Sample RRC & NAS Hex Frames
A curated library of example hex frames for testing and validating RRC and NAS decoders. Each frame below can be pasted directly into the HiCellTek L3 Decoder for instant decoding.
Note: These are example frames for demonstration purposes. They follow correct ASN.1 encoding rules and are suitable for decoder testing and protocol learning.
5G NR RRC. Sample Frames
5G NR RRC messages are defined in 3GPP TS 38.331 and encoded using ASN.1 UPER. These frames demonstrate common NR RRC procedures.
RRCReconfiguration (DL-DCCH)
An NR RRCReconfiguration message carrying a CellGroupConfig with physical cell configuration, MAC parameters and a measurement configuration with two measurement objects. This is one of the most commonly analyzed 5G NR messages.
20108092A3C804000C8142A801E200018A80040000480A14C0230400007414400044000000094480001808002E20140018440080608000900E0002C02808003000200A0830001A014000200050041C001000A002806802000100028020E0008004C014038010 Expected output: RRCReconfiguration with radioBearerConfig, measConfig (two measObjectNR entries), cellGroupConfig containing physicalCellGroupConfig, mac-CellGroupConfig and spCellConfig.
Decode this frame →RRCSetup (DL-CCCH)
An NR RRCSetup message establishing the initial RRC connection with SRB1 configuration. This message is sent by the gNB in response to an RRCSetupRequest from the UE.
1C048001200860090A604801060300E4000C0A320A00400004300480000C30024000310002001C30 Expected output: RRCSetup with rrc-TransactionIdentifier and radioBearerConfig containing SRB-ToAddModList with SRB1 (srb-Identity 1), PDCP configuration and RLC configuration.
Decode this frame →RRCRelease (DL-DCCH)
An NR RRCRelease message directing the UE to transition from RRC_CONNECTED to RRC_IDLE or RRC_INACTIVE. May include redirected carrier information or suspend configuration.
08200000 Expected output: RRCRelease with rrc-TransactionIdentifier. Minimal release without redirection or suspend configuration.
Decode this frame →LTE RRC. Sample Frames
LTE RRC messages are defined in 3GPP TS 36.331 and encoded using ASN.1 UPER. These examples cover the most commonly captured LTE procedures.
RRCConnectionReconfiguration (DL-DCCH)
An LTE RRCConnectionReconfiguration message with measurement configuration including multiple measurement objects and report configurations. Contains radio resource configuration with DRB setup.
2016108000100A3CE8A019401E800088C000470024500830060A049008040000220000301400200E4028814010000B640028A34088 Expected output: RRCConnectionReconfiguration with rrc-TransactionIdentifier, measConfig (measObjectEUTRA with cell lists, reportConfigEUTRA), radioResourceConfigDedicated with DRB-ToAddModList.
Decode this frame →MeasurementReport (UL-DCCH)
An LTE MeasurementReport containing serving cell and neighbor cell measurements. Includes RSRP and RSRQ values for the serving cell and multiple neighbor cells, commonly triggered by event A3 (neighbor better than serving).
0800400438023A0020A0140C8032003500380014A01A640198018C01 Expected output: MeasurementReport with measId, measResultServCell (rsrpResult, rsrqResult) and measResultNeighCells containing multiple measResultListEUTRA entries with physCellId and measurement results.
Decode this frame →SystemInformationBlockType1 (BCCH-DL-SCH)
An LTE SIB1 message broadcast on BCCH-DL-SCH containing cell access information, PLMN identity list, tracking area code, cell identity and SIB scheduling information.
404C469304042810AE0200000000C602500A00980000 Expected output: SystemInformationBlockType1 with cellAccessRelatedInfo (plmn-IdentityList, trackingAreaCode, cellIdentity), cellSelectionInfo (q-RxLevMin) and schedulingInfoList.
Decode this frame →UMTS RRC. Sample Frames
UMTS RRC messages are defined in 3GPP TS 25.331 and encoded using ASN.1 UPER. These frames demonstrate common 3G procedures.
MeasurementControl (DL-DCCH)
A UMTS MeasurementControl message configuring intra-frequency measurements. Contains measurement identity, measurement type with intra-frequency cell info list and reporting criteria.
C908842801C2800A0044882009080020A200826083220802 Expected output: MeasurementControl with measurementIdentity, measurementCommand (setup), measurementType (intraFrequencyMeasurement with intraFreqCellInfoList containing primaryScramblingCode values) and measurementReportingMode.
Decode this frame →RRCConnectionSetup (DL-CCCH)
A UMTS RRCConnectionSetup message establishing the initial RRC connection, including SRB configuration and initial UE identity.
4A881A048080440028140044023010400800A020801008002804800140200300100 Expected output: RRCConnectionSetup with rrc-TransactionIdentifier, SRB information setup list (SRB1, SRB2), UL and DL transport channel configuration.
Decode this frame →How to use these sample frames
Copy the hex frame
Select and copy the hexadecimal string from any sample above.
Open the decoder
Go to the HiCellTek L3 Decoder and select the matching technology and logical channel.
Paste and decode
Paste the hex into the input field and click Decode. The ASN.1 engine parses the frame instantly.
Compare results
Check the decoded tree against the expected output described for each frame on this page.
Frequently Asked Questions
Are these real RRC and NAS frames?
These are example hex frames crafted for demonstration and testing purposes. They follow the correct ASN.1 structure and encoding rules for each protocol and technology so they can be used to verify decoder behavior. Real-world frames from live networks may contain additional IEs and extensions depending on operator configuration.
Can I use these frames to test my own decoder?
Yes. These sample frames are provided specifically for testing decoders and learning how RRC and NAS messages are structured. Paste any frame into the HiCellTek decoder (or your own tool) and compare the decoded output against the expected content described on this page.
What format should hex frames be in?
Hex frames should be pasted as a continuous hexadecimal string (characters 0-9 and A-F). Spaces and line breaks are typically stripped automatically by most decoders. The HiCellTek decoder accepts hex with or without spaces, uppercase or lowercase.
Where can I find more sample frames for testing?
You can capture real frames using QMDL (Qualcomm), DIAG logs, PCAP exports from Wireshark, or the HiCellTek Android app. 3GPP specifications (TS 36.331, TS 38.331, TS 24.301, TS 24.501) also include example message encodings in their annexes.
Related resources
L3 Protocol Decoder
Online RRC and NAS decoder for 2G/3G/4G/5G. Free, no signup.
RRC & NAS Message Glossary
Complete reference of RRC and NAS message types across 3GPP technologies.
What is RRC Protocol?
Complete guide to Radio Resource Control: messages, states, channels and specs.
What is NAS Protocol?
NAS protocol explained: EMM, ESM, 5GMM, 5GSM, cause codes and decoding.
RRC vs NAS. Comparison
Key differences between RRC and NAS protocols in LTE and 5G NR.
Telecom Glossary
RRC, NAS, RSRP, SINR, ASN.1, UPER and more terms explained.