PDU Session Establishment in 5G NAS
PDU Session Establishment is the 5G NAS procedure that provides data connectivity. It replaces the LTE EPS bearer model with a flexible session-based approach supporting IPv4, IPv6, Ethernet and unstructured data types.
Key Facts. PDU Session Establishment
- Protocol
- 5G NAS โ 5GSM (5GS Session Management)
- Direction
- UE ↔ SMF (via AMF)
- 3GPP specification
- TS 24.501 (NAS for 5GS)
- Session types
- IPv4, IPv6, IPv4v6, Ethernet, Unstructured
- LTE equivalent
- PDN Connectivity / EPS Bearer (TS 24.301 ESM)
What is PDU Session Establishment?
PDU Session Establishment is the 5G NAS procedure through which a UE obtains data connectivity from the 5G Core network. It is defined in 3GPP TS 24.501 as part of the 5GSM (5GS Session Management) protocol. Unlike LTE, where a default bearer is automatically created during attach, 5G separates registration (5GMM) from session management (5GSM). The UE must explicitly request a PDU session after successful registration by sending a PDU Session Establishment Request to the SMF (Session Management Function) through the AMF.
The procedure supports a wide range of connectivity types. In addition to traditional IPv4 and IPv6 data sessions, 5G introduces Ethernet-type PDU sessions for industrial IoT and campus networks, as well as Unstructured sessions for constrained IoT devices that need raw data transfer. Each PDU session contains one or more QoS flows identified by a QFI (QoS Flow Identifier), replacing the bearer-based QoS model of LTE. The SMF allocates QoS rules, a session AMBR (Aggregate Maximum Bit Rate), and optionally mapped EPS bearer contexts for interworking with LTE.
PDU Session types
| Type | Description | Use case |
|---|---|---|
| IPv4 | Standard IPv4 connectivity. The SMF/UPF assigns an IPv4 address to the UE. | General internet access, legacy applications requiring IPv4. |
| IPv6 | IPv6-only connectivity. The UE receives a /64 IPv6 prefix via Router Advertisement or PCO. | IoT deployments, networks transitioning to IPv6-only. |
| IPv4v6 | Dual-stack connectivity providing both IPv4 and IPv6 addresses simultaneously. | Most smartphone data sessions, ensuring compatibility with both IPv4 and IPv6 services. |
| Ethernet | Layer 2 (Ethernet frame) transport. No IP address is assigned by the 5GC; the UE uses its own L2/L3 stack. | Industrial IoT, campus networks, TSN (Time-Sensitive Networking), private 5G. |
| Unstructured | Raw point-to-point data transfer without IP or Ethernet headers. Transparent pass-through. | Constrained IoT devices, non-IP protocols, serial data tunneling. |
Key messages in the procedure
| Message | Direction | Purpose |
|---|---|---|
| PDU Session Establishment Request | UE → SMF | Initiates a new PDU session. Contains requested PDU session type, SSC mode, requested QoS rules, DNN, S-NSSAI, and extended PCO. |
| PDU Session Establishment Accept | SMF → UE | Confirms the session. Contains selected PDU session type, assigned QoS rules, session AMBR, PDU address (IP), and mapped EPS bearer contexts. |
| PDU Session Establishment Reject | SMF → UE | Denies the session request. Contains a 5GSM cause code indicating the reason (e.g., insufficient resources, unknown DNN, missing subscription). |
| PDU Session Modification Request/Command | UE ↔ SMF | Modifies an existing session. Can add/remove QoS flows, update QoS rules, change session AMBR, or modify the always-on PDU session indication. |
| PDU Session Release Request/Command | UE ↔ SMF | Terminates a PDU session. All associated QoS flows and resources are released. Can be initiated by UE or network. |
Key Information Elements
| IE name | Purpose |
|---|---|
| PDU session type | Specifies the requested/selected session type: IPv4 (001), IPv6 (010), IPv4v6 (011), Ethernet (100), or Unstructured (101). |
| SSC mode | Session and Service Continuity mode. SSC mode 1 maintains the same UPF anchor during mobility; SSC mode 2 releases and re-establishes; SSC mode 3 allows make-before-break with a new anchor. |
| Authorized QoS rules | Define packet filter sets and their associated QoS Flow Identifier (QFI). Each rule maps traffic to a specific QoS flow with guaranteed or non-guaranteed bit rates. |
| Extended protocol configuration options | Carries protocol parameters like DNS server addresses (IPv4/IPv6), P-CSCF addresses for IMS, and MTU size. Equivalent to LTE's PCO but extended for 5G. |
| SM PDU DN request container | Contains information for the data network (DN) during session establishment. Used for application-specific session parameters or DN authorization. |
| Mapped EPS bearer contexts | Provides EPS bearer context mapping for interworking with LTE. Enables the UE to re-establish EPS bearers when handing over from 5G to LTE. |
PDU Session vs EPS Bearer
| Aspect | LTE (ESM. TS 24.301) | 5G (5GSM. TS 24.501) |
|---|---|---|
| Data connectivity unit | EPS bearer (default + dedicated) | PDU session with QoS flows |
| QoS model | Bearer-level QoS (QCI, ARP, GBR/MBR per bearer) | Flow-based QoS (5QI, QFI, QoS rules per flow) |
| Traffic filtering | TFT (Traffic Flow Template) per bearer | QoS rules with packet filter sets per QoS flow |
| Session types | IPv4, IPv6, IPv4v6 | IPv4, IPv6, IPv4v6, Ethernet, Unstructured |
| Setup trigger | Default bearer created during Attach; dedicated bearers added later | PDU session explicitly requested after Registration |
| Session continuity | Handover with S-GW/P-GW relocation | SSC modes 1/2/3 for flexible UPF anchoring |
| Control plane entity | MME (combined MM + SM signaling) | AMF (5GMM) + SMF (5GSM), separated |
How to decode PDU Session messages
Paste NAS hex frame
Select the NAS 5GS channel and paste the hex, extract it from Wireshark, QMDL tools, or the NAS PDU in DLInformationTransfer/ULInformationTransfer.
Analyze the IEs
Click Decode. Inspect PDU session type, SSC mode, QoS rules, session AMBR, extended PCO and mapped EPS bearer contexts.
Frequently Asked Questions
What is PDU Session Establishment in 5G?
PDU Session Establishment is the 5G NAS procedure by which a UE requests data connectivity from the 5G Core network. It is defined in 3GPP TS 24.501 as part of the 5GSM (5GS Session Management) protocol. The UE sends a PDU Session Establishment Request to the SMF (via the AMF) specifying the desired PDU session type (IPv4, IPv6, IPv4v6, Ethernet, or Unstructured), SSC mode, and optionally requested QoS rules and DNN (Data Network Name). The SMF responds with a PDU Session Establishment Accept containing the allocated IP address, authorized QoS rules, and session AMBR.
What are the different PDU session types in 5G?
5G supports five PDU session types defined in TS 24.501: (1) IPv4, standard IPv4 data connectivity, similar to LTE's IPv4 PDN type. (2) IPv6. IPv6-only connectivity with a /64 prefix assigned to the UE. (3) IPv4v6, dual-stack connectivity providing both IPv4 and IPv6 addresses. (4) Ethernet. Layer 2 connectivity for industrial IoT, campus networks and TSN (Time-Sensitive Networking) applications. (5) Unstructured, raw IP or non-IP data transfer for constrained IoT devices. The Ethernet and Unstructured types are new in 5G and have no LTE equivalent.
How does PDU Session Establishment differ from LTE EPS bearer setup?
In LTE, data connectivity uses the EPS bearer concept where a default bearer is established during attach (via PDN Connectivity Request piggybacked in Attach Request) and dedicated bearers are added for different QoS flows. In 5G, the PDU session concept replaces bearers entirely. A PDU session contains one or more QoS flows, each identified by a QFI (QoS Flow Identifier). The 5G model separates the session management protocol (5GSM) from the mobility management protocol (5GMM), and uses QoS rules and QoS flow descriptions instead of bearer-level TFTs. Additionally, 5G introduces SSC (Session and Service Continuity) modes for controlling session anchoring during mobility.
How do I decode PDU Session Establishment messages?
To decode PDU Session Establishment Request or Accept: (1) Open the HiCellTek online decoder at /en/decoder/. (2) Select 5G NR. (3) Choose the NAS 5GS channel. (4) Paste the hexadecimal NAS frame, extract it from Wireshark, a QMDL parser, or from the dedicatedNAS-Message in an RRC DL/UL Information Transfer. (5) Click Decode. The decoder displays all 5GSM IEs including PDU session type, SSC mode, authorized QoS rules, session AMBR, mapped EPS bearer contexts, and extended protocol configuration options.
Related resources
L3 Protocol Decoder
Online RRC and NAS decoder for 2G/3G/4G/5G. Free, no signup.
What is NAS Protocol?
Complete guide to Non-Access Stratum signaling in LTE and 5G.
Registration Request (5G)
The 5GS registration procedure, first step before PDU session setup.
Attach Request (LTE)
LTE EPS attach procedure, includes default bearer setup via ESM.
NAS Decoder Online
Decode any NAS EMM/ESM or 5GMM/5GSM message from hex instantly.