RRC Message Decoder for LTE & 5G NR
Decode Radio Resource Control messages from your drive test captures, QMDL files or DIAG logs. Paste a hex frame, get the full ASN.1 tree in seconds. Supports 3GPP Release 17, CellGroupConfig, EN-DC tunnel and conditional handover.
What is RRC?
RRC (Radio Resource Control) is the signaling protocol between your phone and the base station. It controls everything about the radio connection: how the phone attaches to a cell, how it gets handed over to a neighbor cell, how it reports signal measurements, and how security keys are configured.
For LTE, RRC is defined in 3GPP TS 36.331. For 5G NR, in 3GPP TS 38.331. Both use ASN.1 UPER encoding, which makes raw hex frames unreadable without a decoder.
RRC State Machine
Understanding RRC states is essential for diagnosing connectivity issues. An unexpected state transition often points to a coverage hole, a misconfigured timer or a congested cell.
No active radio connection. The phone performs cell reselection autonomously and monitors paging. Minimal battery consumption.
Active radio bearer. The network controls handovers, measurement reporting and scheduling. Data transfer is possible.
UE context stored at the network. Fast resume without full connection setup. Saves battery while enabling quick reconnection.
Key RRC Messages for Field Troubleshooting
Initial connection establishment. A missing RRCSetupComplete indicates the phone cannot complete the attach procedure (typically RACH failure or weak coverage).
The most complex RRC message. Carries CellGroupConfig (add/modify cells), measConfig (measurement setup), and nr-SecondaryCellGroupConfig for EN-DC/NR-DC activation. A failed reconfiguration causes call drops.
Sent by the UE to the network with neighbor cell measurements (RSRP, RSRQ, SINR). These reports trigger handover decisions. Analyzing them reveals whether handover failures are caused by late reporting or weak neighbor signal.
Connection teardown with a cause value. Common causes: redirectedCarrierInfo (inter-frequency redirect), deprioritisationReq (load balancing), or t310-Expiry (radio link failure). The cause tells you exactly why the connection dropped.
Broadcast by the cell. SIB1 carries cell identity, PLMN, tracking area and access control. SIB2 contains radio resource configuration (RACH parameters, paging config, UL power control). Essential for verifying cell-level configuration.
How to Decode an RRC Message
From a QMDL capture, HiCellTek app export, Wireshark PCAP, or any DIAG log. The frame is a hexadecimal string representing the UPER-encoded RRC message.
Choose DL-DCCH (downlink dedicated), UL-DCCH (uplink dedicated), BCCH-DL-SCH (broadcast), or PCCH (paging). This tells the decoder which ASN.1 structure to apply.
The C++ ASN.1 engine parses the frame in under 1 ms. Browse the result in tree, raw or table view. Use search to find specific IEs like measConfig, cellGroupConfig or sCellToAddModList.
LTE RRC vs 5G NR RRC
| Feature | LTE RRC (TS 36.331) | NR RRC (TS 38.331) |
|---|---|---|
| States | IDLE, CONNECTED | IDLE, CONNECTED, INACTIVE |
| Encoding | ASN.1 UPER | ASN.1 UPER |
| Max SCells | 7 (CA) | 31 (CA) + 32 (DC) |
| Handover | Standard HO | CHO (Conditional) + DAPS (Dual Active) |
| Key message | RRCConnectionReconfiguration | RRCReconfiguration |
| Dual Connectivity | EN-DC (nr-SCG-r15) | NR-DC (CellGroupConfig) |
Related Protocol Decoders
Frequently Asked Questions
What is RRC in LTE and 5G NR?
What are the most important RRC messages to decode?
How do I decode an RRC message from a QMDL file?
What is RRCReconfiguration and why does it matter?
What is the difference between LTE RRC and NR RRC?
Can I decode the NR config inside an LTE RRCConnectionReconfiguration?
What are RRC states and why do they matter for troubleshooting?
How does the RRC decoder handle Release 17?
Go deeper with real-time L3 analysis
HiCellTek decodes RRC, NAS and IMS/SIP directly on your smartphone. Identify root causes in seconds.
- β Full ASN.1 decoding
- β Real-time filters and search
- β Wireshark PCAP export