Free Tool

NAS Message Decoder for 4G LTE & 5G

Decode Non-Access Stratum messages from your network captures. Identify attach failures, authentication issues and session setup problems by reading the exact NAS cause codes from the raw hex frames.

Open the Decoder See Plans

What is NAS?

NAS (Non-Access Stratum) is the signaling protocol between your phone and the mobile core network. Unlike RRC which manages the radio link, NAS handles identity verification, network registration, IP session establishment and mobility between tracking areas.

For LTE, NAS is defined in 3GPP TS 24.301 and splits into EMM (mobility) and ESM (session). For 5G, NAS is defined in 3GPP TS 24.501 and splits into 5GMM and 5GSM.

NAS in the Protocol Stack

LTE (EPS) NAS

UE ↔ MME

EMM
Attach, Auth, TAU, Detach

ESM
PDN, Bearer, QoS

TS 24.301

5G (5GS) NAS

UE ↔ AMF

5GMM
Registration, Auth, Service

5GSM
PDU Session, QoS Flow

TS 24.501

Key NAS Messages for Troubleshooting

👤

Attach Request / Registration Request

Initial registration to the network. Contains IMSI/GUTI, requested PDN type, APN, UE security capabilities and supported codecs. Decoding this message reveals what the phone is requesting and which capabilities it advertises.

🔒

Authentication Request / Response

Mutual authentication between the USIM and the network. The request carries the RAND and AUTN challenges. A failed authentication (Authentication Failure) with cause "MAC failure" or "SYNCH failure" indicates a SIM/HSS synchronization issue.

🔐

Security Mode Command / Complete

Activates NAS encryption and integrity protection. The command specifies the selected EEA/EIA (LTE) or NEA/NIA (5G) algorithms. After this exchange, subsequent NAS messages are encrypted.

🌐

PDN Connectivity / PDU Session Establishment

IP session setup. The request specifies the APN/DNN, PDN/PDU type (IPv4, IPv6, IPv4v6) and requested QoS. The response carries the assigned IP address, default bearer QoS and protocol configuration options (DNS, MTU).

Common NAS Reject Cause Codes

When a NAS procedure fails, the reject message carries a cause code that pinpoints the problem.

Code	Cause (EMM / 5GMM)	What it means
#2	IMSI unknown in HSS	SIM not provisioned in the core network
#3	Illegal UE	UE identity rejected by network
#7	EPS/5GS services not allowed	Subscription does not include data services
#11	PLMN not allowed	Roaming to this network is forbidden
#17	Network failure	Internal core network error
#22	Congestion	Network overloaded, retry with back-off timer

Related Protocol Decoders

📡

L3 Protocol Decoder

Full decoder: RRC + NAS, all technologies, batch mode.

📡

RRC Decoder

Decode RRC messages: Setup, Reconfiguration, MeasurementReport.

📄

QMDL Decoder

Read and decode Qualcomm DIAG logs on Android.

Frequently Asked Questions

What is NAS in LTE and 5G?

NAS (Non-Access Stratum) is the Layer 3 protocol between the UE and the core network (MME for LTE, AMF for 5G). It handles authentication, registration, session management (PDN/PDU), security mode control, and mobility management. NAS is defined in 3GPP TS 24.301 (EPS/LTE) and TS 24.501 (5GS/NR).

What is the difference between NAS and RRC?

RRC operates between the UE and the base station and manages the radio connection (handovers, measurements, bearer setup). NAS operates between the UE and the core network, passing transparently through the base station. NAS handles identity, authentication, IP session setup and mobility between tracking areas. Both are Layer 3 but at different protocol stack levels.

What are the most important NAS messages?

For LTE: Attach Request/Accept (initial network registration), Authentication Request/Response (USIM verification), Security Mode Command/Complete (encryption activation), and Activate Default EPS Bearer Context (IP session setup). For 5G: Registration Request/Accept, PDU Session Establishment Request/Accept, and Service Request.

How do I decode a NAS message?

Extract the NAS hex payload from a PCAP capture (Wireshark), QMDL file, or HiCellTek export. Select 'NAS' as the protocol type in the decoder, choose LTE EPS or 5GS NAS, paste the hex and click Decode. The result shows the message type, protocol discriminator, security header and all information elements.

Can NAS messages be encrypted?

Yes. After the Security Mode Command procedure, NAS messages are encrypted (using EEA algorithms for LTE, NEA for 5G) and integrity-protected (EIA/NIA). The decoder can parse the security header and protocol discriminator of encrypted messages, but the actual content requires the decryption keys. Unencrypted initial messages (Attach Request, Registration Request) are always fully decodable.

What is the difference between EMM and ESM in LTE NAS?

EMM (EPS Mobility Management) handles registration, authentication, security and tracking area updates. ESM (EPS Session Management) handles PDN connectivity, bearer setup and QoS. In 5G, the equivalents are 5GMM (5G Mobility Management) and 5GSM (5G Session Management). EMM and ESM messages can be piggybacked in the same NAS container.

Why does an Attach Request fail?

Common causes visible in NAS decoding: IMSI unknown in HSS (EMM cause #2), PLMN not allowed (#11), EPS services not allowed (#7), network failure (#17), or congestion (#22). The Attach Reject message carries the exact EMM cause value, which pinpoints the root cause. Decoding the full Attach Request also reveals requested PDN type, APN, UE capabilities and security capabilities.

📡

Go deeper with real-time L3 analysis

HiCellTek decodes RRC, NAS and IMS/SIP directly on your smartphone. Identify root causes in seconds.

✓ Full ASN.1 decoding
✓ Real-time filters and search
✓ Wireshark PCAP export

Request a demo View pricing