5G-NR tutorials and call flows

Most of what follows begins with a packet capture. Each walkthrough opens a Wireshark trace, decodes it with VisualEther, and reads it frame by frame — so what you get is one concrete run of the procedure, timers and retransmissions and dead ends intact, rather than the idealized version. After those come the specification call flows, drawn from the 3GPP documents rather than from a trace. Point VisualEther at your own capture and Claude Code will explain why a registration or PDU-session attempt failed, down to the frame.

Call flows read from packet captures

A 5G NR Attach on the Air Interface, Layer by Layer

A frame-by-frame read of a real, NEA2-ciphered 5G NR radio capture (Wireshark work-item 19757), decrypted with the issue's public UE keys — from random access to two mobile-terminated returns. Also the hub for seven companion walkthroughs: one per protocol layer, plus the decryption that made the trace readable.

The Life of a 5G Connection, One Packet at a Time

The same procedures from the UE side — a Motorola Edge 30 Pro capture of RRC setup, AS security, registration, PDU-session data on the DRB and teardown. It also shows trouble on the wire: RLC-AM retransmissions on SRB1, and an RRC Release retransmitted eleven more times because the UE had already gone.

EN-DC SgNB Addition over X2: Grafting a 5G Bearer onto LTE

A frame-by-frame read of the X2AP SgNB Addition procedure (EN-DC, NSA Option 3), where an LTE master eNB asks a secondary 5G gNB to add an NR data radio bearer. The Request and the Acknowledge that mints the SgNB-UE-X2AP-ID, admits the E-RAB, and returns the RRC CG-Config.

Retrieve UE Context over Xn: RRC Resume, Message by Message

A frame-by-frame read of the Xn leg of RRC Connection Resume — how a target gNB uses the I-RNTI in an RRCResumeRequest to fetch a suspended UE's context from the anchor gNB, authenticated by shortResumeMAC-I and forward-secured by NCC-driven key derivation.

Inside F1AP: A UE Registration Across the 5G CU/DU Split

The F1-C control-plane counterpart to the F1-U walkthrough — a frame-by-frame read of F1AP (TS 38.473) in an OCUDU (srsRAN) capture. F1 Setup brings the interface up, then one UE's whole registration is relayed as RRC and NAS across the split: RRCSetup, authentication, NAS and AS security, the UE Context Setup and Modification that adds the DRB, a PWS broadcast, and the release and F1 Removal that tear it down.

Inside F1-U: NR-U Flow Control Between the gNB's CU and DU

A frame-by-frame read of the F1-U user plane in a real srsRAN capture — the NR-U (NRUP, TS 38.425) flow-control loop where the CU-UP streams DL User Data and the DU answers with DL Data Delivery Status, reporting its highest transmitted PDCP SN and desired buffer size. One voice DRB, followed turn by turn.

Reconstructing a VoNR Voice Call from a Bare srsRAN F1-U Capture

The companion to the F1-U post: strip the NEA0 PDCP header off each F1-U T-PDU and a complete IMS voice call appears underneath. A frame-by-frame VoNR walkthrough — SIP REGISTER and the IMS-AKA 401 challenge, the IPsec ESP associations that hide the INVITE, and 1,670 RTP frames of anchored wideband media.

Call flows from the specifications

Sequence diagrams of the standardized procedures as the 3GPP documents define them — the reference view of what is supposed to happen, with per-node role diagrams and message-level detail alongside each flow.

5G-NR Standalone Access Registration Flow

As 5G gains momentum, the networks will transition to an end-to-end 5G solution with UEs registering with the 5G Core Network. The 5G standalone access registration signaling flow is similar to the 4G attach and default bearer establishment flow. Includes the role each node plays — UE, gNB, AMF, AUSF, UDM, PCF, SMF and UPF — as its own diagram.

5G-NR Non Standalone Access Flow (EN-DC)

LTE support for 5G dual connectivity will enable 4G network operators to introduce 5G services with a minimal upgrade to support 5G data plane. This is achieved with the support for 4G eNB and 5G gNB dual connectivity (EN-DC). Includes the UE, 5G gNB, LTE eNB and 4G core network roles as separate diagrams.

Medium blog posts

5G NR: The New Radio interface for 5G

The 5G air interface that scales from cellular to the mm-wave bands.

5G physical layer specifications

The 5G specifications have been published as the 3GPP 38 series. Here we look at the physical layer specifications.

Massive MIMO

MIMO with large phased array antenna array at the base station

LDPC — low density parity check code

5G AN uses LDPC for channel coding on the traffic channel. LDPC corrects channel errors by maintaining parity bits for a selection of the data bits.

Cloud RAN and eCPRI fronthaul in 5G networks

5G networks will move towards centralizing the radio function using an eCPRI based fronthaul.

Mobility with mm-waves

5G specifications are extending the reach of mobile communication by supporting frequency bands up to 100 GHz.

5G non-standalone access

Signaling flow for 5G access via LTE-5G NR dual connectivity (EN-DC).

5G Service-Based Architecture (SBA)

Learn now the 5G Core Network has been designed around services that are invoked using a standard API.

5G Standalone Access Registration

Signaling flow for 5G standalone access registration.

5G NR RLC Acknowledged Mode

Deep dive into the 5G Radio Link Control in Acknowledged Mode.