LTE Call Flow - Wireshark (Pcap) analysis of LTE UE Attach

In this video we analyze the wireshark trace from an MME for a UE that is going through the initial LTE attach procedure.
This video is from my Course on 4G.
The full course can be found here - tinyurl.com/vwy7zzw8
Other best selling courses:
4G - 4G LTE EPC - Advanced Troubleshooting using Wireshark - tinyurl.com/xem6c8n4
5G - 5G Core - Architectures, Concepts and Call Flows - tinyurl.com/y7rljqqq

[@shubha07m]

This is the best explanation of LTE call flow using Wireshark capture I've ever seen, this is immensely helpful!

[@nasarahmad]

Brilliant stuff__! This is the only resource where you'll see flow of messages & their purpose together with interface & protocol. Beautifully explained. Much appreciated

[@yascarpharmacyltd9344]

Very good detailed presentation, I have been searching for something like this for a while. Thanks.

[@bidhanpatel3987]

Excellent !! Well explained step by step with required info !!!

[@AsimKhatim]

Great Explanation. Keep up the good work, and I look forward for more videos from you

[@cibinnv9059]

Greatest explanation.. Thanks a lot sir.. Got much better idea now.. Pls continue posting more videos.. Really a great explanation. Expecting more videos from you.

[@persiusonime1509]

Simply the best. It comes natural. Very coincise

[@gucheddie3204]

thank you for sharing - i am just starting my LTE journey and this was very helpful

[@nainglinn1745]

The best explanation 🎉🎉🎉!

[@nsivachidambaram]

Expecting more videos from you .. very Good explanation with samples ...

[@saravanakumarkamalakannan9747]

Good explanation in a simple way . . keep up the good work ....thanks

[@sajithnallithodi]

Wonderful. Thank you very much for the lucid explanation.

[@moyukh2007]

ultimate lte attach explained , many thanks

[@resoldab]

Very precise and detailed explanation, it has helped me greatly.

[@sudhanshukumar3822]

This is very useful and best video on the KZbin pf LTE Attach call flow

[@wirelessnerd7131]

Very well put together. Thank you.

[@hariharanmurali9613]

This video is remarkable! Kudos to you

[@bhavinjoshi6780]

Excellent video Sir!!! Many many thanks!!! It would be very very helpful.

[@modilalarun1238]

Excellent explanation, it's very clear and easy to understand. Please post more videos . Thanks for the information. 👍

[@Sandeepy156]

During inter 3GPP handovers which are the interfaces are created between release 8 SGSN to connect with LTE EPC SGW & MME? A. S3/S4 B. S1/S5 C. All of Above D.None of the above If you know the answer can you answer got it this from my college exam

[@basherpvpv3907]

Great thank you...expect more videos like this..

[@balkrishnasrivastava9258]

Best explanation for attach procedure thanks sir

[@balkrishnasrivastava9258]

amazing explained sir with log ....thanks, like this please make RACH procedure also.......

[@danylunny8142]

Thank you. wonderful explanation.

[@ISDANA1]

Excellent Master. Admirable. I feel motivated to learn more. Congratulation

[@suryabh18]

Thanks Claudia. Glad you found the explanation useful

[@ForzaSyria]

thank you brother .. it's really useful :)

[@krishnabonthu312]

Hi Surya, Nice explanation. Thank You.

[@Jitender_Dhankhar]

very well explained sir thank u :)

[@mubarikali8369]

thanks dear for your help and explanation

[@prasadkeshav4371]

Very well explained 👏👌👍

[@jacquelinegomez1011]

This is awesome! Do you happen to have another video that includes a purge request & answer in a s1ap trace & discussing important key factors?

[@rkvizag_USA]

Great explanation!

[@AbdurRahman-po4wg]

Thanks. Well explained.

[@praveensrivastava5537]

its much helpful..thanks sir

[@mohammedfiguig1204]

Best explanation, Thanx,

[@anupdevlikar103]

Loved it !!

[@dominiquebamouni6787]

Very Good explanation. Would you please share the Wireshark packets capture, please. Would like to check to further understand the process. Thank you in advance.

[@manojghongade7095]

This is really good Video with Wireshark Trace analysis. Request you to put similar video for VoLTE end to end call with wireshark trace so it would be great help

[@sureshjain4676]

very well explained

[@DeepakSingh-mj9jw]

nice explanation

[@arcert6743]

Thank you. Excellent explanation and very helpful in understanding the concepts. Can you please guide how the roaming scenarios work while mobile is moving from one operator to another and how S8 interface PGW is selected. Thanks

[@malikyaser1]

If SGW connect with different PGW that is belong to different user plan in RAN it connect via protocol S8.

[@furcamarius9406]

Very usefully explanation. Can you please share also for Gx/Gy flows a similar one? Best regards!

[@malakondaiah1512]

Good information,tq u

[@porapooka]

Can we get similar type of video for IMS to IMS calls with call flows explanation and examples....

[@atahanaltuntas6164]

Very very good video. I just have one confusion, in Initial Context SetUp Message, MME transfers the SGW GTP TEID and SGW IP to ENB for ERAB set up. So it is for user plane. And in Initial Context Setup Response message, eNB transfers GTP TEID and IP of EnodeB. Then why in last step, SGW informs in Modify Bearer Response message about it's GTP TEID and IP address? MME shall know it in initial Create Session Response message i guess? Thanks for your answer in advance

[@kenezmorotz6490]

Dear Sir, thanks for the video. Could you tell me how was the capture gathered?

[@AhmedKhan-du3lg]

At 11:47 it is mentioned that RAT/VPLMN/IMSI info is transferred in the in the AIR request, but later at 14:18 the same info (RAT/VPLMN/IMSI) is getting transferred in the ULR. I think the later case is true .

[@rakeshvarma9424]

superb

[@Sandeepy156]

During inter 3GPP handovers which are the interfaces are created between release 8 SGSN to connect with LTE EPC SGW & MME? A. S3/S4 B. S1/S5 C. All of Above D.None of the above

[@shajeedsk7702]

A very good explanation.!. Will be very much helpful if you provide the .pcap files. Thanks in advance.

[@suryabh18]

Glad u found the video useful. Sorry can't share the raw pcap due to Privacy related concerns. Cheers!

[@unnikrishnanvh5251]

Very useful and nice explanation Can someone tell me in which message the UE gets its IP address from the PGW. Is it from the Create Session Response?

[@suryabh18]

CS response will have the UE IP.

[@Praveenpayakkara]

thank you, one query The S1 AP ID is unique in the ENB, can it possible for another ENB to use the same ID? if not, how the other ENB know this specific S1 AP ID is already used in the NW?

[@suryabh18]

Good question. enb-S1 AP ID is unique within the enb and the MME S1AP ID is unique within the MME. A combination of these 2 uniquely identifies the S1 connection for a given UE. Hope that helps.

[@balkrishnasrivastava9258]

Please make same for enodeb handover procedure

[@smrutiranjan588]

Thank u

[@malakondaiah1512]

Can u upload x2HO,S1HO,csfb,srvcc ,volte,MIMO,CA, wireshark videos

[@Harshitgupta-qw2yc]

Thanks

[@dheerendraprasad2020]

will u provide the wiresharks log from node

[@irfanshiekh1874]

Master peice

[@morhareach7315]

How do I know that UE attached in 4G,2G or 3G? Can you tell me by looking in this flow?

[@ilovesourav]

25:55 slip of the tongue. It is Attach Complete and not Attach Accept. But, overall, an amazing quick byte to brush up before interviews.

[@SAURABHJAIN1989]

I always have this doubt: what is the "initial UE message"? I mean IP of phone / device or what exactly certain numbers or kind of data UE send to MME?

[@sureshgoondla1917]

PCRF is not involved in the LTE initial attach?

[@Winstonsmith1984ingsoc]

can you upload tau/rau procedure pcap analysis?

[@Sandeepy156]

The eNode transmite e Responee message to a preamble using which of the following? Select the best 1 Pot Channel 2 Downlink Control Channel and Shared Channel 3 Shared Channel 4 Paging Channel 5 Data Channel

[@rohitkumara2802]

❤

[@syauqisabili3776]

When i analyzed my pcap file, i get problem that MME closed sctp connection because enodeB(s1aptester) sent ICMP message to MME instead of HEART ACK. do you know why?

[@suryabh18]

Does your enodeB already have a S1 connection established ? Sounds like not.

[@syauqisabili3776]

@@suryabh18 thank you for your reply sir, The log of mme shows 'eNB-S1 accepted' twice. first in s1_path module second in master_sm module after that, Attach request. and the last message is 'eNB-S1[a] connection refused!!!'. these are my files (nextepc.pcap and s1ap.pcap), i hope that your suggestions could help me. drive.google.com/drive/u/0/folders/1mQrEkd10zRALzAaTY3ul9p_nv64r0efw Thank you very much and sorry for disturbing your time.

[@suryabh18]

@@syauqisabili3776 Looked at ur captures. So it seems like SCTP end point on eNB becomes unreachable after the initial attach success. I doubt this is related to the attach. When the enb is in this condition can you verify connectivity to the SCTP port 36412 - some useful commands - www.cyberciti.biz/faq/ping-test-a-specific-port-of-machine-ip-address-using-linux-unix/

[@syauqisabili3776]

@@suryabh18 thanks for your reply sir, I've verified using nping while the condition s1ap is running, the result works properly. (but when im running s1ap, then close automatically without press ctrl+c) when i ran this command on nextepc vm $ sudo netstat --sctp -tulpn one of result shows, sctp 192.168.10.210:36412 LISTEN

[@suryabh18]

@@syauqisabili3776 so you are saying the sctp is healthy on 192.168.10.70 (enb side) under when it does not send a HB_ACK ? If yes, I am not sure what kind of networking you have but maybe worth checking an firewall rules etc. Also u can change sctp settings on both end points to send multiple HB chunks if one does not succeed. Check the vendor doc for exact parameter names. Hope this helps.

[@jaydip6355]

please add on PCRF call flow with it, thanks

[@ashishkumbhar9741]

Please share the same on IMS call flow

[@raghavchakravorthy3896]

where to find this pcap file

[@samtnvideos2918]

How can we view these analysis in wire shark , as I have pcap file but I am not getting those messages can any one help

[@suryabh18]

Hello, you should be able to filter by protocol in wireshark

[@samtnvideos2918]

What filter we need to apply

[@shajeedsk7702]

Hi, please provide the .pcap files if you can. Thanks!

[@pajtimi6265]

Can we have the .pcap file please ?

[@tejas_bodhe]

in which msg PGW allocates IP address to UE

[@suryabh18]

Create session response

[@anshgupta8065]

Please make video on python & c Programming ,which is used in protocol development /testing with interview question in C.

[@electricaladvisorabhinov9884]

GOOD EXPLABATION BUT PLS STOP DRINKING WATER IN BETWEEN

[@travellingguitarsinger]

can you share the sample pcap please?

[@suryabh18]

Sorry Amit I can’t share these since there is some proprietary and confidential information in these logs. Thanks for your understanding.

[@travellingguitarsinger]

@@suryabh18 Understood, Thanks for quick reply.

[@suryabh18]

You can downlead some sample PCAPs from - blog.colte.network/pcap-library/

[@2812manish]

Nice explanation, but it seems that instructor is speaking while with eating something, and it sounds very annoying.

[@ashwinilakade936]

Same issue ....it's irritating ...😐

[@amitdhamija222]

Awesome

[@santhoshreddygogula2768]

bro call logs are not clear

[@vaishnavijadhav3002]

Nothing is visible

[@armurray359]

Good tutorial, but the periodic slurping of whatever he's drinking is driving me nuts 😢.

[@raghavshere]

Would you please stop slurping in between your videos .. It's so irritating . Otherwise from content point of view .. your work is nice .