New draft

RRC: Cell Update procedure ...

070721版本

GPRS RLC/MAC message group

Downlink RLC/MAC control messages
value Message Type
01h PACKET CELL CHANGE ORDER
02h PACKET DOWNLINK ASSIGNMENT
03h PACKET MEASUREMENT ORDER
04h PACKET POLLING REQUEST
05h PACKET POWER CONTROL/TIMING ADVANCE
06h PACKET QUEUEING NOTIFICATION
07h PACKET TIMESLOT RECONFIGURE
08h PACKET TBF RELEASE
09h PACKET UPLINK ACK/NACK
0Ah PACKET UPLINK ASSIGNMENT
0Bh PACKET CELL CHANGE CONTINUE
0Ch PACKET NEIGHBOUR CELL DATA
0Dh PACKET SERVING CELL DATA
21h PACKET ACCESS REJECT
22h PACKET PAGING REQUEST
23h PACKET PDCH RELEASE
24h PACKET PRACH PARAMETERS
25h PACKET DOWNLINK DUMMY CONTROL BLOCK
30h PACKET SYSTEM INFORMATION TYPE 6
31h PACKET SYSTEM INFORMATION TYPE 1
32h PACKET SYSTEM INFORMATION TYPE 2
33h PACKET SYSTEM INFORMATION TYPE 3
34h PACKET SYSTEM INFORMATION TYPE 3bis
35h PACKET SYSTEM INFORMATION TYPE 4
36h PACKET SYSTEM INFORMATION TYPE 5
37h PACKET SYSTEM INFORMATION TYPE 13
38h PACKET SYSTEM INFORMATION TYPE 7
39h PACKET SYSTEM INFORMATION TYPE 8
3Ah PACKET SYSTEM INFORMATION TYPE 14
3Ch PACKET SYSTEM INFORMATION TYPE 3 ter
3Dh PACKET SYSTEM INFORMATION TYPE 3 quater
3Eh PACKET SYSTEM INFORMATION TYPE 15

Uplink RLC/MAC control messages
value Message Type

00h PACKET CELL CHANGE FAILURE
01h PACKET CONTROL ACKNOWLEDGEMENT
02h PACKET DOWNLINK ACK/NACK
03h PACKET UPLINK DUMMY CONTROL BLOCK
04h PACKET MEASUREMENT REPORT
05h PACKET RESOURCE REQUEST
06h PACKET MOBILE TBF STATUS
07h PACKET PSI STATUS
-- PACKET CHANNEL REQUEST
08h EGPRS PACKET DOWNLINK ACK/NACK
09h PACKET PAUSE
0Bh ADDITIONAL MS RADIO ACCESS CAPABILITIES
0Ch PACKET CELL CHANGE NOTIFICATION
0Dh PACKET SI STATUS

Ref:
[-] NetHawk GSM Analyser v8.6 HELP
[-] Radio Link Control/Medium Access Control (RLC/MAC) 3GPP TS 44.060 V4.8.0

070626r1版本

SM message group

ACTIVATE AA PDP CONTEXT ACCEPT
ACTIVATE AA PDP CONTEXT REJECT
ACTIVATE AA PDP CONTEXT REQUEST
ACTIVATE PDP CONTEXT ACCEPT
ACTIVATE PDP CONTEXT REJECT
ACTIVATE PDP CONTEXT REQUEST
ACTIVATE SECONDARY PDP CONTEXT ACCEPT
ACTIVATE SECONDARY PDP CONTEXT REJECT
ACTIVATE SECONDARY PDP CONTEXT REQUEST
DEACTIVATE AA PDP CONTEXT ACCEPT
DEACTIVATE AA PDP CONTEXT REQUEST
DEACTIVATE PDP CONTEXT ACCEPT
DEACTIVATE PDP CONTEXT REQUEST
MODIFY PDP CONTEXT ACCEPT
MODIFY PDP CONTEXT REJECT
MODIFY PDP CONTEXT REQUEST
REQUEST PDP CONTEXT ACTIVATION
REQUEST PDP CONTEXT ACTIVATION REJECT
SM STATUS

[1] NetHawk GSM Analyser v7.9 HELP
[2] GSM Layer 3 (GSM L3) 3GPP TS 24.008 V.4.8.0 (2002-09) , 3GPP TS 44.018 V4.11.0

070619-draft

GMM message group

ATTACH ACCEPT
ATTACH COMPLETE
ATTACH REJECT
ATTACH REQUEST
AUTHENTICATION AND CIPHERING FAILURE
AUTHENTICATION AND CIPHERING REJECT
AUTHENTICATION AND CIPHERING REQUEST
AUTHENTICATION AND CIPHERING RESPONSE
DETACH ACCEPT
DETACH REQUEST
GMM INFORMATION
GMM STATUS
IDENTITY REQUEST
IDENTITY RESPONSE
P-TMSI REALLOCATION COMMAND
P-TMSI REALLOCATION COMPLETE
ROUTING AREA UPDATE ACCEPT
ROUTING AREA UPDATE COMPLETE
ROUTING AREA UPDATE REJECT
ROUTING AREA UPDATE REQUEST

[1] NetHawk GSM Analyser v7.9 HELP
[2] GSM Layer 3 (GSM L3) 3GPP TS 24.008 V.4.8.0 (2002-09) , 3GPP TS 44.018 V4.11.0

070619-draft

CC message group

ALERTING
CALL CONFIRMED
CALL PROCEEDING
CC-ESTABLISHMENT
CC-ESTABLISHMENT CONFIRMED
CONGESTION CONTROL
CONNECT
CONNECT ACKNOWLEDGE
DISCONNECT
EMERGENCY SETUP
FACILITY
HOLD
HOLD ACKNOWLEDGE
HOLD REJECT
MODIFY
MODIFY COMPLETE
MODIFY REJECT
NOTIFY
PROGRESS
RECALL
RELEASE
RELEASE COMPLETE
RETRIEVE
RETRIEVE ACKNOWLEDGE
RETRIEVE REJECT
SETUP
START CC
START DTMF
START DTMF ACKNOWLEDGE
START DTMF REJECT
STATUS
STATUS ENQUIRY
STOP DTMF
STOP DTMF ACKNOWLEDGE
USER INFORMATION

Ref:
[1] NetHawk GSM Analyser v7.9 HELP
[2] GSM Layer 3 (GSM L3) 3GPP TS 24.008 V.4.8.0 (2002-09) , 3GPP TS 44.018 V4.11.0

070619-draft

MM message group

ABORT
AUTHENTICATION FAILURE
AUTHENTICATION REJECT
AUTHENTICATION REQUEST
AUTHENTICATION RESPONSE
CM RE-ESTABLISHMENT REQUEST
CM SERVICE ABORT
CM SERVICE ACCEPT
CM SERVICE PROMPT
CM SERVICE REJECT
CM SERVICE REQUEST
IDENTITY REQUEST
IDENTITY RESPONSE
IMSI DETACH INDICATION
LOCATION UPDATING ACCEPTED
LOCATION UPDATING REJECT
LOCATION UPDATING REQUEST
MM INFORMATION
MM NULL
MM-STATUS
NOTIFICATION RESPONSE
TMSI REALLOCATION COMMAND
TMSI REALLOCATION COMPLETE

Ref:
[1] NetHawk GSM Analyser v7.9 HELP
[2] GSM Layer 3 (GSM L3) 3GPP TS 24.008 V.4.8.0 (2002-09) , 3GPP TS 44.018 V4.11.0.

070619r1-draft

RR message: MEASUREMENT REPORT

Interface:
GSM Um [MS --> BTS];
GSM Abis [BTS --> BSC]

Conn:1 Line:1 TS:30 Subch:0 164 10:58:50.767533
--------E1:
VALID FRAME
00 03 03 08 28 01 0A 1B 3E 19 0A 3F 3F 00 00 02 FF FF 22 00 00 04 0F 0A
98 00 0B 00 12 06 15 3F 3F 01 C0 00 00 00 00 00 00 00 00 00 00 00 00
--------LAPD:
UNNUMBERED INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 0 P/F: 0
08 28 01 0A 1B 3E 19 0A 3F 3F 00 00 02 FF FF 22 00 00 04 0F 0A 98 00 0B
00 12 06 15 3F 3F 01 C0 00 00 00 00 00 00 00 00 00 00 00 00
--------BTSM:
MEAS. RES. (DCh) T=0
Channel Nr
- full rate TCH
- timeslot : 2
Meas.Res. Nr
- value : 62 (3eh)
Uplink Meas.
- length : 10 (ah)
- downlink DTX not used
- rxlev_full : 63 (> -48 dBm)
- rxlev_sub : 63 (> -48 dBm)
- rxqual_full : 0
- rxqual_sub : 0
- suppl. info : 0002FFFF220000
BS Power
- Fast Power Control not in use
- power control level : pn 30 db
L1 Info
- MS power control level : 19 (13h)
- Fast Power Control not in use
- actual TA : 0 (00h) (0 km) <- 將MS的TA數值送給BSC。
L3 Info
- Length indicator: 18 (0012h)
- Link layer serv. data unit
06 15 3F 3F 01 C0 00 00 00 00 00 00 00 00 00 00 00 00
--------RR:
MEASUREMENT REPORT (RR)
Skip Indicator: 00
RR management Protocol Discriminator: 06
Measurement Results:
- BA-Used: 0
- DTX Used: 0 DTX was not used
- Full-Serving-Cell:
- RXLEV: 63 (greater than -48 dBm + SCALE)
- _3G-BA-Used: 00
- MEAS-Valid: 0 The measurement results are valid
- Sub-Serving-Cell:
- RXLEV: 63 (greater than -48 dBm + SCALE)
- RXQUAL-Full-Serving-Cell: 00
- RXQUAL-Sub-Serving-Cell: 00
- NO-NCell-M:
Neighbour cell information not available for serving cell
[EOM]

070617r1版本

Call Trace in Abis

[前言]
用戶MS建立一通呼叫或使用某服務所產生的信令message之間的關連性有很多是非常隱微的，無法從信令message本身的名稱看出來，或是由IMSI/TMSI/P-TMSI等ID來辨識，因此如果沒有一個非常聰明的分析工具，工程師往往感到很頭痛，不知message之間如何由時間上與邏輯性來串聯起來，針對一個用戶的MS需求來分析所有的信令。

[Abis]

Scenario 1:MS發起的BTSM: P-Channel Required
[BTS --> BSC]
Conn:2 Line:1 TS:30 Subch:0 745 10:49:02.0835486
--------E1
VALID FRAME: 00 03 76 46 20 63 01 88 13 7A F1 D1 11 00
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 0 P/F: 0
N(R): 23H N(S): 3BH: 20 63 01 88 13 7A F1 D1 11 00
--------BTSM:
P-CHANNEL REQUIRED (GPRS) T=0
Channel Nr
- uplink CCCH (RACH)
- timeslot : 0
Req. Ref
- Est. cause : one phase packet access <- 理由
- used
- random reference : 2 (2h) <- 隨機碼
- T1' : 30 (1eh) <- 參數1
- T2 : 17 (11h) <- 參數2
- T3 : 14 (eh) <- 參數3
- Frame number : 39641 <- 參數4
Access Delay
- value : 0 (00h)
[EOM]

[BTS <-- BSC]
Conn:2 Line:1 TS:30 Subch:0 746 10:49:02.0885487
--------E1:
VALID FRAME: 00 03 01 78
--------LAPD:
RECEIVER READY
SAPI: 0 (0h) TEI: 1 (1h) C/R: 0 P/F: 0
N(R): 3CH
[EOM]

[BTS <-- BSC]
Conn:2 Line:1 TS:30 Subch:0 752 10:49:02.1405491
--------E1:
VALID FRAME
02 03 46 78 20 60 01 90 2B 17 2D 06 3F 10 0A 00 78 7A F1 D1 00 00 C9 08
00 28 2B 2B 2B 2B 2B 2B 2B FC 00 04
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 1 P/F: 0
N(R): 3CH N(S): 23H
20 60 01 90 2B 17 2D 06 3F 10 0A 00 78 7A F1 D1 00 00 C9 08 00 28 2B 2B
2B 2B 2B 2B 2B FC 00 04
--------BTSM:
P-IMM ASSIGN CCCH COMMAND (GPRS) T=0
Channel Nr
- downlink CCCH (PCH + AGCH)
- timeslot : 0
Full Imm. Ass. Info
- value (hex) : 2D 06 3F 10 0A 00 78
7A F1 D1 00 00 C9 08 00 28 2B 2B 2B
2B 2B 2B 2B
Message Sequence Id
- MSI value: 4 (4h)
--------RR:
IMMEDIATE ASSIGNMENT (RR)
L2 Pseudo Length: 0B
Skip Indicator: 00
RR management Protocol Discriminator: 06
Dedicated mode or TBF:
- TMA: No meaning
- down-link: No meaning
- T/D: 1 this message assigns a Temporary Block Flow (TBF)
Page Mode:
- PM: Normal paging
Packet Channel Description:
- Channel type: 01
- TN: 02
- TSC: 00
- ARFCN: 00 78
Request Reference:
- Est Cause: <- 理由(與P-Channel Required的理由相同)
One phase packet access with request for single timeslot uplink transmission; one PDCH is needed
- Random Reference: 2 (0x2) <- 隨機碼(與P-Channel Required的隨機碼相同)
- T1': 30 (0x1e) <- 參數1(與P-Channel Required的相同)
- T2: 17 (0x11) <- 參數2(與P-Channel Required的相同)
- T3: 14 (0xe) <- 參數3(與P-Channel Required的相同)
- Frame number : 39641 <- 參數4(與P-Channel Required的相同)
Timing advance value: 00
Mobile Allocation Length: 00
MA C: empty
IA Rest Octets:
- Packet Uplink Assignment:
- TFI Assignment: 04
- Polling: no action is required from MS
- USF: 04
- USF Granularity: 00
- Channel Coding Command: coding scheme 1, CS-1
- TLLI Block Channel Coding:
mobile station shall use CS-1 in GPRS TBF mode or MCS-1 in EGPRS TBF mode
- Gamma: GammaCH = 0 dB
- Timing Advance Index: 04
[EOM]

[BTS --> BSC]
Conn:2 Line:1 TS:30 Subch:0 753 10:49:02.1435492
--------E1:
VALID FRAME: 02 03 01 48
--------LAPD:
RECEIVER READY
SAPI: 0 (0h) TEI: 1 (1h) C/R: 1 P/F: 0
N(R): 24H
[EOM]

[BTS --> BSC]
Conn:2 Line:1 TS:30 Subch:0 765 10:49:02.2495499
--------E1:
VALID FRAME: 00 03 78 48 20 61 01 90 FC 00 04 08 F0 C8
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 0 P/F: 0
N(R): 24H N(S): 3CH: 20 61 01 90 FC 00 04 08 F0 C8
--------BTSM:
P-IMMEDIATE ASSIGN ACK (GPRS) T=0
Channel Nr
- downlink CCCH (PCH + AGCH)
- timeslot : 0
Message Sequence Id
- MSI value: 4 (4h)
Frame Number
- T1' : 30 (1eh)
- T2 : 8 (8h)
- T3 : 6 (6h)
- Frame number : 39684
[EOM]

070617r1版本

RR message: IMMEDIATE ASSIGNMENT

Interface:
GSM Um [MS <-- BTS]; GSM Abis [BTS <-- BSC]
Tool: NetHawk GSM Analyser v7.9

GSM Abis:
Conn:1 Line:1 TS:30 Subch:0 9 10:58:18.119781
--------E1:
VALID FRAME
02 03 3A 9A 0C 16 01 90 2B 17 2D 06 3F 00 38 00 32 E4 92 05 00 00 2B 2B
2B 2B 2B 2B 2B 2B 2B 2B 2B
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 1 P/F: 0
N(R): 4DH N(S): 1DH
0C 16 01 90 2B 17 2D 06 3F 00 38 00 32 E4 92 05 00 00 2B 2B 2B 2B 2B 2B
2B 2B 2B 2B 2B
--------BTSM: <--這個BTSM在GSM似乎總是和RR:IMMEDIATE ASSIGNMENT一起出現。
IMM.ASS. CMD (CCh) T=0
Channel Nr
- downlink CCCH (PCH + AGCH)
- timeslot : 0
Full Imm. Ass. Info
- value (hex) : 2D 06 3F 00 38 00 32
E4 92 05 00 00 2B 2B 2B 2B 2B 2B 2B
2B 2B 2B 2B
--------RR:
IMMEDIATE ASSIGNMENT (RR)
L2 Pseudo Length: 0B
Skip Indicator: 00
RR management Protocol Discriminator: 06
Dedicated mode or TBF:
- TMA: No meaning
- down-link: No meaning
- T/D: 0 this message assigns a dedicated mode resource
Page Mode:
- PM: Normal paging
Channel Description:
- Channel type and TDMA offset:
SDCCH/4 + SACCH/C4 or CBCH (SDCCH/4), subchannel 3
- TN: 00
- TSC: 00
- Hopping Channel: 0 Single RF channel
- ARFCN: 50 (32h)
Request Reference:
- Est Cause: <- MS當時送出Channel Request時，包含此理由。
1 Originating call and TCH/F is needed, or originating call
- Random Reference: 4 (0x4) <- MS當時送出Channel Request時，包含此隨機碼。
- T1': 18 (0x12)
- T2: 5 (0x5)
- T3: 16 (0x10)
- Frame number : 24445
Timing advance value: 00
Mobile Allocation Length: 00
MA C: empty
IA Rest Octets: empty
[EOM]

GPRS Abis:(有三個例子)
[Example 1]
Conn:2 Line:1 TS:30 Subch:0 10624 10:50:39.1721050
--------E1:
VALID FRAME
02 03 80 E6 20 60 01 90 2B 17 2D 06 3F 30 0A 00 78 00 F4 6C 00 00 DC 00
00 00 38 00 1C 2B 2B 2B 2B FC 00 11 0C 08 29 43 88 41 10 14 01 91
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 1 P/F: 0
N(R): 73H N(S): 40H
20 60 01 90 2B 17 2D 06 3F 30 0A 00 78 00 F4 6C 00 00 DC 00 00 00 38 00
1C 2B 2B 2B 2B FC 00 11 0C 08 29 43 88 41 10 14 01 91
--------BTSM: <--這個BTSM在GPRS似乎總是和RR:IMMEDIATE ASSIGNMENT一起出現。
P-IMM ASSIGN CCCH COMMAND (GPRS) T=0
Channel Nr
- downlink CCCH (PCH + AGCH)
- timeslot : 0
Full Imm. Ass. Info
- value (hex) : 2D 06 3F 30 0A 00 78
00 F4 6C 00 00 DC 00 00 00 38 00 1C
2B 2B 2B 2B
Message Sequence Id
- MSI value: 17 (11h)
MS Identity
- IMSI : 23xxxxx01411019 <-- 使用dummy ID以保護用戶資料。
--------RR:
IMMEDIATE ASSIGNMENT (RR)
L2 Pseudo Length: 0B
Skip Indicator: 00
RR management Protocol Discriminator: 06
Dedicated mode or TBF:
- TMA: No meaning
- down-link:
this message assigns a resource to the mobile station identified in the IA rest octets
- T/D: 1 this message assigns a Temporary Block Flow (TBF)
Page Mode:
- PM: Normal paging
Packet Channel Description:
- Channel type: 01
- TN: 02
- TSC: 00
- ARFCN: 00 78
Request Reference:
- Est Cause: <- MS當時送出Channel Request時，包含此理由
Location updating and the network does not set NECI bit to 1
- Random Reference: 0 (0x0) <- MS當時送出Channel Request時，包含此隨機碼。
- T1': 30 (0x1e)
- T2: 12 (0xc)
- T3: 35 (0x23)
- Frame number : 40988
Timing advance value: 00
Mobile Allocation Length: 00
MA C: empty
IA Rest Octets:
- Packet Downlink Assignment:
- Temporary Logical Link Identity:
- Local TLLI: C0 00 00 03
- TFI Assignment: 00
- RLC Mode: RLC acknowledged mode;
- Gamma: GammaCH = 0 dB
- Polling: no action is required from MS
- TA Valid: the timing advance value is not valid
- Timing Advance Index: 0C
[EOM]

[Example 2]
Conn:2 Line:1 TS:30 Subch:0 8395 10:50:17.2689796
--------E1:
VALID FRAME
02 03 74 CE 20 60 01 90 2B 17 2D 06 3F 10 0A 00 78 78 5B 56 00 00 CD 0C
00 2C 2B 2B 2B 2B 2B 2B 2B FC 00 0E
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 1 P/F: 0
N(R): 67H N(S): 3AH
20 60 01 90 2B 17 2D 06 3F 10 0A 00 78 78 5B 56 00 00 CD 0C 00 2C 2B 2B
2B 2B 2B 2B 2B FC 00 0E
--------BTSM: <--這個BTSM在GPRS似乎總是和RR:IMMEDIATE ASSIGNMENT一起出現。
P-IMM ASSIGN CCCH COMMAND (GPRS) T=0
Channel Nr
- downlink CCCH (PCH + AGCH)
- timeslot : 0
Full Imm. Ass. Info
- value (hex) : 2D 06 3F 10 0A 00 78
78 5B 56 00 00 CD 0C 00 2C 2B 2B 2B
2B 2B 2B 2B
Message Sequence Id
- MSI value: 14 (Eh)
--------RR:
IMMEDIATE ASSIGNMENT (RR)
L2 Pseudo Length: 0B
Skip Indicator: 00
RR management Protocol Discriminator: 06
Dedicated mode or TBF:
- TMA: No meaning
- down-link: No meaning
- T/D: 1 this message assigns a Temporary Block Flow (TBF)
Page Mode:
- PM: Normal paging
Packet Channel Description:
- Channel type: 01
- TN: 02
- TSC: 00
- ARFCN: 00 78
Request Reference:
- Est Cause: <- MS當時送出Channel Request時，包含此理由。
One phase packet access with request for single timeslot uplink transmission;one PDCH is needed
- Random Reference: 0 (0x0) <- MS當時送出Channel Request時，包含此隨機碼。
- T1': 11 (0xb)
- T2: 22 (0x16)
- T3: 26 (0x1a)
- Frame number : 14816
Timing advance value: 00
Mobile Allocation Length: 00
MA C: empty
IA Rest Octets:
- Packet Uplink Assignment:
- TFI Assignment: 14
- Polling: no action is required from MS
- USF: 06
- USF Granularity: 00
- Channel Coding Command: coding scheme 1, CS-1
- TLLI Block Channel Coding:
mobile station shall use CS-1 in GPRS TBF mode or MCS-1 in EGPRS TBF mode
- Gamma: GammaCH = 0 dB
- Timing Advance Index: 06
[EOM]

[Example 3]
Conn:2 Line:1 TS:30 Subch:0 6845 10:50:01.9568925
--------E1:
VALID FRAME
02 03 6C C0 20 60 01 90 2B 17 2D 06 3F 10 0A 00 78 7A 42 C5 00 00 CC 46 00 26 2B 2B 2B 2B 2B 2B 2B FC 00 0C
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 1 P/F: 0
N(R): 60H N(S): 36H
20 60 01 90 2B 17 2D 06 3F 10 0A 00 78 7A 42 C5 00 00 CC 46 00 26 2B 2B
2B 2B 2B 2B 2B FC 00 0C
--------BTSM: <--這個BTSM在GPRS似乎總是和RR:IMMEDIATE ASSIGNMENT一起出現。
P-IMM ASSIGN CCCH COMMAND (GPRS) T=0
Channel Nr
- downlink CCCH (PCH + AGCH)
- timeslot : 0
Full Imm. Ass. Info
- value (hex) : 2D 06 3F 10 0A 00 78
7A 42 C5 00 00 CC 46 00 26 2B 2B 2B
2B 2B 2B 2B
Message Sequence Id
- MSI value: 12 (Ch)
--------RR:
IMMEDIATE ASSIGNMENT (RR)
L2 Pseudo Length: 0B
Skip Indicator: 00
RR management Protocol Discriminator: 06
Dedicated mode or TBF:
- TMA: No meaning
- down-link: No meaning
- T/D: 1 this message assigns a Temporary Block Flow (TBF)
Page Mode:
- PM: Normal paging
Packet Channel Description:
- Channel type: 01
- TN: 02
- TSC: 00
- ARFCN: 00 78
Request Reference:
- Est Cause: <- MS當時送出Channel Request時，包含此理由。
One phase packet access with request for single timeslot uplink transmission;one PDCH is needed
- Random Reference: 2 (0x2) <- MS當時送出Channel Request時，包含此隨機碼。
- T1': 8 (0x8)
- T2: 5 (0x5)
- T3: 22 (0x16)
- Frame number : 11497
Timing advance value: 00
Mobile Allocation Length: 00
MA C: empty
IA Rest Octets:
- Packet Uplink Assignment:
- TFI Assignment: 11
- Polling: no action is required from MS
- USF: 03
- USF Granularity: 00
- Channel Coding Command: coding scheme 1, CS-1
- TLLI Block Channel Coding:
mobile station shall use CS-1 in GPRS TBF mode or MCS-1 in EGPRS TBF mode
- Gamma: GammaCH = 0 dB
- Timing Advance Index: 03
[EOM]

070621r2版本

LAPD message group

位置：Abis-interface [BTS-BSC]的Layer 2

[前言]
LAPD是Link Access Protocol on D channel的縮寫，定義在CCITT (ITU-T)的Q.921.原本使用於N-ISDN，GSM時代使用於BSC與BTS之間的傳輸，在E1或T1的上層。

LAPD的訊息如下：
Disconnect(DISC)frame ______________--> CF
Disconnect mode(DM)frame ___________<-- RF
Frame reject(FRMR)frame ____________<-- RF
Information(I)frame ________________--> CF
Receiver not ready (RNR)frame ______<-> CF and RF
Receiver ready(RR)frame ____________<-> CF and RF
Reject(REJ)frame ___________________<-> CF and RF
SABME frame ________________________--> CF
Unnumbered acknowledgement(UA)frame <-- RF
Unnumbered information (UI) frame __--> CF
(共10個)
CF:Command-Frame
RF:Response-Frame

Ref:
[1] NetHawk GSM Analyser v7.9 HELP
[2] Gunnar Heine, GSM Networks: Protocols, Terminology, and Implementation, Artech House Publishers.1998.

070616r1版本

BTSM message group

位置：Abis-interface [BTS-BSC]

[前言]
BTSM是BTS Management的簡寫，顧名思義，此堆疊是用來管理BTS的各種資源，聽起來很像是UMTS中的NBAP。但是筆者實在找不出BTSM這個名稱的出處，因為規格書中不使用這個名稱，但BTSM用起來的確比"BTS and BSC Layer 3 management"這一長串名稱來得簡潔有力。

Type Mnemonic
01h DATA REQ
02h DATA IND
03h ERROR IND
04h EST. REQ
05h EST. CONF
06h EST. IND
07h REL REQ
08h REL CONF
09h REL IND
0Ah UNIT DATA REQ
0Bh UNIT DATA IND
11h BCCH INFO
12h CCCH LOAD IND
13h CHAN RQD
14h DELETE IND
15h PAGING CMD
16h IMM.ASS. CMD
17h SMS BROADCAST REQ
19h RF RESOURCE IND
1Ah SACCH FILLING
1Bh OVERLOAD
1Ch ERROR REPORT
1Dh SMS BROADCAST CMD
1Eh CBCH LOAD IND
1Fh NOTIFICATION CMD
21h CHAN ACT.
22h CHAN ACT. ACK
23h CHAN ACT. NACK
24h CONN. FAIL.
25h DEACT. SACCH
26h ENCR. CMD
27h HANDOVER DET.
28h MEAS. RES.
29h MODE MODIFY REQ
2Ah MODE MODIFY ACK
2Bh MODE MODIFY NACK
2Ch PHYS. CONTEXT REQ
2Dh PHYS. CONTEXT CONF
2Eh RF CHANNEL REL
2Fh MS POWER CONTROL
30h BS POWER CONTROL
31h PREP. CONFIG.
32h PREP. MEAS. RES.
33h RF CH. REL. ACK
34h SACCH INFO MODIFY
35h TALKER DET
36h LISTENER DET
37h REMOTE CODEC CONF REP
38h ROUND TD REPORT
39h PRE-HANDO NOTIF
3Ah MR CODEC MOD REQ
3Bh MR CODEC MOC ACK
3Ch MR CODEC MOD NACK
3Dh MR CODEC MOD PER
3Eh TFO REPORT
3Fh TFO MOD REQ
41h LOCATION INFO
(共57個)

附上message全名以供參照：(按字母順序排列)
BCCH INFORMATION
BS POWER CONTROL
CBCH LOAD INDICATION
CCCH LOAD INDICATION
CHANNEL ACTIVATION
CHANNEL ACTIVATION ACKNOWLEDGE
CHANNEL ACTIVATION NEGATIVE ACK
CHANNEL REQUIRED
CONNECTION FAILURE INDICATION
DATA REQUEST
DATA INDICATION
DEACTIVATE SACCH
DELETE INDICATION
ENCRYPTION COMMAND
ERROR INDICATION
ERROR REPORT
ESTABLISH CONFIRM
ESTABLISH INDICATION
ESTABLISH REQUEST
HANDOVER DETECTION
IMMEDIATE ASSIGNMENT COMMAND
IMMEDIATE ASSIGNMENT SENT
LISTENER DETECTION
LOCATION INFORMATION
MEASUREMENT RESULT
MODE MODIFY ACKNOWLEDGE
MODE MODIFY NEGATIVE ACK
MODE MODIFY REQUEST
MS POWER CONTROL
MULTIRATE CODEC MODIFICATION ACKNOLEWDGE
MULTIRATE CODEC MODIFICATION NEGATIVE ACKNOWLEDGE
MULTIRATE CODEC MODIFICATION PERFORMED
MULTIRATE CODEC MODIFICATION REQUEST
NOTIFICATION COMMAND
OVERLOAD
PAGING COMMAND
PHYSICAL CONTEXT CONFIRM
PHYSICAL CONTEXT REQUEST
P-IMMEDIATE ASSIGNMENT ACK
P-IMMEDIATE ASSIGNMENT NACK
P-POLLING COMMAND
P-QUEUING COMMAND
PRE-HANDOVER NOTIFICATION
PREPROCESS CONFIGURE
PREPROCESSED MEASUREMENT RESULT
RELEASE CONFIRM
RELEASE INDICATION
RELEASE REQUEST
REMOTE CODEC CONFIGURATION REPORT
RF CHANNEL RELEASE
RF CHANNEL RELEASE ACKNOWLEDGE
RF RESOURCE INDICATION
ROUND TRIP DELAY REPORT
SACCH FILLING
SACCH INFO MODIFY
SMS BROADCAST COMMAND
SMS BROADCAST REQUEST
TALKER DETECTION
TFO REPORT
TFO MODIFICATION REQUEST
UNIT DATA INDICATION
UNIT DATA REQUEST

Ref:
[1] NetHawk GSM Analyser v7.9 HELP
[2] ETSI TS 100 596(2000-11)Digital cellular telecommunications system (Phase 2+);Base Station Controller - Base Transceiver Station (BSC - BTS) interface;Layer 3 specification
(3GPP TS 08.58 version 8.6.0 Release 1999)

070617r2版本

RR message group

位置：
GSM Um-interface [MS-BTS];
GSM Abis-interface [BTS-BSC]

Messages for Radio Resources management:

Channel establishment messages: Reference
ADDITIONAL ASSIGNMENT
IMMEDIATE ASSIGNMENT
IMMEDIATE ASSIGNMENT EXTENDED
IMMEDIATE ASSIGNMENT REJECT
DTM ASSIGMENT FAILURE
DTM REJECT
DTM REQUEST
PACKET ASSIGNMENT
RR INITIALISATION REQUEST

Ciphering messages: Reference
CIPHERING MODE COMMAND
CIPHERING MODE COMPLETE

Handover messages: Reference
ASSIGNMENT COMMAND
ASSIGNMENT COMPLETE
ASSIGNMENT FAILURE
DTM ASSIGMENT COMMAND
INTER SYSTEM TO UTRAN HANDOVER COMMAND
PDCH ASSIGNMENT COMMAND
HANDOVER COMMAND
HANDOVER COMPLETE
HANDOVER FAILURE
RR-CELL CHANGE ORDER
PHYSICAL INFORMATION
INTER SYSTEM TO CDMA2000 HANDOVER COMMAND

Channel release messages: Reference
CHANNEL RELEASE
PARTIAL RELEASE
PARTIAL RELEASE COMPLETE

Paging messages: Reference
PACKET NOTIFICATION
PAGING REQUEST TYPE 1
PAGING REQUEST TYPE 2
PAGING REQUEST TYPE 3
PAGING RESPONSE

System information messages: Reference
SYSTEM INFORMATION TYPE 1
SYSTEM INFORMATION TYPE 2
SYSTEM INFORMATION TYPE 2bis
SYSTEM INFORMATION TYPE 2ter
SYSTEM INFORMATION TYPE 2quater
SYSTEM INFORMATION TYPE 3
SYSTEM INFORMATION TYPE 4
SYSTEM INFORMATION TYPE 5
SYSTEM INFORMATION TYPE 5bis
SYSTEM INFORMATION TYPE 5ter
SYSTEM INFORMATION TYPE 6
SYSTEM INFORMATION TYPE 7
SYSTEM INFORMATION TYPE 8
SYSTEM INFORMATION TYPE 9
SYSTEM INFORMATION TYPE 10
SYSTEM INFORMATION TYPE 13
SYSTEM INFORMATION TYPE 14
SYSTEM INFORMATION TYPE 15
SYSTEM INFORMATION TYPE 16
SYSTEM INFORMATION TYPE 17 9.1.43e
SYSTEM INFORMATION TYPE 18 9.1.43g
SYSTEM INFORMATION TYPE 19 9.1.43f
SYSTEM INFORMATION TYPE 20 9.1.43h

Specific messages for VBS/VGCS: Reference
NOTIFICATION/FACCH
NOTIFICATION/NCH
NOTIFICATION RESPONSE
TALKER INDICATION
UPLINK ACCESS
UPLINK BUSY
UPLINK FREE
UPLINK RELEASE
VGCS UPLINK GRANT

Measurement specific messages: Reference
EXTENDED MEASUREMENT ORDER
EXTENDED MEASUREMENT REPORT
MEASUREMENT REPORT
MEASUREMENT INFORMATION
ENHANCED MEASUREMENT REPORT

Miscellaneous messages: Reference
CHANNEL MODE MODIFY
CHANNEL MODE MODIFY ACKNOWLEDGE
CHANNEL REQUEST
CLASSMARK CHANGE
CLASSMARK ENQUIRY
UTRAN CLASSMARK CHANGE
cdma2000 CLASSMARK CHANGE
FREQUENCY REDEFINITION
MEASUREMENT REPORT
SYNCHRONIZATION CHANNEL INFORMATION
RR STATUS
GPRS SUSPENSION REQUEST

Configuration Change messages: Reference
CONFIGURATION CHANGE COMMAND
CONFIGURATION CHANGE ACKNOWLEDGE
CONFIGURATION CHANGE REJECT

Application messages: Reference
APPLICATION INFORMATION

Ref:
[-] (2003-12)3GPP TS 44.018 v4.15.1 Release 4

070616r2版本

Call-Flows and Procedures in GSM

[-] MS Power-off procedure (GSM手機關機程序)


070614r1版本

BSSMAP message: Clear Request

Source: GSM A [BSC --> MSC]
Tool: NetHawk GSM Analyser v7.9

Conn:1 Line:1 TS:16 Subch:0 297 16:15:05.353000
--------E1:
VALID FRAME
C7 A9 12 83 10 54 04 65 06 EC 40 4C 00 01 06 00 04 22 04 01 01
--------MTP2:
MSU
- BSN: 71 (47h) BIB: 1 FSN: 41 (29h) FIB: 1
- SCCP
- network indicator : national network
- data, length : 17, (11h)
--------SCCP:
DT1 - DATA FORM 1
SCCP DPC: 5136 (1410h)
SCCP OPC: 5137 (1411h)
SCCP SLS: 6 (06h)
Destination Local Reference
- EC404Ch
Segmenting/Reassembling
- no more data
SCCP User Data
- length 6 (06h)
--------BSSMAP:
CLEAR REQUEST
Cause
- length : 1 (01h)
- radio interface failure
[EOM]

BSSMAP:With this message the BSC indicates that MSC should clear the dedicated resources associated with this transaction. (Copyright 2003, NetHawk Oyj)

070613r1版本

BTSM message: Deactivate SACCH

Source: GSM Abis [BTS <-- BSC]
Tool: NetHawk GSM Analyser v7.9

Conn:4 Line:2 TS:27 Subch:0 133 16:15:03.066000
--------E1:
VALID FRAME: 02 0B F4 48 08 25 01 0E
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 5 (5h) C/R: 1 P/F: 0
N(R): 24H N(S): 7AH: 08 25 01 0E
--------BTSM:
DEACT. SACCH (DCh) T=0
Channel Nr
- full rate TCH
- timeslot : 6
[EOM]

BTSM: This message is sent to the BTS to request the deactivation of the downlink SACCH transmission of a dedicated channel. (Copyright 2003, NetHawk Oyj)

070613r1版本

SCCP message: Release Complete

Source: GSM A [BSC --> MSC]
Tool: NetHawk GSM Analyser v7.9

Conn:1 Line:1 TS:16 Subch:0 132 16:15:03.060000
--------E1:
VALID FRAME: AB 90 0C 83 10 54 04 65 05 9C 40 4C B6 40 58
--------MTP2:
MSU
- BSN: 43 (2Bh) BIB: 1 FSN: 16 (10h) FIB: 1
- SCCP
- network indicator : national network
- data, length : 11, (0Bh)
--------SCCP:
RLC - RELEASE COMPLETE
SCCP DPC: 5136 (1410h)
SCCP OPC: 5137 (1411h)
SCCP SLS: 6 (06h)
Destination Local Reference
- 9C404Ch
Source Local Reference
- B64058h
[EOM]

070613r1版本

SCCP message: Released

Source: GSM A [BSC <-- MSC]
Tool: NetHawk GSM Analyser v7.9

Conn:1 Line:1 TS:16 Subch:0 129 16:15:03.052000
--------E1:
VALID FRAME: 8E AB 0E 83 11 14 04 C5 04 B6 40 58 9C 40 4C 03 00
--------MTP2:
MSU
- BSN: 14 (0Eh) BIB: 1 FSN: 43 (2Bh) FIB: 1
- SCCP
- network indicator : national network
- data, length : 13, (0Dh)
--------SCCP:
RLSD - RELEASED
SCCP DPC: 5137 (1411h)
SCCP OPC: 5136 (1410h)
SCCP SLS: 12 (0Ch)
Destination Local Reference
- B64058h
Source Local Reference
- 9C404Ch
Release Cause
- SCCP user originated
[EOM]

070613r1版本

RR message: Channel Release

Source: GSM Abis [BTS <-- BSC]
Tool: NetHawk GSM Analyser v7.9

[sample 1]
Conn:4 Line:2 TS:27 Subch:0 130 16:15:03.060000
--------E1:
VALID FRAME: 02 0B F2 48 03 01 01 0E 02 00 0B 00 03 06 0D 00
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 5 (5h) C/R: 1 P/F: 0
N(R): 24H N(S): 79H: 03 01 01 0E 02 00 0B 00 03 06 0D 00
--------BTSM:
DATA REQ (RLL) T=1
Channel Nr
- full rate TCH
- timeslot : 6
Link Id
- main DCCH (FACCH or SDCCH)
- SAPI : 0
- Normal priority
L3 Info
- Length indicator: 3 (0003h)
- Link layer serv. data unit: 06 0D 00
--------RR:
CHANNEL RELEASE (RR)
Skip Indicator: 00
RR management Protocol Discriminator: 06
RR Cause value: Normal event
[EOM]

[Sample 2]
Conn:3 Line:2 TS:25 Subch:0 2302 16:15:26.901000
--------E1:
VALID FRAME: 02 03 D4 2E 03 01 01 30 02 00 0B 00 03 06 0D 00
--------LAPD:
INFO
SAPI: 0 (0h) TEI: 1 (1h) C/R: 1 P/F: 0
N(R): 17H N(S): 6AH: 03 01 01 30 02 00 0B 00 03 06 0D 00
--------BTSM:
DATA REQ (RLL) T=1
Channel Nr
- SDCCH/4 subchannel 2
- timeslot : 0
Link Id
- main DCCH (FACCH or SDCCH)
- SAPI : 0
- Normal priority
L3 Info
- Length indicator: 3 (0003h)
- Link layer serv. data unit: 06 0D 00
--------RR:
CHANNEL RELEASE (RR)
Skip Indicator: 00
RR management Protocol Discriminator: 06
RR Cause value: Normal event
[EOM]

070613r1版本

BSSMAP message: Clear Complete

Source: GSM A [BSC --> MSC]
Tool: NetHawk GSM Analyser v7.9

Conn:1 Line:1 TS:16 Subch:0 128 16:15:03.052000
--------E1:
VALID FRAME: AA 8E 0F 83 10 54 04 65 06 9C 40 4C 00 01 03 00 01 21
--------MTP2:
MSU
- BSN: 42 (2Ah) BIB: 1 FSN: 14 (0Eh) FIB: 1
- SCCP
- network indicator : national network
- data, length : 14, (0Eh)
--------SCCP:
DT1 - DATA FORM 1
SCCP DPC: 5136 (1410h)
SCCP OPC: 5137 (1411h)
SCCP SLS: 6 (06h)
Destination Local Reference
- 9C404Ch
Segmenting/Reassembling
- no more data
SCCP User Data
- length 3 (03h)
--------BSSMAP:
CLEAR COMPLETE
[EOM]

070613r1版本

BSSMAP message: Clear Command

Source: GSM A [BSC <-- MSC]
Tool: NetHawk GSM Analyser v7.9

Conn:1 Line:1 TS:16 Subch:0 127 16:15:03.038000
--------E1:
VALID FRAME
8C AA 16 83 11 14 04 C5 06 B6 40 58 00 01 0A 00 08 20 07 02 06 00 04 01 09
--------MTP2:
MSU
- BSN: 12 (0Ch) BIB: 1 FSN: 42 (2Ah) FIB: 1
- SCCP
- network indicator : national network
- data, length : 21, (15h)
--------SCCP:
DT1 - DATA FORM 1
SCCP DPC: 5137 (1411h)
SCCP OPC: 5136 (1410h)
SCCP SLS: 12 (0Ch)
Destination Local Reference
- B64058h
Segmenting/Reassembling
- no more data
SCCP User Data
- length 10 (0Ah)
--------BSSMAP:
CLEAR COMMAND
L3 Header Information
- length : 2 (02h)
- protocol discr. : Radio Resources
- transaction id. : 0 (0h)
- message send from originating side
Cause
- length : 1 (01h)
- call control
[EOM]

070613r1版本

BSSMAP message group

原始位置：GSM A-interface [BSC-MSC]
延伸應用：GSM E-interface [MSC-MSC]

[前言]
BSSMAP顧名思義是與BSS(BTS + BSC)相關的通信堆疊，所以出現在A-interface(BSS-MSC之間)是理所當然的，但是後來被使用在E-interface(MSC-MSC之間)，作為Inter-MSC Handover的程序應用，這點很容易讓工程師感到困惑，請讀者注意。

All the BSSMAP messages are listed in the following table.

ASSIGNMENT REQUEST
ASSIGNMENT COMPLETE
ASSIGNMENT FAILURE
CHANNEL MODIFY REQUEST
BLOCK
BLOCKING ACKNOWLEDGE
CIRCUIT GROUP BLOCK
CIRCUIT GROUP BLOCKING ACKNOWLEDGE
CIRCUIT GROUP UNBLOCK
CIRCUIT GROUP UNBLOCKING ACKNOWLEDGE
CLEAR COMMAND
CLEAR COMPLETE
CLEAR REQUEST
UNBLOCK
UNBLOCKING ACK
HANDOVER CANDIDATE ENQUIRE
HANDOVER CANDIDATE RESPONSE
HANDOVER REQUEST
HANDOVER REQUIRED
HANDOVER REQUIRED REJECT
HANDOVER REQUEST ACKNOWLEDGE
HANDOVER COMMAND
HANDOVER COMPLETE
HANDOVER SUCCEEDED
HANDOVER FAILURE
HANDOVER PERFORMED
HANDOVER DETECT
RESOURCE REQUEST
RESET
RESET ACK
RESOURCE INDICATION
PAGING
OVERLOAD
MSC INVOKE TRACE
BSS INVOKE TRACE
CLASSMARK UPDATE
CLASSMARK REQUEST
CIPHER MODE COMMAND
CIPHER MODE COMPLETE
CIPHER MODE REJECT
COMPLETE LAYER 3 INFORMATION
QUEUING INDICATION
SAPI "N" REJECT
RESET CIRCUIT
RESET CIRCUIT ACKNOWLEDGE
CONFUSION
UNEQUIPPED CIRCUIT
LOAD INDICATION
VGCS/VBS SETUP
VGCS/VBS SETUP ACK
VGCS/VBS SETUP REFUSE
VGCS/VBS ASSIGNMENT REQUEST
VGCS/VBS ASSIGNMENT RESULT
VGCS/VBS ASSIGNMENT FAILURE
VGCS/VBS QUEUING INDICATION
UPLINK REQUEST
UPLINK REQUEST ACKNOWLEDGE
UPLINK REQUEST CONFIRMATION
UPLINK RELEASE INDICATION
UPLINK REJECT COMMAND
UPLINK RELEASE COMMAND
UPLINK SEIZED COMMAND
SUSPEND
RESUME
CHANGE CIRCUIT
CHANGE CIRCUIT ACKNOWLEDGE
COMMON ID
LSA INFORMATION
CONNECTION ORIENTED INFORMATION
PERFORM LOCATION REQUEST
PERFORM LOCATION RESPONSE
PERFORM LOCATION ABORT
CONNECTIONLESS INFORMATION
(共73個，參考[1])

其中使用於E-interface的部分BSSMAP messages如下：

ASSIGNMENT REQUEST (MSC-A -> MSC-I)
Excluded information element: CIRCUIT IDENTITY CODE
ASSIGNMENT COMPLETE (MSC-I -> MSC-A)
Excluded information element: CIRCUIT POOL, CIRCUIT IDENTITY CODE
ASSIGNMENT FAILURE (MSC-I -> MSC-A)
Excluded information elements: CIRCUIT POOL, CIRCUIT POOL LIST
* HANDOVER REQUEST (MSC-A -> MSC-T and MSC-I -> MSC-A)
Excluded information element: CIRCUIT IDENTITY CODE
* HANDOVER REQUEST ACKNOWLEDGE (MSC-T -> MSC-A and MSC-A -> MSC-I)
Excluded information element: CIRCUIT POOL, CIRCUIT IDENTITY CODE
* HANDOVER COMPLETE (MSC-T -> MSC-A)
* HANDOVER FAILURE (MSC-T -> MSC-A and MSC-I -> MSC-A)
Excluded information elements: CIRCUIT POOL, CIRCUIT POOL LIST
HANDOVER PERFORMED (MSC-I -> MSC-A)
* HANDOVER DETECT (MSC-T -> MSC-A)
CLEAR REQUEST (MSC-I -> MSC-A)
SAPI "n" REJECT (MSC-I -> MSC-A)
CONFUSION (MSC-T -> MSC-A, MSC-A -> MSC-T,
MSC-I -> MSC-A and MSC-A -> MSC-I)
# MSC INVOKE TRACE (MSC-A -> MSC-I)
# BSS INVOKE TRACE (MSC-I -> MSC-A and MSC-A -> MSC-T)
CIPHER MODE COMMAND (MSC-A -> MSC-I)
CIPHER MODE COMPLETE (MSC-I -> MSC-A)
CIPHER MODE REJECT (MSC-I -> MSC-A)
** QUEUING INDICATION (MSC-T -> MSC-A, MSC-I -> MSC-A,
and MSC-A -> MSC-I)
CLASSMARK UPDATE (MSC-I -> MSC-A and MSC-A -> MSC-T)
CLASSMARK REQUEST (MSC-A -> MSC-I)
(參考[2])

Ref:
[1] ETSI TS 148 008 V6.11.0 (2005-09) Digital cellular telecommunications system (Phase 2+);Mobile Switching Centre - Base Station system (MSC-BSS) interface; Layer 3 specification(3GPP TS 48.008 version 6.11.0 Release 6)

[2] Digital cellular telecommunications system; Application of the Base Station SystemApplication Part (BSSAP) on the E-interface(GSM 09.08)

070613r1版本