Advanced Trace
Analysis.
The capstone. We open one continuous packet capture of one phone — from the instant it powers on to the instant it powers off — and read the whole story, end to end. Nine modules, one trace. Every message you learned to build now appears on the wire, and you can name each one: the concealed SUCI, the 5G-AKA dance, the clear-to-ciphertext line, CreateSMContext, the PDR/QER/URR, the Path Switch, the sealed CDR. This lesson turns nine chapters into one book — and turns you into someone who can read any 5G capture like a story they already know.
Reading one session, from first contact to teardown
The player screen is a live animation stage with real diagrams — the three-act trace shape scans left to right, call-flows light up lane by lane, NAS turns from clear to ciphertext, and every message is colour-coded to the module that gave it meaning, exactly as the narration reaches it. Karaoke subtitles in English, two subtitle modes, fullscreen.
Every message in the trace
Each message the video reads — its interface, direction, purpose and clause, in trace order. Click any row to open its full IE breakdown. Filter to find any of them.
| Message | Interface | Dir | What it does | Clause |
|---|
One session, from first contact to teardown
Everything the video reads on the wire, as a reference you can scan: the full message sequence in its three acts, what each message carries, which module gave it meaning, and the six habits of reading a real capture. Message names cited to TS 24.501, 23.502, 29.502, 29.244, 33.501.
1 · Registration
- RRC → NAS Registration Request (SUCI, Requested NSSAI).
- AMF / slice selection (NSSF, UDM).
- Authentication — 5G-AKA (AUSF, UDM).
- NAS Security Mode Command → ciphering on.
- Registration Accept (5G-GUTI, Allowed NSSAI).
2 · Session
- PDU Session Establishment Request (SM NAS → SMF).
- NRF discovery → CreateSMContext.
- Policy (PCF) → QoS flows → charging (CHF).
- N4/PFCP → PDR, QER, URR in the UPF.
- N1N2MessageTransfer → user plane up. Mobility mid-session.
3 · Teardown
- PDU Session Release → PFCP Session Deletion.
- Final Charging Data Request → CDR sealed.
- Session gone, phone still registered.
- Deregistration Request → context discarded.
- The capture falls silent.
| # | Message | Where | Module | What it means |
|---|---|---|---|---|
| 1 | RRC Setup | UE ↔ gNB | M1/M2 | the radio door opens; NAS will ride above it |
| 2 | Registration Request | UE → AMF | M2 | SUCI (M1/M6) + Requested NSSAI (M8) |
| 3 | Nnssf_NSSelection / Nudm_SDM | AMF ⇄ NSSF/UDM | M8 | pick the slice and the serving AMF |
| 4 | Nausf_UEAuthentication | AMF → AUSF | M6/M7 | authentication begins, over HTTP/2 |
| 5 | Nudm_UEAuthentication_Get | AUSF → UDM | M6 | SIDF de-conceals SUCI → SUPI; vector made |
| 6 | Authentication Request/Response | AMF ↔ UE | M6 | RAND/AUTN down, RES* up; XRES* matches |
| 7 | NAS Security Mode Command/Complete | AMF ↔ UE | M6 | ciphering on — NAS goes dark after this |
| 8 | Registration Accept/Complete | AMF ↔ UE | M2 | 5G-GUTI (M1) + Allowed NSSAI (M8) |
| 9 | PDU Session Establishment Request | UE → (AMF) → SMF | M3 | SM NAS in a container; DNN + S-NSSAI |
| 10 | NRF discovery → CreateSMContext | AMF ⇄ NRF → SMF | M7 | find an SMF; POST sm-contexts → 201 |
| 11 | Npcf_SMPolicyControl_Create | SMF → PCF | M5 | PCC rules → QoS flows (M4) |
| 12 | Nchf_ConvergedCharging [Initial] | SMF → CHF | M5 | the CDR opens; first quota granted |
| 13 | PFCP Session Establishment | SMF → UPF | M3/M4 | PDR + QER + URR installed |
| 14 | N1N2MessageTransfer | SMF → AMF → UE/gNB | M3 | N1 Accept + N2 → user plane up, end to end |
| 15 | (user-plane data flows) | UE ↔ UPF ↔ DN | M4/5/6/8 | QoS-shaped, metered, ciphered, sliced |
| 16 | Xn/N2 Handover + Path Switch | gNB · AMF · UPF | M2/M6 | context + KgNB move; session holds |
| 17 | PDU Session Release / PFCP Deletion | UE · SMF · UPF | M3 | rules removed; usage reported |
| 18 | Nchf [Termination] | SMF → CHF | M5 | the CDR is sealed — the bill |
| 19 | Deregistration Request | UE → AMF | M2 | power off; security context discarded |
The insight: registration and sessions are separate lives — the phone can sit registered and idle with no session, and open or close many sessions during one registration. The control plane is busy in bursts; in between, the user plane does the real work.
Structure
- 1 · Boundaries — cut the trace into its three acts first.
- 2 · One identity — filter by one SUPI / GUTI / session ID.
- 3 · Read the names — SBI operation names are sentences.
Diagnosis
- 4 · Read the errors — ProblemDetails + NAS cause codes.
- 5 · Correlate the planes — control set up a path; does data follow?
- 6 · Which module? — the index that ties it all together.
Filter by message, interface or module — REGISTRATION · SESSION · TEARDOWN · USER-PLANE.
| Message / element | Act | Interface | Module | Meaning |
|---|
The one sentence for the whole course: a 5G network is a set of functions, exchanging named messages over defined interfaces, to give a subscriber a secure, policed, measured, and mobile connection — and every one of those messages is one you can now read.
5G Core Course · Module 10 · the capstoneTrace-reading mastery check
Questions and answers reshuffle every load. 70%+ to consider the capstone — and the course — complete.