NB IoT -UEsim
The purpose of this tutorial is to show you how to do basic connectivity test between a UEsim and Amari Callbox with LTE NB in Inband Mode. NB IoT is designed to use the bandwidth 200khz which issingle LTE RB(180khz) plusa little bit of guardband. It can be deployed in a few different operationmode called Inband, Guardband, Standalone mode as illustrated below.
Source : Sharetechnote
On top of the operation mode, there are a few additional featuresdepending on operation mode.
- Inband Mode
- with Same PCI
- Non-Anchor Carrier Disabled
- Non-Anchor Carrier Enabled
- with Different PCI
- Guarband Mode
- Standalone Mode
This tutorial is based on the configuration for Inband ,same PCI ,Non-Anchor Carrier Disabled.
Table of Contents
Introduction
Narrowband Internet of Things (NB-IoT) is a 3GPP standardized cellular technology designed to provide low-power, wide-area connectivity for a vast number of IoT devices. Operating within the LTE spectrum, NB-IoT occupies a narrow bandwidth of 200 kHz—equivalent to a single LTE Resource Block (RB) plus a minimal guard band—making it highly efficient for connecting devices that require small, infrequent data transmissions. NB-IoT supports three deployment modes: Inband, where NB-IoT utilizes resource blocks within a normal LTE carrier; Guardband, placing NB-IoT in the unused spectrum between LTE carriers; and Standalone, leveraging re-farmed GSM spectrum. This tutorial focuses on the Inband mode, specifically with the same Physical Cell Identity (PCI) and with the Non-Anchor Carrier feature disabled, using a UEsim (user equipment simulator) and an Amari Callbox, a sophisticated LTE test platform. Understanding and validating basic connectivity in this scenario is critical for engineers verifying NB-IoT device integration, network configuration, and performance. The tutorial walks through the architecture, signaling flows, and configuration steps necessary for establishing a successful NB-IoT connection in the specified mode, providing foundational knowledge essential for further NB-IoT development, deployment, and troubleshooting.
-
Technology Context and Background
- NB-IoT is a cellular IoT technology standardized by 3GPP, optimized for low power, wide coverage, and massive device density.
- It operates within LTE infrastructure, supporting three deployment modes: Inband, Guardband, and Standalone.
- Inband mode allows NB-IoT channels to be embedded within an existing LTE carrier, sharing spectral resources with standard LTE traffic.
- The Amari Callbox provides a controlled LTE eNodeB environment for testing device connectivity, while the UEsim emulates NB-IoT device behavior.
-
Relevance and Importance
- Verifying basic NB-IoT connectivity is a crucial step in device and network validation, ensuring that devices can attach, communicate, and operate as expected.
- This connectivity test is especially significant for deployments where spectral efficiency and coexistence with LTE are paramount, such as in Inband mode with the same PCI and Non-Anchor Carrier disabled.
- The procedures outlined in this tutorial are foundational for further NB-IoT feature testing and real-world deployment readiness.
-
Learner Outcomes
- Understand NB-IoT deployment modes, with a focus on Inband operation.
- Gain practical experience configuring and testing connectivity between a UEsim and Amari Callbox under precise operational parameters.
- Develop the ability to interpret relevant signaling, troubleshoot connection issues, and validate NB-IoT network settings.
- Acquire skills applicable to broader NB-IoT testing, integration, and deployment projects.
-
Prerequisite Knowledge and Skills
- Familiarity with LTE architecture and basic concepts such as Resource Blocks, Physical Cell Identity (PCI), and carrier configuration.
- Understanding of NB-IoT features and deployment scenarios.
- Basic hands-on experience with network test equipment, such as the Amari Callbox and UEsim, including configuration and operation.
- Ability to interpret protocol logs and diagnose connectivity issues in a laboratory environment.
Summary of the Tutorial
This tutorial provides a comprehensive procedure for setting up and testing NB-IoT UE simulation against a call box or network simulator, focusing on configuration, execution, attach procedure, and log analysis for troubleshooting and verification.
-
Test Environment Configuration:
- Ensure matching configurations between the UE simulator (UEsim) and the call box (e.g., Amarisoft eNB). Use ue-nbiot.cfg for UEsim and enb-nbiot.cfg for the call box, creating symbolic links as required.
- Configure the core network using mme-ims.cfg and ensure the correct SIM information is set in ue_db-ims.cfg.
- Critical parameters to match include CELL_BANDWIDTH, NB_NON_ANCHOR, N_ANTENNA_DL, and N_ANTENNA_UL in both UEsim and ENB configurations; NB_MODE is set automatically by UEsim based on signaling messages.
-
Service Verification and Preparation:
- Verify that the LTE service on the call box is running using service lte status. If issues arise, restart the service with service lte restart.
- Enter screen mode on both UEsim and call box using screen -r to access interactive control.
- Check cell configurations using cell phy and cell commands to confirm cells are set as intended.
-
Attach Procedure:
- Start tracing on the call box to monitor signaling and attach progress.
- Power on the UE in UEsim (power_on UE), observe cell detection, SIB decoding, and initial attach messages.
- Upon successful SIB decoding and attach, verify cell registration using cells command and retrieve UE information with ue commands on the call box (both eNB and MME screens).
-
Log Analysis and Verification:
- Examine logs on UEsim (/tmp/ue0.log) and call box (/tmp/enb0.log) using a text editor (e.g., nano) or Amarisoft WebGUI, with a recommendation to use full-stack debug logging for complete visibility.
- Identify and analyze key NB-IoT and LTE signaling messages, including:
- SIB1/SIB2: Confirm correct NB-IoT cell configuration, paging, random access, uplink/downlink channels, and power settings.
- Attach Request/Accept: Trace the NAS/EPS attach sequence, including UE capability, IMSI, bearer requests, and PDN connection details.
- RRC Connection Procedures: Follow RRC Connection Request, Setup, Setup Complete, Security Mode Command/Complete, and UE Capability Enquiry/Information messages to verify dedicated resource assignment and security establishment.
- Authentication/Security: Validate EMM Authentication Request/Response, Security Mode Command/Complete, including algorithm selection (EEA0/EIA2), integrity, and IMEISV reporting.
- Bearer Context: Inspect ESM Activate Default EPS Bearer Context Request/Accept messages for successful allocation of EPS bearers and PDN address assignment.
- For troubleshooting, identify failure points in the registration or attach process by comparing expected and actual log entries.
- For deeper analysis, especially of lower layers, the use of Amarisoft WebGUI is recommended.
-
Best Practices and Notes:
- Always ensure configuration files are synchronized between UE and eNB/call box to prevent mismatches.
- Use the provided commands and log references as templates, adjusting values as needed for specific test requirements.
- Leverage WebGUI for enhanced log navigation and troubleshooting as familiarity with Amarisoft tools increases.
- Full-stack logging is strongly recommended for comprehensive analysis and troubleshooting.
Conclusion: The tutorial outlines a step-by-step methodology for NB-IoT attach and registration testing, emphasizing precise configuration, systematic execution, and structured log analysis to ensure test success and facilitate troubleshooting of failures in UE-to-network interactions.
Test Setup
Test setup for this tutorial is as shown below.
Configuration
An important thing in using UE sim is to do proper matching between UE sim configuration and Call box configuration In this tutorial, I used the ue-catm1.cfgand and enb-catm1.cfgwithout any change
If you use other Network (e.g, other network simulator or real network), you have to make it sure to configure UE sim according to the settings on network side
For UEsim, the ue-nbiot.cfg is used (
For Callbox, the enb-nbiot.cfg is used (
For the core network, mme-ims.cfg is used for configuration.
You would see following in /root/mme/config/ims-ims.cfg file on Callbox
Following is the contents of "ue_db-ims.cfg" on Callbox.
In this tutorial, following SIM information will be used. this is the configuration in ue-nbiot.cfg on UEsim.
Following is the configuration on Callbox (enb-nbiot.cfg). Pay attention to LTE_DL_EARFCN, , NB_NON_ANCHOR , n_antenna_dl and n_antenna_ul because you need to match these parameters on UEsim. NB_MODE is important in ENB side but these configuration will be automatically configured in UEsim based on RRC messages. (
Following is the configuration on UEsim (ue-nbiot.cfg). It is important to note that you need to match the configurations (CELL_BANDWIDTH, NB_NON_ANCHOR, N_ANTENNA_DL, N_ANTENNA_UL) with the configurations of ENB. (
e
Check if LTE service is Running
Whatever you want to test, the first thing you need to do is that call box program (LTE Service) is running. You can check on the execution status of the call box program by running following command and you should get the result as shown below
# service lte status
NOTE : Getting this result is pre-requisite for Call Box Operation, but this result itself does not guarantee the normal operation. If you see some unexpected issues. You may restart the call box with following command
# service lte restart
Getting into Screen Mode
If it is confirmed that the lte service is running, go to screen mode by running 'screen -r' and follow through the steps as shown below. The steps shown here is the procedure that you would use for almost every test and it is highly recommended to get familiar with these steps. For further commands you can use in this screen mode, refer to the tutorial : Command Line Command
Run following command on UE sim
You will get the screen as shown below
Run following command on Callbox
You will get the screen as shown below
Attach UE
Now perform UE attach procedure. This would be a little bit busy process since you need to switch back and forth between Callbox screen and UEsim screen.
Before you start test, it is always recommed to check out basic cell configurations with 'cell phy' and 'cell' command and see if all the cells are configured as intended. (
Start tracing on Callbox
power_on UE on UE sim.
You will see following message once UE detect the cell and decoded SIBs.
Once UE completed SIB decoding and perform initial attach, you will see following trace on Callbox screen.
When the initial attach completed, you can check on the cell information to which the UE sim is registered to with 'cells' command.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (enb) screen.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (mme) screen.
Log Analysis
In this section, you will see how to confirm if UE registration is complete from trace log. You can use the same method to find any issues (e.g, registration failure) for troubleshooting. When UE registration fails, you may use this tutorial to figure out the point of the failure and troubleshoot
Open /tmp/ue0.log on UEsim using any text editor. I am using nano in this tutorial. (NOTE : In the same way, you can check eNB log by opening /tmp/enb0.log on Callbox).
This is sib2-r13, which configures essential NB-IoT parameters for random access, paging, and uplink/downlink channels.
The paging configuration (pcch-Config-r13) sets the default paging cycle to rf128 and defines one repetition (npdcch-NumRepetitionPaging-r13 r1), indicating how often and how many times paging messages are sent. Random access settings (rach-ConfigCommon-r13) allow up to 10 preamble transmissions with an initial target power of -104 dBm, and the contention resolution timer is set to 32 subframes.
For NPRACH (nprach-Config-r13), preambles are scheduled every 80 ms(nprach-Periodicity-r13) with 12 subcarriers and allow up to 10 attempts per CE level(maxNumPreambleAttemptCE-r13).
The uplink shared channel (npusch-ConfigCommon-r13) uses 1 repetition for HARQ feedback and disables group hopping (groupHoppingEnabled-r13 FALSE). For downlink, the NPDSCH transmit power is set to 0 dB (nrs-Power-r13 0).
This is an LTE Attach Request message where the UE initiates an EPS attach with IMSI 001010123456789 and requests a PDN connection. It supports extended protocol configuration (ePCO=1) and multiple DRBs (multipleDRB=1). The embedded PDN Connectivity Request asks for an IPv6 connection (PDN type = 3) with an initial request type.
Pay attention to UE network capability and see if the UE support all the capabilities that is required for the intended test.
This is an NB-IoT RRC Connection Request message with establishmentCause-r13 set to mo-Signalling, indicating the UE is initiating signaling. The UE identity is provided as a random value (5B095D9A1B'H). It supports multi-tone operation (multiToneSupport-r13 = true) and early contention resolution (earlyContentionResolution-r14 = TRUE), with no CQI measurements reported (cqi-NPDCCH-r14 = noMeasurements).
This is an NB-IoT RRC Connection Setup message with transaction ID 0. It configures the dedicated radio resources (radioResourceConfigDedicated-r13), including control signaling over the NPDCCH. The configuration sets npdcch-NumRepetitions-r13 to r8 (8 repetitions), with npdcch-StartSF-USS-r13 as v4 and npdcch-Offset-USS-r13 as zero, defining the starting subframe and offset for NPDCCH in the uplink shared search space (USS).
This is an NB-IoT RRC Connection Setup Complete message indicating the UE has successfully completed the RRC setup procedure. It includes the selected PLMN ID (selectedPLMN-Identity-r13 = 1) and carries the NAS message (dedicatedInfoNAS-r13). The flag up-CIoT-EPS-Optimisation-r13 = true confirms that the UE is using control plane CIoT EPS optimization for efficient small data transmission over NAS.
This is an EMM Authentication Request message (message type = 0x52) from Network to the UE during the LTE attach procedure. It includes a random challenge value (RAND) and an authentication token (AUTN) used for mutual authentication. The message is a plain NAS message (not ciphered or integrity protected) with NAS key set identifier set to 0, indicating initial security context establishment.
This is an EMM Authentication Response message (message type = 0x53) from the UE to the network. It contains the authentication response parameter, an 8-byte value used to verify the UE's identity based on the earlier challenge (RAND). The message is a plain NAS message, indicating it is still part of the initial security setup.
This is a Security Mode Command message (message type = 0x5d) from the network to UE to establish NAS security. It is protected with a new EPS security context (Security header = 0x3) and selects EEA0 for encryption and EIA2 for integrity (Selected NAS security algorithms = 0x02). The UE is asked to confirm previously reported security capabilities, and the network also requests the IMEISV (IMEISV request = 1) for identity verification.
This is a Security Mode Complete message (message type = 0x5e) sent by the UE, confirming acceptance of the NAS security algorithms and EPS security context. The message is both integrity protected and ciphered (Security header = 0x4). The UE also includes its IMEISV (0123456700000101) as requested earlier by the network.
This is an NB-IoT RRC Security Mode Command message (securityModeCommand-r13) sent from the network to the UE. It specifies the selected security algorithms: eea0 for ciphering (no encryption) and eia2 for integrity protection
This is an NB-IoT RRC Security Mode Complete message (securityModeComplete-r13) sent by the UE in response to the Security Mode Command. It confirms acceptance of the configured security algorithms (eea0 for ciphering and eia2 for integrity).
This is an NB-IoT RRC UE Capability Enquiry message (ueCapabilityEnquiry-r13) sent by the network to request the UE’s supported features and capabilities
This is an NB-IoT RRC UE Capability Information message (ueCapabilityInformation-r13) sent by the UE in response to the UE Capability Enquiry. It indicates that the UE supports multi-tone operation (multiTone-r13 = supported), operates on band 20 with 20 dBm power class (powerClassNB-20dBm-r13 = supported), and belongs to Category NB1 (ue-Category-NB-r13 = nb1).
This is an NB-IoT RRC Connection Reconfiguration message (rrcConnectionReconfiguration-r13) used to set up data radio bearer configuration after the attach. It includes dedicatedInfoNASList-r13, which carries a NAS message, and configures DRB 1 for EPS bearer ID 5. The PDCP configuration disables header compression and sets discardTimer to infinity. The RLC is configured in AM mode with retransmission timer t-PollRetransmit = 6000 ms and maxRetxThreshold = 32. The logical channel is assigned ID 4 with priority 13.
This is an EMM Attach Accept message sent from the Network to the UE, confirming successful attach with result "EPS only". The timer T3412 is set to 30 minutes, and the UE is assigned a PDN address (192.168.2.2) with PDN type = IPv4.
Embedded within is an ESM Activate Default EPS Bearer Context Request message (message type = 0xc1), assigning EPS bearer ID 5 with QCI = 9 and APN "default.mnc001.mcc001.gprs". The ESM cause = 0x32 indicates that only IPv4 is allowed. The UE is also informed of supported network features like ePCO=1, S1-U data=1, and IMS VoPS=1
This is an EMM Attach Complete message sent by the UE, confirming successful completion of the attach procedure. It includes an ESM message container with Activate Default EPS Bearer Context Accept (message type = 0xc2) for EPS bearer ID 5, confirming acceptance of the default bearer and PDN connectivity settings provided earlier.
RRC / NAS Signaling
SIB1
: This is the SIB1 sent by eNB to configiture Cat M1 (
{
message c1: systemInformationBlockType1: {
cellAccessRelatedInfo {
plmn-IdentityList {
{
...
},
...
}
},
...
},
cellSelectionInfo {
...
},
p-Max 10,
freqBandIndicator 7,
schedulingInfoList {
...
},
si-WindowLength ms40,
systemInfoValueTag 0,
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
cellAccessRelatedInfo-v1250 {
},
nonCriticalExtension {
hyperSFN-r13 '0000001111'B,
eDRX-Allowed-r13 true,
bandwidthReducedAccessRelatedInfo-r13 {
si-WindowLength-BR-r13 ms40,
si-RepetitionPattern-r13 every4thRF,
schedulingInfoList-BR-r13 {
{
si-Narrowband-r13 1,
si-TBS-r13 b504
}
},
startSymbolBR-r13 3,
si-HoppingConfigCommon-r13 off
}
SIB2
: This is the SIB2 sent by eNB to configiture Cat M1 (
{
message c1: systemInformation: {
criticalExtensions systemInformation-r8: {
sib-TypeAndInfo {
sib2: {
radioResourceConfigCommon {
rach-ConfigCommon {
...
},
maxHARQ-Msg3Tx 5,
preambleTransMax-CE-r13 n10,
rach-CE-LevelInfoList-r13 {
{
preambleMappingInfo-r13 {
firstPreamble-r13 0,
lastPreamble-r13 63
},
ra-ResponseWindowSize-r13 sf50,
mac-ContentionResolutionTimer-r13 sf80,
rar-HoppingConfig-r13 off
}
}
},
bcch-Config {
...
},
pcch-Config {
...
},
prach-Config {
rootSequenceIndex 648,
prach-ConfigInfo {
prach-ConfigIndex 4,
highSpeedFlag FALSE,
zeroCorrelationZoneConfig 11,
prach-FreqOffset 4
}
},
pdsch-ConfigCommon {
...
},
pusch-ConfigCommon {
...
},
pucch-ConfigCommon {
...
},
soundingRS-UL-ConfigCommon setup: {
...
},
uplinkPowerControlCommon {
...
},
ul-CyclicPrefixLength len1,
pusch-ConfigCommon-v1270 {
enable64QAM-v1270 true
},
bcch-Config-v1310 {
modificationPeriodCoeff-v1310 n64
},
pcch-Config-v1310 {
paging-narrowBands-r13 1,
mpdcch-NumRepetition-Paging-r13 r1
},
freqHoppingParameters-r13 {
interval-ULHoppingConfigCommonModeA-r13 interval-FDD-r13: int1
},
pdsch-ConfigCommon-v1310 {
pdsch-maxNumRepetitionCEmodeA-r13 r16
},
pusch-ConfigCommon-v1310 {
pusch-maxNumRepetitionCEmodeA-r13 r8
},
prach-ConfigCommon-v1310 {
rsrp-ThresholdsPrachInfoList-r13 {
0
},
mpdcch-startSF-CSS-RA-r13 fdd-r13: v1,
prach-ParametersListCE-r13 {
{
prach-ConfigIndex-r13 4,
prach-FreqOffset-r13 4,
prach-StartingSubframe-r13 sf2,
maxNumPreambleAttemptCE-r13 n3,
numRepetitionPerPreambleAttempt-r13 n1,
mpdcch-NarrowbandsToMonitor-r13 {
1
},
mpdcch-NumRepetition-RA-r13 r1,
prach-HoppingConfig-r13 off
}
}
},
pucch-ConfigCommon-v1310 {
n1PUCCH-AN-InfoList-r13 {
38
},
pucch-NumRepetitionCE-Msg4-Level0-r13 n1
}
},
ue-TimersAndConstants {
t300 ms200,
t301 ms200,
t310 ms200,
n310 n6,
t311 ms10000,
n311 n5,
t300-v1310 ms5000,
t301-v1310 ms5000
},
freqInfo {
additionalSpectrumEmission 1
},
timeAlignmentTimerCommon infinity
},
Attach Request
: This is the AttachRequest sent by UE to inform UE capability for IoT NAS feature (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x41 (Attach request)
EPS attach type = 1 (EPS attach)
NAS key set identifier:
TSC = 0
NAS key set identifier = 7
Old GUTI or IMSI:
IMSI = 001010123456789
UE network capability:
0xe0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=0, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0xe0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=0, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
0x00 (UCS2=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
0x00 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=0)
0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 0
Procedure transaction identity = 1
Message type = 0xd0 (PDN connectivity request)
Request type = 1 (initial request)
PDN type = 3 (IPv4v6)
Protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00
Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)
Data =
Protocol ID = 0x0003 (DNS Server IPv6 Address Request)
Data =
Protocol ID = 0x000a (IP address allocation via NAS signalling)
Data =
Protocol ID = 0x000c (P-CSCF IPv4 Address Request)
Data =
Protocol ID = 0x000d (DNS Server IPv4 Address Request)
Data =
Voice domain preference and UE's usage setting = 0x05 (IMS PS Voice only, Data centric)
MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)
RrcConnectionSetup
: This is the RrcConnectionSetup sent by eNB to configiture Cat M1 (
{
message c1: rrcConnectionSetup: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetup-r8: {
radioResourceConfigDedicated {
srb-ToAddModList {
...
},
mac-MainConfig explicitValue: {
...
},
physicalConfigDedicated {
...
},
soundingRS-UL-ConfigDedicated release: NULL,
schedulingRequestConfig setup: {
...
},
epdcch-Config-r11 {
config-r11 setup: {
setConfigToAddModList-r11 {
{
setConfigId-r11 0,
transmissionType-r11 distributed,
resourceBlockAssignment-r11 {
numberPRB-Pairs-r11 n2,
resourceBlockAssignment-r11 'E'H
},
dmrs-ScramblingSequenceInt-r11 1,
pucch-ResourceStartOffset-r11 0,
mpdcch-config-r13 setup: {
csi-NumRepetitionCE-r13 sf1,
mpdcch-pdsch-HoppingConfig-r13 off,
mpdcch-StartSF-UESS-r13 fdd-r13: v1,
mpdcch-NumRepetition-r13 r1,
mpdcch-Narrowband-r13 1
}
}
}
}
},
ce-Mode-r13 setup: ce-ModeA
}
UE Capability Information
: This is the UE Capability Information sent by UE to inform RRC capability for Cat M1 (
{
message c1: ueCapabilityInformation: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: ueCapabilityInformation-r8: {
ue-CapabilityRAT-ContainerList {
{
rat-Type eutra,
ueCapabilityRAT-Container {
accessStratumRelease rel13,
ue-Category 1,
pdcp-Parameters {
...
}
},
phyLayerParameters {
...
},
rf-Parameters {
...
},
measParameters {
bandListEUTRA {
...
}
},
featureGroupIndicators '4E001002'H /*
2: PUCCH 2a/2b, abs TPC, RB alloc type 1 for PDSCH, Periodic CQI/PMI/RI reporting on PUCCH: Modes 2-0 and 2-1
5: Long DRX cycle, DRX Mac CE
6: Prioritized bit rate
7: RLC UM
20: SRB1 and SRB2 for DCCH + 8x DRB
31: MFBI
*/,
interRAT-Parameters {
},
nonCriticalExtension {
phyLayerParameters-v920 {
},
interRAT-ParametersGERAN-v920 {
},
csg-ProximityIndicationParameters-r9 {
},
neighCellSI-AcquisitionParameters-r9 {
},
son-Parameters-r9 {
},
nonCriticalExtension {
lateNonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
ce-Parameters-v1370 {
tm9-CE-ModeA-r13 supported
},
nonCriticalExtension {
ce-Parameters-v1380 {
tm6-CE-ModeA-r13 supported
},
fdd-Add-UE-EUTRA-Capabilities-v1380 {
ce-Parameters-v1380 {
}
},
tdd-Add-UE-EUTRA-Capabilities-v1380 {
ce-Parameters-v1380 {
}
...
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
pdcp-Parameters-v1130 {
},
phyLayerParameters-v1130 {
tdd-SpecialSubframe-r11 supported
},
rf-Parameters-v1130 {
},
measParameters-v1130 {
},
interRAT-ParametersCDMA2000-v1130 {
},
otherParameters-r11 {
},
nonCriticalExtension {
nonCriticalExtension {
rf-Parameters-v1180 {
freqBandRetrieval-r11 supported
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
ue-CategoryDL-v1310 m1,
ue-CategoryUL-v1310 m1,
pdcp-Parameters-v1310 {
},
rlc-Parameters-v1310 {
},
mac-Parameters-v1310 {
extendedLongDRX-r13 supported
},
ce-Parameters-r13 {
ce-ModeA-r13 supported
},
interRAT-ParametersWLAN-r13 {
},
wlan-IW-Parameters-v1310 {
},
lwip-Parameters-r13 {
}
....
},
nonCriticalExtension {
nonCriticalExtension {
ue-RadioPagingInfo-r12 {
ue-CategoryDL-v1310 m1,
ce-ModeA-r13 true
}
Attach Accept
: This is the AttachAccept sent by UE to inform NW capability for IoT NAS feature and Activate Default EPS Bearer(
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x63483d18
Sequence number = 0x01
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 1 (EPS only)
T3412 value:
Value = 30
Unit = 1 (1 minute)
TAI list:
Length = 6
Data = 00 00 f1 10 00 01
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 5
Procedure transaction identity = 1
Message type = 0xc1 (Activate default EPS bearer context request)
EPS QoS:
QCI = 9
Access point name = "default.mnc001.mcc001.gprs"
PDN address:
PDN type = 1 (IPv4)
IPv4 = 192.168.2.2
ESM cause = 0x32 (PDN type IPv4 only allowed)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 03 00 00 0a 81 06 08 08 08 08
Protocol ID = 0x000d (DNS Server IPv4 Address)
Data = 8.8.8.8
GUTI:
MCC = 001
MNC = 01
MME Group ID = 32769
MME Code = 1
M-TMSI = 0x275be002
Emergency number list:
Length = 8
Data = 03 1f 19 f1 03 1f 11 f2
EPS network feature support:
0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)
0x08 (15 bearers=0, IWK N26=0, RestrictDCNR=0, RestrictEC=0, ePCO=1, HC-CP CIoT=0, S1-U data=0, UP CIoT=0)