LTE信令分析
一、概述：
本文信令内容为2011年6月杭州LTE实验网期间，采用NSN的网络设备，数据卡终端为创毅，测试软件使用CDS吐出的信令内容。由于试验网期间网络、终端、测试软件都没有完全成熟，所以信令内容只局限于现有试验网阶段。
以下是终端空闲态、RRC连接态做业务涉及到的所有信令内容。从消息看主要是无线资源控制层RRC消息和非接入层NAS消息。NAS高层消息不再多做描述，主要对RRC层消息做简单介绍。
RRC: RRCConnectionRequest
RRC: RRCConnectionSetup
NAS: Attach Request
NAS: Authentication Request
NAS: Authentication Response
NAS: Security Mode Command
NAS: Security Mode Complete
RRC: UECapabilityEnquiry
RRC: UECapabilityInformation
NAS: Attach Accept
RRC: RRCConnectReconfigurationComplete
NAS: Attach Complete
RRC: RRCConnectionRelease
RRC: MasterInformationBlock
RRC: Paging
RRC: MeasurementReport
二、信令流程
1.切换流程：待补充
2.重选信令流程
重选过程是RRC空闲状态下的流程，只有2条信令：RRC: RRCConnectionRequest、RRC: MasterInformationBlock。如下图所示：
3.FTP信令流程：待补充
三、详细信令
1.RRC层信令内容
业务和功能
广播和 NAS 相关的系统消息
广播和 AS 相关的系统消息
寻呼
建立、维护和释放终端和 E-UTRAN 之间的RRC 链接包括分配临时的终端标识，配置
信令承载
安全功能包括密钥的管理
建立、维护和释放点对点的无线承载
移动性管理功能，包括测量控制和上报、切换、小区选择和重选、切换时 RRC 上下文
传递
广播 MBMS 业务
建立、维护和释放 MBMS 无线承载
QoS 管理功能
终端测量控制和上报
上下行透明传递 NAS 消息
1)RRC: RRCConnectionRequest
Message type: CCCH_UL
Direction: Uplink
Computer Timestamp: 14:57:41.890
uL-CCCH-Message
message
c1
rrcConnectionRequest
criticalExtensions
rrcConnectionRequest-r8
ue- Identity
randomValue: 1101110111011101110111011101110111011101
establishmentCause : mo-Signalling
spare : 0
5D DD DD DD DD D6
主要内容：终端身份、建立原因。
2)RRC: RRCConnectionSetup
Message type: CCCH_DL
Direction: Downlink
Computer Timestamp: 14:57:41.937
dL-CCCH-Message
message
c1
rrcConnectionSetup
rrc-TransactionIdentifier : 2
criticalExtensions
c1
rrcConnectionSetup-r8
radioResourceConfigDedicated
srb-ToAddModList
SRB-ToAddMod
srb-Identity : 1
rlc-Config
explicitValue
am
ul-AM-RLC
t-PollRetransmit : ms100
pollPDU : pInfinity
pollByte : kBinfinity
maxRetxThreshold : t16
dl-AM-RLC
t- Reordering : ms50
t- StatusProhibit : ms0 logicalChannelConfig : defaultValue
mac-MainConfig
explicitValue
ul-SCH-Config
maxHARQ-Tx : n4 periodicBSR -Timer : infinity retxBSR-Timer : sf2560 ttiBundling : false timeAlignmentTimerDedicated : sf10240 physicalConfigDedicated pdsch -ConfigDedicated p-a : dB0 pusch -ConfigDedicated betaOffset-ACK-Index : 10 betaOffset-RI-Index : 3 betaOffset-CQI-Index : 8 uplink PowerControl Dedicated p0-UE-PUSCH : 2 deltaMCS-Enabled : en0 accumulationEnabled : true p0-UE-PUCCH : 2 pSRS-Offset : 7 filterCoefficient : fc4 cqi-Report Config cqi-ReportModeAperiodic : rm30 nomPDSCH-RS-EPRE-Offset : 0 cqi-ReportPeriodic setup cqi-PUCCH-ResourceIndex : 4 cqi-pmi-ConfigIndex : 8 cqi-FormatIndicatorPeriodic : widebandCQI simultaneousAckNackAndCQI : false soundingRS -UL-ConfigDedicated setup srs-Bandwidth : bw0 srs-HoppingBandwidth : hbw0 freqDomainPosition : 0 duration : true srs-ConfigIndex : 21 transmissionComb : 1 cyclicShift : cs4 antenna Info explicitValue transmissionMode : tm2 ue-TransmitAntennaSelection : release schedulingRequestConfig
setup
sr-PUCCH-ResourceIndex : 32
sr-ConfigIndex : 13
dsr-TransMax : n64
70 12 98 13 FD 94 04 99 F3 65
9F 28 E1 4D 3E CC 01 00 82 00
82 B8 14 10 06 C0
主要内容：RLC层、MAC层、PHY层各种参数配置。
3)RRC: UECapabilityEnquiry
Message type: DCCH_DL
Direction: Downlink
Computer Timestamp: 14:57:42.296
dL-DCCH-Message
message
c1
ueCapabilityEnquiry
rrc-TransactionIdentifier : 2
criticalExtensions
c1
ueCapabilityEnquiry-r8
ue-CapabilityRequest : eutra
主要内容：UE能力询问
4)RRC: UECapabilityInformation
Message type: DCCH_UL
Direction: Uplink
Computer Timestamp: 14:57:42.296
uL-DCCH-Message
message
c1
ueCapabilityInformation
rrc-TransactionIdentifier : 2
criticalExtensions
c1
ueCapabilityInformation-r8
ue-CapabilityRAT-ContainerList
UE-CapabilityRAT-Containe r
rat-Type : eutra
ueCapabilityRAT-Container : 81000019d2810381d183********
3C 01 00 E8 10 00 01 9D 28 10
38 1D 18 34 42 00 00 00
主要内容：UE能力
5)RRC: RRCConnectionReconfiguration
Message type: DCCH_DL
Direction: Downlink
Computer Timestamp: 15:20:36.000
dL-DCCH-Message
message
c1
rrcConnectionReconfiguration
rrc-TransactionIdentifier : 1
criticalExtensions
c1
rrcConnectionReconfiguration-r8
measConfig
measObjectToAddModList
MeasObjectToAddMod
measObjectId : 1
measObject
measObjectEUTRA
carrierFreq : 38050
allowedMeasBandwidth : mbw100
presenceAntennaPort1 : true
neighCellConfig : 00
offsetFreq : dB0 reportConfigToAddModList
ReportConfigToAddMod
reportConfigId : 1
reportConfig
reportConfigEUTRA
triggerType
event
eventId
eventA3
a3-Offset : 4
reportOnLeave : false
hysteresis : 0
timeToTrigger : ms320
triggerQuantity : rsrp
reportQuantity : sameAsTriggerQuantity
maxReportCells : 8
reportInterval : ms1024
reportAmount : infinity
ReportConfigToAddMod
reportConfigId : 2
reportConfig
reportConfigEUTRA
triggerType
event
eventId
eventA5
a5-Threshold1
threshold-RSRP : 60
a5-Threshold2
threshold-RSRP : 62
hysteresis : 0
timeToTrigger : ms480
triggerQuantity : rsrp
reportQuantity : sameAsTriggerQuantity
maxReportCells : 8
reportInterval : ms240
reportAmount : infinity
ReportConfigToAddMod
reportConfigId : 3
reportConfig
reportConfigEUTRA
triggerType
event
eventId
eventA2
a2-Threshold
threshold-RSRP : 1
hysteresis : 0
timeToTrigger : ms256
triggerQuantity : rsrp
reportQuantity : sameAsTriggerQuantity
maxReportCells : 8
reportInterval : min60
reportAmount : r1
measIdToAddModList
MeasIdToAddMod
measId : 1
measObjectId : 1
reportConfigId : 1
MeasIdToAddMod
measId : 2
measObjectId : 1
reportConfigId : 2
MeasIdToAddMod
measId : 4
measObjectId : 1
reportConfigId : 3
quantityConfig
quantityConfigEUTRA
filterCoefficientRSRP : fc4
filterCoefficientRSRQ : fc4 measGapConfig : release
s-Measure : 90
speedStatePars
setup
mobilityStateParameters
t-Evaluation : s180
t-HystNormal : s180
n-CellChangeMedium : 8
n-CellChangeHigh : 8
timeToTrigger-SF
sf-Medium : oDot5
sf-High : oDot5 radioResourceConfigDedicated
srb-ToAddModList
SRB-ToAddMod
srb-Identity : 2
rlc-Config
explicitValue
am ul-AM-RLC t-PollRetransmit : ms100 pollPDU : pInfinity pollByte : kBinfinity maxRetxThreshold : t16 dl-AM-RLC t-Reordering : ms50 t-StatusProhibit : ms0 logicalChannelConfig : defaultValue drb-ToAddModList DRB-ToAddMod eps-BearerIdentity : 5 drb-Identity : 4 pdcp-Config discardTimer : ms300 rlc-AM statusReportRequired : true headerCompression : notUsed rlc-Config am ul-AM-RLC t-PollRetransmit : ms250 pollPDU : p16 pollByte : kB25 maxRetxThreshold : t16 dl-AM-RLC t-Reordering : ms50 t-StatusProhibit : ms50 logicalChannelIdentity : 4 logicalChannelConfig ul-SpecificParameters priority : 10 prioritisedBitRate : kBps16 bucketSizeDuration : ms100 logicalChannelGroup : 2 mac-MainConfig explicitValue ul-SCH-Config periodicBSR-Timer : sf10 retxBSR-Timer : sf320 ttiBundling : false timeAlignmentTimerDedicated : sf10240 phr-Config
setup
periodicPHR-Timer : sf200
prohibitPHR-Timer : sf100
dl-PathlossChange : dB6
physicalConfigDedicated
cqi-ReportConfig
cqi-ReportModeAperiodic : rm30
nomPDSCH-RS-EPRE-Offset : 0
cqi-ReportPeriodic
setup
cqi-PUCCH-ResourceIndex : 3
cqi-pmi-ConfigIndex : 9
cqi-FormatIndicatorPeriodic :
simultaneousAckNackAndCQI : true
soundingRS-UL-ConfigDedicated
setup
srs-Bandwidth : bw0
srs-HoppingBandwidth : hbw0
freqDomainPosition : 0
duration : true
srs-ConfigIndex : 15
transmissionComb : 1
cyclicShift : cs7
antennaInfo
explicitValue
transmissionMode : tm2
ue-TransmitAntennaSelection : release
6)RRC: RRCConnectReconfigurationComplete
Message type: DCCH_UL
Direction: Uplink
Computer Timestamp: 14:57:42.406
uL-DCCH-Message
message
c1
rrcConnectionReconfigurationComplete
rrc-TransactionIdentifier : 1
criticalExtensions : rrcConnectionReconfigurationComplete-r8
12 00
主要内容：RRC重配消息确认。
7)RRC: RRCConnectionRelease
Message type: DCCH_DL
Direction: Downlink
Computer Timestamp: 14:58:12.546
dL-DCCH-Message
message
c1
rrcConnectionRelease
rrc-TransactionIdentifier : 3
criticalExtensions
c1
rrcConnectionRelease-r8
releaseCause : other
主要内容：RRC释放消息
8)RRC: MasterInformationBlock
Message type: BCCH_BCH
Direction: Downlink
Computer Timestamp: 14:58:12.890
bCCH-BCH-Message
message
dl-Bandwidth : n6 ______a) 下行系统带宽【4 比特】
phich-Config_________b) PHICH 资源指示【3 比特】
phich-Duration : normal
phich-Resource : oneSixth
systemFrameNumber : 11101011_________2) 系统帧号
spare : 1010100111
03 AE A7 AC 00 DE
【MIB，约31 比特】，在PBCH 上传输，携带下列信息：
1) 物理层参数：
a) 下行系统带宽【4 比特】
b) PHICH 资源指示【3 比特】
2) 系统帧号（SFN【8 比特】，除非通过另外的方式提供）
3) CRC【16 比特】
SIB 系统信息在DL-SCH 上传输。按照调度要求（例如：周期）的不同，这些信息又分
在若干个SI 上传输，系统最少支持4 个SI（即SI-1、SI-2、SI-3、SI-4），SI 的信息不做“分段”，但可能使用重传机制，最大TB 大小约为1200bit。
9)RRC: Paging
Message type: PCCH
Direction: Downlink
Computer Timestamp: 15:07:24.234
pCCH-Message
message
c1
paging
pagingRecordList
PagingRecord
ue-Identity
s-TMSI
mmec : 00000001
m-TMSI : 11000001000000000000101000101100
cn-Domain : ps
主要内容：TMSI\ Domain
10)RRC: MeasurementReport
Message type: DCCH_UL
Direction: Uplink
Computer Timestamp: 15:11:32.781
uL-DCCH-Message
message
c1
measurementReport
criticalExtensions
c1
measurementReport-r8
measResults
measId : 1
measResultServCell
rsrpResult : 41
rsrqResult : 26
measResultNeighCells
measResultListEUTRA
MeasResultEUTRA
physCellId : 37
measResult
rsrpResult : 44
主要内容：切换上报
2.NAS层信令内容
1)NAS: Attach Request
Message type: EPS MM
Direction: Uplink
Computer Timestamp: 14:57:41.937
uL-DCCH-Message
message
c1
rrcConnectionSetupComplete
rrc-TransactionIdentifier : 2
criticalExtensions
c1
rrcConnectionSetupComplete-r8
selectedPLMN-Identity : 1
dedicatedInfoNAS : 07417108490680000200003105e0e0000000001d0201d011271780802110010000108106000000 00830600000000000a00
Attach Request
Security header type: (0) Plain NAS message, not security protected
protocol_discriminator : EPS Mobility Management
NAS EPS Mobility Management Message Type : (0x41) Attach request
Type of security context flag (TSC): (0) Native security context
NAS key set identifier: (7) No key is available
Spare bit(s): 0
EPS attach type: (1) EPS attach
EPS mobile identity - Old GUTI or IMSI
Length : 8 octets
odd/even indic: 1
Type of identity: (1) IMSI
IMSI: 460080020000013
UE network capability
Length : 5 octets
EEA0: (1) Support
128-EEA1: (1) Support
128-EEA2: (1) Support
EEA3: (0) Not support
EEA4: (0) Not support
EEA5: (0) Not support
EEA6: (0) Not support
EEA7: (0) Not support
EIA0: (1) Support
128-EIA1: (1) Support
128-EIA2: (1) Support
EIA3: (0) Not support
EIA4: (0) Not support
EIA5: (0) Not support
EIA6: (0) Not support
EIA7: (0) Not support
UEA0: (0) Not support
UEA1: (0) Not support
UEA2: (0) Not support
UEA3: (0) Not support
UEA4: (0) Not support
UEA5: (0) Not support
UEA6: (0) Not support
UEA7: (0) Not support
UCS2 support (UCS2): (0) Not support
UMTS integrity algorithm UIA1: (0) Not support
UMTS integrity algorithm UIA2: (0) Not support
UMTS integrity algorithm UIA3: (0) Not support
UMTS integrity algorithm UIA4: (0) Not support
UMTS integrity algorithm UIA5: (0) Not support
UMTS integrity algorithm UIA6: (0) Not support
UMTS integrity algorithm UIA7: (0) Not support
1xSRVCC capability: (0) SRVCC from E-UTRAN to cdma2000 1xCS Not supported ESM message container
Length : 29 octets
ESM message container contents: 2 1 d0 11 27 17 80 80 21 10 1 0 0 10 81 6 0 0 0 0 83 6 0 0 0 0 0 a 0
0000 .... = EPS bearer identity : 0
.... 0010 = protocol_discriminator : (2) EPS session management messages
Procedure transaction identity : 1
NAS EPS session management messages : (0xd0) PDN connectivity request
PDN type: (1) IPv4
Request type: (1) Initial attach
Protocol Configuration Options
Element ID : 39
Length : 23 octets
Ext: 1
Configuration protocol: (0) PPP
Protocol information:
[0]:
Protocol ID : IPCP (Hex 8021)
Contents length: 16 octets
Protocal contents: (Hex) 01 00 00 10 81 06 00 00 00 00 83 06 00 00
00 00
[1]:
Protocol ID : (Hex A)
Contents length: 0 octets
Protocal contents: (Hex)
24 00 62 0E 82 E2 10 92 0D 00
00 04 00 00 62 0B C1 C0 00 00
00 00 3A 04 03 A0 22 4E 2F 01
00 42 20 02 00 00 21 02 0C 00
00 00 01 06 0C 00 00 00 00 00
14 00
2)NAS: Authentication Request
Message type: EPS MM
Direction: Downlink
Computer Timestamp: 14:57:42.093
dL-DCCH-Message
message
c1
dlInformationTransfer
rrc-TransactionIdentifier : 2
criticalExtensions
c1
dlInformationTransfer-r8
dedicatedInfoType
dedicatedInfoNAS : 07520353abd81891fd7f9327048a3cab884e9610ce14e4f135c480ffbad2774214923ed2 Authentication Request
Security header type: (0) Plain NAS message, not security protected
protocol_discriminator : EPS Mobility Management
NAS EPS Mobility Management Message Type : (0x52) Authentication request
Spare bit(s): 0
Type of security context flag (TSC): (0) Native security context
NAS key set identifier: (3) ASME
Authentication Parameter RAND
RAND value: 53 ab d8 18 91 fd 7f 93 27 4 8a 3c ab 88 4e 96
Authentication Parameter AUTN (UMTS authentication challenge only) - EPS challenge Length : 16 octets
AUTN value: ce 14 e4 f1 35 c4 80 ff ba d2 77 42 14 92 3e d2
SQN xor AK: ce 14 e4 f1 35 c4
AMF: 80 ff
MAC: ba d2 77 42 14 92 3e d2
0C 01 20 3A 90 1A 9D 5E C0 C4
8F EB FC 99 38 24 51 E5 5C 42
74 B0 86 70 A7 27 89 AE 24 07
FD D6 93 BA 10 A4 91 F6 90
3)NAS: Authentication Response
Message type: EPS MM
Direction: Uplink
Computer Timestamp: 14:57:42.187
uL-DCCH-Message
message
c1
ulInformationTransfer
criticalExtensions
c1
ulInformationTransfer-r8
dedicatedInfoType
dedicatedInfoNAS : 0753084acce9a1e6f317d4 Authentication Response
Security header type: (0) Plain NAS message, not security protected
protocol_discriminator : EPS Mobility Management
NAS EPS Mobility Management Message Type : (0x53) Authentication response
Authentication response parameter
Length : 8 octets
RES: 4a cc e9 a1 e6 f3 17 d4
48 01 60 EA 61 09 59 9D 34 3C
DE 62 FA 80
4)NAS: Security Mode Command
Message type: EPS MM
Direction: Downlink
Computer Timestamp: 14:57:42.234
dL-DCCH-Message
message
c1
dlInformationTransfer
rrc-TransactionIdentifier : 2
criticalExtensions
c1
dlInformationTransfer-r8
dedicatedInfoType
dedicatedInfoNAS : 377d8f031300075d020305e0e0000000c1
Security Mode Command
Security header type: (3) Integrity protected with new EPS security context
protocol_discriminator : EPS Mobility Management
Message authentication code: 0x7d8f0313
Sequence number: 0
Security header type: (0) Plain NAS message, not security protected
protocol_discriminator : EPS Mobility Management(7)
NAS EPS Mobility Management Message Type : (0x5d) Security mode command
NAS security algorithms
Spare bit(s): 0
Type of ciphering algorithm: (0) EPS encryption algorithm EEA0 (null ciphering algorithm)
Spare bit(s): 0
Type of integrity protection algorithm: (2) EPS integrity algorithm 128-EIA2 Spare bit(s): 0
Type of security context flag (TSC): (0) Native security context
NAS key set identifier: (3) ASME
UE security capability - Replayed UE security capabilities
Length : 5 octets
EEA0: (1) Support
128-EEA1: (1) Support
128-EEA2: (1) Support
EEA3: (0) Not support
EEA4: (0) Not support
EEA5: (0) Not support
EEA6: (0) Not support
EEA7: (0) Not support
EIA0: (1) Support
128-EIA1: (1) Support
128-EIA2: (1) Support
EIA3: (0) Not support
EIA4: (0) Not support
EIA5: (0) Not support
EIA6: (0) Not support
EIA7: (0) Not support
UEA0: (0) Not support
UEA1: (0) Not support
UEA2: (0) Not support
UEA3: (0) Not support
UEA4: (0) Not support
UEA5: (0) Not support
UEA6: (0) Not support
UEA7: (0) Not support
UMTS integrity algorithm UIA0 : (0) Not support
UMTS integrity algorithm UIA1: (0) Not support
UMTS integrity algorithm UIA2: (0) Not support
UMTS integrity algorithm UIA3: (0) Not support
UMTS integrity algorithm UIA4: (0) Not support
UMTS integrity algorithm UIA5: (0) Not support
UMTS integrity algorithm UIA6: (0) Not support
UMTS integrity algorithm UIA7: (0) Not support
GPRS encryption algorithm GEA1: (0) Not support GPRS encryption algorithm GEA2: (0) Not support GPRS encryption algorithm GEA3: (0) Not support GPRS encryption algorithm GEA4: (0) Not support GPRS encryption algorithm GEA5: (0) Not support GPRS encryption algorithm GEA6: (0) Not support GPRS encryption algorithm GEA7: (0) Not support IMEISV request
1100 .... = Element ID
IMEISV request: (1) IMEISV requested
0C 00 89 BB EC 78 18 98 00 3A
E8 10 18 2F 07 00 00 00 06 08
5)NAS: Security Mode Complete
Message type: EPS MM
Direction: Uplink
Computer Timestamp: 14:57:42.234
uL-DCCH-Message
message
c1
ulInformationTransfer
criticalExtensions
c1
ulInformationTransfer-r8
dedicatedInfoType
dedicatedInfoNAS : 4720e8682200075e23090300000000000000f0
Security Mode Complete
Security header type: (4) Integrity protected and ciphered with new EPS security context protocol_discriminator : EPS Mobility Management
Message authentication code: 0x20e86822
Sequence number: 0
Security header type: (0) Plain NAS message, not security protected
protocol_discriminator : EPS Mobility Management(7)
NAS EPS Mobility Management Message Type : (0x5e) Security mode complete
Mobile identity - IMEISV
Element ID : 35
Length : 9 octets
Odd/even indication: (0) even number of identity digits
Type of identity: (3) IMEISV
Identity digits (BCD): 0000000000000000
48 02 68 E4 1D 0D 04 40 00 EB
C4 61 20 60 00 00 00 00 00 00
1E 00
6)NAS: Attach Accept
Message type: EPS MM
Direction: Downlink
Computer Timestamp: 14:57:42.406
dL-DCCH-Message
message
c1
rrcConnectionReconfiguration
rrc-TransactionIdentifier : 1
criticalExtensions
c1
rrcConnectionReconfiguration-r8
measConfig
measObjectToAddModList
MeasObjectToAddMod
measObjectId : 1
measObject
measObjectEUTRA
carrierFreq : 38050
allowedMeasBandwidth : mbw100
presenceAntennaPort1 : true
neighCellConfig : 00
offsetFreq : dB0
reportConfigToAddModList
ReportConfigToAddMod
reportConfigId : 1
reportConfig
reportConfigEUTRA
triggerType
event
eventId
eventA3
a3-Offset : 4
reportOnLeave : false
hysteresis : 0
timeToTrigger : ms320
triggerQuantity : rsrp
reportQuantity : sameAsTriggerQuantity