LTE Introduction Tilak Nissanka (05/03/2018)

DAY1
Few important tips to remember

Core Network is the Master and Radio Network is the Slave. Radio Network is the Master and UE is the
Slave. This is a truth for any Technology GSM, WCDMA or LTE.

A mobile always access the network to communicate with the Core Network.

NAS signalling is between UE and MME completely transparent to LRAN. eNode-B neither read nor
interpret NAS messages (serves as a messenger).

Core Network should not initiate abnormal connection release unless UE attempt to access the network
again while it already has an ongoing connection.

Repeated failures of one UE model can be a sign of a UE fault. Few failures from different UE models can
be a sign of a network fault.

LTE Signalling Concepts

Comparison with WCDMA
 Non Access Stratum

Radio Network Layer (3GPP)

CN Transport Network Layer

Ra
RAB RAB

Sig
NAS

RNC
Iu Bearer RRC

Iu SignConn RLC/
RANAP RANAP MAC
RBS
Q. Q.
A A NBAP Q. Q. NB
Iup FP Iuc FP A A Iuc FP Iup FP Iub FP Node C/D A A C
SCCP L2 L2 SCCP (FACH, Sync
GTP-U GTP-U A A
RACH, L2 L2
UDP/IP Mtp3b Mtp3b UDP/IP
PCH,
LLC NniSaal NniSaal LLC DCH) UniSaal UniSaa
AAL5 AAL2 AAL5 AAL5 AAL2 AAL5 AAL2 AAL0 AAL5 AAL5
ATM ATM ATM
PHY PHY PHY

Iu Iub
LTE interfaces
eNode-B Sub System Structure
LTE/WCDMA States
Understanding LTE Basic Concepts

S1 Connection consist of signalling connection to MME (S1-CP) and userplane connection to SGw (S1-UP).
Control Plane Structure
User Plane Structure
Control Plane Protocols
User Plane Protocols
Authentication

Both the UE and the network authenticate each other.

- The MME sends a random number (RAND) and a network authentication result (AUTN)
to the UE. The UE use RAND to verify the AUTN sent by the network matches the results calculated in
the UE. Then the
UE sends the Authentication Response (RES) to the network where it is compared with
the network calculated value (XRES) to authenticate the mobile.
 - If RES matches XRES, authentication succeeds and CK and IK (KASME = CK||IK) may be
used to perform ciphering and integrity protection.

LTE Key Generation

Authentication procedure lead to generation of new security key KASME = CK||IK.

This in turn trigger a number of additional keys for the purpose of integrity protection and ciphering.

Integrity Protection

Integrity protection is a message authentication mechanism that protects signaling information from
being corrupted. It does not alter the data; it simply adds a MAC to the message that is derived from the
message contents and a secret key. The receiver computes an expected MAC and compares the two to
determine whether the message has been received intact.

Integrity protection is a mandatory procedure in UMTS and LTE, except for emergency calls. Emergency
calls are not required to use integrity protection, because they may be initiated without a USIM, and the
integrity protection key is stored in the USIM.

The Integrity protection function is performed in the PDCP sublayer.

 Integrity Protection
Procedure

Ciphering (Encryption)

Ciphering is an encryption procedure that prevents control and user data from being overheard. It may
be activated in the Security Mode Command. If it is activated, it is applied to all Radio Bearers (both SRBs
and DRBs).
The ciphering function is performed in the PDCP sublayer.

Ciphering in an optional procedure in UMTS and LTE.

Ciphering Procedure

Man in the Middle Attack

When the phone number catcher system is turned on, the RLN will continuously broadcast the fake cell’s
system information at a given EARFCN [21]. Once a LTE UE around our fake station receives these
important information, including MCC, MNC, and TAC, via MasterInformationBlock (MIB) and
SystemInformationBlock (SIB) messages, and our fake cell meets the cell reselection criteria in LTE [22],
then, the UE would initiate a Tracking Area Update to our RLN. When the fake EPC receives TAU request,
it can either spoof the victim UE’s IMSI by sending it the Identity Request message before redirecting the
UE to the GSM fake station or directly redirect the victim UE to our GSM network by designing the
redirectedCarrierInfo component in the RRCConnectionRelease message. The redirectedCarrierInfo
indicates a carrier frequency and is used to redirect the UEs to another RAN (Radio Access Network), e.g.,
GSM [23].

After the victim UE accessed to our GSM network and initiated a LUR procedure, we send the Identity
Request message to the victim UE, and get the victim’s IMSI in the Identity Response message. Then, the
malicious MS will be informed of the victim UE’s IMSI and initiate an IMSI-type LUR to the operator’s
GSM network using the victim’s IMSI. The malicious MS will expectedly receive an Authentication
Request message containing the authentication parameter (Rand) from the commercial GSM network,
and delivery it to the RGN. The RGN then authenticates the victim UE using the receiving Rand and gets
the SRES from the victim UE in the Authentication Response message. Finally, the malicious MS uses this
SRES to respond to the operator’s authentication and completes the LUR procedure after receiving the
Location Update Accept message containing the TMSI (Temporary Mobile Subscriber Identity) that the
operator’s GSM network allocated to it. At this moment, the malicious MS can either make a call or send
an SMS to the MSISDN displayer using commercial GSM network. The displayer receives the call or SMS
and gets the phone number of the victim UE.

RLC Basics

Sequence Numbers (AM and UM)

Sequence numbers are used for
– Detecting missing PDUs
– Recreate the SDU at the receiver

Polling (AM only)

 Transmitter must ask the receiver for status. This is done using the poll bit
 Poll = 1  Receiver must reply with a status report
 Poll = 0  No action
[2015-09-18 12:08:29.086] [001300\03]4/RncLmUePT(4/RRC_ASN) ossWorld.cc:341 BUS
SEND:RRC PDU (1) SENT, ueRef = 4, length = 96
0000 80 00 00 01 03 82 04 AA 43 E0 08 04 C4 23 88 30 '........C....#.0'  SN:11
0010 3A 80 E2 B8 83 04 28 10 33 88 30 4A 81 24 10 0B ':.....(.3.0J.$..'  SN:12
0020 01 20 A4 B4 98 93 52 B9 5F 83 78 81 20 11 1D 9B '. ....R._.x. ...'  SN:13
0030 1C 44 28 80 02 70 20 A2 04 76 68 81 00 CE 11 1D '.D(..p ..vh.....'  SN:14
0040 70 24 40 1E 04 45 D2 0C 73 D7 AB 87 08 80 00 20 '[email protected]...... '  SN:15
0050 4E 04 14 40 8E CD 56 11 20 26 48 30 18 FA 53 60 '[email protected]. &H0..S`'  SN:16
value DL-DCCH-Message ::=
{
integrityCheckInfo
{
messageAuthenticationCode 2,
rrc-MessageSequenceNumber 0
},
message radioBearerSetup : r3 :
{
radioBearerSetup-r3
{
:
:
[2015-09-18 12:08:29.648] [001300\03]4/RncLmUePT(4/UE_ASN_RRC) ../UehUeCtxtC.cpp:27854
BUS RECEIVE:RRC PDU (2) RECEIVED, ueRef = 4, length = 10
0000 80 00 00 01 03 CC 00 00 05 E0 '..........'  SN:8
value UL-DCCH-Message ::=
{
integrityCheckInfo
{
messageAuthenticationCode 2,
rrc-MessageSequenceNumber 0
},
message radioBearerSetupComplete :
{
:
:

[12:08:29.086] 0013/03/4 <<--------<< (RRC) radioBearerSetup

(rrcTID=0) (actTime:248) (cell-DCH) (cs-domain) (ULsf64)
[12:08:29.098] 0013/07/4 <<---<< (IUBCP) SRBdataDL
(WaitForSwitchForReconfiguration) (CFN=205) (RRC-DCCH-AM) (RLC:Data) (SN:11) (HE=0)
[12:08:29.108] 0013/07/4 <<---<< (IUBCP) SRBdataDL
(WaitForSwitchForReconfiguration) (CFN=206) (RRC-DCCH-AM) (RLC:Data) (SN:12) (HE=0)
[12:08:29.118] 0013/07/4 <<---<< (IUBCP) SRBdataDL
(WaitForSwitchForReconfiguration) (CFN=207) (RRC-DCCH-AM) (RLC:Data) (SN:13) (HE=0)
[12:08:29.128] 0013/07/4 <<---<< (IUBCP) SRBdataDL
(WaitForSwitchForReconfiguration) (CFN=208) (RRC-DCCH-AM) (RLC:Data) (SN:14) (HE=0)
[12:08:29.138] 0013/07/4 <<---<< (IUBCP) SRBdataDL
(WaitForSwitchForReconfiguration) (CFN=209) (RRC-DCCH-AM) (RLC:Data) (SN:15) (HE=0)
[12:08:29.148] 0013/07/4 <<---<< (IUBCP) SRBdataDL
(WaitForSwitchForReconfiguration) (CFN=210) (RRC-DCCH-AM) (RLC:Data) (SN:16) (P)
(HE=1)

[12:08:29.226] 0013/07/4 >>--->> (IUBCP) SRBdataUL

(WaitForSwitchForReconfiguration) (CFN=213) (RRC-DCCH-AM) (RLC:Control) (ack:17)
(SuFi: no_more) (QE=59) (CRCi=00)

[12:08:29.646] 0013/07/4 >>--->> (IUBCP) SRBdataUL

(WaitForSwitchForReconfiguration) (CFN=252) (RRC-DCCH-AM) (RLC:Data) (SN:8) (P) (HE=1)
(QE=25) (CRCi=00)
[12:08:29.648] 0013/03/4 >>-------->> (RRC) radioBearerSetupComplete
(rrcTID=0) (startVal=0x2)

[12:08:29.688] 0013/07/4 <<---<< (IUBCP) SRBdataDL

(CompletelyConfigured) (CFN=8) (RRC-DCCH-AM) (RLC:Control) (ack:9) (SuFi: no_more)

[19:46:41.466] 0009/00/28 <<--------<< (RRC) radioBearerSetup

(rrcTID=0) (cell-DCH) (RAB-ID=0x01) (GSM-MAP) (cs-domain) (ULsf64) (tx-
DivMode=noDiversity) (PSC=361) (DLsf128,c9)

[19:46:41.471] 0009/00/28 <<-<< (RLC) DataToCiph

(rbId:2) (SN:76)
[19:46:41.471] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:77)
[19:46:41.481] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:78)
[19:46:41.481] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:79)
[19:46:41.491] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:80)
[19:46:41.491] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:81)
[19:46:41.501] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:82)
[19:46:41.501] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:83)
[19:46:41.513] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:84)
[19:46:41.523] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:1) (SN:34)
[19:46:41.523] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:85)
[19:46:41.533] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:86)
[19:46:41.533] 0009/00/28 <<-<< (RLC) DataToCiph
(rbId:2) (SN:87) (P)

[19:46:41.903] 0009/00/28 <<-<< (RLC) RETRANSM

(rbId:2) (SN:87) (vt_dat:1) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:42.093] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:2) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:42.283] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:3) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:42.473] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:4) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:42.663] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:5) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:42.853] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:6) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:43.043] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:7) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:43.233] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:8) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:43.423] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:9) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:43.613] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:10) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:43.803] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:11) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:43.993] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:12) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:44.183] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:13) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:44.373] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:14) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:44.563] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:15) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:44.753] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:16) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:44.943] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:17) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:45.133] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:18) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:45.323] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:19) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:45.513] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:20) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:45.703] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:21) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:45.893] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:22) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:46.083] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:23) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:46.273] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:24) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:46.463] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:25) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:46.653] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:26) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:46.843] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:27) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)
[19:46:47.033] 0009/00/28 <<-<< (RLC) RETRANSM
(rbId:2) (SN:87) (vt_dat:28) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)

[19:46:47.223] 0009/00/28 (RLC) RESET

(rbId:2) (SN:87) (vt_dat:29) (max_dat:30) (vt_a:76) (vt_s:88) (vt_ms:108)

[19:46:47.224] 0006/00/28 >>--->> (RANAP) Iu-ReleaseRequest

(cause:radioNetwork/radio-connection-with-UE-Lost)

RLC Failure
OFFLINE_4GCITY_DCG_K> get . MaxRetxThreshold|tPollRetransmit

161101-12:38:46 OFFLINE_4GCITY_dcg_k 16.0c ERBS_NODE_MODEL_F_1_108_COMPLETE

stopfile=/tmp/11476
======================================================================================
===========================
MO                                                      Attribute                
Value
======================================================================================
===========================
RadioBearerTable=default,DataRadioBearer=1              dlMaxRetxThreshold        8
RadioBearerTable=default,DataRadioBearer=1              tPollRetransmitDl         80
RadioBearerTable=default,DataRadioBearer=1              tPollRetransmitUl         80
RadioBearerTable=default,DataRadioBearer=1              ulMaxRetxThreshold        8
RadioBearerTable=default,SignalingRadioBearer=1         dlMaxRetxThreshold        8
RadioBearerTable=default,SignalingRadioBearer=1         tPollRetransmitDl         80
RadioBearerTable=default,SignalingRadioBearer=1         tPollRetransmitUl         80
RadioBearerTable=default,SignalingRadioBearer=1         ulMaxRetxThreshold        8
======================================================================================
===========================
Total: 2 MOs

According to above configuration RLC Failure (Layer 2 timeout) occurs for both UE and eNode-B after
640ms (MaxRetxThreshold X tPollRetransmit).

RLC Failure can be observed with RAC trace object Ft_RLC_FAILURE:

[2017-02-22 05:17:47.885] 000100/02 1/worker2(1/Ft_RLC_FAILURE)
UehBearerCtxtC.cpp:3846 TRACE9:UE_TRACE: CellId 7, RacUeRef 60813707, RlcFailure on
SRB1

DAY2?
Synchronization Failure

n310: This parameter indicates the number of 200 ms intervals when the UE is unable to successfully
decode the PDCCH due to low RSRP detected. That is, this parameter indicates the number of times in
which the UE cannot successfully decode 20 consecutive frames (each radio frame is 10ms) in the
downlink.

t310: It is a timer, in seconds, used to allow the UE to get back in synchronization with the eNode-B.

n311: This parameter indicates the number of 100 ms intervals that the UE must successfully decode the
PDCCH to be back in-synch with the eNode-B. That is, this parameter indicates the number of times in
which the UE must successfully decode 10 consecutive frames in the downlink in order for the UE to
assume the radio link is in-synch.

If the UE detects n310 consecutive out-of-sync indications, it starts the t310 timer. If the timer expires,
the link has failed. If the UE detects n311 consecutive in-sync indications prior to the t310 timer expiring,
then the timer is stopped and the link is restored.
Unlike in WCDMA Layer1 timeout cannot occur from eNode-B side unless tTimeAlignmentTimer is set to
a non-zer value ( default 0).

RRC Re-establishment

UE performs RRC Reestablishment when Radio Link Failure (Synchronization Failure or RLC Failure) have
occurred.

Following configuration allows UE to continue the call via RRC Reestablishment procedure:
OFFLINE_4GCITY_DCG_K> get ENodeBFunction=1 rrcConnReestActive

161101-12:07:29 OFFLINE_4GCITY_dcg_k 16.0c ERBS_NODE_MODEL_F_1_108_COMPLETE

stopfile=/tmp/11476
======================================================================================
===========================
MO                                                      Attribute         Value
======================================================================================
===========================
ENodeBFunction=1                                        rrcConnReestActive true
======================================================================================
===========================
Total: 1 MOs
If eNode-B detected the failure following timer is started by eNode-B,

OFFLINE_4GCITY_DCG_K> get . tWaitForRrcConnReest

161101-11:57:49 OFFLINE_4GCITY_dcg_k 16.0c ERBS_NODE_MODEL_F_1_108_COMPLETE

stopfile=/tmp/11476
======================================================================================
===========================
MO                                                      Attribute         Value
======================================================================================
===========================
Rrc=1                                                   tWaitForRrcConnReest 6
======================================================================================
===========================
Total: 1 MOs

If instead UE detected the failure following timer is started by the UE,

OFFLINE_4GCITY_DCG_K> get Rrc=1 t311

161101-12:47:44 OFFLINE_4GCITY_dcg_k 16.0c ERBS_NODE_MODEL_F_1_108_COMPLETE

stopfile=/tmp/11476
======================================================================================
===========================
MO                                                      Attribute         Value
======================================================================================
===========================
Rrc=1                                                   t311              3000
======================================================================================
===========================
Total: 1 MOs
If UE detect Layer 2 timeout UE have 3.64 seconds (t311 + Layer 2 timeout) to recover the connection via
RRC Reestablishment procedure.

If UE detect Layer 1 timeout UE have 9 seconds (t311 + Layer 1 timeout) to recover the connection via
RRC Reestablishment procedure.

If eNode-B detect Layer 2 timeout UE gets 6.64 seconds (tWaitForRrcConnReest + Layer 2 timeout) to
recover the connection via RRC Reestablishment procedure. If no RRC Reestablishment happens after
6.64 seconds eNode-B initiate call release.

RRC Re-establishment Success

Source Cell
[2017-02-22 05:17:47.092] /7 |=========>| | | | | |
60813707 (RRC4G) MeasurementReport measId:1 rsrpResult:33 rsrqResult:18
physCellId:330
[2017-02-22 05:17:47.097] /7 | | |==================>| |
60813707 (X2AP) HandoverRequest ipAddr:10.113.139.45 ipAddr:10.113.139.45 e-RAB-
ID:5 e-RAB-ID:6 gTP-TEID:270701AF'H gTP-TEID:1234D1AF'H qCI:5 qCI:8 MMEGID:33793
cause:radioNetwork:handover-desirable-for-radio-reasons UE-X2AP-ID:0 nextHop:0
cellSize:verysmall ECGI:{plmnIdentity:450-06,enbId:80600,cellId:7} GUMMEI:
{plmnIdentity:450-06} HRL:{servingPLMN:450-06} mmeUeS1apId:285511268 mmeCode:03'H
[2017-02-22 05:17:47.144] /7 | | |<==================| |
60813707 (X2AP) HandoverRequestAcknowledge ipAddr:10.110.92.120
ipAddr:10.110.92.120 E-RABs-Admitted-List:{e-RAB-ID:5,6} gTP-TEID:CD0FFDB3'H gTP-
TEID:28BFB3F8'H UE-X2AP-ID-OLD:2368 UE-X2AP-ID-NEW:2176
[2017-02-22 05:17:47.146] /7 |=========>| | | | | |
60813707 (RRC4G) HandoverCommand targetPhysCellId:330 dlBandwidth:n100
powerRampingStep:dB4 crnti:11647 antPortCnt:an2 ciphAlg:eea1 intProtAlg:eia2
nextHop:0 keyChangeIndicator:FALSE dl-cFreq:100 dl-BW:20.0MHz ttiBundling:FALSE
txMode:3(OL_MIMO)
[2017-02-22 05:17:47.149] /7 | | |==================>| |
60813707 (X2AP) SNStatusTransfer e-RAB-ID:5 e-RAB-ID:6 UE-X2AP-ID:2368 UE-X2AP-
ID:2176

[2017-02-22 05:17:47.885] 000100/02 1/worker2(1/Ft_RLC_FAILURE)

UehBearerCtxtC.cpp:3846 TRACE9:UE_TRACE: CellId 7, RacUeRef 60813707, RlcFailure on
SRB1

[2017-02-22 05:17:48.354] /7 | | |==================>| |

60813707 (X2AP) PrivateMessage
[2017-02-22 05:17:48.354] /7 | | |==================>| |
60813707 (X2AP) EAB-UEContextFetchResponse ipAddr:10.113.139.45
ipAddr:10.113.139.45 e-RAB-ID:5 e-RAB-ID:6 e-RAB-ID:5 e-RAB-ID:6 gTP-
TEID:270701AF'H gTP-TEID:1234D1AF'H qCI:5 qCI:8 UE-X2AP-ID-OLD:0 UE-X2AP-ID-
NEW:2369 pci:368 shortMAC-I:33509 mmeUeS1Id:285511268 nextHop:0 crnti:673 HLR:
{servingPLMN:54F060'H} GUMMEI:{plmnIdentity:450-06}
[2017-02-22 05:17:48.376] /7 | | |<==================| |
60813707 (X2AP) PrivateMessage
[2017-02-22 05:17:48.376] /7 | | |<==================| |
60813707 (X2AP) EAB-UEContextFetchResponseAccept E-RABs-Admitted-List:{e-RAB-
ID:5,6} UE-X2AP-ID-OLD:2368 UE-X2AP-ID-NEW:2369
[2017-02-22 05:17:48.410] /7 | | |<==================| |
60813707 (X2AP) UEContextRelease UE-X2AP-ID:2368 UE-X2AP-ID:2369

Target Cell
[2017-02-22 05:17:48.345] |=========>| | | | | |
(RRC4G) RRCConnectionReestablishmentRequest cause:handoverFailure crnti:673
shortMAC-I:33509
[2017-02-22 05:17:48.355] /3 | | |<==================| |
25764048 (X2AP) PrivateMessage
[2017-02-22 05:17:48.355] /3 | | |<==================| |
25764048 (X2AP) EAB-UEContextFetchResponse ipAddr:10.113.139.45
ipAddr:10.113.139.45 e-RAB-ID:5 e-RAB-ID:6 e-RAB-ID:5 e-RAB-ID:6 gTP-
TEID:270701AF'H gTP-TEID:1234D1AF'H qCI:5 qCI:8 UE-X2AP-ID-OLD:2368 UE-X2AP-ID-
NEW:2369 pci:368 shortMAC-I:33509 mmeUeS1Id:285511268 nextHop:0 crnti:673 HLR:
{servingPLMN:54F060'H} GUMMEI:{plmnIdentity:450-06}
[2017-02-22 05:17:48.375] /3 | | |==================>| |
25764048 (X2AP) PrivateMessage
[2017-02-22 05:17:48.375] /3 | | |==================>| |
25764048 (X2AP) EAB-UEContextFetchResponseAccept E-RABs-Admitted-List:{e-RAB-
ID:5,6} UE-X2AP-ID-OLD:2368 UE-X2AP-ID-NEW:2369
[2017-02-22 05:17:48.376] /3 |<=========| | | | | |
25764048 (RRC4G) RRCConnectionReestablishment
[2017-02-22 05:17:48.409] /3 |=========>| | | | | |
25764048 (RRC4G) RRCConnectionReestablishmentComplete
[2017-02-22 05:17:48.409] /3 | | |==================>| |
25764048 (X2AP) UEContextRelease UE-X2AP-ID:2368 UE-X2AP-ID:2369
[2017-02-22 05:17:48.415] /3 |<=========| | | | | |
25764048 (RRC4G) RRCConnectionReconfiguration :eventA3 a3Offset:6 :eventA2
:eventA2 :eventA5 measId:4 measId:4 measId:4 measId:4 txMode:3(OL_MIMO)
[2017-02-22 05:17:48.448] /3 |=========>| | | | | |
25764048 (RRC4G) RRCConnectionReconfigurationComplete
[2017-02-22 05:17:56.466] /3 | | |=========================>|
25764048 (S1AP) UEContextReleaseRequest mmeUeS1apId:285511268 enbUeS1apId:270045
cause:radioNetwork:user-inactivity

RRC Re-establishment Failure

[2016-10-31 04:25:07.030] /1 | | |<=========================|
10346682 (S1AP) InitialContextSetupRequest ipAddr:10.82.13.97
mmeUeS1apId:13047443 enbUeS1apId:262153 e-RAB-ID:5 gTP-TEID:F6C056FA'H qCI:7
agMbrDl:200.00Mbps agMbrUl:50.00Mbps HLR:{servingPLMN:54F460'H}
[2016-10-31 04:25:07.030] /1 |<====================================|
10346682 (NAS4G) securityProtectedNASMessage
[2016-10-31 04:25:07.032] /1 |<=========| | | | | |
10346682 (RRC4G) SecurityModeCommand intraFreqReselection:eea1
integrityProtAlgorithm:eia2
[2016-10-31 04:25:07.056] /1 |=========>| | | | | |
10346682 (RRC4G) SecurityModeComplete
[2016-10-31 04:25:07.057] /1 |<=========| | | | | |
10346682 (RRC4G) UECapabilityEnquiry
[2016-10-31 04:25:07.087] /1 |=========>| | | | | |
10346682 (RRC4G) UECapabilityInformation ratType:eutra
[2016-10-31 04:25:07.089] /1 | | |=========================>|
10346682 (S1AP) UECapabilityInfoIndication mmeUeS1apId:13047443
enbUeS1apId:262153
[2016-10-31 04:25:07.116] /1 |<=========| | | | | |
10346682 (RRC4G) RRCConnectionReconfiguration :eventA5 :eventA3 a3Offset:4
:eventA2 :eventA5 :eventA2 :eventA6_r10 :eventA1 measId:7 measId:7 measId:7
measId:7 measId:7 measId:7 measId:7 antPortCnt:an1 drbId:3
[2016-10-31 04:25:07.116] /1 |<====================================|
10346682 (NAS4G) securityProtectedNASMessage

[2016-10-31 04:25:07.421] |=========>| | | | | |

(RRC4G) RRCConnectionReestablishmentRequest cause:reconfigurationFailure crnti:2657
shortMAC-I:41036

[2016-10-31 04:25:07.422] [000100\01]1/worker1(1/Ft_RRC_CONN_REESTABLISHMENT)

UehUeCtxtHandlerMgrC.cpp:3233 TRACE3:UE_TRACE: CellId 1, RacUeRef 10346687, Source UE
found in identity register targetRacUeRef = 10346687, sourceRacUeRef = 10346682   
this trace indicate RacUeRef before and after RRC Re-establishment
[2016-10-31 04:25:07.743] |<=========| | | | | |
(RRC4G) RRCConnectionReestablishmentReject

[2016-10-31 04:25:07.867] [000100\01]1/worker1(1/Ft_RLC_FAILURE)

UehBearerCtxtC.cpp:5294 TRACE9:UE_TRACE: CellId 1, RacUeRef 10346682, RlcFailure on
SRB1

[2016-10-31 04:25:08.532] /1 | | |<=========================|

10346682 (S1AP) UEContextReleaseCommand mmeUeS1apId:13047443 enbUeS1apId:262153
cause:nas:normal-release
[2016-10-31 04:25:13.124] /1 | | |=========================>|
10346682 (S1AP) InitialContextSetupFailure mmeUeS1apId:13047443
enbUeS1apId:262153 cause:radioNetwork:release-due-to-eutran-generated-reason

LTE Basic Concepts

LTE Measurement Events

In LTE, rrcConnectionReconfiguration message is used to configure UE measurement reporting. It

replaces the MeasurementControl message used in the UMTS system.

UE then report configured events in measurementReport message.

http://niviuk.free.fr/lte_event.php

Signal Strength (RSRP) and Signal Quality (RSRQ)

[10:04:38.256]000100 /10 |=========>| | | 87601261 /0

(RRC4G) measurementReport measId:1(A3) rsrp:-94 rsrq:-8.5 phCellId:366 rsrp:-89 rsrq:-
10.5
[2016-09-20 10:04:38.256] [000100\02]1/worker2(1/Ft_RRC_ASN)
elibInsRrcProtocolD.cc:527 BUS_RECEIVE:UE_TRACE: CellId 10, RacUeRef 87601261, Decode
RRC PDU RRCUL_DCCH_Message (29) (buf length = 8 bytes)
0000 08 10 2F 5C 05 B9 B4 4C '../\...L'
RRC {
pdu value UL-DCCH-Message ::= {
message c1 : measurementReport : {
criticalExtensions c1 : measurementReport_r8 : {
measResults {
measId 1,
measResultPCell {
rsrpResult 47,
rsrqResult 23
},
measResultNeighCells measResultListEUTRA : {
MeasResultEUTRA {
physCellId 366,
measResult {
rsrpResult 52,
rsrqResult 19
}
}
}
}
}
}
}
}

RSRP = X - 141 (example rsrpResult 61 --> RSRP = 61 -141 = -80 dBm)

RSRP From To Unit

00 -140 dBm

01 -140 -139 dBm

02 -139 -138 dBm

03 -138 -137 dBm

04 -137 -136 dBm

05 -136 -135 dBm

06 -135 -134 dBm

07 -134 -133 dBm

08 -133 -132 dBm

09 -132 -131 dBm

10 -131 -130 dBm

11 -130 -129 dBm

12 -129 -128 dBm

13 -128 -127 dBm

14 -127 -126 dBm

15 -126 -125 dBm

16 -125 -124 dBm

17 -124 -123 dBm

18 -123 -122 dBm

19 -122 -121 dBm

20 -121 -120 dBm

21 -120 -119 dBm

22 -119 -118 dBm

23 -118 -117 dBm

24 -117 -116 dBm

25 -116 -115 dBm

26 -115 -114 dBm

27 -114 -113 dBm

28 -113 -112 dBm

29 -112 -111 dBm

30 -111 -110 dBm

31 -110 -109 dBm

32 -109 -108 dBm

33 -108 -107 dBm

34 -107 -106 dBm

35 -106 -105 dBm

36 -105 -104 dBm

37 -104 -103 dBm

38 -103 -102 dBm

39 -102 -101 dBm

40 -101 -100 dBm

41 -100 -99 dBm

42 -99 -98 dBm

43 -98 -97 dBm

44 -97 -96 dBm

45 -96 -95 dBm

46 -95 -94 dBm

47 -94 -93 dBm

48 -93 -92 dBm

49 -92 -91 dBm

50 -91 -90 dBm

51 -90 -89 dBm

52 -89 -88 dBm

53 -88 -87 dBm

54 -87 -86 dBm

55 -86 -85 dBm

56 -85 -84 dBm

57 -84 -83 dBm

58 -83 -82 dBm

59 -82 -81 dBm

60 -81 -80 dBm

61 -80 -79 dBm

62 -79 -78 dBm

63 -78 -77 dBm

64 -77 -76 dBm

65 -76 -75 dBm

66 -75 -74 dBm

67 -74 -73 dBm

68 -73 -72 dBm

69 -72 -71 dBm

70 -71 -70 dBm

71 -70 -69 dBm

72 -69 -68 dBm

73 -68 -67 dBm

74 -67 -66 dBm

75 -66 -65 dBm

76 -65 -64 dBm

77 -64 -63 dBm

78 -63 -62 dBm

79 -62 -61 dBm

80 -61 -60 dBm

81 -60 -59 dBm

82 -59 -58 dBm

83 -58 -57 dBm

84 -57 -56 dBm

85 -56 -55 dBm

86 -55 -54 dBm

87 -54 -53 dBm

88 -53 -52 dBm

89 -52 -51 dBm

90 -51 -50 dBm

91 -50 -49 dBm

92 -49 -48 dBm

93 -48 -47 dBm

94 -47 -46 dBm

95 -46 -45 dBm

96 -45 -44 dBm

97 -44 dBm
Protocol Messages

https://www.developingsolutions.com/S1Dict/Dictionary/Initial-Context-Setup_proc.html

Purpose of most common Signalling messages

RRC Protocol

RRCConnectionRequest : Contain m-TMSI and MME Code (MMEC) which is used to route subscriber to
correct MME. Also RRC establishment cause.

CSFB returning UEs instead have a random value which cannot be used to
route subscriber to correct MME

RRCConnectionSetupComplete : For CSFB returning UEs contain MME Code and MME Group Identity
(MMEGI) which should be used to route subscriber to correct MME

Selected PLMN Identity (specially important for RAN Sharing Networks)

Contain first NAS message to MME requesting service type

SecurityModeCommand : Contain ciphering and integrity protection algorithms that the UE and eNode-
B should be used for RRC signalling and userdata over the air

UECapabilityEnquiry : Message is used to request UE to provide its capabilities

UERadioAccessCapabilityInformation : Contain UE Radio Access capabilities

RRCConnectionReconfiguration : Message is used for,

1) To setup/modify/release thresholds for Bad Coverage Event A2,

intra-frequency Hanover Event A3, inter-frequency Handover
Event A5 and IRAT Handover Event B2
 2) To establish/modify/release SRB2 for NAS signalling and to
establish/modify/release DRBs (Data Radio Bearers)
3) To execute intra-LTE Handover (both intra-frequency Hanover
and inter-frequency Hanover)
4) To add/modify/release SCells

MeasurementReport : The message used by UE to inform the network what cells it can see and how
strong it can see them, its current channel condition etc. via Events (in some cases periodically)

rrcConnectionReestablishmentRequest : The purpose of this message is to re-establish the RRC

connection if any of the following happens,

1) Upon detecting radio link failure

2) Upon handover failure
3) Upon integrity check failure
4) Upon an RRC Connection Reconfiguration failure

The UE shall only initiate this procedure when AS security has

been activated.

rrcConnectionReestablishment : The message is used to re-establish RRC Connection. This procedure is

successful only when target cell manages to fetch a valid UE context rom source cell.

rrcConnectionReestablishmentComplete: The message is used b UE to indicate RRC Re-establishment is

successful.

mobilityFromEUTRACommand: The message is used to order handover to WCDMA/GSM. The message

might carry WCDMA System Information. nas-SecurityParamFromEUTRA value is used to calculate
security key to use in WCDMA.

RRCConnectionRelease : The message is used by eNode-B to command the release of RRC connection or
an UE in RRC connected-mode. The message is sent in Acknowledged Mode (AM).

HandoverPreparationInformation: The message contains UE capability and information about the

current connection…..used at X2/S1 Handover and RRC Re-establishment.

DAY3

S1AP Protocol

InitialUEMessage : The message carries,

1) first NAS message from UE to MME

 2) unique eNode-B identification (ENB-UE-S1AP-ID) assigned for this S1
connection
3) Tracking Area Identity (TAI)…..consist of TAC of serving cell and PLMN identity
UE referred to in RRCConnectionSetupComplete message
4) Cell Global Identifier (CGI)…. consist of eNode-B id, cellid and Primary PLMN
(which is same as defined under ENodeBFunction MO)
5) RRC establishment cause (same as indicated in RRCConnectionRequest
message)
6) m-TMSI and MME Code (same as indicated in RRCConnectionRequest
message)

InitialContextSetupRequest : The message carries,

1) unique MME identification (MME-UE-S1AP-ID) assigned for this S1

connection
2) Bit-rates allowed for the connection
3) e-RABs to setup with associated Quality Of Service (QoS)
4) ip-address and GTP tunneling id towards SGw for each e-RAB
5) Security Key (Kenb) and security capabilities of UE
6) Handover Restriction List (HRL) which indicate to which PLMNs
handover is allowed….absence of HRL list means there are no
Handover restrictions
7) UE Radio Access Capabilities
8) Optionally Masked IMEISV of UE (needs MME configuration)
9) Optionally UE specific tracing information (needs to initiate from
MME)

InitialContextSetupResponse : The message carries information about successfully setup e-RABs and ip-
address and GTP tunneling id towards eNode-B. If any e-RAB setup failed it should be indicated with a
cause value.

UECapabilityInfoIndication : The purpose of this message is to provide the MME UE capability related
information. MME forward these UE capabilities to eNode-B in subsequent accesses via
InitialContextSetupRequest message (UE
Radio Capability IE).

E-RABSetupRequest : The message contain additional e-RABs to setup (e-RABs that were not part of
InitialContextSetupRequest message)…..normally used for e-RABid 7 (QCI=1).

Also included is ip-address and GTP tunneling id towards SGw for e-RAB together
with relevant QoS.
 An embedded NAS message to UE must also be present.

E-RABSetupResponse : The message carries information about successfully setup e-RAB and ip-address
and GTP tunneling id towards eNode-B.

If e-RAB setup failed it should be indicated with a cause value.

DownlinkNASTransport : The message contain a NAS message to UE. MME identification (MME-UE-
S1AP-ID) and eNode-B identification (ENB-UE-S1AP-ID) are also included in the message….sent to UE
using SRB2.

UplinkNASTransport : The message contain a NAS message to MME…..received from UE on SRB2. MME-
UE-S1AP-ID and ENB-UE-S1AP-ID are also included in the message. TAI and CGI included as in
InitialUEMessage.

PathSwitchRequest: The message carries,

1) ip-address and GTP tunneling id towards eNode-B for each e-RAB id that are
subjected to Path Switch
2) TAI and CGI as received in X2AP HandoverRequest message
3) MME-UE-S1AP-ID and new ENB-UE-S1AP-ID for S1 connection
4) Security capabilities of the UE

PathSwitchRequestAcknowledge: The message contains,

1) MME-UE-S1AP-ID and new ENB-UE-S1AP-ID for S1 connection

2) If any e-RAB have failed Path Switch procedure it should be
indicated with a cause value
3) Optionally Bit-rates allowed for the connection after Path
Switch procedure
4) Security Key to be used for future Handovers.

Note: If all e-RABs have failed Path Switch procedure then MME would
respond with PathSwitchRequestFailure.

UEContextModificationRequest: The message can be used for,

1) To modify Bit-rates allowed for the connection

2) To request eNode-B to perform CSFN for concerned UE
3) To change used security key (so-called “key change on-the-fly”
procedure)
4) The message contains MME-UE-S1AP-ID and ENB-UE-S1AP-ID for
S1 connection together with LAI to which UE should fallback in
case of CSFB
UEContextReleaseRequest: The message is sent by eNode-B to request the release of UE-associated S1-
logical connection with an appropriate cause value.

UEContextReleaseCommand: The message is sent by MME to order the release of UE-associated S1-
logical connection. The cause valued used in this message is normally used for counter handling
(specially for MME initiated releases).

HandoverRequired: The message is used by eNode-B requesting a Handover to a target via MME. The
target cell can be within LTE or in WCDMA/GSM. The message contains,

1) MME-UE-S1AP-ID and ENB-UE-S1AP-ID for S1 connection

2) HandoverType IE indicating if Handover is within LTE or IRAT
3) Cause for Handover
4) Target cell information
5) RRC Container with UE capability and information about the current
connection….in IRAT case target connection characteristics are decided by
MME/SGSN
6) Source cell information (in RRC container)

HandoverCommand: This is the response received from MME for HandoverRequired message. The
message contains,

1) MME-UE-S1AP-ID and ENB-UE-S1AP-ID for S1 connection

2) HandoverType IE indicating if Handover is within LTE or IRAT
3) RRC Container with UE capability and HandoverCommand to send to
UE…..this HandoverCommand message contain all the information to setup
target connection
4) nas-SecurityParamFromEUTRA value which is used to calculate security key to
use in WCDMA

HandoverRequest: Target eNode-B receive this Handover Request from MME. The message contains,

1) MME-UE-S1AP-ID for S1 connection

2) HandoverType IE indicating if Handover is within LTE or IRAT
3) Cause for Handover
4) Bit Rates allowed for the incoming connection
5) e-RABs to setup with associated Quality Of Service (QoS) and ip-address and
GTP tunneling id towards SGw for each e-RAB
6) Optionally ‘Data-Forwarding-Not-Possible’ IE……the presence of this IE means
data forwarding to eNode-B during Handover execution will not happen
 7) RRC Container with UE capability and information about type of target
connection
8) Handover Restriction List (HRL) which indicate to which PLMNs handover is
allowed….absence of HRL list means there are no Handover restrictions
9) SRVCCOperationPossible IE indicating if VoLTE calls are allowed to Handover
to WCDMA/GSM
10) Security Key (Kenb) and security capabilities of UE
11) Source cell information (in RRC container)

HandoverRequestAcknowledge: This is the response sent by target eNode-B to HandoverRequest

message. The message contains,

1) MME-UE-S1AP-ID and ENB-UE-S1AP-ID for S1 connection

2) E-RABAdmittedList which include admitted e-RABs and ip-address and GTP
tunneling id towards eNode-B….and E-RAB-Failed-To-Setup-List…..if any e-
RAB cannot be setup it is indicated in E-RAB-Failed-To-Setup-List
3) RRC Container with embedded HandoverCommand to send to UE…..this
HandoverCommand message contain all the information to setup target
connection

HandoverNotify: The message is sent to MME to Handover has been successful. The message contains
MME-UE-S1AP-ID and ENB-UE-S1AP-ID for S1 connection, TAI and CGI as in InitialUEMessage message.

S1SetupRequest: The purpose of the S1 Setup procedure is to exchange application level data needed for
the eNode-B and MME to interoperate correctly on the S1 interface. This procedure is always started by
eNode-B. The message
contains Global-ENB-ID, Supported Tracking Area List and optionally eNode-B name.

S1SetupResponse: The message contains,

1) List of PLMNs and globally unique MME identities (GUMMEIs) supported by

MME
2) MME Relative Capacity to re-distribute subscribers in case destination MME
cannot be decided
3) Optionally MME name

Reset: S1 Reset procedure used is to release E-UTRAN S1AP UE related context in case of a failure at
MME or eNode-B side. The message contains,

1) Cause to reset the connection(s)

2) ResetType indicating if only selected connections or every connection to be released
3) ENB-UE-S1AP-ID(s) to be releaed
ErrorIndication: This message can be sent from either MME or eNode-B when any of following occurs,

1) When MME/eNode-B sends a message to eNode-B/MME for a UE with wrong or

missing or invalid MME-UE-S1AP-ID / ENB-UE-S1AP-ID
2) When MME/eNode-B sends a message to eNode-B/MME for a UE with wrong
values for any mandatory IE of any S1AP message

The message contains MME-UE-S1AP-ID / ENB-UE-S1AP-ID and a cause value.

E-RABModifyRequest: The purpose of the e-RAB Modify procedure is to enable modifications of already
established e-RABs for a given UE. The message contains information to modify for referred e-RAB. An
embedded NAS message to
UE may also be present.

E-RABModifyResponse: eNode-B respond with a list of e-RABs which are successfully modified in the ‘e-
RAB Modify List’ IE. If any e-RAB have failed to modify it is indicated in the ‘e-RAB Failed to Modify List’ IE
with a cause value.

E-RABReleaseCommand: The purpose of the e-RAB Release procedure is to enable the release of already
established e-RABs for a given UE. The message contains the information required by the eNode-B to
release at least one E-RAB in
the ‘e-RAB To Be Released List’ IE.. An embedded NAS message to UE may also
be present.

E-RABReleaseResponse: eNode-B respond with a list of e-RABs which are successfully released in the ‘e-
RAB Release List’ IE. If any e-RAB have failed to release it is indicated in the ‘e-RAB Failed to Release List’
IE with a cause value.

LocationReportingControl: The purpose of Location Reporting Control procedure is to request the

eNode-B to report whenever the UE’s location is changed. The message contains ‘Request Type’ IE to
indicates to the eNode-B what to
report:

- to report directly
- to report upon change of serving cell
- to stop reporting at change of serving cell

LocationReport: eNode-B respond with TAI and CGI as in InitialUEMessage message. Also included in
the message is ‘Request Type’ IE received from MME.

WriteReplaceWarningRequest: The purpose of Write-Replace Warning procedure is to start the

broadcasting of warning messages to all UEs. The message contains,
 1) MessageIdentifier to identify warning type
2) WarningAreaList to indicate where to broadcast the message
3) NumberofBroadcastRequest to indicate how many times to
broadcast the message
4) RepetitionPeriod to indicate the time gap between each
transmission
5) Presence of ConcurrentWarningMessageIndicator IE indicate it is a
CMAS message (Sib12)….otherwise ETWS (Sib11)

ENBDirectInformationTransfer: See 3GPP 36.413 for more details

MMEDirectInformationTransfer: See 3GPP 36.413 for more details

ENBConfigurationUpdate: See 3GPP 36.413 for more details

MMEConfigurationUpdate: See 3GPP 36.413 for more details

ENBConfigurationTransfer: See 3GPP 36.413 for more details

MMEConfigurationTransfer: See 3GPP 36.413 for more details

NAS Protocol

serviceRequest: The purpose of the service request procedure is to transfer the EMM (EPS Mobility
Management) mode from EMM-IDLE to EMM-CONNECTED mode and establish the radio and S1 bearers
when user data or signalling is to be sent. Another purpose of this procedure is to invoke MO/MT CS
fallback.

authenticationRequest: The purpose of the Authentication and key agreement (AKA) procedure is to
provide mutual authentication between the user and the network and to agree on a new key K ASME. The
EPS AKA procedure is always
initiated and controlled by the network. The message contains,

1) a random number, RAND which is used by the USIM when it executes the
AKA procedure
2) An authentication token, AUTN which contains parameters that the USIM
uses to authenticate the network

authenticationResponse: UE response to authenticationRequest message contains RES which MME

compares with XRES received from HSS. AKA procedure is successful if RES=XRES. Procedure leads to new
security keys derived from KASME.
securityModeCommand: The purpose of the NAS security mode control procedure is to take an EPS
security context into use, and initialize and start NAS signalling security between the UE and the MME
with the corresponding EPS NAS keys and EPS security algorithms.

securityModeComplete: UE provide its IMEISV if requested by MME in securityModeComplete message.

(to get IMEI of a phone dial *#06#).

attachRequest: Attach procedure is triggered for instance when the UE is powered on or an USIM is
inserted in the phone. In the message last used KASME identifier (NASKeySetIdentifier) is indicated together
with last used EPSMobileIdentity (TMSI or IMSI).

DAY4

attachAccept: MME may assign a new GUTI at successful Attach procedure. The UE used assign new
GUTI in subsequent RRCConnectionRequest / RRCConnectionSetupComplete messages.

The IE TAI List indicates a list of Tracking Areas for which the UE doesn't need to perform
a Tracking Area Updating procedure when entered one of these TAs in the list. The TAIs in a TAI list
assigned by an
MME to a UE belongs to the same MME area.

APN in the message should be same as configured in the UE. Otherwise UE would repeat
attachRequest message.

The UE gets an IP address which is allocated by the PDN GW during the Create Bearer
procedure to send/receive userdata.
trackingAreaUpdateRequest: While an UE is in active state its location is known by the LTE network at
cell level. However, while the UE is in idle state its location is known by the LTE network at Tracking Area
TA level. The MME has to have updated location information about UEs in idle state to find out in which
TA a particular UE is located. For this, the UE notifies MME of its current location by sending a
trackingAreaUpdateRequest message every time it moves between TAs.

In the message last used KASME identifier (NASKeySetIdentifier) is indicated together with last used GUTI.

trackingAreaUpdateAccept: MME may assign a new GUTI at successful TAU procedure. The IE TAI List
indicates a list of Tracking Areas for which the UE doesn't need to perform a Tracking Area Updating
procedure when entered one of these TAs in the list.

identityRequest: The identification procedure is used by the network to request a particular UE to

provide specific identification parameters, e.g. IMSI, IMEI etc. (identity Type 1 means IMSI).

identityResponse: The response message should contain the identification parameters as requested by
the network.

extendedServiceRequest: The message is sent by the UE to the network to initiate a CS fallback or

respond to a MT CS fallback request from the network. The message contains TMSI and KASME identifier
(NASKeySetIdentifier).

CSServiceNotification: The message is sent by the network to notify a UE in EMM-CONNECTED mode (i.e.
NAS signalling connection is already established for the UE) about an incoming CS service (excluding
SMS) over SGs. Paging identity IE is to indicate the identity used for paging for non-EPS services. This
identity could be either IMSI (0) or TMSI (1).

detachRequest: Detach procedure can be initiated by the UE or the network. The UE shall initiate the
detach procedure for instance when the UE is switched off or the USIM is removed from the UE. If the
Detach type IE set to ‘switch off’,
the network should not send a DetachAccept message to the UE.
If the UE has a valid GUTI, the UE shall set the EPS Mobile Identity IE as GUTI.

EMMInformation: The network uses this message to provide the UE with certain information such as
network name, local time etc. The message implementation is optional in both network and the UE side.

X2AP Protocol

HandoverRequest: Source eNode-B sends this message to Target eNode-B requesting a Handover based
on Event A3 or Event A5. The message contains,

1) cause of Handover
2) CGI of target cell
 3) Information about MME currently serving this connection
4) MME-UE-S1AP-ID for the connection
5) Security Key
6) e-RABs to setup with QoS
7) Handover Restriction List (HRL) which indicate to which PLMNs handover is
allowed
8) RRC container with information about current connection
9) Source cell information (in RRC container)

HandoverRequestAcknowledge: Target eNode-B response to HandoverRequest message. The message

contains,

1) Old and new UE-X2AP-ID

2) e-RABs for which resources have been prepared at the target cell
is listed in the 'e-RABs Admitted List' IE
3) e-RABs that have not been admitted are listed in the 'e-RABs Not
Admitted List' IE with an appropriate cause value
4) RRC Container with embedded HandoverCommand to send to
UE…..this HandoverCommand message contain all the
information to setup target connection

SNStatusTransfer: The message contains,

1) Uplink PDCP sequence and Uplink Hyper Frame Number

2) Downlink PDCP sequence and Downlink Hyper Frame Number

These fields are needed for continuing ciphering and integrity protection after the
handover.

UEContextRelease: The message is sent when the target eNode-B has successfully completed the Path
Switching and radio signaling for the handover. The message contains Old and new UE-X2AP-ID.

EAB-UEContextFetchRequest: The message is sent by target eNode-B to source eNode-B to fetch UE

context when UE perform RRC Re-establishment. The message contains,

1) new UE-X2AP-ID
2) PCI of the original cell
3) CGI of original cell
4) crnti for the call in original cell
5) ShortMAC-I….used for integrity protection verification of
rrcConnectionReestablishmentRequest message
6) Frequency and PCI of the cell to which UE sent
rrcConnectionReestablishmentRequest message
EAB-UEContextFetchResponse: Source eNode-B response to EAB-UEContextFetchRequest message. The
message contains,

1) Old and new UE-X2AP-ID

2) PCI, crnti and ShortMAC-I
3) Information about MME that was serving the connection before
RRC Re-establishment
4) MME-UE-S1AP-ID for the connection
5) Security Key
6) e-RABs to setup with QoS
7) Handover Restriction List (HRL) which indicate to which PLMNs
handover is allowed….absence of HRL list means there are no
Handover restrictions
8) Uplink/Downlink PDCP sequence and Uplink/Downlink Hyper
Frame Number to continue ciphering and integrity protection after
RRC Re-establishment
9) RRC container with information about current connection
10) Source cell information (in RRC container)

EAB-UEContextFetchResponseAccept: Target eNode-B sends this message to acknowledge UE context

fetch is a success. e-RABs for which resources have been prepared at the target cell is listed in the 'e-
RABs Admitted List' IE. e-RABs that have not been admitted are listed in the 'e-RABs Not Admitted List' IE
with an appropriate cause value

ErrorIndication: The Error Indication procedure is initiated by an eNode-B to report detected errors in
one incoming message, provided they cannot be reported by an appropriate failure message. The
message contains Old and new UE-X2AP-ID and cause or failure.

X2SetupRequest: The purpose of the X2 Setup procedure is to exchange application level configuration
data needed for two eNode-Bs to interoperate correctly over the X2 interface. The message contains.

1) GlobalENB-ID
2) ECGI of every cell with PCI, TAC, earfcn, and neighbour cell info
3) MME Group Ids supported for each PLMN
X2SetupResponse: The target RBS configures resources according to the content of X2SetupRequest
message. The response contains same information as in X2SetupRequest message.

ENBConfigurationUpdate: See 3GPP 36.423 for more details

All Procedures in LTE

RACH Procedure

The UE must be successful with initial RACH procedure to access the network (for instance to send RRC
Connection Request message).
UE selects one of the 64 available RACH preambles. If UE does not receive any response from the
network, it increases its power in fixed step and sends RACH preamble again.

RACH Procedure at Initial Access (Contention Based)

RACH Procedure at RRC Re-establishment (Contention Based)
RACH Procedure at Handover (Contention Free)
pmRaAttCbra counter stepped at reception of Msg 1 (RACH preamble) from UE.

pmRaSuccCbra counter stepped at reception of Msg 3 (for instance RRC Connection Request) from UE.

RRC Connection Setup Procedure

RRC connection establishment is used to make the transition from RRC Idle mode to RRC Connected
mode. UE must make the transition to RRC Connected mode before transferring any application data, or
completing any signaling procedures with the network.

pmRrcConnEstabAtt counter steps at reception of rrcConnectionRequest from UE.

pmRrcConnEstabSucc counter steps at reception of rrcConnectionSetupComplete from UE.

S1 Connection Setup

eNlode-B needs to setup a signalling connection to MME and a GTP tunnel to SGw in order to provide
various services to an UE.
pmS1SigConnEstabAtt counter is stepped when InitialUEMessage is sent to MME.

pmS1SigConnEstabSucc counter is stepped at the reception of any message (except RESET) on UE-
associated logical S1-connection (see HW40419).

Attach Procedure

UE needs to register with the network to receive services (Speech, SMS, Browsing etc.). This registration
is called Network Attachment. There is always an IP connectivity to Internet for a successfully attached
UE.
Note that Attach is a NAS procedure transparent to LRAN. Relevant KPI (counters) are in MME side.

TAU Procedure

When UE detects it has entered a new TA (Tracking Area) that is not in the list of TAIs (Tracking Area
Indicators) that the UE registered with the network it performs TAU procedure. Another reason for TAU
procedure is re-registering to LTE after CS-fallback is completed.
Note that TAU is a NAS procedure transparent to LRAN. Relevant KPI (counters) are in MME side.
Paging Procedure

GMSC sends a query to HSS find about the location of the UE.

HSS on account of UE’s earlier registration (e.g. Combined Attach procedure) identifies MSC 1 as the
current location.

MSC 1 initiates paging procedure through SGs interface indicating to MME about an incoming MT CS
call.

Paging causes UE to fallback to the CS coverage via either “Handover” or “Redirection” procedure.

All Paging messages received from MME is counted by pmPagS1Received counter.

If any Paging messages received from MME is discarded it is counted by pmPagS1Discarded counter.

Initial Context Setup Procedure

Initial Context Setup Procedure is triggered by MME. The objective of this procedure is to establish a
default bearer for an UE to exchange end to end userdata.

Vital piece of missing information in above picture is Handover Restriction List (HRL).

pmErabEstabAttInit counter is stepped at the reception of InitialContextSetupRequest message from

MME.

pmErabEstabSuccInit counter is stepped when InitialContextSetupResponse message is sent to MME.

DAY5

CSFB Procedure
Following counters exist for CSFB observability:

pmUeCtxtEstabAttCsfb
pmUeCtxtModAttCsfb
pmUeCtxtRelCsfbWcdma
pmUeCtxtRelCsfbGsm
pmUeCtxtRelNaccCsfbWcdma
pmHoPrepAttCsfb
pmHoPrepSuccCsfb
pmHoExeAttCsfb
pmHoExeSuccCsfb

VoLTE call Setup

Voice over LTE (VoLTE) calls are setup between two handsets which both support VoLTE.
Following VoLTE related counters exist:

pmErabEstabAttInitQci
pmErabEstabSuccInitQci
pmErabEstabAttAddedQci
pmErabEstabSuccAddedQci
pmErabRelAbnormalMmeActQci
pmErabRelAbnormalEnbActQci

RRC Re-establishment

This procedure is needed to re-establish RRC Connection in case failure happens from UE point of view
(e.g. radio link failure).

Note that RRC Re-establishment procedure always initiate by the UE.

The counter pmRrcConnReestAtt is stepped at reception of rrcConnectionReestablishmentRequest from
UE.

The counter pmRrcConnReestSucc is stepped at reception of rrcConnectionReestablishmentComplete

from UE.

UE Context Fetch Procedure

UE Context fetch is performed by target eNode-B when UE perform RRC Re-establishment in that eNode-
B.
The counter pmUeCtxtFetchAtt is stepped at reception of UEContextFetchRequest in source cell.

The counter pmUeCtxtFetchSucc is stepped at reception of UEContextRelease in source cell.

Path Switch Procedure

During X2 Handover the target eNode-B sends PathSwitchRequest message to the MME to inform that
the UE has changed cell and the SGW needs to forward the incoming packets to a different destination.
Path Switch procedure have no LRAN counters. Relevant counters are in MME.

В новых релизах появились уже счетчики

Handover

Handover happens when signal strength of serving cell becomes weak and signal strength of a
neighboring cell becomes better.

X2 Handover
[10:04:38.259]000100 /10 | | |====>| | 87601261 /0 (X2AP)
HandoverRequest ueX2Id:0 cause:radioNetwork-handover-desirable-for-radio-reasons\par
plmnId:274f01 enbId:43209 cellId:10 plmnId:274f01 MMEGID:8000 mmeUeS1Id:1378193
eRabId:5 gtpTeId:9ab04e80 plmnId:274f01 plmnId:274f01 plmnId:274f01 enbId:44011
cellId:10  pmHoPrepAttLteIntraF counter
[10:04:38.312]000100 /10 | | |<====| | 87601261 /0 (X2AP)
HandoverRequestAcknowledge ueX2Id:2581 ueX2Id:3184 eRabId:5  pmHoPrepSuccLteIntraF
counter
[10:04:38.313]000100 /10 |=========>| | | 87601261 /0
(RRC4G) rrcConnectionReconfiguration trgPhCid:366 BW:DL-20-MHz  pmHoExeAttLteIntraF
counter
[10:04:38.449]000100 /10 | | |<====| | 87601261 /0 (X2AP)
UEContextRelease ueX2Id:2581 ueX2Id:3184  pmHoExeSuccLteIntraF counter

S1 Handover
[2016-09-29 13:48:43.496] /2 | | |=========================>|
17424861 (S1AP) HandoverRequired tac:113 eNB-ID_macroENB_ID:31161
plmnIdentity:520-05 plmnIdentity:520-05 mmeUeS1apId:182064991 enbUeS1apId:264792
cause:radioNetwork:s1-intra-system-handover-triggered  pmHoPrepAttLteIntraF counter
[2016-09-29 13:48:43.533] /2 | | |<=========================|
17424861 (S1AP) HandoverCommand mmeUeS1apId:182064991 enbUeS1apId:264792 
pmHoPrepSuccLteIntraF counter
[2016-09-29 13:48:43.533] /2 |<=========| | | | | |
17424861 (RRC4G) HandoverCommand targetPhysCellId:470 crnti:2651 dl-cFreq:125 
pmHoExeAttLteIntraF counter
[2016-09-29 13:48:46.625] /2 | | |<=========================|
17424861 (S1AP) UEContextReleaseCommand mmeUeS1apId:182064991 enbUeS1apId:264792
cause:radioNetwork:successful-handover  pmHoExeSuccLteIntraF counter

Mobility between LTE-WCDMA (features for Mobility between UTRAN and LTE)

CSFB to WCDMA
A handset that is camping in LTE has to fallback to WCDMA/GSM in order to make a Voice call (MO call)
or to receive a Voice call (MT call).

eNode-B release the UE in LTE side by indicating UTRAN frequency to which the UE should fallback via
rrcConnectionRelease message:
message c1 : rrcConnectionRelease : {
rrc-TransactionIdentifier 0,
criticalExtensions c1 : rrcConnectionRelease-r8 : {
releaseCause other,
redirectedCarrierInfo utra-FDD : 10565

The presence of the IE "CSFB Indication" in rrcConnectionRequest message in WCDMA indicates that the
UE has arrived from LTE due to a CS Fallback.
value UL-CCCH-Message ::=
{
  message rrcConnectionRequest :
    {
:
:
                                  {
                                    rrcConnectionRequest-v9b0ext
                                    {
                                      cSFBIndication true
                                    }
                                  }

Following counters exist in LTE for CSFB observability:

pmUeCtxtEstabAttCsfb
pmUeCtxtModAttCsfb
pmUeCtxtRelCsfbWcdma
pmUeCtxtRelCsfbGsm
pmUeCtxtRelNaccCsfbWcdma
pmHoPrepAttCsfb
pmHoPrepSuccCsfb
pmHoExeAttCsfb
pmHoExeSuccCsfb

CSFB Idle Mode

[12:51:40.915] du1/6 |======================>| 51224716 /0

(NAS4G) extendedServiceRequest
[12:51:40.936] du1/6 | | |<===========| 51224716 /0 (S1AP)
InitialContextSetupRequest mmeUeS1Id:1211109328 enbUeS1Id:274303 agMbrDl:102,40Mbps
agMbrUl:20,48Mbps qci:8 prioLev:1 preEmptCap:shall-not-trigger-pre-emption
preEmptVul:pre-emptable csfbInd:cs-fallback-required  pmUeCtxtEstabAttCsfb counter
:
:
[12:51:40.969] du1/6 |<=========| | | 51224716 /100711360
(RRC4G) rrcConnectionRelease rCause:other redirect:utra_FDD-10763 
pmUeCtxtRelCsfbWcdma counter
[12:51:40.983] du1/6 | | |===========>| 51224716 /0 (S1AP)
UEContextReleaseRequest mmeUeS1Id:1211109328 enbUeS1Id:274303 cause:radioNetwork-cs-
fallback-triggered

CSFB Connected Mode

[01:08:23.797]000100 /128 | | |<===========| 1081657373/0 (S1AP)
InitialContextSetupRequest mmeUeS1Id:310814582 enbUeS1Id:271689 agMbrDl:838,86Mbps
agMbrUl:838,86Mbps qci:9 prioLev:3 preEmptCap:shall-not-trigger-pre-emption
preEmptVul:pre-emptable
:
:
[01:09:01.956]000100 /128 |<======================| 1081657373/0
(NAS4G) CSServiceNotification
[01:09:02.007]000100 /128 |======================>| 1081657373/0
(NAS4G) extendedServiceRequest
[01:09:02.031]000100 /128 | | |<===========| 1081657373/0 (S1AP)
UEContextModificationRequest enbUeS1Id:271689 csfbInd:cs-fallback-required 
pmUeCtxtModAttCsfb counter
[01:09:02.032]000100 /128 | | |===========>| 1081657373/0 (S1AP)
UEContextModificationResponse mmeUeS1Id:310814582 enbUeS1Id:271689
[01:09:02.032]000100 /128 |<=========| | | 1081657373/0
(RRC4G) rrcConnectionRelease rCause:other redirCarInfo:geran  pmUeCtxtRelCsfbGsm
counter
[01:09:02.067]000100 /128 | | |===========>| 1081657373/0 (S1AP)
UEContextReleaseRequest mmeUeS1Id:310814582 enbUeS1Id:271689 cause:radioNetwork-ue-
not-available-for-ps-service

PSHO Based CSFB

[08:05:58.215]000100 /1 | | |<===========| 8393390 /0 (S1AP)

InitialContextSetupRequest mmeUeS1Id:56764333 enbUeS1Id:262971 agMbrDl:450,00Mbps
agMbrUl:50,00Mbps qci:9 prioLev:3 preEmptCap:shall-not-trigger-pre-emption
preEmptVul:pre-emptable trcID:25058999202104f6
:
:
[08:06:13.072]000100 /1 |======================>| 8393390 /0
(NAS4G) securityProtectedNASMessage
[08:06:13.076]000100 /1 | | |<===========| 8393390 /0 (S1AP)
UEContextModificationRequest enbUeS1Id:262971 csfbInd:cs-fallback-required 
pmUeCtxtModAttCsfb counter
[08:06:13.077]000100 /1 | | |===========>| 8393390 /0 (S1AP)
UEContextModificationResponse mmeUeS1Id:56764333 enbUeS1Id:262971
[08:06:13.084]000100 /1 |<=========| | | 8393390 /16805952
(RRC4G) rrcConnectionReconfiguration cFreq:3086 phCellId:77 phCellId:85 phCellId:105
phCellId:136 phCellId:508 phCellId:511 cFreq:10664 phCellId:23 phCellId:77 phCellId:85
phCellId:136 phCellId:511 event:B1 maxRepCell:4 repInt:480ms event:B1 maxRepCell:4
repInt:480ms measId:7(B1) measId:8(B1)
[08:06:13.110]000100 /1 |=========>| | | 8393390 /0
(RRC4G) rrcConnectionReconfigurationComplete
[08:06:13.525]000100 /1 |=========>| | | 8393390 /0
(RRC4G) measurementReport measId:8(B1) rsrp:-60 rsrq:-6.5 phCellId:511 rscp:-45
[08:06:13.531]000100 /1 | | |===========>| 8393390 /0 (S1AP)
HandoverRequired enbUeS1Id:262971 cause:radioNetwork-cs-fallback-triggered 
pmHoPrepAttCsfb counter
[08:06:13.720]000100 /1 | | |<===========| 8393390 /0 (S1AP)
HandoverCommand mmeUeS1Id:56764333 enbUeS1Id:262971  pmHoPrepSuccCsfb counter
[08:06:13.723]000100 /1 |<=========| | | 8393390 /16805952
(RRC4G) mobilityFromEUTRACommand purpose:handover  pmHoExeAttCsfb counter
[08:06:15.358]000100 /1 | | |<===========| 8393390 /0 (S1AP)
UEContextReleaseCommand cause:radioNetwork-successful-handover  pmHoExeSuccCsfb
counter

Release Redirect to LTE

Release with Redirect to LTE is a Network controlled IRAT mobility feature for moving LTE/UMTS capable
UE’s from WCDMA to LTE when the UE’s transition to lower activity ‘states’.

The feature improves LTE utilization by quickly moving users over to LTE after having been served, for
different reasons, by UMTS.

Release with Redirect to LTE has following triggers:

At the end of Speech call RNC releases the connection with rrcConnectionRelease message that includes
the LTE frequencies the UE shall scan.
},
message rrcConnectionRelease : r3 :
{
:
:
{
redirectionInfo interRATInfo : eutra :
{
eutra-TargetFreqInfoList
{
{
dlEUTRACarrierFreq 1583  LTE frequency
}
}
}
}

UE moves to Idle, scans the LTE frequencies, selects the first suitable LTE cell and registers in LTE by
sending Tracking Area Update Request to eNode-B.
There are no counters to identify CSFB returning UEs in LTE but such UEs use a random value in
RRCConnectionRequest message instead of m-TMSI:

[2016-12-21 00:53:26.276] |=========>| | | | | |

(RRC4G) RRCConnectionRequest cause:mo-Signalling randomValue:456454845802  CSFB
returning UE

[2016-12-21 00:53:26.486] |=========>| | | | | |

(RRC4G) RRCConnectionRequest m-TMSI:4167908001 cause:mo-Data mmeCode:148  UEs
already in LTE

PS IRAT Handover

In case of bad LTE coverage the UE is ordered to handover to best WCDMA cell. Best cell is selected
based on the result of an evaluation of WCDMA neighbor cells measurement.
LTE

[09:57:22.888] /1 | |===========>| 8397002 (S1AP)

HandoverRequired enbUeS1Id:524 cause:radioNetwork:s1-inter-system-handover-triggered
 pmHoPrepAtt counter
[09:57:23.060] /1 | |<===========| 8397002 (S1AP)
HandoverCommand enbUeS1Id:524  pmHoPrepSucc counter
[09:57:23.060] /1 |<====| | | 8397002 (RRC)
mobilityFromEUTRACommand purpose:handover  pmHoExeAtt counter
[09:57:23.356] | |<===========| (S1AP)
UEContextReleaseCommand mmeUeS1Id:79473180 cause:radioNetwork:successful-handover 
pmHoExeSucc counter

WCDMA

[09:57:22.982] 0014/05/393216 <<---<< (RANAP) RelocationRequest

(IMSI=235919100000034) (cause:radioNetwork/resource-optimisation-relocation) (ps-
domain) (target:RNC=145,CI=14512) (UE-History-Information:'000032F51911A45010000020'H)
(SubscriberProfileIDforRFP:1) (RAB-ID=0x5) (trafClass=background)
(maxBitRate=16000000) (maxBitRate=16000000) (arpPrio=2) (RAB-Parameter-
ExtendedMaxBitrateList) (maxBitRate=84000000) (addr=10.206.255.4) (GlobalCN-ID)
(pLMNidentity='32F519'H) (cN-ID=11) (PLMNidentity:'32F519'H)
[09:57:23.045] 0014/05/393216 >>--->> (RANAP) RelocationRequestAcknowledge
(RAB-ID=0x5) (addr=10.208.145.135) (standard-UMTS-integrity-algorithm-UIA1)
[09:57:23.292] 0014/05/2 >>--->> (NBAP) RadioLinkRestoreIndication
(tID=28514L) (RNC.CCID=77) (RL-SetID=0)
[09:57:23.292] 0014/05/2 >>--->> (RANAP) RelocationDetect
[09:57:23.341] 0014/06/2 >>-------->> (RRC) handoverToUTRANComplete
(cs-domain) (startVal=0x0) (ps-domain) (startVal=0xA)

Seen from Core Network

IRAT Offload From LTE

A UE offloaded from LTE to UMTS shall preferably not revert back to LTE until the load in LTE has
receded.

Using WCDMA parameter blockRwrEutraTime (default 200 seconds), it is possible to inhibit all triggering
of Release Redirect to LTE for a period of time for a connection that has been offloaded from LTE.
 From a signaling point of view IRAT Offload from LTE
is identical to PS Handover except for the cause value
used in RelocationRequest message is ‘reduce-load-
in-serving-cell’:
[15:42:44.488] 0006/00/313959
<<---<< (RANAP) RelocationRequest
(IMSI=208018902613811)
(cause:radioNetwork/reduce-load-in-serving-
cell) (ps-domain) (target:RNC=38,CI=5394)

In case of PS Handover cause value used in

RelocationRequest message is ‘resource-
optimisation-relocation’:
[09:57:22.982] 0014/04/ <<---<< (RANAP) RelocationRequest
(IMSI=235919100000034) (cause:radioNetwork/resource-optimisation-relocation) (ps-
domain) (target:RNC=145,CI=14512) (UE-History-Information:'000032F51911A45010000020'H)
(SubscriberProfileIDforRFP:1) (RAB-ID=0x5) (trafClass=background)
(maxBitRate=16000000) (maxBitRate=16000000) (arpPrio=2) (RAB-Parameter-
ExtendedMaxBitrateList) (maxBitRate=84000000) (addr=10.206.255.4) (GlobalCN-ID)
(pLMNidentity='32F519'H) (cN-ID=11) (PLMNidentity:'32F519'H)

[04:24:08.960]000100 /1 |=========>| | | 10350617 /0

(RRC4G) measurementReport measId:4(B1) rsrp:-68 rsrq:-4.5 phCellId:400 rscp:-56
[04:24:08.963]000100 /1 | | |===========>| 10350617 /0 (S1AP)
HandoverRequired enbUeS1Id:278369 cause:radioNetwork-reduce-load-in-serving-cell 
pmHoPrepAttLb counter
[04:24:09.092]000100 /1 | | |<===========| 10350617 /0 (S1AP)
HandoverCommand mmeUeS1Id:91122124 enbUeS1Id:278369  pmHoPrepSuccLb counter
[04:24:09.094]000100 /1 |<=========| | | 10350617 /0
(RRC4G) mobilityFromEUTRACommand purpose:handover  pmHoExeAttLb counter
[04:24:11.073]000100 /1 | | |<===========| 10350617 /0 (S1AP)
UEContextReleaseCommand cause:radioNetwork-successful-handover  pmHoExeSuccLb
counter

SRVCC (Single Radio Voice Call Continuity) Handover

A single radio UE scans and measures the signal quality of the supported radio accesses (LTE, WCDMA
and GSM) at regular intervals, and sends the measurements to the serving radio network.

If the signal quality of the serving LTE radio is below a configured threshold the eNode-B will request the
MME to make a handover to the WCDMA network. The MME node initiates the handover procedure by
sending a PS to CS handover request to the MSC over the Sv-interface.

An SRVCC call is not anchored in the MME during the SRVCC procedure so the MSC has to set up new
connections to both the IMS core and to the WCDMA RAN.
[2017-11-24 17:54:11.333] /12 | | |<=========================|
108064848 (S1AP) E-RABSetupRequest ipAddr:10.128.101.129 mmeUeS1apId:494110274
enbUeS1apId:264217 e-RAB-ID:7 gTP-TEID:1F2EBFD7'H qCI:1
[2017-11-24 17:54:11.380] /12 | | |=========================>|
108064848 (S1AP) E-RABSetupResponse ipAddr:10.216.68.254 mmeUeS1apId:494110274
enbUeS1apId:264217 e-RAB-ID:7 gTP-TEID:1D4FDD37'H
:
:
[2017-11-24 17:54:14.261] /12 | | |=========================>|
108064848 (S1AP) HandoverRequired plmnIdentity:302-720 mmeUeS1apId:494110274
enbUeS1apId:264217 cause:radioNetwork:s1-inter-system-handover-triggered lAC:55060
rNC-ID:43  pmHoPrepAttSrvcc counter
[2017-11-24 17:54:14.843] /12 | | |<=========================|
108064848 (S1AP) HandoverCommand mmeUeS1apId:494110274 enbUeS1apId:264217 
pmHoPrepSuccSrvcc counter
[2017-11-24 17:54:14.844] /12 |<=========| | | | | |
108064848 (RRC4G) MobilityFromEUTRACommand  pmHoExeAttSrvcc counter
[2017-11-24 17:54:15.381] /12 | | |<=========================|
108064848 (S1AP) UEContextReleaseCommand mmeUeS1apId:494110274 enbUeS1apId:264217
cause:radioNetwork:successful-handover  pmHoExeSuccSrvcc counter

Seen from Core Network

PS Handover from WCDMA

WCDMA
[14:30:33.523]0013/03 >>--->> (RANAP) RelocationRequired (UE:11)
(cause:radioNetwork/reduce-load-in-serving-cell) (pLMNidentity='32F519'H) (RNC-ID=268)
(pLMNidentity='32F519'H) (pLMNidentity='32F519'H)
[14:30:33.609]0013/03 <<---<< (RANAP) RelocationCommand (UE:11)
[14:30:33.609]0013/03 <<--------<< (RRC) handoverFromUTRANCommand-EUTRA
(UE:11) (rrcTID=0) (RAB-ID=0x05) (GSM-MAP) (ps-domain)
[14:30:54.089]0013/03 <<---<< (RANAP) Iu-ReleaseCommand (UE:11)
(cause:radioNetwork/successful-relocation)

LTE
[2018-03-07 14:30:33.540] /2 | | |<=========================|
16904194 (S1AP) HandoverRequest IMEISV:35854305111515151515 ipAddr:10.219.33.225
mmeUeS1apId:65766744 e-RAB-ID:5 gTP-TEID:2E9FC5B3'H qCI:9
cause:radioNetwork:reduce-load-in-serving-cell HLR:{servingPLMN:32F519'H}
[2018-03-07 14:30:33.568] /2 | | |=========================>|
16904194 (S1AP) HandoverRequestAcknowledge ipAddr:10.218.210.92
mmeUeS1apId:65766744 enbUeS1apId:266587 e-RAB-ID:5 gTP-TEID:47F40503'H
[2018-03-07 14:30:33.568] /2 |<=========| | | | | |
16904194 (RRC4G) HandoverCommand targetPhysCellId:40 dlBandwidth:n25
powerRampingStep:dB4 crnti:13339 antPortCnt:an1 ciphAlg:eea1 intProtAlg:eia2 dl-
cFreq:414 dl-BW:5.0MHz ttiBundling:FALSE drbId:3
[2018-03-07 14:30:34.060] /2 |=========>| | | | | |
16904194 (RRC4G) RRCConnectionReconfigurationComplete
[2018-03-07 14:30:34.064] /2 | | |=========================>|
16904194 (S1AP) HandoverNotify tac:155 plmnIdentity:235-91 plmnIdentity:235-91
enbId:72239 cellId:2 mmeUeS1apId:65766744 enbUeS1apId:266587

Note that in LTE there are no counters for incoming Handovers.

RIM Transfer
RncFeature=RimUtraSiLteInfoTransfer make it possible to transfer system information of a WCDMA cell
to LTE.
Mandatory IEs in Utra system information container are MIB, SIB1, SIB3, SIB5 and SIB7.

In order to transfer system information from WCDMA to LTE a so-called RIM Association has to be
established between LTE Cell and ExternalUtranCell through CN (SGSN and MME). A RIM Association is
initiated by eNode-B via S1AP/RANAP DirectInformationTransfer message when rimCapable attribute of
ExternalUtranFDD MO is set to RIM_CAPABLE.
LTE

[2015-06-01 16:10:35.916] | | |=========================>|

(S1AP) ENBDirectInformationTransfer plmnIdentity:235-91
[2015-06-01 16:10:36.012] | | |<=========================|
(S1AP) MMEDirectInformationTransfer

WCDMA
[16:10:35.984]0006/04 <<---<< (RANAP) DirectInformationTransfer (ps-
domain) (pLMNidentity='32F519'H) (cN-ID=11)
[16:10:35.984]0014/03 >>--->> (RANAP) DirectInformationTransfer
(pLMNidentity='32F519'H) (pLMNidentity='32F519'H) (ps-domain) (pLMNidentity='32F519'H)
(RNC-ID=146)

At CSFB the LTE network includes the WCDMA system broadcast info in the release massage to the UE.
RRC {
pdu value DL-DCCH-Message ::= {
message c1 : rrcConnectionRelease : {
rrc-TransactionIdentifier 0,
criticalExtensions c1 : rrcConnectionRelease_r8 : {
releaseCause other,
redirectedCarrierInfo utra_FDD : 10625,
nonCriticalExtension {
nonCriticalExtension {
cellInfoList-r9 utra_FDD_r9 : {
{
physCellId-r9 113,
utra-BCCH-Container-r9
'a84d42354896b8bf802c3216189188ccc1157229403220e2f6bc37ce2f72017d700479009142140244040
430c0a17170ab421e04609138af41800a4020600421282ea9888011a8d003affff43fffc5210f0290c0a80
18000c8bf1b15e20000003f3410e30000247894201400010440060222e56300c60202c000c14cc003c4300
b6d810021844a0585842f4000c070001deb007bf9608e30239408e7023ec08e9023f408eb023fc08ed023b
c08f1023cd200316161655043027616ea21400c053fe71e8a533419d2680ceb3406769a033bcd019e2680c
f334067a9a033dcd019f2680d0f3406889a0344cd253661a1e680d113406899a4a7303454d01a2e680d193
580287319760dc2260447409150690a8'H
},
{
physCellId-r9 114,
utra-BCCH-Container-r9
'a84d02354896a8bf80243214189388ccc1153229403220a2f6b437ca2f72017d500479009142140244040
430c0a17170ab421e04609138b041800a402060042129ea98880011a8d003affff43fffc5210f0290c0a80
18000c8bf1b15e20000003f3410e30000247894201400010440060222e56300c60202c000c14cc003c4300
b6d810021844a0585842f4000c060001deb007bf9608e50238c08e7023ec08e9023f408eb023fc08ed023b
c08f1023cd200316161655043027616ea21400c053fe71e8a533419d2680ceb3406769a033bcd019e2680c
f334067a9a033dcd019f2680d0f3406889a0344cd253661a1e680d113406899a4a7303454d01a2e680d193
580287319760dc2260447409150690a8'H
},
{
physCellId-r9 126,
utra-BCCH-Container-r9
'a84c02354896a8bf80343210189188ccc1153229403220a2f6b437ca2f72017d500479009242140244040
430c0a17170ab421e046092391e41800a402060042129ea98880011a8d003affff43fffc5210f0290c0a80
18000c8bf1b15e20000003f3410e30000247894201400010440060222e56300c60202c000c14cc003c4300
b6d810021844a0585842f4000c060001deb007bf9608fd023bc08fb023c408ff023cc08e30239408e7023a
408eb023b5200316161655043027616ea21400c053fe71e8a533419ea680cf734067c9a0343cd01a22680d
133406749a033acd019da680cef3406789a033ccd253661a1e680d113406899a4a7303454d01a2e680d193
580287319760dc2260447409150690a8'H
}
}
}
}
}
}
}
}

The mobile needs only to read a small part of the system broadcast before accessing WCDMA cell. This
decreases the extra call set up delay by up to 0.5 - 0.7s.

TA/LA Mapping
The TA-LA mapping is important due to the combined procedures requested by the UE.

The LTE (TA) and 2G/3G (LA) are mapped by connecting them to the same Geographical Area in the
SGSN-MME.
A TAI list should be assigned in a way that it does not span over different LAs i.e. it should consider the
LA boundaries of the target RAT.

It is possible to map one or several TAs to one LA, but only one LA to a TA.

UE Capability Analysis

In ueCapabilityInformation UE informs all the details of its capabilities. As LTE release goes higher and
more features are added, ueCapabilityInformation has become the longest and most complicated Radio
Message.

Longer the UE capabilities list greater the risk it can cause in certain scenarios, for instance at Handover
when UE capability container has to send to target node…..this can cause issues as Core Network nodes
have limitations for the size of message.

MR151 (from L17.Q3.2 onwards) have a workaround for this issue by means of eNode-B can now request
UE to report only a subset of Carrier Aggregation combinations it supports (by including
requestedFrequencyBands-r11 IE in ueCapabilityEnquiry message):

OFFLINE_131579_DCG_K> mom . requestedBandCombCompresssion

180201-14:57:30 OFFLINE_131579_dcg_k 16.0c ERBS_NODE_MODEL_J_1_82_COMPLETE

stopfile=/tmp/8528

######################################################################################
##############################################
MO Class                  Attribute                             
Type                                               Flags
######################################################################################
##############################################
CarrierAggregationFunction  requestedBandCombCompresssion         
enumRef:RequestedBandCombCompression               noNotification,EricssonOnly
--------------------------------------------------------------------------------------
----------------------------------------------
Determines the size of UE band combination report by controlling which IEs are used to
query the UE band combination support.
Visibility: User category: Ericsson personnel
Dependencies: Only applicable when CarrierAggregation is enabled. The UE must support
at least release 11.
Change takes effect: Takes effect at next UE capability refresh.
Default=R11_REQUESTED_BAND_COMBO
Range: 0,1
**************************************************************************************
**********************************************

Total: 1 MOs, 1 attributes

Note that above option is only available for UEs of release 11 or higher.

Example
OFFLINE_131579_DCG_K> hget EUtranFrequency Freq
180201-15:22:27 OFFLINE_131579_dcg_k 16.0c ERBS_NODE_MODEL_J_1_82_COMPLETE
stopfile=/tmp/8528

======================================================================================
=========================================
MO EUtranFrequencyId
additionalFreqBandList excludeAdditionalFreqBandList freqBand
======================================================================================
=========================================
EUtraNetwork=1,EUtranFrequency=1 1 i[0] =
i[0] = 7
EUtraNetwork=1,EUtranFrequency=1650 1650 i[1] = 9
i[0] = 3
EUtraNetwork=1,EUtranFrequency=EUtranFrequency3 EUtranFrequency3 i[0] =
i[0] = 20
======================================================================================
==========================================
Total: 3 MOs

[2018-01-30 14:03:04.412] [000100\01]1/worker1(1/Ft_RRC_ASN)

/local/repo/elinhuu/racoam/elib/insBl/rrcLU/generated/src/elibInsRrcProtocolD.cc:296
BUS_SEND:UE_TRACE: CellId 22, RacUeRef 192549456, bbUeRef 369183168 Encode RRC PDU
RRCDL_DCCH_Message (32) (buf length = 8 bytes)
0000 38 28 04 98 84 C0 81 80 '8(......'
RRC {
pdu value DL-DCCH-Message ::= {
message c1 : ueCapabilityEnquiry : {
rrc-TransactionIdentifier 0,
criticalExtensions c1 : ueCapabilityEnquiry_r8 : {
ue-CapabilityRequest {
RAT-Type eutra,
RAT-Type utra,
RAT-Type geran-cs
},
nonCriticalExtension {
nonCriticalExtension {
requestedFrequencyBands-r11 {
FreqBandIndicator-r11 20,
FreqBandIndicator-r11 3,
FreqBandIndicator-r11 7
}
}
}
}
}
}
}

[~/decoder/bin]$ ./ue_cap_0.6.pl
/cygdrive/c/Misc/LTE/CSRs/CSR3315780/UERadioAccessCapabilityInformation.log
================
Version: 0.6
File name: /cygdrive/c/Misc/LTE/CSRs/CSR3315780/UERadioAccessCapabilityInformation.log
Options:
================
UE Category: 12
ue-Category 4
ue-Category-v1020 7
ue-Category-v1170 10
ue-Category-v11a0 12
ue-CategoryDL-r12 12
ue-CategoryUL-r12 13
 ue-CategoryDL-v1260 16

3GPP Release: rel13

FGI
featureGroupIndicators '11111111110011110001111010100110'B,
featureGroupIndRel9Add-r9 '11000111100000000000000000000000'B,
featureGroupIndRel10-r10 '01010000001111000000000000000000'B,

Features
Network assisted CRS-IC: not supported
ANR with Autonomous Gaps
Intra: not supported
Inter: not supported
Utran: not supported
Multi Clustered PUSCH (MC_PUSCH): not supported
(* see help notes about MC PUSCH support)
Inter-Frequency OTDOA: not supported
Carrier Aggregation summary: 2CC, 3CC, 4CC, ULCA

Frequency band retrieval: supported,

Frequency band retrieval (requested bands): 20, 3, 7
Total number of band combinations is: 40

BandEUTRA(ext) DL_256-qam UL_64-qam MC_PUSCH

38 supported supported no
39 supported supported no
40 supported supported no
41 supported supported no
34 supported supported no
3 supported supported no
7 supported supported no
20 supported supported no
1 supported supported no
8 supported supported no
26 supported supported no
18 supported supported no
5 supported supported no
6 supported supported no
19 supported supported no
28 supported supported no
32 supported supported no
4 supported supported no
2 supported supported no
12 supported supported no
17 supported supported no
9 supported supported no

Indx BandComb UL|DL Class MIMO_ULDL

#carriers BandCombExt
0: 3+ UD aa .4
1DL 1UL
1: 7+ UD aa .4
1DL 1UL
2: 3+ UD ac .4
2DL 1UL
3: 7+ UD ac .4
2DL 1UL 111
4: 3 3 UD D aa a .2 .2
2DL 1UL 111
5: 7 7 UD D aa a .2 .2
2DL 1UL 1111
 6: 3+ 7+ UD D aa a .4 .4
2DL 1UL 11
7: 7+ 3+ UD D aa a .4 .4
2DL 1UL 11
8: 3+ 20 UD D aa a .4 .2
2DL 1UL 11
9: 20 3+ UD D aa a .2 .4
2DL 1UL 11
10: 7+ 20 UD D aa a .4 .2
2DL 1UL 11
11: 20 7+ UD D aa a .2 .4
2DL 1UL 11
12: 3+ UD cc .4
2DL 2UL
13: 7+ UD cc .4
2DL 2UL 111
14: 7 UD ad .2
3DL 1UL
15: 7 UD cd .2
3DL 2UL
16: 3+ 7+ UD D aa c .4 .4
3DL 1UL 11
17: 7+ 3+ UD D ac a .4 .4
3DL 1UL 11
18: 7+ 3+ UD D cc a .4 .4
3DL 2UL 11
19: 3+ 7+ UD D ac a .4 .4
3DL 1UL
20: 3+ 7+ UD D cc a .4 .4
3DL 2UL
21: 7+ 3+ UD D aa c .4 .4
3DL 1UL
22: 3+ 20 UD D ac a .4 .2
3DL 1UL
23: 20 3+ UD D aa c .2 .4
3DL 1UL
24: 3 3 7+ UD D D aa a a .2 .2 .4
3DL 1UL 11
25: 7+ 3 3 UD D D aa a a .4 .2 .2
3DL 1UL 11
26: 3 3 20 UD D D aa a a .2 .2 .2
3DL 1UL
27: 20 3 3 UD D D aa a a .2 .2 .2
3DL 1UL
28: 3+ 7+ 20 UD D D aa a a .4 .4 .2
3DL 1UL
29: 7+ 3+ 20 UD D D aa a a .4 .4 .2
3DL 1UL
30: 20 3+ 7+ UD D D aa a a .2 .4 .4
3DL 1UL
31: 3+ 7 UD D ac c .4 .2
4DL 1UL 11
32: 7+ 3 UD D ac c .4 .2
4DL 1UL 11
33: 3+ 7 20 UD D D ac a a .4 .2 .2
4DL 1UL
34: 3+ 7 20 UD D D cc a a .4 .2 .2
4DL 2UL
35: 7+ 3 20 UD D D aa c a .4 .2 .2
4DL 1UL
36: 20 3+ 7 UD D D aa c a .2 .4 .2
4DL 1UL
 37: 3 3 7+ 20 UD D D D aa a a a .2 .2 .4 .2
4DL 1UL
38: 7+ 3 3 20 UD D D D aa a a a .4 .2 .2 .2
4DL 1UL
39: 20 3 3 7+ UD D D D aa a a a .2 .2 .2 .4
4DL 1UL

Without support for MR151 iPhone8 Capability is as below:

[~/decoder/bin]$ ./ue_cap_0.6.pl
/cygdrive/c/Misc/LTE/CSRs/CSR3318512/LTE/HandoverRequired_Failure.log
================
Version: 0.6
File name: /cygdrive/c/Misc/LTE/CSRs/CSR3318512/LTE/HandoverRequired_Failure.log
Options:
================
UE Category: 11
   ue-Category 4
   ue-Category-v1020 6
   ue-Category-v1170 9
   ue-Category-v11a0 11
     ue-CategoryDL-r12 11
     ue-CategoryUL-r12 5
 
3GPP Release: rel11
 
FGI
  featureGroupIndicators '01111111110011111111111010111110'B,
  featureGroupIndRel9Add-r9 '11000000100000000000000000000000'B,
  featureGroupIndRel10-r10 '01000000001001000000000000000000'B,
 
Features
  Network assisted CRS-IC: not supported
  ANR with Autonomous Gaps
     Intra: not supported
     Inter: not supported
     Utran: not supported
  Multi Clustered PUSCH (MC_PUSCH): not supported
     (* see help notes about MC PUSCH support)
  Inter-Frequency OTDOA: not supported
  Carrier Aggregation summary: 2CC, 3CC
 
Frequency band retrieval: supported
Frequency band retrieval (requested bands): none
Total number of band combinations is: 79
 
BandEUTRA(ext)  DL_256-qam      UL_64-qam       MC_PUSCH
1               supported       supported       no
3               supported       supported       no
7               supported       supported       no
8               supported       supported       no
20              supported       supported       no
28              supported       supported       no
38              supported       supported       no
40              supported       supported       no
 
Indx   BandComb         UL|DL            Class           MIMO_ULDL      #carriers 
BandCombExt
  0:    3               UD               ac              .2             2DL 1UL
  1:    3   3           UD   D           aa   a          .2  .2         2DL 1UL    111
  2:    3   7           UD   D           aa   a          .2  .2         2DL 1UL    11
  3:    3   7            D  UD            a  aa          .2  .2         2DL 1UL    11
  4:    3  20           UD   D           aa   a          .2  .2         2DL 1UL    11
  5:    3  20            D  UD            a  aa          .2  .2         2DL 1UL    11
  6:    1   3           UD   D           aa   a          .2  .2         2DL 1UL
  7:    1   3            D  UD            a  aa          .2  .2         2DL 1UL
  8:    3   8           UD   D           aa   a          .2  .2         2DL 1UL   
1111
  9:    3   8            D  UD            a  aa          .2  .2         2DL 1UL   
1111
10:    3  28           UD   D           aa   a          .2  .2         2DL 1UL    11
11:    3  28            D  UD            a  aa          .2  .2         2DL 1UL    11
12:    7               UD               ab              .2             2DL 1UL
13:    7               UD               ac              .2             2DL 1UL    111
14:    7   7           UD   D           aa   a          .2  .2         2DL 1UL    1111
15:    7  20           UD   D           aa   a          .2  .2         2DL 1UL    11
16:    7  20            D  UD            a  aa          .2  .2         2DL 1UL    11
17:    1   7           UD   D           aa   a          .2  .2         2DL 1UL
18:    1   7            D  UD            a  aa          .2  .2         2DL 1UL
19:    7   8           UD   D           aa   a          .2  .2         2DL 1UL    111
20:    7   8            D  UD            a  aa          .2  .2         2DL 1UL    111
21:    7  28           UD   D           aa   a          .2  .2         2DL 1UL    11
22:    7  28            D  UD            a  aa          .2  .2         2DL 1UL    11
23:    1  20           UD   D           aa   a          .2  .2         2DL 1UL
24:    1  20            D  UD            a  aa          .2  .2         2DL 1UL
25:   40               UD               ac              .2             2DL 1UL    11
26:    1   8           UD   D           aa   a          .2  .2         2DL 1UL    111
27:    1   8            D  UD            a  aa          .2  .2         2DL 1UL    111
28:    1  28           UD   D           aa   a          .2  .2         2DL 1UL    11
29:    1  28            D  UD            a  aa          .2  .2         2DL 1UL    11
30:   38               UD               ac              .2             2DL 1UL
31:    3   7           UD   D           ac   a          .2  .2         3DL 1UL
32:    3   3   7       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL    11
33:    3   7            D  UD            c  aa          .2  .2         3DL 1UL
34:    3   3   7        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL    11
35:    1   3           UD   D           aa   c          .2  .2         3DL 1UL
36:    1   3            D  UD            a  ac          .2  .2         3DL 1UL
37:    3   3   8       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL    11
38:    3   3   8        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL    11
39:    3   7           UD   D           aa   b          .2  .2         3DL 1UL
40:    3   7           UD   D           aa   c          .2  .2         3DL 1UL    11
41:    3   7   7       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL    11
42:    3   7            D  UD            a  ab          .2  .2         3DL 1UL
43:    3   7            D  UD            a  ac          .2  .2         3DL 1UL    11
44:    3   7   7        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL    11
45:    3   7  20       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL
46:    3   7  20        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL
47:    3   7  20        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL
48:    1   3   7       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL
49:    1   3   7        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL
50:    1   3   7        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL
51:    3   7   8       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL    111
52:    3   7   8        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL    111
53:    3   7   8        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL    111
54:    3   7  28       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL
55:    3   7  28        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL
56:    3   7  28        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL
57:    1   3  20       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL
58:    1   3  20        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL
59:    1   3  20        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL
60:    1   3   8       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL    1111
61:    1   3   8        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL    1111
62:    1   3   8        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL    1111
63:    1   3  28       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL
64:    1   3  28        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL
65:    1   3  28        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL
66:    7  28           UD   D           ab   a          .2  .2         3DL 1UL
67:    7  28           UD   D           ac   a          .2  .2         3DL 1UL
68:    7  28            D  UD            b  aa          .2  .2         3DL 1UL
69:    7  28            D  UD            c  aa          .2  .2         3DL 1UL
70:    1   7  20       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL    11
71:    1   7  20        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL    11
72:    1   7  20        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL    11
73:    1   7   8       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL
74:    1   7   8        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL
75:    1   7   8        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL
76:    1   7  28       UD   D   D       aa   a   a      .2  .2  .2     3DL 1UL    11
77:    1   7  28        D  UD   D        a  aa   a      .2  .2  .2     3DL 1UL    11
78:    1   7  28        D   D  UD        a   a  aa      .2  .2  .2     3DL 1UL    11
DAY6 (по факту System Information началось во второй части 6-го
дня, в первой части были проблемы технического характера и
больший акуент на UE capability)

System Information

UE needs to locate and read the system information before establishing any connection to the E-UTRA.

UE shall apply the System Information acquisition procedure (among others):

 upon selecting and upon reselecting cell,

 after handover completion,
 after entering E-EUTRA from another RAT,
 upon receiving a notification that the system information is changed,
 upon receiving an indication about the presence of an ETWS/CMAS notification,

Most important System Information Block (SIB) are SIB1, SIB2 and Mib.
RRC {
pdu value BCCH-DL-SCH-Message ::= {
message c1 : systemInformationBlockType1 : {
cellAccessRelatedInfo {
plmn-IdentityList {
PLMN-IdentityInfo {
plmn-Identity {
mcc {
MCC-MNC-Digit 2,
MCC-MNC-Digit 5,
MCC-MNC-Digit 0
},
mnc {
MCC-MNC-Digit 0,
MCC-MNC-Digit 1
}
},
cellReservedForOperatorUse reserved
},
PLMN-IdentityInfo {
plmn-Identity {
mcc {
MCC-MNC-Digit 2,
MCC-MNC-Digit 5,
MCC-MNC-Digit 0
},
mnc {
MCC-MNC-Digit 9,
MCC-MNC-Digit 9
}
},
cellReservedForOperatorUse notReserved
}
},
 trackingAreaCode '0010110011110000'B,  tac is 11504
cellIdentity '0111111111101110010000001111'B,  enbid=524004 cellid=15
cellBarred notBarred,
intraFreqReselection allowed,
csg-Indication FALSE
},
cellSelectionInfo {
q-RxLevMin -65
},
freqBandIndicator 7,
schedulingInfoList {
SchedulingInfo {
si-Periodicity rf8,
sib-MappingInfo {
SIB-Type sibType3
}
},
SchedulingInfo {
si-Periodicity rf64,
sib-MappingInfo {
SIB-Type sibType6
}
},
SchedulingInfo {
si-Periodicity rf64,
sib-MappingInfo {
SIB-Type sibType7
}
}
},
si-WindowLength ms10,
systemInfoValueTag 7,
nonCriticalExtension {
nonCriticalExtension {
cellSelectionInfo-v920 {
q-QualMin-r9 -20
}
}
}
}
}
}

Above information is taken from following eNode-B configuration:

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> get ^ENodeBFunction=1 enbid

180305-15:36:58 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c

ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
======================================================================================
===========================
MO Attribute Value
======================================================================================
===========================
ENodeBFunction=1 eNBId 524004
======================================================================================
===========================
Total: 1 MOs

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> get ^EUtranCellFDD cellid 15$

180305-15:39:27 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c

ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
======================================================================================
===========================
MO Attribute Value
======================================================================================
===========================
EUtranCellFDD=1500045 cellId 15
======================================================================================
===========================
Total: 1 MOs

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> get EUtranCellFDD=1500045 tac$

180305-15:48:41 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c

ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
======================================================================================
===========================
MO Attribute Value
======================================================================================
===========================
EUtranCellFDD=1500045 tac 11504
======================================================================================
===========================
Total: 1 MOs

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> get ^ENodeBFunction=1 plmn

180305-15:44:50 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c

ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
======================================================================================
===========================
MO Attribute Value
======================================================================================
===========================
ENodeBFunction=1 eNodeBPlmnId Struct{3}
>>> 1.mcc = 250
>>> 2.mnc = 1
>>> 3.mncLength = 2
======================================================================================
===========================
Total: 1 MOs

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> get EUtranCellFDD=1500045 activePlmnList|

additionalPlmnList|additionalPlmnReservedList|primaryPlmnReserved

180305-15:43:55 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c

ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
======================================================================================
===========================
MO Attribute Value
======================================================================================
===========================
EUtranCellFDD=1500045 activePlmnList t[2] =
>>> Struct[0] has 3 members:
>>> 1.mcc = 250
>>> 2.mnc = 1
>>> 3.mncLength = 2
>>> Struct[1] has 3 members:
>>> 1.mcc = 250
>>> 2.mnc = 99
>>> 3.mncLength = 2
EUtranCellFDD=1500045 additionalPlmnList t[5] =
>>> Struct[0] has 3 members:
>>> 1.mcc = 250
 >>> 2.mnc = 99
>>> 3.mncLength = 2
>>> Struct[1] has 3 members:
>>> 1.mcc = 1
>>> 2.mnc = 1
>>> 3.mncLength = 2
>>> Struct[2] has 3 members:
>>> 1.mcc = 1
>>> 2.mnc = 1
>>> 3.mncLength = 2
>>> Struct[3] has 3 members:
>>> 1.mcc = 1
>>> 2.mnc = 1
>>> 3.mncLength = 2
>>> Struct[4] has 3 members:
>>> 1.mcc = 1
>>> 2.mnc = 1
>>> 3.mncLength = 2
EUtranCellFDD=1500045 additionalPlmnReservedList
b[5] = false true true true true
EUtranCellFDD=1500045 primaryPlmnReserved true
======================================================================================
===========================
Total: 1 MOs

RRC {
pdu value BCCH-DL-SCH-Message ::= {
message c1 : systemInformation : {
criticalExtensions systemInformation_r8 : {
sib-TypeAndInfo {
sib2 : {
radioResourceConfigCommon {
rach-ConfigCommon {
preambleInfo {
numberOfRA-Preambles n64
},
powerRampingParameters {
powerRampingStep dB4,
preambleInitialReceivedTargetPower dBm-110
},
ra-SupervisionInfo {
preambleTransMax n10,
ra-ResponseWindowSize sf10,
mac-ContentionResolutionTimer sf64
},
maxHARQ-Msg3Tx 4
},
bcch-Config {
modificationPeriodCoeff n2
},
pcch-Config {
defaultPagingCycle rf128,
nB oneT
},
prach-Config {
rootSequenceIndex 517,
prach-ConfigInfo {
prach-ConfigIndex 5,
highSpeedFlag FALSE,
zeroCorrelationZoneConfig 12,
prach-FreqOffset 2
}
},
pdsch-ConfigCommon {
referenceSignalPower 14,
 p-b 0
},
pusch-ConfigCommon {
pusch-ConfigBasic {
n-SB 1,
hoppingMode interSubFrame,
pusch-HoppingOffset 0,
enable64QAM FALSE
},
ul-ReferenceSignalsPUSCH {
groupHoppingEnabled TRUE,
groupAssignmentPUSCH 0,
sequenceHoppingEnabled FALSE,
cyclicShift 0
}
},
pucch-ConfigCommon {
deltaPUCCH-Shift ds1,
nRB-CQI 1,
nCS-AN 0,
n1PUCCH-AN 16
},
soundingRS-UL-ConfigCommon setup : {
srs-BandwidthConfig bw0,
srs-SubframeConfig sc3,
ackNackSRS-SimultaneousTransmission TRUE
},
uplinkPowerControlCommon {
p0-NominalPUSCH -103,
alpha al1,
p0-NominalPUCCH -117,
deltaFList-PUCCH {
deltaF-PUCCH-Format1 deltaF0,
deltaF-PUCCH-Format1b deltaF3,
deltaF-PUCCH-Format2 deltaF0,
deltaF-PUCCH-Format2a deltaF0,
deltaF-PUCCH-Format2b deltaF0
},
deltaPreambleMsg3 6
},
ul-CyclicPrefixLength len1,
uplinkPowerControlCommon-v1020 {
deltaF-PUCCH-Format3-r10 deltaF0,
deltaF-PUCCH-Format1bCS-r10 deltaF2
}
},
ue-TimersAndConstants {
t300 ms400,
t301 ms600,
t310 ms2000,
n310 n20,
t311 ms5000,
n311 n1
},
freqInfo {
additionalSpectrumEmission 1
},
timeAlignmentTimerCommon infinity
}
}
}
}
}
}

Above information is taken from following eNode-B configuration:

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> hget . t300|t301|t310|t311|n300|n311
180305-15:57:42 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c
ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
..........
======================================================================================
===========================
MO n311 t301 t310 t311
======================================================================================
===========================
RlfProfile=0 1 600 2000 5000
======================================================================================
===========================

======================================================================================
===========================
MO n311 t300 t301 t310 t311
======================================================================================
===========================
Rrc=1 1 400 600 2000 5000
======================================================================================
===========================
Total: 1 MOs

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> hget EUtranCellFDD=1500045 pZeroNominalPusch|

pZeroNominalPucch

180305-16:23:27 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c

ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
.
======================================================================================
===========================
MO pZeroNominalPucch pZeroNominalPusch
======================================================================================
===========================
EUtranCellFDD=1500045 -117 -103
======================================================================================
===========================
Total: 1 MOs

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> get EUtranCellFDD=1500045 rachRootSequence|prach

180305-16:29:13 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c

ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
======================================================================================
===========================
MO Attribute Value
======================================================================================
===========================
EUtranCellFDD=1500045 rachRootSequence 517
======================================================================================
===========================
Total: 1 MOs

And coli command, lratdbi | egrep -i "prachConfiguration|CellIdT".

System Information mapping can be seen with following command:

OFFLINE_BTS_15_004_L_MTSVC_DCG_K> get EUtranCellFDD=1500045 mappingInfo

180305-16:42:19 OFFLINE_BTS_15_004_L_MTSVC_dcg_k 16.0c

ERBS_NODE_MODEL_F_1_108_COMPLETE stopfile=/tmp/12464
======================================================================================
===========================
MO Attribute Value
======================================================================================
===========================
EUtranCellFDD=1500045 mappingInfo Struct{11}
>>> 1.mappingInfoSIB4 = 0 (NOT_MAPPED)
>>> 2.mappingInfoSIB15 = 0 (NOT_MAPPED)
>>> 3.mappingInfoSIB16 = 0 (NOT_MAPPED)
>>> 4.mappingInfoSIB5 = 3 (MAPPED_SI_3)
>>> 5.mappingInfoSIB6 = 4 (MAPPED_SI_4)
>>> 6.mappingInfoSIB7 = 5 (MAPPED_SI_5)
>>> 7.mappingInfoSIB8 = 0 (NOT_MAPPED)
>>> 8.mappingInfoSIB3 = 1 (MAPPED_SI_1)
>>> 9.mappingInfoSIB10 = 1 (MAPPED_SI_1)
>>> 10.mappingInfoSIB11 = 0 (NOT_MAPPED)
>>> 11.mappingInfoSIB12 = 0 (NOT_MAPPED)
======================================================================================
===========================
Total: 1 MOs

System Information can be obtained real-time from an eNode-B using following colli commandsl:

get cell ^cellid$

cell sib -cellId 2

OR

rrt-cell system | grep SysInfoC | grep -i active | cut -d '>' -f 3- | awk '{print "rrt-cell info " $1}' > sysinfo
run sysinfo

Or by lock/unlock cell and activating RRC_ASN traces.

ANR Example (see attached files) (12:25 время Тилака)

MME Selection (13:01 время Тилака)

The UE uses TMSI (or more correctly GUTI) to identify itself to the network.

This GUTI can be,

Native : meaning assigned to UE directly by MME (for instance via attachAccept or

trackingAreaUpdateAccept message)                                                               

OR

Mapped : derived by CSFB UEs from 3G P-TMSI and RAI

UE indicate if it has a Native GUTI or Mapped GUTI in the very first NAS message sent to MME.

The case where UE is already in LTE it indicates that it has a Native GUTI in for instance attachRequest or
trackingAreaUpdateRequest message as below:
[2018-03-11 18:01:18.011] /11 |====================================>|
93139607 (NAS4G) attachRequest m-TMSI:3393989981 AttachType:Combined EPS/IMSI
attach NASKeySetIdentifier:4

},
TMSIStatus '00'H,
mobileStationClassmark2 '57 58 86'H,
VoiceDomainPreferencesAndUEsUsageSetting {
spare '00'H,
uesUsageSetting Voice centric (0),
voiceDomainPreferenceForEutran CS Voice only (0)
},
oldGUTIType '00'H  old GUTI type 0 means Native (1 means Mapped)

MME selection for an UE is based on what UE report to eNode-B in rrcConnectionRequest or

rrcConnectionSetupComplete message.

rrcConnectionRequest message is used if UE already have a valid TMSI as below:

[2018-03-11 17:54:13.110] /1 |=========>| | | | | |

9171409 (RRC4G) RRCConnectionRequest m-TMSI:3925961002 cause:mt-Access
mmeCode:104

[2018-03-11 17:54:13.110] [000100\01]1/worker1(1/Ft_RRC_ASN)

UehUeCtxtHandlerMgrC.cpp:4247 BUS_RECEIVE:UE_TRACE: CellId 1, RacUeRef 9171409, Decode
RRC PDU RRCUL_CCCH_Message (33) (buf length = 6 bytes)
0000 46 8E A0 16 92 A4 'F.....'
RRC {
pdu value UL-CCCH-Message ::= {
message c1 : rrcConnectionRequest : {
criticalExtensions rrcConnectionRequest_r8 : {
ue-Identity s_TMSI : {
mmec '01101000'B,  MME code is 104
m-TMSI '11101010000000010110100100101010'B
},
establishmentCause mt-Access,
spare '0'B
}
}
}
}

If UE does not have a valid TMSI (which is the case when UE return after CSFB) then UE normally report a
random value in rrcConnectionRequest message as below:
[2018-03-11 17:55:26.977] |=========>| | | | | |
(RRC4G) RRCConnectionRequest cause:mo-Signalling randomValue:981979706860
[2018-03-11 17:55:26.977] [000100\01]1/worker1(1/Ft_RRC_ASN)
UehUeCtxtHandlerMgrC.cpp:4247 BUS_RECEIVE:UE_TRACE: CellId 0, RacUeRef 5145444, Decode
RRC PDU RRCUL_CCCH_Message (33) (buf length = 6 bytes)
0000 5E 4A 28 D3 5E C6 '^J(.^.'
RRC {
pdu value UL-CCCH-Message ::= {
message c1 : rrcConnectionRequest : {
criticalExtensions rrcConnectionRequest_r8 : {
ue-Identity randomValue : '1110010010100010100011010011010111101100'B, 
random value
establishmentCause mo-Signalling,
spare '0'B
}
}
}
}

In cases where UE report a random value, MME selection is based on what UE report in
rrcConnectionSetupComplete message:
[2018-03-11 17:55:27.020] /0 |=========>| | | | | |
5145444 (RRC4G) RRCConnectionSetupComplete selectedPLMN-Identity:1 mmegi:12428
mmeCode:80

[2018-03-11 17:55:27.020] [000100\02]1/worker2(1/Ft_RRC_ASN)

/local/repo/elinhuu/racoam/elib/insBl/rrcLU/generated/src/elibInsRrcProtocolD.cc:581
BUS_RECEIVE:UE_TRACE: CellId 0, RacUeRef 5145444, bbUeRef 0 Decode RRC PDU
RRCUL_DCCH_Message (34) (buf length = 90 bytes)
0000 20 30 30 8C 50 53 17 C5 F4 E5 47 09 07 48 12 0B ' 00.PS....G..H..'
0010 F6 56 F5 01 30 8C 50 F6 2F 63 5A 82 19 52 31 08 '.V..0.P./cZ..R1.'
0020 50 0B F6 56 F5 01 80 01 50 FD 41 63 E1 55 69 3C 'P..V....P.Ac.Ui<'
0030 B5 DD 58 04 F0 F0 C0 40 52 56 F5 01 0F AD 5C 20 '..X....@RV....\ '
0040 00 57 02 20 00 31 03 E5 60 34 13 56 F5 01 30 8C '.W. .1..`4.V..0.'
0050 11 03 57 58 86 5D 01 00 E1 71 '..WX.]...q'
RRC {
pdu value UL-DCCH-Message ::= {
message c1 : rrcConnectionSetupComplete : {
rrc-TransactionIdentifier 0,
criticalExtensions c1 : rrcConnectionSetupComplete_r8 : {
selectedPLMN-Identity 1,
registeredMME {
mmegi '0011000010001100'B,  MMEGI is 12428
mmec '01010000'B  MME code is 80
},
dedicatedInfoNAS
'17c5f4e547090748120bf656f501308c50f62f635a8219523108500bf656f501800150fd4163e155693cb
5dd5804f0f0c0405256f5010fad5c2000570220003103e560341356f501308c11035758865d0100e1'H,
nonCriticalExtension {
nonCriticalExtension {
gummei-Type-r10 mapped,
rlf-InfoAvailable-r10 true
}
}
}
}
}
In this case MME routing works like this,

If Most Significant Bit (MSB) of MME Group Identity (MMEGI) is 0  route UE to indicated MME code
found under attribute mmeCodeListOtherRATs

                                                                                                                                                                  OR

If Most Significant Bit (MSB) of MME Group Identity (MMEGI) is 1  route UE to indicated MME code
found under attribute mmeCodeListLTERelated and MME Group Identity (MMEGI) is same as
mmeGIListLTERelated  

For UEs returning from CSFB it is the first option that would apply, namely:

If Most Significant Bit (MSB) of MME Group Identity (MMEGI) is 0  route UE to indicated MME code
found under attribute mmeCodeListOtherRATs

MME Routing Examples

L10999-MTN_HQ_PH1_PCELL> hget TermPointToMme mmeCodeListLTERelated|

mmeCodeListOtherRATs|mmeGIListLTERelated|usedIpAddress

180317-19:42:20 10.45.204.241 18.0a ERBS_NODE_MODEL_J_1_82_COMPLETE

stopfile=/tmp/25386
..
======================================================================================
===========================
MO mmeCodeListLTERelated mmeCodeListOtherRATs
mmeGIListLTERelated usedIpAddress
======================================================================================
===========================
TermPointToMme=MME_010104039241 i[1] = 104 i[1] = 104 i[1] =
32769 10.104.39.241
TermPointToMme=MME_010111039241 i[1] = 80 i[1] = 80 i[1] =
32769 10.111.39.241
TermPointToMme=MME_010127039241 i[1] = 72 i[1] = 72 i[1] =
32769 10.127.39.242
======================================================================================
===========================
Total: 3 MOs

Example 1

[2018-03-11 18:01:31.110] /1 |=========>| | | | | |

9179625 (RRC4G) RRCConnectionRequest m-TMSI:3566716577 cause:mo-Data mmeCode:72
[2018-03-11 18:01:31.145] /1 |====================================>|
9179625 (NAS4G) serviceRequest
[2018-03-11 18:01:31.145] /1 | | |=========================>|
9179625 (S1AP) InitialUEMessage m-TMSI:d497c6a1'H tac:4013 plmnIdentity:655-10
plmnIdentity:655-10 enbId:10999 cellId:1 enbUeS1apId:278248 mMEC:48'H cause:mo-
Data
[2018-03-11 18:01:31.171] [000100\01]1/worker1(1/Ft_RRC_CONN_SETUP)
UehNwIfDTermC.cpp:2236 TRACE7:UE_TRACE: CellId 1, RacUeRef 9179625, uehNwIfDTermC:
received signal: s1MessageInInd; port: uehNwIfDProxyP[0]; state: no such state; data:
UehNwIfS1MessageInIndD{racUeRef 9179625,cellId
1,mmeIpAddress"10.127.39.242",secData,gummei"{0x48,0x8001,[0x28f,0xa,0x2]}",mmeRef
245,mmeFroId 2}

[2018-03-11 18:01:31.110] [000100\01]1/worker1(1/Ft_RRC_ASN)

UehUeCtxtHandlerMgrC.cpp:4247 BUS_RECEIVE:UE_TRACE: CellId 1, RacUeRef 9179625, Decode
RRC PDU RRCUL_CCCH_Message (33) (buf length = 6 bytes)
0000 44 8D 49 7C 6A 18 'D.I|j.'
RRC {
pdu value UL-CCCH-Message ::= {
message c1 : rrcConnectionRequest : {
criticalExtensions rrcConnectionRequest_r8 : {
ue-Identity s_TMSI : {
mmec '01001000'B,  MME code is 72
m-TMSI '11010100100101111100011010100001'B
},
establishmentCause mo-Data,
spare '0'B
}
}
}
}

Example 2

[2018-03-11 18:00:45.120] /1 |=========>| | | | | |

9220584 (RRC4G) RRCConnectionRequest cause:mo-Signalling randomValue:520989964798
[2018-03-11 18:00:45.162] /1 |=========>| | | | | |
9220584 (RRC4G) RRCConnectionSetupComplete selectedPLMN-Identity:1 mmegi:12428
mmeCode:80
[2018-03-11 18:00:45.162] /1 |====================================>|
9220584 (NAS4G) trackingAreaUpdateRequest m-TMSI:3845097754 dlBandwidth:Combined
TA/LA updating
[2018-03-11 18:00:45.162] /1 | | |=========================>|
9220584 (S1AP) InitialUEMessage tac:4013 plmnIdentity:655-10 plmnIdentity:655-
10 enbId:10999 cellId:1 enbUeS1apId:278241 cause:mo-Signalling

[2018-03-11 18:00:45.509] [000100\01]1/worker1(1/Ft_RRC_CONN_SETUP)

UehNwIfDTermC.cpp:2236 TRACE7:UE_TRACE: CellId 1, RacUeRef 9220584, uehNwIfDTermC:
received signal: s1MessageInInd; port: uehNwIfDProxyP[0]; state: no such state; data:
UehNwIfS1MessageInIndD{racUeRef 9220584,cellId
1,mmeIpAddress"10.111.39.241",secData,gummei"{0x50,0x8001,[0x28f,0xa,0x2]}",mmeRef
164,mmeFroId 0}

2018-03-11 18:00:45.162] [000100\01]1/worker1(1/Ft_RRC_ASN)

/local/repo/elinhuu/racoam/elib/insBl/rrcLU/generated/src/elibInsRrcProtocolD.cc:581
BUS_RECEIVE:UE_TRACE: CellId 1, RacUeRef 9220584, bbUeRef 0 Decode RRC PDU
RRCUL_DCCH_Message (34) (buf length = 90 bytes)
0000 20 30 30 8C 50 53 17 00 61 EE 96 05 07 48 01 0B ' 00.PS..a....H..'
0010 F6 56 F5 01 30 8C 50 E5 2F 89 1A 80 19 D2 AE 94 '.V..0.P./.......'
0020 50 0B F6 56 F5 01 80 01 50 E6 FF 89 BB 55 94 EF 'P..V....P....U..'
0030 27 A4 58 04 F0 F0 C0 40 52 56 F5 01 0F AD 5C 20 ''.X....@RV....\ '
0040 00 57 02 20 00 31 03 E5 60 34 13 56 F5 01 30 8C '.W. .1..`4.V..0.'
0050 11 03 57 58 86 5D 01 00 E1 61 '..WX.]...a'
RRC {
pdu value UL-DCCH-Message ::= {
message c1 : rrcConnectionSetupComplete : {
rrc-TransactionIdentifier 0,
criticalExtensions c1 : rrcConnectionSetupComplete_r8 : {
selectedPLMN-Identity 1,
registeredMME {
mmegi '0011000010001100'B,  MMEGI is 12428
mmec '01010000'B  MME code is 80
},
dedicatedInfoNAS
'170061ee96050748010bf656f501308c50e52f891a8019d2ae94500bf656f501800150e6ff89bb5594ef2
7a45804f0f0c0405256f5010fad5c2000570220003103e560341356f501308c11035758865d0100e1'H,
nonCriticalExtension {
nonCriticalExtension {
gummei-Type-r10 mapped
}
}
}
}
}

Example 3

[2018-03-11 18:01:17.966] /11 |=========>| | | | | |

93139607 (RRC4G) RRCConnectionRequest cause:mo-Signalling randomValue:169268204499
[2018-03-11 18:01:18.011] /11 |=========>| | | | | |
93139607 (RRC4G) RRCConnectionSetupComplete selectedPLMN-Identity:1 mmegi:32769
mmeCode:104
[2018-03-11 18:01:18.011] /11 |====================================>|
93139607 (NAS4G) attachRequest m-TMSI:3393989981 EPSAttachTypeValue:Combined
EPS/IMSI attach nonDrxTimer:0 NASKeySetIdentifier:4
[2018-03-11 18:01:18.012] /11 | | |=========================>|
93139607 (S1AP) InitialUEMessage tac:4013 plmnIdentity:655-10 plmnIdentity:655-
10 enbId:10999 cellId:11 enbUeS1apId:278246 cause:mo-Signalling

[2018-03-11 18:01:18.201] [000100\03]1/worker3(1/Ft_RRC_CONN_SETUP)

UehNwIfDTermC.cpp:2236 TRACE7:UE_TRACE: CellId 11, RacUeRef 93139607, uehNwIfDTermC:
received signal: s1MessageInInd; port: uehNwIfDProxyP[0]; state: no such state; data:
UehNwIfS1MessageInIndD{racUeRef 93139607,cellId
11,mmeIpAddress"10.104.39.241",secData,gummei"{0x68,0x8001,[0x28f,0xa,0x2]}",mmeRef
165,mmeFroId 1}

[2018-03-11 18:01:18.011] [000100\03]1/worker3(1/Ft_RRC_ASN)

/local/repo/elinhuu/racoam/elib/insBl/rrcLU/generated/src/elibInsRrcProtocolD.cc:581
BUS_RECEIVE:UE_TRACE: CellId 11, RacUeRef 93139607, bbUeRef 0 Decode RRC PDU
RRCUL_DCCH_Message (34) (buf length = 94 bytes)
0000 20 30 80 01 68 57 17 05 CE DA 1A 04 07 41 42 0B ' 0..hW.......AB.'
0010 F6 56 F5 01 80 01 68 CA 4C 2D 5D 04 F0 F0 C0 C0 '.V....h.L-].....'
0020 00 23 02 01 D0 31 27 1D 80 80 21 10 01 01 00 10 '.#...1'...!.....'
0030 81 06 00 00 00 00 83 06 00 00 00 00 00 03 00 00 '................'
0040 0A 00 00 0D 00 52 56 F5 01 0F AD 5C 20 00 31 03 '.....RV....\ .1.'
0050 E5 60 34 90 11 03 57 58 86 5D 01 00 E0 60 '.`4...WX.]...`'
RRC {
pdu value UL-DCCH-Message ::= {
message c1 : rrcConnectionSetupComplete : {
rrc-TransactionIdentifier 0,
criticalExtensions c1 : rrcConnectionSetupComplete_r8 : {
 selectedPLMN-Identity 1,
registeredMME {
mmegi '1000000000000001'B,  MMEGI is 32769
mmec '01101000'B  MME code is 104
},
dedicatedInfoNAS
'1705ceda1a040741420bf656f501800168ca4c2d5d04f0f0c0c000230201d031271d80802110010100108
10600000000830600000000000300000a00000d005256f5010fad5c20003103e560349011035758865d010
0e0'H,
nonCriticalExtension {
nonCriticalExtension {
gummei-Type-r10 native
}
}
}
}
}

DAY7
IMEISV fetch from MME (время 11:01 у Тилака)

To identify UE model it is required to configure MME to send IMEISV to eNode-B via

InitialContextSetupRequest message as below:
[2017-01-16 19:35:44.486] 15 | | |<=========================|
133034066 (S1AP) InitialContextSetupRequest IMEISV: 01397300641515151516
mmeUeS1apId:362196766 enbUeS1apId:275474qCI:8 HRL:{servingPLMN:310-410}
forbiddenInterRATs:cdma2000 :{e-RAB-ID:5,ipAddr:2600:300:2020:28ff:0:0:0:6,gTP-
TEID:80B9A087'H}

        {

          id 192,

          criticality ignore,

          value Masked-IMEISV :

'0000000100111001011100110000000001100100111111111111111100010110'B

        }

Masked-IMEISV IE in InitialContextSetupRequest message is decoded as below:

0000000100111001011100110000000001100100111111111111111100010110

0000 0001 0011 1001 0111 0011 0000 0000 0110 0100 1111 1111 1111 1111 0001 0110

0     1    3     9    7    3    0    0    6    4   15   15   15   15    1    6

IMEISV = 01397300641515151516

TAC = 01397300   Apple:iPhone_5S

Huawei implementation is such that it requires to swap every octet in TAC to get the actual TAC as
below:

53 47 60 70 --> 35 74 06 07 = 35740607

35740607;GALAXY:J7_2016_SM-J710FN/DS

In order to propagate IMEISV to other eNode-Bs at X2 Handover (via X2AP HandoverRequest message)
it is required to enable Differentiated UE Handling feature.

Ericsson MME Configuration (время у Тилака 11:13)

==========================

1) Backup prior activity

gsh checkpoint { -cpn Pres1ImeiNodeFunctionEnabled }

2) Check features in relation to imei

gsh list_node_function -name imei

gsh get_node_function -name s1ap_send_masked_imeisv

3) Turn on s1ap_send_masked_imeisv feature

gsh modify_node_function -name s1ap_send_masked_imeisv -state on

4) Activate configuration change

gsh list_config_pending
gsh check_config
gsh activate_config_pending

5) Backup post activity

gsh checkpoint { -cpn Posts1ImeiNodeFunctionEnabled }

Huawei MME Configuration

========================

Set Compatibility of S1 Interface (SET S1CMPT)

MSKIMEISVSCOPE: Masked IMEISV Sending Scope: This parameter is optional.

This parameter specifies the sending scope of the Masked IMEISV IE in the Initial
Context Setup Request and Handover Request messages that the MME sends to eNodeBs.
Upon receiving the IE, an eNodeB can then perform IMEISV-based differentiated control
on UEs.
Data source: planned for the entire network
Value:
SPECENODEB(Specified eNodeBs)
ALLENODEB(All eNodeBs)
Initial value: SPECENODEB(Specified eNodeBs)
Configuration notes: The Masked IMEISV IE is introduced in 3GPP Release 12. Huawei
eNodeBs support the Masked IMEISV IE. The MME identifies Huawei eNodeB through Huawei
proprietary messages Huawei eNodeBs send over the S1 interface. eNodeBs from other
vendors may not be able to support this IE.
If the MME is connected to some eNodeBs that do not support the Masked IMEISV IE, set
this parameter to SPECENODEB(Specified eNodeBs). Then the MME sends this IE only to
Huawei eNodeBs.
If all eNodeBs connected to the MME support the Masked IMEISV IE, set this parameter
to ALLENODEB(All eNodeBs). Then the MME sends this IE to all eNodeBs.

IMSI/TMSI Tracing (время у Тилака 11:28)

IMSI tracing from OSS/MME

========================

IMSI/UE tracing can be initiated from OSS or MME as below:

3GPP 32.422 elaborate Trace Activation procedure even further:

4.1.2.11 E-UTRAN activation mechanisms

The Trace Session should be activated in in an eNB when the eNB receives the TRACE
START, INITIAL CONTEXT SETUP REQUEST or HANDOVER REQUEST message with the IE Trace
Activation from the MME and if some activities have been started on the interfaces
that have been requested to be traced.
If the subscriber or equipment which is traced makes a handover to a target eNB using
the X2 interface, the source eNB should propagate the trace control and configuration
parameters further to the target eNB by using the HANDOVER REQUEST message. When the
target eNB receives the HANDOVER REQUEST message it should immediately start a Trace
Session according to the trace control and configuration parameters received in the
HANDOVER REQUEST message.
The TRACE START, INITIAL CONTEXT SETUP REQUEST or HANDOVER REQUEST message that is
received from the MME contains the following information:

• Trace Reference
• including Trace Recording Session Reference
• Trace Depth
• List of interfaces for eNB
• IP address of Trace Collection Entity

In InitialContextSetupRequest received from MME there is a reference to interfaces to trace in LRAN:

S1AP {
pdu value S1AP-PDU ::= initiatingMessage : {
procedureCode 9,
criticality reject,
value InitialContextSetupRequest : {
protocolIEs {
{
:
:
{
id 25,
criticality ignore,
value TraceActivation : {
e-UTRAN-Trace-ID '06f220020417000c'H,
interfacesToTrace '11100000'B,  intrefaces to trace are S1AP, X2AP and
RRC
traceDepth maximum,
traceCollectionEntityIPAddress '00000000'B
}
},
:
:

In TraceStart received from MME there is a reference to the streaming server ip-address and interfaces
to trace in LRAN:

S1AP {
  pdu value S1AP-PDU ::= initiatingMessage : {
    procedureCode 27,
    criticality ignore,
    value TraceStart : {
      protocolIEs {
        {
          id 0,
          criticality reject,
          value MME-UE-S1AP-ID : 45052715
        },
        {
          id 8,
          criticality reject,
          value ENB-UE-S1AP-ID : 264411
        },
        {
          id 25,
          criticality ignore,
          value TraceActivation : {
            e-UTRAN-Trace-ID '49f4474460000001'H,
            interfacesToTrace '11100000'B,   intrefaces to trace are S1AP, X2AP and
RRC
            traceDepth maximum,
            traceCollectionEntityIPAddress '00001010101011100010000010110111'B   
ip-address of streaming server is 10.174.32.183
          }
        }
      }
    }
  }
}

UE tracing can be initiated from Ericsson MME using following commands:

=== sysadm@eqm01s14p2 ANCB ~ # gsh create_ue_trace -id 505686260000004 -ref

50568626004 -ifl s1,x2,uu -ent enodeb
=== sysadm@eqm01s14p2 ANCB ~ # gsh create_ue_trace -id 602022212133307 -type imsi
-ref 60202444447 -depth maximum -ifl all -dm medium -iflm all -ip NULL -ent enodeb

Note : Huawei MME needs to enable the feature call E2E (End to End) to initiate UE tracing in Ericsson
eNode-B.

To fetch UE tracing information for a particular IMSI in Ericsson MME:

=== SGSN10 sysadm@eqm01s0fp2 ANCB fm_alarm/tmp # gsh get_ue_trace -id 235919300000191

Parameter Active Data Planned Data
-----------------------------------------------------------------
timestamp 20180515131824 _
planState _ _
type (UeIdType) imsi _
ref (UeTraceReference) 00000000002 _
depth (UeTraceDepth) maximum _
ifl (UeTraceInterfaceListENodeB) all _
iflm (UeTraceInterfaceListMme) all _
ip (OSSLogServerIpAddress) NULL _
imsi (Imsi) 235919300000191 _
imei (Imei) undefined _
isv (ImeiSv) undefined _
sti (Stmsi) undefined _
ent (EpsNodeType) enodeb _
tfs (TraceFirstStartedAt) undefined _
cause (TraceFailureCause) undefined _
origin (Origin) action _
utd (UeTraceDuration) NULL _

To fetch all UE tracing activated users in Ericsson MME:

SGSN10 sysadm@eqm01s0fp2 ANCB fm_alarm/tmp # gsh list_ue_trace

ps Class Identifiers |
---------------------------------------
A ue_trace -id 235919300000191
A ue_trace -id 235919300000194
A ue_trace -id 235919300000196
A ue_trace -id 235919300000197
A ue_trace -id 235919300000198
A ue_trace -id 235919300000199

UE Tracing logs (and CTR logs) are saved at following location in G1 RBS types:
ls /c/pm_data

UE Tracing logs (and CTR logs) are saved at following location in G2 RBS types:

ftree /pm_data/

To fetch ROP file in G1 RBS types:

ftget /c/pm_data/A20181120.2200-2215_CellTrace_DUL1_1.bin.gz .

To fetch ROP file in G2:

ftget /pm_data/A20181120.0615-0630_uetrace_510f01100125.bin.gz .

TMSI tracing from eNode-B (12:03 время Тилака)

=======================

In order to start TMSI tracing from eNode-B it is required to find out TMSI assigned to UE from MME.

In Ericsson MME following commands can be used to get the TMSI of a certain IMSI/MSISDN:

=== SGSN08 eric@eqm01s0fp2 ANCB ~ # gsh get_subscriber -imsi 602022212026542 -dl 2

Subscriber Data
----------------------------------------------------------------------
IMSI : 602022212026542
Mobile Subscriber ISDN No. : 201000059866
IMEI : 354453061270320
Roaming Status : Home
Suspend Status : Not Suspended
HSS Address : hq-hss01-003.epc.mnc002.mcc602.3gppnetwork.org
Home PLMN APN Operator Id : mnc002.mcc602.gprs
APN OI Replacement : Information not available
Subscribed Teleservices : No SMS
Network Access Mode : Packet/Circuit Switched
Regional Subscription Zone Code List : Information not available
Radio Access Technology : LTE
Mobility Management State : EMM-REGISTERED ECM-CONNECTED
OLP Priority : 3
MPS-CS-Priority : Information not available
MPS-EPS-Priority : Information not available
CS Service : csfb and sms
Security Context State : Security Context with Secure exchange
Paging Proceed Flag : Set
Last Visited Tracking Area [TAI] : 602-02-21250
Tracking Area List : 602-02-21250
Periodic TA Update Timer : 3240
GUTI
PLMN Id : 602-02
 MME Group Id : 10
MME Code : 136
M-TMSI : 3492468410 (#D02AD6BA)
MSC/VLR Address : BC6
:
:

=== HBMME26BER ericsson@eqm01s0fp2 ANCB ~ # gsh get_subscriber -msisdn 8618714606155

-dl 2

Subscriber Data
----------------------------------------------------------------------
IMSI : 460026490013444
Mobile Subscriber ISDN No. : 8618714606155
IMEI : 863285038584460
Roaming Status : Home
Suspend Status : Not Suspended
HSS Address :
hbhss03fe101ber.hb.hl.node.epc.mnc000.mcc460.3gppnetwork.org
Home PLMN APN Operator Id : mnc002.mcc460.gprs
APN OI Replacement : Information not available
Subscribed Teleservices : No SMS
Network Access Mode : Information not available
Regional Subscription Zone Code List :
Radio Access Technology : LTE
Mobility Management State : EMM-REGISTERED ECM-CONNECTED
OLP Priority : 1
MPS-CS-Priority : Information not available
MPS-EPS-Priority : Information not available
CS Service : csfb and sms
Security Context State : Security Context with Secure exchange
Paging Proceed Flag : Set
Last Visited Tracking Area [TAI] : 460-00-17760
Tracking Area List : 460-00-17760
Periodic TA Update Timer : 3240
GUTI
PLMN Id : 460-00
MME Group Id : 578
MME Code : 210
M-TMSI : 3761219950 (#E02FA96E)
MSC/VLR Address :
8613441706.VLR.mnc000.mcc460.3gppnetwork.org
:
:

TMSI tracing covers following scenarios:

1) Tracing the TMSI within same eNode-B (even after Handovers)

2) Continue tracing the TMSI in target eNode-B even after X2 Handover
3) Continue tracing the TMSI even if RRC Re-establishment happens

TMSI Tracing is initiated as below:

SELIITENB00496> ue set -tmsi 3225446511 -traceref 322544

180404-07:09:37 10.75.137.26 18.0c ERBS_NODE_MODEL_J_1_265_COMPLETE

stopfile=/tmp/10798
$ ue set -tmsi 3225446511 -traceref 322544
Set traceref 000000322544 for racUeRef 0 on cell 0
$

SELIITENB00496> ue enable -ue -traceref 322544

180404-07:09:40 10.75.137.26 18.0c ERBS_NODE_MODEL_J_1_265_COMPLETE

stopfile=/tmp/10798
$ ue enable -ue -traceref 322544
Enable Ue OK!
$

TMSI must be given in decimal.

Traceref is just a number (it is possible to give any number) and during the ongoing call it is possible to
see given traceref from below command:

SELIITENB00496> ue print -ue

180404-07:11:11 10.75.137.26 18.0c ERBS_NODE_MODEL_J_1_265_COMPLETE

stopfile=/tmp/10798
$ ue print -ue
CellId  RacUeRef   BbUeRef    
{traceRef,interfaces,traceDepth,ipAddress}                           
TypeOfActiveTrace SetByColi CTSess
2       16781328   33554944    {0x000000322544,
[],0,0.0.0.0}                                         LRUT              true     
2399  
$

Here is an example of TMSI tracing in both source eNode-B and target eNode-B after X2 Handover.

Source eNode-B

SELIITENB00496> ue set -tmsi 3225446511 -traceref 322544

180404-07:09:37 10.75.137.26 18.0c ERBS_NODE_MODEL_J_1_265_COMPLETE

stopfile=/tmp/10798
$ ue set -tmsi 3225446511 -traceref 322544
Set traceref 000000322544 for racUeRef 0 on cell 0
$

SELIITENB00496> ue enable -ue -traceref 322544

180404-07:09:40 10.75.137.26 18.0c ERBS_NODE_MODEL_J_1_265_COMPLETE

stopfile=/tmp/10798
$ ue enable -ue -traceref 322544
Enable Ue OK!
$

[2018-04-04 05:11:01.631]             |=========>|    |    |    |    |     

|              (RRC4G)  RRCConnectionRequest m-TMSI:3225446511  cause:mo-Data 
mmeCode:16
[2018-04-04 05:11:01.638]      /2     |<=========|    |    |    |    |      |  
16781328   (RRC4G)  RRCConnectionSetup transmissionMode:tm3  t-PollRetransmit:ms80  t-
Reordering:ms35
[2018-04-04 05:11:01.670]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  RRCConnectionSetupComplete selectedPLMN-Identity:1
[2018-04-04 05:11:01.671]      /2     |    |     |=========================>|  
16781328   (S1AP)   InitialUEMessage m-TMSI:3225446511  tac:4316  plmnIdentity:262-80 
plmnIdentity:262-80  enbId:200496  cellId:2  enbUeS1apId:262160  mMEC:10'H  cause:mo-
Data
[2018-04-04 05:11:01.671]      /2     |====================================>|  
16781328   (NAS4G)  serviceRequest
[2018-04-04 05:11:01.681]      /2     |    |     |<=========================|  
16781328   (S1AP)   InitialContextSetupRequest ipAddr:10.75.206.129 
mmeUeS1apId:47869666  enbUeS1apId:262160  e-RAB-ID:5  gTP-TEID:7F1FEC4C'H  qCI:9 
agMbrDl:300.00Mbps  agMbrUl:300.00Mbps  HRL:{servingPLMN:262-80}
[2018-04-04 05:11:01.681]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  UERadioAccessCapabilityInformation
[2018-04-04 05:11:01.681]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  UE-EUTRA-Capability ueCategory:4  accessStratumRelease:rel11 
bandEUTRA:1
[2018-04-04 05:11:01.683]      /2     |<=========|    |    |    |    |      |  
16781328   (RRC4G)  SecurityModeCommand intraFreqReselection:eea1 
integrityProtAlgorithm:eia2
[2018-04-04 05:11:01.708]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  SecurityModeComplete
[2018-04-04 05:11:01.710]      /2     |<=========|    |    |    |    |      |  
16781328   (RRC4G)  UECapabilityEnquiry
[2018-04-04 05:11:01.736]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  UECapabilityInformation ratType:eutra
[2018-04-04 05:11:01.739]      /2     |    |     |=========================>|  
16781328   (S1AP)   UECapabilityInfoIndication mmeUeS1apId:47869666 
enbUeS1apId:262160
[2018-04-04 05:11:01.739]      /2     |<=========|    |    |    |    |      |  
16781328   (RRC4G)  UERadioAccessCapabilityInformation
[2018-04-04 05:11:01.753]      /2     |<=========|    |    |    |    |      |  
16781328   (RRC4G)  RRCConnectionReconfiguration  :eventA3  a3Offset:0   :eventA2  
:eventA2  measId:3  measId:3  measId:3  drbId:3
[2018-04-04 05:11:01.778]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  RRCConnectionReconfigurationComplete
[2018-04-04 05:11:01.780]      /2     |    |     |=========================>|  
16781328   (S1AP)   InitialContextSetupResponse ipAddr:10.75.138.26 
mmeUeS1apId:47869666  enbUeS1apId:262160  e-RAB-ID:5  gTP-TEID:EE3468CD'H
[2018-04-04 05:11:57.898]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  MeasurementReport measId:2(A2) rsrp:-87 rsrq:-6.5
[2018-04-04 05:11:57.900]      /2     |<=========|    |    |    |    |      |  
16781328   (RRC4G)  RRCConnectionReconfiguration  :eventA1   :eventA1   :eventA5 
measId:6  measId:6  measId:6
[2018-04-04 05:11:57.922]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  RRCConnectionReconfigurationComplete
[2018-04-04 05:11:59.489]      /2     |=========>|    |    |    |    |      |  
16781328   (RRC4G)  MeasurementReport measId:6(A5) rsrp:-89 rsrq:-6.0 phCellId:295
rsrp:-95 rsrq:-7.0
[2018-04-04 05:11:59.494]      /2     |    |     |==================>|      |  
16781328   (X2AP)   HandoverRequest ipAddr:10.75.206.129  e-RAB-ID:5  gTP-
TEID:7F1FEC4C'H  qCI:9  MMEGID:32768  cause:radioNetwork:handover-desirable-for-radio-
reasons  UE-X2AP-ID:0  nextHop:0  cellSize:verysmall  target ECGI:{plmnIdentity:262-
80,enbId:200497,cellId:6}  GUMMEI:{plmnIdentity:262-80}  HRL:{servingPLMN:262-80} 
mmeUeS1apId:47869666  mmeCode:10'H
[2018-04-04 05:11:59.494]      /2     |<=========|    |    |    |    |      |  
16781328   (RRC4G)  HandoverPreparationInformation trackingAreaCode:4316 
sourcePhysCellId:289  sourceECGI:{plmnIdentity:262-80,enbId:200496,cellId:2} 
cipheringAlgorithm:eea1  integrityProtAlgorithm:eia2  crnti:26899
[2018-04-04 05:11:59.527]      /2     |    |     |<==================|      |  
16781328   (X2AP)   HandoverRequestAcknowledge ipAddr:10.75.138.27  E-RABs-Admitted-
List:{e-RAB-ID:5}  gTP-TEID:5C7B4E67'H  UE-X2AP-ID-OLD:5  UE-X2AP-ID-NEW:5
[2018-04-04 05:11:59.527]      /2     |<=========|    |    |    |    |      |  
16781328   (RRC4G)  HandoverCommand targetPhysCellId:295  powerRampingStep:dB4  ra-
PreambleIndex:52  crnti:2995  antPortCnt:an2  ciphAlg:eea1  intProtAlg:eia2 
nextHop:0  keyChangeIndicator:FALSE  dl-cFreq:300  ttiBundling:FALSE 
txMode:3(OL_MIMO)
[2018-04-04 05:11:59.532]      /2     |    |     |==================>|      |  
16781328   (X2AP)   SNStatusTransfer e-RAB-ID:5  UE-X2AP-ID:5  UE-X2AP-ID:5
[2018-04-04 05:11:59.753]      /2     |    |     |<==================|      |  
16781328   (X2AP)   UEContextRelease UE-X2AP-ID:5  UE-X2AP-ID:5

Target eNode-B
SELIITENB00497> ue set -tmsi 3225446511 -traceref 322544

180404-07:09:39 10.75.137.27 18.0c ERBS_NODE_MODEL_J_1_265_COMPLETE

stopfile=/tmp/17309
$ ue set -tmsi 3225446511 -traceref 322544
Set traceref 000000322544 for racUeRef 0 on cell 0
$

SELIITENB00497> ue enable -ue -traceref 322544

180404-07:09:41 10.75.137.27 18.0c ERBS_NODE_MODEL_J_1_265_COMPLETE

stopfile=/tmp/17309
$ ue enable -ue -traceref 322544
Enable Ue OK!
$

[2018-04-04 05:11:59.496]      /6     |    |     |<==================|      |  

50339956   (X2AP)   HandoverRequest ipAddr:10.75.206.129  e-RAB-ID:5  gTP-
TEID:7F1FEC4C'H  qCI:9  MMEGID:32768  cause:radioNetwork:handover-desirable-for-radio-
reasons  UE-X2AP-ID:5  nextHop:0  cellSize:verysmall  target ECGI:{plmnIdentity:262-
80,enbId:200497,cellId:6}  GUMMEI:{plmnIdentity:262-80}  HRL:{servingPLMN:262-80} 
mmeUeS1apId:47869666  mmeCode:10'H
[2018-04-04 05:11:59.496]      /6     |=========>|    |    |    |    |      |  
50339956   (RRC4G)  HandoverPreparationInformation trackingAreaCode:4316 
sourcePhysCellId:289  sourceECGI:{plmnIdentity:262-80,enbId:200496,cellId:2} 
cipheringAlgorithm:eea1  integrityProtAlgorithm:eia2  crnti:26899
[2018-04-04 05:11:59.496]      /6     |=========>|    |    |    |    |      |  
50339956   (RRC4G)  UE-EUTRA-Capability ueCategory:4  accessStratumRelease:rel11 
bandEUTRA:5
[2018-04-04 05:11:59.525]      /6     |<=========|    |    |    |    |      |  
50339956   (RRC4G)  HandoverCommand targetPhysCellId:295  powerRampingStep:dB4  ra-
PreambleIndex:52  crnti:2995  antPortCnt:an2  ciphAlg:eea1  intProtAlg:eia2 
nextHop:0  keyChangeIndicator:FALSE  dl-cFreq:300  ttiBundling:FALSE 
txMode:3(OL_MIMO)
[2018-04-04 05:11:59.526]      /6     |    |     |==================>|      |  
50339956   (X2AP)   HandoverRequestAcknowledge ipAddr:10.75.138.27  E-RABs-Admitted-
List:{e-RAB-ID:5}  gTP-TEID:5C7B4E67'H  UE-X2AP-ID-OLD:5  UE-X2AP-ID-NEW:5
[2018-04-04 05:11:59.526]      /6     |<=========|    |    |    |    |      |  
50339956   (RRC4G)  HandoverCommand targetPhysCellId:295  powerRampingStep:dB4  ra-
PreambleIndex:52  crnti:2995  antPortCnt:an2  ciphAlg:eea1  intProtAlg:eia2 
nextHop:0  keyChangeIndicator:FALSE  dl-cFreq:300  ttiBundling:FALSE 
txMode:3(OL_MIMO)
[2018-04-04 05:11:59.533]      /6     |    |     |<==================|      |  
50339956   (X2AP)   SNStatusTransfer e-RAB-ID:5  UE-X2AP-ID:5  UE-X2AP-ID:5
[2018-04-04 05:11:59.594]      /6     |=========>|    |    |    |    |      |  
50339956   (RRC4G)  RRCConnectionReconfigurationComplete
[2018-04-04 05:11:59.596]      /6     |    |     |=========================>|  
50339956   (S1AP)   PathSwitchRequest tac:4316  plmnIdentity:262-80  plmnIdentity:262-
80  ipAddr:10.75.138.27  enbId:200497  cellId:6  mmeUeS1apId:47869666 
enbUeS1apId:262410  e-RAB-ID:5  gTP-TEID:491E3238'H
[2018-04-04 05:11:59.752]      /6     |    |     |<=========================|  
50339956   (S1AP)   PathSwitchRequestAcknowledge mmeUeS1apId:67058602 
enbUeS1apId:262410
[2018-04-04 05:11:59.752]      /6     |    |     |==================>|      |  
50339956   (X2AP)   UEContextRelease UE-X2AP-ID:5  UE-X2AP-ID:5
[2018-04-04 05:11:59.754]      /6     |<=========|    |    |    |    |      |  
50339956   (RRC4G)  RRCConnectionReconfiguration  :eventA3  a3Offset:0   :eventA2  
:eventA2  measId:3  measId:3  measId:3
[2018-04-04 05:11:59.797]      /6     |=========>|    |    |    |    |      |  
50339956   (RRC4G)  RRCConnectionReconfigurationComplete

Source eNode-B transfer TMSI (Dec 3225446511 = Hex c040686f) to target eNode-B via
HandoverRequest message using the newly introduced Ericsson proprietary IE:
[2018-04-04 05:11:59.494]      /2     |    |     |==================>|      |  
16781328   (X2AP)   HandoverRequest ipAddr:10.75.206.129  e-RAB-ID:5  gTP-
TEID:7F1FEC4C'H  qCI:9  MMEGID:32768  cause:radioNetwork:handover-desirable-for-radio-
reasons  UE-X2AP-ID:0  nextHop:0  cellSize:verysmall  target ECGI:{plmnIdentity:262-
80,enbId:200497,cellId:6}  GUMMEI:{plmnIdentity:262-80}  HRL:{servingPLMN:262-80} 
mmeUeS1apId:47869666  mmeCode:10'H

        {
          id 43229,
          criticality ignore,
          value EAB-HandoverRequest-ExtConveyor : {
            protocolIEs {
              {
                id 4159,
                criticality ignore,
                value Opaque Open Type : '0400c040686f'H
              }
            }
          }
        }

If RRC Re-establishment happens, source cell would transfer TMSI to the target cell via EAB-
UEContextFetchResponse message.

Counter tracing from eNode-B (время у Тилака 12:20)

=========================

Counter traces are activated (together with other layer3 traces) as below:
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name UtranCellRelation::pmHoPrepAttSrvcc
lh mp pm trace enable -counter -name UtranCellRelation::pmHoPrepSuccSrvcc
lh mp pm trace enable -counter -name UtranCellRelation::PmHoExeAttSrvcc
lh mp pm trace enable -counter -name UtranCellRelation::PmHoExeSuccSrvcc
lh mp pm trace enable -counter -id 851976
lh mp pm trace enable -counter -id 851977
lh mp pm trace enable -counter -id 851990
lh mp pm trace enable -counter -id 851991

L04426-UPINGTON_WATERBOARD> lh mp pm trace print -counter | grep -i 'PmHo.*Srvcc '

190718-12:43:43 10.45.15.57 18.0g MSRBS_NODE_MODEL_19.Q2_377.28078.1057_05f9

stopfile=/tmp/20288
0001: 851974 pmHoPrepSuccSrvccLb 851975 pmLbQualifiedUe
851976 pmHoPrepAttSrvcc
0001: 851977 pmHoPrepSuccSrvcc 851978 pmHoPrepAtt
851979 pmHoExeAtt
0001: 851989 pmHoExeSuccCsfbEm 851990 pmHoExeAttSrvcc
851991 pmHoExeSuccSrvcc
0001: 851992 pmHoPrepCancelSrvcc 851993 pmHoPrepCancelSrvccReest
851994 pmHoExeCancelSrvcc
0001:1179651 pmHoPrepSuccCsfbEm 1179652 pmHoPrepAtt1xRttSrvcc
1179653 pmHoPrepSucc1xRttSrvcc
[2019-02-06 03:45:15.404] 2 | | |=========================>|
21209205 (S1AP) HandoverRequired plmnIdentity:404-10
mmeUeS1apId:70310096 enbUeS1apId:267447 cause:radioNetwork:s1-inter-system-handover-
triggered lAC:42071 rNC-ID:124
[2019-02-06 03:45:15.562] 2 | | |<=========================|
21209205 (S1AP) HandoverCommand mmeUeS1apId:70310096
enbUeS1apId:267447
[2019-02-06 03:45:15.563] 2 |<=========| | | | | |
21209205 33658016 (RRC4G) MobilityFromEUTRACommand
[2019-02-06 03:45:16.075] 2 | | |<=========================|
21209205 (S1AP) UEContextReleaseCommand mmeUeS1apId:70310096
enbUeS1apId:267447 cause:radioNetwork:successful-handover
[2019-02-06 03:45:16.076] 2 | | |=========================>|
21209205 (S1AP) UEContextReleaseComplete tac:2108 plmnIdentity:404-10
plmnIdentity:404-10 enbId:904844 cellId:2 mmeUeS1apId:70310096 enbUeS1apId:267447

[2019-02-06 03:45:15.804] | | | | | | | |
(T&E) du1 com_ericsson_triobjif:TRACE5: { cpu_id = 2 }, { processAndObjIf =
"LmCellOmfPT12(Ft_PM_COUNTERS)", fileAndLine = "OmfPmCounterStorageD.cpp:622", msg =
"increment, counter = UtranCellRelation::pmHoPrepAttSrvcc (id = 851976), froId = 1382,
steps = 1, racUeRef = 21209205" }
[2019-02-06 03:45:15.804] | | | | | | | |
(T&E) du1 com_ericsson_triobjif:TRACE5: { cpu_id = 2 }, { processAndObjIf =
"LmCellOmfPT12(Ft_PM_COUNTERS)", fileAndLine = "OmfPmCounterStorageD.cpp:622", msg =
"increment, counter = UtranCellRelation::pmHoPrepSuccSrvcc (id = 851977), froId =
1382, steps = 1, racUeRef = 21209205" }
[2019-02-06 03:45:16.308] | | | | | | | |
(T&E) du1 com_ericsson_triobjif:TRACE5: { cpu_id = 1 }, { processAndObjIf =
"LmCellOmfPT12(Ft_PM_COUNTERS)", fileAndLine = "OmfPmCounterStorageD.cpp:622", msg =
"increment, counter = UtranCellRelation::pmHoExeAttSrvcc (id = 851990), froId = 1382,
steps = 1, racUeRef = 21209205" }
[2019-02-06 03:45:16.308] | | | | | | | |
(T&E) du1 com_ericsson_triobjif:TRACE5: { cpu_id = 1 }, { processAndObjIf =
"LmCellOmfPT12(Ft_PM_COUNTERS)", fileAndLine = "OmfPmCounterStorageD.cpp:622", msg =
"increment, counter = UtranCellRelation::pmHoExeSuccSrvcc (id = 851991), froId = 1382,
steps = 1, racUeRef = 21209205" }

Events tracing from eNode-B (время у Тилака 12:31)

========================

Counter traces are activated (together with other layer3 traces) as below:
lh mp te e all Ft_MON_EVENTS
lh mp pm trace enable -event -name S1HandoverRequest
lh mp pm trace enable -event -name S1HandoverRequestAcknowledge
lh mp pm trace enable -event -name S1HandoverFailure
lh mp pm trace enable -event -id 625
lh mp pm trace enable -event -id 626
lh mp pm trace enable -event -id 622

L04426-UPINGTON_WATERBOARD> lh mp pm trace print -event | grep -i ' S1Handover'

190718-21:27:35 10.45.15.57 18.0g MSRBS_NODE_MODEL_19.Q2_377.28078.1057_05f9

stopfile=/tmp/16433
0001: 617 S1ErabSetupResponse 618 S1ErrorIndication
619 S1HandoverCancel
0001: 620 S1HandoverCancelAcknowledge 621 S1HandoverCommand
622 S1HandoverFailure
0001: 623 S1HandoverNotify 624 S1HandoverPreparationFailure
625 S1HandoverRequest
0001: 626 S1HandoverRequestAcknowledge 627 S1InitialContextSetupFailure
628 S1InitialContextSetupRequest

[2019-07-18 11:33:41.131] 1 | | |<=========================|

15118413 (S1AP) HandoverRequest IMEISV:86057204021515151502
mmeUeS1apId:234517703 qCI:9 qCI:8 qCI:8 cause:radioNetwork:reduce-load-in-serving-
cell HRL:{servingPLMN:655-10} :{e-RAB-ID:5,ipAddr:10.111.38.145,gTP-TEID:55412D1C'H}
:{e-RAB-ID:6,ipAddr:10.111.38.145,gTP-TEID:4EF12F02'H} :{e-RAB-
ID:7,ipAddr:10.111.38.145,gTP-TEID:78012D0F'H}
[2019-07-18 11:33:41.131] 1 | | |<=========================|
15118413 (S1AP) SourceeNB-ToTargeteNB-TransparentContainer targetECGI:
{plmnIdentity:655-10,enbId:4426,cellId:1}
[2019-07-18 11:33:41.131] 1 |=========>| | | | | |
15118413 (RRC4G) HandoverPreparationInformation
[2019-07-18 11:33:41.131] 1 |=========>| | | | | |
15118413 (RRC4G) UE-EUTRA-Capability ue-Category:4
accessStratumRelease:rel12 bandEUTRA:1
[2019-07-18 11:33:41.132] 1 |=========>| | | | | |
15118413 (RRC4G) HandoverPreparationInformation
[2019-07-18 11:33:41.132] 1 |=========>| | | | | |
15118413 (RRC4G) UE-EUTRA-Capability ue-Category:4
accessStratumRelease:rel12 bandEUTRA:1
[2019-07-18 11:33:47.139] 1 | | |=========================>|
15118413 (S1AP) HandoverFailure mmeUeS1apId:234517703
cause:radioNetwork:ho-failure-in-target-EPC-eNB-or-target-system

(Ft_MON_EVENTS)", fileAndLine = "OmfPmEventAgentDistributionHandlerD.cpp:180", msg =

"Is Event Active localEventId = 622 racUeRef = 15118413, isActive = 1)" }
(Ft_MON_EVENTS)", fileAndLine = "OmfPmEventAgentDistributionHandlerD.cpp:233", msg =
"Store event with l3MessageContent ../UehNwIfDTermEventUtilitiesD.cpp:1529 event =
OmfMonS1HandoverFailure (localId = 622)" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "RECORDLENGTH = 66;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "RECORDTYPE = 4;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "TIMESTAMP = 11:33:47:139;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "EVENTNAME = LOCAL_S1_HANDOVER_FAILURE;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "EVENTID = 622;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "RBSMODULEID = MasterDu;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "GLOBALCELLID = 1133057;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "CELLID = 1;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "ENBS1APID = 268972;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "MMES1APID = 234517703;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "GUMMEI = 0x56,0xf5,0x1,0x80,0x1,0x48;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "TRACERECORDINGSESSIONREFERENCE = 0x5a,0xac;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "RACUEREF = 15118413;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "MESSAGEDIRECTION = Sent;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "L3MESSAGELENGTH = 22;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "EUTRANCELLFROID = 474;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "L3MESSAGECONTENTS = 0x40,0x1,0x0,0x12,0x0,0x0,0x2,0x0,0x0,0x40" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= " 0x5,0xc0,0xd,0xfa,0x74,0xc7,0x0,0x2,0x40,0x2" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= " 0x0,0xc0;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "HOREJECTCAUSE = OtherReason;" }
(Ft_MON_EVENTS)", fileAndLine = "../OmfPmEventAgentDistributionHandlerD.cpp:595", msg
= "" }

DAY8

An introduction to non-standalone 5G (время у Тилака 10:17)

================================

NR Terminology

MCG (Master Cell Group) Bearer

SCG (Secondary Cell Group) Bearer

Split Bearer (MCG Split, SCG Split)

MCG ( Master Cell Group ) Bearer: A bearer terminating at MN node (in case of EN-DC, more specifically

at eNB)

SCG ( Secondary Cell Group ) Bearer: A bearer terminating at SN node (in case of EN-DC, more specifically

at gNB)

Here terminating means, which node (MN/SN) PDCP is being used for the bearer. If PDCP (E-PDCP/NR-

PDCP: MN node support both E-PDCP and NR-PDCP) is used from MN node then we call it MN

terminating. If NR-PDCP is used from SN node then we call it SN terminating.

A MCG bearer can be configured with either E-PDCP or NR-PDCP. Thus, MCG bearer can be configured
in two variation (E-UTRA PDCP -> E-UTRA-RLC/MAC, E-UTRA-PHY) and (NR-PDCP -> E-UTRA-RLC/MAC, E-

UTRA-PHY)

Whereas a SCG bearer is always configured with NR-PDCP only (NR-PDCP -> NR-RLC/MAC, NR-PHY)

Non-Standalone 5G uses control-plane in LTE (RED marked below) and user-plane in 5G (Green marked
below).
The Non-Standalone 5G concept have similarities to inter eNode-B Carrier Aggregation.
The Primary Cell is always in LTE which controls the connection.

The Secondary Cell is in 5G……..however from user plane perspective 5G cell is the Primary Cell because
5G node is in control of the user plane.

LTE cell is used to send user data to the UE only if 5G cell is incapable of handling all the data received
from SGw…….in such situations user data is sent from 5G node to LTE node via X2 interface.

5G cell (NR leg) can be added either based on measurements or without measurements.

Without measurements if neighbour relation to 5G cell is defined:

KI10ENB7329> get ENodeBFunction=1,EUtranCellFDD=1 GUtranCellRef

190425-09:48:26 10.67.71.39 19.0e MSRBS_NODE_MODEL_19.Q2_377.28075.60_bc7e

stopfile=/tmp/15128
======================================================================================
===========================
MO Attribute Value
======================================================================================
===========================
EUtranCellFDD=1 extGUtranCellRef
GUtraNetwork=1,ExternalGNodeBFunction=107330,ExternalGUtranCell=26280-107330-1
======================================================================================
===========================
Total: 1 Mos

[2019-04-24 13:18:36.749] 1 | | |==================>|

| 8392779 (X2AP) SgNBAdditionRequest
ipAddr:10.67.75.39 ipAddr:10.88.210.161 plmnIdentity:262-80
enbId:107329 cellId:1 e-RAB-ID:5 gTP-TEID:C2415ED6'H gTP-
TEID:5901021E'H qCI:9 UE-X2AP-ID:0

[2019-04-24 13:18:36.760] 1 | | |<==================|

| 8392779 (X2AP) SgNBAdditionRequestAcknowledge
ipAddr:10.67.75.40 ipAddr:10.67.75.40 e-RAB-ID:5 gTP-
TEID:18869C77'H gTP-TEID:7177A06C'H qCI:9 SgNB-UE-X2AP-ID:1110017
UE-X2AP-ID:1

With measurements (event B1) if neighbour relation to 5G cell is not defined:

[2019-04-15 09:58:44.609] 1 |<=========| | | | |

| 8392747 16842976 (RRC4G) RRCConnectionReconfiguration
logicalChannelIdentity:3 eps-BearerIdentity:5 logicalChannelGroup:1
srb-Identity:2 MeasObjectToAddMod:{cFreq:636000} :eventB1_NR_r15
measId:1(B1) drbId:3
[2019-04-15 09:58:45.213] 1 |=========>| | | | |
| 8392747 (RRC4G) MeasurementReport measId:1(B1)
PCell:{rsrp:-81,rsrq:-6.5}
[2019-04-15 09:58:45.219] 1 | | |==================>|
| 8392747 (X2AP) SgNBAdditionRequest
ipAddr:10.67.75.41 ipAddr:10.88.210.161 plmnIdentity:262-80
enbId:107331 cellId:1 e-RAB-ID:5 gTP-TEID:8D3AF083'H gTP-
TEID:1AC1026F'H qCI:9 UE-X2AP-ID:0
[2019-04-15 09:58:45.230] 1 | | |<==================|
| 8392747 (X2AP) SgNBAdditionRequestAcknowledge
ipAddr:10.67.75.42 ipAddr:10.67.75.42 e-RAB-ID:5 gTP-
TEID:188B2D75'H gTP-TEID:7884412B'H qCI:9 SgNB-UE-X2AP-ID:4113 UE-
X2AP-ID:1021

Once NR leg is added the userplane is switched from LTE to 5G:

[2019-04-15 09:58:44.524] 1 | | |
<=========================| 8392747 (S1AP)
InitialContextSetupRequest mmeUeS1apId:43867027 enbUeS1apId:262187
qCI:9 agMbrDl:600.00Mbps agMbrUl:600.00Mbps HRL:{servingPLMN:262-
80} :{e-RAB-ID:5,ipAddr:10.88.210.161,gTP-TEID:1AC1026F'H}
[2019-04-15 09:58:44.634] 1 | | |
=========================>| 8392747 (S1AP)
InitialContextSetupResponse mmeUeS1apId:43867027
enbUeS1apId:262187 :{e-RAB-ID:5,ipAddr:10.67.75.41,gTP-
TEID:2927F2AA'H}
:
:
[2019-04-15 09:58:45.213] 1 |=========>| | | | |
| 8392747 (RRC4G) MeasurementReport measId:1(B1)
PCell:{rsrp:-81,rsrq:-6.5}
[2019-04-15 09:58:45.219] 1 | | |==================>|
| 8392747 (X2AP) SgNBAdditionRequest
ipAddr:10.67.75.41 ipAddr:10.88.210.161 plmnIdentity:262-80
enbId:107331 cellId:1 e-RAB-ID:5 gTP-TEID:8D3AF083'H gTP-
TEID:1AC1026F'H qCI:9 UE-X2AP-ID:0
[2019-04-15 09:58:45.230] 1 | | |<==================|
| 8392747 (X2AP) SgNBAdditionRequestAcknowledge
ipAddr:10.67.75.42 ipAddr:10.67.75.42 e-RAB-ID:5 gTP-
TEID:188B2D75'H gTP-TEID:7884412B'H qCI:9 SgNB-UE-X2AP-ID:4113 UE-
X2AP-ID:1021
:
:
[2019-04-15 09:58:45.355] 1 | | |
=========================>| 8392747 (S1AP) E-
RABModificationIndication ipAddr:10.67.75.42 mmeUeS1apId:43867027
enbUeS1apId:262187 e-RAB-ID:5
[2019-04-15 09:58:45.367] 1 | | |
<=========================| 8392747 (S1AP) E-
RABModificationConfirm mmeUeS1apId:43867027 enbUeS1apId:262187 e-
RAB-ID:5

NR leg can be removed,

 due to RLC failure in 5G node:
[2019-04-18 08:49:30.365] 1 | | |
<=========================| 8392768 (S1AP)
InitialContextSetupRequest mmeUeS1apId:46002795 enbUeS1apId:262208
qCI:9 agMbrDl:600.00Mbps agMbrUl:600.00Mbps HRL:{servingPLMN:262-
80} :{e-RAB-ID:5,ipAddr:10.88.210.161,gTP-TEID:790107AE'H}
[2019-04-18 08:49:30.446] 1 | | |
=========================>| 8392768 (S1AP)
InitialContextSetupResponse mmeUeS1apId:46002795
enbUeS1apId:262208 :{e-RAB-ID:5,ipAddr:10.67.75.39,gTP-
TEID:31135026'H}
:
:
[2019-04-18 08:49:34.027] 1 | | |
=========================>| 8392768 (S1AP) E-
RABModificationIndication ipAddr:10.67.75.40 mmeUeS1apId:46002795
enbUeS1apId:262208 e-RAB-ID:5
[2019-04-18 08:49:34.032] 1 | | |
<=========================| 8392768 (S1AP) E-
RABModificationConfirm mmeUeS1apId:46002795 enbUeS1apId:262208 e-
RAB-ID:5
[2019-04-18 08:49:35.088] 1 | | |<==================|
| 8392768 (X2AP) SgNBReleaseRequired
cause:radioNetwork:radio-connection-with-UE-lost SgNB-UE-X2AP-
ID:21320 UE-X2AP-ID:841
[2019-04-18 08:49:35.092] 1 | | |==================>|
| 8392768 (X2AP) SgNBReleaseConfirm SgNB-UE-X2AP-
ID:21320 UE-X2AP-ID:841
[2019-04-18 08:49:33.717] 1 |<=========| | | | |
| 8392768 16832160 (RRC4G) RRCConnectionReconfiguration
targetPhysCellId:87 logicalChannelIdentity:3 eps-BearerIdentity:5
logicalChannelGroup:1 srb-Identity:1 srb-Identity:2
dlBandwidth:n100 powerRampingStep:dB4 MeasObjectToAddMod:
{cFreq:640320} :eventB1_NR_r15 measId:1(B1) crnti:6149
antPortCnt:an2 ciphAlg:eea1 intProtAlg:eia2 nextHop:0
keyChangeIndicator:FALSE drbId:3 dl-cFreq:3100 dl-BW:20.0MHz
ttiBundling:FALSE txMode:3(OL_MIMO)
[2019-04-18 08:49:33.717] 1 | | |<==================|
| 8392768 (X2AP) SNStatusTransfer e-RAB-ID:5 SgNB-
UE-X2AP-ID:21319 UE-X2AP-ID:840 UE-X2AP-ID:840
[2019-04-18 08:49:33.795] 1 |=========>| | | | |
| 8392768 (RRC4G)
RRCConnectionReconfigurationComplete
[2019-04-18 08:49:33.796] 1 | | |
=========================>| 8392768 (S1AP) E-
RABModificationIndication ipAddr:10.67.75.39 mmeUeS1apId:46002795
enbUeS1apId:262208 e-RAB-ID:5
[2019-04-18 08:49:33.806] 1 | | |
<=========================| 8392768 (S1AP) E-
RABModificationConfirm mmeUeS1apId:46002795 enbUeS1apId:262208 e-
RAB-ID:5
[2019-04-18 08:49:33.807] 1 | | |==================>|
| 8392768 (X2AP) UEContextRelease SgNB-UE-X2AP-
ID:21319 UE-X2AP-ID:0 UE-X2AP-ID:840

due to user inactivity:

[2019-04-15 09:58:50.528] 1 | | |<==================|

| 8392747 (X2AP) SgNBActivityNotification UE-X2AP-
ID:1021 UserPlaneTrafficActivityReport:inactive
[2019-04-15 09:59:15.545] 1 | | |
=========================>| 8392747 (S1AP)
UEContextReleaseRequest mmeUeS1apId:43867027 enbUeS1apId:262187
cause:radioNetwork:user-inactivity
[2019-04-15 09:59:15.557] 1 | | |
<=========================| 8392747 (S1AP)
UEContextReleaseCommand mmeUeS1apId:43867027 enbUeS1apId:262187
cause:radioNetwork:release-due-to-eutran-generated-reason
[2019-04-15 09:59:15.558] 1 |<=========| | | | |
| 8392747 16843008 (RRC4G) RRCConnectionRelease cause:other
[2019-04-15 09:59:15.584] 1 | | |==================>|
| 8392747 (X2AP) SgNBReleaseRequest
cause:radioNetwork:user-inactivity SgNB-UE-X2AP-ID:4113 UE-X2AP-
ID:1021
[2019-04-15 09:59:15.586] 1 | | |<==================|
| 8392747 (X2AP) SgNBReleaseRequestAcknowledge SgNB-
UE-X2AP-ID:4113 UE-X2AP-ID:1021

or due to UE measurements:

[2019-05-22 11:58:31.202] 1 | | |
<=========================| 8392804 (S1AP)
InitialContextSetupRequest mmeUeS1apId:9261021 enbUeS1apId:262244
qCI:9 agMbrDl:2000.00Mbps agMbrUl:2000.00Mbps HRL:{servingPLMN:262-
80} :{e-RAB-ID:5,ipAddr:10.75.201.129,gTP-TEID:63CF00F2'H}
[2019-05-22 11:58:31.310] 1 | | |
=========================>| 8392804 (S1AP)
InitialContextSetupResponse mmeUeS1apId:9261021 enbUeS1apId:262244 :
{e-RAB-ID:5,ipAddr:10.58.118.51,gTP-TEID:944FA97D'H}
:
:
[2019-05-22 11:59:47.720] 1 |===================>| | |
| 8392804 (RRC5G) MeasurementReport measId:1(A3)
physCellId:61
[2019-05-22 11:59:47.721] 1 | | |==================>|
| 8392804 (X2AP) RRCTransfer SgNB-UE-X2AP-ID:8193
UE-X2AP-ID:105
[2019-05-22 11:59:47.725] 1 | | |<==================|
| 8392804 (X2AP) SgNBReleaseRequired
cause:radioNetwork:sCG-Mobility SgNB-UE-X2AP-ID:8193 UE-X2AP-ID:105
[2019-05-22 11:59:47.729] 1 | | |==================>|
| 8392804 (X2AP) SgNBReleaseConfirm SgNB-UE-X2AP-
ID:8193 UE-X2AP-ID:105
[2019-05-22 11:59:47.733] 1 |<=========| | | | |
| 8392804 16783456 (RRC4G) RRCConnectionReconfiguration
targetPhysCellId:165 logicalChannelIdentity:3
logicalChannelIdentity:4 eps-BearerIdentity:5 eps-BearerIdentity:6
logicalChannelGroup:1 logicalChannelGroup:1 srb-Identity:1 srb-
Identity:2 dlBandwidth:n100 powerRampingStep:dB4
MeasObjectToAddMod:{cFreq:637180} :eventB1_NR_r15 measId:1(B1)
crnti:281 antPortCnt:an2 ciphAlg:eea0 intProtAlg:eia2 nextHop:0
keyChangeIndicator:FALSE drbId:3 dl-cFreq:3100 dl-BW:20.0MHz
ttiBundling:FALSE txMode:3(OL_MIMO)
[2019-05-22 11:59:47.735] 1 | | |<==================|
| 8392804 (X2AP) SNStatusTransfer e-RAB-ID:5 SgNB-
UE-X2AP-ID:8193 UE-X2AP-ID:105 UE-X2AP-ID:105
[2019-05-22 11:59:47.786] 1 |=========>| | | | |
| 8392804 (RRC4G)
RRCConnectionReconfigurationComplete
[2019-05-22 11:59:47.787] 1 | | |
=========================>| 8392804 (S1AP) E-
RABModificationIndication ipAddr:10.58.118.51 ipAddr:10.58.118.51
mmeUeS1apId:9261021 enbUeS1apId:262244 e-RAB-ID:5 e-RAB-ID:6
[2019-05-22 11:59:47.806] 1 | | |
<=========================| 8392804 (S1AP) E-
RABModificationConfirm mmeUeS1apId:9261021 enbUeS1apId:262244 e-RAB-
ID:5
[2019-05-22 11:59:47.807] 1 | | |==================>|
| 8392804 (X2AP) UEContextRelease SgNB-UE-X2AP-
ID:8193 UE-X2AP-ID:0 UE-X2AP-ID:105

NR leg must be removed when LTE Primary Cell changes (after event A3 or event A5).

[2019-04-26 10:50:00.685] 2 | | |
<=========================| 16781460 (S1AP)
InitialContextSetupRequest mmeUeS1apId:15557270 enbUeS1apId:262372
qCI:9 agMbrDl:600.00Mbps agMbrUl:600.00Mbps HRL:{servingPLMN:262-
80} :{e-RAB-ID:5,ipAddr:10.88.210.161,gTP-TEID:590103CC'H}
[2019-04-26 10:50:00.795] 2 | | |
=========================>| 16781460 (S1AP)
InitialContextSetupResponse mmeUeS1apId:15557270
enbUeS1apId:262372 :{e-RAB-ID:5,ipAddr:10.67.75.39,gTP-
TEID:406377F6'H}
:
:
[2019-04-26 10:50:01.423] 2 |=========>| | | | |
| 16781460 (RRC4G) MeasurementReport measId:4(B1)
PCell:{rsrp:-96,rsrq:-6.5} NeighCells:{rsrp:-91,rsrq:-11.0}
[2019-04-26 10:50:01.430] 2 | | |==================>|
| 16781460 (X2AP) SgNBAdditionRequest
ipAddr:10.67.75.39 ipAddr:10.88.210.161 plmnIdentity:262-80
enbId:107329 cellId:2 e-RAB-ID:5 gTP-TEID:A3CAB34F'H gTP-
TEID:590103CC'H qCI:9 UE-X2AP-ID:0
[2019-04-26 10:50:01.441] 2 | | |<==================|
| 16781460 (X2AP) SgNBAdditionRequestAcknowledge
ipAddr:10.67.75.40 ipAddr:10.67.75.40 e-RAB-ID:5 gTP-
TEID:909CA2DB'H gTP-TEID:8D630ED0'H qCI:9 SgNB-UE-X2AP-ID:1110143
UE-X2AP-ID:135
[2019-04-26 10:50:01.541] 2 | | |
=========================>| 16781460 (S1AP) E-
RABModificationIndication ipAddr:10.67.75.40 mmeUeS1apId:15557270
enbUeS1apId:262372 e-RAB-ID:5
[2019-04-26 10:50:01.550] 2 | | |
<=========================| 16781460 (S1AP) E-
RABModificationConfirm mmeUeS1apId:15557270 enbUeS1apId:262372 e-
RAB-ID:5
:
:
[2019-04-26 10:50:02.354] 2 |=========>| | | | |
| 16781460 (RRC4G) MeasurementReport measId:7(A5)
PCell:{rsrp:-85,rsrq:-6.5} phCellId:87 NeighCells:{rsrp:-89,rsrq:-
4.0}
[2019-04-26 10:50:02.359] 2 | | |==================>|
| 16781460 (X2AP) HandoverRequest
ipAddr:10.88.210.161 e-RAB-ID:5 gTP-TEID:590103CC'H qCI:9
MMEGID:32811 cause:radioNetwork:handover-desirable-for-radio-reasons
UE-X2AP-ID:0 nextHop:0 cellSize:verysmall GUMMEI:{plmnIdentity:262-
80} target ECGI:{plmnIdentity:262-80,enbId:107329,cellId:1} HRL:
{servingPLMN:262-80} mmeUeS1apId:15557270 mmeCode:A8'H
[2019-04-26 10:50:02.372] 2 | | |<==================|
| 16781460 (X2AP) HandoverRequestAcknowledge E-RABs-
Admitted-List:{e-RAB-ID:5} UE-X2AP-ID-OLD:135 UE-X2AP-ID-NEW:137
[2019-04-26 10:50:02.372] 2 |<=========| | | | |
| 16781460 (RRC4G) HandoverCommand targetPhysCellId:87
logicalChannelIdentity:3 eps-BearerIdentity:5 logicalChannelGroup:1
srb-Identity:1 srb-Identity:2 dlBandwidth:n100 powerRampingStep:dB4
crnti:14853 antPortCnt:an2 ciphAlg:eea1 intProtAlg:eia2 nextHop:0
keyChangeIndicator:FALSE drbId:3 dl-cFreq:3100 dl-BW:20.0MHz
ttiBundling:FALSE txMode:3(OL_MIMO)
[2019-04-26 10:50:02.376] 2 | | |==================>|
| 16781460 (X2AP) SgNBReleaseRequest e-RAB-ID:5
cause:radioNetwork:mCG-Mobility SgNB-UE-X2AP-ID:1110143 UE-X2AP-
ID:135
[2019-04-26 10:50:02.378] 2 | | |<==================|
| 16781460 (X2AP) SgNBReleaseRequestAcknowledge SgNB-
UE-X2AP-ID:1110143 UE-X2AP-ID:135
[2019-04-26 10:50:02.381] 2 | | |<==================|
| 16781460 (X2AP) SNStatusTransfer e-RAB-ID:5 SgNB-
UE-X2AP-ID:1110143 UE-X2AP-ID:135 UE-X2AP-ID:135
[2019-04-26 10:50:02.453] 1 |=========>| | | | |
| 8392788 (RRC4G)
RRCConnectionReconfigurationComplete
[2019-04-26 10:50:02.454] 1 | | |
=========================>| 8392788 (S1AP) E-
RABModificationIndication ipAddr:10.67.75.39 mmeUeS1apId:15557270
enbUeS1apId:262372 e-RAB-ID:5
[2019-04-26 10:50:02.466] 1 | | |
<=========================| 8392788 (S1AP) E-
RABModificationConfirm mmeUeS1apId:15557270 enbUeS1apId:262372 e-
RAB-ID:5
[2019-04-26 10:50:02.466] 1 | | |==================>|
| 8392788 (X2AP) UEContextRelease UE-X2AP-ID:135
UE-X2AP-ID:137

https://medium.com/@5gnr/5g-nr-en-dc-bearer-concept-291e21b79b38

VoLTE call establishment when a NR Leg already exist (время у Тилака 11:28)

The NR leg can continue in Secondary Node – SN (gNb) even after the VoLTE call has been established
(split-bearer allowed):

[2019-09-30 19:46:14.035]      0      |    |     |<=========================|  

2269299               (S1AP)   E-RABSetupRequest mmeUeS1apId:205004578 
enbUeS1apId:269225  qCI:1  E-RABToBeSetupItemBearerSUReq:{e-RAB-
ID:7,ipAddr:10.238.180.21,gTP-TEID:077C1FA5'H}
[2019-09-30 19:46:14.035]      0      |<====================================|  
2269299               (NAS4G)  securityProtectedNASMessage
[2019-09-30 19:46:14.037]      0      |<=========|    |    |    |    |      |  
2269299    47424      (RRC4G)  RRCConnectionReconfiguration logicalChannelIdentity:5 
eps-BearerIdentity:7  logicalChannelGroup:1  drbId:5  rohc-
TRUE:profile0x0001,profile0x0002
[2019-09-30 19:46:14.037]      0      |<====================================|  
2269299    47424      (NAS4G)  securityProtectedNASMessage
[2019-09-30 19:46:14.086]      0      |=========>|    |    |    |    |      |  
2269299               (RRC4G)  RRCConnectionReconfigurationComplete
[2019-09-30 19:46:14.087]      0      |    |     |=========================>|  
2269299               (S1AP)   E-RABSetupResponse mmeUeS1apId:205004578 
enbUeS1apId:269225  E-RABSetupItemBearerSURes:{e-RAB-ID:7,ipAddr:10.64.182.177,gTP-
TEID:93B48F4F'H}
                                                  

Or the NR leg can be moved to Master Node – MN (eNode-B) before the VoLTE call is established (split-
bearer not allowed):

[2019-09-30 19:18:11.653]      2      |    |     |<=========================|  

20275248              (S1AP)   E-RABSetupRequest mmeUeS1apId:299374759 
enbUeS1apId:268921  qCI:1  E-RABToBeSetupItemBearerSUReq:{e-RAB-
ID:7,ipAddr:10.225.62.137,gTP-TEID:05381F53'H}
[2019-09-30 19:18:11.653]      2      |<====================================|  
20275248              (NAS4G)  securityProtectedNASMessage
[2019-09-30 19:18:11.655]      2      |    |     |==================>|      |  
20275248              (X2AP)   SgNBModificationRequest e-RAB-ID:5 
cause:radioNetwork:action-desirable-for-radio-reasons  SgNB-UE-X2AP-ID:39627  UE-X2AP-
ID:2155
[2019-09-30 19:18:11.662]      2      |    |     |<==================|      |  
20275248              (X2AP)   SgNBModificationRequestAcknowledge e-RAB-ID:5  SgNB-UE-
X2AP-ID:39627  UE-X2AP-ID:2155
[2019-09-30 19:18:11.663]      2      |<=========|    |    |    |    |      |  
20275248   33589152   (RRC4G)  RRCConnectionReconfiguration logicalChannelIdentity:5 
eps-BearerIdentity:7  logicalChannelGroup:1  drbId:5  rohc-
TRUE:profile0x0001,profile0x0002
[2019-09-30 19:18:11.663]      2      |<====================================|  
20275248   33589152   (NAS4G)  securityProtectedNASMessage
[2019-09-30 19:18:11.727]      2      |=========>|    |    |    |    |      |  
20275248              (RRC4G)  RRCConnectionReconfigurationComplete
[2019-09-30 19:18:11.728]      2      |    |     |==================>|      |  
20275248              (X2AP)   SgNBReconfigurationComplete SgNB-UE-X2AP-ID:39627  UE-
X2AP-ID:2155
[2019-09-30 19:18:11.728]      2      |    |     |=========================>|  
20275248              (S1AP)   E-RABSetupResponse mmeUeS1apId:299374759 
enbUeS1apId:268921  E-RABSetupItemBearerSURes:{e-RAB-ID:7,ipAddr:10.64.143.71,gTP-
TEID:3D1C8E07'H}
                                                 
Important NR related System Constants (время у Тилака 11:38)

4052  enable/disable LTE carrier aggregation for endc capable ue

4072  enable/disable split bearer together with a VoLTE call
4654  enable/disable checking of UL MrDc capabilities (время у Тилака 12:16)
4564  enable/disable eNode-B releasing entire connection when the eNode-B received E-
RABReleaseCommand from the MME to release the split bearer (время у Тилака 12:23)
4045  enable/disable NR Leg release before or after X2 Handover Preparation
RP270  enable/disable UE capability check in the gNode-B

DAY9

Relevant Signalling for each Procedure

RRC Connection Setup

[2016-12-21 01:18:42.516] /128 |=========>| | | | | |
1081722310 (RRC4G) RRCConnectionRequest cause:mo-Signalling randomValue:662590347328
[2016-12-21 01:18:42.522] /128 |<=========| | | | | |
1081722310 (RRC4G) RRCConnectionSetup transmissionMode:tm3 t-PollRetransmit:ms80 t-
Reordering:ms35
[2016-12-21 01:18:42.577] /128 |=========>| | | | | |
1081722310 (RRC4G) RRCConnectionSetupComplete selectedPLMN-Identity:1 mmegi:804
mmeCode:146

pmRrcConnEstabAtt counter steps at reception of rrcConnectionRequest from UE.

pmRrcConnEstabSucc counter steps at reception of rrcConnectionSetupComplete from UE.

S1 Connection Setup
[2016-10-26 08:45:03.898] /3 |=========>| | | | | |
26792005 (RRC4G) RRCConnectionSetupComplete selectedPLMN-Identity:1
[2016-10-26 08:45:03.899] /3 | | |=========================>|
26792005 (S1AP) InitialUEMessage m-TMSI:f06c23ba'H tac:408 plmnIdentity:426-01
plmnIdentity:426-01 enbId:4517 cellId:3 enbUeS1apId:612883 mMEC:02'H cause:mo-
Data
[2016-10-26 08:45:03.899] /3 |====================================>|
26792005 (NAS4G) serviceRequest
[2016-10-26 08:45:03.914] /3 | | |<=========================|
26792005 (S1AP) InitialContextSetupRequest ipAddr:172.26.33.151
ipAddr:172.26.33.147 mmeUeS1apId:42894249 enbUeS1apId:612883 e-RAB-ID:6 e-RAB-ID:5
gTP-TEID:94308210'H gTP-TEID:9430820F'H qCI:6 qCI:8 interfacesToTrace:s1x2uu
agMbrDl:140.00Mbps agMbrUl:120.00Mbps HLR:{servingPLMN:24F610'H}
pmS1SigConnEstabAtt counter is stepped when InitialUEMessage is sent to MME.

pmS1SigConnEstabSucc counter is stepped at the reception of any message on UE-associated logical S1-
connection (see HW40419).

Paging Procedure

PS Paging
[2017-03-30 14:57:51.036] | | |<=========================|
(S1AP) Paging m-TMSI:e517f01b'H tac:43001 plmnIdentity:510-11 mMEC:C8'H
CNDomain:ps
[2017-03-30 14:57:51.532] /5 |=========>| | | | | |
42510147 (RRC4G) RRCConnectionRequest m-TMSI:3843551259 cause:mt-Access
mmeCode:200
[2017-03-30 14:57:51.537] /5 |<=========| | | | | |
42510147 (RRC4G) RRCConnectionSetup transmissionMode:tm4 t-PollRetransmit:ms160
t-Reordering:ms35
[2017-03-30 14:57:51.560] /5 |=========>| | | | | |
42510147 (RRC4G) RRCConnectionSetupComplete selectedPLMN-Identity:1
[2017-03-30 14:57:51.560] /5 | | |=========================>|
42510147 (S1AP) InitialUEMessage m-TMSI:e517f01b'H tac:43001 plmnIdentity:510-11
plmnIdentity:510-11 enbId:430002 cellId:5 enbUeS1apId:268425 mMEC:C8'H cause:mt-
Access
[2017-03-30 14:57:51.560] /5 |====================================>|
42510147 (NAS4G) serviceRequest

CS Paging
[2015-06-08 13:17:39.168] | | |<=========================|
(S1AP) Paging m-TMSI:e003c7b3'H tac:159 plmnIdentity:235-91 mMEC:00'H
CNDomain:cs
[2015-06-08 13:17:39.720] |=========>| | | | | |
(RRC4G) RRCConnectionRequest m-TMSI:3758344115 cause:mt-Access mmeCode:0
[2015-06-08 13:17:39.728] /1 |<=========| | | | | |
8392774 (RRC4G) RRCConnectionSetup t-PollRetransmit:ms80 t-Reordering:ms35
[2015-06-08 13:17:39.756] /1 |=========>| | | | | |
8392774 (RRC4G) RRCConnectionSetupComplete selectedPLMN-Identity:1
[2015-06-08 13:17:39.756] /1 | | |=========================>|
8392774 (S1AP) InitialUEMessage m-TMSI:e003c7b3'H tac:159 plmnIdentity:235-91
plmnIdentity:235-91 enbId:72261 cellId:1 enbUeS1apId:69 mMEC:00'H cause:mt-Access
[2015-06-08 13:17:39.756] /1 |====================================>|
8392774 (NAS4G) extendedServiceRequest m-TMSI:1051730364339 serviceType:mobile
terminating CS fallback or 1xCS fallback
[2015-06-08 13:17:39.788] /1 | | |<=========================|
8392774 (S1AP) InitialContextSetupRequest plmnIdentity:235-91
ipAddr:10.201.105.243 mmeUeS1apId:28324519 enbUeS1apId:69 e-RAB-ID:5 gTP-
TEID:A3C06690'H qCI:9 agMbrDl:256.00Mbps agMbrUl:256.00Mbps
csFallbackIndicator:cs-fallback-required HLR:{servingPLMN:32F519'H}

All Paging messages received from MME is counted by pmPagS1Received counter.

If any Paging messages received from MME is discarded it is counted by pmPagS1Discarded counter.

pmPagReceived counter accounts for all Paging messages routed to this cell. Theoretically this counter
should be smaller than pmPagS1Received counter.
pmPagDiscarded counter accounts for Paging messages that are not broadcasted from cell for whatever
reason, for instance congestion.

Initial Context Setup Procedure

[2017-02-14 13:42:40.401] /18 | | |<=========================|
152420686 (S1AP) InitialContextSetupRequest ipAddr:10.200.234.8
mmeUeS1apId:135307507 enbUeS1apId:292120 e-RAB-ID:5 gTP-TEID:8127C00C'H qCI:8
agMbrDl:256.00Mbps agMbrUl:100.00Mbps
[2017-02-14 13:42:40.401] /18 |=========>| | | | | |
152420686 (RRC4G) UERadioAccessCapabilityInformation
[2017-02-14 13:42:40.401] /18 |=========>| | | | | |
152420686 (RRC4G) UE-EUTRA-Capability ueCategory:4 accessStratumRelease:rel10
bandEUTRA:1
[2017-02-14 13:42:40.402] /18 |<=========| | | | | |
152420686 (RRC4G) SecurityModeCommand intraFreqReselection:eea1
integrityProtAlgorithm:eia2
[2017-02-14 13:42:40.427] /18 |=========>| | | | | |
152420686 (RRC4G) SecurityModeComplete
[2017-02-14 13:42:40.453] /18 |<=========| | | | | |
152420686 (RRC4G) RRCConnectionReconfiguration :eventA3 a3Offset:6 :eventA2
:eventA2 :eventA2 :eventA6_r10 :eventA1 measId:6 measId:6 measId:6 measId:6
measId:6 measId:6 antPortCnt:an2 drbId:3
[2017-02-14 13:42:40.482] /18 |=========>| | | | | |
152420686 (RRC4G) RRCConnectionReconfigurationComplete
[2017-02-14 13:42:40.483] /18 | | |=========================>|
152420686 (S1AP) InitialContextSetupResponse ipAddr:100.76.192.27
mmeUeS1apId:135307507 enbUeS1apId:292120 e-RAB-ID:5 gTP-TEID:E23C1BBC'H

pmErabEstabAttInit counter is stepped at the reception of InitialContextSetupRequest message from

MME.

pmErabEstabSuccInit counter is stepped when InitialContextSetupResponse message is sent to MME.

Attach Procedure
[2016-12-21 01:18:42.577] /128 | | |=========================>|
1081722310 (S1AP) InitialUEMessage tac:29138 plmnIdentity:460-00 plmnIdentity:460-
00 enbId:927023 cellId:128 enbUeS1apId:276123 cause:mo-Signalling
[2016-12-21 01:18:42.577] /128 |====================================>|
1081722310 (NAS4G) attachRequest m-TMSI:3844179331 EPSAttachTypeValue:Combined
EPS/IMSI attach nonDrxTimer:0 NASKeySetIdentifier:2
[2016-12-21 01:18:42.606] /128 | | |<=========================|
1081722310 (S1AP) DownlinkNASTransport mmeUeS1apId:160380819 enbUeS1apId:276123
[2016-12-21 01:18:42.606] /128 |<=========| | | | | |
1081722310 (RRC4G) DLInformationTransfer
[2016-12-21 01:18:42.606] /128 |<====================================|
1081722310 (NAS4G) authenticationRequest NASKeySetIdentifier:3
RAND:'8F0C28AF2D853F9E6E0BDC886D90D658'H AUTN:'D306259E1C26F0951E95965BB9478199'H
[2016-12-21 01:18:42.822] /128 |=========>| | | | | |
1081722310 (RRC4G) ULInformationTransfer
[2016-12-21 01:18:42.822] /128 |====================================>|
1081722310 (NAS4G) authenticationResponse RES:'C8E95817D260224E'H
[2016-12-21 01:18:42.822] /128 | | |=========================>|
1081722310 (S1AP) UplinkNASTransport tac:29138 plmnIdentity:460-00
plmnIdentity:460-00 enbId:927023 cellId:128 mmeUeS1apId:160380819
enbUeS1apId:276123
[2016-12-21 01:18:42.852] /128 | | |<=========================|
1081722310 (S1AP) DownlinkNASTransport mmeUeS1apId:160380819 enbUeS1apId:276123
[2016-12-21 01:18:42.852] /128 |<=========| | | | | |
1081722310 (RRC4G) DLInformationTransfer
[2016-12-21 01:18:42.852] /128 |<====================================|
1081722310 (NAS4G) securityModeCommand CipheringAlgorithm:EPS encryption algorithm
EEA0 IntegrityProtectionAlgorithm:EPS integrity algorithm 128-EIA2
NASKeySetIdentifier:3
[2016-12-21 01:18:42.882] /128 |=========>| | | | | |
1081722310 (RRC4G) ULInformationTransfer
[2016-12-21 01:18:42.882] /128 |====================================>|
1081722310 (NAS4G) securityModeComplete
[2016-12-21 01:18:42.882] /128 | | |=========================>|
1081722310 (S1AP) UplinkNASTransport tac:29138 plmnIdentity:460-00
plmnIdentity:460-00 enbId:927023 cellId:128 mmeUeS1apId:160380819
enbUeS1apId:276123
[2016-12-21 01:18:42.901] /128 | | |<=========================|
1081722310 (S1AP) DownlinkNASTransport mmeUeS1apId:160380819 enbUeS1apId:276123
[2016-12-21 01:18:42.901] /128 |<=========| | | | | |
1081722310 (RRC4G) DLInformationTransfer
[2016-12-21 01:18:42.901] /128 |<====================================|
1081722310 (NAS4G) ESMInformationRequest EPSBearerIdentity:0 protocolDiscriminator:2
procedureTransactionIdentity:13
[2016-12-21 01:18:42.922] /128 |=========>| | | | | |
1081722310 (RRC4G) ULInformationTransfer
[2016-12-21 01:18:42.922] /128 |====================================>|
1081722310 (NAS4G) ESMInformationResponse accessPointName:cmnet APN:cmnet
[2016-12-21 01:18:42.922] /128 | | |=========================>|
1081722310 (S1AP) UplinkNASTransport tac:29138 plmnIdentity:460-00
plmnIdentity:460-00 enbId:927023 cellId:128 mmeUeS1apId:160380819
enbUeS1apId:276123
[2016-12-21 01:18:43.055] /128 | | |<=========================|
1081722310 (S1AP) InitialContextSetupRequest ipAddr:100.79.247.209
mmeUeS1apId:160380819 enbUeS1apId:276123 e-RAB-ID:5 gTP-TEID:3B431B0B'H qCI:9
agMbrDl:100.00Mbps agMbrUl:100.00Mbps HLR:{servingPLMN:64F000'H}
forbiddenInterRATs:cdma2000
[2016-12-21 01:18:43.056] /128 |<=========| | | | | |
1081722310 (RRC4G) SecurityModeCommand intraFreqReselection:eea0
integrityProtAlgorithm:eia2
[2016-12-21 01:18:43.082] /128 |=========>| | | | | |
1081722310 (RRC4G) SecurityModeComplete
[2016-12-21 01:18:43.083] /128 |<=========| | | | | |
1081722310 (RRC4G) UECapabilityEnquiry
[2016-12-21 01:18:43.102] /128 |=========>| | | | | |
1081722310 (RRC4G) UECapabilityInformation ratType:eutra
[2016-12-21 01:18:43.102] /128 |=========>| | | | | |
1081722310 (RRC4G) UE-EUTRA-Capability ueCategory:4 accessStratumRelease:rel10
bandEUTRA:39
[2016-12-21 01:18:43.102] /128 | | |=========================>|
1081722310 (S1AP) UECapabilityInfoIndication mmeUeS1apId:160380819
enbUeS1apId:276123
[2016-12-21 01:18:43.102] /128 |<=========| | | | | |
1081722310 (RRC4G) UERadioAccessCapabilityInformation
[2016-12-21 01:18:43.102] /128 |<=========| | | | | |
1081722310 (RRC4G) UE-EUTRA-Capability ueCategory:4 accessStratumRelease:rel10
bandEUTRA:39
[2016-12-21 01:18:43.117] /128 |<=========| | | | | |
1081722310 (RRC4G) RRCConnectionReconfiguration :eventA3 a3Offset:4 :eventA2
:eventA2 measId:3 measId:3 measId:3 drbId:3
[2016-12-21 01:18:43.117] /128 |<====================================|
1081722310 (NAS4G) attachAccept m-TMSI:3844441519 ipv4Address:10.14.82.100
accessPointName:cmnet.mnc002.mcc460.gprs EPSAttachResult:combined EPS/IMSI attach
t3412Value:9 unit:decihours
[2016-12-21 01:18:43.147] /128 |=========>| | | | | |
1081722310 (RRC4G) RRCConnectionReconfigurationComplete
[2016-12-21 01:18:43.147] /128 | | |=========================>|
1081722310 (S1AP) InitialContextSetupResponse ipAddr:100.102.160.105
mmeUeS1apId:160380819 enbUeS1apId:276123 e-RAB-ID:5 gTP-TEID:8BED054A'H
[2016-12-21 01:18:43.187] /128 |=========>| | | | | |
1081722310 (RRC4G) ULInformationTransfer
[2016-12-21 01:18:43.187] /128 |====================================>|
1081722310 (NAS4G) attachComplete
[2016-12-21 01:18:43.187] /128 | | |=========================>|
1081722310 (S1AP) UplinkNASTransport tac:29138 plmnIdentity:460-00
plmnIdentity:460-00 enbId:927023 cellId:128 mmeUeS1apId:160380819
enbUeS1apId:276123

Note that Attach is a NAS procedure transparent to LRAN. Relevant KPI (counters) are in MME side.

TAU Procedure
[2016-12-21 01:19:11.424] /130 | | |=========================>|
1097171694 (S1AP) InitialUEMessage m-TMSI:d48fb777'H tac:29138 plmnIdentity:460-00
plmnIdentity:460-00 enbId:927023 cellId:130 enbUeS1apId:276301 mMEC:90'H
cause:mo-Signalling
[2016-12-21 01:19:11.424] /130 |====================================>|
1097171694 (NAS4G) trackingAreaUpdateRequest m-TMSI:3566188407 dlBandwidth:Combined
TA/LA updating
[2016-12-21 01:19:11.458] /130 | | |<=========================|
1097171694 (S1AP) DownlinkNASTransport mmeUeS1apId:260652557 enbUeS1apId:276301
[2016-12-21 01:19:11.459] /130 |<=========| | | | | |
1097171694 (RRC4G) DLInformationTransfer
[2016-12-21 01:19:11.459] /130 |<====================================|
1097171694 (NAS4G) authenticationRequest NASKeySetIdentifier:4
RAND:'4E0AB2A48F395F6B475A8088D1EFE125'H AUTN:'38734300F795F095EDC0C1660B921FE6'H
[2016-12-21 01:19:12.107] /130 |=========>| | | | | |
1097171694 (RRC4G) ULInformationTransfer
[2016-12-21 01:19:12.107] /130 |====================================>|
1097171694 (NAS4G) authenticationResponse RES:'6C84B78D77693CBA'H
[2016-12-21 01:19:12.107] /130 | | |=========================>|
1097171694 (S1AP) UplinkNASTransport tac:29138 plmnIdentity:460-00
plmnIdentity:460-00 enbId:927023 cellId:130 mmeUeS1apId:260652557
enbUeS1apId:276301
[2016-12-21 01:19:12.137] /130 | | |<=========================|
1097171694 (S1AP) DownlinkNASTransport mmeUeS1apId:260652557 enbUeS1apId:276301
[2016-12-21 01:19:12.137] /130 |<=========| | | | | |
1097171694 (RRC4G) DLInformationTransfer
[2016-12-21 01:19:12.137] /130 |<====================================|
1097171694 (NAS4G) securityModeCommand CipheringAlgorithm:EPS encryption algorithm
EEA0 IntegrityProtectionAlgorithm:EPS integrity algorithm 128-EIA2
NASKeySetIdentifier:4
[2016-12-21 01:19:12.167] /130 |=========>| | | | | |
1097171694 (RRC4G) ULInformationTransfer
[2016-12-21 01:19:12.167] /130 |====================================>|
1097171694 (NAS4G) securityModeComplete
[2016-12-21 01:19:12.167] /130 | | |=========================>|
1097171694 (S1AP) UplinkNASTransport tac:29138 plmnIdentity:460-00
plmnIdentity:460-00 enbId:927023 cellId:130 mmeUeS1apId:260652557
enbUeS1apId:276301
[2016-12-21 01:19:12.193] /130 | | |<=========================|
1097171694 (S1AP) DownlinkNASTransport mmeUeS1apId:260652557 enbUeS1apId:276301
[2016-12-21 01:19:12.194] /130 |<=========| | | | | |
1097171694 (RRC4G) DLInformationTransfer
[2016-12-21 01:19:12.194] /130 |<====================================|
1097171694 (NAS4G) trackingAreaUpdateAccept EPSUpdateResultValue:Combined TA/LA
updated

Note that TAU is a NAS procedure transparent to LRAN. Relevant KPI (counters) are in MME side.
CSFB procedure

Idle Mode
[2015-06-08 13:17:39.756] /1 |=========>| | | | | |
8392774 (RRC4G) RRCConnectionSetupComplete selectedPLMN-Identity:1
[2015-06-08 13:17:39.756] /1 |====================================>|
8392774 (NAS4G) extendedServiceRequest m-TMSI:1051730364339 serviceType:mobile
terminating CS fallback or 1xCS fallback
[2015-06-08 13:17:39.756] /1 | | |=========================>|
8392774 (S1AP) InitialUEMessage m-TMSI:e003c7b3'H tac:159 plmnIdentity:235-91
plmnIdentity:235-91 enbId:72261 cellId:1 enbUeS1apId:69 mMEC:00'H cause:mt-Access
[2015-06-08 13:17:39.788] /1 | | |<=========================|
8392774 (S1AP) InitialContextSetupRequest plmnIdentity:235-91
ipAddr:10.201.105.243 mmeUeS1apId:28324519 enbUeS1apId:69 e-RAB-ID:5 gTP-
TEID:A3C06690'H qCI:9 agMbrDl:256.00Mbps agMbrUl:256.00Mbps
csFallbackIndicator:cs-fallback-required HLR:{servingPLMN:32F519'H}
[2015-06-08 13:17:39.788] /1 |=========>| | | | | |
8392774 (RRC4G) UERadioAccessCapabilityInformation
[2015-06-08 13:17:39.788] /1 |<=========| | | | | |
8392774 (RRC4G) SecurityModeCommand intraFreqReselection:eea1
integrityProtAlgorithm:eia2
[2015-06-08 13:17:39.812] /1 |=========>| | | | | |
8392774 (RRC4G) SecurityModeComplete
[2015-06-08 13:17:39.824] /1 |<=========| | | | | |
8392774 (RRC4G) RRCConnectionReconfiguration :eventA3 a3Offset:6 :eventA2
:eventA2 :eventA3 a3Offset:0 measId:4 measId:4 measId:4 measId:4 drbId:3
[2015-06-08 13:17:39.852] /1 |=========>| | | | | |
8392774 (RRC4G) RRCConnectionReconfigurationComplete
[2015-06-08 13:17:39.852] /1 | | |=========================>|
8392774 (S1AP) InitialContextSetupResponse ipAddr:10.201.105.9
mmeUeS1apId:28324519 enbUeS1apId:69 e-RAB-ID:5 gTP-TEID:2D88E3F9'H
[2015-06-08 13:17:39.852] /1 |<=========| | | | | |
8392774 (RRC4G) RRCConnectionRelease cause:other redirectedCarrierInfo:utra_FDD
[2015-06-08 13:17:39.892] /1 | | |=========================>|
8392774 (S1AP) UEContextReleaseRequest mmeUeS1apId:28324519 enbUeS1apId:69
cause:radioNetwork:cs-fallback-triggered

pmUeCtxtEstabAttCsfb counter is stepped at reception of InitialContextSetupRequest with csfb

indicator.

pmUeCtxtRelCsfbWcdma counter is stepped at sending of RRCConnectionRelease with redirect

information, due to a received CS Fallback Indicator.

pmUeCtxtRelCsfbWcdma counter is stepped at sending of RRCConnectionRelease with redirect

information, due to a received CS Fallback Indicator and WCDMA System Information included in
RRCConnectionRelease message.

Connected Mode
[2016-12-21 01:08:23.797] /128 | | |<=========================|
1081657373 (S1AP) InitialContextSetupRequest ipAddr:100.79.247.193
mmeUeS1apId:310814582 enbUeS1apId:271689 e-RAB-ID:5 gTP-TEID:7657C033'H qCI:9
agMbrDl:838.86Mbps agMbrUl:838.86Mbps HLR:{servingPLMN:64F000'H}
[2016-12-21 01:08:23.863] /128 | | |=========================>|
1081657373 (S1AP) InitialContextSetupResponse ipAddr:100.102.160.105
mmeUeS1apId:310814582 enbUeS1apId:271689 e-RAB-ID:5 gTP-TEID:BE4DCE8A'H
:
:
[2016-12-21 01:09:01.956] /128 | | |<=========================|
1081657373 (S1AP) DownlinkNASTransport mmeUeS1apId:310814582 enbUeS1apId:271689
[2016-12-21 01:09:01.956] /128 |<=========| | | | | |
1081657373 (RRC4G) DLInformationTransfer
[2016-12-21 01:09:01.956] /128 |<====================================|
1081657373 (NAS4G) CSServiceNotification
[2016-12-21 01:09:02.007] /128 |=========>| | | | | |
1081657373 (RRC4G) ULInformationTransfer
[2016-12-21 01:09:02.007] /128 |====================================>|
1081657373 (NAS4G) extendedServiceRequest m-TMSI:1051796405187 serviceType:mobile
terminating CS fallback or 1xCS fallback
[2016-12-21 01:09:02.007] /128 | | |=========================>|
1081657373 (S1AP) UplinkNASTransport tac:29138 plmnIdentity:460-00
plmnIdentity:460-00 enbId:927023 cellId:128 mmeUeS1apId:310814582
enbUeS1apId:271689
[2016-12-21 01:09:02.031] /128 | | |<=========================|
1081657373 (S1AP) UEContextModificationRequest plmnIdentity:460-00
mmeUeS1apId:310814582 enbUeS1apId:271689 csFallbackIndicator:cs-fallback-required
[2016-12-21 01:09:02.032] /128 | | |=========================>|
1081657373 (S1AP) UEContextModificationResponse mmeUeS1apId:310814582
enbUeS1apId:271689
[2016-12-21 01:09:02.032] /128 |<=========| | | | | |
1081657373 (RRC4G) RRCConnectionRelease cause:other redirectedCarrierInfo:geran
startingARFCN:94 bandIndicator:dcs1800
[2016-12-21 01:09:02.067] /128 | | |=========================>|
1081657373 (S1AP) UEContextReleaseRequest mmeUeS1apId:310814582 enbUeS1apId:271689
cause:radioNetwork:ue-not-available-for-ps-service

pmUeCtxtModAttCsfb counter is stepped at reception of UEContextModificationRequest with csfb

indicator.

PSHO Based CSFB

LTE

[08:06:13.076]000100 /1 | | |<===========| 8393390 /0 (S1AP)

UEContextModificationRequest enbUeS1Id:262971 csfbInd:cs-fallback-required
[08:06:13.077]000100 /1 | | |===========>| 8393390 /0 (S1AP)
UEContextModificationResponse mmeUeS1Id:56764333 enbUeS1Id:262971
[08:06:13.084]000100 /1 |<=========| | | 8393390 /16805952
(RRC4G) rrcConnectionReconfiguration cFreq:3086 phCellId:77 phCellId:85 phCellId:105
phCellId:136 phCellId:508 phCellId:511 cFreq:10664 phCellId:23 phCellId:77 phCellId:85
phCellId:136 phCellId:511 event:B1 maxRepCell:4 repInt:480ms event:B1 maxRepCell:4
repInt:480ms measId:7(B1) measId:8(B1)
[08:06:13.110]000100 /1 |=========>| | | 8393390 /0
(RRC4G) rrcConnectionReconfigurationComplete
[08:06:13.525]000100 /1 |=========>| | | 8393390 /0
(RRC4G) measurementReport measId:8(B1) rsrp:-60 rsrq:-6.5 phCellId:511 rscp:-45
[08:06:13.531]000100 /1 | | |===========>| 8393390 /0 (S1AP)
HandoverRequired mmeUeS1Id:56764333 enbUeS1Id:262971 cause:radioNetwork-cs-fallback-
triggered lAC:398 rNC-ID:398
[08:06:13.720]000100 /1 | | |<===========| 8393390 /0 (S1AP)
HandoverCommand mmeUeS1Id:56764333 enbUeS1Id:262971
[08:06:13.723]000100 /1 |<=========| | | 8393390 /16805952
(RRC4G) mobilityFromEUTRACommand purpose:handover
[08:06:15.358]000100 /1 | | |<===========| 8393390 /0 (S1AP)
UEContextReleaseCommand cause:radioNetwork-successful-handover

WCDMA
[08:06:13.692]0006/01 >>--->> (RANAP) RelocationRequestAcknowledge
(UE:643) (RAB-ID=0x5) (addr=10.254.113.9) (standard-UMTS-integrity-algorithm-UIA1)
[08:06:13.940]0006/01 >>-------->> (RRC) handoverToUTRANComplete (UE:643)
(cs-domain) (startVal=0x4) (ps-domain) (startVal=0x6)
[08:06:13.940]0006/01 >>--->> (RANAP) RelocationComplete (UE:643)

pmUeCtxtModAttCsfb counter is stepped at reception of UEContextModificationRequest with csfb

indicator.

pmHoPrepAttCsfb counter is stepped when HandoverRequired message is sent.

pmHoPrepSuccCsfb counter is stepped when HandoverCommand message is received.

pmHoExeAttCsfb counter is stepped when mobilityFromEUTRACommand message is sent.

pmHoExeSuccCsfb counter is stepped when UEContextReleaseCommand message is received with cause

‘successful-handover’.

RRC Re-establishment/UE Context Fetch Procedure

[2017-08-17 08:25:19.616] |=========>| | | | | |
(RRC4G) RRCConnectionReestablishmentRequest cause:otherFailure crnti:13805
shortMAC-I:44745
[2017-08-17 08:25:19.618] | | |==================>| |
(X2AP) EAB-UEContextFetchRequest plmnIdentity:260-06 enbId:5153 cellId:55 UE-
X2AP-ID:634 pci:29 shortMAC-I:44745 targetCellPCI:67 earfcn:3350 crnti:13805
[2017-08-17 08:25:19.624] /55 | | |<==================| |
468512808 (X2AP) EAB-UEContextFetchResponse ipAddr:10.24.18.9 e-RAB-ID:5 e-RAB-
ID:5 gTP-TEID:8463A06E'H qCI:7 UE-X2AP-ID-OLD:900 UE-X2AP-ID-NEW:634 pci:29
shortMAC-I:44745 mmeUeS1Id:197151291 nextHop:4 crnti:13805 HLR:
{servingPLMN:62F060'H} GUMMEI:{plmnIdentity:260-06}
[2017-08-17 08:25:19.638] /55 | | |==================>| |
468512808 (X2AP) EAB-UEContextFetchResponseAccept E-RABs-Admitted-List:{e-RAB-ID:5}
UE-X2AP-ID-OLD:900 UE-X2AP-ID-NEW:634
[2017-08-17 08:25:19.638] /55 |<=========| | | | | |
468512808 (RRC4G) RRCConnectionReestablishment
[2017-08-17 08:25:19.678] /55 |=========>| | | | | |
468512808 (RRC4G) RRCConnectionReestablishmentComplete
[2017-08-17 08:25:19.678] /55 | | |=========================>|
468512808 (S1AP) PathSwitchRequest tac:115 plmnIdentity:260-06 plmnIdentity:260-
06 ipAddr:10.232.30.26 enbId:5153 cellId:55 mmeUeS1apId:197151291
enbUeS1apId:272525 e-RAB-ID:5 gTP-TEID:49A470FE'H
[2017-08-17 08:25:19.703] /55 | | |<=========================|
468512808 (S1AP) PathSwitchRequestAcknowledge ipAddr:10.24.18.9
mmeUeS1apId:197151291 enbUeS1apId:272525 e-RAB-ID:5 gTP-TEID:8463A06E'H
[2017-08-17 08:25:19.704] /55 | | |==================>| |
468512808 (X2AP) UEContextRelease UE-X2AP-ID:900 UE-X2AP-ID:634

The counter pmRrcConnReestAtt is stepped at reception of rrcConnectionReestablishmentRequest from

UE.

The counter pmRrcConnReestSucc is stepped at reception of rrcConnectionReestablishmentComplete

from UE.
The counter pmUeCtxtFetchAtt is stepped at reception of UEContextFetchRequest in source cell.

The counter pmUeCtxtFetchSucc is stepped at reception of UEContextRelease in source cell.

Reset
[2017-03-24 19:43:56.460] | | |=========================>|
(S1AP) Reset enbUeS1apId:541616 cause:misc:om-intervention
[2017-03-24 19:43:56.570] | | |<=========================|
(S1AP) ResetAcknowledge enbUeS1apId:541616

No eNode-B counters exist for Reset procedure.

Handover

X2 Handover
Source Cell
[2017-02-22 05:16:55.167] /4 |=========>| | | | | |
35406053 (RRC4G) MeasurementReport measId:9(A5) rsrp:-115 rsrq:-13.0 phCellId:32
rsrp:-98 rsrq:-11.5 phCellId:365 rsrp:-98 rsrq:-12.5 phCellId:364 rsrp:-100 rsrq:-14.0
sFreqId:1 sCellRsrp:-100 sCellRsrq:-14.0
[2017-02-22 05:16:55.171] /4 | | |==================>| |
35406053 (X2AP) HandoverRequest ipAddr:10.113.109.133 ipAddr:10.113.109.133 e-
RAB-ID:5 e-RAB-ID:6 gTP-TEID:12EC41A7'H gTP-TEID:174571A7'H qCI:5 qCI:6
MMEGID:33793 cause:radioNetwork:handover-desirable-for-radio-reasons UE-X2AP-ID:0
nextHop:0 cellSize:verysmall ECGI:{plmnIdentity:450-06,enbId:80600,cellId:2}
GUMMEI:{plmnIdentity:450-06} HRL:{servingPLMN:450-06} mmeUeS1apId:147746
mmeCode:02'H
[2017-02-22 05:16:55.217] /4 | | |<==================| |
35406053 (X2AP) HandoverRequestAcknowledge ipAddr:10.110.92.120
ipAddr:10.110.92.120 E-RABs-Admitted-List:{e-RAB-ID:5,6} gTP-TEID:78111016'H gTP-
TEID:CB9B3AD9'H UE-X2AP-ID-OLD:2308 UE-X2AP-ID-NEW:2126
[2017-02-22 05:16:55.220] /4 |<=========| | | | | |
35406053 (RRC4G) HandoverCommand targetPhysCellId:32 dlBandwidth:n50
powerRampingStep:dB4 crnti:11109 antPortCnt:an2 ciphAlg:eea1 intProtAlg:eia2
nextHop:0 keyChangeIndicator:FALSE dl-cFreq:2600 dl-BW:10.0MHz ttiBundling:FALSE
txMode:3(OL_MIMO)
[2017-02-22 05:16:55.223] /4 | | |==================>| |
35406053 (X2AP) SNStatusTransfer e-RAB-ID:5 e-RAB-ID:6 UE-X2AP-ID:2308 UE-X2AP-
ID:2126
[2017-02-22 05:16:55.313] /4 | | |<==================| |
35406053 (X2AP) UEContextRelease UE-X2AP-ID:2308 UE-X2AP-ID:2126
[2017-02-22 05:16:55.181] |=========>| | | | | |
(RRC4G) UE-EUTRA-Capability ueCategory:4 accessStratumRelease:rel10 bandEUTRA:5

pmHoPrepAttLteInterF counter is stepped when HandoverRequest is sent to target eNode-B.

pmHoPrepSuccLteInterF counter is stepped when HandoverRequestAcknowledge is received from target

eNode-B.

pmHoExeAttLteInterF counter is stepped when HandoverCommand/rrcConnectionReconfiguration is

sent to UE.

pmHoExeSuccLteInterF counter is stepped when UEContextRelease is received from target eNode-B.

Target Cell
[2017-02-22 05:16:55.179] /2 | | |<==================| |
17662069 (X2AP) HandoverRequest ipAddr:10.113.109.133 ipAddr:10.113.109.133 e-
RAB-ID:5 e-RAB-ID:6 gTP-TEID:12EC41A7'H gTP-TEID:174571A7'H qCI:5 qCI:6
MMEGID:33793 cause:radioNetwork:handover-desirable-for-radio-reasons UE-X2AP-ID:2308
nextHop:0 cellSize:verysmall ECGI:{plmnIdentity:450-06,enbId:80600,cellId:2}
GUMMEI:{plmnIdentity:450-06} HRL:{servingPLMN:450-06} mmeUeS1apId:147746
mmeCode:02'H
[2017-02-22 05:16:55.206] /2 | | |==================>| |
17662069 (X2AP) HandoverRequestAcknowledge ipAddr:10.110.92.120
ipAddr:10.110.92.120 E-RABs-Admitted-List:{e-RAB-ID:5,6} gTP-TEID:78111016'H gTP-
TEID:CB9B3AD9'H UE-X2AP-ID-OLD:2308 UE-X2AP-ID-NEW:2126
[2017-02-22 05:16:55.206] /2 |<=========| | | | | |
17662069 (RRC4G) HandoverCommand targetPhysCellId:32 dlBandwidth:n50
powerRampingStep:dB4 crnti:11109 antPortCnt:an2 ciphAlg:eea1 intProtAlg:eia2
nextHop:0 keyChangeIndicator:FALSE dl-cFreq:2600 dl-BW:10.0MHz ttiBundling:FALSE
txMode:3(OL_MIMO)
[2017-02-22 05:16:55.237] /2 | | |<==================| |
17662069 (X2AP) SNStatusTransfer e-RAB-ID:5 e-RAB-ID:6 UE-X2AP-ID:2308 UE-X2AP-
ID:2126
[2017-02-22 05:16:55.272] /2 |=========>| | | | | |
17662069 (RRC4G) RRCConnectionReconfigurationComplete
[2017-02-22 05:16:55.274] /2 | | |=========================>|
17662069 (S1AP) PathSwitchRequest tac:43115 plmnIdentity:450-06
plmnIdentity:450-06 ipAddr:10.110.92.120 ipAddr:10.110.92.120 enbId:80600 cellId:2
mmeUeS1apId:147746 enbUeS1apId:266290 e-RAB-ID:5 e-RAB-ID:6 gTP-TEID:E231ED53'H
gTP-TEID:AD4DCE85'H
[2017-02-22 05:16:55.302] /2 | | |<=========================|
17662069 (S1AP) PathSwitchRequestAcknowledge mmeUeS1apId:147746
enbUeS1apId:266290
[2017-02-22 05:16:55.302] /2 | | |==================>| |
17662069 (X2AP) UEContextRelease UE-X2AP-ID:2308 UE-X2AP-ID:2126

Note that in LTE there are no counters for incoming Handovers (use getstat command as an alternative).

S1 Handover
Source Cell
[2017-04-14 14:17:54.064] /5 |=========>| | | | | |
43966476 (RRC4G) MeasurementReport measId:1(A3) rsrp:-118 rsrq:-14.5 phCellId:455
rsrp:-114 rsrq:-15.0
[2017-04-14 14:17:54.066] /5 | | |=========================>|
43966476 (S1AP) HandoverRequired tac:13111 eNB-ID_macroENB_ID:42799
plmnIdentity:730-01 plmnIdentity:730-01 mmeUeS1apId:21108084 enbUeS1apId:278182
cause:radioNetwork:s1-intra-system-handover-triggered
[2017-04-14 14:17:54.131] /5 | | |<=========================|
43966476 (S1AP) HandoverCommand mmeUeS1apId:21108084 enbUeS1apId:278182
[2017-04-14 14:17:54.132] /5 |<=========| | | | | |
43966476 (RRC4G) HandoverCommand targetPhysCellId:455 dlBandwidth:n75
powerRampingStep:dB4 crnti:23637 ciphAlg:eea2 intProtAlg:eia2 nextHop:2
keyChangeIndicator:FALSE dl-cFreq:9485 dl-BW:15.0MHz ttiBundling:FALSE
txMode:3(OL_MIMO)
[2017-04-14 14:17:54.134] /5 | | |=========================>|
43966476 (S1AP) ENBStatusTransfer mmeUeS1apId:21108084 enbUeS1apId:278182 e-RAB-
ID:5
[2017-04-14 14:17:54.258] /5 | | |<=========================|
43966476 (S1AP) UEContextReleaseCommand mmeUeS1apId:21108084 enbUeS1apId:278182
cause:radioNetwork:successful-handover
pmHoPrepAttLteIntraF counter is stepped when HandoverRequired is sent to MME.

pmHoPrepSuccLteIntraF counter is stepped when HandoverCommand is received from MME.

pmHoExeAttLteIntraF counter is stepped when HandoverCommand/rrcConnectionReconfiguration is

sent to UE.

pmHoExeSuccLteIntraF counter is stepped when UEContextReleaseCommand received from MME with

cause ‘successful-handover’.

Target Cell
[14:22:10.817]000100 /4 | | |<===========| 38465912 /0 (S1AP)
HandoverRequest mmeUeS1Id:24442193 cause:radioNetwork-s1-intra-system-handover-
triggered agMbrDl:256,00Mbps agMbrUl:50,00Mbps qci:6 prioLev:2 preEmptCap:shall-not-
trigger-pre-emption preEmptVul:pre-emptable plmnId:730f01
[14:22:10.840]000100 /4 | | |===========>| 38465912 /0 (S1AP)
HandoverRequestAcknowledge mmeUeS1Id:24442193 enbUeS1Id:263953
[14:22:10.840]000100 /4 |<=========| | | 38465912 /67224000
(RRC4G) HandoverCommand trgPhCid:267 dl-cFreq:9485 BW:DL-15-MHz
[14:22:10.888]000100 /4 | | |<===========| 38465912 /0 (S1AP)
MMEStatusTransfer mmeUeS1Id:24442193 enbUeS1Id:263953
[14:22:11.205]000100 /4 |=========>| | | 38465912 /0
(RRC4G) rrcConnectionReconfigurationComplete
[14:22:11.205]000100 /4 | | |===========>| 38465912 /0 (S1AP)
HandoverNotify mmeUeS1Id:24442193 enbUeS1Id:263953 plmnId:730f01 plmnId:730f01
tac:13111

Note that in LTE there are no counters for incoming Handovers (use getstat command as an alternative).

PS Handover from LTE

LTE

[09:57:22.888]000100 /1 |=========>| | | 8397002 /0

(RRC4G) measurementReport measId:2(A2) rsrp:-94 rsrq:-3.0
[09:57:22.888]000100 /1 | | |===========>| 8397002 /0 (S1AP)
HandoverRequired mmeUeS1Id:79473180 enbUeS1Id:524 cause:radioNetwork-s1-inter-system-
handover-triggered\par plmnId:23591
[09:57:23.060]000100 /1 | | |<===========| 8397002 /0 (S1AP)
HandoverCommand mmeUeS1Id:79473180 enbUeS1Id:524
[09:57:23.060]000100 /1 |<=========| | | 8397002 /0
(RRC4G) mobilityFromEUTRACommand purpose:handover
[09:57:23.356]000100 | | |<===========| (S1AP)
UEContextReleaseCommand cause:radioNetwork-successful-handover

pmHoPrepAtt counter is stepped when HandoverRequired is sent to MME.

pmHoPrepSucc counter is stepped when HandoverCommand is received from MME.

pmHoExeAtt counter is stepped when mobilityFromEUTRACommand is sent to UE.

pmHoExeSucc counter is stepped when UEContextReleaseCommand received from MME with cause
‘successful-handover’.

WCDMA

[09:57:22.982] 0014/05/393216 <<---<< (RANAP) RelocationRequest

(IMSI=235919100000034) (cause:radioNetwork/resource-optimisation-relocation) (ps-
domain) (target:RNC=145,CI=14512) (UE-History-Information:'000032F51911A45010000020'H)
(SubscriberProfileIDforRFP:1) (RAB-ID=0x5) (trafClass=background)
(maxBitRate=16000000) (maxBitRate=16000000) (arpPrio=2) (RAB-Parameter-
ExtendedMaxBitrateList) (maxBitRate=84000000) (addr=10.206.255.4) (GlobalCN-ID)
(pLMNidentity='32F519'H) (cN-ID=11) (PLMNidentity:'32F519'H)
[09:57:23.045] 0014/05/393216 >>--->> (RANAP) RelocationRequestAcknowledge
(RAB-ID=0x5) (addr=10.208.145.135) (standard-UMTS-integrity-algorithm-UIA1)
[09:57:23.292] 0014/05/2 >>--->> (NBAP) RadioLinkRestoreIndication
(tID=28514L) (RNC.CCID=77) (RL-SetID=0)
[09:57:23.292] 0014/05/2 >>--->> (RANAP) RelocationDetect
[09:57:23.341] 0014/06/2 >>-------->> (RRC) handoverToUTRANComplete
(cs-domain) (startVal=0x0) (ps-domain) (startVal=0xA)

Seen from Core Network

PS Handover to LTE
WCDMA
[14:30:33.523]0013/03 >>--->> (RANAP) RelocationRequired (UE:11)
(cause:radioNetwork/reduce-load-in-serving-cell) (RNC-ID=268) (pLMNidentity='32F519'H)
(pLMNidentity='32F519'H)
[14:30:33.609]0013/03 <<---<< (RANAP) RelocationCommand (UE:11)
[14:30:33.609]0013/03 <<--------<< (RRC) handoverFromUTRANCommand-EUTRA
(UE:11) (rrcTID=0) (RAB-ID=0x05) (GSM-MAP) (ps-domain)
[14:30:54.089]0013/03 <<---<< (RANAP) Iu-ReleaseCommand (UE:11)
(cause:radioNetwork/successful-relocation)

LTE
[2018-03-07 14:30:33.540] /2 | | |<=========================|
16904194 (S1AP) HandoverRequest IMEISV:35854305111515151515 ipAddr:10.219.33.225
mmeUeS1apId:65766744 e-RAB-ID:5 gTP-TEID:2E9FC5B3'H qCI:9
cause:radioNetwork:reduce-load-in-serving-cell HLR:{servingPLMN:32F519'H}
[2018-03-07 14:30:33.568] /2 | | |=========================>|
16904194 (S1AP) HandoverRequestAcknowledge ipAddr:10.218.210.92
mmeUeS1apId:65766744 enbUeS1apId:266587 e-RAB-ID:5 gTP-TEID:47F40503'H
[2018-03-07 14:30:33.568] /2 |<=========| | | | | |
16904194 (RRC4G) HandoverCommand targetPhysCellId:40 dlBandwidth:n25
powerRampingStep:dB4 crnti:13339 antPortCnt:an1 ciphAlg:eea1 intProtAlg:eia2 dl-
cFreq:414 dl-BW:5.0MHz ttiBundling:FALSE drbId:3
[2018-03-07 14:30:34.060] /2 |=========>| | | | | |
16904194 (RRC4G) RRCConnectionReconfigurationComplete
[2018-03-07 14:30:34.064] /2 | | |=========================>|
16904194 (S1AP) HandoverNotify tac:155 plmnIdentity:235-91 plmnIdentity:235-91
enbId:72239 cellId:2 mmeUeS1apId:65766744 enbUeS1apId:266587

Note that in LTE there are no counters for incoming Handovers (use getstat command as an alternative).

SRVCC Handover (VoLTE Handover to WCDMA/GSM)

[2017-11-24 17:54:11.333] /12 | | |<=========================|
108064848 (S1AP) E-RABSetupRequest ipAddr:10.128.101.129 mmeUeS1apId:494110274
enbUeS1apId:264217 e-RAB-ID:7 gTP-TEID:1F2EBFD7'H qCI:1
[2017-11-24 17:54:11.380] /12 | | |=========================>|
108064848 (S1AP) E-RABSetupResponse ipAddr:10.216.68.254 mmeUeS1apId:494110274
enbUeS1apId:264217 e-RAB-ID:7 gTP-TEID:1D4FDD37'H
:
:
:
[2017-11-24 17:54:14.260] /12 |=========>| | | | | |
108064848 (RRC4G) MeasurementReport measId:11(B2) rsrp:-122 rsrq:-14.5 phCellId:28
[2017-11-24 17:54:14.261] /12 | | |=========================>|
108064848 (S1AP) HandoverRequired plmnIdentity:302-720 mmeUeS1apId:494110274
enbUeS1apId:264217 cause:radioNetwork:s1-inter-system-handover-triggered lAC:55060
rNC-ID:43
[2017-11-24 17:54:14.843] /12 | | |<=========================|
108064848 (S1AP) HandoverCommand mmeUeS1apId:494110274 enbUeS1apId:264217
[2017-11-24 17:54:14.844] /12 |<=========| | | | | |
108064848 (RRC4G) MobilityFromEUTRACommand
[2017-11-24 17:54:15.381] /12 | | |<=========================|
108064848 (S1AP) UEContextReleaseCommand mmeUeS1apId:494110274 enbUeS1apId:264217
cause:radioNetwork:successful-handover

pmHoPrepAttSrvcc counter is stepped when HandoverRequired is sent to MME.

pmHoPrepSuccSrvcc counter is stepped when HandoverCommand is received from MME.

pmHoExeAttSrvcc counter is stepped when mobilityFromEUTRACommand is sent to UE.

pmHoExeSuccSrvcc counter is stepped when UEContextReleaseCommand received from MME with

cause ‘successful-handover’.

Seen from Core Network

LTE Identifiers

ID Meaning Description
IMSI (
International Mobile Subscriber Unique identification of mobile (LTE) subscriber
IMSI digits)
Identity Network (MME) gets the PLMN of the subscriber
= MCC
Public Land Mobile Network PLMN
PLMN ID Unique identification of PLMN
Identifier 6 digit
MCC Mobile Country Code assigned by ITU 3 digit
MNC Mobile Network Code assigned by National Authority 2 or 3
Mobile Subscriber Identification
MSIN assigned by operator 9 or 10
Number
GUTI (
Globally Unique Temporary UE To identify a UE between the UE and the MME on
GUTI bits) =
Identity behalf of IMSI for security reason
TMSI
GUTI is stored in TIN parameter of UE’s MM context.
Temporary Identity used in Next
TIN TIN indicates which temporary ID will be used in the TIN =
Update
next update.
SAE Temporary Mobile To locally identify a UE in short within a MME group S-TMS
S-TMSI
Subscriber Identity (Unique within a MME Pool) + M-T
M-TMSI MME Mobile Subscriber Identity Unique within a MME 32 bits
GUMM
To identify a MME uniquely in global
GUMMEI Globally Unique MME Identity 48 bits
GUTI contains GUMMEI
MMEI
To identify a MME uniquely within a PLMN MMEI
MMEI MME Identifier
Operator commissions at eNBMMEI + MME
MMEGI MME Group Identifier Unique within a PLMN 16 bits
To identify a MME uniquely within a MME Group. S-
MMEC MME Code 8 bits
TMSI contains MMEC8
Cell- Radio Network Temporary 0x000
C-RNTI To identify an UE uniquely in a cell
Identifier bits)
International Mobile Equipment IMEI (
IMEI To identify a ME (Mobile Equipment) uniquely
Identity SNR +
IMEI/S
IMEI/SV IMEI/Software Version To identify a ME (Mobile Equipment) uniquely
+ SNR
To identify a Cell in global (Globally Unique) ECGI (
ECGI E-UTRAN Cell Global Identifier
EPC can know UE location based of ECGI bits) =
ECI (2
ECI E-UTRAN Cell Identifier To identify a Cell within a PLMN
Cell ID
To identify a specific PDN GW (P-GW)
IP add
PGW ID PDN GW Identity HSS assigns P-GW for PDN (IP network) connection
FQDN
of each UE
TAI (n
To identify Tracking Area
TAI Tracking Area Identity bits) =
Globally uniqueTAI
GW
TAC Tracking Area Code To indicate eNB to which Tracking Area the eNB 16 bits
belongs (per Cell)
 Unique within a PLMN16
UE can move into the cells included in TAL list
TAI List Tracking Area Identity List without location update (TA update) Variab
Globally unique
To identify an PDN (IP network), that mobile data
user wants to communicate with
PDN Identity (APN) is used to determine the P-GW
PDN Id
and point of interconnection with a PDN
PDN ID Packet Data Network Identity APN.N
With APN as query parameter to the DNS
(variab
procedures, the MME will receive a list of candidate
P-GWs, and then a P-GW is selected by MME with
policy
EPS Bearer Evolved Packet System Bearer To identify an EPS bearer (Default or Dedicated) per
4 bits
ID Identifier an UE4
E-UTRAN Radio Access Bearer
E-RAB ID To identify an E-RAB per an UE 4 bits
Identifier•
DRB ID Data Radio Bearer Identifier To identify a DRB per an UE4 4 bits
To identify the default bearer associated with a
LBI Linked EPS Bearer ID 4 bits
dedicated EPS bearer4
To identify the end point of a GTP tunnel when the
TEID Tunnel End Point identifier 32 bits
tunnel is established

Tracing eNode-B (Время у Тилака 12:26 День 9)

Always disable active traces before activating new traces:

lh mp ue disable -allcell
all te default *
all te default -restart
lh mp te filter reset *
mtd kill -all
lh gcpu te default
hicap disable

RAC (Control Plane)

RRC Degradation Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e all Ft_RRC_CONN_SETUP 
lh mp te e all ABNORMAL
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmRrcConnEstabAtt
lh mp pm trace enable -counter -name EUtranCellFDD::pmRrcConnEstabSucc 
lh mp pm trace enable -counter -name EUtranCellFDD::pmRrcConnEstabAttMta  if
terminating RRC is degraded
lh mp pm trace enable -counter -name EUtranCellFDD::pmRrcConnEstabSuccMta 

Last two traces only if terminating RRC degraded (Paging related)

S1 Degradation Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e all Ft_RRC_CONN_SETUP 
lh mp te e all ABNORMAL
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmS1SigConnEstabAtt
lh mp pm trace enable -counter -name EUtranCellFDD::pmS1SigConnEstabSucc

Paging Degradation Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te filter set "[0]=$0 AND [1]=$0A AND [2]=$40" Ft_S1AP_ASN  G1 RBS types
lh mp te filter set ‘[0]=$0 AND [1]=$0A AND [2]=$40’ Ft_S1AP_ASN  G2 RBS types
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e all Ft_PAGING
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name ENodeBFunction::pmPagS1Discarded
lh mp pm trace enable -counter -name ENodeBFunction::pmPagS1Received
lh mp pm trace enable -counter -name EUtranCellFDD::pmPagDiscarded
lh mp pm trace enable -counter -name EUtranCellFDD::pmPagReceived
lh mp pm trace enable -counter -name EUtranCellFDD::pmRrcConnEstabAttMta
lh mp pm trace enable -counter -name EUtranCellFDD::pmRrcConnEstabSuccMta 

mtd peek -ta dlMacPeBl -si LPP_UP_DLMACPE_EI_PAGING_DATA_FAIL_IND

lh gcpu te e all UpDlMacPeBl_Spaging  G1 RBS types
lh gcpu bbte enable UpDlMacPeBl_Spaging  G2 RBS types

Rim Transfer Issues

LTE Traces

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all Ft_RIM

WCDMA Traces

lh mod ueidtrace 'off' -all

lh mod uerandtrace 'off' -all
all te default *
all te default -restart
lh mod ue_pm disable -counter all
lh mod traceCounter off
all te d info *
all te d error *

lh mod te e all RIM_UTRASI

lh ranapmp te e all RIM_UTRASI

Basic Traces (время у Тилака 12:43 День 9)

General traces to be activated for any issue (except RRC/S1/Paging Degradation

issues):

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN     G2 RBS types
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN    G1 RBS types
lh mp te e all NAS_MSG_TRANSFER
lh mp te e trace9 Ft_RLC_FAILURE
lh mp te e trace3 Ft_RRC_CONN_REESTABLISHMENT
lh mp te e trace3 Ft_CONTEXT_FETCH
lh mp te e all ABNORMAL

RRC, S1AP and X2AP must be traced for any issue.

Paging messages must filter out to avoid signalling overflow (to see Paging messages
again run, lh mp te filter reset Ft_S1AP_ASN)
trace9 Ft_RLC_FAILURE is needed to see if the connection has run into RLC failure
trace3 Ft_RRC_CONN_REESTABLISHMENT is needed to see if UE have performed RRC Re-
establishment in same RBS
trace3 Ft_CONTEXT_FETCH is needed to see if UE have performed RRC Re-establishment in
another RBS

Depending on problem under investigation following additional traces need to be

activated

NAS Signalling Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e all Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e all Ft_INACTIVITY_SUPERVISION
lh mp te e all Ft_NO_ACTIVE_PROC
lh mp te e all ABNORMAL
e-RAB setup (Initial Context Setup) Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e trace9 Ft_RLC_FAILURE
lh mp te e trace3 Ft_RRC_CONN_REESTABLISHMENT
lh mp te e trace3 Ft_CONTEXT_FETCH
lh mp te e all Ft_INITIAL_CTXT_SETUP
lh mp te e all Ft_ERAB_SETUP
lh mp te e all Ft_EPS_BEARER_SETUP
lh mp te e all Ft_NO_ACTIVE_PROC
lh mp te e all ABNORMAL
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabEstabAttInit
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabEstabSuccInit
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabEstabAttAddedQci
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabEstabSuccAddedQci

QCI Counters only if degradation is with VoLTE (QCI=1)

CSFB Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e all Ft_UE_RAC_MEASUREMENTS
lh mp te e all Ft_RRC_CONN_RELEASE
lh mp te e all Ft_UE_CTXT_MODIFICATION
lh mp te e all Ft_OUTGOING_HANDOVER
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmUeCtxtEstabAttCsfb
lh mp pm trace enable -counter -name EUtranCellFDD::pmUeCtxtModAttCsfb
lh mp pm trace enable -counter -name EUtranCellFDD::pmUeCtxtRelCsfbWcdma
lh mp pm trace enable -counter -name UtranCellRelation::pmHoPrepAttCsfb
lh mp pm trace enable -counter -name UtranCellRelation::pmHoPrepSuccCsfb
lh mp pm trace enable -counter -name UtranCellRelation::pmHoExeAttCsfb
lh mp pm trace enable -counter -name UtranCellRelation::pmHoExeSuccCsfb

Ft_OUTGOING_HANDOVER only if PshoBasedCsfbToUtran feature is enabled

Counters on UtranCellRelation only if PshoBasedCsfbToUtran feature is enabled
RRC Re-establishment Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e all Ft_RRC_CONN_REESTABLISHMENT
lh mp te e all Ft_CONTEXT_FETCH
lh mp te e all ABNORMAL
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmRrcConnReestAtt
lh mp pm trace enable -counter -name EUtranCellFDD::pmRrcConnReestSucc
lh mp pm trace enable -counter -name EUtranCellFDD::pmUeCtxtFetchAtt
lh mp pm trace enable -counter -name EUtranCellFDD::pmUeCtxtFetchSucc

Handover Issues

Outgoing Handover Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e trace9 Ft_RLC_FAILURE
lh mp te e trace3 Ft_RRC_CONN_REESTABLISHMENT
lh mp te e trace3 Ft_CONTEXT_FETCH
lh mp te e all Ft_UE_RAC_MEASUREMENTS
lh mp te e all Ft_OUTGOING_HANDOVER
lh mp te e all Ft_INTRA_CELL_HANDOVER
lh mp te e all ABNORMAL
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellRelation::pmHoPrepAttLteIntraF 
intra frequency handover counters
lh mp pm trace enable -counter -name EUtranCellRelation::pmHoPrepSuccLteIntraF
lh mp pm trace enable -counter -name EUtranCellRelation::pmHoExeAttLteIntraF
lh mp pm trace enable -counter -name EUtranCellRelation::pmHoExeSuccLteIntraF
lh mp pm trace enable -counter -name EUtranCellRelation::pmHoPrepAttLteInterF 
inter frequency handover counters
lh mp pm trace enable -counter -name EUtranCellRelation::pmHoPrepSuccLteInterF
lh mp pm trace enable -counter -name EUtranCellRelation::pmHoExeAttLteInterF
lh mp pm trace enable -counter -name EUtranCellRelation::pmHoExeSuccLteInterF
lh mp pm trace enable -counter -name UtranCellRelation::pmHoPrepAtt  PS handover
to WCDMA counters
lh mp pm trace enable -counter -name UtranCellRelation::pmHoPrepSucc
lh mp pm trace enable -counter -name UtranCellRelation::pmHoExeAtt
lh mp pm trace enable -counter -name UtranCellRelation::pmHoExeSucc
lh mp pm trace enable -counter -name UtranCellRelation::pmHoPrepAttSrvcc  VoLTE
handover to WCDMA counters
lh mp pm trace enable -counter -name UtranCellRelation::pmHoPrepSuccSrvcc
lh mp pm trace enable -counter -name UtranCellRelation::pmHoExeAttSrrvcc
lh mp pm trace enable -counter -name UtranCellRelation::pmHoExeSuccSrvcc

Ft_INTRA_CELL_HANDOVER for Handover issues within same cell (e.g. TTI Bundling, key
change on-the-fly etc.)
Only one of Inter-frequency or Intra-Frequency or IRAT counters should be activated
based on the need

Incoming Handover Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e trace9 Ft_RLC_FAILURE
lh mp te e trace3 Ft_RRC_CONN_REESTABLISHMENT
lh mp te e trace3 Ft_CONTEXT_FETCH
lh mp te e all Ft_NO_ACTIVE_PROC
lh mp te e all Ft_S1_X2_ENB_ID
lh mp te e all Ft_INCOMING_HANDOVER
lh mp te e all ABNORMAL

eNode-B initiated call Drop Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e trace9 Ft_RLC_FAILURE
lh mp te e all Ft_PDCCH_UL_SYNC_FAILURE
lh mp te e all ABNORMAL 
lh mp te e all Ft_ERAB_RELEASE                                                     
lh mp te e trace3 Ft_RRC_CONN_REESTABLISHMENT
lh mp te e trace3 Ft_CONTEXT_FETCH
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabRelAbnormalEnb
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabRelAbnormalEnbAct

MME initiated call Drop Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e trace9 Ft_RLC_FAILURE
lh mp te e all Ft_PDCCH_UL_SYNC_FAILURE
lh mp te e all ABNORMAL
lh mp te e all Ft_ERAB_RELEASE                                                      
lh mp te e trace3 Ft_RRC_CONN_REESTABLISHMENT
lh mp te e trace3 Ft_CONTEXT_FETCH
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabRelAbnormalMme
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabRelAbnormalMmeAct
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabRelAbnormalMmeActQci
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabRelMmeActEutra

VoLTE Drop Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e trace9 Ft_RLC_FAILURE
lh mp te e all Ft_PDCCH_UL_SYNC_FAILURE
lh mp te e all ABNORMAL 
lh mp te e all Ft_ERAB_RELEASE                                                     
lh mp te e trace3 Ft_RRC_CONN_REESTABLISHMENT
lh mp te e trace3 Ft_CONTEXT_FETCH
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabRelAbnormalEnbActQci
lh mp pm trace enable -counter -name EUtranCellFDD::pmErabRelAbnormalMmeActQci

Carrier Aggregation Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e all Ft_UE_RAC_MEASUREMENTS
lh mp te e all Ft_CARRIER_AGGREGATION
lh mp te e all uehUeBl_SCellEvalSwU
lh mp te e trace5 Ft_PM_COUNTERS
lh mp pm trace enable -counter -name EUtranCellFDD::pmCaConfiguredDlSamp
lh mp pm trace enable -counter -name EUtranCellFDD::pmCaConfiguredMeasAtt
lh mp pm trace enable -counter -name EUtranCellFDD::pmCaConfiguredMeasSucc
lh mp pm trace enable -counter -name EUtranCellFDD::pmCaDeconfigured
ANR Related Issues

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in cellid 1 
lh mp te e bus_send bus_receive Ft_S1AP_ASN
lh mp te e bus_send bus_receive Ft_RRC_ASN
lh mp te e bus_send bus_receive Ft_X2AP_ASN
lh mp te e trace7 Ft_RRC_CONN_SETUP  
lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN   
lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN  
lh mp te e all NAS_MSG_TRANSFER
lh mp te e all Ft_UE_RAC_MEASUREMENTS
lh mp te e all Ft_OUTGOING_HANDOVER
lh mp te e all Ft_ANR_COMMON
lh mp te e all Ft_CELL_ANR_MEAS
lh mp te e all Ft_UE_ANR_MEAS
lh mp te e all Ft_PNP
lh mp te e all Ft_CONFIG

Other useful RAC traces

lh mp te e all Ft_CONN_COORD  need to activate in case eNode-B handling is

suspicious
lh mp te e all Ft_X2AP_SETUP
lh mp te e all Ft_X2AP_RELEASE
lh mp te e trace7 uehRrcSigBl_CtxtSwU  to see RLC Ack for NAS Messages sent to UE
lh mp te e trace7 Ft_RRC_CONN_RELEASE  to see RLC Ack for RRCConnectionRelease
sent to UE
lh mp te e all Ft_ERAB_MODIFY  need to activate in case of e-RAB modification
failing
lh mp te e all Ft_BB_TRIGGERED_RRC_RECONF
lh mp te e all Ft_X2_COMMON_SIGNALING  need to activate in case of X2
communication issues
lh mp te e all Ft_X2_DEDICATED_SIGNALING
lh mp te e all Ft_S1_COMMON_SIGNALING  need to activate in case of S1
communication issues
lh mp te e all Ft_S1_DEDICATED_SIGNALING
lh mp te e all Ft_UE_POSITIONING  need to activate for Positioning related issues
lh mp te e all Ft_RAC_SECURITY  need to activate in cases there is a security
mismatch between UE and eNode-B
lh mp te e all SCTP_UPT  need to activate in case SCTP Association setup fails
lh mp te e all Ft_TRAFFIC_SECURITY
lh mp te e all Ft_SYSCONST
lh mp te e all uehBearerBl_HandlingSwU
lh mp te e all uehMeasBl_HoEvalSwU
lh mp te e all uehBearerHandlingC
lh mp te e all uehUeCtxtC
lh mp te e all uehBearerCtxtC
lh mp te e all uehNwIfCtxtC

BB (User Plane)
gcpu00256 and gcpu00512 = Air interface uplink and S1-U uplink traffic
gcpu00768 = air interface downlink and S1-U downlink traffic
gcpu01024 = control/coordination

/diagm/bbte listagents  to check which boards available in G2 RBS types

mon-
monu all  to start target monitor for BB traces in G2 RBS types
mon mp  to start target monitor for RAC traces in G2 RBS types

lh gcpu fte s  to check which BB traces are enabled

lh gcpu te default  to disable all BB traces in G1 RBS types

lh gcpu te d UpUlPdcpPeFt_DRB_SDU  to disable the trae (cannot disable all BB
traces in one command in G2 RBS types)

RACH Issues

mtd peek -ta ulCellPeBl -si LPP_UP_ULCELLPE_CI_SCHEDULE_RA_RESPONSE_IND

mtd peek -ta dlMacCeBl -sig UPC_DLMACCE_FI_SCHEDULE_RA_MSG2_REQ
mtd peek -ta dlMacPeBl -sig LPP_UP_DLMACPE_CI_DL_CCH_ALLOC_IND -dir incoming
mtd peek -ta ulMacPeBl -si LPP_UP_ULMACPE_CI_RA_MSG3_IND -di 3 -rep 65535
mtd peek -ta dlL1PeBl -signal LPP_UP_DLMACPE_CI_PDCCH_IND -dir incoming
mtd peek -ta ulL1PeBl -signal LPP_UP_ULMACPE_CI_UL_L1_HARQFDBK2_DL_IND
mtd peek -ta ulL1PeBl -signal LPP_UP_ULL1PE_EI_ALLOCATION_IND
mtd peek -ta ulMacCeBl -signal LPP_UP_ULMACPE_CI_UL_MAC_CTRL_INFO_IND
mtd peek -ta ulMacPeBl -signal LPP_UP_ULMACPE_CI_UL_UE_ALLOC_IND -dir incoming

Zero Throughput Issues

lhsh gcpu00256 te e all UpUlPdcpPeFt_DRB_SDU    If G1 RBS

lhsh gcpu00768 te e all UpDlPdcpPeFt_DRB_SDU 
lh gcpu te e all UpDlPdcpPeFt_DISCARD
lh gcpu te e all UpUlPdcpPeFt_DISCARD
lh gcpu te e all UpDlRlcPeFt_RETRANSM
lh gcpu te e all UpUlPdcpPeBl
lh gcpu te e all UpUlPdcpPeBl

lh gcpu bbte enable UpUlPdcpPeFt_DRB_SDU all  If G2 RBS

lh gcpu bbte enable UpDlPdcpPeFt_DRB_SDU all
lh gcpu bbte enable UpDlPdcpPeFt_DISCARD
lh gcpu bbte enable UpUlPdcpPeFt_DISCARD
lh gcpu bbte enable UpDlRlcPeFt_RETRANSM
lh gcpu bbte enable UpDlPdcpPeBl
lh gcpu bbte enable UpUlPdcpPeBl

Low Throughput Issues

https://lte-
wiki.rnd.ki.sw.ericsson.se/wiki/UP_L2:_Troubleshooting/List_of_L2_Traces#Useful_traces
_for_Throughput_Debugging
Downlink
========

mtd peek -ta dlMacCeBl -sig LPP_UP_DLMACPE_CI_DL_UE_ALLOC_IND -dir OUTGOING

mtd peek -ta dlMacCeBl -sig LPP_UP_DLMACPE_CI_DL_UE_CANDIDATES_IND -dir INCOMING

Uplink
======

mtd peek -ta ulMacPeBl -signal LPP_UP_ULMACPE_CI_UL_UE_ALLOC_IND -dir incoming

mtd peek -ta ulMacCeBl -signal LPP_UP_ULMACPE_CI_UL_MAC_CTRL_INFO_IND
mtd peek -ta ulMacCeBl -signal LPP_UP_ULMACPE_CI_UL_L1_MEASRPRT2_UL_IND -dir INCOMING

Output from bbfilter command

============================
timestamp |lost|Cell|Sfn |Sf|BbUeRef |ulmodul|prb|prbSt|prbEn|ndf|
rv|tbs |ul_procId|harq|dtx|bsr |phr|puschPwr|puschSinr|sr|srStrong|sfCounter|
2018-01-16 13:59:26.059326 | | 15 | 944| 1| f0000c0| 16QAM | 3 | 94 | 96 | Y |
0| 1288 | 1 | ACK| N | 0 | 23| -96.0 | 23 | | | 9441 |
2018-01-16 13:59:29.899325 | | 15 | 304| 1| f0000c0| 16QAM | 3 | 94 | 96 | Y |
0| 1288 | 1 | ACK| N | 0 | 23| -96.1 | 23 | | | 13281 |
2018-01-16 13:59:33.132966 | | 15 | 627| 5| f0000c0| | | | | |
| | | | | | | | |SR| N | 16515 |
2018-01-16 13:59:33.142324 | | 15 | 628| 4| f0000c0| 16QAM | 2 | 95 | 96 | Y |
0| 904 | 4 | DTX| Y | | | -132.3 | -17 | | | 16524 |

Trace Activation and Running Scripts

1) Always disable active traces before activating new traces:

lh mp ue disable -allcell
all te default *
all te default -restart
lh mp te filter reset *
mtd kill -all
lh gcpu te default
hicap disable

2) One of the following coli commands is a pre-requisite for trace collection:

lh mp ue enable -allcell -allUe -timeout 720  tracing all UEs in whole

eNode-B
lh mp ue enable -cellid 1 -allue -timeout 720    tracing all UEs only in
cellid 1 

3) Activate new traces. Make sure traces were accepted. If any trace is not accepted due to syntax
error it is visible from command output:

L10999-MTN_HQ_PH1_PCELL> lh mp te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40"

Ft_S1AP_ASN  trace accepted

180319-12:51:22 10.45.204.241 18.0a ERBS_NODE_MODEL_J_1_82_COMPLETE stopfile=/tmp/511

======================================================================================
=======
$ lhsh 000100 te filter set "[0]<>$0 OR [1]<>$0A OR [2]<>$40" Ft_S1AP_ASN
$

L10999-MTN_HQ_PH1_PCELL> lh mp te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40'

Ft_S1AP_ASN  trace not accepted

180319-12:51:36 10.45.204.241 18.0a ERBS_NODE_MODEL_J_1_82_COMPLETE stopfile=/tmp/511

======================================================================================
=======
$ lhsh 000100 te filter set '[0]<>$0 OR [1]<>$0A OR [2]<>$40' Ft_S1AP_ASN
0001: Usage: Take cmd 'man te' for help info
$

4) Start target monitor as below:

mon-

mon mp  if only RAC traces are collected

mon all  in G1 nodes both RAC and BB traces can be collected with one target
monitor

monu all  in G2 nodes RAC and BB traces should be collected with two separate
target monitors

5) Call output raw traces LTE.log. Open a new window from where LTE.log is saved and make sure
(in real-time) there is no signalling overflow:

tail -f LTE.log | grep -i ‘overflow’

6) Decode raw traces as below:

https://wcdma-confluence.rnd.ki.sw.ericsson.se/display/PB/LTNG+-+Download

cat LTE.log | /home/eratini/ltngflow/bin/ltng-decoder -s > MP.log

cat LTE.log | /home/eratini/ltngflow/bin/ltng-flow -s -w > flow.log

Usage of scripts

Raw LTE log must be decoded in black and white:

cat LTE.log | /home/eratini/ltngflow/bin/ltng-decoder -s > MP.log

cat LTE.log | /home/eratini/ltngflow/bin/ltng-flow -s -w > flow.log

cat flow.log | perl /home/eratini/decoder/bin/findDrop.pl > output.log (to execute the script)

Depending on the problem correct conditions must be used to get desired output.

RRC Setup Degradation (Время у Тилака 10:56 День 10)

=====================
next unless $str =~ /RRCConnectionRequest/;
next unless $str !~ /RRCConnectionSetupComplete/;

OR

next unless $str =~ /pmRrcConnEstabAtt/;

next unless $str !~ /pmRrcConnEstabSucc/;

S1 Setup Degradation
====================

next unless $str =~ /InitialUEMessage/;

next unless $str !~ /<==.*S1/;
next unless $str !~ /InitialContextSetupResponse/;

OR

next unless $str =~ /pmS1SigConnEstabAtt/;

next unless $str !~ /pmS1SigConnEstabSucc/;

Initial Context Setup Degradation (Время у Тилака 11:03 День 10)

=================================

next unless $str =~ /InitialContextSetupFailure/;

OR

next unless $str =~ /pmS1SigConnEstabAtt/;

next unless $str !~ /pmS1SigConnEstabSucc/;

MME initiated Drops

===================

next unless $str !~ /UEContextReleaseRequest/;

next unless $str =~ /UEContextReleaseCommand.*release-due-to-eutran-generated-reason/;

OR

next unless $str =~ /pmErabRelAbnormalMmeAct/;

eNode-B initiated Drops

=======================
next unless $str =~ /UEContextReleaseRequest.*radio-connection-with-ue-lost/;

OR

next unless $str =~ /pmErabRelAbnormalEnbAct/;

MME initiated VoLTE Drops

=========================

next unless $str !~ /UEContextReleaseRequest/;

next unless $str =~ /UEContextReleaseCommand.*release-due-to-eutran-generated-reason/;
next unless $str =~ /qCI:1/ || $str =~ /e-RAB-ID:7/;

OR

next unless $str =~ /pmErabRelAbnormalMmeActQciSub1;

eNode-B initiated VoLTE Drops

=============================

next unless $str =~ /UEContextReleaseRequest.*radio-connection-with-ue-lost/;

next unless $str =~ /qCI:1/ || $str =~ /e-RAB-ID:7/; # For VoLte

OR

next unless $str =~ /pmErabRelAbnormalEnbAct QciSub1/;

s1HO preparation failure

========================

next unless $str =~ /(S1AP).*HandoverRequired/;

next unless $str =~ /(S1AP).*HandoverPreparationFailure/;

s1HO times out

==============

next unless $str =~ /(S1AP).*HandoverRequired/;

next unless $str =~ /UEContextReleaseRequest.*tS1relocoverall-expiry/;

s1HO followed by RRC Re-establishment

=====================================
next unless $str =~ /(S1AP).*HandoverRequired.*s1-intra-system-handover-triggered/;
next unless $str =~ /EAB-UEContextFetch.*/;
next unless $str !~ /RRCConnectionReestablishment/;

s1HO followed by RRC Re-establishment for IRAT Handover

=======================================================

next unless $str =~ /(S1AP).*HandoverRequired.*s1-inter-system-handover-triggered/;

next unless $str =~ /EAB-UEContextFetch.*/;
next unless $str !~ /RRCConnectionReestablishment/;

x2HO preparation failure

========================

next unless $str =~ /====>.*HandoverRequest /;

next unless $str =~ /(X2AP).*HandoverPreparationFailure/;

x2HO times out

==============

next unless $str =~ /====>.*HandoverRequest /;

next unless $str =~ /UEContextReleaseRequest.*tx2relocoverall-expiry/;

x2HO followed by RRC Re-establishment

=====================================

next unless $str =~ /====>.*HandoverRequest /;

next unless $str =~ /<====.*HandoverRequestAcknowledge/;
next unless $str =~ /EAB-UEContextFetch.*/;
next unless $str !~ /RRCConnectionReestablishment/;

IFHO Failure
============

next unless $str =~ /====>.*HandoverRequest /;

next unless $str =~ /<====.*HandoverRequestAcknowledge/;
next unless $str =~ /MeasurementReport.*(A5)/;
next unless $str =~ /EAB-UEContextFetch.*/;
next unless $str !~ /RRCConnectionReestablishment/;
Usage of Extractor.pl script
============================

cat MP.log | perl /home/eratini/decoder/bin/Extractor.pl -rac "Decode S1AP PDU

S1InitialContextSetupRequest" > InitialContextSetupRequest.log

cat MP.log | tr -d '\000' | perl /home/eratini/decoder/bin/Extractor.pl -rac "RacUeRef 113431699," >

temp.log

Useful Moshell commands (время у Тилака 11:11 день 9)

=======================

get Ip=1 nodeIpAddress (ip-address of the node, G1 only)

get address usedAddress (ip-address of the node, G2 only)

lget licens featurestate 1 (all activated features, G1 only)

hget 1,FeatureState description|serviceState|featureState (all feature states, G2 only)

ma FEATURES Lm=1,FeatureState serviceState 1 (all activated features, G2 only)

get FEATURES description (all activated features, G2 only)

hget ^EUtranCell.*= earfcndl|^freqband|^additionalFreqBandList|^cellid|physicalLayerCellId$|tac$

hget ^EUtranCell.*= earfcndl|^freqband|^additionalFreqBandList|^cellid|layer|tac$

get EUtraNetwork=1,ExternalENodeBFunction=.*,TermPointToENB=.* operationalState

lhsh 000100 acpsh info (find SGw ip-address, G1 only)

tn/tnrh-gtp-path (find SGw ip-address, G2 only)

tn/tnrh-session (find references to all connections towards SGw, G2 only)

EtHostMo_startPing -d 189.40.173.20 -h 1 -c 100 -s 1012 (ping SGw ip-address 100 times with
1012 bytes, G1 only)

iacrh ping -dst 114.0.97.97 -src 10.21.202.191 -n 5 -s 32 (ping SGw ip-address from HostEt ip-
address 5 times with 32 bytes, G1 only)
iacrh ping -dst 10.159.44.113 -src 10.21.194.191 -n 5 -s 32 (ping MME ip-address from HostEt ip-
address 5 times with 32 bytes, G1 only)

iacrh traceroute -dst 114.0.97.97 -src 10.21.202.191 (traceroute between SGw and HostEt, G1
only)

mcc Transport=1,Router=vr_LTE_Traffic,InterfaceIPv4=Traffic,AddressIPv4=1 ping 114.2.28.117

(ping SGw ip-address from IPv4 ip-address, G2 only)

mcc Transport=1,Router=vr_4G_TRAFFIC ping 10.23.105.13 -c 3 --interface

Transport=1,Router=vr_4G_TRAFFIC,InterfaceIPv4=2,AddressIPv4=1 (ping SGw ip-address from
IPv4 ip-address, G2 only)

mcc Transport=1,Router=vr_LTE_MME,InterfaceIPv4=MME,AddressIPv4=1 ping 10.159.44.114 --count

10 (ping MME ip-address from IPv4 ip-address, G2 only)

mcc Transport=1,Router=vr_LTE_Traffic,InterfaceIPv4=Traffic,AddressIPv4=1 traceroute 114.2.28.117

(traceroute between SGw and iPv4, G2 only)

get Transport=1,SctpEndpoint=1 localIpAddress (interface towards MME and TermPointToENB, G2

only)

mcc Transport=1,Router=vr_LTE_MME,InterfaceIPv4=MME,AddressIPv4=1 ping 10.21.198.80 (ping

TermPointToENB, G2 only)

getstat (numbers for certain events not available with counters)

ue print -ue -allcell -v (to check all ongoing connections)

ue print -bearer -allcell (to check all ongoing bearers)

get . maxNoOfPmFiles (max number of ROP files that can be saved in the eNode-B)

get . StorageSize (max allowed storage for Events, CTR and UETR)

momdi (to see Ericsson only parameters)

/cm/internalmomread ManagedElement=1,ENodeBFunction=1,TermPointToMme=RFT-MTGHWUSN02
logicalname (to see read-only parameters in G2 RBS types)

geti TermPointToMme=RFT-MTGHWUSN02 logicalname (to see read-only parameters in G2 RBS types)

lratdbi | egrep -i "prachConfiguration|CellIdT" (RACH configuration)

hget cell rachrootseq|earfcndl|cellra (RACH configuration)

hanging_ues (to check hanging UEs)

chmod 777 db.dat (need rights to run db.dat of any CV is in cv.zip folder in DCGM)

moshell -d db.dat (open any CV with moshell)

diff kget1.zip kget2.zip (compare two kgets using modump.zip, use the command h diff for options)

pmxh fdd pmErabRelAbnormalEnbAct$|pmErabRelAbnormalMmeAct$|pmErabRelAbnormalEnb$|

pmErabRelMme$ -m 2

pmxh fdd pmErabRelAbnormalEnbActQci|pmErabRelAbnormalMmeActQci -m 2 | awk '{printf "%-10s %-

65s %-30s %-20s\n", $1,$2,$3,$4}'

pmxh fdd pmErabEstabAttInit$|pmErabEstabSuccInit$|pmErabEstabAttAdded$|

pmErabEstabSuccAdded$ -m 2

pmxh fdd pmErabEstabAttAddedQci$|pmErabEstabAttInitQci$ -m 2 | awk '{printf "%-10s %-65s %-30s

%-20s\n", $1,$2,$3,$4}'

pmxh fdd pmErabEstabAttInitQci$|pmErabEstabSuccInitQci$ -m 2 | awk '{printf "%-10s %-65s %-30s %-

20s\n", $1,$2,$3,$4}'

pmxh fdd pmUeCtxtEstabAtt$|pmUeCtxtEstabSucc$ -m 24 -a

pmxh fdd pmRrcConnReconfAttNoMob$|pmRrcConnReconfSuccNoMob$ -m 24 -a

pmxnh fdd pmS1SigConnEstabAtt$|pmS1SigConnEstabSucc$ -m 24 -a

pmxh fdd pmRrcConnEstabAtt$|pmRrcConnEstabAttReatt$|pmRrcConnEstabSucc$ -m 24 -a

pmxh fdd pmUeCtxtFetchAtt$|pmUeCtxtFetchSucc$ -m 12 -a

pmxh fdd pmRrcConnReestAtt$|pmRrcConnReestSucc$ -m 12 -a

pmxh fdd pmRrcConnReestAttQci$|pmRrcConnReestSuccQci$ -m 2 | awk '{printf "%-10s %-65s %-30s %-

20s\n", $1,$2,$3,$4}'

pmxnh . pmHoPrepAttLteIntraF$|pmHoPrepSuccLteIntraF$|pmHoExeAttLteIntraF$|
pmHoExeSuccLteIntraF$ -m 24 -h

pmxnh . pmHoPrepAttLteInterF$|pmHoPrepSuccLteInterF$|pmHoExeAttLteInterF$|
pmHoExeSuccLteInterF$ -m 24 -h

Useful UNIX commands (время у Тилака 11:03 день 9)

====================
du -m /cygdrive/c/Misc/LTE/CSRs/ | sort -nr | head -25 (find biggest 25 folders)

find . -printf '%s %p\n' | sort -nr | head -25 (go through all files in all folders and list top 25 in order
of size)

grep -rnw '/cygdrive/c/Misc/LTE/CSRs/' -e 'NASNonDeliveryIndication.*x2-handover-triggered'

(go through all subfolders and files and get all lines containing that string)

split MP.log -n 5 (split the file into 5 equal small files)

cat MP.log | sed -n '/15:06:09.832/,/15:06:10.092/ p' > temp.log (cut only a portion of log between
two timestamps)

zcat MP_binary.zip | less (indicates if it is a binary file)

zcat MP_binary.zip | tr -d '\000' | less (remove binary characters and display as a normal file)

cat LTE.log | tr -d '\000' > LTE2.log (new file not considered binary)

cat * */* *flow* | perl /home/eratini/decoder/bin/findDrop.pl > temp.log (script go through all
subfolders and files with name 'flow')

cat LTE.log | sed -e '/Decode S1AP PDU S1Paging/,+3d' > LTE2.log (remove all Paging messages
from raw log)

Summary (время у Тилака 10:26 день 9)

UE reads System Information when in idle mode prior to accesssing the network.

UE must go through a successful RACH procedure to setup a RRC connection, perform RRC Re-
establishment or perform Handover.

UE needs a RRC Connection to communicate with the network. RRC Connection is between UE and
eNode-B.

eNode-B needs to setup a S1 connection to facilitate UE communication with the Core network
(MME/SGw). S1 connection consist of a signalling connection to MME and userplane bearer to SGw.

UE communicate with the MME using NAS signalling which is completely transparent to eNode-B. When
it comes to NAS signalling the role of eNode-B is that of a facilitator, to forward messages between MME
and UE.

UE perform Attach procedure when switching on the phone. UE receives an unique ip-address to PGw at
Attach procedure together with a TMSI and a MME code.
UE perform Tracking Area Update procedure when moving into a new Tracking Area or when returning
to LTE after CSFB. MME update new UE location to HSS to make sure Paging to UE works even
after that.

UE can be only in two states in LTE, either in Idle mode or in connected mode.

Authentication procedure always generate new security keys that would be used for ciphering and
integrity protection.

Integrity protection is only applicable for signalling and it is mandatory. Integrity protection mechannism
make sure exchanged signalling between UE and network is not altered over the air.

Ciphering is optional for both signalling and userdata. Ciphering mechanism make sure exchanged
signalling/data between UE and network cannot be intercepted and listened by middle man.

PDCP layer carry out ciphering and integrity protection functions in LTE.

RLC layer is responsible for segmentation/assembly of signalling/data and retransmissions.

RLC failure occurs when there is no acknowledgement (even after max number of retransmissions) for
sent data from receiver.

Synchronization failure occurs when UE is in 'out of sync state' for a continuous period of 6 seconds. If
during these 6 seconds UE get back network signal for a 100ms period UE is 'in sync' state again.

RRC Re-establishment takes place when Synchronization failure or RLC failure occurs in the UE. RRC Re-
establishment is always initiated by the UE.

UE context fetch for RRC Re-establishment is only supported between Ericsson eNode-Bs.

RRC Re-establishment is not supported under certain circumstances, for instance when UE does not have
an established e-RAB.

Event A2 is used to indicate bad coverage, Event A3 is used to indicate a neighbour from same frequency
is better than serving cell, Event A5 is used to indicate a neighbour from another frequency is better than
serving cell and Event B2 is used to indicate a neighbour from another RAT is better than serving cell.

RSRP is a measure of signal strength whereas RSRQ is a measure of signal quality.

UE indicates MME code received from Attach procedure in rrcConnectionRequest message.

UE indicates MME code in rrcConnectionSetupComplete message when returning to LTE after a Speech
call in WCDMA/GSM.

MME selection is based on information in rrcConnectionRequest message (when UE is already in LTE) or

information in rrcConnectionSetupComplete message (when returning to LTE after CSFB).

In ueCapabilityInformation message UE informs all the details of its capabilities to the network.
Rim is the procedure used to transfer WCDMA/GSM System Information to LTE. WCDMA/GSM System
Information is included in rrcConnectionRelease message at CSFB.

UE fallbak to WCDMA/GSM for circuit switched services such as Speech.

VoLTE calls are setup in LTE with QCI=1 used for userdata and QCI=5 used for IMS signalling. VolTE calls
are always setup with an internet bearer.

Path Switch procedure happens after X2 Handover or after RRC Re-establishment. Target eNode-B
inform MME about UE's new location whereupon MME request SGw to send userdta to the target
eNode-B.