocol

Non-Access Stratum (NAS) Protocol

Based on 3GPP 24-301

The non-access stratum (NAS) described in the
present document forms the highest stratum
of the control plane between UE and MME at
the radio interface (reference point "LTE-Uu“)

See 3GPP TS 23.401 [10]).

Main functions of the protocols that are part of the NAS are:

- the support of mobility of the user equipment (UE); and

- the support of session management procedures to establish

and maintain IP connectivity between the UE and a packet
data network gateway (PDN GW).
 E-UTRAN EPS
UE eNB MME S-GW PDN-GW

NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDCP PDCP SCTP SCTP UDP UDP UDP UDP

RLC RLC IP IP IP IP IP IP

MAC MAC L2 L2 L2 L2 L2 L2

PHY PHY L1 L1 L1 L1 L1 L1
Functions :
E-UTRAN =

EPS =

UE =

eNodeB = eNB =

MME =

S-GW = Serving Gateway =

PDN-GW =
LTE Initial Attach Example :

When an UE
 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request
AIR
Initial UE Message AIA
ULR
ULA
Create Session Request
Activate Default EPS Bearer Context Request
Attach Acceptt Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.1 Attach with IMSI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response
 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request (PDN Connectivity Request)
Initial UE Message Create Session Request
Activate Default EPS Bearer Context Request
Attach Acceptt Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.2 Attach with GUTI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response

Detach Request Detach Request

Delete Session Request
Uplink NAS Transport Delete Session Response
Detach Accept Detach Accept
Downlink NAS Transport
UE Context Release Command
UE Context Release Complete
1 - The UE initiates the Attach procedure by the transmission of a
NAS Attach Request to the MME.
Attach Request message

3GPP 24-301 Version 8

1/2
2/2
Ethernet Port 49152 = 0C = Initial UE Message
Hexa C000
Attach Request in a
S1 Protocol
IP Initial UE Message S1 InitialUEMessage
Initial Context Setup Req.
PDN = Packet Data Network
SCTP Initial Context Setup Resp.
EPS = Evolved Packet System
UE Capability Information
Initiating Downlink NAS Transport
InitialUEMessage Uplink NAS Transport
Items
00 08 = 41 = Attach Request
eNB-UE-S1AP-id
EMM = EPS Mobility Management
Attach Request,
Attach Accept,
00 1A =
Attach Reject,
NAS-PDU Attach
Attach Complete
Request Detach Request,
S1 AP ESM Detach Accept
Message
D0 = PDN Connectivity Request
00 43 = TAI
ESM = EPS Session Mangement
PDN Connectivity Request
00 64 = PDN Connectivity Reject
EUTRAN-CGI Activate Default EPS Bearer Context Request
PDN Connectivity Reject
00 86 = PDN Disconnect Request
RRC-Estb-cause Deactivate EPS Bearer Context Request
PDN Disconnect Reject
 Port 49152 = Hexa C000
Ethernet Attach Request in a
IP 0C S1 InitialUEMessage
SCTP
The eNB UE S1AP ID is used
Initiating to uniquely identify the UE association over
0C = InitialUEMessage the S1 interface within the eNB
Items
00 08 =
eNB-UE-S1AP-id This information element is used
to uniquely identify a Tracking Area
00 1A =
NAS-PDU 41 = Attach
Request
S1 AP ESM This information element is used
Message
to globally identify a cell
00 43 = TAI
The purpose of the RRC Establishment Cause IE
00 64 = is to indicate to the MME the reason for RRC
EUTRAN-CGI Connection Establishment.
The encoding is
00 86 = emergency, highPriorityAccess,
RRC-Estb-cause mt-Access, mo-Signalling,
mo-Data, spare3, spare2, spare1}
 Port 49152 = Hexa C000
Ethernet Attach Request in a
IP S1 InitialUEMessage
SCTP
- Attach Type: EPS Attach
Initiating - IMSI or TMSI
0C = InitialUEMessage - Network Capability:
Items
Encryption Algorithms
00 08 =
eNB-UE-S1AP-id

00 1A =
NAS-PDU 41 = Attach
Request
S1 AP ESM - Procedure Transaction ID
Message
- Message: PDN Connectivity Request
- PDN Type: IPv4
00 43 = TAI
- Request Type: Initial Request
- Protocol Configuration Options:
00 64 =
EUTRAN-CGI PPP IPCP
DNS Server Address: 0.0.0.0
00 86 =
RRC-Estb-cause
 X7: 7 = EPS Mobility Management Message (EMM)
M, ½, V

0X: 0 = Plain NAS message, not security protected

M, ½, V

M, 1, V 41 = Attach Request
M, ½, V X1: 1 = EPS Attach

M, ½, V 7X: 0 = No key is available

M, 5-12, LV IMSI or GUTI (MCC, MMC and M-TMSI)

EPS Encryption Algorithms, EPS Integrity Algorithms,
M, 3-14, LV UMTS Encryption Algorithms, UMTS Integrity Algorithms, etc.

M, n, LV-E
PDN Connectivity Request message
EMM = EPS Mobility Management messages

41
EMM = EPS Mobility Management messages
9.9.3.21 NAS key set identifier

The NAS key set identifier is allocated by the network.

The NAS key set identifier information element is coded as shown

in figure 9.9.3.21.1 and table 9.9.3.21.1.

The NAS key set identifier is a type 1 information element.

9.9.3.12 EPS mobile identity

The purpose of the EPS mobile identity information element is to

provide either the IMSI or the GUTI.

The EPS mobile identity information element is coded as shown in

figures 9.9.3.12.1 and 9.9.3.12.2 and table 9.9.3.12.1.

The EPS mobile identity is a type 4 information element with a

minimum length of 3 octets and a maximum length of 13 octets.
GUTI
IMSI
 ESM = EPS session management messages

PDN connectivity request

 Port 49152 = Hexa C000
Ethernet PDN Connectivity Request, in a
IP Attach Request, in a
S1 InitialUEMessage
SCTP
Initiating
0C = InitialUEMessage
Items
ESM Message Container Length
00 08 =
EPS Bear ID Protoc. Discrim
eNB-UE-S1AP-id
Procedure Transaction ID
Message Type
00 1A = PDN Type Request Type
NAS-PDU 41 = Attach
Request
S1 AP ESM
Message

Protocol Configuration Options

00 43 = TAI

00 64 =
EUTRAN-CGI

00 86 =
RRC-Estb-cause
This message is sent by the UE to the network to initiate establishment of a PDN connection.

X2: 2 = EPS Session Management Message (ESM)

M, ½, V

M, ½, V 0X: 0 = No EPS bearer identity assigned

00: 00 = No Procedure transaction identity assigned

M, 1, V

M, 1, V D0 = PDN Connectivity Request

To indicate new connection, or established:
M, ½, V
Initial Request ? Or Handover ?

M, ½, V 1X: 1 = IPv4, 2 = IPv6, 3 = IPv4 and IPv6

O, 1, TV

O, 3-102, TLV

O, 3-253, TLV Configuration Request for PPP, DNS

 3GPP 24-008
Protocol Configuration Options in the PDN Connectivity Request

= 27
= 0E

= 000 = PPP

= 80 21 = PPP IPCP
= 0A

01 = Configuration Request
00 = Identifier
00 0A = Length
81 = Primary DNS Server Address
06 = Length
00
00
= IP Address
00
00
3GPP 24-007
9.9.4.5 ESM information transfer flag
The purpose of the ESM information transfer flag information
element is to indicate whether ESM information, i.e. protocol
configuration options or APN or both, is to be transferred security protected.
The ESM information transfer flag information element is coded as
shown in figure 9.9.4.5.1 and table 9.9.4.5.1.
The ESM information transfer flag is a type 1 information element.
9.5.1.1 Access point name
This IE is included in the message when the MS selects a specific
external network to be connected to.
10.5.6.3 Protocol configuration options
The purpose of the protocol configuration options information
element is to:
- transfer external network protocol options associated with a
PDP context activation, and

- transfer additional (protocol) data (e.g. configuration

parameters, error codes or messages/events) associated with
an external protocol or an application.
The protocol configuration options is a type 4 information element
with a minimum length of 3 octets and a maximum length of 253
octets.
The protocol configuration options information element is coded as
shown in figure 10.5.136/3GPP TS 24.008 and table 10.5.154/3GPP
TS 24.008.
3GPP 24-008
3GPP 24-008
 3GPP 24-008
Protocol Configuration Options in the PDN Connectivity Request

= 27
= 0E

= 000 = PPP

= 80 21 = PPP IPCP
= 0A

01 = Configuration Request
00 = Identifier
00 0A = Length
81 = Primary DNS Server Address
06 = Length
00
00
= IP Address
00
00
The UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY
REQUEST message contained in the ESM message container information element
to request PDN connectivity.
Attach Accept message

3GPP 24-301 Version 8

 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request
AIR
Initial UE Message AIA
ULR
ULA
Create Session Request
Activate Default EPS Bearer Context Request
Attach Acceptt Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.1 Attach with IMSI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response
 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request (PDN Connectivity Request)
Initial UE Message Create Session Request
Activate Default EPS Bearer Context Request
Attach Acceptt Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.2 Attach with GUTI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response

Detach Request Detach Request

Delete Session Request
Uplink NAS Transport Delete Session Response
Detach Accept Detach Accept
Downlink NAS Transport
UE Context Release Command
UE Context Release Complete
 Port 49152 = Hexa C000
Ethernet Attach Accept in a
IP S1 InitialContext
SCTP
SetupRequest
Initiating
09 = InitialContext The MME UE S1AP ID uniquely identifies the UE
SetupRequest association over the S1 interface within the MME
Items
00 00 =
The eNB UE S1AP ID uniquely identify the UE
MME-UE-S1AP-ID association over the S1 interface within the eNB
00 08 =
eNB-UE-S1AP-ID The UE Aggregate Maximum Bitrate is applicable for
00 42 = all Non-GBR bearers per UE which is defined for the
UEAggregatMaxBitrate Downlink and the Uplink direction and provided by
the MME to the eNB.
S1 AP 00 18 =
E-RABTobeSetup
ListCtxtSUReq 42 = The UE Security Capabilities IE defines
Attach ESM
Message
the supported algorithms for encryption
Accept and integrity protection in the UE.
00 6B =
UESecurityCapabilities The Security Key IE is used to apply security in
the eNB for different scenarios as defined in
00 49 = 3GPP 33-401 (Security Architecture).
SecurityKey
 Port 49152 = Hexa C000
Ethernet Attach Accept in a
IP S1 InitialContext
SCTP
SetupRequest
Initiating E-RAB-ID
09 = InitialContext
SetupRequest
Items E-RAB Level QoS Parameters
00 00 =
MME-UE-S1AP-ID
00 08 = Transport Layer Address
eNB-UE-S1AP-ID
00 42 = GTP-TEID
UEAggregatMaxBitrate

S1 AP 00 18 = NAS-PDU (Attach Accept)

E-RABTobeSetup
- Message Type = Attach Accept
ListCtxtSUReq 42 =
ESM - Attach Result = EPS Only
Attach
Accept
Message - GPRS Timer – T3412
- TAI List
00 6B = - ESM Message Container (Activate Default
UESecurityCapabilities
EPS Bearer Context Request)
00 49 = - EPS Mobile Identity
SecurityKey - GPRS Timer – T3402
- GPRS Timer – T3423
 Port 49152 = Hexa C000
Ethernet Attach Accept in a
IP S1 InitialContext
SCTP NAS-PDU SetupRequest
Initiating - Message Type = Attach Accept
09 = InitialContext
SetupRequest
- Attach Result = EPS Only
Items - GPRS Timer – T3412
00 00 = - TAI List
MME-UE-S1AP-ID - ESM Message Container
00 08 = - Procedure Transaction ID
eNB-UE-S1AP-ID
- Message: Activate Default EPS Bearer
00 42 =
UEAggregatMaxBitrate
Context Request
- EPS Quality of Service
S1 AP 00 18 =
- Access Point Name
E-RABTobeSetup
ListCtxtSUReq 42 = - PDN Address
Attach ESM - Protocol Configuration Options:
Message
Accept PPP ICP
DNS Server Address: 10.8.16.249
00 6B =
UESecurityCapabilities

00 49 = - EPS Mobile Identity

SecurityKey - GPRS Timer – T3402
- GPRS Timer – T3423
This message is sent by the network to the UE to indicate that the corresponding
attach request has been accepted.
EMM

42
 EPS session management messages

Activate Default EPS Bearer Context request

 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request
AIR
Initial UE Message AIA
ULR
ULA
Create Session Request
Activate Default EPS Bearer Context Request
Attach Acceptt Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.1 Attach with IMSI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response
 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request (PDN Connectivity Request)
Initial UE Message Create Session Request
Activate Default EPS Bearer Context Request
Attach Acceptt Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.2 Attach with GUTI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response

Detach Request Detach Request

Delete Session Request
Uplink NAS Transport Delete Session Response
Detach Accept Detach Accept
Downlink NAS Transport
UE Context Release Command
UE Context Release Complete
 Port 49152 = Hexa C000 Activate Default EPS Bearer Context Request
Ethernet
IP
Attach Accept in a
S1 InitialContext
SCTP SetupRequest
Initiating
09 = InitialContext
SetupRequest ESM Message Container Length
Items EPS Bear ID Protoc. Discrim
00 00 = Procedure Transaction ID
MME-UE-S1AP-ID
Message Type
00 08 =
eNB-UE-S1AP-ID EPS Quality of Service
00 42 =
UEAggregatMaxBitrate
Access Point Name
S1 AP 00 18 =
E-RABTobeSetup
ListCtxtSUReq 42 = PDN Address
Attach ESM
Message
Accept

00 6B =
UESecurityCapabilities

00 49 =
SecurityKey Protocol Configuration Options
This message is sent by the network to the UE to request activation of a default
EPS bearer context.
M, ½, V
M, ½, V
M, 1, V
M, 1, V
M, 2-10, LV
M, 2-101, LV
M, 6-14, LV
O, 3-4, TLV
O, 14-18, TLV

O, 2, TV
O, 1, TV
O, 3, TLV
O, 4-8, TLV
O, 2, TV

O, 3-253, TLV
3GPP 24-007
Quality of Service Class Identifier (QCI), octet 3 (see 3GPP TS 23.203 [7])
Bits
87654321

In UE to network direction and in network to UE direction:

00000000 Reserved
00000001 QCI 1
00000010 QCI 2
00000011 QCI 3
00000100 QCI 4
00000101 QCI 5
00000110 QCI 6
00000111 QCI 7
00001000 QCI 8
00001001 QCI 9
00001010
to Reserved
01111111
10000000
to Operator-specific QCIs
11111110
11111111 Reserved
Maximum bit rate for uplink, octet 4 (see 3GPP TS 23.107 [5])
Bits
87654321
In UE to network direction:
00000000 Subscribed maximum bit rate for uplink
In network to UE direction:
00000000 Reserved
In UE to network direction and in network to UE direction:
00000001 The maximum bit rate is binary coded in 8 bits, using a granularity
to of 1 kbps
00111111 giving a range of values from 1 kbps to 63 kbps in 1 kbps increments.
01000000 The maximum bit rate is 64 kbps + ((the binary coded value in
to 8 bits – 01000000) * 8 kbps)
01111111 giving a range of values from 64 kbps to 568 kbps in 8 kbps increments.
10000000 The maximum bit rate is 576 kbps + ((the binary coded value in
to 8 bits – 10000000) * 64 kbps)
11111110 giving a range of values from 576 kbps to 8640 kbps in 64 kbps increments.
11111111 0kbps
If the sending entity wants to indicate a maximum bit rate for uplink higher than 8640 kbps, it
shall set octet 4 to "11111110", i.e. 8640 kbps, and shall encode the value for the maximum bit
rate in octet 8.
Maximum bit rate for downlink, octet 5 (see 3GPP TS 23.107 [5])

Coding is identical to that of maximum bit rate for uplink.

If the sending entity wants to indicate a maximum bit rate for downlink higher than
8640 kbps, it shall set octet 5 to "11111110", i.e. 8640 kbps, and shall encode the value
for the maximum bit rate in octet 9.

In this version of the protocol, for messages specified in the present document, the
sending entity shall not request 0 kbps for both the maximum bit rate for downlink and
the maximum bit rate for uplink at the same time. Any entity receiving a request for
0 kbps in both the maximum bit rate for downlink and the maximum bit rate for uplink
shall consider that as a syntactical error (see clause 8 of 3GPP TS 24.008 [13]).
Guaranteed bit rate for uplink, octet 6 (see 3GPP TS 23.107 [5])

Coding is identical to that of maximum bit rate for uplink.

If the sending entity wants to indicate a guaranteed bit rate for uplink higher than
8640 kbps, it shall set octet 6 to "11111110", i.e. 8640 kbps, and shall encode the
value for the guaranteed bit rate in octet 10.
Guaranteed bit rate for downlink, octet 7 (see 3GPP TS 23.107 [5])

Coding is identical to that of maximum bit rate for uplink.

If the sending entity wants to indicate a guaranteed bit rate for downlink higher than
8640 kbps, it shall set octet 7 to "11111110", i.e. 8640 kbps, and shall encode the
value for the guaranteed bit rate in octet 11.
Maximum bit rate for uplink (extended), octet 8
Bits
87654321
In UE to network direction and in network to UE direction:
00000000 Use the value indicated by the maximum bit rate for uplink in octet 4.

For all other values: ignore the value indicated by the maximum bit rate for uplink in octet 4
and use the following value:
00000001 The maximum bit rate is 8600 kbps + ((the binary coded
to value in 8 bits) * 100 kbps),
01001010 giving a range of values from 8700 kbps to 16000 kbps in 100 kbps increment

01001011 The maximum bit rate is 16 Mbps + ((the binary coded

to value in 8 bits - 01001010) * 1 Mbps),
10111010 giving a range of values from 17 Mbps to 128 Mbps in 1 Mbps increments.

10111011 The maximum bit rate is 128 Mbps + ((the binary coded
to value in 8 bits - 10111010) * 2 Mbps),
11111010 giving a range of values from 130 Mbps to 256 Mbps in 2 Mbps increments.

The network shall map all other values not explicitly defined onto one of the values defined in
this version of the protocol. The network shall return a negotiated value which is explicitly
defined in this version of the protocol.
Maximum bit rate for downlink (extended), octet 9

This field is an extension of the maximum bit rate for downlink in octet 5. The coding is
identical to that of the maximum bit rate for uplink (extended).

The network shall map all other values not explicitly defined onto one of the values
defined in this version of the protocol. The network shall return a negotiated value
which is explicitly defined in this version of the protocol.
Guaranteed bit rate for uplink (extended), octet 10
Bits
87654321
In UE to network direction and in network to UE direction:
00000000 Use the value indicated by the guaranteed bit rate for uplink in octet 6.

For all other values: ignore the value indicated by the guaranteed bit rate for uplink in octet 6
and use the following value:
00000001 The guaranteed bit rate is 8600 kbps + ((the binary coded
to value in 8 bits) * 100 kbps),
01001010 giving a range of values from 8700 kbps to 16000 kbps in 100 kbps increment

01001011 The guaranteed bit rate is 16 Mbps + ((the binary coded

to value in 8 bits - 01001010) * 1 Mbps),
10111010 giving a range of values from 17 Mbps to 128 Mbps in 1 Mbps increments.

10111011 The guaranteed bit rate is 128 Mbps + ((the binary coded
to value in 8 bits - 10111010) * 2 Mbps),
11111010 giving a range of values from 130 Mbps to 256 Mbps in 2 Mbps increments.

The network shall map all other values not explicitly defined onto one of the values defined in
this version of the protocol. The network shall return a negotiated value which is explicitly
defined in this version of the protocol.
Guaranteed bit rate for downlink (extended), octet 11

This field is an extension of the guaranteed bit rate for downlink in octet 7.
The coding is identical to that of guaranteed bit rate for uplink (extended).

The network shall map all other values not explicitly defined onto one of the
values defined in this version of the protocol. The network shall return a
negotiated value which is explicitly defined in this version of the protocol.
9.5.1.1 Access point name
This IE is included in the message when the MS selects a specific
external network to be connected to.
MME-UE-S1AP-ID ::= INTEGER (0..4294967295)

ENB-UE-S1AP-ID ::= INTEGER (0..16777215)

UEAggregateMaximumBitrate ::= SEQUENCE {
uEaggregateMaximumBitRateDL BitRate,
uEaggregateMaximumBitRateUL BitRate,
iE-Extensions ProtocolExtensionContainer { {UEAggregate-MaximumBitrates-ExtIEs} } OPT,
...
}
 3GPP 24-008
Protocol Configuration Options in the Activate Default EPS Bearer Context request

= 27
= 0E

= 000 = PPP

= 80 21 = PPP IPCP
= 0A

03 = Configuration NAK
00 = Identifier
00 0A = Length
81 = Primary DNS Server Address
06 = Length
0a
08
= IP Address
10
f9
Attach Complete message
 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request
AIR
Initial UE Message AIA
ULR
ULA
Create Session Request
Activate Default EPS Bearer Context Request
Attach Acceptt Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.1 Attach with IMSI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response
 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request
Create Session Request
Initial UE Message
Activate Default EPS Bearer Context Request
Attach Accept Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.2 Attach with GUTI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response

Detach Request Detach Request

Delete Session Request
Uplink NAS Transport Delete Session Response
Detach Accept Detach Accept
Downlink NAS Transport
UE Context Release Command
UE Context Release Complete
 Port 49152 = Hexa C000
Ethernet Attach Complete in a
IP S1 UplinkNASTransport
SCTP
Initiating The MME UE S1AP ID uniquely identifies the UE
0D=UplinkNASTransport association over the S1 interface within the MME
Items
00 00 =
The eNB UE S1AP ID uniquely identify the UE
MME-UE-S1AP-id association over the S1 interface within the eNB
00 08 =
eNB-UE-S1AP-id

S1 AP 00 1A = - Procedure Transaction ID
NAS-PDU 43 = Attach - Message: Activate Default EPS Bearer
Complete
Context Accept
ESM
Message
- PDN Type: IPv4
- Request Type: Initial Request
00 64 = - Protocol Configuration Options:
E-UTRAN-CGI PPP ICP
DNS Server Address: 0.0.0.0
00 43 = TAI
0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f ...e/6.@CiJU....
0010 08 00 45 ba 00 68 00 8d 40 00 40 84 9e af 0a 0b ..E..h..@.@.....
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 8b bd C...C.....@g.b..
0030 07 97 00 03 00 45 47 5c 4b af 00 03 00 05 00 00 .....EG\K.......
0040 00 12 00 0d 40 31 00 00 05 00 00 00 02 00 80 00 ....@1..........
0050 08 00 02 00 06 00 1a 00 08 07 07 43 00 03 52 00 ...........C..R.
0060 c2 00 64 40 08 00 62 f2 20 00 00 50 10 00 43 40 ..d@..b. ..P..C@
0070 06 00 62 f2 20 00 7b 00 00 00
00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f
08 00 45 ba 00 68 00 8d 40 00 40 84 9e af 0a 0b
43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 8b bd
07 97 00 03 00 45 47 5c 4b af 00 03 00 05 00 00
00 12
00 0d 40 31 00 00
05
00 00 00 02 00 80
00 08 00 02 00 06
00 1a 00 08 07 07 43 00 03 52 00 c2
00 64 40 08 00 62 f2 20 00 00 50 10
00 43 40 06 00 62 f2 20 00 7b
00 00 00
 Port 49152 = Hexa C000
Ethernet Attach Complete in a
IP 0D S1 UplinkNASTransport
SCTP
I/O Msg Crit Lgth
00 00 Items
Item 0 = MME-UE-S1AP-id

Item 1 = eNB-UE-S1AP-id

Item 2 : 00
1A = NAS-PDU Item Length = 00 08h = 08 PDU Length=7
SecHdr ProtDisc Msg=AttachCm NASKyId/AttTyp Length = 03
S1 AP EPS ber id ProtDisc Procedure TransID Message Type
Item 2 =
00 1A = NAS-PDU

Item 3 = EUTRAN-CGI
Item 4 = TAI
(Based on file 2.1 Attach with IMSI Diameter 318 316)
EMM

43
EMM
 EPS session management messages

Activate Default EPS Bearer Context accept

3GPP 24-007
8.2 EPS mobility management messages Page 165
8.2.1 Attach accept 165
8.2.2 Attach complete 167
8.2.3 Attach reject 168
8.2.4 Attach request 168
8.2.5 Authentication failure 170
8.2.6 Authentication reject 171
8.2.7 Authentication request 171
8.2.8 Authentication response 171
8.2.9 CS service notification 172
8.2.10 Detach accept 173
8.2.11 Detach request 174
8.2.12 Downlink NAS Transport 175
8.2.13 EMM information 175
8.2.14 EMM status 176
8.2.15 Extended service request 177
8.2 EPS mobility management messages (Cont.) 165
8.2.16 GUTI reallocation command 177
8.2.17 GUTI reallocation complete 178
8.2.18 Identity request 178
8.2.19 Identity response 179
8.2.20 Security mode command 179
8.2.21 Security mode complete 180
8.2.22 Security mode reject 181
8.2.23 Security protected NAS message 181
8.2.24 Service reject 182
8.2.25 Service request 182
8.2.26 Tracking area update accept 183
8.2.27 Tracking area update complete 185
8.2.28 Tracking area update reject 186
8.2.29 Tracking area update request 186
8.2.30 Uplink NAS Transport 189
8.3 EPS session management messages 189

8.3.1 Activate dedicated EPS bearer context accept 189

8.3.2 Activate dedicated EPS bearer context reject 190
8.3.3 Activate dedicated EPS bearer context request 191
8.3.4 Activate default EPS bearer context accept 192
8.3.5 Activate default EPS bearer context reject 192
8.3.6 Activate default EPS bearer context request 193

8.3.7 Bearer resource allocation reject 195

8.3.8 Bearer resource allocation request 195
8.3.9 Bearer resource modification reject 196
8.3.10 Bearer resource modification request 197

8.3.11 Deactivate EPS bearer context accept 198

8.3.12 Deactivate EPS bearer context request 198
8.3 EPS session management messages (Cont.) 189

8.3.13 ESM information request 199

8.3.14 ESM information response 199
8.3.15 ESM status 200

8.3.16 Modify EPS bearer context accept 200

8.3.17 Modify EPS bearer context reject 201
8.3.18 Modify EPS bearer context request 202

8.3.19 PDN connectivity reject 203

8.3.20 PDN connectivity request 204
8.3.21 PDN disconnect reject 204
8.3.22 PDN disconnect request 205
Message EXAMPLES
Attach Request examples
1/2
2/2
 Attach with IMSI
Attach Request Alemania

0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f
0010 08 00 45 ba 00 84 00 8a 40 00 40 84 9e 96 0a 0b
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 41 17
0030 b9 d3 00 03 00 62 47 5c 4b ac 00 03 00 02 00 00
0040 00 12 00 0c 40 4e 00 00 05 00 08 00 02 00 06 00
0050 1a 00 26 25 07 41 71 08 29 26 20 65 00 10 27 04
0060 02 e0 e0 00 14 02 01 d0 11 27 0e 80 80 21 0a 01
0070 00 00 0a 81 06 00 00 00 00 00 43 00 06 00 62 f2
0080 20 00 7b 00 64 40 08 00 62 f2 20 00 00 50 10 00
0090 86 40 01 30 00 00
00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f
Attach with IMSI
08 00 45 ba 00 84 00 8a 40 00 40 84 9e 96 0a 0b
43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 41 17
b9 d3 00 03 00 62 47 5c 4b ac 00 03 00 02 00 00
00 12
00 0c 40 4e 00 00
05 Items Attach Request
00 08 00 02 00 06
00 1a 00 26
25 (25 = PDU Length) IMSI
07 (0 = , 7 = )
41
71 (7 = , 1 = ) Network Capability
08 29 26 20 65 00 10 27 04
02 e0 e0 ESM Message
00 14 02 01 (0 = , 2 = , 01 = ) PDN Connectivity Request
d0
11 (1 = , 1 = )
27 0e 80
80 21 0a 01 00 00 0a 81 06 00 00 00 00
00 43 00 06 00 62 f2 20 00 7b
00 64 40 08 00 62 f2 20 00 00 50 10
00 86 40 01 30
00 00
 Port 49152 = Hexa C000
Ethernet Attach Request in a
IP 0C S1 InitialUEMessage
SCTP
I/O Msg Crit Lgth
00 00 Items
Item 0 = eNB-UE-S1AP-id Item 1 : 00
1A = NAS-PDU Item Length = 00 26h = 38 PDU Length
SecHdr ProtDisc Msg=AttachRq NASKyId/AttTyp Identity Length
1st Digt oe Type 3rd Digit/2nd Dig
14th Dig/15th Dig

NtwCap length ESM Message

Item 1 =
S1 AP 00 1A = NAS-PDU Container length EPS ber id ProtDisc Procedure TransID Message Type

PDN Type Req Typ Protocol Config=27 Length = 0E Conf Prot=PPP

Protocol ID = IPCP Length = 0A 01 = Config Req

ID Length DNS Address

Length = 06 IP Address

IP Address
Item 2 = TAI
Item 3 = EUTRAN-CGI
Item 4 = RRC-Estb-cause

(Based on file 2.1 Attach with IMSI Diameter 318 316)

 Attach with GUTI

0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f ...e/6.@CiJU....
0010 08 00 45 ba 00 8c 02 95 40 00 40 84 9c 83 0a 0b ..E.....@.@.....
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 b3 04 C...C.....@g.b..
0030 d0 8c 00 03 00 6b 47 5c 4b d3 00 03 00 10 00 00 .....kG\K.......
0040 00 12 00 0c 40 57 00 00 05 00 08 00 02 00 0f 00 ....@W..........
0050 1a 00 2f 2e 07 41 71 0b f6 62 f2 20 00 01 01 c3 ../..Aq..b. ....
0060 40 00 14 02 e0 e0 00 14 02 01 d0 11 27 0e 80 80 @...........'...
0070 21 0a 01 00 00 0a 81 06 00 00 00 00 52 62 f2 20 !...........Rb.
0080 00 7b 00 43 00 06 00 62 f2 20 00 7b 00 64 40 08 .{.C...b. .{.d@.
0090 00 62 f2 20 00 00 50 10 00 86 40 01 30 00 .b. ..P...@.0.
00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f
08 00 45 ba 00 8c 02 95 40 00 40 84 9c 83 0a 0b Attach with GUTI
43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 b3 04
d0 8c 00 03 00 6b 47 5c 4b d3 00 03 00 10 00 00 00 12
00 0c 40 57 00 00
05 Items
00 08 00 02 00 0f Attach Request
00 1a 00 2f
2e (2e = PDU Length)
07 (0 = , 7 = ) GUTI
41
71 (7 = , 1 = )
0b f6 62 f2 20 00 01 01 c3 40 00 14 Network Capability
02 e0 e0 ESM Message
00 14 02 01 (0 = , 2 = , 01 = )
d0
PDN Connectivity Request
11 (1 = , 1 = )
27 0e 80
80 21 0a 01 00 00 0a 81 06 00 00 00 00
52 62 f2 20 00 7b ((Last visited) Tracking Area Identity = )
00 43 00 06 00 62 f2 20 00 7b
00 64 40 08 00 62 f2 20 00 00 50 10
00 86 40 01 30
00
 Attach Request Curitiba

0000 00 13 5f 21 b3 c0 00 40 43 6f 6d e9 81 00 82 8d .._!...@Com.....
0010 08 00 45 8a 00 a0 03 1f 40 00 40 84 f6 95 0a 34 ..E.....@.@....4
0020 15 9b 0a 34 15 99 8e 3c 8e 3c 44 fd 60 16 34 a1 ...4...<.<D.`.4.
0030 4e 2a 00 03 00 7e 97 b6 00 4b 00 01 00 00 00 00 N*...~...K......
0040 00 12 00 0c 40 6a 00 00 05 00 08 00 02 00 7f 00 ....@j..........
0050 1a 00 42 41 07 41 72 08 79 42 99 10 11 00 01 30 ..BA.Ar.yB.....0
0060 04 e0 e0 c0 40 00 20 02 01 d0 11 27 1a 80 80 21 ....@. ....'...!
0070 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 ................
0080 00 00 0d 00 00 0a 00 5c 0a 00 31 03 e5 e0 34 90 .......\..1...4.
0090 11 03 57 58 a6 00 43 00 06 00 27 f4 99 00 02 00 ..WX..C...'.....
00a0 64 40 08 00 27 f4 99 00 00 10 20 00 86 40 01 30 d@..'..... ..@.0
00b0 00 00
00 13 5f 21 b3 c0 00 40 43 6f 6d e9 81 00 82 8d
Attach Request Curitiba
08 00 45 8a 00 a0 03 1f 40 00 40 84 f6 95 0a 34
15 9b 0a 34 15 99 8e 3c 8e 3c 44 fd 60 16 34 a1
4e 2a 00 03 00 7e 97 b6 00 4b 00 01 00 00 00 00 00 12
00 0c 40 6a 00 00
05 Items
00 08 00 02 00 7f Attach Request
00 1a 00 42
41 07 (0 = , 7 = )
41 72 (7 = , 2 = ) IMSI
08 79 42 99 10 11 00 01 30 Network Capability
04 e0 e0 c0 40 ESM Message
00 20 02 01 (0 = , 2 = , 01 = )
d0 11 (1 = , 1 = ) PDN Connectivity Request
27 1a 80
80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00
00 0d 00 00 0a 00
5c 0a 00 (DRX parameter = )
31 03 e5 e0 34 (MS Network Capability = )
90 (TMSI-Status = )
11 03 57 58 a6 (Mobile Station Classmark 2 = )
00 43 00 06 00 27 f4 99 00 02
00 64 40 08 00 27 f4 99 00 00 10 20
00 86 40 01 30
 Felipe Giraldo

RAW DATA:

0000: 00 0C 40 3E 00 00 05 00 08 00 02 00 01 00 1A 00 ................
0010: 16 15 07 41 71 08 39 01 20 18 00 01 00 00 02 80 ...Aq.9.........
0020: 80 00 04 02 01 D0 11 00 43 00 06 00 13 00 82 00 ........C.......
0030: 01 00 64 40 08 00 13 00 82 3E 80 3E 80 00 86 40 ..d.............
0040: 01 40 ..
 Felipe Giraldo

00 0C 40 3E 00 00
05 Items
00 08 00 02 00 01 Attach Request
00 1A 00 16
15
07 IMSI
41
71 (7 = , 1 = )
Network Capability
08 39 01 20 18 00 01 00 00
02 80 80 ESM Message
00 04 02 01 (0 = , 2 = , 01 = )
D0
11 (1 = , 1 = ) PDN Connectivity Request
00 43 00 06 00 13 00 82 00 01
00 64 40 08 00 13 00 82 3E 80 3E 80
00 86 40 01 40
Attach Accept examples
 Attach with IMSI

0000 00 40 43 69 4a 55 00 a0 a5 65 2f 36 81 00 04 8f
0010 08 00 45 02 00 e4 ea 99 40 00 40 84 b4 de 0a 0b
0020 43 02 0a 0b 43 04 c0 00 c0 00 d0 a9 0a a7 ee a0
0030 21 18 00 03 00 c3 3c c3 c0 9b 00 03 00 02 00 00
0040 00 12 00 09 00 80 ae 00 00 06 00 00 00 02 00 80
0050 00 08 00 02 00 06 00 42 00 06 08 ad 98 20 82 32
0060 00 18 00 64 00 00 34 00 5f 45 00 07 04 0f 80 ac
0070 18 06 d3 09 00 00 3c 50 07 42 01 49 06 40 62 f2
0080 20 00 7b 00 32 52 01 c1 05 07 ff ff ff ff 12 08
0090 69 6e 74 65 72 6e 65 74 03 6e 67 32 04 6d 6e 65 internet.ng2.mne
00a0 74 05 01 ac 1b 85 19 27 0e 80 80 21 0a 03 00 00
00b0 0a 81 06 0a 08 10 f9 50 0b f6 62 f2 20 00 01 01
00c0 c3 40 00 13 17 2c 59 49 00 6b 00 05 00 00 00 00
00d0 00 00 49 00 20 00 00 00 00 00 00 00 00 00 00 00
00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00f0 00 00 00 00 00 00
00 40 43 69 4a 55 00 a0 a5 65 2f 36 81 00 04 8f Attach with IMSI
08 00 45 02 00 e4 ea 99 40 00 40 84 b4 de 0a 0b
43 02 0a 0b 43 04 c0 00 c0 00 d0 a9 0a a7 ee a0
21 18 00 03 00 c3 3c c3 c0 9b 00 03 00 02 00 00
00 12 00 09 00 80 ae 00 00
06 Items
00 00 00 02 00 80
00 08 00 02 00 06
00 42 00 06 08 ad 98 20 82 32
00 18 00 64 00 00 34 00 5f 45 00 07 04 0f 80 ac 18 06 d3
09 00 00 3c
50 07 42 01
49
06 40 62 f2 20 00 7b
00 32 52 01 c1 05 07 ff ff ff ff
12 08 69 6e 74 65 72 6e 65 74 03 6e 67 32 04 6d 6e 65 74
05 01 ac 1b 85 19
27 0e 80 80 21 0a 03 00 00 0a 81 06 0a 08 10 f9
50 0b f6 62 f2 20 00 01 01 c3 40 00 13
17 2c
59 49
00 6b 00 05 00 00 00 00 00
00 49 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ESM Message Container Content
Attach Accept
Activate Default EPS Bearer Context Request
50 (PDU Length)
07 (0 = Security Header Type, 7 = Protocol Discrim)
42
01 (0 = Spare, 1 = EPS Attach Result)
49 T3412 GPRS Timer
06 40 62 f2 20 00 7b TAI List
Access Point Name
00 32 52 01 c1 05 07 ff ff ff ff
12 08 69 6e 74 65 72 6e 65 74 03 6e 67 32 04 6d 6e 65 74
05 01 ac 1b 85 19
PDN Address
27 0e
80 Protocol Configuration Options
80 21 0a 03 00 00 0a 81 06 0a 08 10 f9
50 0b f6 62 f2 20 00 01 01 c3 40 00 13 DNS Address
17 2c
59 49 EPS Mobile Identity (GUTI)
T3402 GPRS Timer MCC, MNC, MME, M-TMSI
T3423 GPRS Timer
 Port 49152 = Hexa C000 09
Ethernet InitialContextSetupRq
Init/Outco Msg Type Criticality Length
IP Length 00 00 06 Items
(with Attach Accept)
Item 0 Id = 00 00 Criticality Length=02 00 00 = MME-UE-S1AP-ID
SCTP Item 1 = 00 08 00 08 = eNB-UE-S1AP-ID
Criticality Length=02
Item 2 Id = 00 42 Criticality Length=06 00 42 = UEAggregateMaximum
Bitrate
Item 3 = 00 18 00 18 = E-RABToBeSetupListCtxt
Criticality Length=64 SUReq

S1 AP Item 4 id= 00 6B 00 6B = UESecurityCapabilities

Criticality Length=05
Item 5
Id = 00 49 Criticality Length=20 00 49 = SecurityKey

Padding

(Based on file 2.1 ATTACH_WITH_IMSI 318 316

00 34 = E-RABToBeSetupItemCtxtSUReq
00 34 Critic = 00 Length = 5F
00 18 = E-RABToBeSetupListCtxtSUReq ERABId = 5 ERABlevelQoSParameters = 00 07 04
00 80 Transport Layer Address
AC 18 06 D3 GTP-ID
09 00 00 3c Length = 50 SecHr/ProtD
42=AttachAc SP/AttRslt GPRS Timer Length TAI
TAI
Item 3 = 00 18 Length ESM
Criticality Length=64 E-RAB 00 SecHr/ProtD ProcedTID C1 =Activate Length=5
EPS Quality of Service
Length=12

Access Point Name

Length=5 PDN Address

27=PConfO Length=E

50 =GUTI Length=0B
 Attach with GUTI

0000 00 40 43 69 4a 55 00 a0 a5 65 2f 36 81 00 04 8f .@CiJU...e/6....
0010 08 00 45 02 00 d8 ec 94 40 00 40 84 b2 ef 0a 0b ..E.....@.@.....
0020 43 02 0a 0b 43 04 c0 00 c0 00 d0 a9 0a a7 ef ed C...C...........
0030 87 b0 00 03 00 b5 3c c3 c0 af 00 03 00 08 00 00 ......<.........
0040 00 12 00 09 00 80 a0 00 00 06 00 00 00 02 00 89 ................
0050 00 08 00 02 00 0f 00 42 00 06 08 ad 98 20 82 32 .......B..... .2
0060 00 18 00 56 00 00 34 00 51 45 00 07 04 0f 80 ac ...V..4.QE......
0070 18 06 d3 09 00 00 3e 42 07 42 01 49 06 40 62 f2 ......>B.B.I.@b.
0080 20 00 7b 00 24 52 01 c1 05 07 ff ff ff ff 04 03 .{.$R..........
0090 6c 74 65 05 01 ac 1b 85 1b 27 0e 80 80 21 0a 03 lte......'...!..
00a0 00 00 0a 81 06 0a 08 10 f9 50 0b f6 62 f2 20 00 .........P..b. .
00b0 01 01 c3 40 00 15 17 2c 59 49 00 6b 00 05 00 00 ...@...,YI.k....
00c0 00 00 00 00 49 00 20 00 00 00 00 00 00 00 00 00 ....I. .........
00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00e0 00 00 00 00 00 00 00 00 00 00 ..........
00 40 43 69 4a 55 00 a0 a5 65 2f 36 81 00 04 8f Attach with GUTI
08 00 45 02 00 d8 ec 94 40 00 40 84 b2 ef 0a 0b
43 02 0a 0b 43 04 c0 00 c0 00 d0 a9 0a a7 ef ed
87 b0 00 03 00 b5 3c c3 c0 af 00 03 00 08 00 00
00 12 00 09 00 80 a0 00 00
06 Items
00 00 00 02 00 89
00 08 00 02 00 0f
00 42 00 06 08 ad 98 20 82 32
00 18 00 56 00 00 34 00 51 45 00 07 04 0f 80 ac 18 06 d3
09 00 00 3e
42 07 42 01
49 T3412 GPRS Timer
06 40 62 f2 20 00 7b TAI List
00 24 52 01 c1 05 07 ff ff ff ff Activ. Default EPS Bearer Context Req.
04 03 6c 74 65 Access Point Name
05 01 ac 1b 85 1b PDN Address
27 0e 80 80 21 0a 03 00 00 0a 81 06 0a 08 10 f9
50 0b f6 62 f2 20 00 01 01 c3 40 00 15 EPS Mobile Identity (GUTI)
17 2c T3402 GPRS Timer
59 49 T3423 GPRS Timer Protocol Configuration Options
00 6b 00 05 00 00 00 00 00
00 49 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
 Felipe Giraldo

RAW DATA:
0000: 00 09 00 80 A8 00 00 06 00 00 00 03 40 36 0F 00 .............6..
0010: 08 00 02 00 01 00 42 00 0A 18 03 93 87 00 60 01 ......B.........
0020: C9 C3 80 00 18 00 59 00 00 34 00 54 45 40 09 06 ......Y..4.TE...
0030: 00 00 00 00 00 00 00 00 0F 80 0A CB 79 E1 00 74 ............y..t
0040: B6 25 3D 27 00 00 00 00 01 07 42 01 54 06 40 13 ..........B.T...
0050: 80 20 00 01 00 1B 52 01 C1 01 09 09 08 6E 65 74 ......R......net
0060: 68 61 77 6B 31 05 01 0A DC 06 03 5E 04 FE FE 76 hawk1..........v
0070: 58 50 0B F6 13 80 20 80 01 01 C0 04 AF 9C 17 2C XP..............
0080: 00 6B 00 05 00 00 00 00 00 00 49 00 20 F1 06 58 .k........I....X
0090: D6 36 31 3A E4 42 53 1F 4D 05 35 73 3E 04 D4 CB .61..BS.M.5s....
00A0: 82 37 7C 28 98 88 E2 50 2A CC 30 49 D7 .7.....P..0I.
RAW DATA:
00 09 00 80 A8 00 00 Felipe Giraldo
6 Items
00 00 00 03 40 36 0F
00 08 00 02 00 01
00 42 00 0A 18 03 93 87 00 60 01 C9 C3 80
00 18 00 59 00 00 34 00 54 45 40 09 06 00 00
00 00 00 00 00 00 0F 80 0A CB 79 E1 00 74 B6 25
3D 27
00 00 00 00 01 07
42 Attach Accept
01 Result
54 GPRS Timer ESM Message Container
06 40 13 80 20 00 01 TAI
00 1B 52 01
C1 01 09 Activate Default EPS Bearer Context Request - EPS QoS
09 08 6E 65 74 68 61 77 6B 31
05 01 0A DC 06 03
5E 04 FE FE 76 58
50 0B F6 13 80 20 80 01 01 C0 04 AF 9C
17 2C
00 6B 00 05 00 00 00 00 00
00 49 00 20 F1 06 58 D6 36 31 3A E4 42 53 1F 4D 05 35 73 3E 04 D4 CB
82 37 7C 28 98 88 E2 50 2A CC 30 49 D7
Attach Complete examples
 Attach with IMSI

0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f ...e/6.@CiJU....
0010 08 00 45 ba 00 68 00 8d 40 00 40 84 9e af 0a 0b ..E..h..@.@.....
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 8b bd C...C.....@g.b..
0030 07 97 00 03 00 45 47 5c 4b af 00 03 00 05 00 00 .....EG\K.......
0040 00 12 00 0d 40 31 00 00 05 00 00 00 02 00 80 00 ....@1..........
0050 08 00 02 00 06 00 1a 00 08 07 07 43 00 03 52 00 ...........C..R.
0060 c2 00 64 40 08 00 62 f2 20 00 00 50 10 00 43 40 ..d@..b. ..P..C@
0070 06 00 62 f2 20 00 7b 00 00 00 ..b. .{...
00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f Attach with IMSI
08 00 45 ba 00 68 00 8d 40 00 40 84 9e af 0a 0b
43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 8b bd
07 97 00 03 00 45 47 5c 4b af 00 03
00 05 00 00 00 12 00
0d 40 31 00 00
05 Items
00 00 00 02 00 80 Attach Complete
00 08 00 02 00 06
00 1a 00 08 PDU Length
07
07 (0 = Security Header Type NAS Plain Not sec protect , 7 = Prot Discrim EMM)
43
00 03 ESM Message Container
52 (5 = EPS Bearer Identity, 2 = Protocol Discriminator ESM)
00 (Procedure Transaction Identity)
c2 Activate default EPS bearer context accept
00 64 40 08 00 62 f2 20 00 00 50 10
00 43 40 06 00 62 f2 20 00 7b
00 00 00
 Attach with GUTI

0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f ...e/6.@CiJU....
0010 08 00 45 ba 00 68 02 98 40 00 40 84 9c a4 0a 0b ..E..h..@.@.....
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 9e 19 C...C.....@g.b..
0030 c0 a6 00 03 00 45 47 5c 4b d6 00 03 00 13 00 00 .....EG\K.......
0040 00 12 00 0d 40 31 00 00 05 00 00 00 02 00 89 00 ....@1..........
0050 08 00 02 00 0f 00 1a 00 08 07 07 43 00 03 52 00 ...........C..R.
0060 c2 00 64 40 08 00 62 f2 20 00 00 50 10 00 43 40 ..d@..b. ..P..C@
0070 06 00 62 f2 20 00 7b 00 00 00 ..b. .{...
 Attach with GUTI

00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f
08 00 45 ba 00 68 02 98 40 00 40 84 9c a4 0a 0b
43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 9e 19
c0 a6 00 03 00 45 47 5c 4b d6 00 03 00 13 00 00
00 12 00 0d 40 31 00 00
05 Items
00 00 00 02 00 89
00 08 00 02 00 0f
00 1a 00 08 07 07 Attach Complete
43
00 03 ESM Message Container
52 (5 = EPS Bearer Identity, 2 = Protocol Discriminator ESM)
00 (Procedure Transaction Identity)
c2 Activate default EPS bearer context accept
00 64 40 08 00 62 f2 20 00 00 50 10
00 43 40 06 00 62 f2 20 00 7b 00 00 00
 Felipe Giraldo

RAW DATA:
0000: 00 0D 40 38 00 00 05 00 00 00 03 40 36 0F 00 08 ...8........6...
0010: 00 02 00 01 00 1A 00 0E 0D 27 00 00 00 00 01 07 ................
0020: 43 00 03 52 00 C2 00 64 40 08 00 13 00 82 3E 80 C..R...d........
0030: 3E 80 00 43 40 06 00 13 00 82 00 01 ...C........
 Felipe Giraldo

RAW DATA:

00 0D 40 38 00 00
05 Items
00 00 00 03 40 36 0F
00 08 00 02 00 01
00 1A 00 0E 0D 27 00 00 00 00 01 07 Attach Complete
43
00 03 ESM Message Container
52 (5 = EPS Bearer Identity, 2 = Protocol Discriminator ESM)
00 (Procedure Transaction Identity)
C2 Activate default EPS bearer context accept
00 64 40 08 00 13 00 82 3E 80 3E 80
00 43 40 06 00 13 00 82 00 01
Detach Request examples
 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request
Create Session Request
Initial UE Message
Activate Default EPS Bearer Context Request
Attach Accept Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.2 Attach with GUTI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response

Detach Request Detach Request

Delete Session Request
Uplink NAS Transport Delete Session Response
Detach Accept Detach Accept
Downlink NAS Transport
UE Context Release Command
UE Context Release Complete
0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f ...e/6.@CiJU....
0010 08 00 45 ba 00 70 02 a0 40 00 40 84 9c 94 0a 0b ..E..p..@.@.....
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 ed bb C...C.....@g.b..
0030 3f b5 00 03 00 4d 47 5c 4b d7 00 03 00 14 00 00 ?....MG\K.......
0040 00 12 00 0d 40 39 00 00 05 00 00 00 02 00 89 00 ....@9..........
0050 08 00 02 00 0f 00 1a 00 10 0f 07 45 71 0b f6 62 ...........Eq..b
0060 f2 20 00 01 01 c3 40 00 15 00 64 40 08 00 62 f2 . ....@...d@..b.
0070 20 00 00 50 10 00 43 40 06 00 62 f2 20 00 7b 00 ..P..C@..b. .{.
0080 00 00 ..
Detach Accept examples
 UE eNB MME S-GW PDN-GW
HSS
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request
Attach Request Attach Request
Create Session Request
Initial UE Message
Activate Default EPS Bearer Context Request
Attach Accept Attach Acceptt Create Session Response
Initial Context Setup Request
(Based on 2.2 Attach with GUTI)
Initial Context Setup Response
UE Capability Information
Activate Default EPS Bearer Context Accept
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response

Detach Request Detach Request

Delete Session Request
Uplink NAS Transport Delete Session Response
Detach Accept Detach Accept
Downlink NAS Transport
UE Context Release Command
UE Context Release Complete
0000 00 40 43 69 4a 55 00 a0 a5 65 2f 36 81 00 04 8f .@CiJU...e/6....
0010 08 00 45 02 00 4c ec 9d 40 00 40 84 b3 72 0a 0b ..E..L..@.@..r..
0020 43 02 0a 0b 43 04 c0 00 c0 00 d0 a9 0a a7 1c 55 C...C..........U
0030 64 97 00 03 00 2a 3c c3 c0 b0 00 03 00 09 00 00 d....*<.........
0040 00 12 00 0b 40 16 00 00 03 00 00 00 02 00 89 00 ....@...........
0050 08 00 02 00 0f 00 1a 00 03 02 07 46 00 00 ...........F..
Service Request examples
 UE eNB MME S-GW PDN-GW
NAS NAS HSS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request

Attach Request Attach Request
Initial UE Message Create Session Request
Activate Default EPS Bearer Context Request
Attach Accept Attach Accept Create Session Response
Initial Context Setup Request
(Based on 2.7
Initial Context Setup Response Network initiated
UE Capability Information Service Request
Activate Default EPS Bearer Context Acceptt after Inactivity
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response

After 30 Seconds of Inactivity ::

Initial Context Release Request
Release Access Bearers Request
Realease Access Bearers Response
UE Context Release Command
UE Context Release Complete
 UE eNB MME S-GW PDN-GW
NAS NAS HSS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

Downlink Data Notification

Downlink Data Notification Acknowledgement

PAGING
(Based on 2.7
Network initiated
Service Request Service Request Service Request
after Inactivity
Initial UE Message

Initial Context Setup Request, Capability Information

Initial Context Setup Response

Modify Bearer Request

Modify Bearer Response
0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f ...e/6.@CiJU....
0010 08 00 45 ba 00 6c 03 bb 40 00 40 84 9b 7d 0a 0b ..E..l..@.@..}..
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 44 3c C...C.....@g.bD<
0030 e4 1d 00 03 00 4b 47 5c 4c 1a 00 01 00 27 00 00 .....KG\L....'..
0040 00 12 00 0c 40 37 00 00 06 00 08 00 02 00 1f 00 ....@7..........
0050 1a 00 05 04 c7 e6 00 00 00 43 00 06 00 62 f2 20 .........C...b.
0060 00 7b 00 64 40 08 00 62 f2 20 00 00 50 10 00 86 .{.d@..b. ..P...
0070 40 01 20 00 60 00 06 00 40 c3 40 00 24 00 @. .`...@.@.$.

This message is sent by the UE to the network to request the establishment

of a NAS signalling connection and of the radio and S1 bearers.
Its structure does not follow the structure of a standard layer 3 message.
00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f
08 00 45 ba 00 6c 03 bb 40 00 40 84 9b 7d 0a 0b
43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 44 3c
e4 1d 00 03 00 4b 47 5c 4c 1a 00 01 00 27 00 00
00 12
00 0c 40 37 00 00
06 Items
00 08 00 02 00 1f eNB-UE-S1AP-ID
00 1a 00 05 NAS-PDU
04 PDU Length
c7 (c = Security Header Type for SERVICE REQUEST, 7 = Prot. Discrim EMM)
e6 (111 = NAS Key Set Id = No Key available, 0 0110 = Sequence Number)
00 00 Short MAC
00 43 00 06 00 62 f2 20 00 7b TAI = MCC + MNC + TAC
00 64 40 08 00 62 f2 20 00 00 50 10 E-UTRAN-CGI = MCC + MNC + Cell ID
00 86 40 01 20 RRC-Establishment-Cause = mt-Access
00 60 00 06 00 40 c3 40 00 24 S-TMSI = MMEC + mTMSI
00 Padding octet

TAC = Tracking Area Code

MMEC = MME Code = 0000 0000 0100 0000
Tracking Area Update Request examples

Tracking Area Update Accept examples

Tracking Area Update Complete examples

 UE eNB MME S-GW PDN-GW
NAS NAS HSS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDN Connectivity Request

Attach Request Attach Request
Initial UE Message Create Session Request
Activate Default EPS Bearer Context Request
Attach Accept Attach Accept Create Session Response
Initial Context Setup Request (Based on 2.8
Initial Context Setup Response Periodic Tracking Area
UE Capability Information
Activate Default EPS Bearer Context Acceptt
Attach Complete Attach Complete Modify Bearer Request
Uplink NAS Transport Modify Bearer Response

After 30 Seconds of Inactivity ::

Initial Context Release Request
Release Access Bearers Request
Realease Access Bearers Response
UE Context Release Command
UE Context Release Complete
 UE eNB MME S-GW PDN-GW
NAS NAS HSS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C
After 60 Seconds of Inactivity ::
Tracking Area Update Request
(Based on 2.8
Initial UE Message Periodic Tracking Area
Tracking Area Update Accept
Downlink AS Transport
Tracking Area Update Complete
Uplink NAS Transport
UE Context Release Command
UE Context Release Complete

After 60 Seconds of Inactivity ::

Tracking Area Update Request
Initial UE Message
Tracking Area Update Accept
Downlink AS Transport
Tracking Area Update Complete
Uplink NAS Transport
UE Context Release Command

UE Context Release Complete

0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f ...e/6.@CiJU....
0010 08 00 45 ba 00 7c 04 68 40 00 40 84 9a c0 0a 0b ..E..|.h@.@.....
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 d1 d6 C...C.....@g.b..
0030 c3 6a 00 03 00 5c 47 5c 4c 3e 00 01 00 33 00 00 .j...\G\L>...3..
0040 00 12 00 0c 40 48 00 00 06 00 08 00 02 00 28 00 ....@H........(.
0050 1a 00 16 15 07 48 73 0b f6 62 f2 20 00 01 01 c3 .....Hs..b. ....
0060 40 00 25 52 62 f2 20 00 7b 00 43 00 06 00 62 f2 @.%Rb. .{.C...b.
0070 20 00 7b 00 64 40 08 00 62 f2 20 00 00 50 10 00 .{.d@..b. ..P..
0080 86 40 01 30 00 60 00 06 00 40 c3 40 00 25 .@.0.`...@.@.%
00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f
08 00 45 ba 00 7c 04 68 40 00 40 84 9a c0 0a 0b
43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 d1 d6
c3 6a 00 03 00 5c 47 5c 4c 3e 00 01 00 33 00 00
00 12
00 0c 40 48 00 00 Initial UE Message
06 Items
00 08 00 02 00 28 eNB-UE-S1AP-ID
00 1a 00 16 NAS-PDU
15 PDU Length
07 (0 = Security Header Type = Plain NAS Not security Protected, 7 = Protoc. Discrim.)
48 Tracking Area Update Request
73 (0=Type of Secur = Native, 111=NAS Key set not available, 0=No, 011=Periodic Upd
0b f6 62 f2 20 00 01 01 c3 40 00 25 EPS Mobile Identity = GUTI (MCC,MNC,MME, TMS
52 62 f2 20 00 7b Tracking Area Identity (Last visited) = MCC + MNC + TAC
00 43 00 06 00 62 f2 20 00 7b TAI = MCC + MNC + TAC
00 64 40 08 00 62 f2 20 00 00 50 10 EUTRAN CGI = MCC + MNC + Cell ID
00 86 40 01 30 RRC Establisment Cause = mo-Signalling
00 60 00 06 00 40 c3 40 00 25 S-TMSI (MMEC + m-TMSI)
 UE eNB MME S-GW PDN-GW
NAS NAS HSS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C
After 60 Seconds of Inactivity ::
Tracking Area Update Request
(Based on 2.8
Initial UE Message Periodic Tracking Area
Tracking Area Update Accept
Downlink AS Transport
Tracking Area Update Complete
Uplink NAS Transport
UE Context Release Command
UE Context Release Complete

After 60 Seconds of Inactivity ::

Tracking Area Update Request
Initial UE Message
Tracking Area Update Accept
Downlink AS Transport
Tracking Area Update Complete
Uplink NAS Transport
UE Context Release Command

UE Context Release Complete

0000 00 40 43 69 4a 55 00 a0 a5 65 2f 36 81 00 04 8f .@CiJU...e/6....
0010 08 00 45 02 00 68 ee 48 40 00 40 84 b1 ab 0a 0b ..E..h.H@.@.....
0020 43 02 0a 0b 43 04 c0 00 c0 00 d0 a9 0a a7 04 b2 C...C...........
0030 92 b0 00 03 00 46 3c c3 c0 f2 00 01 00 1e 00 00 .....F<.........
0040 00 12 00 0b 40 32 00 00 03 00 00 00 02 00 a4 00 ....@2..........
0050 08 00 02 00 28 00 1a 00 1f 1e 07 49 00 5a 1e 50 ....(......I.Z.P
0060 0b f6 62 f2 20 00 01 01 c3 40 00 26 54 06 40 62 ..b. ....@.&T.@b
0070 f2 20 00 7b 17 2c 59 49 00 00 . .{.,YI..
00 40 43 69 4a 55 00 a0 a5 65 2f 36 81 00 04 8f
08 00 45 02 00 68 ee 48 40 00 40 84 b1 ab 0a 0b
43 02 0a 0b 43 04 c0 00 c0 00 d0 a9 0a a7 04 b2
92 b0 00 03 00 46 3c c3 c0 f2 00 01 00 1e 00 00
00 12
00 0b 40 32 00 00 Downlink NAS Transport
03 Items
00 00 00 02 00 a4 MME-UE-S1AP-ID
00 08 00 02 00 28 eNB-UE-S1AP-ID
00 1a 00 1f NAS-PDU
1e
07 (0 = Secur. Header Type = Plain Not Secur. protected, 7 = Protocol Discriminator = EMM)
49 Tracking Area Udate Accept
00 (0 = Spare, 0 = Result = TA Updated)
5a 1e T3412 GPRS Timer (60 seconds)
50 0b f6 62 f2 20 00 01 01 c3 40 00 26 EPS Mobility Identity (GUTI =MCC,MNC,MME,M-TMSI)
54 06 40 62 f2 20 00 7b TAI (MCC, MNC, TAC)
17 2c T3402 GPRS Timer (12 minutes)
59 49 T3423 GPRS Timer (54 minutes)
00 00 Padding octets
 UE eNB MME S-GW PDN-GW
NAS NAS HSS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C
After 60 Seconds of Inactivity ::
Tracking Area Update Request
(Based on 2.8
Initial UE Message Periodic Tracking Area
Tracking Area Update Accept
Downlink AS Transport
Tracking Area Update Complete
Uplink NAS Transport
UE Context Release Command
UE Context Release Complete

After 60 Seconds of Inactivity ::

Tracking Area Update Request
Initial UE Message
Tracking Area Update Accept
Downlink AS Transport
Tracking Area Update Complete
Uplink NAS Transport
UE Context Release Command

UE Context Release Complete

0000 00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f ...e/6.@CiJU....
0010 08 00 45 ba 00 60 04 69 40 00 40 84 9a db 0a 0b ..E..`.i@.@.....
0020 43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 80 e6 C...C.....@g.b..
0030 75 5e 00 03 00 40 47 5c 4c 3f 00 01 00 34 00 00 u^...@G\L?...4..
0040 00 12 00 0d 40 2c 00 00 05 00 00 00 02 00 a4 00 ....@,..........
0050 08 00 02 00 28 00 1a 00 03 02 07 4a 00 64 40 08 ....(......J.d@.
0060 00 62 f2 20 00 00 50 10 00 43 40 06 00 62 f2 20 .b. ..P..C@..b.
0070 00 7b .{
00 a0 a5 65 2f 36 00 40 43 69 4a 55 81 00 04 8f
08 00 45 ba 00 60 04 69 40 00 40 84 9a db 0a 0b
43 04 0a 0b 43 02 c0 00 c0 00 40 67 ed 62 80 e6
75 5e 00 03 00 40 47 5c 4c 3f 00 01 00 34 00 00
00 12
00 0d 40 2c 00 00 Uplink NAS Transport
05 Items
00 00 00 02 00 a4 MME-UE-S1AP-ID
00 08 00 02 00 28 eNB-UE-S1AP-ID
00 1a 00 03 NAS-PDU
02 PDU-Length
07 (0 = Security Header Type = Plain Not Security protected, 7 = Protocol Discrim EMM)
4a Tracking Area Update Complete
00 64 40 08 00 62 f2 20 00 00 50 10 EUTRAN-CGI = MCC, MNC, Cell ID
00 43 40 06 00 62 f2 20 00 7b TAI = MCC, MNC, TAC