NB IoT (standalone) -UEsim
The purpose of this tutorial is to show you how to do basic connectivity test between a UEsim and Amari Callbox with LTE NB in standaloneMode. NB IoT is designed to use the bandwidth 200khz which issingle LTE RB(180khz) plusa little bit of guardband. It can be deployed in a few different operationmode called Inband, Guardband, Standalone mode as illustrated below.
Source : Sharetechnote
On top of the operation mode, there are a few additional featuresdepending on operation mode.
- Inband Mode
- with Same PCI
- Non-Anchor Carrier Disabled
- Non-Anchor Carrier Enabled
- with Different PCI
- Guarband Mode
- Standalone Mode
This tutorial is based on the configuration for standalone mode.
Table of Contents
Introduction
Narrowband IoT (NB-IoT) is a specialized cellular technology within the LTE family, optimized for low-power, wide-area (LPWA) connectivity and addressing the requirements of massive Internet of Things (IoT) deployments. NB-IoT operates within a narrow bandwidth of 200 kHz, utilizing the equivalent of a single LTE resource block (180 kHz) with additional guard bands to minimize interference and optimize spectrum efficiency. This technology supports three main deployment modes: Inband (within existing LTE carriers), Guardband (using unused LTE spectrum), and Standalone (utilizing re-farmed GSM spectrum). Standalone mode is particularly significant for rural or remote deployments where dedicated spectrum is available, providing robust coverage and simple network architecture. The Amari Callbox, a comprehensive LTE test platform, together with a UEsim (User Equipment Simulator), enables detailed emulation and testing of NB-IoT connectivity scenarios, ensuring that devices and networks conform to the 3GPP NB-IoT specifications. Understanding the architectural differences, such as anchor versus non-anchor carriers and PCI (Physical Cell ID) configurations, is essential for effective deployment and troubleshooting. This tutorial focuses on performing a basic connectivity test between a UEsim and an Amari Callbox configured for LTE NB-IoT in standalone mode, equipping engineers and researchers with practical insights into the initial phases of NB-IoT network validation.
-
Context of NB-IoT Technology
- NB-IoT is a 3GPP standardized technology under the LTE umbrella, designed for massive IoT applications requiring low power consumption, extended coverage, and minimal data throughput.
-
It operates in three deployment modes:
- Inband Mode: NB-IoT channels are embedded within existing LTE carriers.
- Guardband Mode: NB-IoT is deployed in the unused guard bands of LTE spectrum.
- Standalone Mode: NB-IoT is deployed independently, often in re-farmed 2G/GSM spectrum, allowing for dedicated operation.
- The Amari Callbox serves as an all-in-one LTE eNodeB and core network emulator, while the UEsim acts as a programmable user equipment simulator for comprehensive connectivity testing.
-
Relevance and Importance of the Tutorial Topic
- NB-IoT is critical for enabling scalable, energy-efficient IoT deployments across diverse scenarios such as smart metering, asset tracking, and environmental monitoring.
- Standalone mode provides enhanced coverage and reduced complexity, making it pivotal for isolated or specialized IoT networks.
- Validating basic connectivity between simulated UE and network infrastructure is essential for ensuring device interoperability and network reliability.
-
Learning Outcomes
- Understand the fundamental principles of NB-IoT, particularly standalone mode operation.
- Gain practical experience in configuring and validating connectivity between a UEsim and Amari Callbox.
- Learn to identify and resolve common configuration issues specific to NB-IoT deployment modes.
- Develop familiarity with key NB-IoT parameters such as bandwidth, carrier type, PCI, and guardband allocation.
-
Prerequisite Knowledge and Skills
- Basic understanding of LTE architecture and radio access network concepts.
- Familiarity with NB-IoT operational principles and deployment modes.
- Experience with laboratory test equipment, specifically UEsim and Amari Callbox platforms.
- Knowledge of spectrum allocation and resource block configuration in LTE.
- Fundamental troubleshooting skills for wireless connectivity issues.
Summary of the Tutorial
This tutorial describes the end-to-end procedure for setting up and verifying NB-IoT UE attach using Amarisoft UE simulator (UEsim) and Callbox (eNB), with a focus on test configuration, execution, and log analysis.
-
Test Configuration and Setup:
- Ensure configuration files ue-nbiot-standalone.cfg (for UEsim) and enb-nbiot-standalone.cfg (for Callbox) are present and correctly linked using symbolic links.
- Verify that important parameters such as dl_earfcn, n_antenna_dl, n_antenna_ul, operation_mode, cell bandwidth, and USIM-related fields (imsi, K) are matched between UEsim and Callbox.
- On the Callbox, ensure the mme-ims.cfg is used and includes the relevant authentication and IMS registration information from ue_db-ims.cfg.
-
Service Verification and Screen Access:
- Confirm that the LTE service is running on the Callbox using service lte status. If issues arise, restart the service with service lte restart.
- Access the screen session for both UEsim and Callbox using screen -r to enable command execution and monitoring.
- Familiarize yourself with command-line operations within the Amarisoft environment for test execution and monitoring.
-
UE Attach Procedure:
- Initiate the UE attach process by powering on the UE in the simulator.
- Monitor both the UEsim and Callbox screens for key indicators:
- Use cell phy and cell commands on Callbox to check basic configuration (ARFCN, BAND, BW, etc.).
- On successful SIB decoding and cell detection, UEsim will display relevant messages and initial attach progress.
- Callbox will trace the attach process; use cells and ue commands to verify UE registration.
- Switch between UEsim and Callbox screens as needed to observe attach signaling and status.
-
Log Analysis and Verification:
- Collect and inspect log files /tmp/ue0.log (UEsim) and /tmp/enb0.log (Callbox) using a text editor or the Amarisoft WebGUI for detailed analysis.
- Ensure full stack logging is enabled for comprehensive traceability of all protocol layers.
- Verify the occurrence of key signaling and configuration messages in the logs:
- NPSS/NPBCH detection, SIB1/SIB2 decoding for cell and NB-IoT configuration.
- Attach Request from UE with correct IMSI and capability information.
- NB-IoT RRC Connection Request, Setup, and Setup Complete messages confirming RRC establishment.
- Authentication Request/Response and Security Mode Command/Complete exchanges for NAS and RRC security.
- UE Capability Enquiry and Information for feature support (multi-tone, NB1 category, etc.).
- RRC Connection Reconfiguration and Complete for DRB and NAS bearer setup.
- Attach Accept and Attach Complete messages confirming successful network registration and bearer activation (including APN, PDN address, and feature support).
- Use the log traces to troubleshoot failures by identifying points where the expected signaling does not occur or indicates an error.
-
Key Signaling Messages and Parameters:
- SIB1/SIB2: Cell and NB-IoT configuration broadcast by eNB, including paging, random access, and channel parameters.
- Attach Request: UE informs network of its NAS and RRC capabilities, IMSI, and requests EPS attach.
- RRC Connection Setup: Network configures dedicated resources for the UE.
- UE Capability Information: UE reports supported NB-IoT features and bands.
- Attach Accept: Network assigns PDN address, EPS bearer, and confirms attach result.
- Security establishment: Authentication, security mode command/complete for both NAS and RRC layers.
Conclusion: The tutorial provides a comprehensive, step-by-step methodology for configuring NB-IoT test scenarios with Amarisoft tools, executing UE attach, and analyzing logs for successful attach and troubleshooting. Following these procedures ensures correct configuration alignment, successful protocol signaling, and the ability to identify and resolve any issues encountered during attach tests.
Test Setup
Test setup for this tutorial is as shown below.
Configuration
An important thing in using UE sim is to do proper matching between UE sim configuration and Call box configuration In this tutorial, I used the ue-nbiot-standalone.cfgand and enb-nbiot-standalone.cfgwithout any change
If you use other Network (e.g, other network simulator or real network), you have to make it sure to configure UE sim according to the settings on network side
For UEsim, the ue-nbiot-standalone.cfg is used (
For Callbox, the enb-nbiot-standalone.cfg is used (
For the core network, mme-ims.cfg is used for configuration.
Open upenb-nbiot-standalone.cfg and note some fundamental configuration parameter for this test. It is important to note dl_earfcn, n_antenna_dl, n_antenna_ul and operation_mode and UEsim configuration should set to match these parameters.
You would see following in /root/mme/config/ims-ims.cfg file on Callbox. The important part to note is 'include "ue_db-ims.cfg" which carries the information about authentication and IMS registration.
Following is the contents of "ue_db-ims.cfg" on Callbox. sim_algo, imsi, amf, sqn, K are authentication related parameters and other parts (impi, impu, domain) are for IMS registration and basic call setup.
In this tutorial, following SIM information will be used. this is the configuration in ue-nbiot-standalone.cfg on UEsim.The important part to note are imsi and K which is USIM parameter for attach.
Following is the configuration on Callbox (enb-nbiot-standalone.cfg). The important part to note is dl_earfcn and operation_mode in this test. You should match dl_earfcn on Call box with dl_earfcn on UEsim.
Following is the configuration on UEsim (ue-nbiot-standalone.cfg) . The important things to note are to match the UEsim parameters (CELL_BANDWIDTH, N_ANTENNA_DL, N_ANTENNA_UL, dl_earfcn) with the correspoinding configurations of Callbox (eNB)
Check if LTE service is Running
Whatever you want to test, the first thing you need to do is that call box program (LTE Service) is running. You can check on the execution status of the call box program by running following command and you should get the result as shown below
# service lte status
NOTE : Getting this result is pre-requisite for Call Box Operation, but this result itself does not guarantee the normal operation. If you see some unexpected issues. You may restart the call box with following command
# service lte restart
Getting into Screen Mode
If it is confirmed that the lte service is running, go to screen mode by running 'screen -r' and follow through the steps as shown below. The steps shown here is the procedure that you would use for almost every test and it is highly recommended to get familiar with these steps. For further commands you can use in this screen mode, refer to the tutorial : Command Line Command
Run following command on UE sim
You will get the screen as shown below
Run following command on Callbox
You will get the screen as shown below
Attach UE
Now perform UE attach procedure. This would be a little bit busy process since you need to switch back and forth between Callbox screen and UEsim screen.
This is not the mandatory step, but I would stronly recommend you to check the output of 'cell phy' and 'cell' command in (ENB) screen and check out the basic configuration (e.g, ARFCN, BAND, BW etc) is configured as intended.
Start tracing on Callbox
power_on UE on UE sim.
You will see following message once UE detect the cell and decoded SIBs.
Once UE completed SIB decoding and perform initial attach, you will see following trace on Callbox screen.
When the initial attach completed, you can check on the cell information to which the UE sim is registered to with 'cells' command.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (enb) screen.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (mme) screen.
Log Analysis
In this section, you will see how to confirm if UE registration is complete from trace log. You can use the same method to find any issues (e.g, registration failure) for troubleshooting. When UE registration fails, you may use this tutorial to figure out the point of the failure and troubleshoot
Open /tmp/ue0.log on UEsim using any text editor. I am using nano in this tutorial. (NOTE : In the same way, you can check eNB log by opening /tmp/enb0.log on Callbox).
First thing to note is to check if NPSS and NPBCH is logged. If you find this, it indcates that UEsim successfully detected sync channels and decoded MIB.
This is SystemInformationBlockType1-r13 message indicating that the cell operates on frequency band 20 (freqBandIndicator-r13) and broadcasts system information every 128 radio frames with repetition every 2nd frame (si-Periodicity-r13, si-RepetitionPattern-r13). The PLMN is identified as MCC 001 and MNC 01 (plmn-Identity-r13), and the cell is not reserved (cellReservedForOperatorUse-r13 notReserved). The system information(i.e, SIB2 and others)is carried in transport block index b208 (si-TB-r13).
This is sib2-r13, which configures essential NB-IoT parameters for random access, paging, and uplink/downlink channels.
The paging configuration (pcch-Config-r13) sets the default paging cycle to rf128 and defines one repetition (npdcch-NumRepetitionPaging-r13 r1), indicating how often and how many times paging messages are sent. Random access settings (rach-ConfigCommon-r13) allow up to 10 preamble transmissions with an initial target power of -104 dBm, and the contention resolution timer is set to 32 subframes.
For NPRACH (nprach-Config-r13), preambles are scheduled every 80 ms(nprach-Periodicity-r13) with 12 subcarriers and allow up to 10 attempts per CE level(maxNumPreambleAttemptCE-r13). Each RA preamble is repeated once, and the downlink control channel uses 8 repetitions (npdcch-NumRepetitions-RA-r13 r8).
The uplink shared channel (npusch-ConfigCommon-r13) uses 1 repetition for HARQ feedback and disables group hopping (groupHoppingEnabled-r13 FALSE). For downlink, the NPDSCH transmit power is set to 0 dB (nrs-Power-r13 0).
This is an LTE Attach Request message where the UE initiates an EPS attach with IMSI 001010123456789 and requests a PDN connection. It supports extended protocol configuration (ePCO=1) and multiple DRBs (multipleDRB=1). The embedded PDN Connectivity Request asks for an IPv6 connection (PDN type = 3) with an initial request type.
Pay attention to UE network capability and see if the UE support all the capabilities that is required for the intended test.
This is an NB-IoT RRC Connection Request message with establishmentCause-r13 set to mo-Signalling, indicating the UE is initiating signaling. The UE identity is provided as a random value (5B095D9A1B'H). It supports multi-tone operation (multiToneSupport-r13 = true) and early contention resolution (earlyContentionResolution-r14 = TRUE), with no CQI measurements reported (cqi-NPDCCH-r14 = noMeasurements).
This is an NB-IoT RRC Connection Setup message with transaction ID 0. It configures the dedicated radio resources (radioResourceConfigDedicated-r13), including control signaling over the NPDCCH. The configuration sets npdcch-NumRepetitions-r13 to r8 (8 repetitions), with npdcch-StartSF-USS-r13 as v4 and npdcch-Offset-USS-r13 as zero, defining the starting subframe and offset for NPDCCH in the uplink shared search space (USS).
This is an NB-IoT RRC Connection Setup Complete message indicating the UE has successfully completed the RRC setup procedure. It includes the selected PLMN ID (selectedPLMN-Identity-r13 = 1) and carries the NAS message (dedicatedInfoNAS-r13). The flag up-CIoT-EPS-Optimisation-r13 = true confirms that the UE is using control plane CIoT EPS optimization for efficient small data transmission over NAS.
This is an EMM Authentication Request message (message type = 0x52) from Network to the UE during the LTE attach procedure. It includes a random challenge value (RAND) and an authentication token (AUTN) used for mutual authentication. The message is a plain NAS message (not ciphered or integrity protected) with NAS key set identifier set to 0, indicating initial security context establishment.
This is an EMM Authentication Response message (message type = 0x53) from the UE to the network. It contains the authentication response parameter, an 8-byte value used to verify the UE's identity based on the earlier challenge (RAND). The message is a plain NAS message, indicating it is still part of the initial security setup.
This is a Security Mode Command message (message type = 0x5d) from the network to UE to establish NAS security. It is protected with a new EPS security context (Security header = 0x3) and selects EEA0 for encryption and EIA2 for integrity (Selected NAS security algorithms = 0x02). The UE is asked to confirm previously reported security capabilities, and the network also requests the IMEISV (IMEISV request = 1) for identity verification.
This is a Security Mode Complete message (message type = 0x5e) sent by the UE, confirming acceptance of the NAS security algorithms and EPS security context. The message is both integrity protected and ciphered (Security header = 0x4). The UE also includes its IMEISV (0123456700000101) as requested earlier by the network.
This is an NB-IoT RRC Security Mode Command message (securityModeCommand-r13) sent from the network to the UE. It specifies the selected security algorithms: eea0 for ciphering (no encryption) and eia2 for integrity protection
This is an NB-IoT RRC Security Mode Complete message (securityModeComplete-r13) sent by the UE in response to the Security Mode Command. It confirms acceptance of the configured security algorithms (eea0 for ciphering and eia2 for integrity).
This is an NB-IoT RRC UE Capability Enquiry message (ueCapabilityEnquiry-r13) sent by the network to request the UE’s supported features and capabilities
This is an NB-IoT RRC UE Capability Information message (ueCapabilityInformation-r13) sent by the UE in response to the UE Capability Enquiry. It indicates that the UE supports multi-tone operation (multiTone-r13 = supported), operates on band 20 with 20 dBm power class (powerClassNB-20dBm-r13 = supported), and belongs to Category NB1 (ue-Category-NB-r13 = nb1).
This is an NB-IoT RRC Connection Reconfiguration message (rrcConnectionReconfiguration-r13) used to set up data radio bearer configuration after the attach. It includes dedicatedInfoNASList-r13, which carries a NAS message, and configures DRB 1 for EPS bearer ID 5. The PDCP configuration disables header compression and sets discardTimer to infinity. The RLC is configured in AM mode with retransmission timer t-PollRetransmit = 6000 ms and maxRetxThreshold = 32. The logical channel is assigned ID 4 with priority 13.
This is an NB-IoT RRC Connection Reconfiguration Complete message (rrcConnectionReconfigurationComplete-r13) sent by the UE. It confirms successful application of the configuration received in the preceding RRC Connection Reconfiguration message, including DRB setup and NAS content.
This is an EMM Attach Accept message sent from the Network to the UE, confirming successful attach with result "EPS only". The timer T3412 is set to 30 minutes, and the UE is assigned a PDN address (192.168.2.2) with PDN type = IPv4.
Embedded within is an ESM Activate Default EPS Bearer Context Request message (message type = 0xc1), assigning EPS bearer ID 5 with QCI = 9 and APN "default.mnc001.mcc001.gprs". The ESM cause = 0x32 indicates that only IPv4 is allowed. The UE is also informed of supported network features like ePCO=1, S1-U data=1, and IMS VoPS=1
This is an EMM Attach Complete message sent by the UE, confirming successful completion of the attach procedure. It includes an ESM message container with Activate Default EPS Bearer Context Accept (message type = 0xc2) for EPS bearer ID 5, confirming acceptance of the default bearer and PDN connectivity settings provided earlier.
RRC / NAS Signaling
SIB1
: This is the SIB1 sent by eNB to configiture NB IoT (
{
message c1: systemInformationBlockType1-r13: {
hyperSFN-MSB-r13 '01'H,
cellAccessRelatedInfo-r13 {
plmn-IdentityList-r13 {
{
...
}
},
...
},
cellSelectionInfo-r13 {
...
},
p-Max-r13 10,
freqBandIndicator-r13 7,
eutraControlRegionSize-r13 n3,
nrs-CRS-PowerOffset-r13 dB0,
schedulingInfoList-r13 {
{
si-Periodicity-r13 rf128,
si-RepetitionPattern-r13 every2ndRF,
sib-MappingInfo-r13 {
},
si-TB-r13 b208
}
},
si-WindowLength-r13 ms160,
systemInfoValueTagList-r13 {
0
}
SIB2
: This is the SIB2 sent by eNB to configiture NB IoT (
{
message c1: systemInformation: {
criticalExtensions systemInformation-r8: {
sib-TypeAndInfo {
sib2: {
radioResourceConfigCommon {
rach-ConfigCommon {
preambleInfo {
numberOfRA-Preambles n52
},
powerRampingParameters {
powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104
},
ra-SupervisionInfo {
preambleTransMax n10,
ra-ResponseWindowSize sf10,
mac-ContentionResolutionTimer sf40
},
maxHARQ-Msg3Tx 5
},
bcch-Config {
...
},
pcch-Config {
...
},
prach-Config {
rootSequenceIndex 204,
prach-ConfigInfo {
prach-ConfigIndex 4,
highSpeedFlag FALSE,
zeroCorrelationZoneConfig 11,
prach-FreqOffset 2
}
},
pdsch-ConfigCommon {
...
},
pusch-ConfigCommon {
pusch-ConfigBasic {
n-SB 1,
hoppingMode interSubFrame,
pusch-HoppingOffset 4,
enable64QAM TRUE
},
ul-ReferenceSignalsPUSCH {
groupHoppingEnabled FALSE,
groupAssignmentPUSCH 0,
sequenceHoppingEnabled FALSE,
cyclicShift 0
}
},
pucch-ConfigCommon {
...
},
soundingRS-UL-ConfigCommon setup: {
...
},
uplinkPowerControlCommon {
...
},
ul-CyclicPrefixLength len1,
pusch-ConfigCommon-v1270 {
enable64QAM-v1270 true
}
},
ue-TimersAndConstants {
t300 ms200,
t301 ms200,
t310 ms200,
n310 n6,
t311 ms10000,
n311 n5
},
freqInfo {
additionalSpectrumEmission 1
},
timeAlignmentTimerCommon infinity
},
Attach Request
: This is the AttachRequest sent by UE to inform UE capability for NB IoT NAS feature (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x41 (Attach request)
EPS attach type = 1 (EPS attach)
NAS key set identifier:
TSC = 0
NAS key set identifier = 7
Old GUTI or IMSI:
IMSI = 001010123456789
UE network capability:
0xe0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=0, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0xe0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=0, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
0x00 (UCS2=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
0x00 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=0)
0x90 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=1, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)
0x01 (15 bearers=0, SGC=0, N1mode=0, DCNR=0, CP backoff=0, RestrictEC=0, V2X PC5=0, multipleDRB=1)
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 0
Procedure transaction identity = 1
Message type = 0xd0 (PDN connectivity request)
Request type = 1 (initial request)
PDN type = 3 (IPv4v6)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00
Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)
Data =
Protocol ID = 0x0003 (DNS Server IPv6 Address Request)
Data =
Protocol ID = 0x000a (IP address allocation via NAS signalling)
Data =
Protocol ID = 0x000c (P-CSCF IPv4 Address Request)
Data =
Protocol ID = 0x000d (DNS Server IPv4 Address Request)
Data =
Protocol ID = 0x0016 (APN rate control support indicator)
Data =
Additional update type = 0x01 (no additional information, keeping NAS signalling connection not required, SMS only)
MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)
RrcConnectionSetup
: This is the RrcConnectionSetup sent by eNB to configiture NB IoT (
{
message c1: rrcConnectionSetup-r13: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetup-r13: {
radioResourceConfigDedicated-r13 {
srb-ToAddModList-r13 {
{
rlc-Config-r13 explicitValue: am: {
ul-AM-RLC-r13 {
t-PollRetransmit-r13 ms6000,
maxRetxThreshold-r13 t32
},
dl-AM-RLC-r13 {
}
},
logicalChannelConfig-r13 explicitValue: {
priority-r13 1
}
}
},
mac-MainConfig-r13 explicitValue-r13: {
ul-SCH-Config-r13 {
periodicBSR-Timer-r13 pp16,
retxBSR-Timer-r13 pp64
},
timeAlignmentTimerDedicated-r13 infinity
},
physicalConfigDedicated-r13 {
npdcch-ConfigDedicated-r13 {
npdcch-NumRepetitions-r13 r8,
npdcch-StartSF-USS-r13 v4,
npdcch-Offset-USS-r13 zero
},
npusch-ConfigDedicated-r13 {
npusch-AllSymbols-r13 FALSE
}
UE Capability Information
: This is the UE Capability Information sent by UE to inform RRC capability for NB IoT (
{
message c1: ueCapabilityInformation-r13: {
rrc-TransactionIdentifier 0,
criticalExtensions ueCapabilityInformation-r13: {
ue-Capability-r13 {
accessStratumRelease-r13 rel14,
ue-Category-NB-r13 nb1,
multipleDRB-r13 supported,
pdcp-Parameters-r13 {
supportedROHC-Profiles-r13 {
profile0x0002 TRUE,
profile0x0003 FALSE,
profile0x0004 TRUE,
profile0x0006 FALSE,
profile0x0102 FALSE,
profile0x0103 FALSE,
profile0x0104 FALSE
},
maxNumberROHC-ContextSessions-r13 cs12
},
phyLayerParameters-r13 {
multiTone-r13 supported
},
rf-Parameters-r13 {
supportedBandList-r13 {
{
band-r13 7,
powerClassNB-20dBm-r13 supported
}
}
}
},
ue-RadioPagingInfo-r13 {
ue-Category-NB-r13 nb1
},
nonCriticalExtension {
ue-Capability-ContainerExt-r14 {
ue-Category-NB-r14 nb2,
rf-Parameters-v1430 {
}
Attach Accept
: This is the AttachAccept sent by UE to inform NW capability for IoT NAS feature and Activate Default EPS Bearer(
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x8cd0b681
Sequence number = 0x01
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 1 (EPS only)
T3412 value:
Value = 30
Unit = 1 (1 minute)
TAI list:
Length = 6
Data = 00 00 f1 10 00 02
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 5
Procedure transaction identity = 1
Message type = 0xc1 (Activate default EPS bearer context request)
EPS QoS:
QCI = 9
Access point name = "default.mnc001.mcc001.gprs"
PDN address:
PDN type = 1 (IPv4)
IPv4 = 192.168.2.2
ESM cause = 0x32 (PDN type IPv4 only allowed)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 03 00 00 0a 81 06 08 08 08 08
Protocol ID = 0x000d (DNS Server IPv4 Address)
Data = 8.8.8.8
Protocol ID = 0x0016 (APN rate control parameters)
Data = 00 00 00 00
GUTI:
MCC = 001
MNC = 01
MME Group ID = 32769
MME Code = 1
M-TMSI = 0x209e332f
Emergency number list:
Length = 8
Data = 03 1f 19 f1 03 1f 11 f2
EPS network feature support:
0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)
0x0a (15 bearers=0, IWK N26=0, RestrictDCNR=0, RestrictEC=0, ePCO=1, HC-CP CIoT=0, S1-U data=1, UP CIoT=0)
Additional update result = 0x02 (SMS only)