Celluar Network including LTE has very complicated structure and it is made up of may different layers. In addition, the network is communicating with many different user (UEs) at the same time. So if you pick any one point along the network architecture and observe the traffic following in and out of the point, it is highly likely that many traffics for multiple users are following through the point. In this situation, how each of the network components can figure out which traffic is for which UE. Also when the traffic gets transmitted onto the air, each UE is recieving all the physical layer data not only for itself but also for other UE. In this case how UE can figure out which data it has to decode and which data it has to discard.
To solve this issues, we use specific IDs. But in many cases different network components uses different types of IDs even for the same UE and same data. For example, even for the same data and the same UE, the type of IDs between UE and eNB and type of IDs on X2, S1, S5 interfaces may be different. So it will be very difficult and very confusing to follow through a single traffic from a UE to final destination. Also, when you are discussing with other people about the traffic and IDs, you may easily confuse others (sometimes confuse yourself :)) if you don't specify exact point along the overall data path and explicitely mention on your intention of the discussion.
Before you read through this page, I recommend you to go through the diagram at this link LTE-Identifier and get a big picture on what kind of ID is used at each point on overall data path. In this page, I will keep adding specific details of each IDs and examples of real signaling message so that you can use this page as a dictionary of IDs. (This is very beginning, so please don't expect the complete dictionary for now :))
Note : Following table is based on the document from MNC Group (LTE-Identifier)
|
ID |
Meaning |
Description |
Structure |
|
IMSI |
International Mobile Subscriber Identity |
Unique identification of mobile (LTE) subscriber Network (MME) gets the PLMN of the subscriber |
IMSI (not more than 15 digits) = PLMN ID + MSIN = MCC + MNC + MSIN |
|
Public Land Mobile Network Identifier |
Unique identification of PLMN |
PLMN ID (not more than 6 digits) = MCC + MNC |
|
MCC |
Mobile Country Code |
assigned by ITU |
3 digits |
MNC |
Mobile Network Code |
assigned by National Authority |
2 or 3 digits |
MSIN |
Mobile Subscriber Identification Number |
assigned by operator |
9 or 10 digits |
GUTI |
Globally Unique Temporary UE Identity |
To identify a UE between the UE and the MME on behalf of IMSI for security reason |
GUTI (not more than 80 bits) = GUMMEI + M-TMSI |
TIN |
Temporary Identity used in Next Update |
GUTI is stored in TIN parameter of UE’s MM context. TIN indicates which temporary ID will be used in the next update. |
TIN = GUTI |
|
S-TMSI |
SAE Temporary Mobile Subscriber Identity |
To locally identify a UE in short within a MME group (Unique within a MME Pool) |
S-TMSI (40 bits) = MMEC + M-TMSI |
|
MME Mobile Subscriber Identity |
Unique within a MME |
32 bits |
|
|
GUMMEI |
Globally Unique MME Identity |
To identify a MME uniquely in global GUTI contains GUMMEI |
GUMMEI (not more than 48 bits)= PLMN ID + MMEI |
|
MMEI |
MME Identifier |
To identify a MME uniquely within a PLMN Operator commissions at eNBMMEI |
MMEI (24 bits) = MMEGI + MMEC |
|
MME Group Identifier |
Unique within a PLMN |
16 bits |
|
MME Code |
To identify a MME uniquely within a MME Group. S-TMSI contains MMEC8 |
8 bits |
|
|
Cell- Radio Network Temporary Identifier |
To identify an UE uniquely in a cell |
0x0001 ~ 0xFFF3 (16 bits) |
|
|
IMEI |
International Mobile Equipment Identity |
To identify a ME (Mobile Equipment) uniquely |
IMEI (15 digits) = TAC + SNR + CD |
|
IMEI/SV |
IMEI/Software Version |
To identify a ME (Mobile Equipment) uniquely |
IMEI/SV (16 digits) = TAC + SNR + SVN |
|
ECGI |
E-UTRAN Cell Global Identifier |
To identify a Cell in global (Globally Unique) EPC can know UE location based of ECGI |
ECGI (not more than 52 bits) = PLMN I D+ ECI |
|
ECI |
E-UTRAN Cell Identifier |
To identify a Cell within a PLMN |
ECI (28 Bits) = eNB ID + Cell ID |
PGW ID |
PDN GW Identity |
To identify a specific PDN GW (P-GW) HSS assigns P-GW for PDN (IP network) connection of each UE |
IP address (4 bytes) or FQDN (variable length) |
TAI |
Tracking Area Identity |
To identify Tracking Area Globally uniqueTAI |
TAI (not more than 32 bits) = PLMN ID + TAC P-GW |
TAC |
Tracking Area Code |
To indicate eNB to which Tracking Area the eNB belongs (per Cell) Unique within a PLMN16 |
16 bits |
TAI List |
Tracking Area Identity List |
UE can move into the cells included in TAL list without location update (TA update) Globally unique |
Variable length |
PDN ID |
Packet Data Network Identity |
To identify an PDN (IP network), that mobile data user wants to communicate with PDN Identity (APN) is used to determine the P-GW and point of interconnection with a PDN With APN as query parameter to the DNS procedures, the MME will receive a list of candidate P-GWs, and then a P-GW is selected by MME with policy |
PDN Identify = APN = APN.NI + APN.OI (variable length) |
EPS Bearer ID |
Evolved Packet System Bearer Identifier |
To identify an EPS bearer (Default or Dedicated) per an UE4 |
4 bits |
|
E-UTRAN Radio Access Bearer Identifier• |
To identify an E-RAB per an UE |
4 bits |
|
|
Data Radio Bearer Identifier |
To identify a DRB per an UE4 |
4 bits |
|
LBI |
Linked EPS Bearer ID |
To identify the default bearer associated with a dedicated EPS bearer4 |
4 bits |
|
Tunnel End Point identifier |
To identify the end point of a GTP tunnel when the tunnel is established |
32 bits |
PLMN/CellID in SIB1
The broadcast carries the identities every UE needs before it has any of its own. Four of them appear in the decode below, and each has a size fixed by 36.331 rather than by the operator. Reading them off the picture is the quickest way to learn those sizes.
This is a RRC OTA (Over the air) message between UE and eNB.
The MCC is three digits and the MNC is two or three : 36.331 makes MCC a sequence of exactly three MCC-MNC-Digit values, and MNC a sequence of two or three.This cell broadcasts MCC 001 and MNC 01 : three digits then two, which is the two digit MNC case.trackingAreaCode is 16 bits : the string reads as fifteen zeros and a one, so this is TAC 1.cellIdentity is 28 bits and holds a single one : 36.331 fixes the length, and the highlighted row is the only value on the screen that is not an enumeration.
That last field is the one worth knowing the rules for. 23.003 clause 19.6 builds the E-UTRAN Cell Global Identification by concatenating the PLMN Identifier with the E-UTRAN Cell Identity, and fixes the ECI at 28 bits.
What 23.003 does not fix is what those 28 bits mean. The clause says the exact coding of the ECI is the responsibility of each PLMN operator. Many operators split it into an eNB part and a cell part, but that is a convention rather than a requirement. A value read off one network cannot be decomposed by another network's rules.
SIB1 carries the identities a UE has before it has any : the PLMN, the tracking area and the cell.Three of the four sizes are fixed by 36.331 : three MCC digits, two or three MNC digits, and a 16 bit tracking area code.The ECI is 28 bits and globally unique with the PLMN in front : 23.003 clause 19.6 makes the pair the ECGI.The inside of the ECI belongs to the operator : 23.003 leaves its coding to each PLMN, so no split is guaranteed.
MME IDs
The two decodes below are the same identity travelling in opposite directions. One is the GUTI the UE already held and offers on attach, and the other is the GUTI the network hands back. Comparing where the fields sit in each is more useful than reading either alone.
This is a NAS OTA (Over the air) message between UE and eNB. (These messages are usually embedded into a RRC message. For example, Attach Request would be embedded in RRC Connection Setup Complete and Attach Accept would be embedded in RRC Connection Reconfiguration message. Refer to here for full message example)
Both pictures show the MME Group ID split across two octets : 128 in the first and 1 in the continuation, which makes 128 times 256 plus 1, or 32769.The MME Code is one octet and follows it : the uplink picture reads 1 and the downlink picture reads 0.The octet numbering differs by one between the two : Group ID at octets 6 and 7 going up, and at octets 7 and 8 coming down.The field names are the decoder's, not the specification's : 24.301 calls the whole thing the EPS mobile identity.
That one octet of difference is the useful part, and it is not a decoder quirk. 24.301 clause 9.9.3.12 defines one EPS mobile identity element, and the messages carry it in two different forms.
In the Attach Request the element is mandatory and arrives without an identifier, so it opens with its length octet. In the Attach Accept it is optional, so an identifier octet goes in front of the length. Everything after that point therefore shifts one place, which is exactly what the two pictures show.
The same element appears in two forms : with an identifier octet in front when it is optional, and without when it is mandatory.That accounts for the whole offset : one octet, applied to every field after the first.The contents do not change : identity type, PLMN, MME Group ID, MME Code and M-TMSI, in that order, either way.Count from the end when comparing decodes : the last four octets are the M-TMSI in both forms.
M-TMSI
The same two messages appear again below, with the highlight moved to the end of the element. The four octets picked out here are the only part of the identity that belongs to this subscriber, and everything in front of them names the network.
This is a NAS OTA (Over the air) message between UE and eNB. (These messages are usually embedded into a RRC message. For example, Attach Request would be embedded in RRC Connection Setup Complete and Attach Accept would be embedded in RRC Connection Reconfiguration message. Refer to here for full message example)
The M-TMSI is four octets in both directions : read as 0, 0, 0 and 1, which is M-TMSI 1.It sits at octets 9 to 12 going up : the uplink element runs to twelve octets in total.It sits at octets 10 to 13 coming down : the same one octet shift the section above explains.Thirteen octets is the full element : 24.301 gives the optional form an identifier, a length of 11, and 11 octets of contents.
23.003 clause 2.8.1 puts the division plainly. Within the MME, the mobile shall be identified by the M-TMSI. Everything in front of it identifies the MME instead. The same clause fixes the sizes at 32 bits for the M-TMSI and 16 for the MME Group ID.
Those four octets do a second job the pictures do not show. Clause 2.9 builds the S-TMSI from the MME Code and the M-TMSI alone, and the network pages with that shorter form. The PLMN identity and the MME Group ID are dropped, because the network already knows which area it is paging in.
One constraint follows from that. 23.003 requires the operator to keep the MME Code unique within the MME pool area, because the S-TMSI has nothing else left in it to tell two MMEs apart.
The M-TMSI is 32 bits : 23.003 fixes the length, and the four octets in the pictures are the whole of it.Everything before it names the MME : within the MME, the specification says, the mobile is identified by the M-TMSI.Paging uses a shorter form : the S-TMSI is the MME Code and the M-TMSI, with the PLMN and the group left out.The MME Code has to be unique in the pool : the S-TMSI carries nothing else that separates two MMEs.
TEID
A tunnel endpoint identifier names one end of one GTP tunnel. The captures below show it inside S1AP and X2AP rather than in a GTP header. That is where the nodes exchange the values, before any user data flows. Each tunnel gets a separate value at each end.
Followings are some examples of TEID in S1AP messages. I made visible some other types of IDs as well for your reference.
An S1AP Initial Context Setup Request, with the NAS message inside it,
S1 Application Protocol
S1AP-PDU: initiatingMessage (0)
initiatingMessage
procedureCode: id-InitialContextSetup (9)
criticality: reject (0)
value
InitialContextSetupRequest
protocolIEs: 8 items
Item 0: id-MME-UE-S1AP-ID
ProtocolIE-Field
id: id-MME-UE-S1AP-ID (0)
criticality: reject (0)
value
MME-UE-S1AP-ID: 285212685
Item 1: id-eNB-UE-S1AP-ID
ProtocolIE-Field
id: id-eNB-UE-S1AP-ID (8)
criticality: reject (0)
value
ENB-UE-S1AP-ID: 3
Item 2: id-uEaggregateMaximumBitrate
Item 3: id-E-RABToBeSetupListCtxtSUReq
ProtocolIE-Field
id: id-E-RABToBeSetupListCtxtSUReq (24)
criticality: reject (0)
value
E-RABToBeSetupListCtxtSUReq: 1 item
Item 0: id-E-RABToBeSetupItemCtxtSUReq
ProtocolIE-SingleContainer
id: id-E-RABToBeSetupItemCtxtSUReq (52)
criticality: reject (0)
value
E-RABToBeSetupItemCtxtSUReq
e-RAB-ID: 5
e-RABlevelQoSParameters
qCI: 9
allocationRetentionPriority
...
transportLayerAddress: 12345678 ...
gTP-TEID: 12345678
...
EPS mobile identity - GUTI
Element ID: 0x50
Length: 11
.... 0... = odd/even indic: 0
.... .110 = Type of identity: GUTI
Mobile Country Code (MCC): 001
Mobile Network Code (MNC): 01
MME Group ID: 12345
MME Code: 12
M-TMSI: 0x12345678
....
Item 4: ...
A GTP header from the same exchange,
GPRS Tunneling Protocol
Flags: 0x30
001. .... = Version: GTP release 99 version (1)
...1 .... = Protocol type: GTP (1)
.... 0... = Reserved: 0
.... .0.. = Is Next Extension Header present?: No
.... ..0. = Is Sequence Number present?: No
.... ...0 = Is N-PDU number present?: No
Message Type: T-PDU (0xff)
Length: 59
TEID: 0x12345678
T-PDU Data: 450000....
An X2AP Handover Request,
EUTRAN X2 Application Protocol (X2AP)
X2AP-PDU: initiatingMessage (0)
initiatingMessage
procedureCode: id-handoverPreparation (0)
criticality: reject (0)
value
HandoverRequest
protocolIEs: 6 items
Item 0: id-Old-eNB-UE-X2AP-ID
ProtocolIE-Field
id: id-Old-eNB-UE-X2AP-ID (10)
criticality: reject (0)
value
UE-X2AP-ID: 2
Item 1: id-Cause
ProtocolIE-Field
id: id-Cause (5)
criticality: ignore (1)
value
Cause: radioNetwork (0)
radioNetwork: handover-desirable-for-radio-reasons (0)
Item 2: id-TargetCell-ID
ProtocolIE-Field
id: id-TargetCell-ID (11)
criticality: reject (0)
value
ECGI
pLMN-Identity: 123456
Mobile Country Code (MCC): 001
Mobile Network Code (MNC): 01
eUTRANcellIdentifier: 12345678
Item 3: id-GUMMEI-ID
ProtocolIE-Field
id: id-GUMMEI-ID (23)
criticality: reject (0)
value
GUMMEI
gU-Group-ID
pLMN-Identity: 123456
Mobile Country Code (MCC): 001
Mobile Network Code (MNC): 01
mME-Group-ID: 1234
mME-Code: 21
Item 4: id-UE-ContextInformation
ProtocolIE-Field
id: id-UE-ContextInformation (14)
criticality: reject (0)
value
UE-ContextInformation
...
e-RABs-ToBeSetup-List: 1 item
Item 0: id-E-RABs-ToBeSetup-Item
ProtocolIE-Single-Container
id: id-E-RABs-ToBeSetup-Item (4)
criticality: ignore (1)
value
E-RABs-ToBeSetup-Item
e-RAB-ID: 5
e-RAB-Level-QoS-Parameters
...
uL-GTPtunnelEndpoint
...
transportLayerAddress: xxxxxxxx
transportLayerAddress(IPv4):
xxx.xxx.xxx.xxx
gTP-TEID: 12345678
rRC-Context: < RRC HEX >...
HandoverPreparationInformation
criticalExtensions: c1 (0)
c1: handoverPreparationInformation-r8 (0)
handoverPreparationInformation-r8
ue-RadioAccessCapabilityInfo: 1 item
Item 0
UE-CapabilityRAT-Container
rat-Type: eutra (0)
ueCapabilityRAT-Container:
< Hex String >...
as-Config
...
Item 5: id-UE-HistoryInformation
ProtocolIE-Field
id: id-UE-HistoryInformation (15)
criticality: ignore (1)
value
UE-HistoryInformation: 1 item
Item 0
LastVisitedCell-Item: e-UTRAN-Cell (0)
e-UTRAN-Cell
global-Cell-ID
pLMN-Identity: 123456
Mobile Country Code (MCC): 001
Mobile Network Code (MNC): 01
eUTRANcellIdentifier: 12345678
cellType
cell-Size: small (1)
time-UE-StayedInCell: 11
Followings are some examples of TEID in X2AP messages. I made visible some other types of IDs as well for your reference.
An X2AP Handover Request Acknowledge,
EUTRAN X2 Application Protocol (X2AP)
X2AP-PDU: successfulOutcome (1)
successfulOutcome
procedureCode: id-handoverPreparation (0)
criticality: reject (0)
value
HandoverRequestAcknowledge
protocolIEs: 4 items
Item 0: id-Old-eNB-UE-X2AP-ID
ProtocolIE-Field
id: id-Old-eNB-UE-X2AP-ID (10)
criticality: ignore (1)
value
UE-X2AP-ID: 2
Item 1: id-New-eNB-UE-X2AP-ID
ProtocolIE-Field
id: id-New-eNB-UE-X2AP-ID (9)
criticality: ignore (1)
value
UE-X2AP-ID: 1
Item 2: id-E-RABs-Admitted-List
ProtocolIE-Field
id: id-E-RABs-Admitted-List (1)
criticality: ignore (1)
value
E-RABs-Admitted-List: 1 item
Item 0: id-E-RABs-Admitted-Item
ProtocolIE-Single-Container
id: id-E-RABs-Admitted-Item (0)
criticality: ignore (1)
value
E-RABs-Admitted-Item
e-RAB-ID: 5
uL-GTP-TunnelEndpoint
...0 .... Extension Present Bit: False
transportLayerAddress: xxxxxxxx
transportLayerAddress(IPv4):
xxx.xxx.xxx.xxx
gTP-TEID: 12345678
dL-GTP-TunnelEndpoint
..0. .... Extension Present Bit: False
transportLayerAddress: xxxxxxxx
transportLayerAddress(IPv4):
xxx.xxx.xxx.xxx
gTP-TEID: 12345678
Item 3: id-TargeteNBtoSource-eNBTransparentContainer
ProtocolIE-Field
id: id-TargeteNBtoSource-eNBTransparentContainer (12)
criticality: ignore (1)
value
TargeteNBtoSource-eNBTransparentContainer: < Hex String ...>
HandoverCommand
criticalExtensions: c1 (0)
c1: handoverCommand-r8 (0)
handoverCommand-r8
handoverCommandMessage: < Hex String ...>
DL-DCCH-Message
message: c1 (0)
....
A TEID is per tunnel and per direction : the uplink and downlink endpoints in the captures carry different values.The same message carries several kinds of identity at once : the highlights in the boxes above pick out more than the TEID.X2 and S1 both carry tunnel endpoints : the handover captures show them being handed from one node to another.The address travels with the identifier : a TEID only means something against the transport address beside it.
DRB-ID
Following is RRC Connection Reconfiguration message sent from eNB to UE. DRB ID is marked in Red and some other IDs are also marked in blue for your reference.
An RRC Connection Reconfiguration sent from eNB to UE, with the NAS message inside it,
c1: rrcConnectionReconfiguration-r8 (0)
rrcConnectionReconfiguration-r8
dedicatedInfoNASList: 1 item
Item 0
DedicatedInfoNAS: 27f9574e50056200c5050501010101011722300008404a12...
Non-Access-Stratum (NAS)PDU
0010 .... = Security header type: Integrity protected and ciphered (2)
.... 0111 = Protocol discriminator: EPS mobility management messages (0x07)
Message authentication code: 0xf9574e50
Sequence number: 5
0110 .... = EPS bearer identity: EPS bearer identity value 6 (6)
.... 0010 = Protocol discriminator: EPS session management messages (0x02)
Procedure transaction identity: 0
NAS EPS session management messages:
Activate dedicated EPS bearer context request (0xc5)
0000 .... = Spare half octet: 0
.... 0101 = Linked EPS bearer identity: EPS bearer identity value 5 (5)
EPS quality of service
Length: 5
Quality of Service Class Identifier (QCI): QCI 1 (1)
...
Traffic Flow Template
Length: 23
001. .... = TFT operation code: Create new TFT (1)
...0 .... = E bit: Parameters list is not included
.... 0010 = Number of packet filters: 2
Packet filter: 0
00.. .... = Spare bit(s): 0
..11 .... = Packet filter direction: Bidirectional (3)
.... 0000 = Packet filter identifier: 1 (0)
....
Packet filter: 1
00.. .... = Spare bit(s): 0
..11 .... = Packet filter direction: Bidirectional (3)
.... 0001 = Packet filter identifier: 2 (1)
....
radioResourceConfigDedicated
drb-ToAddModList: 1 item
Item 0
DRB-ToAddMod
eps-BearerIdentity: 6
drb-Identity: 2
pdcp-Config
discardTimer: infinity (7)
rlc-UM
pdcp-SN-Size: len12bits (1)
headerCompression: notUsed (0)
notUsed: NULL
rlc-Config: um-Bi-Directional (1)
um-Bi-Directional
ul-UM-RLC
sn-FieldLength: size10 (1)
dl-UM-RLC
sn-FieldLength: size10 (1)
t-Reordering: ms50 (10)
logicalChannelIdentity: 4
logicalChannelConfig
ul-SpecificParameters
priority: 13
prioritisedBitRate: infinity (7)
bucketSizeDuration: ms100 (1)
logicalChannelGroup: 2
mac-MainConfig: explicitValue (0)
...
physicalConfigDedicated
...
Following is handoverPreparation message captured at X2 interface. DRB ID is marked in Red and some other IDs are also marked in blue for your reference.
An X2AP Handover Request carrying the bearer configuration,
EUTRAN X2 Application Protocol (X2AP)
X2AP-PDU: initiatingMessage (0)
initiatingMessage
procedureCode: id-handoverPreparation (0)
criticality: reject (0)
value
HandoverRequest
protocolIEs: 6 items
Item 0: id-Old-eNB-UE-X2AP-ID
ProtocolIE-Field
id: id-Old-eNB-UE-X2AP-ID (10)
criticality: reject (0)
value
UE-X2AP-ID: 2
Item 1: id-Cause
...
Item 2: id-TargetCell-ID
...
Item 3: id-GUMMEI-ID
...
Item 4: id-UE-ContextInformation
ProtocolIE-Field
id: id-UE-ContextInformation (14)
criticality: reject (0)
value
UE-ContextInformation
mME-UE-S1AP-ID: 123456789
uESecurityCapabilities
...
aS-SecurityInformation
...
uEaggregateMaximumBitRate
...
subscriberProfileIDforRFP: 1
e-RABs-ToBeSetup-List: 1 item
Item 0: id-E-RABs-ToBeSetup-Item
ProtocolIE-Single-Container
id: id-E-RABs-ToBeSetup-Item (4)
criticality: ignore (1)
value
E-RABs-ToBeSetup-Item
e-RAB-ID: 5
e-RAB-Level-QoS-Parameters
qCI: 9
allocationAndRetentionPriority
...
dL-Forwarding: dL-forwardingProposed (0)
uL-GTPtunnelEndpoint
...
gTP-TEID: 024a4023
rRC-Context: ...
HandoverPreparationInformation
criticalExtensions: c1 (0)
c1: handoverPreparationInformation-r8 (0)
handoverPreparationInformation-r8
ue-RadioAccessCapabilityInfo: 1 item
Item 0
UE-CapabilityRAT-Container
...
as-Config
...
sourceRadioResourceConfig
srb-ToAddModList: 2 items
Item 0
SRB-ToAddMod
srb-Identity: 1
...
Item 1
SRB-ToAddMod
srb-Identity: 2
...
drb-ToAddModList: 1 item
Item 0
DRB-ToAddMod
eps-BearerIdentity: 5
drb-Identity: 2
pdcp-Config
...
rlc-Config: am (0)
...
logicalChannelIdentity: 3
logicalChannelConfig
...
mac-MainConfig: explicitValue (0)
...
sps-Config
...
physicalConfigDedicated
...
Item 5: id-UE-HistoryInformation
...
The DRB identity is local to the radio bearer : it names the bearer between the UE and the eNB, and nothing beyond it.It travels beside the EPS bearer identity : the reconfiguration above carries both, and they are not the same number.A handover carries the whole set across : the X2 capture repeats the bearer configuration for the target.The blue marks are the author's : the paragraphs above say which colour marks which kind of identity.
E-RAB ID
The captures below are the same three messages the section on TEID used, with the highlight moved to a different field. Reading them a second time is the point, because one message carries several identities and only one of them is in question here.
An S1AP Initial Context Setup Request, read again for a different field,
S1 Application Protocol
S1AP-PDU: initiatingMessage (0)
initiatingMessage
procedureCode: id-InitialContextSetup (9)
criticality: reject (0)
value
InitialContextSetupRequest
protocolIEs: 8 items
Item 0: id-MME-UE-S1AP-ID
ProtocolIE-Field
id: id-MME-UE-S1AP-ID (0)
criticality: reject (0)
value
MME-UE-S1AP-ID: 285212685
Item 1: id-eNB-UE-S1AP-ID
ProtocolIE-Field
id: id-eNB-UE-S1AP-ID (8)
criticality: reject (0)
value
ENB-UE-S1AP-ID: 3
Item 2: id-uEaggregateMaximumBitrate
Item 3: id-E-RABToBeSetupListCtxtSUReq
ProtocolIE-Field
id: id-E-RABToBeSetupListCtxtSUReq (24)
criticality: reject (0)
value
E-RABToBeSetupListCtxtSUReq: 1 item
Item 0: id-E-RABToBeSetupItemCtxtSUReq
ProtocolIE-SingleContainer
id: id-E-RABToBeSetupItemCtxtSUReq (52)
criticality: reject (0)
value
E-RABToBeSetupItemCtxtSUReq
e-RAB-ID: 5
e-RABlevelQoSParameters
qCI: 9
allocationRetentionPriority
...
transportLayerAddress: 12345678 ...
gTP-TEID: 12345678
...
EPS mobile identity - GUTI
Element ID: 0x50
Length: 11
.... 0... = odd/even indic: 0
.... .110 = Type of identity: GUTI
Mobile Country Code (MCC): 001
Mobile Network Code (MNC): 01
MME Group ID: 12345
MME Code: 12
M-TMSI: 0x12345678
....
Item 4: ...
An X2AP Handover Request, read again for a different field,
EUTRAN X2 Application Protocol (X2AP)
X2AP-PDU: initiatingMessage (0)
initiatingMessage
procedureCode: id-handoverPreparation (0)
criticality: reject (0)
value
HandoverRequest
protocolIEs: 6 items
Item 0: id-Old-eNB-UE-X2AP-ID
ProtocolIE-Field
id: id-Old-eNB-UE-X2AP-ID (10)
criticality: reject (0)
value
UE-X2AP-ID: 2
Item 1: id-Cause
ProtocolIE-Field
id: id-Cause (5)
criticality: ignore (1)
value
Cause: radioNetwork (0)
radioNetwork: handover-desirable-for-radio-reasons (0)
Item 2: id-TargetCell-ID
ProtocolIE-Field
id: id-TargetCell-ID (11)
criticality: reject (0)
value
ECGI
pLMN-Identity: 123456
Mobile Country Code (MCC): 001
Mobile Network Code (MNC): 01
eUTRANcellIdentifier: 12345678
Item 3: id-GUMMEI-ID
ProtocolIE-Field
id: id-GUMMEI-ID (23)
criticality: reject (0)
value
GUMMEI
gU-Group-ID
pLMN-Identity: 123456
Mobile Country Code (MCC): 001
Mobile Network Code (MNC): 01
mME-Group-ID: 1234
mME-Code: 21
Item 4: id-UE-ContextInformation
ProtocolIE-Field
id: id-UE-ContextInformation (14)
criticality: reject (0)
value
UE-ContextInformation
...
e-RABs-ToBeSetup-List: 1 item
Item 0: id-E-RABs-ToBeSetup-Item
ProtocolIE-Single-Container
id: id-E-RABs-ToBeSetup-Item (4)
criticality: ignore (1)
value
E-RABs-ToBeSetup-Item
e-RAB-ID: 5
e-RAB-Level-QoS-Parameters
...
uL-GTPtunnelEndpoint
...
transportLayerAddress: xxxxxxxx
transportLayerAddress(IPv4):
xxx.xxx.xxx.xxx
gTP-TEID: 12345678
rRC-Context: < RRC HEX >...
HandoverPreparationInformation
criticalExtensions: c1 (0)
c1: handoverPreparationInformation-r8 (0)
handoverPreparationInformation-r8
ue-RadioAccessCapabilityInfo: 1 item
Item 0
UE-CapabilityRAT-Container
rat-Type: eutra (0)
ueCapabilityRAT-Container:
< Hex String >...
as-Config
...
Item 5: id-UE-HistoryInformation
ProtocolIE-Field
id: id-UE-HistoryInformation (15)
criticality: ignore (1)
value
UE-HistoryInformation: 1 item
Item 0
LastVisitedCell-Item: e-UTRAN-Cell (0)
e-UTRAN-Cell
global-Cell-ID
pLMN-Identity: 123456
Mobile Country Code (MCC): 001
Mobile Network Code (MNC): 01
eUTRANcellIdentifier: 12345678
cellType
cell-Size: small (1)
time-UE-StayedInCell: 11
Followings are some examples of TEID in X2AP messages. I made visible some other types of IDs as well for your reference.
An X2AP Handover Request Acknowledge, read again for a different field,
EUTRAN X2 Application Protocol (X2AP)
X2AP-PDU: successfulOutcome (1)
successfulOutcome
procedureCode: id-handoverPreparation (0)
criticality: reject (0)
value
HandoverRequestAcknowledge
protocolIEs: 4 items
Item 0: id-Old-eNB-UE-X2AP-ID
ProtocolIE-Field
id: id-Old-eNB-UE-X2AP-ID (10)
criticality: ignore (1)
value
UE-X2AP-ID: 2
Item 1: id-New-eNB-UE-X2AP-ID
ProtocolIE-Field
id: id-New-eNB-UE-X2AP-ID (9)
criticality: ignore (1)
value
UE-X2AP-ID: 1
Item 2: id-E-RABs-Admitted-List
ProtocolIE-Field
id: id-E-RABs-Admitted-List (1)
criticality: ignore (1)
value
E-RABs-Admitted-List: 1 item
Item 0: id-E-RABs-Admitted-Item
ProtocolIE-Single-Container
id: id-E-RABs-Admitted-Item (0)
criticality: ignore (1)
value
E-RABs-Admitted-Item
e-RAB-ID: 5
uL-GTP-TunnelEndpoint
...0 .... Extension Present Bit: False
transportLayerAddress: xxxxxxxx
transportLayerAddress(IPv4):
xxx.xxx.xxx.xxx
gTP-TEID: 12345678
dL-GTP-TunnelEndpoint
..0. .... Extension Present Bit: False
transportLayerAddress: xxxxxxxx
transportLayerAddress(IPv4):
xxx.xxx.xxx.xxx
gTP-TEID: 12345678
Item 3: id-TargeteNBtoSource-eNBTransparentContainer
ProtocolIE-Field
id: id-TargeteNBtoSource-eNBTransparentContainer (12)
criticality: ignore (1)
value
TargeteNBtoSource-eNBTransparentContainer: < Hex String ...>
HandoverCommand
criticalExtensions: c1 (0)
c1: handoverCommand-r8 (0)
handoverCommand-r8
handoverCommandMessage: < Hex String ...>
DL-DCCH-Message
message: c1 (0)
....
The E-RAB identity names the bearer end to end : it spans the radio bearer and the S1 bearer together.The same capture answers more than one question : which is why these three messages appear twice on this page.It is carried in both S1AP and X2AP : the setup message and the handover message both name it.Match it against the DRB identity, not against the TEID : the tunnel endpoint names transport, and the E-RAB names the bearer.
Reference
[1] 23.003 : 3GPP - Numbering, addressing and identification, v20.0.0. Clause 19.6 gives the E-UTRAN Cell Identity and the E-UTRAN Cell Global Identification, and leaves the coding of the ECI to each operator.
[2] 24.301 : 3GPP - Non-Access-Stratum protocol for EPS; Stage 3, v20.0.0. Clause 9.9.3.12 gives the EPS mobile identity element that carries the GUTI, in both its forms.
[3] 36.331 : 3GPP - E-UTRA; Radio Resource Control, v19.3.0. CellIdentity is 28 bits, TrackingAreaCode is 16, and the MCC and MNC digit counts are fixed there.