5G gave the RRC state machine a third state. Between IDLE and CONNECTED sits RRC_INACTIVE: a UE with no traffic gets suspended rather than released, the gNB keeps its access-stratum context, and the UE walks away with an I-RNTI — a token naming that stored context.
Then mobility happens. The UE wakes up with data to send, but at a cell served by a different gNB. The new node has no idea who this UE is. Resolving that is a small, tidy Xn procedure called Retrieve UE Context, and a five-frame XnAP-over-SCTP capture holds all of it.
What the capture shows
The interface comes up first (frames 1-2). Xn Setup Request and Response, non-UE-associated, each gNB advertising its served-cell configuration — PLMN, gNB ID, NR-PCI, TAC, slice. Nothing UE-specific can travel until this is done.
The I-RNTI is a pointer; the shortResumeMAC-I is a signature (frame 3). The UE's RRCResumeRequest carried both. The I-RNTI tells the target gNB which node holds the context and which context it is. The UE computes shortResumeMAC-I from its stored keys, so the anchor can verify the resume request is genuine before releasing anything.
Resuming forward-secures the keys (frame 4). The context comes back with a NextHopChainingCount (NCC = 2) and a 32-byte K_NG-RAN* next-hop key. The target derives fresh AS keys from those — vertical key derivation — so the new cell cannot read traffic the UE exchanged before the resume. Riding along: UE-AMBR, and one PDU session with its QoS flow.
Both ends get cross-referenced (frame 5). The Confirm quotes both UE XnAP IDs, binding the two nodes' identifiers to the same UE-associated Xn connection.
And the distinction that trips people up: this is not Handover Preparation. Handover is source-driven — the serving gNB decides to move a connected UE and pushes the context to a target it chose. Retrieve UE Context is target-driven — the UE arrives, asks to resume, and the new gNB pulls. Same outcome, opposite trigger.
One caveat the write-up states plainly: it's a single-machine loopback capture with some trivial field values, so read it for the shape of the procedure rather than for realistic numbers.
Full walk-through, frame by frame: https://www.eventhelix.com/5G/xn-ue-context-retrieval/ — every field value, the decoded packet trees, and where the Xn leg sits in the end-to-end resume across Uu and NG.
The sequence diagrams were generated from the PCAP with VisualEther, which turns a Wireshark capture into an annotated sequence diagram; there's a free Community edition, and the interactive diagram for this capture opens each message's full Wireshark field tree on click.
Top comments (0)