DEV Community

Sandeep Ahluwalia
Sandeep Ahluwalia

Posted on Originally published at eventhelix.com

A 5G NSA phone never attaches to 5G: reading an EN-DC attach from a real capture

#5g #networking #wireshark #telecom

In 5G Non-Standalone (Option 3, or EN-DC), there is no 5G core. The UE attaches to the 4G EPC through an LTE anchor eNB, and 5G arrives later as a secondary leg that the eNB asks a nearby gNB to add. A new walkthrough reads that whole flow from a real 40-frame capture taken on the LTE leg of an open5gs test network.

What the capture shows

EN-DC is negotiated during the attach, long before it is used. The UE sets the DCNR bit in its first Attach Request (frame 7). The core answers with NR security capabilities in the InitialContextSetupRequest (frame 13) and marks dual connectivity with NR "Not restricted" in the Attach Accept.

One reconfiguration arms the flow. Frame 19 delivers the Attach Accept, builds the bearers, and installs seven measurement identities. Only measId 7 is bound to the NR measurement object (band n78), with event B1-NR.

A measurement triggers 5G, not the attach. The first measId-7 report (frame 24) carries NR PCI 0 at −91 to −90 dBm SS-RSRP. The eNB sends the X2 SgNB Addition Request in the very next frame, and the gNB's Acknowledge returns the NR configuration for the UE.

The bearer moves to NR in two steps. An RRC Reconfiguration releases LTE DRB 1 and re-adds it on the NR secondary cell group, so PDCP relocates to the gNB. The S1AP E-RAB Modification (frames 31–32) then points the S1-U downlink at the gNB.

Only measId-7 reports carry NR. Frame 24 and the periodic bundles in frames 33–40 include an NR neighbor list; the measId 1 and 2 reports never mention NR.

A VisualEther annotated sequence diagram with four lifelines, MME, eNB, SgNB, and UE, and a plain-English commentary column on the right. Frame 24, an RRC Measurement Report from the UE to the eNB, lists measId 7, LTE RSRP between -77 and -76 dBm, NR PCI 0, NR SS-RSRP between -91 and -90 dBm, and NR SS-RSRQ between -11.0 and -10.5 dB; its commentary calls it the 5G trigger, the first measurement report carrying NR. Frame 25, an X2 SgNB Addition Request from the eNB to the SgNB, lists MeNB-UE-X2AP-ID 0, E-RAB-ID 5, DRB-ID 1, and PDCP at SgNB (SCG bearer). Frame 26, the SgNB Addition Request Acknowledge back to the eNB, lists MeNB-UE-X2AP-ID 0 and SgNB-UE-X2AP-ID 1779; its commentary notes that the gNB mints its own X2AP ID, pairing the two nodes for this UE.

It is a lab capture: AS security uses the EEA0 null cipher with EIA2 integrity, there is no NAS authentication, and the B1 threshold sits at the RSRP floor, so EN-DC comes up on any detected NR cell. The NR radio leg itself is not in this LTE-side trace.

The walkthrough goes frame by frame through all six phases, including the EN-DC X2 Setup, the Dual Connectivity Power Headroom Report, and a close read of the measurement configuration.

Full walk-through: https://www.eventhelix.com/5G/nsa-en-dc-attach/

Top comments (0)