IoT LTE Cat - M1 - 2 Coverage Level -UEsim
The purpose of this tutorial is to show you how to do configure multiple coverage level for Cat-M1 and how to force UEsim to attach with a specified coverage level. The way to configure muliple coverage level (CE level) is done through SIB2 and overall structure of SIB2 IE(information elements) structure related to CE level configuration is as follows. Amarisoft Callbox does not provide any set of individual configuration parameters. It would be too complicated to support this as individual configuration parameters. So for now, you need to edit the SIB2 ASN.1 file manually and call the asn from callbox configuration file. It would be good to have a big picture shown below in your mind to edit the sib2 asn meaningfully.
Source : Sharetechnote
Table of Contents
- IoT LTE Cat - M1 - 2 Coverage Level -UEsim
Introduction
The evolution of cellular IoT technologies, particularly LTE Cat-M1 (also known as eMTC), has introduced sophisticated mechanisms to optimize connectivity and coverage for low-power, wide-area devices. Central to this optimization is the concept of Coverage Enhancement (CE) levels, which categorize user equipment (UE) based on their radio conditions to ensure reliable network access even in challenging environments. The configuration of multiple CE levels is primarily managed through System Information Block Type 2 (SIB2), a critical information element broadcast by the eNodeB that defines essential radio resource parameters, including those governing random access and coverage enhancements. In practical test and simulation environments, such as with the Amarisoft Callbox and UEsim, direct parameterization of CE levels via intuitive GUIs is often not supported due to the complexity of the underlying ASN.1 structures. Instead, practitioners must manually edit the SIB2 ASN.1 files to tailor CE-level parameters and incorporate these configurations into the callbox setup. This approach requires a strong understanding of the SIB2 information element architecture and ASN.1 encoding, as well as how these parameters influence UE behavior during the attach procedure. Mastery of these concepts is crucial for network engineers, testers, and researchers aiming to validate coverage strategies and optimize IoT device performance in diverse deployment scenarios, thereby ensuring robust and adaptive network behavior in the broader LTE ecosystem.
-
Context of the Technology
- LTE Cat-M1 is designed for low-power, wide-area applications, supporting IoT devices that require extended coverage and energy efficiency.
- Coverage Enhancement (CE) levels in LTE enable devices located in poor radio environments to maintain connectivity by adapting access and scheduling parameters.
- SIB2 is a core broadcast message in LTE, responsible for disseminating critical radio resource parameters, including those for CE level configuration.
- ASN.1 (Abstract Syntax Notation One) is a standardized data representation protocol used to encode SIB2, requiring manual editing for advanced configurations in certain test environments.
-
Relevance and Importance of the Tutorial Topic
- Configuring multiple CE levels is essential for simulating real-world IoT scenarios, ensuring that devices under various coverage conditions are properly supported.
- The Amarisoft Callbox, widely used for LTE testing, does not provide granular CE-level configuration via its interface, making manual SIB2 ASN.1 editing an essential skill.
- Understanding the relationship between SIB2 configuration and UE attach behavior is critical for network optimization and troubleshooting.
-
Learner Outcomes
- Gain a comprehensive understanding of SIB2 structure, focusing on coverage enhancement parameters.
- Acquire practical skills in editing ASN.1 files to configure CE levels for LTE Cat-M1.
- Learn how to force UEsim to attach with a specified coverage level by referencing customized SIB2 configurations.
- Develop the ability to map abstract coverage concepts to real-world network simulation and testing scenarios.
-
Prerequisite Knowledge and Skills
- Basic understanding of LTE network architecture and signaling procedures, specifically SIB messages and attach process.
- Familiarity with ASN.1 syntax and encoding principles.
- Experience with Amarisoft Callbox configuration files and general test environment setup.
- Ability to use text editors and interpret protocol specifications for SIB2 and RACH parameters.
Summary of the Tutorial
This tutorial details the procedures for setting up and testing UE simulation (UEsim) with a call box for Cat-M1 LTE, including initial configuration, service checks, attach procedures, and log analysis. The methodology emphasizes ensuring proper configuration matching between the UE simulator and the call box, executing test commands, and analyzing signaling messages during the attach process.
-
Test Setup and Configuration:
- Ensure matching configurations between UEsim and the call box using ue-catm1.cfg and enb-catm1.cfg files.
- Verify SIM information and network-side configuration settings are consistent across UEsim and call box (refer to respective configuration files such as ims-ims.cfg, enb-catm1-2cl.cfg, and ue-catm1-2cl.cfg).
-
LTE Service Status Check:
- Verify that the LTE service is running on the call box by executing service lte status.
- If issues arise, restart the service using service lte restart.
-
Screen Mode Operation:
- Enter screen mode using screen -r for separate UEsim and call box sessions.
- Familiarize with the command-line interface for both UEsim and call box to facilitate test operations.
-
UE Attach Procedure:
- Start tracing on the call box and power on the UE in UEsim.
- Monitor messages indicating cell detection and SIB decoding on UEsim.
- Upon successful SIB decoding and initial attach, observe corresponding traces on the call box.
- Check registration status and connection information using cells and ue commands on the call box (in both enb and mme screens).
- During attach, UEsim sends PRACH with a specific coverage level index, which can be controlled via configuration file settings.
-
Log Analysis and Message Inspection:
- Examine log messages for:
- RRC/NAS signaling exchanges, including SIB1 and SIB2 broadcasts from eNB for Cat-M1 configuration.
- Attach Request from UE, detailing EPS Mobility Management parameters and capabilities.
- RrcConnectionSetup and UE Capability Information for Cat-M1.
- Attach Accept message from the network, including EPS bearer establishment and feature support.
- Verify that all configuration parameters and feature indicators match the intended test scenario.
- For log analysis, confirm that PRACH indices and message contents correspond to the configured coverage level.
- Examine log messages for:
-
Coverage Level Testing:
- To attach with a specific coverage level, set the desired level in the UEsim configuration file, as UEsim does not dynamically select based on RSRP.
- Validate from logs that PRACH and attach messages use the correct coverage level as specified.
In summary, the tutorial guides users through a systematic approach to configure, execute, and analyze UE attach tests in a Cat-M1 LTE simulation environment, with particular attention to signaling message verification and coverage level control via configuration.
Test Setup
Test setup for this tutorial is as shown below.
I used antennas on the first SDR card of both UEsim and Callbox for the radio connection. I used WiFi to control UEsim. You can also use its Ethernet port, identified here with address 192.168.1.80.
Configuration
An important thing in using UE sim is to do proper matching between UE sim configuration and Call box configuration In this tutorial, I used the ue-catm1.cfg and and enb-catm1.cfg without any change
If you use other Network (e.g, other network simulator or real network), you have to make it sure to configure UE sim according to the settings on network side
You would see following in /root/mme/config/ims-ims.cfg file on Callbox
The include statement loads ue_db-ims.cfg as the user database. Check the subscriber information in this file against the SIM settings used by UEsim.
In this tutorial, following SIM information will be used. this is the configuration in ue-catm1.cfg on UEsim.
The imsi is "001010123456789", and K is "00112233445566778899aabbccddeeff". I use these values to match the simulated subscriber with the Callbox user database.
The capability block sets as_release: 13 and ue_category: 13. The later forced-CE example uses ue_category: -1. The UEsim reference defines -1 as the backward-compatible value for Category M1.
The external_sim and tun_setup_script lines are commented out. The channel block is conditional on CHANNEL_SIM == 1 and is outside the coverage-level change used here.
Following is the configuration on Callbox (enb-catm1-2cl.cfg)
I set N_COVERAGE_LEVEL to 2 to select the two-coverage-level configuration. The value 1 selects the single-level branch instead.
TDD is 0 for FDD, and N_RB_DL is 25 for a 5 MHz cell. N_ANTENNA_DL and N_ANTENNA_UL are both 1. CHANNEL_SIM is 0, so the channel simulator is disabled.
The cell broadcasts PLMN "00101". With TDD set to 0, the active dl_earfcn is 3350, corresponding to 2680 MHz in band 7.
The other FDD frequency choices are commented out, and the TDD branch is not used. If you change dl_earfcn, match the UEsim frequency to the new Callbox setting.
With N_COVERAGE_LEVEL set to 2, br_sib_sched_list loads "sib23_br_ce.asn" for SIB2 and SIB3. The si_periodicity is 16 radio frames. The single-level branch uses "sib23_br.asn" and is not used here.
The coverage level 1 block sets br_mpdcch_css_ra_al: 8 and br_mpdcch_css_n_rep: 4 for the RAR common search space. It also sets br_rar_coderate: 0.20 and br_pusch_msg3_mcs: 5.
For UE-specific MPDCCH, br_mpdcch_n_rb is 4, br_mpdcch_tm_type is "distributed", and br_mpdcch_al is 8. The br_mpdcch_n_rep value is 2, with br_mpdcch_n_rep_max set to 8. Data repetition settings are br_pdsch_n_rep: 4, br_pusch_n_rep: 2, and br_msg3_pusch_n_rep: 2. Match the number of br_coverage_levels entries to the number of PRACH configurations in SIB2.
Following is the configuration on UEsim (ue-catm1-2cl.cfg)
I set TDD to 0 and CELL_BANDWIDTH to 5 to match the Callbox FDD cell. N_ANTENNA_DL and N_ANTENNA_UL are both 1. UE_COUNT is 1 for this test.
The cell_groups entry uses group_type: "cat_m1" and multi_ue: true. The cell takes its bandwidth from CELL_BANDWIDTH and its antenna counts from N_ANTENNA_DL and N_ANTENNA_UL.
The active FDD branch sets dl_earfcn: 3350, matching the Callbox band 7 cell. The TDD branch with dl_earfcn: 40620 is not used.
Check if LTE service is Running
Whatever you want to test, the first thing you need to do is that call box program (LTE Service) is running. You can check on the execution status of the call box program by running following command and you should get the result as shown below
# service lte status
On UEsim, the Active field reports active (running). The Loaded field identifies an enabled lte.service unit, and the process list includes /root/ots/ltestart.sh.
I also check the service on Callbox. Its Active field reports active (running), with a separate process list for /root/ots/ltestart.sh.
NOTE : Getting this result is pre-requisite for Call Box Operation, but this result itself does not guarantee the normal operation. If you see some unexpected issues. You may restart the call box with following command
# service lte restart
Getting into Screen Mode
If it is confirmed that the lte service is running, go to screen mode by running 'screen -r' and follow through the steps as shown below. The steps shown here is the procedure that you would use for almost every test and it is highly recommended to get familiar with these steps. For further commands you can use in this screen mode, refer to the tutorial : Command Line Command
Run following command on UE sim
I enter screen -r at the Linux shell prompt on UEsim. The UE commands in the following steps are entered at the (ue) prompt.
You will get the screen as shown below
RF0 reports sample_rate=5.760 MHz, dl_freq=2680.000 MHz, and ul_freq=2560.000 MHz for band 7. The antenna counts are dl_ant=1 and ul_ant=1. The selected console is window 2, labeled UE.
Run following command on Callbox
I enter screen -r separately on Callbox. This session provides the ENB and MME consoles used to monitor the attach.
You will get the screen as shown below
Press Ctrl+A first, release the keys, and then press the window number. Use 0 for MME, 1 for ENB, 3 for IMS, or 4 for MBMSGW. The selected ENB window is marked in yellow.
Callbox reports dl_freq=2680.000 MHz and ul_freq=2560.000 MHz on band 7. Its sample_rate=5.760 MHz and antenna counts dl_ant=1 and ul_ant=1 match the UEsim RF settings.
Attach UE
Now perform UE attach procedure. This would be a little bit busy process since you need to switch back and forth between Callbox screen and UEsim screen.
Start tracing on Callbox
I enter t at the (enb) prompt before starting the UE. The console prints Press [return] to stop the trace. Press Return when you want to stop it.
power_on UE on UE sim.
I enter power_on at the (ue) prompt on UEsim. Keep the Callbox trace running while the UE starts its access procedure.
You will see following message once UE detect the cell and decoded SIBs.
The UE console reports Cell 0: SIB found after power_on. I then check the Callbox trace and MME registration result for the subsequent access steps.
Once UE completed SIB decoding and perform initial attach, you will see following trace on Callbox screen.
The PRACH line reports cell=01, seq=10, ta=4, and snr=28.4 dB. The following statistics identify UE_ID 1 on cell 001 with RNTI 0961.
The first row has DL bitrate 2.37k and UL bitrate 3.89k. The listed DL retx and UL rxko values are all 0.
When the initial attach completed, you can check on the cell information to which the UE sim is registered to with 'cells' command.
The cells command identifies Cell #0 as LTE-M with PCI 1 and FDD operation. The EARFCNs are DL=3350 and UL=21350. The cell bandwidth is listed as DL=25 and UL=25 RBs.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (enb) screen.
The (enb) ue result lists RAN_UE_ID 5, CN_UE_ID 104, Cell 0x001, and RNTI 0x0965. This RNTI differs from 0961 in the earlier trace, so use the identifiers from your own run when matching records.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (mme) screen.
The subscriber SUPI is 001010123456789, matching the configured IMSI. The CN field is EPC and REG is Y. One bearer is listed, with IP_ADDR 192.168.2.2.
Log Analysis
I use the decoded SIB2 and PRACH events to check which coverage level the UE used. Compare the preamble range with the RAR scheduling parameters.
I check rach-CE-LevelInfoList-r13 in the decoded SIB2. The first preambleMappingInfo-r13 entry has firstPreamble-r13 0 and lastPreamble-r13 25 for CE0. The second entry uses 26 through 51 for CE1.
Both entries use ra-ResponseWindowSize-r13 sf50, mac-ContentionResolutionTimer-r13 sf80, and rach-HoppingConfig-r13 off. The message sequence includes authentication, security setup, Attach accept, and Attach complete.
The prach-ParametersListCE-r13 contains two entries. Both use prach-ConfigIndex-r13 4, prach-FreqOffset-r13 4, and prach-StartingSubframe-r13 sf2. Both also use maxNumPreambleAttemptCE-r13 n3 and numRepetitionPerPreambleAttempt-r13 n1.
Each entry has mpdcch-NarrowbandsToMonitor-r13 set to 1, mpdcch-NumRepetition-RA-r13 r1, and prach-HoppingConfig-r13 off. The pucch-NumRepetitionCE-Msg4-Level0-r13 and pucch-NumRepetitionCE-Msg4-Level1-r13 values are both n1.
As you see, UE send PRACH with index belonging to Coverage Level 0
The PRACH event has sequence_index=16, which falls within the CE0 range 0 through 25. The following RAR contains rapid=16.
The common-search-space scheduling entry reports L=24 and n_rep=1. The br_mpdcch_css_ra_al value for this case is 24. These values provide a comparison with the CE1 run below.
Attaching with a specified Coverage Level
UEsim does not support the selection of coverage level based on RSRP in Cat-M for now. The only way you can make UEsim attach with a certain coverage level is to specify it in the configuration file as follows.
I set forced_ce_level: 1 inside the ue_list entry to force CE1. Set forced_ce_level: 0 if you want to force CE0 for comparison.
This configuration uses as_release: 13 and ue_category: -1. The IMSI and K match the earlier subscriber example. The external_sim and tun_setup_script options remain commented out.
You can confirm from the log that UE is sending PRACH with the index belonging to Coverage Level 1
The PRACH event reports sequence_index=29, within the CE1 range 26 through 51. The RAR contains rapid=29.
The scheduling entry reports L=8 and n_rep=4. These match br_mpdcch_css_ra_al: 8 and br_mpdcch_css_n_rep: 4 in the coverage level 1 configuration. RRC connection setup and RRC connection setup complete follow the random access exchange.
RRC / NAS Signaling
The following message extracts provide the Cat-M1 broadcast, capability, and attach details for reference. I use them to check the configured cell and the resulting bearer settings.
SIB1
: This is the SIB1 sent by eNB to configiture Cat M1 (
{
message c1: systemInformationBlockType1: {
cellAccessRelatedInfo {
plmn-IdentityList {
{
...
},
...
}
},
...
},
cellSelectionInfo {
...
},
p-Max 10,
freqBandIndicator 7,
schedulingInfoList {
...
},
si-WindowLength ms40,
systemInfoValueTag 0,
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
cellAccessRelatedInfo-v1250 {
},
nonCriticalExtension {
hyperSFN-r13 '0000001111'B,
eDRX-Allowed-r13 true,
bandwidthReducedAccessRelatedInfo-r13 {
si-WindowLength-BR-r13 ms40,
si-RepetitionPattern-r13 every4thRF,
schedulingInfoList-BR-r13 {
{
si-Narrowband-r13 1,
si-TBS-r13 b504
}
},
startSymbolBR-r13 3,
si-HoppingConfigCommon-r13 off
}
SIB2
: This is the SIB2 sent by eNB to configiture Cat M1 (
{
message c1: systemInformation: {
criticalExtensions systemInformation-r8: {
sib-TypeAndInfo {
sib2: {
radioResourceConfigCommon {
rach-ConfigCommon {
preambleInfo {
...
},
powerRampingParameters {
...
},
ra-SupervisionInfo {
...
},
maxHARQ-Msg3Tx 5,
preambleTransMax-CE-r13 n10,
rach-CE-LevelInfoList-r13 {
{
preambleMappingInfo-r13 {
firstPreamble-r13 0,
lastPreamble-r13 25
},
ra-ResponseWindowSize-r13 sf50,
mac-ContentionResolutionTimer-r13 sf80,
rar-HoppingConfig-r13 off
},
{
preambleMappingInfo-r13 {
firstPreamble-r13 26,
lastPreamble-r13 51
},
ra-ResponseWindowSize-r13 sf50,
mac-ContentionResolutionTimer-r13 sf80,
rar-HoppingConfig-r13 off
}
}
},
bcch-Config {
...
},
pcch-Config {
...
},
prach-Config {
...
},
pdsch-ConfigCommon {
...
},
pusch-ConfigCommon {
...
},
pucch-ConfigCommon {
...
},
soundingRS-UL-ConfigCommon setup: {
...
},
uplinkPowerControlCommon {
...
},
ul-CyclicPrefixLength len1,
pusch-ConfigCommon-v1270 {
enable64QAM-v1270 true
},
bcch-Config-v1310 {
modificationPeriodCoeff-v1310 n64
},
pcch-Config-v1310 {
paging-narrowBands-r13 1,
mpdcch-NumRepetition-Paging-r13 r1
},
freqHoppingParameters-r13 {
interval-ULHoppingConfigCommonModeA-r13 interval-FDD-r13: int1
},
pdsch-ConfigCommon-v1310 {
pdsch-maxNumRepetitionCEmodeA-r13 r16
},
pusch-ConfigCommon-v1310 {
pusch-maxNumRepetitionCEmodeA-r13 r8
},
prach-ConfigCommon-v1310 {
rsrp-ThresholdsPrachInfoList-r13 {
0
},
mpdcch-startSF-CSS-RA-r13 fdd-r13: v1,
prach-ParametersListCE-r13 {
{
prach-ConfigIndex-r13 4,
prach-FreqOffset-r13 4,
prach-StartingSubframe-r13 sf2,
maxNumPreambleAttemptCE-r13 n3,
numRepetitionPerPreambleAttempt-r13 n1,
mpdcch-NarrowbandsToMonitor-r13 {
1
},
mpdcch-NumRepetition-RA-r13 r1,
prach-HoppingConfig-r13 off
},
{
prach-ConfigIndex-r13 4,
prach-FreqOffset-r13 4,
prach-StartingSubframe-r13 sf2,
maxNumPreambleAttemptCE-r13 n3,
numRepetitionPerPreambleAttempt-r13 n1,
mpdcch-NarrowbandsToMonitor-r13 {
1
},
mpdcch-NumRepetition-RA-r13 r8,
prach-HoppingConfig-r13 off
}
}
},
pucch-ConfigCommon-v1310 {
n1PUCCH-AN-InfoList-r13 {
38,
38
},
pucch-NumRepetitionCE-Msg4-Level0-r13 n1,
pucch-NumRepetitionCE-Msg4-Level1-r13 n1
}
},
ue-TimersAndConstants {
t300 ms200,
t301 ms200,
t310 ms200,
n310 n6,
t311 ms10000,
n311 n5,
t300-v1310 ms5000,
t301-v1310 ms5000
},
freqInfo {
additionalSpectrumEmission 1
},
timeAlignmentTimerCommon infinity
},
Attach Request
: This is the AttachRequest sent by UE to inform UE capability for IoT NAS feature (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x41 (Attach request)
EPS attach type = 1 (EPS attach)
NAS key set identifier:
TSC = 0
NAS key set identifier = 7
Old GUTI or IMSI:
IMSI = 001010123456789
UE network capability:
0xe0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=0, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0xe0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=0, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
0x00 (UCS2=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
0x00 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=0)
0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 0
Procedure transaction identity = 1
Message type = 0xd0 (PDN connectivity request)
Request type = 1 (initial request)
PDN type = 3 (IPv4v6)
Protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00
Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)
Data =
Protocol ID = 0x0003 (DNS Server IPv6 Address Request)
Data =
Protocol ID = 0x000a (IP address allocation via NAS signalling)
Data =
Protocol ID = 0x000c (P-CSCF IPv4 Address Request)
Data =
Protocol ID = 0x000d (DNS Server IPv4 Address Request)
Data =
Voice domain preference and UE's usage setting = 0x05 (IMS PS Voice only, Data centric)
MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)
RrcConnectionSetup
: This is the RrcConnectionSetup sent by eNB to configiture Cat M1 (
{
message c1: rrcConnectionSetup: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetup-r8: {
radioResourceConfigDedicated {
srb-ToAddModList {
...
},
mac-MainConfig explicitValue: {
...
},
physicalConfigDedicated {
...
},
soundingRS-UL-ConfigDedicated release: NULL,
schedulingRequestConfig setup: {
...
},
epdcch-Config-r11 {
config-r11 setup: {
setConfigToAddModList-r11 {
{
setConfigId-r11 0,
transmissionType-r11 distributed,
resourceBlockAssignment-r11 {
numberPRB-Pairs-r11 n2,
resourceBlockAssignment-r11 'E'H
},
dmrs-ScramblingSequenceInt-r11 1,
pucch-ResourceStartOffset-r11 0,
mpdcch-config-r13 setup: {
csi-NumRepetitionCE-r13 sf1,
mpdcch-pdsch-HoppingConfig-r13 off,
mpdcch-StartSF-UESS-r13 fdd-r13: v1,
mpdcch-NumRepetition-r13 r1,
mpdcch-Narrowband-r13 1
}
}
}
}
},
ce-Mode-r13 setup: ce-ModeA
}
UE Capability Information
: This is the UE Capability Information sent by UE to inform RRC capability for Cat M1 (
{
message c1: ueCapabilityInformation: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: ueCapabilityInformation-r8: {
ue-CapabilityRAT-ContainerList {
{
rat-Type eutra,
ueCapabilityRAT-Container {
accessStratumRelease rel13,
ue-Category 1,
pdcp-Parameters {
...
}
},
phyLayerParameters {
...
},
rf-Parameters {
...
},
measParameters {
bandListEUTRA {
...
}
},
featureGroupIndicators '4E001002'H /*
2: PUCCH 2a/2b, abs TPC, RB alloc type 1 for PDSCH, Periodic CQI/PMI/RI reporting on PUCCH: Modes 2-0 and 2-1
5: Long DRX cycle, DRX Mac CE
6: Prioritized bit rate
7: RLC UM
20: SRB1 and SRB2 for DCCH + 8x DRB
31: MFBI
*/,
interRAT-Parameters {
},
nonCriticalExtension {
phyLayerParameters-v920 {
},
interRAT-ParametersGERAN-v920 {
},
csg-ProximityIndicationParameters-r9 {
},
neighCellSI-AcquisitionParameters-r9 {
},
son-Parameters-r9 {
},
nonCriticalExtension {
lateNonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
ce-Parameters-v1370 {
tm9-CE-ModeA-r13 supported
},
nonCriticalExtension {
ce-Parameters-v1380 {
tm6-CE-ModeA-r13 supported
},
fdd-Add-UE-EUTRA-Capabilities-v1380 {
ce-Parameters-v1380 {
}
},
tdd-Add-UE-EUTRA-Capabilities-v1380 {
ce-Parameters-v1380 {
}
...
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
pdcp-Parameters-v1130 {
},
phyLayerParameters-v1130 {
tdd-SpecialSubframe-r11 supported
},
rf-Parameters-v1130 {
},
measParameters-v1130 {
},
interRAT-ParametersCDMA2000-v1130 {
},
otherParameters-r11 {
},
nonCriticalExtension {
nonCriticalExtension {
rf-Parameters-v1180 {
freqBandRetrieval-r11 supported
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
ue-CategoryDL-v1310 m1,
ue-CategoryUL-v1310 m1,
pdcp-Parameters-v1310 {
},
rlc-Parameters-v1310 {
},
mac-Parameters-v1310 {
extendedLongDRX-r13 supported
},
ce-Parameters-r13 {
ce-ModeA-r13 supported
},
interRAT-ParametersWLAN-r13 {
},
wlan-IW-Parameters-v1310 {
},
lwip-Parameters-r13 {
}
....
},
nonCriticalExtension {
nonCriticalExtension {
ue-RadioPagingInfo-r12 {
ue-CategoryDL-v1310 m1,
ce-ModeA-r13 true
}
Attach Accept
: This is the AttachAccept sent by UE to inform NW capability for IoT NAS feature and Activate Default EPS Bearer(
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x63483d18
Sequence number = 0x01
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 1 (EPS only)
T3412 value:
Value = 30
Unit = 1 (1 minute)
TAI list:
Length = 6
Data = 00 00 f1 10 00 01
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 5
Procedure transaction identity = 1
Message type = 0xc1 (Activate default EPS bearer context request)
EPS QoS:
QCI = 9
Access point name = "default.mnc001.mcc001.gprs"
PDN address:
PDN type = 1 (IPv4)
IPv4 = 192.168.2.2
ESM cause = 0x32 (PDN type IPv4 only allowed)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 03 00 00 0a 81 06 08 08 08 08
Protocol ID = 0x000d (DNS Server IPv4 Address)
Data = 8.8.8.8
GUTI:
MCC = 001
MNC = 01
MME Group ID = 32769
MME Code = 1
M-TMSI = 0x275be002
Emergency number list:
Length = 8
Data = 03 1f 19 f1 03 1f 11 f2
EPS network feature support:
0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)
0x08 (15 bearers=0, IWK N26=0, RestrictDCNR=0, RestrictEC=0, ePCO=1, HC-CP CIoT=0, S1-U data=0, UP CIoT=0)