For 25 years one box did everything. Now four open software components — running on different hardware, sometimes from different vendors — speak F1, E1, and Open Fronthaul to deliver the same radio service. Here is every functional split, every interface, every reason the industry did this.
In 4G LTE (3GPP Release 8 onward, 2008–present), the entire radio access network is delivered as a single physical unit called the eNodeB. It contains the radio frequency (RF) chain, the entire physical layer (PHY), every Layer-2 protocol (MAC, RLC, PDCP), the radio resource control (RRC) entity, and the connection to the core network — all wrapped in one vendor's hardware and one vendor's software. You buy eNBs from Ericsson, Nokia, Huawei, ZTE, Samsung, or NEC. You do not mix.
3GPP Release 14 (2017) introduced CUPS — Control and User Plane Separation for the EPC. The Serving Gateway became S-GW-C + S-GW-U; the PDN Gateway became P-GW-C + P-GW-U. A new control protocol called PFCP (on the Sxa/Sxb interfaces) let one S-GW-C steer many S-GW-Us. This was the proof-of-concept the industry used to justify full RAN disaggregation in 5G: scale control and data planes independently, on different hardware, ideally from different vendors.
3GPP Release 15 (2018) shipped the full split. The 5G base station — the gNB — is logically not one node. It is up to four: CU-CP, CU-UP, DU, RU. Each one terminates a specific subset of the protocol stack, sits on its own hardware, and speaks well-defined 3GPP (and O-RAN) interfaces to its neighbors. Specs: TS 38.401 defines the overall architecture and the F1 + E1 interfaces; TS 38.473 is F1AP; TS 38.463 is E1AP; TS 38.425 is the F1-U user-plane container; O-RAN WG4 defines the Open Fronthaul 7.2x split that goes RU↔DU.
TR 38.801 documented eight functional split candidates — each labeled Option 1 through Option 8 — describing where to draw the line between the central unit and the distributed unit. The trade-off is the eternal one in telecoms: centralization gain (cheaper, smarter, more poolable) vs fronthaul cost (the lower in the stack you split, the more bandwidth and the tighter the latency the link between them needs). The industry converged on Option 2 for the F1 interface (CU↔DU) and Option 7-2x for the Open Fronthaul (DU↔RU). The legacy Option 8 split is what CPRI did and what 5G is trying to escape from.
| Dimension | LTE (4G) | 5G NR (disaggregated) |
|---|---|---|
| Base station unit | eNB (single physical box) | gNB = CU-CP + CU-UP + DU + RU (4 logical functions) |
| Vendor model | Vertical lock-in (one vendor end-to-end) | Open multi-vendor (different vendors per unit) |
| Layer-3 (RRC) | In eNB | In CU-CP |
| PDCP (cipher / integrity) | In eNB (single instance for CP+UP) | Split: PDCP-C in CU-CP · PDCP-U in CU-UP |
| SDAP (QoS-flow→DRB) | Doesn't exist (LTE has no QFI) | In CU-UP — new for 5G |
| RLC / MAC | In eNB | In DU |
| PHY-high (coding, modulation) | In eNB | In DU |
| PHY-low + RF | In eNB (or RRH over CPRI) | In RU (Open Fronthaul 7.2x) |
| Control to core | S1-MME (S1AP / SCTP) — single interface | NG-C / N2 (NGAP / SCTP) from CU-CP only |
| User-plane to core | S1-U (GTP-U / UDP) | NG-U / N3 (GTP-U / UDP) from CU-UP only |
| Inter-site link | X2 (X2AP) for HO + dual connectivity | Xn (XnAP) — protocol-equivalent, different stack |
| Core network | EPC — MME / S-GW / P-GW / HSS / PCRF | 5GC — AMF / SMF / UPF / AUSF / UDM / PCF / NRF / ... (SBA) |
| Core-network interface | Diameter (S6a) + GTP-C (S5/S11) | HTTP/2 + JSON (SBI / SBA) — modern microservices |
| Control-plane split (CUPS) | Added in Rel-14 for S-GW + P-GW only | Built-in everywhere · SMF programs UPF via PFCP (N4) |
| Open RAN extensions | None (closed by design) | SMO · Non-RT RIC (A1) · Near-RT RIC (E2 + xApps) |
| Fronthaul transport | CPRI (Option 8) · proprietary | eCPRI · Open FH 7.2x · IP/Ethernet · 25–100 GbE |
| Backhaul transport | IP/Ethernet (microwave or fiber) | IP/Ethernet — same, but stricter QoS / sync |
| Time-sync requirement | ≤±1.5 µs (PTP G.8275.1) | ≤±130 ns (TDD) · ≤±60 ns (URLLC) · LLS-C profiles |
| Deployment model | Physical box per cell site | Cloud-native (vRAN) · CU on common server · DU near antenna · RU at antenna |
| AI/ML integration point | None defined | RIC xApps (Near-RT) + rApps (Non-RT) via E2 + A1 |
Disaggregation invented new wire formats — most live in 3GPP TS 38.4xx or O-RAN WG4. Here's exactly what's on each cable.
| Interface | Between | L7 / Encap | L4 | Spec | Why it exists |
|---|---|---|---|---|---|
| F1-C | DU ↔ CU-CP | F1AP | SCTP / IP | TS 38.473 | Carries DU↔CU control: F1 Setup, UE Context, RRC msg transfer, paging |
| F1-U | DU ↔ CU-UP | NR-U inside GTP-U | UDP / IP | TS 38.425 | Carries PDCP PDUs DU↔CU with flow-control feedback |
| E1 | CU-CP ↔ CU-UP | E1AP | SCTP / IP | TS 38.463 | CU-CP tells CU-UP which bearers to set up, hands over PDCP keys + F1-U TEIDs |
| Open FH 7.2x | RU ↔ DU | eCPRI (CUS-plane + M-plane) | Ethernet / IP | O-RAN WG4 CUS / M | Carries IQ samples + beamforming weights + sync + management |
| NG-C / N2 | CU-CP ↔ AMF | NGAP | SCTP / IP | TS 38.413 | RAN ↔ Core control (NG Setup, Initial UE Msg, PDU Session Resource Setup, Handover) |
| NG-U / N3 | CU-UP ↔ UPF | GTP-U with QFI ext header | UDP / IP | TS 29.281 | RAN ↔ Core user-plane data with QoS-Flow marking |
| E2 | Near-RT RIC ↔ DU/CU | E2AP + Service Models (KPM, RC, NI, CCC) | SCTP | O-RAN WG3 | Near-RT RIC consumes KPIs, sends RAN control commands at 10 ms–1 s timescale |
| A1 | Non-RT RIC ↔ Near-RT RIC | REST + JSON | HTTPS / TCP | O-RAN WG2 A1 | Pushes policies + ML models from SMO down to Near-RT RIC for xApps |
| O1 | SMO ↔ every NE | NETCONF + YANG | SSH / TCP | O-RAN WG1 O1 | FCAPS — fault, config, performance, security mgmt of every CU/DU/RU/NF |
| O2 | SMO ↔ O-Cloud | O-Cloud Mgmt API | HTTPS | O-RAN WG6 O2 | Manages the underlying cloud (Kubernetes, OpenStack) that hosts vRAN workloads |
RU from Mavenir, DU from Wind River, CU from Samsung, RIC from Juniper. Open interfaces mean operators can mix and match instead of buying one vendor end-to-end. Rakuten Mobile built an entire greenfield network this way.
DU and CU run as containers on COTS x86 (Intel FlexRAN) or Ampere ARM servers. Independent scaling: ten DUs sharing one CU; one CU pool covering hundreds of cells.
Near-RT RIC hosts xApps over E2 — closed-loop control of scheduling, beamforming, anti-jamming, ML-based handover, energy saving. Non-RT RIC hosts rApps for slower policy + ML training. This was impossible in LTE.
Heavy data traffic? Scale CU-UP and UPF horizontally without touching CU-CP. Signaling storms? Scale CU-CP and AMF. Same gain CUPS gave the core, now in the RAN.
Different keys, different operators, different trust zones per slice. CU-UP can be hosted at the edge for a hyperscaler tenant; CU-CP can stay in the operator core. Zero-trust between every interface.
NSSAI flowing all the way to the DU scheduler. Different SLAs (eMBB, URLLC, mMTC) sharing one physical RAN with isolated logical instances per slice.
Drop these exact components onto a canvas and watch interfaces wire themselves. The Build Custom canvas in the simulator extras knows every 3GPP-defined pair from RU↔DU to AMF↔SEPP.