RRCReconfiguration Message

RRCReconfiguration is the most important and complex RRC message in 5G NR. It carries all radio configuration changes, from handovers to bearer setup, measurement updates and cell group modifications.

Key Facts. RRCReconfiguration

Message name: RRCReconfiguration (5G NR) / RRCConnectionReconfiguration (LTE)
Direction: Downlink, gNB → UE
Logical channel: DL-DCCH (Downlink Dedicated Control Channel)
3GPP specification: TS 38.331 (5G NR), TS 36.331 (LTE)
Encoding: ASN.1 UPER (Unaligned Packed Encoding Rules)
UE response: RRCReconfigurationComplete (on UL-DCCH)

What is RRCReconfiguration?

RRCReconfiguration is the workhorse message of the 5G NR RRC protocol. Sent by the gNB (5G base station) to a UE in RRC_CONNECTED state, it instructs the UE to modify its radio configuration. Almost every significant change to the radio connection, from adding a secondary cell to executing a handover, is carried inside this single message type.

The message is defined in 3GPP TS 38.331 and uses ASN.1 with UPER encoding. A single RRCReconfiguration frame can contain hundreds of Information Elements (IEs) spanning physical layer parameters, MAC configuration, RLC bearer setup, PDCP configuration, measurement objects, security key updates and NAS message containers. This makes it one of the largest and most complex messages on the air interface.

In LTE, the equivalent message is RRCConnectionReconfiguration (TS 36.331). While the structure differs. LTE uses RadioResourceConfigDedicated rather than CellGroupConfig, the functional purpose is identical. In Non-Standalone (NSA) deployments using EN-DC, the LTE RRCConnectionReconfiguration carries the NR secondary cell group configuration inside the nr-SecondaryCellGroupConfig-r15 IE, effectively embedding an NR RRCReconfiguration payload.

When is RRCReconfiguration sent?

The gNB sends RRCReconfiguration whenever the radio configuration of a connected UE needs to change. The most common scenarios include:

Handover

The message carries a reconfigurationWithSync IE that provides the target cell configuration, new C-RNTI, random access parameters and timing advance. The UE detaches from the source cell and synchronizes to the target cell.

SCell addition / removal

For Carrier Aggregation, the gNB uses CellGroupConfig to add, modify or release Secondary Cells (SCells). Each SCell carries its own physical layer, MAC and scheduling configuration.

Bearer setup / release

When a new PDU session is established, DRBs (Data Radio Bearers) are set up via radioBearerConfig. SRB2 is also established through this message after initial security activation.

Measurement configuration

The measConfig IE defines which frequencies to measure, which events to report (A1–A6, B1–B2), gap configurations and quantity filters. This controls UE measurement behavior for mobility decisions.

Security update

A masterKeyUpdate IE can refresh the KgNB-derived keys, changing the security context. This occurs during intra-gNB handovers or when the security key needs to be refreshed.

NAS message delivery

NAS PDUs from the AMF can be piggybacked in the dedicatedNAS-MessageList IE, allowing the network to deliver registration accept, PDU session commands or other NAS messages alongside radio reconfiguration.

Key Information Elements

IE name	Purpose
CellGroupConfig	Configures SpCell (PCell/PSCell) and SCells: physical layer (BWP, PDSCH, PUSCH, CSI), MAC (BSR, PHR, SR, DRX), RLC bearers. This is the primary cell configuration container.
radioBearerConfig	Sets up, modifies or releases SRBs (SRB1, SRB2, SRB3) and DRBs. Contains PDCP config (header compression, ciphering), SDAP config (QoS flow mapping) and RLC mode selection.
measConfig	Measurement configuration: measObjectNR/EUTRA (frequencies, SSB config), reportConfig (event triggers A1–A6, B1–B2, periodical), measIdList (linking objects to reports), quantityConfig and measGapConfig.
reconfigurationWithSync	Handover command: target cell ID, new C-RNTI, RACH config for target cell, SSB measurement timing, timing advance group. Present only during handover.
masterKeyUpdate	Security key refresh: indicates whether to derive new keys using NCC (next hop chaining count), and specifies ciphering/integrity algorithms if changed.
secondaryCellGroupConfig	SCG (Secondary Cell Group) configuration for NR-NR Dual Connectivity or NR-E-UTRA DC. Contains a full CellGroupConfig for the secondary node.
dedicatedNAS-MessageList	List of NAS PDUs piggybacked from the AMF, such as registration accept, PDU session establishment accept, or service accept messages.

LTE RRCConnectionReconfiguration vs NR RRCReconfiguration

Aspect	LTE (TS 36.331)	5G NR (TS 38.331)
Message name	RRCConnectionReconfiguration	RRCReconfiguration
Cell config container	RadioResourceConfigDedicated	CellGroupConfig
Handover IE	mobilityControlInfo	reconfigurationWithSync
QoS flow mapping	Not applicable (EPS bearer based)	SDAP config in radioBearerConfig
BWP support	Not applicable	Active BWP switching via CellGroupConfig

How to decode RRCReconfiguration online

Open the decoder

Go to the HiCellTek L3 Decoder and select 5G NR (or 4G LTE for the LTE equivalent).

Select DL-DCCH

Choose DL-DCCH as the logical channel. RRCReconfiguration is always sent on the downlink dedicated control channel.

Paste hex frame

Paste the hexadecimal RRCReconfiguration frame from your QCAT, Wireshark, PCAP or DIAG log capture.

Analyze the tree

Click Decode. Expand CellGroupConfig, measConfig, radioBearerConfig nodes. Export to JSON or TXT for documentation.

Decode RRCReconfiguration now →

Frequently Asked Questions

What is RRCReconfiguration used for in 5G NR?

RRCReconfiguration is the primary RRC message sent by the gNB to modify the radio configuration of a UE in RRC_CONNECTED state. It is used for handovers, adding or removing secondary cells (SCells), setting up or releasing radio bearers (SRBs and DRBs), updating measurement configurations, activating security, and configuring Carrier Aggregation or Dual Connectivity. It is defined in 3GPP TS 38.331 and is the most complex and frequently analyzed 5G NR RRC message.

What is the LTE equivalent of RRCReconfiguration?

The LTE equivalent is RRCConnectionReconfiguration, defined in 3GPP TS 36.331. Both messages serve the same purpose, modifying the radio configuration of a connected UE, but RRCReconfiguration uses the 5G NR ASN.1 structure with CellGroupConfig, while the LTE version uses RadioResourceConfigDedicated. In EN-DC (E-UTRA–NR Dual Connectivity), the LTE RRCConnectionReconfiguration carries the NR configuration inside the nr-Config or nr-SecondaryCellGroupConfig-r15 IE.

What are the key IEs inside RRCReconfiguration?

The most important Information Elements inside RRCReconfiguration include: CellGroupConfig (physical layer, MAC, RLC, PDCP and antenna configuration for SpCells and SCells), radioBearerConfig (SRB and DRB setup/release with PDCP and SDAP parameters), measConfig (measurement objects, report configurations, quantity configs and measurement gaps), masterKeyUpdate (security key refresh), and secondaryCellGroupConfig (SCG configuration for Dual Connectivity scenarios). The message also carries a NAS container (dedicatedNAS-MessageList) when NAS messages must be piggybacked.

How do I decode an RRCReconfiguration hex frame?

To decode an RRCReconfiguration message: (1) Open the HiCellTek online decoder at /en/decoder/. (2) Select 5G NR as the technology (or 4G LTE for RRCConnectionReconfiguration). (3) Choose DL-DCCH as the logical channel, since RRCReconfiguration is always sent on the downlink dedicated control channel. (4) Paste the hexadecimal frame. (5) Click Decode. The decoder will produce a full ASN.1 tree view showing every IE, including nested CellGroupConfig structures and measurement configurations.