Amarisoft

UE Capability Enquiry

This tutorial show how Amari Callbox configures items in UE Capabiility Enquiry message by default and how we can add additional enquiry items in the message. UE capability Enquiry/UE capability Information is a signaling mechanism by which UE inform RAN (Radio Access Network) about its RRC capability.  During the initial attach procedure, there are several steps in which UE and Network exchange its capability so that they can setup a proper data pipes that can be supported by both of them. Following is overall procedure of this capability information exchange mechanism.

NOTE : For most of Protocol Test equipment, the equipment just exchange signaling message and does not analyze the details of the contents of the message which is different from live network operation. Amarisoft mechnism is much more like live network operation. It analyze the contents of the capability information and apply the configuration differently depending on the contents of the message.

NOTE : If you try some test (apply some configuration) and found it not working as expected, I would suggest you first to check about these capability message and see if UE informs all the details of the capability required for the intended feature.

Table of Contents

Introduction

The Amari Callbox is a versatile test platform widely used for emulating and analyzing wireless network procedures, especially in environments focused on LTE and 5G technologies. Central to cellular communications is the exchange of capability information between the User Equipment (UE) and the Radio Access Network (RAN), which ensures that both ends of the connection can negotiate and agree upon supported features and configurations. The UE Capability Enquiry and UE Capability Information signaling procedures play a pivotal role in this negotiation, enabling the network to dynamically adjust its behavior based on the UE's capabilities. Architecturally, this exchange occurs during the initial attach process, leveraging both RRC (Radio Resource Control) and NAS (Non-Access Stratum) protocols to systematically convey information about supported radio technologies, bearers, and advanced features (such as carrier aggregation or dual connectivity). Unlike basic protocol test equipment, the Amarisoft solution emulates real-world network behavior by not only transmitting but also thoroughly analyzing the content of capability messages, adapting network configuration in real time according to the actual capabilities reported by the UE. This approach is critical for validating interoperability, enabling feature testing, and ensuring that the live network experience can be accurately replicated and troubleshooted in a controlled test environment. Understanding how the Amari Callbox handles UE Capability Enquiry message configuration—and how it can be customized—provides valuable insight into both protocol mechanics and practical network deployment considerations.

Summary of the Tutorial

This tutorial demonstrates test procedures for configuring and verifying UE Capability Enquiry messages using the Amarisoft Callbox. The tests focus on how different configurations impact the content of UE Capability Enquiry messages, serving as a baseline and guide for user-defined modifications.

Key Points Across All Tests:

Test Setup

Test setup for this tutorial is as shown below.  

TestSetup Callbox UE 1sdr 01

Key Configuration Parameters

Followings are important configuration parameters for this tutorial. You may click on the items for the descriptions from Amarisoft documents.

Test 1 :  UE Capability Enquiries in default configuraton

This test is just to show how the default configuration of UE Capability Enquiries that is sent by Amarisoft Callbox. This test is mainly for information purpose and setting the baseline. From this baseline, how to add specific user defined configurations will be shown in other test cases.

Configuration

In this test, I am using gnb-sa.cfg (NR SA Default Configuration) without any modification just to show how the default configuration sets UE Capability Enquiry message.

UeCapability Test 1 Config 01

Run and Check in the log

In this test, Amarisoft Callbox is running with the default UE Capability Enquiry behavior. The cell configuration shows NR cell 0x001 on band n78 with 20 MHz bandwidth, DL ARFCN 632628, UL ARFCN 632628, SSB ARFCN 632544, and 30 kHz SCS. Since no explicit requested frequency band list is configured in the UE capability enquiry configuration, the Callbox automatically builds the UE Capability Enquiry based on the serving cell configuration. In the log, the UE Capability Enquiry includes rat-Type set to nr and capabilityRequestFilter with bandInformationNR showing bandNR 78. This means the Callbox is asking the UE to report NR capability related to the configured serving band n78. Depending on the Callbox software release, capabilityRequestFilter IE may or may not appear in the generated message, but the default behavior is still based on the current cell configuration.

UeCapability Test 1 Run 01

Test 2 :  UE Capability Enquiries  with Additional Enquiries

This test is an example of adding a user defined configuration in UE Capability Enquiries message. The simplest and the most frequently used configuration would be to specify specific bands in the message. In this test, I will show how to specify specific NR bands in the message.

Configuration

In this test, I am using gnb-sa-uecap.cfg which is copied and modified from gnb-sa.cfg

UeCapability Test 2 Config 01

Following is the parameter that I added to gnb-sa-uecap.cfg within nr_cell_list: [  ]. For adding the specific NR bands, you just need to specify the 'rat' type and bands in requested_freq_bands_nr: [  ] configuration.

To request specific NR bands in the UE Capability Enquiry message, configure requested_freq_bands_nr and add each target band with rat set to nr and band_nr set to the NR band number. In this example, the list includes multiple NR bands such as n1, n2, n3, n4, n5, n6, n7, n8, n9, n10, n41, n78, n79, n80, n81, n82, n83, n84, n86, and n89. This configuration can be placed either in nr_cell_list or in nr_cell_default. In this tutorial, it is added under nr_cell_list, so it applies to this specific cell configuration. With this setting, Amarisoft populates the UE Capability Enquiry message with the configured NR band list instead of relying only on the serving cell band. A similar method can also be used for NSA or LTE by configuring requested_freq_bands_nr_mrdc or requested_eutra_freq_bands.

UeCapability Test 2 Config 02

Run and Check in the log

Run the test and check UE capability enquiry message in the log. You can confirm that all the band you specified in the configuration file is added to ueCapabilityEnquiry message.  You can see that the specified frequencies are configured in frequencyBandListFilter in capabilityRequestFilter IE (Information Element).

In this example, the UE Capability Enquiry is sent after Security Mode Complete, and the decoded message shows rat-Type set to nr. Under capabilityRequestFilter, frequencyBandListFilter is populated with the NR bands configured in requested_freq_bands_nr. You can confirm that the configured bands are added one by one as bandInformationNR entries, such as bandNR 1, bandNR 2, bandNR 3, bandNR 4, bandNR 5, bandNR 6, bandNR 7, bandNR 8, bandNR 9, bandNR 10, bandNR 41, bandNR 78, and bandNR 79. This confirms that Amarisoft is not using only the serving cell band in this test. Instead, it is generating the UE Capability Enquiry according to the user-defined NR band list in the configuration file.

UeCapability Test 2 Run 01

You can also check the detailed UE capability from the UE Capability Information message. After selecting the UE Capability Information log, scroll down in the decoded message panel and check rf-Parameters. Under supportedBandListNR, the UE reports the detailed capability for each supported NR band. In this example, bandNR 78 is shown with related feature information such as mimo-ParametersPerBand, supported SCS, CSI-RS capability, and codebook parameters. This section is useful to confirm not only whether the UE supports the requested band, but also what kind of radio capability the UE reports for that band. When checking the result, make sure that the reported band list matches the bands requested in the UE Capability Enquiry configuration and that there is no unexpected band outside the configured requested_freq_bands_nr list.

UeCapability Test 2 Run 02

One important item to check in UE Capability Information is the channel bandwidth support for each NR band. Many test issues happen when the test cell is configured with a channel bandwidth that the UE does not support for that band. In the decoded UE Capability Information message, scroll down to rf-Parameters and check the channelBWs-DL or channelBWs-UL field for the target band. In this example, the log shows the supported channel bandwidth bitmap for each SCS, such as scs-15kHz, scs-30kHz, and scs-60kHz. This bitmap tells which channel bandwidths are supported by the UE for that specific band and SCS combination. Before running a test with a specific bandwidth, compare the cell bandwidth configuration with this UE capability value. If the configured bandwidth is not supported by the UE, the UE may fail to camp, attach, register, or complete the intended test scenario. (NOTE : Refer to this note for the interpretation of the bitmap)

UeCapability Test 2 Run 03

Amarisoft Callbox extracts the NR band combination information from the UE Capability Information message and prints it as a separate log entry. In this example, after the UE sends UE Capability Information, the Callbox generates an additional NR band combinations log. This makes it easier to check the supported CA or band combination information without manually searching through the full UE capability message. The decoded output shows the supported band combinations in a simpler format, such as DL n41A + UL n41A and DL n78A + UL n78A, together with related feature information like MIMO layer, bandwidth, and SCS. You can also use the UE Caps button to view the band and band combination information in a tabular format, which is useful when the UE capability message is large.

UeCapability Test 2 Run 04

You can check the UE band combination capability in a tabular format from the UE Caps window. In this example, the CA combination section shows the reported NR combinations in a much simpler view than the raw UE Capability Information message. Comb. 1 shows DL n41A + UL n41A, with DL MIMO 4, 100 MHz, SCS 30 kHz, and UL MIMO 1, 100 MHz, SCS 30 kHz. Comb. 2 shows DL n78A + UL n78A with the same type of feature information. This view is useful when you want to quickly confirm the supported band combination, bandwidth, SCS, and MIMO capability without scrolling through the long decoded RRC message. (NOTE : If you are not familiar with how to get this display, check on this note) .

UeCapability Test 2 Run 05

Test 3 :  UE Capability Enquiries  with All Additional Enquiries (as of 20250211)

This test is an example of adding a user defined configuration in UE Capability Enquiries message. In this tutorial, I am putting all the paramters that will be enabled in UE capabiltility Enquiry. This is more of showing the syntax and position of those parmeters in cell configuration.

Configuration

In this test, I am using gnb-sa-uecap-all.cfg which is copied and modified from gnb-sa.cfg

UeCapability Test 2 Config 01

Following is the first part of the configuration added in gnb-sa-uecap.cfg under nr_cell_list. This section defines the serving NR cell before adding the UE Capability Enquiry related parameters. In this example, the configuration supports different cell settings depending on NR_TDD and FR2. For FR2, band 257 is used with DL NR ARFCN 2079167, 120 kHz SSB subcarrier spacing, and a long SSB position bitmap. For FR1 TDD, band 78 is used with DL NR ARFCN 632628, 30 kHz SSB subcarrier spacing, and SSB position bitmap 10000000. For the other FR1 case, band 7 is used with DL NR ARFCN 536020, 15 kHz SSB subcarrier spacing, 30 kHz data subcarrier spacing, and SSB position bitmap 1000. This part sets the basic serving cell condition, and the UE Capability Enquiry parameters added later will be applied under this nr_cell_list cell configuration.

In this example, all available UE Capability Enquiry related parameters are added under the same nr_cell_list configuration. This is mainly to show the syntax and the position of each parameter in the configuration file. It does not mean that all of these parameters should be enabled for a normal test case. The example includes ue_cap_rat_type with nr, eutra-nr, and eutra, NR band requests for n7, n78, and n79, EUTRA band requests for bands 1, 3, and 7, EUTRA CCS limits, reduced format request, EUTRA reduced inter-band non-contiguous combination request, NR-DC request, RRC segmentation support, single UE capability enquiry, SRS switching time request, uplink TX switching request, and UE assistance information. These settings are included as a full reference example based on the Amarisoft release available as of 2025-02-11, so you can later select only the parameters that are useful for your own test scenario.

Run and Check in the log

Run the test and check whether the configured parameters are properly included in the UE Capability Enquiry message.

In this example, requested_freq_bands_nr is configured with NR bands n7, n78, and n79. In the decoded UE Capability Enquiry message, these values are mapped into capabilityRequestFilter and shown under frequencyBandListFilter as bandInformationNR entries for bandNR 7, bandNR 78, and bandNR 79. The same log also shows that srs_switching_time_request is mapped into nonCriticalExtension as srs-SwitchingTimeRequest set to true. This confirms that the parameters added in the configuration file are reflected in the actual UE Capability Enquiry message sent by the Callbox.

Sample Log

In this screenshot, you will see how the parameters requested_freq_bands, request_reduce_format, requested_eutra_max_ccs_dl, requested_eutra_max_ccs_ul, request_eutra_reduced_int_non_cont_comb, mr_dc_request_nr_dc, uplink_tx_swich_request, srs_switch_time_request  and rrc_ul_segmentation_support are mapped to corresponding IEs in the message.

The requested_eutra_freq_bands setting is mapped to requestedFrequencyBands-r11 and shows EUTRA bands 1, 3, and 7. The request_reduced_format setting is mapped to requestReducedFormat-r13 true. The requested_eutra_max_ccs_dl and requested_eutra_max_ccs_ul settings are mapped to requestedMaxCCsDL-r13 4 and requestedMaxCCsUL-r13 2. The request_eutra_reduced_int_non_cont_comb setting is mapped to requestReducedIntNonContComb-r13 true. The mr_dc_request_nr_dc setting is mapped to includeNR-DC true under capabilityRequestFilterCommon. The uplink_tx_switch_request setting is mapped to uplinkTxSwitchRequest-r16 true, and rrc_ul_segmentation_support is mapped to rrc-SegAllowed-r16 enabled. This confirms that the configuration parameters are inserted into the proper UE Capability Enquiry IEs and that the Callbox generates the message according to the user-defined settings.

Then check the UE Capability Information message returned from the UE. Even when a specific capability item is requested in UE Capability Enquiry, the UE may not report the corresponding capability if the item is optional or if the UE does not support that feature. In this example, the UE Capability Information includes the appliedFreqBandListFilter with bandNR 7, bandNR 78, and bandNR 79, which confirms that the UE received and applied the requested NR band filter. However, the actual reported capability still depends on UE implementation and supported features. For example, the log shows supportedSRS-TxPortSwitch as notSupported, even though SRS switching time was requested in the enquiry. In another part of the decoded message, some requested capability areas are reported as supported, such as uplinkTxSwitchRequest-r16 true, rrc-SegAllowed-r16 enabled, dl-DedicatedMessageSegmentation-r16 supported, and full-RRC-Segmentation-r16 supported. This means UE Capability Enquiry can request information, but it does not force the UE to claim support. The final confirmation must always be done from the UE Capability Information message reported by the UE.

© 2025 All rights reserved | Legal notice |