The reveal begins. Everything on this diagram lived inside ciphered PDCP on DRB 1 until the published UE keys deciphered it — the radio-stack walkthrough saw only UL SDAP -> QFI 2 here. With PDCP open, the SDAP payload turns out to be an ordinary IPv6 conversation, and it opens the way any TCP app does: a SYN from the UE (port 33939) to the P-CSCF on the SIP port 5060. (The UE reached its global address 3000:0:0:2::2 moments earlier via IPv6 Router Solicitation / Advertisement — the SLAAC prefix 3000:0:0:2:: — which this diagram omits to keep the two lanes clean.)

Message Details