Osmocom Analog » Osmo-CC

h1. Open5GS-Traces

{{>toc}}

p{background:red}. *!This is Work-In-Progress!*

h2. Setup of this example

* Ericsson RBS 6402 (eNodeB)

* Open5GS (4G network elements)

* OsmoHLR with OsmoDia2GSUP (HSS)

* OsmoMSC (SMS)

h2. Idle

When all phones are Idle, one will see the following trace with Wireshark on the link between eNodeB (Ericsson RBS) and MME (Open5GS).

p{border: solid 1px}. !wireshark_enb_idle.png!

The eNodeB (IP 10.0.15.117) is connected to MME (IP 10.0.15.1) via SCTP. Also the eNodeB syncs its clock to NTP server (IP 10.0.15.1).

The network 10.0.15.0/24 is the RAN network in this example.

h2. 4G Attachment

!attach.png!

The phone is turned on and ready to attach to 4G network.

p{border: solid 1px}. !wireshark_enb_attach.png!

A 4G phone is attached to the network, using SIM cards that is registered in the HSS. The APN name used is "internet".

Lets go into detail:

h3. Attach request

p{border: solid 1px}. !wireshark_enb_attach_attach_request.png!

The UE sends an "Attach request". It is the message type of the "NAS-PDU" information element of the "initiatingMessage". The "NAS-PDU" message type is highlighted blue in the picture above.

Also within the "NAS-PDU" is the "EPS mobile identity". In this case the UE has the mobile country code "999" and the mobile network code "10". The IMSI is not shown. Because the UE was attached before, a TMSI is used. 

h3. ESM information request

p{border: solid 1px}. !wireshark_enb_attach_ESM_infomation_request.png!

The MME sends an "ESM information request" to the UE, to request APN name. The "NAS-PDU" message type is highlighted blue in the picture above.

h3. ESM information response

p{border: solid 1px}. !wireshark_enb_attach_ESM_infomation_response.png!

The UE send an "ESM information response." The UE uses the APN name "internet". The "NAS-PDU" message type is highlighted blue in the picture above.

This is the default configuration in the example setup. It can be configured in the configuration file for OsmoHLR. (osmo-hlr.cfg)

h3. Attach accept

p{border: solid 1px}. !wireshark_enb_attach_attach_accept.png!

The MME sends an "Attach accept" to the UE. The "NAS-PDU" message type is highlighted blue in the picture above.

Also within the “NAS-PDU” is an “ESM message container” with an “EPS session management message” to activate the default EPS bearer context. (Highlighted light blue in the picture above.)

The subsequent “InitialContextSetupResponse” and “UECapabilityInfoIndication” messages are not depicted. The latter message contains capabilities of the UE.

h3. Attach complete

p{border: solid 1px}. !wireshark_enb_attach_attach_complete.png!

Finally the UE sends an "Attach complete". The "NAS-PDU" message type is highlighted blue in the picture above.

Also within the “NAS-PDU” is an “ESM message container” with an “Activate default EPS bearer context accept”. (Highlighted light blue in the picture above.)

h2. Packet transfer

p{border: solid 1px}. !wireshark_enb_gtp_1.png!

The "GPRS Tunneling Protocol" (GTP) is used to tunnel packet traffic of the user plane. between eNodeB and SGW.

p{border: solid 1px}. !wireshark_enb_gtp_2.png!

As depicted above, the GTP packet transmitted from the eNodeB (IP 10.0.15.117) to the SGW (IP 10.0.15.3).

The carried packet is transmitted from the UE (IP 10.0.6.2) to the destination in the Internet (IP 104.26.15.42)

h2. 4G Detachment

!detach.png!

The 4G phone is turned off or the airplane mode is turned on. The phone detaches from network.

p{border: solid 1px}. !wireshark_enb_detach.png!

Lets go into detail:

h.3 Detach Request

p{border: solid 1px}. !wireshark_enb_detach_detach_request.png!

Similar to the "Attach request", described above, the UE sends an "Detach request". It is the message type of the "NAS-PDU" information element of the "initiatingMessage". The "NAS-PDU" message type is highlighted blue in the picture above.

Also within the "NAS-PDU" is the "EPS mobile identity". This is also similar to the "Attach request".

The subsequent “UEContextReleaseCommand” message (sent from EMM) and “UEContextREleaseComplete” messages (sent from UE) are not depicted.