UE Capabilities: decoding MRDC, CA Combos, and NR for network optimization

UE Capabilities are the most underutilized data in network optimization. Buried in RRC messages, they precisely describe what a terminal can do: which carrier combinations it supports, what MIMO level it achieves, whether it supports MRDC (Multi-RAT Dual Connectivity) for 5G NSA. Ignoring this data means optimizing a network without knowing the actual capabilities of the device fleet. This guide explains how to read, decode, and leverage UE Capabilities in the field.

What is UE-CapabilityInformation?

The RRC message that describes the terminal

UE-CapabilityInformation is an RRC message sent by the terminal (UE) to the base station (eNB in LTE, gNB in NR) in response to a UECapabilityEnquiry request. This message contains an exhaustive description of the terminal’s radio capabilities.

In LTE, the message is defined in 3GPP specification 36.331 (RRC Protocol Specification). In NR, specification 38.331 defines the equivalent structure.

The typical content of a UE-CapabilityInformation includes:

• Supported RF bands: list of LTE bands (B1, B3, B7, B20, B28, B38, B40, B41…) and NR bands (n1, n3, n28, n41, n77, n78, n79…)
• CA Combinations: supported carrier combinations (e.g., 3C-7A, 1A-3A-7A, n78A-n78A)
• MIMO layers: number of MIMO layers supported per band (2, 4, or 8 layers)
• Maximum modulation: 64QAM, 256QAM, or 1024QAM in downlink/uplink
• MRDC support: whether the terminal supports LTE+NR dual connectivity
• Feature sets: advanced capabilities (SUL, SDL, supplementary uplink, DSS, etc.)
• Supported measurements: which measurement reports the terminal can provide

Why this data is critical

A properly configured 5G NSA network with EN-DC (E-UTRA NR Dual Connectivity) will be useless if the terminals in the area do not support the right band combinations. Similarly, an operator that activates 3CA (3 Carrier Aggregation) on an area will see no benefit if only 15% of the device fleet supports that combination.

UE Capabilities answer concrete operational questions:

• What percentage of terminals in my area support the CA combo B1+B3+B7?
• How many terminals support EN-DC with n78?
• What is the maximum modulation actually supported on my primary band?
• Does the device fleet support 4x4 MIMO on B7?

MRDC: Multi-RAT Dual Connectivity

MRDC principle in 5G NSA

MRDC is the fundamental mechanism of 5G NSA (Non-Standalone). It allows a terminal to simultaneously maintain a connection on two different radio technologies:

• LTE: serves as the anchor (Master Node / MN) for the control plane
• NR: serves as the secondary node (Secondary Node / SN) for the user plane

This architecture is called EN-DC (E-UTRA NR Dual Connectivity), defined in options 3/3a/3x of the 3GPP specification.

EN-DC Architecture (Option 3x):

  ┌──────┐         ┌──────┐
  │  eNB │─────────│  gNB │
  │ (MN) │  X2-C   │ (SN) │
  └──┬───┘         └──┬───┘
     │                 │
     │    ┌──────┐     │
     └────│  UE  │─────┘
          └──────┘
  Control plane    User plane
  via LTE          via LTE + NR

MRDC capabilities structure in UE-CapabilityInformation

In the UE-CapabilityInformation message, MRDC support is indicated by the presence of the IE (Information Element) UE-MRDC-Capability. This structure contains:

measParametersMRDC: the inter-RAT measurement parameters that the terminal supports (NR measurements from an LTE connected state).

rf-ParametersMRDC: the RF parameters for dual connectivity mode, including:

• supportedBandCombinationList: the list of supported MRDC band combinations
• Each combination defines: LTE bands of the Master Node + NR bands of the Secondary Node

Concrete MRDC CA combo example:

Band Combination MRDC:
  LTE: B1A (2100 MHz, 20 MHz, 2 MIMO layers, 256QAM DL)
  LTE: B3A (1800 MHz, 20 MHz, 2 MIMO layers, 256QAM DL)
  NR:  n78A (3500 MHz, 100 MHz, 4 MIMO layers, 256QAM DL)

This combination means that the terminal can simultaneously aggregate 2 LTE carriers (B1+B3) and 1 NR carrier (n78), for a substantial combined theoretical throughput.

Field use case: MRDC diagnosis

An engineer observes that a 5G terminal stays on LTE only in an area covered by a gNB n78. The possible causes are multiple, but diagnosis starts with UE Capabilities:

1. Does the terminal support EN-DC? Check for the presence of UE-MRDC-Capability
2. Is the band combination supported? The terminal on B1 must support the MRDC combo B1+n78
3. Is the network requesting the right measurements? The MeasurementConfiguration sent to the terminal must include NR measurements (measObjectNR)

Without access to decoded UE Capabilities, this diagnosis is a dead end.

CA Combos: Carrier Aggregation Combinations

CA Combo structure

CA Combos define the exact combinations of carriers (Component Carriers) that a terminal can aggregate simultaneously. The nomenclature follows the 3GPP convention:

Format: BandClass-BandClass-...

Where:

• Band = band number (B1, B3, B7, n78…)
• Class = bandwidth class of the Component Carrier

Class	Maximum bandwidth (LTE)	Maximum bandwidth (NR FR1)
A	5-20 MHz	5-100 MHz
B	20-25 MHz (intra-band)	10-100 MHz
C	25-40 MHz (intra-band)	10-200 MHz
D	40-60 MHz	200-400 MHz
I	100 MHz (NR specific)	-

Common CA Combo examples

LTE Carrier Aggregation:

Combo	Description	Max theoretical DL throughput
3A-7A	B3 (20 MHz) + B7 (20 MHz)	~300 Mbps (2x2 MIMO)
1A-3A-7A	B1 + B3 + B7 (3x 20 MHz)	~450 Mbps (2x2 MIMO)
1A-3A-7A-20A	B1+B3+B7+B20 (4CA)	~500 Mbps
3C	B3 intra-band (2x 20 MHz contiguous)	~300 Mbps

EN-DC (LTE + NR):

Combo	Description	Max theoretical DL throughput
1A-3A_n78A	B1+B3 LTE + n78 NR (100 MHz)	~1.5 Gbps
3A_n78C	B3 LTE + n78 NR (200 MHz, 4x4 MIMO)	~2.5 Gbps
1A-3A-7A_n78A	3CA LTE + n78 NR	~2 Gbps

How to read CA Combos in UE-CapabilityInformation

In the decoded message, CA Combos appear in the supportedBandCombinationList structure. Each entry contains:

BandCombination {
  bandList [
    BandParameters {
      bandEUTRA: 3          // LTE Band B3
      ca-BandwidthClassDL: a // Class A
      supportedMIMO-CapabilityDL: twoLayers
    },
    BandParameters {
      bandEUTRA: 7          // LTE Band B7
      ca-BandwidthClassDL: a // Class A
      supportedMIMO-CapabilityDL: fourLayers
    }
  ]
}

Manual decoding is tedious. A typical UE-CapabilityInformation message contains several hundred combinations, encoded in ASN.1 PER (Packed Encoding Rules). Automated decoding is essential.

NR Capabilities: 5G-specific features

NR Feature Sets

In 5G NR, capabilities are structured differently through the Feature Sets concept. Each Feature Set defines a set of RF and baseband parameters for an NR Component Carrier:

• featureSetDownlink: number of DL MIMO layers, max DL modulation, max bandwidth
• featureSetUplink: number of UL MIMO layers, max UL modulation, UL MIMO support
• featureSetPerCC: capabilities per individual Component Carrier

Feature Sets are then referenced in Band Combinations to define the exact capabilities of each CC in each combination.

Critical NR parameters to verify

Parameter	Field impact	Typical values
maxNumberMIMO-LayersPDSCH	Max DL throughput	2, 4, or 8 layers
supportedModulationOrderDL	Spectral efficiency	256QAM (8) or 1024QAM (10)
supportedBandwidthDL	NR bandwidth	40, 50, 80, 100 MHz (FR1)
maxNumberMIMO-LayersCB-PUSCH	UL MIMO throughput	1 or 2 UL layers
pusch-256QAM	Advanced UL modulation	Supported or not
beamCorrespondence	Beamforming performance	true/false
csi-RS-CFRA	Beam management	Number of CSI-RS ports

Verifying Standalone (SA) support

For 5G SA (Standalone), the terminal must support NR connection without an LTE anchor. This is indicated by the presence of:

• accessStratumRelease: supported NR release (release-15, release-16, release-17…)
• pdcp-Parameters: NR standalone PDCP support
• rlc-Parameters: NR standalone RLC support
• mac-Parameters: NR standalone MAC support

A terminal that supports EN-DC does not necessarily support SA. This distinction is crucial during NSA to SA migration.

Field exploitation of UE Capabilities with HiCellTek

Automatic capture and decoding

HiCellTek captures UE-CapabilityInformation messages directly from the terminal’s Qualcomm DIAG interface. ASN.1 decoding is performed in real time by the native RRC decoding libraries, without relying on an external post-processing tool.

The capture flow is as follows:

1. Interception: the DIAG parser captures the raw RRC message on the DCCH channel
2. ASN.1 decoding: the LTE/NR ASN.1 decoder transforms the PER binary stream into a readable hierarchical structure
3. Structured extraction: CA Combos, Feature Sets, and MRDC parameters are extracted in tabular format
4. Export: data is available in PCAP, CSV, or HLOG format for further analysis

For a deeper dive into complete Layer 3 decoding, see our guide on real-time RRC and NAS decoding.

Use case: fleet audit for CA activation

An operator wants to activate 3CA (B1+B3+B7) on a cluster of urban sites. Before configuring the eNBs, it is essential to validate the percentage of terminals that support this combination.

Methodology with HiCellTek:

1. Install HiCellTek on a Qualcomm test terminal
2. Perform a drive test in the target area to capture Layer 3 traffic
3. Extract the UE-CapabilityInformation from observed terminals (via messages broadcast on the RRC link)
4. Analyze the distribution of supported CA Combos
5. Produce a fleet compatibility report vs planned network configuration

This analysis allows estimating the actual benefit of 3CA activation before any configuration change.

For a complete guide on Carrier Aggregation and its field implications, see our LTE and 5G Carrier Aggregation practical guide.

Use case: vendor negotiation for EN-DC activation

During discussions with equipment vendors (Ericsson, Nokia, Huawei, ZTE), UE Capabilities provide factual data to:

• Validate network configurations: “Our fleet supports the B3+n78 combo in EN-DC, activate this configuration on the gNBs”
• Identify terminal limitations: “Terminal X only supports 2 MIMO layers on n78, not 4: the theoretical gain is reduced”
• Prioritize deployment decisions: “80% of the fleet supports n78A but only 30% supports n78C: deploy n78A first”
• Document discrepancies: “The vendor claims 4x4 MIMO on n78 but UE Capabilities show 2 layers — investigate”

HiCellTek’s structured exports (PCAP, CSV) serve as supporting evidence in these technical discussions.

Best practices for UE Capabilities analysis

Analysis checklist

When examining a UE-CapabilityInformation, systematically verify:

1. Supported bands: does the terminal support all bands deployed in the area?
2. Relevant CA Combos: among the hundreds of combos, filter those matching the network bands
3. MIMO layers per band: 2 layers vs 4 layers doubles the theoretical throughput
4. Max modulation: 256QAM vs 64QAM in DL represents a 33% gain in spectral efficiency
5. MRDC support: presence and completeness of the UE-MRDC-Capability structure
6. NR Feature Sets: do the NR Feature Sets match the planned gNB configurations?

Common pitfalls

Pitfall 1: confusing band support with CA combo support A terminal can support B3 and B7 individually without supporting the B3+B7 combination in CA. Only the supportedBandCombinationList is authoritative.

Pitfall 2: ignoring Feature Sets In NR, two terminals supporting the same n78 band can have very different capabilities (2 vs 4 MIMO layers, 100 vs 200 MHz bandwidth).

Pitfall 3: forgetting UL capabilities The focus is often on downlink, but uplink capabilities (UL MIMO, 256QAM UL, PUSCH configuration) directly impact the quality of symmetric services (video conferencing, cloud upload).

Pitfall 4: not versioning capabilities Terminal firmware updates can modify UE Capabilities. After an OTA update rollout, it is advisable to recapture capabilities to verify changes.

Formula: UE Capabilities impact on theoretical throughput

The maximum theoretical throughput depends directly on UE Capabilities:

Throughput_max (Mbps) = Sum(CC) [ BW_CC x Spectral_eff x N_MIMO x (1 - OH) ]

Where:

• BW_CC = Component Carrier bandwidth (MHz)
• Spectral_eff = spectral efficiency based on modulation (64QAM ~5.5, 256QAM ~7.4, 1024QAM ~9.0 bits/Hz)
• N_MIMO = number of MIMO layers (2 or 4)
• OH = protocol overhead (~14% in LTE, ~8% in NR)

Example: terminal supporting 3A-7A with 4x4 MIMO and 256QAM

CC B3: 20 MHz x 7.4 x 4 x 0.86 = 509 Mbps
CC B7: 20 MHz x 7.4 x 4 x 0.86 = 509 Mbps
Total = 1018 Mbps theoretical

If the terminal only supports 2x2 MIMO on B3, the calculation becomes:

CC B3: 20 MHz x 7.4 x 2 x 0.86 = 254 Mbps
CC B7: 20 MHz x 7.4 x 4 x 0.86 = 509 Mbps
Total = 763 Mbps theoretical (-25%)

The difference between 2 and 4 MIMO layers on a single band impacts the total throughput by 25%. Knowing UE Capabilities allows setting realistic performance expectations.

Conclusion

UE Capabilities are not a protocol detail: they are the keystone between network configuration and the performance perceived by the user. MRDC, CA Combos, NR Feature Sets — each parameter has a direct impact on throughput, latency, and quality of experience.

HiCellTek transforms this raw data into actionable information: real-time ASN.1 decoding, structured CA Combo extraction, export to standard formats for vendor discussions and optimization reports.

---

Want to leverage UE Capabilities in your optimization campaigns? Contact our team for a demonstration: sales@hicelltek.com or visit hicelltek.com.