LTE RRC Decoder. Decode 4G Signaling Messages Online
Instantly decode LTE RRC messages from TS 36.331 Release 17. RRCConnectionReconfiguration, MeasurementReport, SIB, HandoverCommand and more. Native C++ ASN.1 UPER engine β free, no signup.
Key Facts. LTE RRC Decoder
- Protocol
- RRC (Radio Resource Control) for E-UTRAN / LTE
- 3GPP Spec
- TS 36.331, up to Release 17
- Radio Access
- EUTRA (Evolved Universal Terrestrial Radio Access)
- Encoding
- ASN.1 UPER (Unaligned Packed Encoding Rules)
- 3GPP Release
- R8 through R17, full backward compatibility
- Engine
- Native C++ compiled with asn1c, sub-millisecond decoding
- Free plan
- 20 LTE RRC decodes/day, no signup
- NSA tunnel
- Automatic nr-SecondaryCellGroupConfig-r15 extraction
What is LTE RRC?
LTE RRC (Radio Resource Control) is the Layer 3 signaling protocol defined in 3GPP TS 36.331 that operates between the User Equipment (UE) and the eNodeB in the E-UTRAN (Evolved UMTS Terrestrial Radio Access Network). RRC is responsible for establishing, maintaining and releasing radio connections. It configures every aspect of the radio link: measurement reporting, handover procedures, radio bearer setup, security activation, carrier aggregation, and System Information broadcasting. Every LTE device in the field exchanges hundreds of RRC messages during a typical session, making RRC analysis fundamental to network troubleshooting and optimization.
RRC messages are encoded using ASN.1 UPER (Unaligned Packed Encoding Rules), a compact binary format that minimizes over-the-air overhead. This encoding makes raw hex frames unreadable without a dedicated decoder. The HiCellTek LTE RRC decoder uses a native C++ ASN.1 engine compiled directly from the TS 36.331 Release 17 ASN.1 schema, ensuring full accuracy and support for the latest IEs including carrier aggregation extensions, eLAA, NB-IoT parameters, and the nr-SecondaryCellGroupConfig-r15 IE used to tunnel NR configuration in NSA deployments.
Key LTE RRC messages
| Message | Channel | Direction | Purpose |
|---|---|---|---|
| RRCConnectionSetup | DL-CCCH | eNB → UE | Establishes the initial RRC connection and assigns SRB1 configuration. |
| RRCConnectionReconfiguration | DL-DCCH | eNB → UE | Modifies radio configuration: measurement setup, bearer changes, CA addition, handover, NR tunnel. |
| MeasurementReport | UL-DCCH | UE → eNB | Reports RSRP, RSRQ and SINR measurements for serving and neighbor cells. |
| RRCConnectionRelease | DL-DCCH | eNB → UE | Releases the RRC connection and moves the UE to RRC_IDLE state. |
| RRCConnectionReestablishment | DL-CCCH | eNB → UE | Re-establishes a failed connection (handover failure, RLF, integrity check failure). |
| SystemInformationBlockType1 | BCCH-DL-SCH | eNB → broadcast | Broadcasts cell access information: PLMN list, TAC, cell barring, SIB scheduling. |
| HandoverCommand | DL-DCCH (encapsulated) | eNB → UE | Target cell radio configuration delivered during inter-eNB handover via S1/X2. |
| SecurityModeCommand | DL-DCCH | eNB → UE | Activates ciphering and integrity protection algorithms (EEA, EIA). |
LTE RRC logical channels
LTE RRC messages are transported over eight logical channels. The decoder automatically detects the channel type, but manual selection is available for ambiguous frames.
| Channel | Direction | Description |
|---|---|---|
| DL-DCCH | Downlink | Dedicated Control Channel, carries RRCConnectionReconfiguration, SecurityModeCommand, RRCConnectionRelease and most dedicated messages from eNB to UE. |
| UL-DCCH | Uplink | Dedicated Control Channel, carries MeasurementReport, RRCConnectionReconfigurationComplete, SecurityModeComplete from UE to eNB. |
| DL-CCCH | Downlink | Common Control Channel, carries RRCConnectionSetup, RRCConnectionReject, RRCConnectionReestablishment. |
| UL-CCCH | Uplink | Common Control Channel, carries RRCConnectionRequest, RRCConnectionReestablishmentRequest from UE to eNB. |
| BCCH-BCH | Broadcast | Broadcast Control Channel (BCH), carries the Master Information Block (MIB) with system bandwidth, SFN and PHICH config. |
| BCCH-DL-SCH | Broadcast | Broadcast Control Channel (DL-SCH), carries SIB1 through SIB26 and SystemInformation messages. |
| PCCH | Broadcast | Paging Control Channel, carries Paging messages to notify idle UEs of incoming calls, SMS or system info changes. |
| MCCH | Multicast | Multicast Control Channel, carries MBSFNAreaConfiguration for MBMS service scheduling. |
LTE RRC states
LTE defines two RRC states that determine the level of signaling activity and resource allocation for a UE.
RRC_IDLE
- No dedicated radio resources allocated
- UE monitors paging channel (PCCH) for incoming events
- UE performs cell reselection autonomously
- UE reads System Information (MIB, SIBs) from broadcast channels
- Mobility managed by UE, no eNB involvement
- DRX cycle configured by SIB2 for power savings
RRC_CONNECTED
- Dedicated radio bearers (SRB1, SRB2, DRBs) established
- UE sends MeasurementReport based on configured events (A1-A6, B1-B2)
- Handover controlled by eNB via RRCConnectionReconfiguration
- Carrier aggregation and EN-DC configured via measConfig
- Security (ciphering + integrity) active on all bearers
- Connected-mode DRX optionally enabled for battery optimization
State transitions: UE transitions from IDLE to CONNECTED via RRCConnectionSetup (after RRCConnectionRequest). It returns to IDLE via RRCConnectionRelease or after Radio Link Failure (RLF). All decoded RRC messages carry context about which state transition is occurring, the decoder highlights these transitions in the tree view.
How to decode LTE RRC messages
Select 4G LTE
Open the HiCellTek decoder and select 4G LTE. Choose the logical channel: DL-DCCH, UL-DCCH, BCCH-DL-SCH, or use auto-detect.
Paste hex frame
Paste the hexadecimal RRC frame from your QMDL capture, Wireshark PCAP, TEMS log or HiCellTek Android export.
Decode
The C++ ASN.1 UPER engine parses the frame per TS 36.331 R17 and renders the result in tree, raw or table view.
Analyze & export
Inspect measConfig, radioResourceConfigDedicated, mobilityControlInfo. Export to .txt or .json.
LTE RRC decoder use cases
Drive test analysis
Decode MeasurementReport and RRCConnectionReconfiguration messages from drive test logs to analyze handover decisions, event A3/A5 triggers, neighbor cell rankings, and RSRP/RSRQ thresholds configured by the network. Identify missing neighbors, ping-pong handovers, and coverage gaps from the decoded RRC tree.
CA and handover validation
Verify carrier aggregation configuration (SCell additions, band combinations, cross-carrier scheduling) and EN-DC setup by decoding RRCConnectionReconfiguration messages. Confirm that the correct SCells are activated, TDD configs match planning, and the nr-SecondaryCellGroupConfig is properly tunneled for NSA deployments.
SIB audit
Decode SystemInformationBlockType1 and SIB2 through SIB26 to audit broadcast parameters: cell access restrictions, PLMN lists, tracking area codes, idle mode DRX, RACH configuration, PRACH parameters, power control settings, and inter-frequency/inter-RAT reselection priorities. Essential for new site integration and optimization.
Frequently Asked Questions. LTE RRC Decoder
What is RRCConnectionReconfiguration?
RRCConnectionReconfiguration is the most important LTE RRC message defined in TS 36.331. It is sent by the eNodeB to the UE on the DL-DCCH logical channel to modify the radio configuration. It carries measurement configurations, radio bearer additions or modifications, handover commands, carrier aggregation (CA) setup, and in NSA deployments it tunnels the NR CellGroupConfig via the nr-SecondaryCellGroupConfig-r15 IE. A single RRCConnectionReconfiguration can contain hundreds of IEs, making a decoder essential for analysis.
What channels does LTE RRC use?
LTE RRC uses eight logical channels: DL-DCCH and UL-DCCH for dedicated signaling between the eNB and a specific UE, DL-CCCH and UL-CCCH for common signaling during initial access, BCCH-BCH for the Master Information Block (MIB), BCCH-DL-SCH for System Information Blocks (SIBs), PCCH for paging messages, and MCCH for MBMS (Multimedia Broadcast Multicast Service) control information. The HiCellTek decoder supports all eight channels with automatic detection.
Can I decode LTE RRC for free?
Yes. The HiCellTek free plan provides 20 LTE RRC decodes per day with no signup required. Simply select 4G LTE, choose the logical channel (or use auto-detect), paste the hex frame, and click Decode. The free plan covers all LTE RRC messages including RRCConnectionReconfiguration, MeasurementReport, SIB, and HandoverCommand. The Pro plan at 29 EUR/month adds unlimited decodes, NAS decoding, batch mode and JSON export.
What is the difference between LTE RRC and NR RRC?
LTE RRC is defined in TS 36.331 and governs the radio interface between the UE and eNodeB in E-UTRAN (4G). NR RRC is defined in TS 38.331 and governs the interface between the UE and gNodeB in NG-RAN (5G). Key differences include: NR RRC adds the RRC_INACTIVE state for power savings, NR uses CellGroupConfig instead of RadioResourceConfigDedicated, NR supports bandwidth parts (BWPs), and NR RRC messages can be significantly larger due to FR2 beam management parameters. In NSA mode, NR RRC configuration is tunneled inside LTE RRCConnectionReconfiguration.
How do I get LTE RRC hex frames?
LTE RRC hex frames can be obtained from several sources: QMDL captures using the Qualcomm DIAG interface, PCAP files exported from Wireshark or tshark (filter on lte-rrc), HiCellTek Android app exports, TEMS Investigation or Nemo Analyze log exports, Accuver XCAL logs, or network-side traces from eNodeB vendors. The hex frame is the raw ASN.1 UPER-encoded byte sequence representing a single RRC PDU on a specific logical channel.
Related resources
L3 Protocol Decoder
Full multi-technology decoder: 2G, 3G, 4G LTE, 5G NR RRC and NAS.
What is RRC (Radio Resource Control)?
Complete guide to the RRC protocol: messages, procedures, channels and 3GPP specifications.
RRC vs NAS. Comparison
Differences between RRC and NAS protocols, encoding formats and use cases.
5G NR RRC Decoder
Decode NR RRC messages: RRCReconfiguration, CellGroupConfig, TS 38.331 R17.
NAS Decoder Online
Decode LTE EPS NAS and 5G NAS messages: Attach, Registration, PDU Session.
Telecom glossary
RRC, NAS, RSRP, SINR, VoLTE, ASN.1, all terms explained.