A new radio connection, the same NAS context. 13.629329 s after frame 38. In between, the radio side released the connection at frame 128 and set up a fresh one at frames 131 and 132 — and then re-ran the Access-Stratum Security Mode procedure from scratch immediately after this message, at frames 136 and 137.

Read that ordering carefully, because it is the whole point in miniature. This frame is the RRC Setup Complete of the new connection, and the NAS Service Request rides inside it. So the Service Request goes out before the new Access-Stratum context exists — integrity protected by NAS keys that predate the radio connection carrying it. Nothing about the release touched NAS. This Service Request reads Security header type: Integrity protected (1), message authentication code 0xb98305d2, Sequence number: 4 — continuing straight on from frame 36's uplink 3 — and NAS key set identifier: 2, Type of security context flag (TSC): Native security context (for KSIAMF): still the context frames 7 to 14 established. The NAS security context survived an idle period that destroyed the radio one entirely. That is the two-layer split stated as plainly as a trace can state it.

The readable body:

Service type: Mobile terminated services (2). The network paged the UE; the UE is answering.
5GS mobile identity, length 7, Type of identity: 5G-S-TMSI (4): AMF Set ID: 1, AMF Pointer: 1, 5G-TMSI: 0xc2345678 — the same TMSI frame 4's 5G-GUTI carried.
NAS message container, element ID 0x71, Length: 17, Encrypted data.

Header type 1 and a sealed container: the same cleartext-IE rule as frame 4, on a different message. A Service Request is an initial NAS message too, so it is sent integrity protected but not ciphered, with only the IEs the AMF needs up front in the clear and the rest in the container. That is why this page can read its last message after six sealed ones — not because anything was decrypted, but because 3GPP requires the opening move of a NAS connection to be legible.

One NAS message of the capture is not on this timeline. Frame 150 is another Service Request, 33.279932 s after frame 133 and so past the session extractor's 30-second idle timer. It carries Sequence number: 5 under the same ngKSI 2 — the uplink NAS count still marching on, on the capture's third radio connection.

Message Details