NAS Decoder Online. Decode LTE & 5G NAS Messages
Decode NAS messages for LTE (TS 24.301) and 5G (TS 24.501). Attach, Registration, Authentication, PDU Session, cause codes and security parameters. TLV binary parsing with full IE coverage β Pro plan for unlimited decoding.
Key Facts. NAS Decoder Online
- Protocols
- LTE EPS NAS (EMM + ESM) and 5G NAS (5GMM + 5GSM)
- 3GPP Specs
- TS 24.301 (EPS NAS) + TS 24.501 (5GS NAS)
- Encoding
- TLV (Type-Length-Value) binary format
- Sub-protocols
- EMM, ESM (LTE) + 5GMM, 5GSM (5G)
- Cause codes
- Full cause code lookup with textual descriptions
- Pricing
- Pro plan: 29 EUR/month (unlimited NAS + RRC, batch, JSON)
- Batch mode
- Up to 1,000 NAS frames per batch (Pro plan)
- Output
- Tree view, raw text, table view, JSON export
What is NAS decoding?
NAS (Non-Access Stratum) is the Layer 3 signaling protocol that operates between the UE and the core network, the MME (Mobility Management Entity) in LTE/EPC and the AMF (Access and Mobility Management Function) in 5G Core. Unlike RRC, which manages the radio connection to the base station, NAS handles end-to-end procedures that are transparent to the radio access network: authentication, registration, session management, security activation, and mobility management. NAS messages are carried as payloads inside RRC messages (specifically within dedicated information elements) but are processed by the core network, not the eNodeB or gNodeB.
NAS messages are encoded using a TLV (Type-Length-Value) binary format defined in TS 24.007, unlike RRC which uses ASN.1 UPER. Each NAS message consists of a protocol discriminator, security header, message type, and a sequence of mandatory and optional IEs. The HiCellTek NAS decoder parses both LTE EPS NAS (TS 24.301. EMM and ESM) and 5G NAS (TS 24.501 β 5GMM and 5GSM), displaying every IE with its decoded value, cause code descriptions, and security algorithm identifiers. NAS decoding is essential for diagnosing attach failures, authentication issues, PDN/PDU session problems, roaming rejections, and VoLTE/VoNR session establishment failures.
Supported NAS message types
| LTE EPS NAS (TS 24.301) | Sub-protocol | 5G NAS (TS 24.501) | Sub-protocol |
|---|---|---|---|
| AttachRequest | EMM | RegistrationRequest | 5GMM |
| AttachAccept | EMM | RegistrationAccept | 5GMM |
| AttachReject | EMM | RegistrationReject | 5GMM |
| AuthenticationRequest | EMM | AuthenticationRequest | 5GMM |
| AuthenticationResponse | EMM | AuthenticationResponse | 5GMM |
| SecurityModeCommand | EMM | SecurityModeCommand | 5GMM |
| PDNConnectivityRequest | ESM | PDUSessionEstablishmentRequest | 5GSM |
| ServiceRequest | EMM | ServiceRequest | 5GMM |
| DetachRequest | EMM | DeregistrationRequest | 5GMM |
NAS cause codes reference
NAS cause codes appear in reject messages (AttachReject, RegistrationReject, ServiceReject, TAUReject) and indicate the specific reason the network denied a procedure. The decoder displays both the numeric code and the textual description.
| Cause code | Description | Typical scenario |
|---|---|---|
| #3 | Illegal UE | IMSI/SUPI flagged in EIR, stolen or blacklisted device. |
| #6 | Illegal ME | IMEI blocked in the Equipment Identity Register (EIR). |
| #7 | EPS services not allowed | Subscription does not include LTE/EPS data services. |
| #11 | PLMN not allowed | UE attempting to register on a PLMN not in its allowed list (roaming). |
| #12 | Tracking area not allowed | UE location not permitted for this subscription (regional restrictions). |
| #15 | No suitable cells in tracking area | No cells in the current TA support the UE's requested services. |
| #25 | Not authorized for this CSG | UE not a member of the Closed Subscriber Group (femtocell / small cell). |
| #40 | No EPS bearer context activated | Service request denied because no PDN connection is active. |
How to decode NAS messages online
Select NAS protocol
Open the HiCellTek decoder and select NAS decoding. Choose LTE NAS (TS 24.301) or 5G NAS (TS 24.501).
Paste hex payload
Paste the NAS hex payload from your PCAP, QMDL capture, Wireshark export, or HiCellTek Android app.
Decode
The engine parses the TLV binary structure, identifies all IEs, and displays cause codes with descriptions.
Analyze & export
Review cause codes, auth parameters, PDN/PDU session details. Export to .json for automated processing.
Pro plan required: NAS decoding is available on the Pro plan (29 EUR/month). The Pro plan includes unlimited NAS and RRC decoding, batch mode up to 1,000 frames, JSON export, and advanced search filters. A 7-day trial is available.
NAS decoder use cases
Attach failure diagnosis
Decode AttachReject and RegistrationReject messages to identify the exact NAS cause code blocking a UE from registering on the network. Differentiate between SIM issues (cause #3, #6), subscription problems (cause #7, #11), location restrictions (cause #12, #15), and authentication failures. Correlate the NAS reject with the preceding AuthenticationRequest/Response exchange to pinpoint the failure point in the registration flow.
VoLTE session analysis
Decode ESM messages to trace the VoLTE bearer setup: PDNConnectivityRequest with APN "ims", ActivateDefaultEPSBearerContextRequest for the default bearer, and ActivateDedicatedEPSBearerContextRequest for the QCI-1 voice bearer. Verify QoS parameters (GBR, MBR), TFT (Traffic Flow Template) filters, and linked EPS bearer IDs. Essential for debugging VoLTE call setup failures, one-way audio issues, and IMS registration problems.
Roaming troubleshooting
Analyze NAS messages exchanged during roaming: AttachRequest with IMSI or mapped GUTI, AuthenticationRequest/Response (to verify AKA vectors from HPLMN), and TAURequest/TAUAccept for tracking area updates. Identify roaming-specific rejections (cause #11 PLMN not allowed, cause #12 TA not allowed) and verify that the visited network applies the correct roaming agreement parameters, APN restrictions, and PLMN selection priorities.
Frequently Asked Questions. NAS Decoder
Is NAS decoding free?
NAS decoding is available on the HiCellTek Pro plan at 29 EUR/month. The free plan covers 20 RRC decodes per day but does not include NAS. The Pro plan provides unlimited NAS decoding for both LTE EPS NAS (TS 24.301) and 5G NAS (TS 24.501), along with batch mode (up to 1,000 frames), JSON export, and advanced search filters. A 7-day trial is available so you can test NAS decoding before committing.
What NAS protocols are supported?
The HiCellTek NAS decoder supports two NAS protocol stacks: LTE EPS NAS defined in TS 24.301, which includes EMM (EPS Mobility Management) and ESM (EPS Session Management) messages; and 5G NAS defined in TS 24.501, which includes 5GMM (5G Mobility Management) and 5GSM (5G Session Management) messages. Both protocol stacks are decoded with full TLV IE parsing, including optional and conditional IEs up to the latest 3GPP release.
What are NAS cause codes?
NAS cause codes are numeric values included in reject messages (AttachReject, RegistrationReject, ServiceReject, etc.) that indicate why the network denied a request. Common cause codes include #3 (Illegal UE), #6 (Illegal ME), #7 (EPS services not allowed), #11 (PLMN not allowed), #12 (Tracking area not allowed), #15 (No suitable cells in tracking area), and #40 (No EPS bearer context activated). The decoder displays the cause code with its textual description for immediate diagnosis.
Can I batch decode NAS messages?
Yes. The Pro plan supports batch decoding of up to 1,000 NAS frames in a single operation. Paste multiple hex frames separated by newlines, and the decoder processes all of them sequentially. Results can be exported as a single JSON file containing all decoded messages, which is ideal for post-processing in scripts or importing into analysis tools. Batch mode works for both LTE NAS and 5G NAS frames.
What is the difference between EMM and 5GMM?
EMM (EPS Mobility Management) is the LTE NAS sub-protocol defined in TS 24.301 that handles UE registration (Attach), authentication, security, tracking area updates, and service requests in the EPC (Evolved Packet Core). 5GMM (5G Mobility Management) is the equivalent sub-protocol defined in TS 24.501 for the 5G Core (5GC). Key differences: 5GMM uses Registration instead of Attach, supports NSSAI (network slicing), adds LADN (Local Area Data Network) concepts, uses SUCI/SUPI instead of IMSI/GUTI for privacy, and introduces the Service Request type for different access scenarios (3GPP, non-3GPP, emergency).
Related resources
L3 Protocol Decoder
Full multi-technology decoder: 2G, 3G, 4G LTE, 5G NR RRC and NAS.
What is NAS (Non-Access Stratum)?
NAS protocol explained: EMM, ESM, 5GMM, 5GSM, cause codes and decoding guide.
RRC vs NAS. Comparison
Differences between RRC and NAS protocols, encoding formats and use cases.
LTE RRC Decoder
Decode LTE RRC messages: RRCConnectionReconfiguration, SIB, TS 36.331 R17.
5G NR RRC Decoder
Decode NR RRC messages: RRCReconfiguration, CellGroupConfig, TS 38.331 R17.
Telecom glossary
RRC, NAS, RSRP, SINR, VoLTE, ASN.1, all terms explained.