An LTE Attach and a VoLTE Call on the Air Interface, Layer by Layer

Reading a real srsRAN LTE capture taken at the eNB's MAC layer. Two phones attach to one cell, register with IMS, and call each other. The trace was decoded and annotated with VisualEther. Every security layer in it uses a null cipher, so no keys are needed: the radio stack, the core-network signaling, and even the SIP call inside IMS IPsec read in the clear.

💡 Read the walkthrough and the diagram side by side: open the interactive diagram in a split-screen window, or open it in a new tab and snap the two windows side by side.

Overview

The capture is 3,380 frames over 113 seconds from one srsRAN eNB, connected to an EPC and an IMS core. Two phones are on the cell, C-RNTI 70 and C-RNTI 71. Each one attaches, opens an internet PDN and an IMS PDN, and registers with IMS. Then they call each other six times. Each call adds a voice bearer for its duration and removes it at hang-up.

Three facts shape what you will read:

• Every cipher is null. NAS security uses EEA0 (null ciphering) with EIA2 integrity, and so does radio (AS) security. The IMS IPsec tunnel that protects SIP negotiates ealg=null with HMAC-SHA-1 integrity. Each layer authenticates its traffic but encrypts nothing. That is unusual outside a lab, and it is what makes the whole call readable: the SIP INVITE, the SDP codec negotiation, and the AMR-WB voice packets.
• The capture was re-tagged so Wireshark can tell the phones apart. srsRAN labels every frame UEId=0, so Wireshark tracks both phones' RLC and PDCP as one UE. That produces false retransmission warnings, wrong PDCP COUNTs, and SIP messages that never reassemble. A small script set each frame's UEId to its C-RNTI; nothing else in the file changes. Why Wireshark needs this is explained near the end.
• The diagram is a windowed cut. The full capture renders as about 3,900 messages, most of them voice packets and RLC acknowledgements. The annotated diagram keeps 166: both attaches, UE 70's IMS registration, and the first call from dial to hang-up. It uses the original Wireshark frame numbers, so you can check any claim against the issue's file. The other five calls repeat the pattern.

In the interactive viewer or the HTML sequence diagram above, click any message to open its parameters and the full Wireshark field tree for that frame.

A primer on the LTE radio stack

Here is the layer cake every frame rides on, from application intent at the top down to the radio at the bottom.

Each layer talks to its peer on the other side of the link. The control plane and the user plane share PDCP, RLC, MAC, and PHY. They differ at the top, and in where they end in the core. NAS signaling runs between the UE and the MME, relayed through the eNB. User data leaves the eNB over S1-U to the serving and PDN gateways.

Key ideas from this stack:

Signaling bearers and data bearers. Control messages travel on Signaling Radio Bearers: SRB1 from the start, and SRB2, added with the first reconfiguration for NAS traffic. User data travels on Data Radio Bearers. In LTE each EPS bearer, the core network's unit of QoS, maps one-to-one onto a DRB. LTE has no SDAP layer. (5G added SDAP to map several QoS flows onto one DRB.)

QCI. Every EPS bearer carries a QoS Class Identifier. You will see three. QCI 9 is best-effort internet data. QCI 5 is IMS signaling. QCI 1 is conversational voice, with a guaranteed bit rate. Each phone holds DRB 1 for internet and DRB 2 for SIP, plus a voice DRB for the length of each call: DRB 3 for the first call, and the next number for each call after that, up to DRB 8.

RLC acknowledged and unacknowledged mode. SRBs and the two data bearers run RLC AM: each PDU has a sequence number, the receiver returns Status PDUs with a cumulative ACK_SN, and missing PDUs are resent. The voice bearer runs RLC UM, which keeps sequence numbers for reordering but never acknowledges or retransmits. A voice packet that arrives late is useless, so retransmitting it would only add delay.

Three security contexts. NAS security is negotiated between the UE and the MME, and AS security between the UE and the eNB. IMS IPsec runs between the UE and the P-CSCF, inside the user plane. Each has its own handshake and keys. Here all three pick a null cipher, so everything stays readable.

Follow one protocol at a time

This page interleaves every layer on one timeline. Each companion page follows one protocol on its own, with its own annotated diagram, ordered here from the bottom of the stack upward. The last card leaves the radio for the core network: the eNB also logged its S1AP link to the MME during the same run, on the same clock.

The flow at a glance

The cut follows nine phases. The interactive diagram shows every arrow.

1. UE 70 onto the cell (frames 1–5): random access, RRC Connection Setup, and the Attach Request.
2. Identify, authenticate, secure (frames 6–18): Identity, Authentication, NAS Security Mode, AS Security Mode.
3. Capabilities and the default bearer (frames 19–29): UE capabilities, Attach Accept, DRB 1.
4. The IMS PDN (frames 30–35): a second default bearer, QCI 5 on DRB 2.
5. IMS registration (frames 36–68): SIP REGISTER in the clear, the 401 challenge, the protected REGISTER inside ESP.
6. UE 71 attaches (frames 301–518): the same sequence, with one difference.
7. Call setup (frames 821–983): INVITE, 183, the QCI-1 bearer on both phones, PRACK, UPDATE, 180 Ringing, 200 OK.
8. Voice (frames 985–1003): AMR-WB RTP on DRB 3, 20 ms per frame.
9. Hang-up (frames 1143–1156): BYE, and the voice bearer torn down on both phones.

The capture drives three state machines. On the radio side, each phone goes from idle to connected and stays there: srsRAN never releases them.

In the core, the EMM state machine tracks registration. Unlike the 5G capture this page parallels, nothing is hidden here. The Attach Accept is readable, so the move to EMM-REGISTERED can be confirmed in frame 24.

The bearers have their own life cycle. The two default bearers live as long as the attach, while the voice bearer exists only for the length of each call.

Phase 1 — Onto the cell (frames 1–5)

Frame 1 — Random Access Response (Msg2). The UE's preamble (Msg1) is a physical-layer event and does not appear in a MAC capture. The eNB answers preamble 0x24 on RA-RNTI 2, an identity derived from when the preamble arrived. It assigns Temporary C-RNTI 70, a Timing Advance, and an uplink grant for Msg3.

Frame 2 — RRC Connection Request (Msg3). The UE speaks on the common control channel (CCCH, LCID 0) with a random identity value and cause mo-Signalling: the UE wants to talk to the core network.

Frame 3 — Contention resolution + RRC Connection Setup (Msg4). A MAC control element (LCID 0x1c) echoes the UE's Msg3 bytes, so the UE knows it won the random access. The RRC part installs SRB1 and the MAC reporting rules: a buffer status report every 20 subframes, a power headroom report every 50.

Frame 4 — RRC Connection Setup Complete. The UE is now RRC_CONNECTED. Inside the RRC message rides the first NAS message, an Attach Request (combined EPS/IMSI attach) with a PDN Connectivity Request. The UE identifies itself with an old GUTI, a temporary identity from an earlier attach.

Frame 5 is the first RLC Status PDU: the eNB confirms SRB1 data up to ACK_SN 1. These acknowledgements run through every reliable exchange that follows.

Phase 2 — Identify, authenticate, secure (frames 6–18)

Frames 6–7 — Identity. The MME does not recognize the GUTI, so it asks for the permanent identity. The answer is IMSI 001011234567895, on the 3GPP test network (MCC 001, MNC 01).

Frames 9 and 11 — Authentication. The MME sends a challenge and the UE's SIM answers with RES. A correct answer proves the SIM holds the subscriber key and leaves both sides with the same root key, K_ASME.

Frames 13–14 — NAS security. The MME picks EEA0 for ciphering and 128-EIA2 (AES-CMAC) for integrity. From frame 14 on, NAS messages carry a security header that says "integrity protected and ciphered", but the cipher is null, so the body is plaintext. That is why the Attach Accept below is readable.

Frames 16–17 — AS security. The eNB runs the other Security Mode procedure, for the radio link: again eea0 / eia2. From here, every PDCP PDU on an SRB carries a real integrity tag (MAC-I 0xd8c5635b in frame 19), but no data is encrypted. Two procedures, two key sets, one for the core and one for the radio.

Phase 3 — Capabilities and the default bearer (frames 19–29)

Frames 19–23 — UE capabilities. The eNB asks what the UE supports. The answer is too big for one uplink grant, so RLC splits it into three segments: SN 5 (frame 20), SN 6 (frame 21), and SN 7 (frame 22). The framing-info bits mark them first, middle, and last. The reassembled report says release 12, UE category 4. Frame 23's Status PDU, ACK_SN 8, confirms all three arrived.

Frame 24 — Attach Accept and DRB 1. One RRC Connection Reconfiguration carries the NAS Attach Accept and Activate Default EPS Bearer Context Request: APN internet, QCI 9, EPS bearer 5. The RRC side builds the matching radio bearer, DRB 1 on LCID 3 in RLC AM, and adds SRB2. The UE asked for IPv4v6; ESM cause 50 tells it only IPv4 is allowed.

Frame 27 — Attach Complete. The UE confirms the reconfiguration, and in the same MAC PDU sends Attach Complete on the new SRB2. UE 70 is attached, with an address on the internet PDN. Frame 29's EMM Information carries the network name and time zone.

Phase 4 — The IMS PDN (frames 30–35)

Voice over LTE needs a separate PDN for IMS. 0.2 s after attaching, the UE asks for the ims APN (frame 30). Frame 32 delivers a second default bearer: QCI 5, EPS bearer 6, on DRB 2 / LCID 4. The same message's protocol options give the UE the address of its P-CSCF, the IMS entry point. UE 70 now holds two addresses: 192.168.100.2 on internet and 192.168.101.2 on IMS.

Phase 5 — IMS registration (frames 36–68)

Frames 36–44 — REGISTER in the clear. The first packet on DRB 2 is a TCP SYN to the P-CSCF at 172.22.0.21, port 5060. Over that connection the UE sends a SIP REGISTER, split across two TCP segments (frames 40 and 42). No security exists yet, so it travels in the clear. Its Security-Client header offers four IPsec suites, HMAC-MD5 or HMAC-SHA-1, each with AES-CBC or null encryption.

Frame 48 — The 401 challenge. The P-CSCF answers 401 Unauthorized with an IMS-AKA challenge (AKAv1-MD5). Its Security-Server header picks hmac-sha-1-96 with ealg=null: the IPsec tunnel will authenticate SIP but not encrypt it.

Frames 63–68 — Protected REGISTER. The second REGISTER goes inside ESP, from the UE's protected client port 53360 to the P-CSCF's server port 6100. Its SPI, 0x00001001 (4097), is the spi-s the P-CSCF chose in frame 48. Downlink packets use 0x0db517d8, which is 229971928, the spi-c the UE offered in frame 42. The 200 OK in frame 68 completes registration, 2.3 s after UE 70's first random access.

Phase 6 — UE 71 attaches (frames 301–518)

14.5 s later, the second phone runs the same sequence: random access with Temporary C-RNTI 71, identity, authentication, both Security Mode procedures, capabilities, Attach Accept, and an IMS PDN (frames 511–516). Its IMSI is 001011234567896. Its capability report fits in one frame and says release 10: an older phone than UE 70.

One step differs. UE 71 sets the ESM information transfer flag in its Attach Request (frame 304). The flag asks the MME to collect the PDN details later, once NAS security protects them. So after the NAS Security Mode Complete, the MME sends an ESM Information Request (frame 316) and gets the details in frame 317. UE 70 left the flag clear, so its PDN request needed no second round.

Phase 7 — Call setup (frames 821–983)

At 23.4 s, UE 70 dials. Every SIP message rides DRB 2 inside ESP, between the phone and the P-CSCF. The null encryption chosen in frame 48 is what makes them readable.

Frame 821 — INVITE. UE 70 calls tel:0698765432100. Its SDP offer lists three codecs: EVS, AMR-WB, and AMR. It also sets QoS preconditions (des:qos mandatory, curr:qos none): the call must not ring until both ends have a voice bearer. The INVITE was segmented by RLC across several frames. Only the re-tagged capture reassembles it.

Frame 839 — 183 Session Progress. UE 71 answers with its SDP: AMR-WB (payload type 99), 20 ms per packet, preconditions still unmet. The answer settles the codec and the media ports, which is what the IMS core needs to authorize a voice bearer.

Frames 844 and 846 — The voice bearer. 8 ms after the 183 leaves UE 71, the eNB reconfigures it with Activate Dedicated EPS Bearer Context Request. 6 ms later UE 70 gets the same bearer:

• QCI 1, EPS bearer 7, a guaranteed 80 kbps each way,
• a traffic flow template whose packet filters match the RTP ports, so only voice enters this bearer,
• on the radio side, DRB 3 on LCID 5 in RLC UM, with a 10-bit RLC sequence number, 50 ms reordering timer, 12-bit PDCP sequence number, and 100 ms PDCP discard timer.

The 183 reaches UE 70 in frame 845. Its SDP no longer points at UE 71: it says c=IN IP4 172.22.0.16, port 49016. The IMS core rewrote the answer so that media flows through its relay at 172.22.0.16, not directly between the phones.

Here is frame 844's complete decoded field tree. Expand any node to open it:

Frame 844, eNB → UE 71. One RRC Connection Reconfiguration carries both halves of the voice bearer: the NAS Activate Dedicated EPS Bearer Context Request for the core network, and the DRB 3 radio configuration for the eNB and UE.

Frames 852–892 — Preconditions met, then ringing. UE 70 sends PRACK to acknowledge the reliable 183. Then it sends UPDATE (frame 872) to say its own voice bearer is in place. UE 71 answers 200 OK (frame 886). Only then, with both preconditions satisfied, does it send 180 Ringing (frame 889). This ordering is the point of preconditions: a phone that rings before its voice bearer exists could be answered into silence.

Frames 973–983 — Answer. UE 71 answers with 200 OK 1.6 s after ringing, and UE 70's ACK completes the INVITE transaction.

Phase 8 — Voice (frames 985–1003)

24 ms after the ACK, the first RTP packet leaves UE 70 on DRB 3 (frame 985): AMR-WB, PDCP SN 0 on the new bearer. 0.7 ms later the relay's copy reaches UE 71 on its own DRB 3 (frame 986), with the same RTP sequence number. The next packets follow 20 ms apart, matching the ptime:20 in the SDP. UE 71's reverse stream starts at frame 1002.

The 20 ms pace doesn't last. After seven speech packets, UE 70's stream drops to one small packet every 160 ms: 27 bytes of UDP instead of 53. That's AMR-WB silence suppression. When nobody is talking, the codec stops sending speech and sends a comfort-noise update every eighth frame instead, so the far end can play matching background noise. These lab phones spend most of the call in silence.

Compare these frames with the SIP frames on DRB 2. The voice PDUs carry no RLC poll bit and get no RLC Status PDUs, because RLC UM has neither. Meanwhile DRB 2 keeps its acknowledgements running: frame 988 is an RLC status for UE 71's signaling bearer, in the middle of the voice packets. The call lasts about 4.5 s.

Phase 9 — Hang-up (frames 1143–1156)

UE 71 hangs up with a BYE (frame 1143). 9 ms later both phones receive Deactivate EPS Bearer Context Request for bearer 7, cause "regular deactivation". In the same RRC messages, DRB 3 appears in drb-ToReleaseList (frames 1146–1147). The BYE reaches UE 70 in frame 1149, and UE 70's 200 OK closes the dialog (frames 1154 and 1156).

After that, each phone is back to its two default bearers. The same cycle runs five more times. The second call goes the other way, with UE 71 dialing. The capture ends at 113 s with both phones still connected.

Why the capture was re-tagged

srsRAN writes each frame with a MAC-LTE framing header that includes a UE identity tag. It always writes 0. Wireshark uses that tag, not the C-RNTI, to keep each UE's RLC and PDCP state apart. With two phones on the cell, it merged them. In the original file, that shows up three ways:

• False retransmissions. Wireshark flags PDCP "SN repeated" and RLC "AM frame retransmitted" when one phone's sequence numbers interleave with the other's. Frame 854, for example, is flagged as a repeat of PDCP SN 25. The earlier SN 25 belonged to the other phone.
• Wrong PDCP COUNTs. COUNT combines the sequence number with a counter that increases each time the number wraps. Interleaved sequence numbers look like wraps, so UE 71's first DRB 1 packets showed COUNTs above 4,000 a few seconds after attaching.
• Lost SIP messages. RLC reassembly mixes segments from both phones and fails. Call 1's INVITE never decoded at all.

The fix sets the UE identity tag of each C-RNTI frame to its C-RNTI. Nothing else in the file changes. The lesson applies to any multi-UE capture: before trusting an analysis flag, check that the tool is tracking UEs the way you think it is.

Takeaways

1. An attach has a sequence. Random access → RRC setup → identity and authentication → NAS security → AS security → capabilities → default bearer.
2. LTE secures the core and the radio separately. NAS and AS each run their own Security Mode handshake. IMS adds a third layer, IPsec, negotiated in SIP headers.
3. One EPS bearer, one radio bearer. Each bearer the core creates (QCI 9 internet, QCI 5 IMS, QCI 1 voice) gets its own DRB with its own RLC and PDCP entities.
4. SIP drives the radio. The 183 answer leads to the QCI-1 bearer, preconditions hold the 180 Ringing back until both bearers exist, and the BYE leads to the bearer's release. The three steps sit milliseconds apart on the wire.
5. Voice uses RLC UM. No acknowledgements and no retransmissions: on a voice bearer, a late packet is worse than a lost one.
6. Check what the tool assumes. A capture-format detail, a constant UE identity tag, was enough to fake retransmissions and hide a SIP INVITE.