Radio logs analysis

 1️⃣ Voice Registration State

The first part of the log indicates the current voice registration status:

5765]< VOICE_REGISTRATION_STATE {.regState = REG_ROAMING, .rat = LTE, .reasonForDenial = NONE, .cellIdentity = {.lte = {.base = {.base = {.mcc = 404, .mnc = 86, .ci = 205418246, .pci = 378, .tac = 54140, .earfcn = 1582}, .operatorNames = {.alphaLong = Vi India, .alphaShort = Vi India}, .bandwidth = 15000}, .additionalPlmns = [], .optionalCsgInfo = {.noinit = {}}, .bands = [3]}}, .registeredPlmn = 40486, .accessTechnologySpecificInfo = {.noinit = {}}} [PHONE1]

Analysis:

regState = REG_ROAMING → The device is in roaming mode while registered on the LTE network.
rat = LTE → The Radio Access Technology (RAT) is LTE.
reasonForDenial = NONE → No denial reason, meaning there are no issues with network registration.

• Cell Identity Details:
• MCC = 404, MNC = 86 → The Mobile Country Code (404) and Mobile Network Code (86) correspond to Vi India (Vodafone Idea).
• ci (Cell ID) = 205418246 → Unique identifier for the LTE cell tower.
• pci (Physical Cell ID) = 378 → A unique identifier used for handover decisions.
• tac (Tracking Area Code) = 54140 → Helps in identifying the location area for mobility management.
• earfcn (EARFCN = 1582) → The frequency channel number used for LTE communication.
• Bandwidth = 15000 (15 MHz) → The available spectrum bandwidth for this LTE connection.
• bands = [3] → LTE Band 3 is being used

2️⃣ Data Registration State

        03-01 06:43:20.503 D/SST     ( 3743): [1] handlePollStateResultMessage: PS IWLAN. 

NetworkRegistrationInfo{ domain=PS transportType=WLAN registrationState=NOT_REG_OR_SEARCHING networkRegistrationState=NOT_REG_OR_SEARCHING roamingType=NOT_ROAMING accessNetworkTechnology=UNKNOWN rejectCause=0 emergencyEnabled=false availableServices=[] cellIdentity=null voiceSpecificInfo=null dataSpecificInfo=null nrState=**** rRplmn= isUsingCarrierAggregation=false}

• Analysis:

  • PS IWLAN (Packet Switched over Wi-Fi LAN) → This means the device is attempting to use Wi-Fi for data services instead of the cellular network.
  • registrationState = NOT_REG_OR_SEARCHING → The device is not currently registered for data services over Wi-Fi.
  • networkRegistrationState = NOT_REG_OR_SEARCHING → No active data network connection is available.
  • accessNetworkTechnology = UNKNOWN → No specific data access technology (LTE, 3G, etc.) is detected.
  • isUsingCarrierAggregation = false → The device is not using LTE Carrier Aggregation for faster speeds.

3️⃣ Network Registration Information

03-01 06:43:20.503 D/NRM-C-1 ( 3743): onRequestNetworkRegistrationInfoComplete result: 0, info: NetworkRegistrationInfo{ domain=CS transportType=WWAN registrationState=ROAMING networkRegistrationState=ROAMING roamingType=UNKNOWN accessNetworkTechnology=LTE rejectCause=0 emergencyEnabled=false availableServices=[VOICE,SMS,VIDEO] cellIdentity=CellIdentityLte:{ mCi=205418246 mPci=378 mTac=54140 mEarfcn=1582 mBands=[3] mBandwidth=15000 mMcc=404 mMnc=86 mAlphaLong=Vi India mAlphaShort=Vi India mAdditionalPlmns={} mCsgInfo=null}

 4️⃣ Physical Channel Configuration

03-01 06:43:20.503 D/NRM-C-1 ( 3743): onRequestNetworkRegistrationInfoComplete result: 0, info: NetworkRegistrationInfo{ domain=CS transportType=WWAN registrationState=ROAMING networkRegistrationState=ROAMING roamingType=UNKNOWN accessNetworkTechnology=LTE rejectCause=0 emergencyEnabled=false availableServices=[VOICE,SMS,VIDEO] cellIdentity=CellIdentityLte:{ mCi=205418246 mPci=378 mTac=54140 mEarfcn=1582 mBands=[3] mBandwidth=15000 mMcc=404 mMnc=86 mAlphaLong=Vi India mAlphaShort=Vi India mAdditionalPlmns={} mCsgInfo=null}

4️⃣ Physical Channel Configuration

03-01 06:43:20.503 D/NetworkTypeController( 3743): [1] Physical channel configs updated: [{mConnectionStatus=PrimaryServing,mCellBandwidthDownlinkKhz=15000,mCellBandwidthUplinkKhz=0,mNetworkType=LTE,mFrequencyRange=MID,mDownlinkChannelNumber=2147483647,mUplinkChannelNumber=2147483647,mContextIds=[0],mPhysicalCellId=378,mBand=0,mDownlinkFrequency=0,mUplinkFrequency=0}]

How to Check logs CS Cellular

CS Cellular LOGS SUB-1

handlePollStateResultMessage: CS cellular. NetworkRegistrationInfo{ domain=CS transportType=WWAN registrationState=HOME networkRegistrationState=HOME roamingType=NOT_ROAMING accessNetworkTechnology=LTE rejectCause=0 emergencyEnabled=false availableServices=[VOICE,SMS,VIDEO] cellIdentity=CellIdentityLte:{ mCi=739876 mPci=343 mTac=124 mEarfcn=1451 mBands=[3] mBandwidth=10000 mMcc=405 mMnc=861 mAlphaLong=JIO 4G mAlphaShort=JIO 4G mAdditionalPlmns={} mCsgInfo=null} voiceSpecificInfo=VoiceSpecificRegistrationInfo { mCssSupported=false mRoamingIndicator=0 mSystemIsInPrl=0 mDefaultRoamingIndicator=0} dataSpecificInfo=null nrState=**** rRplmn=405861 isUsingCarrierAggregation=false}

PS Cellular LOGS SUB-1

03-01 06:42:56.786 D/SST     ( 3743): [0] handlePollStateResultMessage: PS cellular. NetworkRegistrationInfo{ domain=PS transportType=WWAN registrationState=HOME networkRegistrationState=HOME roamingType=NOT_ROAMING accessNetworkTechnology=LTE rejectCause=0 emergencyEnabled=false availableServices=[DATA] cellIdentity=CellIdentityLte:{ mCi=739876 mPci=343 mTac=124 mEarfcn=1451 mBands=[3] mBandwidth=10000 mMcc=405 mMnc=861 mAlphaLong=JIO 4G mAlphaShort=JIO 4G mAdditionalPlmns={} mCsgInfo=null} voiceSpecificInfo=null dataSpecificInfo=android.telephony.DataSpecificRegistrationInfo :{ maxDataCalls = 16 isDcNrRestricted = false isNrAvailable = false isEnDcAvailable = false mLteAttachResultType = 0 mLteAttachExtraInfo = 0 LteVopsSupportInfo :  mVopsSupport = 2 mEmcBearerSupport = 2 } nrState=**** rRplmn=405861 isUsingCarrierAggregation=false}

SUB2 & rawSPN with RSRP in Logs ?

 

Sub1 & SPN in logs

 In given Picture you can the logs rawplan = JIO 4G

Unwanted NR RSRP In Logs

In given Picture you can see while be trying to camp on volte to Vowifi network NR network Shows Unwated RSRP =2147483647

RRC connection and Reject used in LTE.

UE LTE registration failure Problem Analysis using high-level UE logs

 

Problem Analysis using high-level UE logs

When the above LTE registration test scenario is executed, the following output is received with high-level details. However, only the “registration denied” status is conveyed from the registration attempt, and the root reason for the failure remains unknown.

 Running test scenario BCALL VoLTE DeREG VoLTE 01

                    Signal Strength ... ✔ OK in  2.504s | 87

                    Getting IMSI ... ✔ OK in  2.705s |   134550007900125 OK  

                    Attaching to LTE ... ✖ FAILED in  16.863s | Status: Registration denied, +CEREG: 0, 3

 Execution completed

Problem Analysis using detailed device log

• Obtain the UE device logs and decode the logs.
• Analyse the decoded logs and verify that the Attach Request is rejected due to the core network rejection for the attach request with cause of "#8" EPS services and non-EPS services not allowed.

Summary of Timmers

 

IMS Overview

 IP Multimedia Subsystem (IMS) is a standardized architecture framework used to deliver IP-based multimedia services over mobile and fixed networks. It is essential in providing a wide range of services like voice over LTE (VoLTE), voice over WiFi (VoWiFi), video calling, messaging, and other rich communication services (RCS) on mobile networks.

Key Components of IMS:

·         P-CSCF (Proxy Call Session Control Function):

The first point of contact in the IMS network for the user equipment (UE). It handles SIP registration and forwards SIP messages to the correct entity within the IMS.

·         I-CSCF (Interrogating Call Session Control Function):

Handles routing of SIP messages to the appropriate S-CSCF and assists in locating the user’s home network in roaming scenarios.

·         S-CSCF (Serving Call Session Control Function):

The central node in IMS, responsible for handling the session state, user registration, and service control. It interacts with application servers (AS) to provide services.

·         HSS (Home Subscriber Server):

A database that contains subscriber-related information such as user profiles, authentication data, and service configurations. It supports the S-CSCF in authenticating and authorizing users.

·         AS (Application Server):

Hosts various applications and services, such as voicemail, video calling, and conference services. It interacts with the S-CSCF to deliver these services to users.

·         BGCF (Breakout Gateway Control Function):

Determines the appropriate network for routing calls that are leaving the IMS network, particularly for calls directed towards the Public Switched Telephone Network (PSTN).

·         MGCF (Media Gateway Control Function):

Controls the Media Gateway (MGW) and is responsible for the signaling translation between the IMS network and the PSTN.

·         Media Gateway (MGW):

Converts media streams between different formats, such as IP streams in IMS and circuit-switched streams in the PSTN.

·         MRF (Media Resource Function):

Provides media-related functions such as conferencing, announcements, and media stream mixing.

IMS Services:

·         VoLTE (Voice over LTE):

IMS enables voice services over the LTE network, allowing high-quality voice calls alongside data services.

·         VoWiFi (Voice over WiFi):

Extends voice services over WiFi networks, providing better coverage, especially indoors.

·         Video Calling:

IMS supports video calls by utilizing SIP signaling and RTP for media transfer.

·         Rich Communication Services (RCS):

Enhanced messaging services, including file sharing, group chat, and location sharing, integrated into the native messaging app.

Benefits of IMS:

·         Service Convergence:

Provides a unified architecture for delivering various multimedia services, reducing complexity and improving service integration.

·         Scalability:

IMS can scale to support a vast number of users and services, making it suitable for large telecom networks.

·         Interoperability:

IMS is based on open standards, which allows for interoperability between equipment from different vendors and across different networks.

·         Flexibility:

Supports a wide range of IP-based services, making it adaptable to future innovations and service demands.

·         Enhanced User Experience:

Enables high-quality voice and video services with seamless handovers between different networks (e.g., LTE to WiFi), improving overall user experience.

Challenges:

·         Complexity:

• Implementing and managing an IMS network can be complex due to the number of components and interfaces involved.

·         Cost:

• Initial deployment and integration with legacy systems can be costly for operators.

·         Security:

• Given the open and IP-based nature of IMS, robust security measures are necessary to protect against attacks and ensure service availability.

H.265 vs. H.264 – Main Difference

✅ H.265 Introduces:

• B-Frames with Adaptive Motion Compensation → More efficient motion estimation.
• CU (Coding Unit) based prediction → Uses flexible block sizes (up to 64×64 pixels) instead of fixed 16×16 macroblocks in H.264.
• More efficient reference frames → H.265 can reference more past/future frames for improved compression.

..0. .... = H.263 Optional PB-frames mode: Normal I- or P-picture

H.265 Continuous Presence Multipoint (CPM): Off → The first bit of this field is 0, meaning CPM is disabled.

Video conference in Wireshark logs

 0... .... = H.263 Continuous Presence Multipoint and Video Multiplex (CPM): Off

 0... .... = H.265 Continuous Presence Multipoint and Video Multiplex (CPM): Off

CPM (Continuous Presence Multipoint) in Video Conferencing

CPM ON (1):

• Used in video conferencing where multiple participants' video feeds are combined into a single stream.
• Allows a grid/multi-screen view (e.g., Zoom, Microsoft Teams, Cisco Webex).
• Required for MCUs (Multipoint Control Units) handling multi-party calls

CPM OFF(0):

• Used for single video streams (one-to-one calls or a single video source).
• Ideal for direct peer-to-peer calls (e.g., a single camera sending a video feed).

User-Agent on Wireshark

Wireshark logs

1. SIP Registration Process

The User Agent (192.168.105.110) periodically registers itself with the SIP server (192.168.105.105) to be reachable.

• Packet 1: REGISTER request from 192.168.105.110 to 192.168.105.105
• Packet 2: SIP Server responds with 100 Trying (Processing the request)
• Packet 3: SIP Server confirms registration with 200 OK

🔄 Re-Registration:

• SIP clients typically refresh their registration periodically (e.g., every 10, 40, 70, or 100 seconds, as seen in packets 4, 11, 24, and 1358).

 2. First Call Attempt (Invite & Decline - Call Rejected)

At timestamp 36.002756, the client (192.168.105.110) attempts to call SIP user 2504 at the server (192.168.105.105).

• Packet 7: INVITE sent to sip:2504@192.168.105.105
• Packet 8: 100 Trying (SIP Server acknowledges the request)
• Packet 9: 603 Decline (Call is rejected)
• Packet 10: ACK (Acknowledgment of rejection)

💡 Possible reasons for decline:

• User 2504 is unavailable.
• The server rejects the call due to policy, configuration, or network issues.

 3. Second Call Attempt (Successful Call Setup)

At timestamp 52.003970, another call is made to sip:2504@192.168.105.105, but this time the call is routed differently:

• Packet 14-15: INVITE and 100 Trying
• Packet 16: Server 192.168.105.105 sends an INVITE to sip:2504@192.168.105.110:5060 (redirecting the call).
• Packet 17: 100 Trying from 192.168.105.110
• Packets 18-19: 180 Ringing (Indicates the call is ringing)
• Packets 20-21: 200 OK (INVITE) (Call is accepted)
• Packets 22-23: ACK (Acknowledging the call setup)

🎯 Conclusion: The second call attempt was successful after redirection.

Relationship between RNTI and DCI Format

The RNTI and the DCI format are two important pieces of information that are used in LTE to identify the UE and the type of downlink transmission that is being transmitted. The image you sent shows the usage of RNTI and DCI formats in different situations.

Whats DCI ?

DCI: - DCI (Downlink Control Information) is transmitted from the eNodeB (also known as eNB, which is the base station in LTE networks) to the UE (User Equipment)

eNodeB to UE:

·         The eNodeB transmits DCI to the UE in the downlink direction. DCI carries critical information regarding the scheduling of downlink and uplink resources. This includes information like resource block allocation, modulation and coding scheme, HARQ (Hybrid Automatic Repeat Request) process, and power control commands.

·         The DCI is embedded in the PDCCH (Physical Downlink Control Channel), which is responsible for informing the UE about where to find its allocated data in the LTE frame structure.

·         After receiving the DCI, the UE knows which time-frequency resources it should use for either receiving downlink data or sending uplink data.

·         DCI formats are required to tell the UE how to get its data which is transmitted on PDSCH in the same Subframe.

·         PDCCH is a control channel that carries DCI information. DCI is like a map for a UE to find and decode PDSCH from the resource grid.

The DCI format gives the UE, details such as:

·         Number of resource blocks

·         Resource allocation type

·         Modulation scheme

·         Transport block

·         Redundancy version (RV)

·         Coding rate

·         CQI

·         CSG info

Here is an example of how DCI formats are used:

·         The eNB wants to send data to a UE.

·         The eNB selects a set of resource blocks on the PDSCH to carry the data.

·         The eNB encodes the data into a transport block.

·         The eNB encodes the DCI information for the transport block.

·         The eNB transmits the DCI information on the PDCCH.

·         The UE receives the DCI information and decodes it.(DCI = 0 For SSS additions)

·         The UE uses the DCI information to decode the transport block on the PDSCH.

·         Once the UE has decoded the transport block, it can extract the data that was intended for it.

Carrier Aggregation Introduction

Carrier Aggregation is a feature which came into 3GPP Release 10. It is part of the feature of LTE- Advanced which is a common term used to describe the improvements in LTE. The focus of Release 10 was to advance LTE towards providing better user experience by providing higher data rates in cost-efficient way and in the same way maintaining backward compatibility.

The two main functionalities that are brought to achieve this criterion for LTE-A are Carrier Aggregation and Multi Antenna techniques.

Types of CA

Legacy UE behaviour