Attach Request. LTE EPS Attach Procedure

The Attach Request is the first NAS message a UE sends to register with the LTE EPC. It initiates the EPS attach procedure that includes authentication, security activation and default bearer establishment.

Key Facts. Attach Request

Protocol: NAS (Non-Access Stratum). EMM (EPS Mobility Management)
Message type: Attach Request (message type 0x41)
Direction: Uplink. UE → MME
Carried in: RRCConnectionSetupComplete (dedicatedNAS-Message)
3GPP specification: TS 24.301 (NAS for EPS)
5G equivalent: Registration Request (TS 24.501)

EPS attach procedure overview

The EPS attach procedure is the mechanism by which a UE registers with the LTE Evolved Packet Core (EPC) and obtains connectivity. It is defined in 3GPP TS 24.301 and involves multiple NAS message exchanges between the UE and the MME (Mobility Management Entity). The attach procedure also establishes the default EPS bearer, providing the UE with an IP address and basic data connectivity.

The procedure is initiated when the UE powers on, inserts a SIM, enters LTE coverage, or needs to re-register after a previous detach. The Attach Request NAS message is the first message in this procedure and is transported inside the RRC layer's RRCConnectionSetupComplete message, meaning it is sent as soon as the RRC connection is established.

After the initial Attach Request, the MME typically performs mutual authentication (AuthenticationRequest/Response), activates NAS security (SecurityModeCommand/Complete), and then completes the attach with Attach Accept (which includes the default bearer context in the ESM message container). The UE confirms with Attach Complete.

Attach procedure message flow

UE → MME: Attach Request

Carried in RRCConnectionSetupComplete. Contains EPS mobile identity (IMSI or GUTI), EPS attach type, UE network capability, ESM message container (PDN Connectivity Request), and optional IEs.

MME → UE: Authentication Request

Contains RAND and AUTN from the HSS. The UE validates AUTN and computes RES. If the UE identifies a PLMN mismatch or SQN failure, it sends Authentication Failure instead.

UE → MME: Authentication Response

Contains RES (authentication response parameter). The MME compares RES with XRES from the HSS to verify the UE's identity.

MME → UE: NAS Security Mode Command

Activates NAS ciphering and integrity protection. Specifies the selected algorithms (e.g., EEA2/EIA2 for AES-based encryption and integrity).

UE → MME: NAS Security Mode Complete

Confirms NAS security activation. From this point, all NAS messages are integrity protected and optionally ciphered.

MME → UE: Attach Accept

Completes the registration. Contains the assigned GUTI, TAI list, ESM message container (Activate Default EPS Bearer Context Request with IP address, QoS and APN), and T3412 (periodic TAU timer).

UE → MME: Attach Complete

Contains the ESM message Activate Default EPS Bearer Context Accept. The UE is now registered and has an active default bearer with an IP address.

EPS attach types

EPS Attach

Registers for EPS (packet-switched) services only. The UE obtains an IP address and can use data services. This is the standard attach type for data-only devices and VoLTE-capable UEs.

Combined EPS/IMSI Attach

Registers for both EPS and non-EPS (circuit-switched) services. Used when the UE requires CSFB (Circuit Switched Fallback) for voice or SMS over SGs interface to the MSC/VLR.

Emergency Attach

Allows emergency call registration without a valid USIM or when normal attach fails. The network creates a limited EPS context for the emergency service. Authentication may be skipped.

Key Information Elements in Attach Request

IE name	Type	Description
EPS attach type	Mandatory	Indicates the type of attach: EPS attach (001), combined EPS/IMSI attach (010), or EPS emergency attach (110).
NAS key set identifier	Mandatory	Identifies the NAS security context. Set to 111 (no key available) for initial attach, or to the existing KSI if the UE has cached security context.
EPS mobile identity	Mandatory	UE identity: IMSI (initial attach or GUTI unknown), GUTI (when previously registered), or IMEI (emergency attach without USIM).
UE network capability	Mandatory	Lists supported NAS security algorithms: EEA0–EEA3 (ciphering) and EIA1–EIA3 (integrity). Also indicates UE capabilities like LPP, NR-DC, V2X.
ESM message container	Mandatory	Contains the piggybacked ESM message, typically PDN Connectivity Request, which specifies the PDN type (IPv4, IPv6, IPv4v6) and optionally the APN.
Last visited registered TAI	Optional	The TAI (Tracking Area Identity) where the UE was last registered. Helps the MME determine if inter-MME mobility occurred.
DRX parameter	Optional	Requested DRX cycle length for idle mode paging. Values include 32, 64, 128, or 256 radio frames.
Voice domain preference	Optional	Indicates UE's voice preference: CS voice only, IMS PS voice only, CS voice preferred, or IMS PS voice preferred.

Common Attach Reject cause codes

Cause #	Name	Meaning
#3	Illegal UE	The IMSI is not known in the HSS or authentication failed permanently. The UE should not reattempt with this USIM.
#6	Illegal ME	The IMEI is blacklisted (stolen/blocked device). The mobile equipment is not authorized on this network.
#7	EPS services not allowed	The subscription does not include EPS services. The UE cannot use LTE data services with this subscription.
#11	PLMN not allowed	The UE's subscription does not allow registration on this PLMN. Common in roaming scenarios with restricted roaming agreements.
#12	Tracking area not allowed	The UE is not allowed in this tracking area. The UE should move to a different TA or select a different PLMN.
#15	No suitable cells in TA	No cells in the tracking area can provide the required service. Often related to CSG (Closed Subscriber Group) restrictions.

How to decode Attach Request online

Open the decoder

Go to the HiCellTek L3 Decoder and select 4G LTE.

Select NAS channel

Choose the NAS EPS protocol. Attach Request is a NAS-layer EMM message, not an RRC message.

Paste hex frame

Paste the NAS hex, extract it from Wireshark, QCAT, or from the dedicatedNAS-Message in RRCConnectionSetupComplete.

Analyze the IEs

Click Decode. Inspect EPS mobile identity, attach type, UE network capability and the embedded ESM PDN Connectivity Request.

Decode Attach Request now →

Frequently Asked Questions

What is the Attach Request message in LTE?

The Attach Request is a NAS (Non-Access Stratum) message sent by the UE to the MME (Mobility Management Entity) to register with the EPC (Evolved Packet Core) network. It is the first NAS message in the LTE attach procedure and is carried inside the RRCConnectionSetupComplete message at the RRC layer. The Attach Request contains the UE's identity (IMSI, GUTI or IMEI), UE network capability (supported ciphering and integrity algorithms), ESM message container (PDN connectivity request), and the requested attach type.

What are the different LTE attach types?

There are three main attach types defined in 3GPP TS 24.301: (1) EPS Attach, registers for EPS (packet) services only; the UE receives an IP address and can use data services. (2) Combined EPS/IMSI Attach, registers for both EPS and non-EPS (circuit-switched) services simultaneously; used when the UE needs SMS over SGs or CSFB (Circuit Switched Fallback). (3) Emergency Attach, allows the UE to attach for emergency calls even without a valid SIM/USIM or when normal attach is not possible. The attach type is indicated in the EPS attach type IE of the Attach Request.

What causes Attach Reject and what are common EMM cause codes?

The MME sends Attach Reject when the UE cannot be registered. Common EMM cause codes include: #3 (Illegal UE), the IMSI/IMEI is not authorized; #6 (Illegal ME), the mobile equipment is not allowed; #7 (EPS services not allowed), the subscription does not include EPS; #11 (PLMN not allowed), the UE cannot register on this network; #12 (Tracking area not allowed), the UE is restricted from this TA; #13 (Roaming not allowed in this tracking area); #14 (EPS services not allowed in this PLMN); #15 (No suitable cells in tracking area). The cause code helps diagnose registration failures in the field.

How do I decode an Attach Request NAS message?

To decode an Attach Request: (1) Open the HiCellTek online decoder at /en/decoder/. (2) Select 4G LTE. (3) Choose the NAS EPS channel (or 'NAS' if listed generically). (4) Paste the hexadecimal NAS frame, you can extract it from Wireshark, QCAT or the dedicatedNAS-Message IE inside an RRCConnectionSetupComplete. (5) Click Decode. The decoder shows all IEs including EPS mobile identity, UE network capability, ESM message container (which itself contains PDN connectivity request), and optional IEs like DRX parameters and voice domain preference.