L3 Protocol Decoder Guide 4G/5G Field Signaling Analysis
Understanding and decoding Layer 3 signaling in the field: RRC, NAS, SIP and DIAMETER messages. The definitive reference for diagnosing handover failures, attach rejects and VoLTE call drops.
In a nutshell
Layer 3 signaling governs the entire lifecycle of a mobile connection: network attachment (NAS), radio configuration (RRC), voice call setup (SIP) and authentication (DIAMETER). Decoding these messages in the field allows you to identify the exact root cause of network issues: failure cause codes, reconfiguration parameters, expired timers. It is the most powerful tool available to an RF engineer for moving from symptom to diagnosis.
What is Layer 3 signaling?
In the 3GPP mobile network protocol model, Layer 3 (L3) encompasses the signaling protocols that control the connection between the UE and the network. Unlike Layer 1 (physical) and Layer 2 (data link), which handle data transmission over the radio interface, Layer 3 manages the connection logic, mobility and service control.
Layer 3 protocols are divided into two main strata. The Access Stratum (AS) contains the RRC (Radio Resource Control) protocol, which manages the radio connection: connection establishment, inter-frequency measurements, handovers, and radio bearer reconfiguration. The Non-Access Stratum (NAS) contains the mobility management protocols (EMM in 4G, 5GMM in 5G) and session management protocols (ESM in 4G, 5GSM in 5G).
On top of these layers, voice and multimedia services use SIP (Session Initiation Protocol) for VoLTE and VoNR, and DIAMETER for authentication and service authorization. All of these protocols are encoded in ASN.1 (for RRC and NAS) or in structured text (for SIP).
Key Layer 3 protocols
The four essential signaling protocols for field diagnostics.
RRC (Radio Resource Control)
Manages the radio connection between the UE and the eNodeB/gNodeB. Key messages: RRC Connection Setup, RRC Reconfiguration (bearer addition/removal, handover), Measurement Report (handover triggering), RRC Release (connection teardown with cause). RRC is the richest protocol for radio diagnostics.
NAS (Non-Access Stratum)
Manages the relationship between the UE and the core network. Key messages: Attach Request/Accept/Reject, Tracking Area Update, PDN Connectivity Request, Authentication. NAS cause codes precisely identify why a terminal is rejected by the network (PLMN not allowed, IMSI unknown, etc.).
SIP (Session Initiation Protocol)
Signaling protocol for VoLTE and VoNR. Key messages: INVITE (call initiation), 200 OK (response), BYE (call termination), CANCEL, SIP 408 (timeout), SIP 503 (service unavailable). SIP decoding is essential for diagnosing voice quality issues and call setup failures.
DIAMETER
Authentication and authorization protocol in the EPC/5GC core network. Used between the MME/AMF and the HSS/UDM for subscriber authentication and subscription profile management. DIAMETER messages are not directly visible on the radio interface, but their effects (reject, timeout) are reflected in NAS responses.
Why decode Layer 3 in the field?
Radio metrics (RSRP, RSRQ, SINR) indicate signal conditions, but they do not reveal the cause of a problem. A terminal may have an excellent RSRP of -85 dBm and still fail to attach to the network if the NAS Attach is rejected. A handover can fail despite good signal on the target cell if the RRC reconfiguration is incorrect.
Field Layer 3 decoding eliminates the delay between detecting an issue and diagnosing it. Traditionally, the engineer captures a QMDL file, transfers it to a PC, opens it in QCAT, filters relevant messages and analyzes the cause codes. This workflow can take hours. With an on-device L3 decoder, the diagnosis is immediate.
This capability is particularly critical for time-sensitive troubleshooting interventions: service restoration, site acceptance, coverage audits for regulators. The L3 decoder allows you to confirm or rule out a diagnostic hypothesis in seconds.
Use cases: field Layer 3 diagnostics
Handover analysis
Visualize the complete sequence: Measurement Report, RRC Reconfiguration, Handover Command, Handover Complete or Handover Failure. Identify the exact cause of a handover failure (cause code, timer expiry, missing neighbour).
VoLTE setup diagnostics
Follow a VoLTE call setup end-to-end: SIP INVITE, 100 Trying, 183 Session Progress, 200 OK. Identify where the call fails: SIP timeout, QCI 1 bearer not configured, codec negotiation failure.
Attach failures
Decode the NAS Attach Reject with its exact cause code: #3 (Illegal UE), #6 (Illegal ME), #7 (EPS services not allowed), #11 (PLMN not allowed). Each cause code points to a specific corrective action.
The HiCellTek Layer 3 Decoder
The HiCellTek L3 Decoder module captures and decodes signaling messages in real time directly on the Android handset. Access to the Qualcomm DIAG interface allows reading the same raw data as traditional tools (QCAT, TEMS), but without requiring a PC or USB cable.
The interface provides a stream of messages filterable by protocol type (RRC, NAS, SIP), by direction (uplink/downlink), by timestamp and by keyword. Each message is decoded and displayed with its structured fields, allowing you to read cause codes, configuration parameters and bearer identifiers directly.
ASN.1 decoding is performed in real time by the integrated C++ decoding engine, which supports 3GPP specifications up to Release 17. Messages are automatically correlated with L1/L2 radio metrics and GPS position, providing a complete view of each network event in its spatial and temporal context.
Related resources
FAQ: Layer 3 Decoder
What is Layer 3 signaling in mobile networks?
Layer 3 (L3) signaling encompasses the control protocols above the data link layer: RRC (Radio Resource Control) for radio management, NAS (Non-Access Stratum) for mobility and session management, SIP for voice over IP (VoLTE/VoNR) and DIAMETER for authentication. These messages govern the entire lifecycle of a mobile connection.
Why does a field engineer need an L3 decoder?
An L3 decoder enables you to pinpoint the exact root cause of a network issue: an Attach Reject with cause code #11 (PLMN not allowed), a handover failure with cause #2 (unspecified), or a VoLTE drop caused by a SIP 408 timeout. Without L3 decoding, the engineer only sees symptoms (service loss, call drop) without being able to diagnose the underlying cause.
What is the difference between RRC and NAS?
RRC (Radio Resource Control) manages the radio connection between the UE and the base station: measurement configuration, handovers, bearer reconfiguration. NAS (Non-Access Stratum) manages the relationship between the UE and the core network (MME in 4G, AMF in 5G): attachment, authentication, EPS bearer/PDU session management. RRC is transparent to the core network, while NAS is transparent to the base station.
Does HiCellTek decode L3 messages in real time in the field?
Yes. HiCellTek captures and decodes RRC, NAS, SIP and DIAMETER messages in real time directly on the Android handset, with no PC or post-processing required. Messages are displayed in a filterable interface with search by type, cause code and timestamp. Export to Excel, QMDL or HLOG is available at any time.
Decode L3 signaling directly in the field
RRC, NAS, SIP, DIAMETER: all signaling decoded in real time on your Android smartphone. No PC, no cables, no post-processing.