A 5G radio capture can be encrypted twice over, by two separate networks holding two different sets of keys. Wireshark work-item 19757 published a 5G NR trace together with the UE's keys, which makes it an unusually honest capture to learn from: 151 frames over about 49 seconds, taken at the MAC layer of a single cell, with radio security genuinely switched on — NEA2 (AES) ciphering and NIA2 (AES-CMAC) integrity, not the NEA0 null cipher most lab traces run.
What the capture shows
5G secures the core and the radio separately, and the two procedures run side by side. Frames 11–16 carry the NAS (core) Security Mode procedure between the UE and the AMF, and it runs twice. The commands carry NAS security-header type 3; the responses come back as type 4, "integrity protected and ciphered" — the moment the NAS bodies go dark. Frames 17–18 then carry the AS (radio) Security Mode Command from the gNB, selecting NEA2/NIA2: a different peer, different keys, its own procedure, the same shape.
The published keys are the Access-Stratum keys. So the radio stack opens, and the core stays shut. Frame 38 holds both states in a single packet: an RRC Reconfiguration readable because the AS keys deciphered PDCP, carrying a NAS PDU marked security-header type 2 that stays an opaque blob.
That same frame builds the data bearer. DRB 1 on LCID 4, an sdap-Config with the uplink SDAP header present and the downlink header absent, QFI 2, PDCP with an 18-bit sequence number, RLC-AM with t-PollRetransmit 80 ms.
A third context sits underneath. Once PDCP gives up the user plane, the IMS signaling inside it turns out to be protected by IPsec, so it re-seals on its own terms.
The rest reads the way a healthy connection should. An SDAP user plane stamped QFI 2, ACK_SN climbing to 18, not one NACK anywhere. Then an RRC Release the UE never acknowledges — PDCP SN 7, MAC-I 0xa48652fc, poll bit set — which RLC repeats once when t-PollRetransmit expires. The identical SN and MAC-I are the signature that says retransmission, not a second command.
Worth being clear about what makes this legible: the keys shipped with the capture. Without them, the RRC Reconfiguration and the entire user plane are opaque PDCP blobs, and NEA2 stays NEA2.
The full walkthrough runs all six phases frame by frame, and six companion articles take the same capture one layer at a time — MAC-NR, RLC-NR, PDCP-NR, SDAP, NR-RRC, and NAS-5GS.
Full walk-through: https://www.eventhelix.com/5G/nr-attach-air-interface/
Top comments (0)