5G NR gNB MAC — Complete Flow
Companion conversation log: 5G NR gNB MAC — Cross-Layer RRC Release Triage walks the same capture as a User ↔ Claude session.
Source pcap:
gnb_mac.pcapcomes from the Wireshark merge request wireshark/wireshark!12834.
Capture from the gNB radio side (DLT=149, MAC-NR / RLC-NR / PDCP-NR / NR-RRC / NAS-5GS over a synthetic UDP wrapper, srsRAN_Project style). 68 frames covering two consecutive UE radio sessions on the same gNB cell.
- Test PLMN: MCC=001 / MNC=01
- AS security: NEA0 ciphering / NIA2 integrity (lab profile)
- Bearers seen: SRB1, SRB2, DRB (LCID 4, 18-bit PDCP SN, AM RLC)
- Two UEs:
- UE-1 — C-RNTI
0x4601, ueid=1 — performs Initial Registration, then is released. - UE-2 — C-RNTI
0x4602, ueid=2 — performs Service Request (returning UE with 5G-S-TMSI0xe9003dcc), establishes a PDU session, sends a few UL DRB bursts, deregisters, and is released.
- UE-1 — C-RNTI
Timestamps in the capture begin 2023-10-27T06:29:27.945Z; UE-2 starts ~10.3 s after UE-1.
Session 1 — UE-1 (RNTI 0x4601): Initial Registration
| # | Frame | Dir | Layer | Event |
|---|---|---|---|---|
| 1 | 1 | UE→gNB | NR-RRC (CCCH/LCID 52) | RRC Setup Request — mo-Signalling, random e9dde06d… |
| 2 | 2 | gNB→UE | NR-RRC (CCCH/LCID 0) | RRC Setup — SRB1 added (AM, t-PollRetx=45 ms, sr-TransMax=64, periodicBSR=sf10), TAG/CORESET config |
| 3 | 3 | UE→gNB | NR-RRC (SRB1) + NAS-5GS | RRC Setup Complete + piggyback NAS Registration Request (initial, 5G-GUTI 0xc5003bc1) |
| 4 | 5 | gNB→UE | NAS-5GS | DL Info Transfer — Authentication Request |
| 5 | 7 | UE→gNB | NAS-5GS | UL Info Transfer — Authentication Response |
| 6 | 9 | gNB→UE | NAS-5GS | DL Info Transfer — NAS Security Mode Command |
| 7 | 10 | UE→gNB | NAS-5GS | UL Info Transfer — NAS Security Mode Complete + replay of Registration Request |
| 8 | 12 | gNB→UE | NR-RRC | AS Security Mode Command — cipher=nea0, integrity=nia2 |
| 9 | 13 | UE→gNB | NR-RRC | AS Security Mode Complete |
| 10 | 15 | gNB→UE | NAS-5GS | DL Info Transfer — Registration Accept |
| 11 | 16 | UE→gNB | NAS-5GS | UL Info Transfer — Registration Complete |
| 12 | 18 | gNB→UE | NAS-5GS | DL Info Transfer — Configuration Update Command |
Frames 4, 6, 8, 11, 14, 17, 19 are RLC AM Status PDUs (ACK_SN climbs 1→5 on SRB1, no NACKs).
RRC Release for UE-1 lands inside Session 2's timeline (see frames 24, 31, 32). Three back-to-back releases on RNTI 0x4601 with identical PDCP SN=5 / MAC-I 0x3cabf79f are RLC poll-retransmissions of one Release PDU. See Cross-layer release analysis below — this release is abnormal (radio-link loss), not a graceful teardown.
Session 2 — UE-2 (RNTI 0x4602): Service Request, Data, Deregistration
2a. RRC re-establishment & service authorisation
| # | Frame | Dir | Layer | Event |
|---|---|---|---|---|
| 1 | 20 | UE→gNB | NR-RRC (CCCH) | RRC Setup Request — mo-Data |
| 2 | 21 | gNB→UE | NR-RRC (CCCH) | RRC Setup — SRB1 config (same template as UE-1) |
| 3 | 22 | UE→gNB | NR-RRC + NAS-5GS | RRC Setup Complete + piggyback NAS Service Request (5G-S-TMSI 0xe9003dcc) |
| 4 | 25 | gNB→UE | NR-RRC | AS Security Mode Command — nea0 / nia2 |
| 5 | 26 | UE→gNB | NR-RRC | AS Security Mode Complete |
| 6 | 28 | gNB→UE | NAS-5GS | DL Info Transfer — Service Accept |
| 7 | 29 | UE→gNB | NAS-5GS | UL Info Transfer — UL NAS Transport carrying PDU Session Establishment Request |
2b. Capability exchange & DRB setup
| # | Frame | Dir | Layer | Event |
|---|---|---|---|---|
| 8 | 33 | gNB→UE | NR-RRC | UE Capability Enquiry (RAT=nr) |
| 9 | 35 | UE→gNB | NR-RRC | UE Capability Information — PowerClass pc2 |
| 10 | 37 | gNB→UE | NR-RRC | RRC Reconfiguration — adds SRB2 + DRB1 for PDU Session 1, QFI=1, default DRB, PDCP SN size 18-bit DL/UL, ROHC notUsed; SRB2 (LCID 2, AM, t-PollRetx=45 ms), DRB1 (LCID 4, AM, t-PollRetx=20 ms, pollPDU=16), dynamic HARQ-ACK codebook |
| 11 | 38 | UE→gNB | NR-RRC | RRC Reconfiguration Complete |
2c. User-plane (LCID 4 = DRB1) uplink burst
Frames 40–68 are UE→gNB PDCP PDUs on LCID 4 / DRB1, interleaved with gNB RLC AM Status ACKs (all ACK_SN=0, no NACKs — DRB just opened). The PDCP plane is reported as Signalling because the dissector cannot bind LCID 4 to a DRB without an explicit drb-pcap mapping, but the COUNT progression and pollPDU=16-driven Status requests are real.
- PDCP COUNTs observed (12-bit SN, shown as the dissector-emitted COUNT field):
- 128, 384, 640, 896, 1152, 1408, 1664, 1920, 2176, 2432, 2688, 2944, 3200, 3456, 3712, 3968, 128, 384, 640
- Polling pattern: every ~2nd PDU sets the RLC Poll bit (
Status report is requested), matching the configured pollPDU=16. - PHR stays steady at PH ≈ 22 dB, Pcmax ≈ 22 dBm through the burst; drops to PH ≈ 19 dB toward the end (frames 60+).
- All transmissions on HARQ pid 0, FDD uplink.
2d. Deregistration & release
| # | Frame | Dir | Layer | Event |
|---|---|---|---|---|
| 12 | 64 | UE→gNB | NAS-5GS (SRB2) | UL Info Transfer — Deregistration Request (UE-originating) |
| 13 | 66 | gNB→UE | NR-RRC | RRC Release (PDCP SN=4, MAC-I 0x21c437d8) |
| 14 | 67 | gNB→UE | NR-RRC | RRC Release — retransmit (poll-retx storm, UE already gone) |
| 15 | 68 | gNB→UE | NR-RRC | RRC Release — retransmit |
Cross-layer release analysis
The capture contains 6 RRC Release frames but only 2 distinct release events — one per UE. Each release is a single PDU retransmitted three times because RLC-AM keeps polling for a Status PDU that the UE will never send. The retx storms look alike on the surface but the root causes are very different:
| Event | UE | Frames | PDCP SN | MAC-I | Verdict |
|---|---|---|---|---|---|
| Release UE-1 | RNTI 0x4601 | 24, 31, 32 | 5 | 0x3cabf79f | Abnormal — radio-link loss |
| Release UE-2 | RNTI 0x4602 | 66, 67, 68 | 4 | 0x21c437d8 | Normal — switch-off deregistration |
UE-1 (0x4601) — abnormal release
Walking the layers:
- RRC. Last RRC procedure is Configuration Update Command at F18 (t = 28.249 s). No Configuration Update Complete ever arrives. Then nothing on
0x4601for ~10 s until the Release at F24 (t = 38.269 s). - PDCP. DL SRB1 PDU ordering: SN 0 = Auth Request (F5), SN 1 = NAS SMC (F9), SN 2 = AS SMC (F12), SN 3 = Registration Accept (F15), SN 4 = Configuration Update Command (F18), SN 5 = RRC Release (F24). The Release reuses the next sequential SN — F18 went on the wire as SN=4 and was never confirmed end-to-end.
- RLC. UE-1's UL Status PDU history: ACK_SN climbs 1, 1, 2, 3, 4, 5, 5. F19 (t = 28.265 s, ~16 ms after F18) is the last thing ever heard from UE-1, and it still reports ACK_SN=5 — i.e. it had not acked the Configuration Update Command. UE-1 went radio-silent immediately afterwards.
- MAC / timers. SRB1 was configured with
t-PollRetransmit=ms45,maxRetxThreshold=t8→ RLC max-retx should fire in ~360 ms. The 10-second gap before the Release is far longer than that, so the trigger is not RLC max-retx alone. Two consistent interpretations:- UE-1 declared upper-layer RLF on its own side (TS 38.331 §5.3.10.3, N310 → T310 expiry from physical-layer problems) and moved to RRC_IDLE autonomously within the silent window.
- The gNB held the UE in context against an inactivity timer (~10 s default in many srsRAN configs) and released by inactivity rather than by max-retx.
Verdict. No graceful NAS Deregistration, no Configuration Update Complete, no MAC CE indicating reattach. This is an inactivity / RLF-driven release of a UE that had silently dropped off the air. Confirmation would come from an NGAP capture showing UE Context Release Request with cause radio-connection-with-UE-lost (TS 38.413 §9.3.1.2), or a UE-side trace showing T310 expiry during the silent window.
UE-2 (0x4602) — normal release
Walking the layers:
- RRC. Last UE-2 RRC procedure is Deregistration Request (UE-originating) at F64 (t = 43.788 s). 7 ms later the gNB sends RRC Release at F66 (t = 43.795 s).
- PDCP. DL SRB1 PDU ordering is clean and sequential — SN 0 = AS SMC, SN 1 = Service Accept, SN 2 = UE Cap Enquiry, SN 3 = RRC Reconfiguration, SN 4 = RRC Release. Every prior PDU was acked (UE-2's Status PDUs walked ACK_SN to 5 on SRB1).
- NAS. The 7 ms gap between Deregistration Request and Release matches the NGAP round-trip: AMF receives Deregistration Request → sends
UE Context Release Command→ gNB issues RRC Release. Per TS 24.501 §5.5.2.2.5, when the UE sets the switch-off indicator it locally enters 5GMM-DEREGISTERED and moves to RRC_IDLE immediately after sending the Deregistration Request — without waiting for Deregistration Accept. - RLC. By the time the Release arrives over the air, UE-2 is already in RRC_IDLE and not monitoring SRB1. The Poll bit never gets an answer, so RLC-AM dutifully retransmits twice more (F67, F68).
Verdict. Textbook switch-off deregistration. The retx storm is a benign side-effect of the spec-compliant interaction between "UE goes silent immediately on switch-off" and "RLC-AM polls until max-retx".
Side-by-side summary
| UE-1 (0x4601) | UE-2 (0x4602) | |
|---|---|---|
| Last UE→gNB activity | F19 RLC Status (t=28.265 s) | F64 Deregistration Request (t=43.788 s) |
| Gap before Release | ~10 s of silence | 7 ms (NGAP round-trip) |
| Triggering DL PDU | Configuration Update Command (SN=4) un-ACKed | clean ack-chain through Reconfiguration, then Release |
| RLC max-retx fired? | Should have at ~360 ms but Release is 10 s later → gNB inactivity / RLF cleanup | N/A — UE moved to IDLE by NAS switch-off |
| UE state at Release | Already in IDLE due to UE-side RLF (N310/T310 expiry probable) | Already in IDLE due to NAS switch-off |
| Cause class | Abnormal — radio-link loss / inactivity cleanup | Normal — graceful deregistration |
Sessions index (from sessions.fxt)
All sessions are reported as incomplete::mid-capture because the radio side captures don't carry SCTP/IP teardown markers — the FXT uses auto-start so each per-bearer view is still rendered.
| Session type | Count | Per-UE breakdown |
|---|---|---|
| mac-ue | 2 | one per C-RNTI |
| rrc-connection | 2 | one per C-RNTI |
| pdcp-bearer | 3 | SRB1 ×2, DRB1 ×1 (UE-2 only) |
| rlc-bearer | 3 | same split as PDCP |
| nas-5gs | 2 | UE-1 initial-registration, UE-2 service-request |
Tooling
Templates used: bundled 5g-nr-radio/explore.fxt.xml and 5g-nr-radio/sessions.fxt.xml. Tshark flags: DLT=149→udp + all six MAC/RLC/PDCP LTE/NR heuristics + nas-5gs.null_decipher:TRUE (safe here because AS cipher is NEA0).
Source of the gnb_mac.pcap sample: Wireshark merge request !12834.