RRC & NAS Message Glossary
A complete reference of RRC (Radio Resource Control) and NAS (Non-Access Stratum) messages used in 2G, 4G LTE and 5G NR networks. Each entry includes a definition, message direction, 3GPP specification reference, key Information Elements and a link to decode the message with the HiCellTek L3 Protocol Decoder.
About this glossary
This glossary covers the most common RRC and NAS messages encountered during protocol analysis, drive testing and network troubleshooting. Definitions are based on 3GPP specifications up to Release 17. For LTE, the RRC specification is TS 36.331 and the NAS specification is TS 24.301. For 5G NR, the RRC specification is TS 38.331 and the NAS specification is TS 24.501. Use this page as a quick reference when analyzing decoded protocol traces.
RRC Messages (Radio Resource Control)
RRCReconfiguration / RRCConnectionReconfiguration
RRCReconfiguration is the primary NR RRC message used by the gNB to modify the radio configuration of a connected UE. In LTE, the equivalent message is RRCConnectionReconfiguration. It carries CellGroupConfig, measurement configurations, radio bearer additions or modifications, and handover commands. This is one of the most frequently decoded messages in field analysis because it controls carrier aggregation setup, EN-DC configuration and mobility procedures.
- Direction
- Network → UE
- 3GPP Spec
- TS 38.331 (NR), TS 36.331 (LTE)
- Key IEs
- CellGroupConfig, MeasConfig, RadioBearerConfig, masterCellGroup, nr-SecondaryCellGroupConfig
RRCSetup / RRCConnectionSetup
RRCSetup is sent by the network in response to an RRCSetupRequest from the UE. It establishes the Signaling Radio Bearer 1 (SRB1) and transitions the UE from RRC_IDLE to RRC_CONNECTED state. In LTE, the equivalent is RRCConnectionSetup. The message contains the initial radio resource configuration that the UE must apply, including cell-specific parameters and default radio bearer settings.
- Direction
- Network → UE
- 3GPP Spec
- TS 38.331 (NR), TS 36.331 (LTE)
- Key IEs
- radioBearerConfig, masterCellGroup, lateNonCriticalExtension
RRCRelease / RRCConnectionRelease
RRCRelease is sent by the network to command the UE to release the RRC connection and return to RRC_IDLE or RRC_INACTIVE state. In LTE, the equivalent is RRCConnectionRelease. The message may include redirection information to another frequency or RAT, idle mode mobility control information, and suspend configuration for NR RRC_INACTIVE state. Analyzing this message helps diagnose unexpected connection drops and forced redirections.
- Direction
- Network → UE
- 3GPP Spec
- TS 38.331 (NR), TS 36.331 (LTE)
- Key IEs
- redirectedCarrierInfo, idleModeMobilityControlInfo, suspendConfig, deprioritisationReq
MeasurementReport
MeasurementReport is sent by the UE to the network when a measurement reporting condition is met (event-triggered) or at periodic intervals. It contains measured values for serving and neighbor cells such as RSRP, RSRQ, SINR and cell identity. The network uses these reports to make handover, carrier aggregation and load balancing decisions. This is a critical message for mobility optimization and coverage analysis.
- Direction
- UE → Network
- 3GPP Spec
- TS 38.331 (NR), TS 36.331 (LTE)
- Key IEs
- measResults, measId, measResultServingMOList, measResultNeighCells, physCellId, rsrp, rsrq, sinr
RRCReestablishment / RRCConnectionReestablishment
RRCReestablishment is sent by the network in response to an RRCReestablishmentRequest when the UE attempts to recover a failed RRC connection. In LTE, the equivalent is RRCConnectionReestablishment. The procedure is triggered when the UE experiences radio link failure, handover failure or integrity check failure. Successful reestablishment restores the connection without a full setup procedure. Frequent reestablishment attempts indicate coverage gaps or mobility configuration issues.
- Direction
- Network → UE
- 3GPP Spec
- TS 38.331 (NR), TS 36.331 (LTE)
- Key IEs
- nextHopChainingCount, masterCellGroup (NR), radioResourceConfigDedicated (LTE)
SystemInformationBlockType1 (SIB1)
SIB1 is the first system information block broadcast by the cell. It contains essential parameters that the UE needs to access the cell: cell identity, PLMN list, tracking area code, cell barring status, scheduling information for other SIBs, and access control parameters. In NR, SIB1 also carries the cell selection information including q-RxLevMin and q-QualMin. Every cell in a mobile network broadcasts SIB1 periodically.
- Direction
- Network → UE (broadcast)
- 3GPP Spec
- TS 38.331 (NR), TS 36.331 (LTE)
- Key IEs
- cellAccessRelatedInfo, cellSelectionInfo, schedulingInfoList, si-WindowLength, plmn-IdentityInfoList
SecurityModeCommand (RRC)
The RRC SecurityModeCommand is sent by the network to activate integrity protection and optionally ciphering on the signaling radio bearers. The UE must apply the specified security algorithms and respond with a SecurityModeComplete message. If the UE cannot support the requested algorithms, it sends a SecurityModeFailure. This message is essential for verifying that the correct ciphering and integrity algorithms are negotiated between network and device.
- Direction
- Network → UE
- 3GPP Spec
- TS 38.331 (NR), TS 36.331 (LTE)
- Key IEs
- securityConfigSMC (cipheringAlgorithm, integrityProtAlgorithm)
UECapabilityInformation
UECapabilityInformation is sent by the UE in response to a UECapabilityEnquiry from the network. It reports the device capabilities including supported bands, band combinations, carrier aggregation configurations, MIMO layers, feature groups and protocol features. This message is critical for understanding what a device can support and why certain network features may or may not be activated. The decoded output is often very large due to the comprehensive capability reporting.
- Direction
- UE → Network
- 3GPP Spec
- TS 38.331 (NR), TS 36.331 (LTE)
- Key IEs
- ue-CapabilityRAT-ContainerList, supportedBandListNR, featureSetCombinations, supportedBandCombinationList
RRCResume (NR)
RRCResume is a 5G NR message sent by the network to resume a suspended RRC connection. It transitions the UE from RRC_INACTIVE back to RRC_CONNECTED state without requiring a full connection setup. The RRC_INACTIVE state was introduced in NR to reduce signaling overhead for devices with intermittent data traffic such as IoT sensors. RRCResume carries the updated master cell group configuration and any radio bearer modifications needed to resume data transfer.
- Direction
- Network → UE
- 3GPP Spec
- TS 38.331 (NR)
- Key IEs
- masterCellGroup, radioBearerConfig, fullConfig, suspendConfig
NAS Messages (Non-Access Stratum)
Attach Request (LTE) / Registration Request (5G)
The Attach Request is the initial NAS message sent by the UE to register with the LTE Evolved Packet Core (EPC) via the MME. In 5G, the equivalent is the Registration Request sent to the AMF. The message carries the UE identity (IMSI or GUTI), requested network capabilities, PDN connectivity information and EPS attach type. This is the starting point for analyzing registration failures and understanding what the device requests from the network.
- Direction
- UE → Network
- 3GPP Spec
- TS 24.301 (LTE), TS 24.501 (5G)
- Key IEs
- EPS mobile identity, UE network capability, ESM message container (LTE); 5GS mobile identity, 5GMM capability, requested NSSAI (5G)
Attach Accept (LTE) / Registration Accept (5G)
The Attach Accept is sent by the MME to confirm successful LTE registration. In 5G, the Registration Accept is sent by the AMF. The message assigns the UE a temporary identity (GUTI or 5G-GUTI), confirms the allowed tracking areas, provides the EPS or 5GS session management parameters, and may include the negotiated network features. Analyzing this message reveals what the network granted versus what the UE originally requested.
- Direction
- Network → UE
- 3GPP Spec
- TS 24.301 (LTE), TS 24.501 (5G)
- Key IEs
- EPS attach result, GUTI, TAI list, ESM message container (LTE); 5GS registration result, 5G-GUTI, allowed NSSAI (5G)
Attach Reject (LTE) / Registration Reject (5G)
The Attach Reject or Registration Reject is sent by the network when the UE registration fails. The message includes an EMM cause code (LTE) or 5GMM cause code (5G) that explains why registration was denied. Common causes include IMSI unknown, PLMN not allowed, illegal UE and network failure. Decoding the cause code is the first step in diagnosing why a subscriber cannot attach to the network.
- Direction
- Network → UE
- 3GPP Spec
- TS 24.301 (LTE), TS 24.501 (5G)
- Key IEs
- EMM cause (LTE), 5GMM cause (5G), T3346 value, T3502 value
Authentication Request / Authentication Response
The Authentication Request is sent by the network (MME in LTE, AMF in 5G) to verify the identity of the UE using AKA (Authentication and Key Agreement) procedures. The message contains the RAND and AUTN parameters derived from the subscriber's credentials. The UE responds with an Authentication Response containing the RES value. If authentication fails, the UE sends an Authentication Failure with the appropriate cause. These messages are essential for diagnosing SIM-related issues and security procedure failures.
- Direction
- Both (Request: Network → UE, Response: UE → Network)
- 3GPP Spec
- TS 24.301 (LTE), TS 24.501 (5G)
- Key IEs
- RAND, AUTN, RES/RES* (response), AUTS (sync failure), ngKSI/eKSI
Security Mode Command / Security Mode Complete (NAS)
The NAS Security Mode Command is sent by the network to activate NAS security (integrity protection and ciphering) after successful authentication. The message specifies the selected NAS security algorithms and the replayed UE security capabilities for verification. The UE responds with Security Mode Complete if it accepts the algorithms, or Security Mode Reject if it does not. In 5G, the Security Mode Complete may also carry the initial NAS message in a protected container.
- Direction
- Both (Command: Network → UE, Complete: UE → Network)
- 3GPP Spec
- TS 24.301 (LTE), TS 24.501 (5G)
- Key IEs
- selected NAS security algorithms, replayed UE security capabilities, IMEISV request, NAS message container (5G)
PDN Connectivity Request (LTE) / PDU Session Establishment Request (5G)
The PDN Connectivity Request is an ESM message in LTE used to request a new PDN connection (data bearer). In 5G, the equivalent is the PDU Session Establishment Request, a 5GSM message. These messages specify the requested APN or DNN (Data Network Name), PDU session type (IPv4, IPv6, IPv4v6), requested QoS parameters and protocol configuration options. Analyzing these messages is essential for troubleshooting data connectivity issues, APN misconfigurations and QoS problems.
- Direction
- UE → Network
- 3GPP Spec
- TS 24.301 (LTE ESM), TS 24.501 (5G 5GSM)
- Key IEs
- PDN type, APN (LTE), DNN (5G), requested QoS, protocol configuration options, PDU session type
Tracking Area Update Request
The Tracking Area Update (TAU) Request is sent by the UE when it moves to a new tracking area or when a periodic update timer expires. The message carries the current GUTI, the EPS update type (TA updating, combined TA/LA updating, periodic updating) and the UE network capability. In 5G, mobility registration updates serve a similar purpose. TAU messages are important for analyzing mobility behavior, paging optimization and understanding roaming patterns.
- Direction
- UE → Network
- 3GPP Spec
- TS 24.301 (LTE)
- Key IEs
- old GUTI, EPS update type, UE network capability, last visited registered TAI, bearer status
Service Request
The Service Request is sent by the UE to request the establishment or resumption of a NAS signaling connection when it is in EMM-IDLE mode (LTE) or 5GMM-IDLE/INACTIVE mode (5G). This is typically triggered by uplink data, a mobile-originated call or a response to paging. The message is integrity protected using the stored NAS security context. Frequent service requests can indicate inefficient network timer configurations or excessive paging cycles.
- Direction
- UE → Network
- 3GPP Spec
- TS 24.301 (LTE), TS 24.501 (5G)
- Key IEs
- KSI and sequence number (LTE), ngKSI, service type, 5G-S-TMSI (5G)
Detach Request (LTE) / Deregistration Request (5G)
The Detach Request is sent by either the UE or the network to terminate the EPS attachment. In 5G, the equivalent is the Deregistration Request. UE-initiated detach occurs when the device powers off or switches to a different RAT. Network-initiated detach occurs when the subscription is removed or the UE is unreachable. The message includes the detach type (EPS detach, IMSI detach, combined) and the cause for network-initiated cases. Understanding detach patterns helps diagnose unexpected disconnections.
- Direction
- Both (UE → Network or Network → UE)
- 3GPP Spec
- TS 24.301 (LTE), TS 24.501 (5G)
- Key IEs
- detach type, EMM cause (LTE), 5GMM cause (5G), switch off flag
Common NAS Cause Codes
NAS cause codes are included in reject and failure messages to indicate why a procedure was denied. The following table lists the most commonly encountered cause codes across LTE (TS 24.301) and 5G (TS 24.501).
| Code | Name | Meaning |
|---|---|---|
| #2 | IMSI unknown in HSS | The subscriber is not provisioned in the HSS/UDM database. |
| #3 | Illegal UE | The UE identity is not accepted by the network. Typically a SIM or USIM issue. |
| #6 | Illegal ME | The mobile equipment (IMEI) is not accepted. May indicate a blacklisted device. |
| #7 | EPS/5GS services not allowed | The subscription does not permit EPS or 5GS services in this PLMN. |
| #11 | PLMN not allowed | The UE is not authorized to access this PLMN. Common in roaming scenarios. |
| #12 | Tracking area not allowed | The UE is not permitted in this tracking area. May require a TAU in a different area. |
| #15 | No suitable cells in TA | No cells in the current tracking area support the requested service. |
| #17 | Network failure | A temporary failure in the core network. The UE should retry after a timer expires. |
| #22 | Congestion | The network is congested and cannot accept the request at this time. |
| #111 | Protocol error, unspecified | A protocol-level error occurred that does not match any specific cause code. |
Related resources
L3 Protocol Decoder
Decode RRC and NAS messages online. Free, no signup. Supports 2G, 4G LTE and 5G NR.
What is RRC (Radio Resource Control)?
Complete guide to the RRC protocol: messages, procedures, channels and 3GPP specifications.
What is NAS (Non-Access Stratum)?
NAS protocol explained: EMM, ESM, 5GMM, 5GSM, cause codes and decoding guide.
Free Online RRC & NAS Decoder
Decode RRC messages for free. 20 decodes/day, no signup, no install.
Telecom Glossary
RRC, NAS, RSRP, SINR, VoLTE, ASN.1 and all telecom terms explained.