The first SDAP PDU of the capture, and the whole layer in one byte. The bearer this rides on did not exist until a moment ago. Frame 38's RRC Reconfiguration added drb-Identity: 1 with an sdap-Config reading pdu-Session: 1, sdap-HeaderUL: present (0), sdap-HeaderDL: absent (1), defaultDRB: True, and a mappedQoS-FlowsToAdd: 1 item holding QFI: 2. Everything on this diagram is that configuration being obeyed.

Unwrap this transmission from the bottom and the SDAP header falls out of the bytes. MAC-NR carries a 55-byte SDU on LCID: 4. RLC-NR reads it as DRB 1, AM, uplink, SN=0, poll set, 52 bytes of data beginning 800000827dbd4542. Split that: 80 00 00 is the three-byte PDCP header for an 18-bit sequence number (PDU Type: Data PDU, Seq Num: 0), and the very next byte, 82, is the entire SDAP header — 1000 0010, which Wireshark expands as PDU Type: Data PDU, Reserved: 0x0, QFI: 2.

Note where the ciphertext starts. This bearer runs NEA2 (AES), yet the 82 sits in the clear and Wireshark's Deciphered Data for the same PDU begins 6000000000083aff — an IP header, not the SDAP byte. TS 38.323 §5.8 excludes the SDAP header from ciphering precisely so a receiver can classify a packet before it decrypts it. Everything above the SDAP header on this diagram is Decrypting a 5G NR radio capture's subject; SDAP stops at the QFI.

Message Details