If you have a single RRC or NAS hexadecimal payload from QXDM/QCAT, Wireshark, TEMS, Nemo, a PCAP export or a drive-test log, you should not need to rebuild a complete trace just to inspect one Layer 3 message.
The HiCellTek online 3GPP decoder decodes supported RRC and NAS messages from 2G GSM, 3G UMTS, 4G LTE and 5G NR, including supported structures through 3GPP Release 18. It is accessed directly from a browser, with no local installation.
Quick facts
- 2G, 3G, 4G and 5G in one interface
- RRC and NAS workflows
- 20 free RRC decodes per day, without signup
- Tree and raw views, plus text export in the free plan
- NAS, JSON, table view and batch decoding in Pro
- Automatic expansion of supported LTE-to-NR containers
- Hex frames are processed in memory and are not retained by HiCellTek
RRC and NAS are not the same thing
RRC is the access-stratum control protocol between the UE and the radio network. It carries procedures and configuration such as connection setup, measurement reporting, handover-related reconfiguration, radio bearers, SIBs and UE capabilities.
The official protocol specifications are 3GPP TS 38.331 for NR RRC and 3GPP TS 36.331 for LTE RRC.
NAS runs between the UE and the core network. It covers registration or attach, authentication, mobility management and session management. The relevant specifications include 3GPP TS 24.501 for 5GS NAS and 3GPP TS 24.301 for EPS NAS.
This distinction matters during troubleshooting: an RRC failure points you toward the radio-access procedure, while a NAS reject gives information from the core-network procedure. A reliable diagnosis still requires the surrounding message sequence and radio context.
How to decode an RRC or NAS message online
- Open the HiCellTek 3GPP decoder.
- Paste the hexadecimal PDU only, without the logging header.
- Select GSM, UMTS, LTE or NR.
- Select RRC or NAS and the correct logical channel when required.
- Choose the direction, or use automatic detection.
- Decode and inspect the structured result.
For RRC, selecting the correct channel is important because the same bitstream can only be interpreted against the expected ASN.1 message structure. Typical channels include DL-DCCH, UL-DCCH, DL-CCCH, UL-CCCH, BCCH-BCH, BCCH-DL-SCH and PCCH.
Example: a 5G Registration Reject
Consider this minimal plain 5GS NAS payload:
7e004411
In the expected 5GMM context, it represents a Registration Reject carrying 5GMM cause 17: network failure.
That is useful evidence, but it should not be treated as a complete root-cause analysis by itself. Correlate it with the preceding Registration Request, authentication and security procedures, RRC events and core-network logs.
LTE-to-NR container decoding
One difficult NSA case is an NR configuration embedded inside an LTE RRC message. In EN-DC, an LTE RRCConnectionReconfiguration can carry nr-SecondaryCellGroupConfig-r15, which contains the NR CellGroupConfig.
For supported structures, HiCellTek detects and expands this nested LTE-to-NR container automatically. This avoids manually extracting and decoding the NR payload separately.
HiCellTek or Wireshark?
They solve different parts of the workflow.
Use Wireshark when you have a complete PCAP or PCAPNG and need packet timing, filtering and correlation across protocols. Wireshark's display filters are especially useful for full-trace analysis.
Use the HiCellTek decoder when you already have an isolated RRC or NAS PDU and want a fast structured decode without preparing a capture file.
In practice, the two tools are complementary.
Validation and scope
The production decoding engine was checked against a bounded corpus of 63,375 cases covering 2G through 5G and supported messages through Release 18. The corpus contained 36,904 expected decodes and 26,471 expected safe rejections, with zero oracle or transport failures in that test scope.
This is validation evidence, not a claim that every possible frame or vendor-specific capture format will decode. Malformed, truncated or incorrectly framed payloads may be rejected intentionally.
Documentation and examples
For a compact compatibility scope, a byte-level 5GMM example, official specification links, and the privacy and validation boundaries, see the public HiCellTek 3GPP decoder documentation. The repository contains documentation and examples only; the decoding engine remains proprietary.
Who is it for?
- RF engineers working on drive tests and optimization
- Protocol analysts investigating signaling procedures
- Operators validating SIBs, measurements and radio configuration
- Core-network teams reading EPS and 5GS NAS messages
- Telecom students learning real 3GPP structures
- Anyone who has a hexadecimal Layer 3 payload and needs a readable tree
Try the online decoder
Open the free online 3GPP RRC and NAS decoder.
The free plan includes 20 RRC decodes per day with no signup. NAS decoding and advanced features are available in Pro.
If you test it with a real field capture, tell me which message or workflow you would like the decoder to support next.
Top comments (0)