When a UE registers on a network, it needs two things for its display: a name for the network and the current local time. The network can leave both to the UE, or it can send them explicitly. 3GPP calls the explicit way NITZ, which 24.008 expands as Network Identity and Time Zone. This page shows where the NITZ messages sit in a registration and how to read them in a log.
Network Name displayed on your mobile phone screen is determined by two different way as described below :
Option 1: UE decode PLMN from Location Updating Accept or Attach Accept message and display the network name registered for the PLMN.
Option 2 : Network explicitely notifies UE of Network Information by NAS message, MM:Information and/or GMM:Information as described in this page.
Whether to take Option 1 or Option 2 is up to Network Operator's implementation and the exact point of the NAS message if Option 2 is taken is also up to Network Operator's implementation. The protocol sequence for a registration for Option 2 is only an example. The exact sequence would vary depending on each network operator.
- Where does NITZ fit in a registration ?
- Step 19 - RRC : downlinkDirectTransfer + MM:Information
- Step 28 - RRC : downlinkDirectTransfer + GMM:Information
- How does the UE use the NITZ values ?
- Reference
Where does NITZ fit in a registration ?
The MM information procedure is a single NAS message from the network, with no answer from the UE. The network puts it into a connection that is already running, so let's see which connection that is. The list below is a full CS and PS registration from a test system, with the two NITZ messages at steps 19 and 28.
1) MIB
2) SIB
3) RACH Preamble
4) AICH
5) RACH Message
6) RRC: RRC Connection Request
7) RRC: RRC Connection Setup
8) RRC: RRC Connection Setup Complete
9) RRC: initialDirectTransfer + MM: Location Updating Request
10) RRC : downlinkDirectTransfer + MM:Authentication Request
11) RRC: initialDirectTransfer + GMM: Attach Request
12) RRC : uplinkDirectTransfer + MM:Authentication Response
13) RRC : Security Mode Command
14) RRC : Security Mode Complete
15) RRC : downlinkDirectTransfer + MM:Identity Request
16) RRC : uplinkDirectTransfer + MM:Identity Response
17) RRC : downlinkDirectTransfer + MM:Location Updating Accept
18) RRC : uplinkDirectTransfer + MM:TMSI Reallocation Complete
19) RRC : downlinkDirectTransfer + MM:Information
20) RRC : downlinkDirectTransfer + GMM: AuthenticationAndCipheringRequest
21) RRC : uplinkDirectTransfer + GMM: AuthenticationAndCipheringResponse
22) RRC : Security Mode Command
23) RRC : Security Mode Complete
24) RRC : downlinkDirectTransfer + GMM:Identity Request
25) RRC : uplinkDirectTransfer + GMM:Identity Response
26) RRC : downlinkDirectTransfer + GMM:Attach Accept
27) RRC : uplinkDirectTransfer + GMM:Attach Complete
28) RRC : downlinkDirectTransfer + GMM:Information
29) RRC : RRC Connection Release
30) RRC : RRC Connection Release Complete
The CS registration runs from step 9 to step 18, and it ends when the UE confirms its new TMSI. The network sends MM INFORMATION right after that, at step 19. The PS registration runs from step 11 to step 27 in the same way, and GMM INFORMATION follows the Attach Complete at step 28. So each domain sends its own copy of the same information, after its own registration.
24.008 gives the network a lot of freedom here. MM INFORMATION may be sent at any time during an RR connection, and GMM INFORMATION at any time during an established GMM context. The network may send none, one or several of them, and the copies do not need the same content. The specification even suggests a moment right after AUTHENTICATION REQUEST, where the extra message delays no other transaction. Support is optional on both sides. A UE that does not support the message ignores it and returns MM STATUS or GMM STATUS with cause #97.
NITZ uses an existing connection : 24.008 defines no procedure that sets up a connection for NITZ, so the UE gets new values only when it has a connection for another reason.The two domains are independent : MM INFORMATION belongs to the CS domain and GMM INFORMATION to the PS domain, so a PS only UE can still get NITZ from GMM INFORMATION.No NITZ message is not an error : The message is optional in the network, and then the UE falls back to Option 1.
Step 19 - RRC : downlinkDirectTransfer + MM:Information
This is the CS copy of NITZ, and it carries four IEs. Two of them give the network name and two give the time. The coloured lines in the capture below mark the name and time values.
Decoded message from a test equipment log,
DL-DCCH-Message
integrityCheckInfo
messageAuthenticationCode: 1e45b70e
rrc-MessageSequenceNumber: 2
message: downlinkDirectTransfer (5)
downlinkDirectTransfer: r3 (0)
r3
downlinkDirectTransfer-r3
rrc-TransactionIdentifier: 1
cn-DomainIdentity: cs-domain (0)
nas-Message: 05324312834d228e76ab0523d376584e9fd2ebe4f41b4508...
GSM A-I/F DTAP - MM Information
Protocol Discriminator: Mobility Management messages
.... 0101 = Protocol discriminator: Mobility Management messages (0x05)
0000 .... = Skip Indicator: No indication of selected PLMN (0)
00.. .... = Sequence number: 0
..11 0010 = DTAP Mobility Management Message Type: MM Information (0x32)
Network Name - Full Name
Element ID: 0x43
Length: 10
1... .... = Extension: No Extension
.000 .... = Coding Scheme: Cell Broadcast data coding scheme,
GSM default alphabet, language unspecified, ....
.... 0... = Add CI: The MS should not add the letters
for the Country's Initials to the text string
.... .011 = Number of spare bits in last octet:
bits 6 to 8(inclusive) are spare and set to '0' in octet n
Text String: TestNetwork
Network Name - Short Name
Element ID: 0x45
Length: 4
1... .... = Extension: No Extension
.000 .... = Coding Scheme: Cell Broadcast data coding scheme,
GSM default alphabet, language unspecified, ....
.... 0... = Add CI: The MS should not add the letters
for the Country's Initials to the text string
.... .000 = Number of spare bits in last octet:
this field carries no information about the number of spare bits ...
Text String: Test
Time Zone and Time - Universal Time and Local Time Zone
Element ID: 0x47
Year 14, Month 03, Day 25
Hour 04, Minutes 17, Seconds 09
Timezone: GMT - 5 hours 0 minutes
Daylight Saving Time
Element ID: 0x49
Length: 1
0000 00.. = Spare bit(s): 0
.... ..00 = No adjustment for Daylight Saving Time
Let's go through the IEs in the order they appear. The IE with Element ID 0x43 is the Full name for network, and 0x45 is the Short name for network. Both use the Network Name coding. Coding Scheme 000 means the GSM default alphabet packed into 7 bits, and the other defined value, 001, means UCS2. "TestNetwork" has 11 characters, which take 77 bits, so they fill 10 octets and leave 3 spare bits. This matches the Number of spare bits field. For the short name the field is 000, a value that 24.008 also allows when the network gives no information about the spare bits.
The IE with Element ID 0x47 is Universal time and local time zone. Its date and time are in universal time, not in local time. The time zone gives the offset of the local time from GMT, here minus 5 hours. So the UE computes the local time as 04:17:09 minus 5 hours, which is 23:17:09 on March 24, 2014. The last IE, 0x49, is Network Daylight Saving Time. Its value 00 means that the time zone above includes no daylight saving adjustment.
Notice that the message has no Local time zone IE, 0x46. That IE carries only the time zone, without a date and a time. The LSA Identity IE, 0x48, is not present either.
The time in NITZ is universal time : The UE adds the time zone to it. A UE that shows 04:17 here has taken universal time as local time.The name belongs to the PLMN of the LAI : The network wants the UE to show this name for the MCC and MNC of the location area where the UE started the connection.Only four of the six IEs are used : Both MM INFORMATION and GMM INFORMATION define the Local time zone and the LSA Identity as well, and this network sends neither.
Step 28 - RRC : downlinkDirectTransfer + GMM:Information
The PS copy arrives after the Attach Complete. Compare it with step 19, because the values are the same and only the wrapping has changed. That makes it easy to see which part belongs to NITZ and which part belongs to the domain.
Decoded message from a test equipment log,
DL-DCCH-Message
integrityCheckInfo
messageAuthenticationCode: 1905f951
rrc-MessageSequenceNumber: 6
message: downlinkDirectTransfer (5)
downlinkDirectTransfer: r3 (0)
r3
downlinkDirectTransfer-r3
rrc-TransactionIdentifier: 1
cn-DomainIdentity: ps-domain (1)
nas-Message: 08214312834d228e76ab0523d376584e9fd2ebe4f41b4508...
GSM A-I/F DTAP - GMM Information
Protocol Discriminator: GPRS mobility management messages
.... 1000 = Protocol discriminator: GPRS mobility management messages (0x08)
0000 .... = Skip Indicator: No indication of selected PLMN (0)
DTAP GPRS Mobility Management Message Type: GMM Information (0x21)
Network Name - Full Name
Element ID: 0x43
Length: 10
1... .... = Extension: No Extension
.000 .... = Coding Scheme: Cell Broadcast data coding scheme,
GSM default alphabet, language unspecified, ....
.... 0... = Add CI: The MS should not add the letters
for the Country's Initials to the text string
.... .011 = Number of spare bits in last octet:
bits 6 to 8(inclusive) are spare and set to '0' in octet n
Text String: TestNetwork
Network Name - Short Name
Element ID: 0x45
Length: 4
1... .... = Extension: No Extension
.000 .... = Coding Scheme: Cell Broadcast data coding scheme,
GSM default alphabet, language unspecified, ...
.... 0... = Add CI: The MS should not add the letters
for the Country's Initials to the text string
.... .000 = Number of spare bits in last octet:
this field carries no information about the number of spare bits ...
Text String: Test
Time Zone and Time
Element ID: 0x47
Year 14, Month 03, Day 25
Hour 04, Minutes 17, Seconds 10
Timezone: GMT - 5 hours 0 minutes
Daylight Saving Time
Element ID: 0x49
Length: 1
0000 00.. = Spare bit(s): 0
.... ..00 = No adjustment for Daylight Saving Time
Three things differ from step 19. The RRC message now names the ps-domain in cn-DomainIdentity. The protocol discriminator is 8, GPRS mobility management, instead of 5, and the message type is GMM Information, 0x21, instead of MM Information, 0x32. The IEs that follow use the same Element IDs and the same coding in both messages.
The time is one second later than in step 19, 04:17:10 instead of 04:17:09. This shows that the network fills in the time when it builds each message. The UE therefore gets two slightly different times in one registration. A UE that sets its clock from NITZ can take the later one. The names, the time zone and the daylight saving value are identical.
Why send the same values twice? The UE may be attached to only one of the two domains, and each domain has its own core network node. The MSC sends MM INFORMATION and the SGSN sends GMM INFORMATION, and each node sends its own message.
Only the header changes between the two messages : Protocol discriminator 8 and message type 0x21 mark GMM INFORMATION. The NITZ IEs keep the same codes.The time field is filled per message : Two messages sent a second apart carry times a second apart.Check both domains when the display is wrong : A wrong name may come from either the MSC or the SGSN, because each one sends its own copy.
How does the UE use the NITZ values ?
The messages above are only half of the story. What the user finally sees depends on the UE, because 24.008 lets the UE decide how to use the contents. Let's go through the values the UE receives and the choices it has.
The specification says that a UE which supports the message shall accept it, and may then use the contents to update the information it stores. So every step after reception is optional. A UE may show the NITZ name, may keep its own name for the PLMN from Option 1, or may combine them. The same holds for the time.
For the name, the network asks the UE to connect the name with the MCC and MNC in the LAI of the cell where the UE started the connection. 24.008 still calls the first message of that connection the Channel Request. The Add CI bit tells the UE whether to add the country initials in front of the name. In this capture Add CI is 0, so the UE shows "TestNetwork" or "Test" without them.
For the time, 24.008 gives a warning of its own. Earlier versions of the protocol were not clear about the time, and some mobile stations took the received NITZ time as local time. Such a UE shows the wrong time by the size of the time zone offset. 24.008 also tells the UE to assume that the time zone applies to the location area of the cell where the connection started.
NITZ is a suggestion, not a command : The UE must accept the message, but it decides whether to use the name and the time.A wrong local time often means a wrong interpretation : If the error equals the time zone offset, check whether the UE has used universal time as local time.The time is not guaranteed to be accurate : 24.008 tells the UE not to assume that the time information is accurate.
Reference
- 3GPP TS 24.008 v20.0.0 : Mobile radio interface Layer 3 specification; Core network protocols; Stage 3