SMS Over SGs Interface - LTE

23/4/2014 Terminating the SMS over SGs interface | LTE AND BEYOND | Tech-blog on 4G/LTE and beyond..

http://www.lteandbeyond.com/2013/08/terminating-sms-over-sgs-interface.html 1/21

LTE, 4G, EPC, MME, PGW, SGW, Interfaces and beyond tech-blog by Bart Barton

LTE AND BEYOND

If you liked it, or content was helpful to you please add "+1" to article you used or share it on facebook or so.

Make it easier to find for others who could need those information, allow them find these articles on the spot. But.. it's your call.

Recommendations until now +5 Recommend this on Google

A U G 1 3 , 2 0 1 3

Terminating the SMS over SGs interface

All the best to you on the workaholic day! As I was told by the BBC in the morning.

Recently I've been asked to investigate curious case which on the SMS duplicates. On the end it appeared it's

more than just duplicates issue, but because of confidentiality agreements I will not speak about that.

From the begining I would like to add that on the bottom of this article you will find a trace from live MME

node. Sometimes to see the real signaling is better than just the call flow. Also I have to add that the trace

was collected only on the MME, that's why signaling steps not involving the MME are not present there.

As the Figure 1 caption stays presented call flow is for the idle mode.

According to the specification the if the UE is in active mode, the only difference is that steps 6, 7, 8 are

missing, also in the step 9d the MME includes the E-CGI and TAI.

At first I would like to start with the call flow, so here it is.

SMS OVER THE SGS

SMS Active Mode

SMS Idle Mode

Fig. 1. Mobile terminating the SMS - idle mode

Search

SEARCH THIS BLOG

Bart Barton

Follow 209

I'm a M.Sc, B.Eng of Telco and

Electronics from Poland who

graduated both of his degree on

Military University of Technology in

Warsaw, Poland. I've created this

blog to help myself as others

gaining knowledge on LTE/4G and

beyond. Hope that it will be, or

maybe even was, useful to You.

When there is nothing to do, there

is always something to do. Except

doing the dishes, and so on. ;-)

You can find me also on LinkedIn

http://linkedin.com/in/bartbarton

or my profile on Google+ I'm also

running the

www.lteandbeyond.com

Also directly through bart [at] lte

and beyond [dot] com

View my complete profile

ABOUT ME

Home

A little bit about me

PAGES

Subscribe in a reader

SUBSCRIBE TECH-BLOG!

attach (4)

CDF (2)

CDR (1)

CSFB (2)

CTF (3)

DNS in LTE (6)

ECM (2)

EMM (4)

GUTI (3)

LABEL



1. The combined EPS/IMSI attach procedure.

2-4. The SC initiates transfer of mobile terminating SMS. The HLR is requested for routing number for SMS

services and the SMS message is forwarded to the MSC/VLR where the MS/UE is CS attached.

5. The MSC/VLR sends a Paging (IMSI, VLR TMSI, Location Information, SMS indicator) message to the MME.

6. The MME initiates the paging procedure by sending the Paging message to each eNodeB with cells belonging

to the tracking area(s) in which the UE is registered. The UE is paged with its S-TMSI.

7. The MS/UE is paged by the eNodeBs.

8. The UE sends a Service Request message to the MME. The UE indicates its S-TMSI in the RRC signalling.

The MME sends the S1-AP Initial Context Setup Request message to the eNodeB and the eNodeB establishes

the Radio Bearers.

8a. The MME sends a Service Request message to the MSC. In order to permit the MSC to create an accurate

charging record, the MME adds the IMEISV, the local time zone, the Mobile Station Classmark 2, and the UE's

current TAI and E-CGI.

9a. The MSC/VLR builds the SMS message to be sent as defined in Spec (i.e. the SMS message consists of CP

DATA/RP DATA/TPDU/SMS DELIVER parts). The MSC/VLR forwards the SMS message to the MME in a Downlink

Unitdata message.

9b. The MME encapsulates the SMS message in a NAS message and sends the message to the MS/UE.

9c, 9d. The MS/UE acknowledges receipt of the SMS message to the MSC/VLR.

10. The MS/UE returns a delivery report. The delivery report is encapsulated in an NAS message and sent to

the MME.

11. The MME forwards the delivery report to the MSC/VLR in an Uplink Unitdata message.

12-13. The delivery report is forwarded to the SC.

14-15. In parallel to steps 12-13, the MSC/VLR acknowledges receipt of the delivery report to the MS/UE.

16. The MSC/VLR indicates to the MME that no more NAS messages need to be tunnelled - Release Request.

The below is a SMS over SGs trace. It has been splited into sections as the steps from Fig. 1., hope you will

find it helpful.

STEP 5

INBOUND>>>>> 11:50:41:569 Eventid:173001(3)

SGS Rx PDU, from MSC-VLR-IP:29118 to MME-SGs-Interface-IP:29118 (48)

SGs-AP (48 bytes)

PAGING_REQUEST(0x1)

IMSI

2*************7

VLR_NAME

0x0************f444146

4****5

. M S C I N . ** L . ********

SERVICE_INDICATOR

SMS(0x2)

TMSI

0x69d3ad95

LOCATION_AREA_IDENTIFIER

MCC[2**] MNC[**] LAC[2*7]

STEP 6



Protocol IE ID : UEIdentityIdxValue (80)

Criticality

| 01.. .... | Ignore (1)

UEIdentityIdxValue Value :

| .000 0010 | Length Determinant : 2

Value :

| 1101 1100 | | 01.. .... | 0x371

IE : 2

Protocol IE ID : UEPagID (43)

Criticality

| 01.. .... | Ignore (1)

UEPagID Value :


Value :

| 0... .... | Ext bit : 0

| .0.. .... | Choice index : 0

S-TMSI

| ..0. .... | Ext bit : 0

Bit map :

| ...0 .... | IE Extensions : Not present

MMEC

0x**

M-TMSI

0xc4a12020

IE : 3

Protocol IE ID : CNDomain (109)

Criticality

| 01.. .... | Ignore (1)

CNDomain Value :


Value :

| 0... .... | PS (0)

IE : 4

Protocol IE ID : TAILst (46)

Criticality

| 01.. .... | Ignore (1)

TAILst Value :


Value :

Item Count : 1

Item : 1

TAI Item

Protocol IE ID : TAIItem (47)

Criticality

| 01.. .... | Ignore (1)


Value :

| 0... .... | Ext bit : 0

Bit map :

| .0.. .... | IE Extensions : Not present

PLMN Identity

0x***51

TAC

0x**04




Value :

| 1101 1100 | | 01.. .... | 0x**1

IE : 2


Criticality

| 01.. .... | Ignore (1)

UEPagID Value :


Value :

| 0... .... | Ext bit : 0

| .0.. .... | Choice index : 0

S-TMSI

| ..0. .... | Ext bit : 0

Bit map :


MMEC

0x**

M-TMSI

0xc4a12020

IE : 3


Criticality

| 01.. .... | Ignore (1)

CNDomain Value :


Value :

| 0... .... | PS (0)

IE : 4


Criticality

| 01.. .... | Ignore (1)

TAILst Value :


Value :

Item Count : 1

Item : 1

TAI Item


Criticality

| 01.. .... | Ignore (1)


Value :

| 0... .... | Ext bit : 0

Bit map :


PLMN Identity

0x***451

TAC

0x**04




Criticality

| 01.. .... | Ignore (1)

UEPagID Value :


Value :

| 0... .... | Ext bit : 0

| .0.. .... | Choice index : 0

S-TMSI

| ..0. .... | Ext bit : 0

Bit map :


MMEC

0x**

M-TMSI

0xc4a12020

IE : 3


Criticality

| 01.. .... | Ignore (1)

CNDomain Value :


Value :

| 0... .... | PS (0)

IE : 4


Criticality

| 01.. .... | Ignore (1)

TAILst Value :


Value :

Item Count : 1

Item : 1

TAI Item


Criticality

| 01.. .... | Ignore (1)


Value :

| 0... .... | Ext bit : 0

Bit map :


PLMN Identity

0x***451

TAC

0x**04




Value :

| 0... .... | Ext bit : 0

| .0.. .... | Choice index : 0

S-TMSI

| ..0. .... | Ext bit : 0

Bit map :


MMEC

0x**

M-TMSI

0xc4a12020

IE : 3


Criticality

| 01.. .... | Ignore (1)

CNDomain Value :


Value :

| 0... .... | PS (0)

IE : 4


Criticality

| 01.. .... | Ignore (1)

TAILst Value :


Value :

Item Count : 1

Item : 1

TAI Item


Criticality

| 01.. .... | Ignore (1)


Value :

| 0... .... | Ext bit : 0

Bit map :


PLMN Identity

0x***451

TAC

0x**04



S-TMSI

| ..0. .... | Ext bit : 0

Bit map :


MMEC

0x**

M-TMSI

0xc4a12020

IE : 3


Criticality

| 01.. .... | Ignore (1)

CNDomain Value :


Value :

| 0... .... | PS (0)

IE : 4


Criticality

| 01.. .... | Ignore (1)

TAILst Value :


Value :

Item Count : 1

Item : 1

TAI Item


Criticality

| 01.. .... | Ignore (1)


Value :

| 0... .... | Ext bit : 0

Bit map :


PLMN Identity

0x***451

TAC

0x**04



MMEC

0x**

M-TMSI

0xc4a12020

IE : 3


Criticality

| 01.. .... | Ignore (1)

CNDomain Value :


Value :

| 0... .... | PS (0)

IE : 4


Criticality

| 01.. .... | Ignore (1)

TAILst Value :


Value :

Item Count : 1

Item : 1

TAI Item


Criticality

| 01.. .... | Ignore (1)


Value :

| 0... .... | Ext bit : 0

Bit map :


PLMN Identity

0x***451

TAC

0x**04

STEP 8

INBOUND>>>>> 11:50:42:796 Eventid:155212(3)

S1AP Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (60)

S1 Application Part (S1AP) (60 bytes)

| 0... .... | Ext bit : 0

| .00. .... | Choice index : Initiating Message (0)

Procedure Code : INITIAL UE MESSAGE (12)

Criticality

| 01.. .... | Ignore (1)

INITIAL UE MESSAGE Value :


Value :

| 0... .... | Ext bit : 0

IEs Count : 6

IE : 1

Protocol IE ID : eNB_UE_S1AP_ID (8)

Criticality

| 00.. .... | Reject (0)

eNB_UE_S1AP_ID Value :


Value :

| 01.. .... | Length Determinant : 2

2632 (0xa48)

IE : 2

Protocol IE ID : NAS_PDU (26)

Criticality

| 00.. .... | Reject (0)

NAS_PDU Value :


Value :


0xc7162927

EPS Mobility Management

Protocol Discriminator



EPS MOBILITY MANAGEMENT MESSAGES(0x7)

Security Header Type

NAS_MSG_SECURITY_HDR_SERVICE_REQUEST(0xc)

KSI and Sequence Number

KSI

(0x0)

SEQUENCE NUMBER

(0x16)

Short MAC

(0x2927)


IE : 3

Protocol IE ID : TAI (67)

Criticality

| 00.. .... | Reject (0)

TAI Value :


Value :

Bit map :

| 0... .... | IE Extensions : Not present

PLMN Identity

0x***451

TAC

0x**04

IE : 4

Protocol IE ID : EUTRAN_CGI_ID (100)

Criticality

| 01.. .... | Ignore (1)

EUTRAN_CGI_ID Value :


Value :

| 0... .... | Ext bit : 0

Bit map :


PLMN Identity

0x***451

Cell Identity

| 0000 0000 | + 20 bits : 0x****114

IE : 5

Protocol IE ID : RRC_Establishment_Cause (134)

Criticality

| 01.. .... | Ignore (1)

RRC_Establishment_Cause Value :


Value :

| 0... .... | Ext bit : 0

| .010 .... | mt-Access (2)

IE : 6

Protocol IE ID : S_TMSI (96)

Criticality

| 00.. .... | Reject (0)

S_TMSI Value :


Value :

| 0... .... | Ext bit : 0

Bit map :


MMEC

0x**

M-TMSI

0xc4a12020

INBOUND>>>>> 11:50:42:796 Eventid:153001(3)

NAS Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (4)

Non Access Stratum (NAS) (4 bytes)






KSI and Sequence Number

KSI



(0x0)

SEQUENCE NUMBER

(0x16)

Short MAC

(0x2927)




E-RAB ID

| ...0 .... | Ext bit : 0

| .... 0101 | 5 (0x05)

E-RAB Level QOS Parameters

| 0... .... | Ext bit : 0

Bit map :

| .0.. .... | GBR QOS Information : Not present

| ..0. .... | IE Extensions : Not present

QCI

8 (0x08)

Allocation and Retention Priority

| 0... .... | Ext bit : 0

Bit map :


Priority Level

| ..01 10.. | 6 (0x06)

Pre-emption Capability

| .... ..0. | shall-not-trigger-pre-emption (0)

Pre-emption Vulnerability

| .... ...1 | pre-emptable (1)

Transport Layer Address

| 0... .... | Ext bit : 0

| .000 1111 | | 1... .... | Length Determinant : 32

| 0000 1010 | + 24 bits : 0x0ac8e908

GTP-TEID

0xb3d6606b

IE : 5

Protocol IE ID : UESecurityCapabilities (107)

Criticality

| 00.. .... | Reject (0)

UESecurityCapabilities Value :


Value :

| 0... .... | Ext bit : 0

Bit map :


Encryption Algorithms

| ..0. .... | Ext bit : 0

| ...1 1000 | + 11 bits : 0xc000

Integrity Protection Algorithms

| ...0 .... | Ext bit : 0

| .... 1100 | + 12 bits : 0xc000

IE : 6

Protocol IE ID : SecurityKey (73)

Criticality

| 00.. .... | Reject (0)

SecurityKey Value :


Value :

0x38237196a333f8b7fb516fe8a48bd53a932b1142bf3ca8402fbf4919f73b7fe8

IE : 7

Protocol IE ID : UERadioCapblty (74)

Criticality

| 01.. .... | Ignore (1)

UERadioCapblty Value :


Value :


0x013801024c520000208313050b8fff0b8fff0b8ffebe1ff901103004870ca74a926020580000000000

INBOUND>>>>> 11:50:42:914 Eventid:155212(3)



| 0... .... | Ext bit : 0

| .01. .... | Choice index : Successful Outcome (1)

Procedure Code : INITIAL CONTEXT SETUP (9)

Criticality

| 00.. .... | Reject (0)

INITIAL CONTEXT SETUP Value :


Value :

| 0... .... | Ext bit : 0

IEs Count : 3



IE : 1

Protocol IE ID : MME_UE_S1AP_ID (0)

Criticality

| 01.. .... | Ignore (1)

MME_UE_S1AP_ID Value :


Value :


33586054 (0x2007b86)

IE : 2


Criticality

| 01.. .... | Ignore (1)



Value :


2632 (0xa48)

IE : 3

Protocol IE ID : E-RABSetupLstCtxtSURes (51)

Criticality

| 01.. .... | Ignore (1)

E-RABSetupLstCtxtSURes Value :


Value :

Item Count : 1

Item : 1

E-RAB Setup Item

Protocol IE ID : E-RABSetupItemCtxtSURes (50)

Criticality

| 01.. .... | Ignore (1)


Value :

| 0... .... | Ext bit : 0

Bit map :


E-RAB ID

| ..0. .... | Ext bit : 0

| ...0 101. | 5 (0x05)

Transport Layer Address

| .... ...0 | Ext bit : 0

| 0001 1111 | Length Determinant : 32

| 0110 0100 | + 24 bits : 0x644d100b

GTP-TEID

0xe82dd55f

***CONTROL*** 11:50:42:915 Eventid:147118

imsi 2*************7, MME-EGTPC-BRR-STATE for brr-id 5 changed from MME_EGTPC_STATE_ACTIVE to

MME_EGTPC_STATE_MOD_BRR_REQ_PENDING



EPS BEARER ID:

Type: 73 Length: 1 Inst: 0

Value: 5

Hex: 4900 0100 05

ENB-DATA FTEID:


Value:

Interface: ENODE-B S1-U

IPv4 Flag: 1

IPv6 Flag: 0

Teid: 0xE82DD55F

IPV4 Addr: eNB-5-IP

Hex: 5700 **** **** 2DD5 5F64 **** 0B

Hex: 5D00 **** **** **** 0557 0009 **** E82D

D55F 644D 100B

INBOUND>>>>> 11:50:42:919 Eventid:141004(3)

[MME-S11]GTPv2C Rx PDU, from SPGW-S11-Interface-IP:2123 to MME-S11-Interface-IP:30513 (46)

TEID: 0x808C8020, Message type: EGTP_MODIFY_BEARER_RESPONSE (0x23)

Sequence Number: 0x7C2220 (8135200)

GTP HEADER

Version number: 2

TEID flag: Present

Piggybacking flag: Not present

Message Length: 0x002A (42)

INFORMATION ELEMENTS

CAUSE:


Value:

Cause: EGTP_CAUSE_REQ_ACCEPTED (0x10)

PCE: 0

BCE: 0

CS: 0

Hex: 0200 0200 1000

BEARER CONTEXT MODIFIED:


Value:

EPS BEARER ID:


Value: 5

Hex: 4900 0100 05

CAUSE:


Value:

Cause: EGTP_CAUSE_REQ_ACCEPTED (0x10)

PCE: 0

BCE: 0

CS: 0

Hex: 0200 0200 1000

SGW-DATA FTEID:


Value:

Interface: SGW S1-U

IPv4 Flag: 1

IPv6 Flag: 0

Teid: 0xB3D6606B

IPV4 Addr: SGW-S1U-Interface-IP

Hex: 5700 **** **** **** 08

Hex: 5D00 **** **** **** 0AC8 E908

***CONTROL*** 11:50:42:919 Eventid:147118

imsi 2*************7, MME-EGTPC-BRR-STATE for brr-id 5 changed from MME_EGTPC_STATE_MOD_BRR_REQ_PENDING to

MME_EGTPC_STATE_ACTIVE



STEP 8a

> 11:50:42:958 Eventid:173001(3)


SGs-AP (49 bytes)

DOWNLINK_UNITDATA(0x7)

IMSI

2*************7

NAS_MESSAGE_CONTAINER

0x09012101010791447758100650001504

0c914457758853500000318070110514

4002b518

. . . . . . . D w X . . P . . .

. . D W u . S P . . 1 . p . . .

. . . .

STEP 9b



0c914457758853500000318070110514

4002b518

. . . . . . . D w X . . P . . .

. . D W u . S P . . 1 . p . . .

. . . .

> 11:50:43:016 Eventid:155212(3)



| 0... .... | Ext bit : 0


Procedure Code : UPLINK NAS TRANSPORT (13)

Criticality

| 01.. .... | Ignore (1)

UPLINK NAS TRANSPORT Value :


Value :

| 0... .... | Ext bit : 0

IEs Count : 5

IE : 1


Criticality

| 00.. .... | Reject (0)





Value :


33586054 (0x2007b86)

IE : 2


Criticality

| 00.. .... | Reject (0)



Value :


2632 (0xa48)

IE : 3


Criticality

| 00.. .... | Reject (0)

NAS_PDU Value :


Value :


0x27a06c90d89768eefaac5b

NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)

MAC = 0x****0d8

NAS Count = 0x97

IE : 4


Criticality

| 01.. .... | Ignore (1)



Value :

| 0... .... | Ext bit : 0

Bit map :


PLMN Identity

0x***451

Cell Identity

| 0000 0000 | + 20 bits : 0x****114

IE : 5


Criticality

| 01.. .... | Ignore (1)

TAI Value :


Value :

Bit map :


PLMN Identity

0x***451

TAC

0x**04

INBOUND>>>>> 11:50:43:016 Eventid:153001(3)




MAC = 0x****90d8

NAS Count = 0x97





NAS_MSG_SECURITY_HDR_PLAIN_NAS_MSG(0x0)

Message Type

UL_NAS_TRANSPORT(0x63)

NAS Msg Container

0x8904

. .



STEP 9d

> 11:50:43:112 Eventid:155212(3)



| 0... .... | Ext bit : 0


Procedure Code : UPLINK NAS TRANSPORT (13)

Criticality

| 01.. .... | Ignore (1)

UPLINK NAS TRANSPORT Value :


Value :

| 0... .... | Ext bit : 0

IEs Count : 5

IE : 1


Criticality

| 00.. .... | Reject (0)



Value :


33586054 (0x2007b86)

IE : 2


Criticality

| 00.. .... | Reject (0)



Value :


2632 (0xa48)

IE : 3


Criticality

| 00.. .... | Reject (0)

NAS_PDU Value :




Value :


0x27cc04c41698fbfe9394bc21d4ecfa567375


MAC = 0x****c416

NAS Count = 0x98

IE : 4


Criticality

| 01.. .... | Ignore (1)



Value :

| 0... .... | Ext bit : 0

Bit map :


PLMN Identity

0x***451

Cell Identity

| 0000 0000 | + 20 bits : 0x****114

IE : 5


Criticality

| 01.. .... | Ignore (1)

TAI Value :


Value :

Bit map :


PLMN Identity

0x***451

TAC

0x**04

INBOUND>>>>> 11:50:43:112 Eventid:153001(3)




MAC = 0x****c416

NAS Count = 0x98





NAS_MSG_SECURITY_HDR_PLAIN_NAS_MSG(0x0)

Message Type

UL_NAS_TRANSPORT(0x63)

NAS Msg Container

0x890106020141020000

. . . . . A . . .

STEP 11



{0x57, 0x58, 0xa6}

REVISION

ES_IND

RF_POWER_CAP

PS_CAP

SS_SCREEN_IND

SM_CAP

CM3

LCSVA_CAP

CMSP

A5_3

TRACKING_AREA_IDENTITY

MCC[2**] MNC[**] TAC[***80]

E_UTRAN_CELL_GLOBAL_IDENTITY

MCC[2**] MNC[**] CELLID[0x***4]

STEP 14

INBOUND>>>>> 11:50:43:152 Eventid:173001(3)


SGs-AP (15 bytes)

DOWNLINK_UNITDATA(0x7)

IMSI

2*************7

NAS_MESSAGE_CONTAINER

0x0904

. .

STEP 15



Posted by Bart Barton at 1:06 AM

Labels: MME, SGs

Location: Newbury, West Berkshire, UK


Criticality

| 00.. .... | Reject (0)



Value :


2632 (0xa48)

IE : 3


Criticality

| 00.. .... | Reject (0)

NAS_PDU Value :


Value :


0x27c5e8f7ce55b8c0730024


MAC = 0x****7ce

NAS Count = 0x55

STEP 16

INBOUND>>>>> 11:50:43:162 Eventid:173001(3)


SGs-AP (11 bytes)

RELEASE_REQUEST(0x1b)

IMSI

2*************7

Source:

My own experience

3GPP TS 23.272

Details about the delivery exchange between MSC and SC can be found in 3GPP TS 23.040

+5 Recommend this on Google



Newer Post Older Post

1 comment

Top comments

Bart Barton via Google+ 8 months ago - Shared publicly

SMS over SGs - enjoy!

+232

1 Reply

Add a comment as Rahul Kumar

Home

Subscribe to: Post Comments (Atom)

Bart Barton

209 followers

Follow

FOLLOW ME MAYBE?

Bart Barton. Powered by Blogger.

Documents

SMS Over SGs Interface - LTE