UE Capabilities Guide 4G LTE & 5G NR
Understanding and decoding the capabilities declared by mobile terminals. CA combinations, MIMO layers, EN-DC/NR-DC, supported bands: everything a field engineer needs to know for diagnosing network configuration issues.
In a nutshell
UE Capabilities are the information transmitted by the terminal to the network via the RRC message UECapabilityInformation. They define what the terminal can do: frequency bands, carrier aggregation, MIMO layers, 5G support (EN-DC, SA, NSA). Decoding this information in the field instantly identifies whether a performance problem originates from the terminal or the network.
Key Facts. UE Capabilities
- RRC message
- UECapabilityInformation (UL-DCCH)
- Trigger
- UECapabilityEnquiry from eNB/gNB
- LTE container
- UE-EUTRA-Capability (TS 36.331)
- NR container
- UE-NR-Capability (TS 38.331)
- MRDC container
- UE-MRDC-Capability (TS 38.331)
- Encoding
- ASN.1 UPER (Unaligned PER)
- Typical size
- 2,000 - 15,000+ bytes (depends on CA combos)
What are UE Capabilities?
In 3GPP mobile networks (4G LTE and 5G NR), each terminal declares its radio capabilities to the network during connection establishment. This mechanism is defined in 3GPP TS 36.331 (LTE) and 3GPP TS 38.331 (NR).
When a base station (eNodeB in LTE, gNodeB in NR) needs to know a terminal's capabilities, it sends a UECapabilityEnquiry message. The terminal responds with a UECapabilityInformation message containing all its radio capabilities encoded in ASN.1 UPER.
This information is essential for the network: it determines the optimal connection configuration. A terminal that does not support 4x4 MIMO will only be configured with 2x2. A terminal without 3CC CA support cannot aggregate three carriers, even if the network allows it. Without verifying UE capabilities, a field engineer may spend hours troubleshooting a network issue that is actually a terminal limitation.
How UE Capability Exchange Works
The UE capability exchange is a two-step procedure initiated by the network:
Step 1: UECapabilityEnquiry (DL)
The eNB/gNB sends a UECapabilityEnquiry message on the DL-DCCH logical channel.
It specifies which RAT types it requests via the ue-CapabilityRAT-TypeList field.
Common RAT types are eutra, nr, and eutra-nr (for MRDC).
The network may also request ue-CapabilityRAT-RequestFilters to limit the
response to specific band combinations or frequency ranges.
Step 2: UECapabilityInformation (UL)
The UE responds with UECapabilityInformation on the UL-DCCH channel.
The ue-CapabilityRAT-ContainerList field contains one or more capability
containers: UE-EUTRA-Capability for LTE, UE-NR-Capability
for 5G NR, and UE-MRDC-Capability for multi-RAT dual connectivity.
Each container is a complete ASN.1-encoded capability set.
In EN-DC (NSA Option 3x) deployments, the LTE eNB typically requests both eutra
and eutra-nr capabilities. The MRDC capability container is critical because
it contains the supportedBandCombinationList for LTE+NR combinations.
Without it, the network cannot configure the NR secondary cell group (SCG).
Key Information Elements
The most important fields declared in the UE Capability Information message.
supportedBandCombinationList
Defines all carrier aggregation combinations the terminal supports in downlink and uplink.
Each entry specifies the component bands, bandwidth class (A, B, C, etc.), MIMO layers
per band, and maximum modulation (64QAM, 256QAM). For example, CA_1A-3A-7A
means aggregation of bands 1, 3 and 7 each in class A (up to 20 MHz). This is the most
analyzed field during CA troubleshooting.
featureSetCombinations (NR)
Introduced in 5G NR to provide a more compact representation of feature sets. Instead of
repeating all parameters per band combination, NR uses feature set indices that reference
entries in featureSetsDownlink and featureSetsUplink arrays.
Each feature set defines MIMO layers, modulation order, supported channel bandwidths
and SRS resources. Understanding this indirection is essential for NR capability analysis.
MRDC Capabilities (UE-MRDC-Capability)
The MRDC (Multi-RAT Dual Connectivity) capability container carries the LTE+NR band
combinations for EN-DC (Option 3x) and NE-DC (Option 4). Key fields include
supportedBandCombinationList with both LTE and NR component carriers,
measParametersMRDC for inter-RAT measurement capabilities, and
generalParametersMRDC for power sharing and timing constraints.
Supported Band Lists
supportedBandListEUTRA (LTE) and supportedBandListNR (NR)
enumerate all frequency bands the terminal can operate on individually. This includes
FDD and TDD bands for LTE, and FR1 (sub-6 GHz) and FR2 (mmWave) bands for NR.
A terminal purchased in a different region may not support local bands, which is
a common cause of service issues that UE capabilities instantly reveal.
MIMO Layers
The number of supported MIMO layers per band determines the theoretical maximum throughput. A 2x2 MIMO terminal supports two spatial layers, a 4x4 MIMO terminal supports four. In 5G NR, some terminals support up to 8 layers in FR1. This information is critical for validating that the network configures the correct rank indicator (RI) and for explaining throughput discrepancies between devices in benchmark campaigns.
UE Category
The fields ue-Category, ue-CategoryDL and
ue-CategoryUL indicate the theoretical maximum throughput class.
LTE categories range from Cat 1 (10 Mbps DL) to Cat 20 (2 Gbps DL). In 5G NR,
the feature set mechanism replaces UE categories, but the concept of throughput
class remains important for network capacity planning and SLA verification.
Field Use Cases
CA configuration validation
Verify that a terminal supports the CA combination deployed at a site before escalating a ticket. Example: the network offers CA_1A-3A but the terminal only supports CA_1A standalone.
Throughput troubleshooting
A throughput lower than expected may come from a terminal limited to 2x2 MIMO or 64QAM. UE Capabilities confirm or rule out this hypothesis in seconds, avoiding hours of network-side investigation.
EN-DC 5G NSA verification
Ensure the terminal supports the locally deployed EN-DC combination (e.g., DC_1A-n78A) before diagnosing an SCG activation failure on the NR layer. Missing MRDC capabilities are a frequent root cause.
Multi-device benchmarking
Compare UE Capabilities across different smartphones in a drive test campaign. Differences in CA combinations, MIMO layers or modulation support explain performance gaps between devices on the same network.
Band compatibility audit
Verify that imported or BYOD terminals support all local frequency bands. A device purchased overseas may lack support for operator-specific bands, causing coverage gaps in specific areas.
NR-DC and SA readiness
Check whether a terminal supports SA (Standalone) mode with the required NR bands, or NR-DC (dual NR connectivity) for advanced 5G deployments. Feature set analysis reveals supported BWP configurations and beam management capabilities.
How to Decode UE Capabilities with HiCellTek
HiCellTek provides two methods for decoding UE Capabilities: real-time on-device capture via the Android app, and instant online decoding via the web decoder.
Select UL-DCCH channel
Choose UL-DCCH as the logical channel, since UECapabilityInformation is an uplink dedicated message.
Paste the hex frame
Paste the hexadecimal UECapabilityInformation frame from your QCAT, QMDL, Wireshark or DIAG log capture.
Analyze capabilities
Browse the decoded ASN.1 tree. Search for specific IEs like supportedBandCombinationList, MIMO layers or feature sets. Export to JSON.
Real-Time UE Capability Decoding on Android
The HiCellTek Android app captures and decodes the UECapabilityInformation message in real time directly on the handset via the Qualcomm DIAG interface. No export to PC or post-processing is required: the engineer sees all capability information immediately.
The module displays in a structured view: supported CA combinations, MIMO layers per band, EN-DC/NR-DC support with specific combinations, FR1/FR2 bands and UE category. Data is exportable to Excel and CSV for integration into acceptance test reports.
This capability is particularly valuable during multi-device benchmark campaigns: by comparing UE Capabilities across different smartphones, the engineer can explain performance differences observed in drive tests and isolate terminal limitations from network-side issues.
Related Resources
FAQ: UE Capabilities 4G/5G
What is UE Capability Information in 3GPP?
UE Capability Information is an RRC message sent by the mobile terminal to the network declaring its radio capabilities: supported frequency bands, carrier aggregation combinations (CA), MIMO layers, EN-DC or NR-DC support, UE categories and voice codecs. The network uses this information to configure the connection optimally.
Why are UE Capabilities important for field troubleshooting?
UE Capabilities allow you to verify whether a terminal actually supports the expected features: 3CC CA, 4x4 MIMO, 256QAM, EN-DC on a specific band. Without this verification, a field engineer can spend hours investigating a network problem when the terminal simply does not support the desired configuration.
How do you read CA combinations in a UE Capability message?
CA combinations are listed in the supportedBandCombinationList field of the UE Capability Information message. Each combination defines the component bands (BandCombinationParameters), the number of MIMO layers per band, the maximum modulation and the bandwidth class. For example, CA_3A-7A-20A means aggregation of bands 3, 7 and 20 in downlink.
What is the difference between UE-EUTRA-Capability and UE-NR-Capability?
UE-EUTRA-Capability is the container for LTE capabilities defined in 3GPP TS 36.331. UE-NR-Capability is the container for 5G NR capabilities defined in TS 38.331. In EN-DC (NSA) mode, the UE-MRDC-Capability container carries the multi-RAT dual connectivity capabilities, including the LTE+NR band combinations. All three may be requested by the network in a single UECapabilityEnquiry.
Can HiCellTek decode UE Capabilities in the field?
Yes. The HiCellTek UE Capabilities module decodes the UECapabilityInformation message captured via the Qualcomm DIAG interface in real time. The engineer sees supported bands, CA combinations, MIMO layers and EN-DC/NR-DC support immediately, without any post-processing tool. The online decoder also accepts hex frames for quick analysis.
Decode UE Capabilities in the field
No more post-processing: HiCellTek decodes terminal capabilities in real time, directly on your Android smartphone. Or paste a hex frame in the online decoder.