The richest message in the capture. One RRCReconfiguration, rrc-TransactionIdentifier: 0, 235 bytes on the wire, and it configures four layers at once plus carries a NAS payload. Read it in four parts.

1. The bearers it adds. radioBearerConfig holds srb-ToAddModList with srb-Identity: 2 — a second signaling bearer, with no pdcp-Config, so defaults again — and drb-ToAddModList with drb-Identity: 1, the capture's only data bearer.

2. What DRB 1 gets. Its cnAssociation is an sdap-Config: pdu-Session: 1, sdap-HeaderDL: absent (1), sdap-HeaderUL: present (0), defaultDRB: True, and a one-item mappedQoS-FlowsToAdd naming QFI: 2. Those two header switches are the whole reason every SDAP PDU in this capture is an uplink one. Its pdcp-Config sets discardTimer: infinity, pdcp-SN-SizeUL: len18bits, pdcp-SN-SizeDL: len18bits, headerCompression: notUsed, statusReportRequired: true, and — worth noticing — no integrityProtection, so user-plane data is ciphered but not integrity-protected.

3. The security restatement. securityConfig repeats cipheringAlgorithm: nea2 and integrityProtAlgorithm: nia2 and adds keyToUse: master. There is no masterKeyUpdate, so this is not a re-key — it is the new bearers being told which existing key set to inherit.

4. The 18-octet masterCellGroup. Compare that with frame 3's 209 octets: a cell-group configuration is a delta, not a replacement. mac-CellGroupConfig, physicalCellGroupConfig and spCellConfig are all absent, so everything frame 3 set stays exactly as it was. What this one adds is a two-item rlc-BearerToAddModList:

DRB 1 on logicalChannelIdentity: 4, priority: 1, logicalChannelGroup: 1, and a full rlc-Config.
SRB 2 on logicalChannelIdentity: 2, priority: 3, logicalChannelGroup: 0, and no rlc-Config — defaults again.

DRB 1's rlc-Config is the only RLC configuration anywhere in this capture: ul-AM-RLC with sn-FieldLength: size18, t-PollRetransmit: ms80, pollPDU: p32768, pollByte: kB750, maxRetxThreshold: t8; dl-AM-RLC with sn-FieldLength: size18, t-Reassembly: ms80, t-StatusProhibit: ms30.

And finally, dedicatedNAS-MessageList with one item of 122 octets — security header type 2, message authentication code 0x9b072356, NAS sequence number 3, then Encrypted data. A frame in which the RRC decodes completely and the NAS payload inside it does not: the two-security-layer story in a single packet.

Also worth noting for what is not here: no measConfig, no secondaryCellGroup. No measurement reporting is ever configured in this trace, despite the UE advertising R16 logged-measurement support at frame 23.

Message Details