LTE網絡注冊流程（1）（2）（3）

 轉載自：https://www.freesion.com/article/98531378588/， 用於個人保存使用，感謝那位博主。

LTE網絡注冊流程（1）

最近在學習lte網絡相關內容，並做些簡單記錄，並且結合高通平台的qxdm log做簡要分析。

首先，介紹下lte注冊的總體流程，后續再完善整體結構，至於lte注冊信令流程，網上搜索就有一堆的資料，筆者就不再上傳了。

1.設備開機，plmn 選擇，小區選擇
plmn = mcc+mnc
過程如下，開機后，先從設備sim卡中獲取上次注冊的plmn,如果獲取不到，則需要進行全頻段掃描，獲取一個Plmn列表，從中選擇一個Plmn，選定Plmn后根據其對應頻點找到同步信號，與小區進行時頻的同步，從而獲取小區的系統信息。

2.接收系統信息
系統信息，下圖主要表示各個消息的作用。

接收到系統信息后，測量小區信號強度，判斷小區是否能夠駐留。小區的系統信息允許終端駐留，終端就會駐留到目標小區，並且選中該小區所在的Plmn，至此，目標小區就變成終端的服務小區。

3.隨機接入
隨機接入是終端與基站建立聯系的過程，隨機接入后，終端才能實現與小區的同步。與隨機接入相關的消息MSG1-MSG4.

隨機接入后，終端與基站建立起srb1，成功建立了rrc連接，后面就需要進行附着過程。

4.附着，建立默認承載
lte附着過程存在兩個特點
雙向鑒權，建立默認承載

附着過程包括，請求附着，獲取終端用戶id，鑒權，啟動Nas信令安全通信，接受附着，建立srb2和默認承載完成附着。如下圖

至此，lte注冊流程就跑完了，下面貼上一張終端log圖

關於附着之前的log沒有抓取到，這里就不貼出來來了，后面我會對沒一步具體介紹也做個簡單的記錄的，特么一些消息的重要信息

LTE網絡注冊流程（2）

本文說說lte系統信息吧，分為Mib和sib，sib系統信息存在sib1-sib12，主要介紹下mib,sib1 sib2 sib3 sib4 sib4的作用。

mib:
mib包含了非常重要的系統信息，包括小區標識（PCI），頻率，當前系統幀號，發射天線個數及小區帶寬，phich信道配置。

sib1信息
sib1也是重要的系統信息，終端附着到lte網絡必不可少的，包含如plmn值，小區選擇准則，小區工作頻段指示，其他sib消息的調度信息。

sib2信息
sib2也攜帶了重要的系統信息，比如小區是否阻塞，是否允許UE駐留小區，所有物理信道配置，一些重要定時器的配置。

各種信道配置我也沒整明白，下面就說主要定時器的作用。
T300：RRC 連接建立定時器
T301定時器：RRC重建定時器
T310：下行失步定時器
N310： 接受失步指示最大數目，與t310相關
等
如果需要了解，請自己去查下lte 各種定時器作用。

SIB3消息
包含了小區選擇和重選的相關信息。

sib4,sib5
sib4包含lte網絡內同頻相鄰小區信息，sib5包含lte網絡內異頻或者不同頻段的相鄰小區信息，主要包含了該小區的具體頻率值，重選該小區的門限，小區重選優先級等。

關於小區重選准則如下：
1.向優先級高的小區重選
高優先級小區信號強度在指定時間內大於指定門限
ue在當前服務小區駐留時間大於1s
2.向同優先級小區重選
同等優先級小區的信號強度必須指定時間內持續大於當前服務小區信號強度
ue在當前服務小區駐留時間大於1s
3.向低優先級小區重選
沒有優先級等於或者高於當前服務小區的優先級的小區的信號強度大於指定門限
當前服務小區信號強度小於指定門限
候選的低優先級小區信號強度指定時間內持續大於指定門限
ue在當前服務小區駐留時間大於1s

關於小區測量准則
1.如果服務小區是最高優先級小區，其信號強度持續時間內高於指定門限 不測量
2.如果服務小區的信號強度小於指定門限， 需要測量 系統內同異頻小區信號強度
3.如果服務小區不是最高優先級小區，需要周期性測量比服務小區高優先級的小區信號強度
低於服務小區優先級的，只有服務小區信號強度小於指定門限時才會去測量。

 

LTE網絡注冊流程（3）

本文介紹下下lte網絡注冊的附着和建立默認承載的過程之中消息分析.

1.attach request
消息中主要包括：
EPS attach type 數據業務附着類型
EPS Mobile identity 終端用戶標識（IMSI or GUTI）
UE Network Capbility 終端支持哪些加密和完整性保護算法
Tracking Area Identity 最后訪問跟蹤區TA
DRX Parameter 不連續接受配置
voice domain preference and UE’S Usage setting 語音業務參數
注意：建立默認承載的請求也在其中，這里就是lte中的又一大特色，一條rrc信令上搭載兩條nas消息。

下面為一個消息具體示例

1.  
   22:52:12.665 [0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
2.  
   pkt_version = 1 (0x1)
3.  
   rel_number = 9 (0x9)
4.  
   rel_version_major = 5 (0x5)
5.  
   rel_version_minor = 0 (0x0)
6.  
   security_header_or_skip_ind = 0 (0x0)
7.  
   prot_disc = 7 (0x7) (EPS mobility management messages)
8.  
   msg_type = 65 (0x41) (Attach request)
9.  
   lte_emm_msg
10.  
    emm_attach_request
11.  
    tsc = 0 (0x0) (cached sec context)
12.  
    nas_key_set_id = 3 (0x3)
13.  
    att_type = 2 (0x2) (combined EPS/IMSI attach) //附着類型
14.  
    eps_mob_id //終端用戶標識
15.  
    id_type = 6 (0x6) (GUTI) //GUTI
16.  
    odd_even_ind = 0 (0x0)
17.  
    Guti_1111 = 15 (0xf)
18.  
    mcc_1 = 3 (0x3) //MCC MNC
19.  
    mcc_2 = 1 (0x1)
20.  
    mcc_3 = 1 (0x1)
21.  
    mnc_3 = 0 (0x0)
22.  
    mnc_1 = 4 (0x4)
23.  
    mnc_2 = 8 (0x8)
24.  
    MME_group_id = 0 (0x0)
25.  
    MME_code = 0 (0x0)
26.  
    m_tmsi = 0 (0x0)
27.  
    ue_netwk_cap //終端支持哪些加密和完整性保護算法
28.  
    EEA0 = 1 (0x1) //lte加密算法支持能力
29.  
    EEA1_128 = 1 (0x1)
30.  
    EEA2_128 = 1 (0x1)
31.  
    EEA3_128 = 1 (0x1)
32.  
    EEA4 = 0 (0x0)
33.  
    EEA5 = 0 (0x0)
34.  
    EEA6 = 0 (0x0)
35.  
    EEA7 = 0 (0x0)
36.  
    EIA0 = 0 (0x0) //lte完整性保護算法支持能力
37.  
    EIA1_128 = 1 (0x1)
38.  
    EIA2_128 = 1 (0x1)
39.  
    EIA3_128 = 1 (0x1)
40.  
    EIA4 = 0 (0x0)
41.  
    EIA5 = 0 (0x0)
42.  
    EIA6 = 0 (0x0)
43.  
    EIA7 = 0 (0x0)
44.  
    oct5_incl = 1 (0x1)
45.  
    UEA0 = 1 (0x1) //3g加密算法支持能力
46.  
    UEA1 = 1 (0x1)
47.  
    UEA2 = 0 (0x0)
48.  
    UEA3 = 0 (0x0)
49.  
    UEA4 = 0 (0x0)
50.  
    UEA5 = 0 (0x0)
51.  
    UEA6 = 0 (0x0)
52.  
    UEA7 = 0 (0x0)
53.  
    oct6_incl = 1 (0x1)
54.  
    UCS2 = 0 (0x0)
55.  
    UIA1 = 1 (0x1) //3G完整性保護算法的支持能力
56.  
    UIA2 = 0 (0x0)
57.  
    UIA3 = 0 (0x0)
58.  
    UIA4 = 0 (0x0)
59.  
    UIA5 = 0 (0x0)
60.  
    UIA6 = 0 (0x0)
61.  
    UIA7 = 0 (0x0)
62.  
    oct7_incl = 1 (0x1)
63.  
    ProSedd = 0 (0x0)
64.  
    ProSe = 0 (0x0)
65.  
    H_245_ASH = 0 (0x0)
66.  
    ACC_CSFB = 1 (0x1)
67.  
    LPP = 1 (0x1)
68.  
    LCS = 0 (0x0)
69.  
    vcc_1xsr = 0 (0x0)
70.  
    NF = 1 (0x1)
71.  
    oct8_incl = 0 (0x0)
72.  
    oct9_incl = 0 (0x0)
73.  
    oct10_incl = 0 (0x0)
74.  
    oct11_incl = 0 (0x0)
75.  
    oct12_incl = 0 (0x0)
76.  
    oct13_incl = 0 (0x0)
77.  
    oct14_incl = 0 (0x0)
78.  
    oct15_incl = 0 (0x0)
79.  
    esm_msg_container //**默認承載
80.  
    eps_bearer_id_or_skip_id = 0 (0x0)
81.  
    prot_disc = 2 (0x2) (EPS session management messages)
82.  
    trans_id = 1 (0x1)
83.  
    msg_type = 208 (0xd0) (PDN connectivity request) //**默認承載請求
84.  
    lte_esm_msg
85.  
    pdn_connectivity_req
86.  
    pdn_type = 3 (0x3) (Ipv4v6) //PDN 類型
87.  
    req_type = 1 (0x1) (initial request) //請求類型
88.  
    info_trans_flag_incl = 1 (0x1)
89.  
    esm_info_trans_flag = 1 (0x1)
90.  
    access_pt_name_incl = 0 (0x0)
91.  
    prot_config_incl = 1 (0x1)
92.  
    prot_config
93.  
    ext = 1 (0x1)
94.  
    conf_prot = 0 (0x0)
95.  
    num_recs = 3 (0x3)
96.  
    sm_prot[ 0]
97.  
    protocol_id = 32801 (0x8021) (IPCP)
98.  
    prot_len = 16 (0x10)
99.  
    ipcp_prot
100.  
     ipcp_prot_id = 1 (0x1) (CONF_REQ)
101.  
     identifier = 0 (0x0)
102.  
     rfc1332_conf_req
103.  
     num_options = 2 (0x2)
104.  
     conf_options[ 0]
105.  
     type = 129 (0x81)
106.  
     rfc1877_primary_dns_server_add
107.  
     length = 6 (0x6)
108.  
     ip_addr = 0 (0x0) (0.0.0.0)
109.  
     conf_options[ 1]
110.  
     type = 131 (0x83)
111.  
     rfc1877_sec_dns_server_add
112.  
     length = 6 (0x6)
113.  
     ip_addr = 0 (0x0) (0.0.0.0)
114.  
     sm_prot[ 1]
115.  
     protocol_id = 13 (0xd) (DNS Server IPv4 Address Requestt)
116.  
     prot_len = 0 (0x0)
117.  
     sm_prot[ 2]
118.  
     protocol_id = 3 (0x3) (DNS Server IPv6 Addr Req)
119.  
     prot_len = 0 (0x0)
120.  
     num_recs2 = 6 (0x6)
121.  
     sm_container[ 0]
122.  
     container_id = 65280 (0xff00) (unknown)
123.  
     container_len = 3 (0x3)
124.  
     container_contents[ 0] = 19 (0x13)
125.  
     container_contents[ 1] = 1 (0x1)
126.  
     container_contents[ 2] = 132 (0x84)
127.  
     sm_container[ 1]
128.  
     container_id = 1 (0x1) (P-CSCF IPv6 Address Request)
129.  
     container_len = 0 (0x0)
130.  
     sm_container[ 2]
131.  
     container_id = 12 (0xc) (P-CSCF IPv4 Address Request)
132.  
     container_len = 0 (0x0)
133.  
     sm_container[ 3]
134.  
     container_id = 10 (0xa) (IP address allocation via NAS signalling)
135.  
     container_len = 0 (0x0)
136.  
     sm_container[ 4]
137.  
     container_id = 5 (0x5) (NWK Req Bearer Control indicator)
138.  
     container_len = 0 (0x0)
139.  
     sm_container[ 5]
140.  
     container_id = 16 (0x10) (Ipv4 Link MTU Request)
141.  
     container_len = 0 (0x0)
142.  
     dev_properties_incl = 0 (0x0)
143.  
     nbifom_incl = 0 (0x0)
144.  
     header_compression_config_inclu = 0 (0x0)
145.  
     ext_prot_config_incl = 0 (0x0)
146.  
     p_tmsi_sig_incl = 0 (0x0)
147.  
     add_guti_incl = 0 (0x0)
148.  
     reg_tai_incl = 1 (0x1)
149.  
     tracking_area_id
150.  
     mcc_mnc
151.  
     mcc_1 = 3 (0x3)
152.  
     mcc_2 = 1 (0x1)
153.  
     mcc_3 = 1 (0x1)
154.  
     mnc_3 = 0 (0x0)
155.  
     mnc_1 = 4 (0x4)
156.  
     mnc_2 = 8 (0x8)
157.  
     tracking_area_id = 11 (0xb)
158.  
     drx_params_incl = 1 (0x1)
159.  
     drx_params
160.  
     split_pg_cycle_code = 10 (0xa)
161.  
     cycle_len_coeff = 0 (0x0)
162.  
     split_on_ccch = 0 (0x0)
163.  
     non_drx_timer = 0 (0x0)
164.  
     ms_netwk_cap_incl = 1 (0x1)
165.  
     ms_netwk_cap
166.  
     length = 3 (0x3)
167.  
     r99 = 1 (0x1)
168.  
     GEA1 bits
169.  
     GEA/ 1 = 1 (0x1)
170.  
     SM capabilities via dedicated channels = 1 (0x1)
171.  
     SM capabilities via GPRS channels = 1 (0x1)
172.  
     UCS2 support = 0 (0x0)
173.  
     SS Screening Indicator = 1 (0x1)
174.  
     SoLSA Capability = 0 (0x0)
175.  
     Revision level indicator = 1 (0x1)
176.  
     PFC feature mode = 1 (0x1)
177.  
     Extended GEA bits
178.  
     GEA/ 2 = 1 (0x1)
179.  
     GEA/ 3 = 1 (0x1)
180.  
     GEA/ 4 = 0 (0x0)
181.  
     GEA/ 5 = 0 (0x0)
182.  
     GEA/ 6 = 0 (0x0)
183.  
     GEA/ 7 = 0 (0x0)
184.  
     LCS VA capability = 0 (0x0)
185.  
     PS inter-RAT HO from GERAN to UTRAN Iu mode capability = 0 (0x0)
186.  
     PS inter-RAT HO from GERAN to E-UTRAN S1 mode capability = 0 (0x0)
187.  
     EMM Combined procedures Capability = 1 (0x1)
188.  
     ISR support = 1 (0x1)
189.  
     SRVCC to GERAN/UTRAN capability = 1 (0x1)
190.  
     EPC capability = 1 (0x1)
191.  
     NF capability = 1 (0x1)
192.  
     spare_bits0_count = 0 (0x0)
193.  
     old_loc_area_id_incl = 0 (0x0)
194.  
     tmsi_stat_incl = 1 (0x1)
195.  
     tmsi_stat
196.  
     tmsi_flag = 0 (0x0)
197.  
     ms_class_mark2_incl = 1 (0x1)
198.  
     ms_class_mark2
199.  
     rev_level = 2 (0x2)
200.  
     es_ind = 0 (0x0)
201.  
     a5_1_alg_sup = 1 (0x1)
202.  
     rf_power_cap = 7 (0x7)
203.  
     pseudo_sync_cap = 0 (0x0)
204.  
     ss_screen_ind = 1 (0x1)
205.  
     sm_cap = 1 (0x1)
206.  
     vbs = 0 (0x0)
207.  
     vgcs = 0 (0x0)
208.  
     freq_cap = 0 (0x0)
209.  
     class_3_avail = 1 (0x1)
210.  
     lcsva_cap = 1 (0x1)
211.  
     ucs2 = 0 (0x0)
212.  
     solsa = 0 (0x0)
213.  
     cmsp = 1 (0x1)
214.  
     a5_3_alg_sup = 0 (0x0)
215.  
     a5_2_alg_sup = 0 (0x0)
216.  
     ms_class_mark3_incl = 0 (0x0)
217.  
     supp_codecs_incl = 1 (0x1)
218.  
     supp_codecs
219.  
     num_codecs = 2 (0x2)
220.  
     codecs[ 0]
221.  
     sysid = 4 (0x4)
222.  
     length = 2 (0x2)
223.  
     bitmap[ 0] = 96 (0x60)
224.  
     bitmap[ 1] = 4 (0x4)
225.  
     codecs[ 1]
226.  
     sysid = 0 (0x0)
227.  
     length = 2 (0x2)
228.  
     bitmap[ 0] = 31 (0x1f)
229.  
     bitmap[ 1] = 2 (0x2)
230.  
     add_update_type_incl = 0 (0x0)
231.  
     voice_domain_pref_incl = 1 (0x1)
232.  
     voice_domain_pref //語音業務相關參數
233.  
     length = 1 (0x1)
234.  
     UE_usage_setting = 1 (0x1) (Data centric)
235.  
     //volte 優先 cs語音
236.  
     voice_domain_pref_for_EUTRAN = 3 (0x3) (IMS PS Voice preferred, CS Voice as secondary)
237.  
     dev_properties_incl = 0 (0x0)
238.  
     old_guti_incl = 0 (0x0)
239.  
     ms_network_feature_incl = 1 (0x1)
240.  
     ms_network_feature_support
241.  
     ext_periodic_timers = 1 (0x1)
242.  
     network_resource_id_container_incl = 0 (0x0)
243.  
     t3324_incl = 0 (0x0)
244.  
     t3412_ext_incl = 0 (0x0)
245.  
     ext_drx_par_incl = 0 (0x0)
246.  
     ue_add_security_cap_incl = 0 (0x0)
247.  
     ue_status_incl = 0 (0x0)

2.獲取終端id

1.  
   //請求
2.  
   22:52:12.897 [0xB0EC] LTE NAS EMM Plain OTA Incoming Message
3.  
   pkt_version = 1 (0x1)
4.  
   rel_number = 9 (0x9)
5.  
   rel_version_major = 5 (0x5)
6.  
   rel_version_minor = 0 (0x0)
7.  
   security_header_or_skip_ind = 0 (0x0)
8.  
   prot_disc = 7 (0x7) (EPS mobility management messages)
9.  
   msg_type = 85 (0x55) (Identity request) //獲取終端id請求
10.  
    lte_emm_msg
11.  
    emm_id_req
12.  
    identity_type_2
13.  
    type_of_identity = 1 (0x1) //終端id類型（imsi or guti）
14.  
    //響應
15.  
    22:52:12.897 [0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
16.  
    pkt_version = 1 (0x1)
17.  
    rel_number = 9 (0x9)
18.  
    rel_version_major = 5 (0x5)
19.  
    rel_version_minor = 0 (0x0)
20.  
    security_header_or_skip_ind = 0 (0x0)
21.  
    prot_disc = 7 (0x7) (EPS mobility management messages)
22.  
    msg_type = 86 (0x56) (Identity response)
23.  
    lte_emm_msg
24.  
    emm_id_resp
25.  
    mobile_identity
26.  
    id_type_check = 9 (0x9)
27.  
    ident_type = 1 (0x1)
28.  
    odd_even_ind = 1 (0x1)
29.  
    num_ident = 15 (0xf) //獲取到的Imsi 311480123456789
30.  
    ident[ 0] = 3 (0x3)
31.  
    ident[ 1] = 1 (0x1)
32.  
    ident[ 2] = 1 (0x1)
33.  
    ident[ 3] = 4 (0x4)
34.  
    ident[ 4] = 8 (0x8)
35.  
    ident[ 5] = 0 (0x0)
36.  
    ident[ 6] = 1 (0x1)
37.  
    ident[ 7] = 2 (0x2)
38.  
    ident[ 8] = 3 (0x3)
39.  
    ident[ 9] = 4 (0x4)
40.  
    ident[ 10] = 5 (0x5)
41.  
    ident[ 11] = 6 (0x6)
42.  
    ident[ 12] = 7 (0x7)
43.  
    ident[ 13] = 8 (0x8)
44.  
    ident[ 14] = 9 (0x9)

3.鑒權和安全通信
這里消息就不列出來了
鑒權過程，是雙向鑒權，首先mme 給ue 轉發鑒權請求，ue收到鑒權消息后會對網絡進行鑒權，確認網絡身份后，利用鑒權算法獲取響應消息返回給網絡，網絡在通過響應對ue進行鑒權，判斷用戶是否為合法用戶。

安全通信其實就是ue和網絡商量出一組加密算法，作為相互傳遞消息時使用的，最終建立起安全通信。

4.接受附着
這里注意里終端用戶在成功附着的同時，也會發生位置更新。
下面接受attach accept消息，主要包括下面內容：跟蹤區TA列表，MME為終端分配的guti標識，定時器餐宿，EPS網絡配置參數。

1.  
   22:52:13.806 [0xB0EC] LTE NAS EMM Plain OTA Incoming Message
2.  
   pkt_version = 1 (0x1)
3.  
   rel_number = 9 (0x9)
4.  
   rel_version_major = 5 (0x5)
5.  
   rel_version_minor = 0 (0x0)
6.  
   security_header_or_skip_ind = 0 (0x0)
7.  
   prot_disc = 7 (0x7) (EPS mobility management messages)
8.  
   msg_type = 66 (0x42) (Attach accept)
9.  
   lte_emm_msg
10.  
    emm_attach_accept
11.  
    attach_result = 1 (0x1) (EPS only) //附着結果
12.  
    t3412
13.  
    unit = 7 (0x7)
14.  
    timer_value = 1 (0x1)
15.  
    tai_list //TA列表
16.  
    num_tai_list = 1 (0x1)
17.  
    tai_list[ 0]
18.  
    list_type = 0 (0x0)
19.  
    num_element = 0 (0x0)
20.  
    mcc_mnc //網絡的mcc mnc
21.  
    mcc_1 = 3 (0x3)
22.  
    mcc_2 = 1 (0x1)
23.  
    mcc_3 = 1 (0x1)
24.  
    mnc_3 = 0 (0x0)
25.  
    mnc_1 = 4 (0x4)
26.  
    mnc_2 = 8 (0x8)
27.  
    tac[ 0] = 11 (0xb)
28.  
    esm_msg_container
29.  
    eps_bearer_id_or_skip_id = 5 (0x5)
30.  
    prot_disc = 2 (0x2) (EPS session management messages)
31.  
    trans_id = 1 (0x1)
32.  
    msg_type = 193 (0xc1) (Activate default EPS bearer context request)
33.  
    lte_esm_msg
34.  
    act_def_eps_bearer_context_req
35.  
    eps_qos //qos服務質量
36.  
    qci = 5 (0x5) (QC5)
37.  
    oct4_incl = 0 (0x0)
38.  
    oct5_incl = 0 (0x0)
39.  
    oct6_incl = 0 (0x0)
40.  
    oct7_incl = 0 (0x0)
41.  
    oct8_incl = 0 (0x0)
42.  
    oct9_incl = 0 (0x0)
43.  
    oct10_incl = 0 (0x0)
44.  
    oct11_incl = 0 (0x0)
45.  
    oct12_incl = 0 (0x0)
46.  
    oct13_incl = 0 (0x0)
47.  
    oct14_incl = 0 (0x0)
48.  
    oct15_incl = 0 (0x0)
49.  
    access_point //接入方式，或者apn信息 apn 為ims
50.  
    num_acc_pt_val = 4 (0x4)
51.  
    acc_pt_name_val[ 0] = 3 (0x3) (length)
52.  
    acc_pt_name_val[ 1] = 105 (0x69) (i)
53.  
    acc_pt_name_val[ 2] = 109 (0x6d) (m)
54.  
    acc_pt_name_val[ 3] = 115 (0x73) (s)
55.  
    pdn_addr //pdn 地址
56.  
    pdn_addr_len = 9 (0x9)
57.  
    pdn_type = 2 (0x2) (IPv6)
58.  
    ipv6_interface_id = 0x000000000000001 (0:0:0:1)
59.  
    trans_id_incl = 1 (0x1)
60.  
    trans_id
61.  
    length = 1 (0x1)
62.  
    ti_flag = 0 (0x0)
63.  
    ti_value = 0 (0x0)
64.  
    qos_incl = 0 (0x0)
65.  
    llc_sapi_incl = 0 (0x0)
66.  
    radio_priority_incl = 0 (0x0)
67.  
    pkt_flow_id_incl = 0 (0x0)
68.  
    apn_ambr_incl = 0 (0x0)
69.  
    esm_cause_incl = 1 (0x1)
70.  
    esm_cause
71.  
    esm_cause = 51 (0x33) (PDN type IPv6 only allowed)
72.  
    prot_config_incl = 1 (0x1)
73.  
    prot_config
74.  
    ext = 1 (0x1)
75.  
    conf_prot = 0 (0x0)
76.  
    num_recs = 0 (0x0)
77.  
    num_recs2 = 2 (0x2)
78.  
    sm_container[ 0]
79.  
    container_id = 3 (0x3) (DNS Server IPv6 Address)
80.  
    container_len = 16 (0x10)
81.  
    address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
82.  
    sm_container[ 1]
83.  
    container_id = 1 (0x1) (P-CSCF IPV6 Address)
84.  
    container_len = 16 (0x10)
85.  
    address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
86.  
    connectivity_type_incl = 0 (0x0)
87.  
    wlan_offload_acceptability_incl = 0 (0x0)
88.  
    nbifom_incl = 0 (0x0)
89.  
    header_compression_config_inclu = 0 (0x0)
90.  
    ctrl_plane_only_ind_incl = 0 (0x0)
91.  
    ext_prot_config_incl = 0 (0x0)
92.  
    serv_plmn_rate_ctrl_incl = 0 (0x0)
93.  
    ext_apn_ambr_incl = 0 (0x0)
94.  
    ext_eps_qos_incl = 0 (0x0)
95.  
    guti_incl = 1 (0x1)
96.  
    guti //guti標識
97.  
    id_type = 6 (0x6) (GUTI)
98.  
    odd_even_ind = 0 (0x0)
99.  
    Guti_1111 = 15 (0xf)
100.  
     mcc_1 = 3 (0x3)
101.  
     mcc_2 = 1 (0x1)
102.  
     mcc_3 = 1 (0x1)
103.  
     mnc_3 = 0 (0x0)
104.  
     mnc_1 = 4 (0x4)
105.  
     mnc_2 = 8 (0x8)
106.  
     MME_group_id = 0 (0x0)
107.  
     MME_code = 0 (0x0)
108.  
     m_tmsi = 0 (0x0)
109.  
     loc_id_incl = 0 (0x0)
110.  
     ms_id_incl = 0 (0x0)
111.  
     emm_cause_incl = 1 (0x1)
112.  
     emm_cause
113.  
     cause_value = 18 (0x12) (CS domain not available)
114.  
     T3402_incl = 0 (0x0)
115.  
     T3423_incl = 0 (0x0)
116.  
     equ_plmns_incl = 0 (0x0)
117.  
     emergnecy_num_list_incl = 0 (0x0)
118.  
     eps_netwk_feature_support_incl = 1 (0x1)
119.  
     eps_netwk_feature_support //網絡特性描述
120.  
     length = 1 (0x1)
121.  
     CPCIoT = 0 (0x0)
122.  
     ERwoPDN = 0 (0x0)
123.  
     ESRPS = 0 (0x0)
124.  
     CS_LCS = 0 (0x0) (No info about support of loc service via cs is available)
125.  
     EPC_LCS = 0 (0x0) (Location Services via EPC not supported)
126.  
     EMC_BS = 1 (0x1) (Emergency bearer services in S1 Mode supported)
127.  
     IMSVoPS = 1 (0x1) (IMS Vo PS Session in S1 Mode supported)
128.  
     add_update_result_incl = 0 (0x0)
129.  
     t3412_ext_incl = 0 (0x0)
130.  
     t3324_incl = 0 (0x0)
131.  
     ext_drx_par_incl = 0 (0x0)
132.  
     dcn_id_incl = 0 (0x0)
133.  
     sms_srvc_status_incl = 0 (0x0)
134.  
     non_3gpp_access_emerg_num_policy_incl = 0 (0x0)
135.  
     t3448_incl = 0 (0x0)
136.  
     nwk_policy_incl = 0 (0x0)
137.  
     t3447_ext_incl = 0 (0x0)
138.  
     ext_emergency_number_incl = 0 (0x0)
139.  
     cipher_ket_data_incl = 0 (0x0)

5.建立默認承載
消息中包括默認承載id，qos參數，分配的ip地址，dns地址，默認apn，來自hss的簽約信息。

備注qci含義：
GBR
QCI=1: Example Services: Conversational voicemscbsc
　　QCI=2: Conversational Video (Live streaming)
　　QCI=3: Real Time Gaming
　　QCI=4: Non-conversational voice (buffered streaming)
Non-GBR
QCI=5: IMS signaling
　　QCI=6: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
　　QCI=7: Voice, Video (live streaming), interactive gaming
　　QCI=8: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
　　QCI=9: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)

1.  
   22:52:13.806 [0xB0E2] LTE NAS ESM Plain OTA Incoming Message
2.  
   pkt_version = 1 (0x1)
3.  
   rel_number = 9 (0x9)
4.  
   rel_version_major = 5 (0x5)
5.  
   rel_version_minor = 0 (0x0)
6.  
   eps_bearer_id_or_skip_id = 5 (0x5)
7.  
   prot_disc = 2 (0x2) (EPS session management messages)
8.  
   trans_id = 1 (0x1)
9.  
   msg_type = 193 (0xc1) (Activate default EPS bearer context request)
10.  
    lte_esm_msg
11.  
    act_def_eps_bearer_context_req
12.  
    eps_qos //qos參數
13.  
    qci = 5 (0x5) (QC5)
14.  
    oct4_incl = 0 (0x0)
15.  
    oct5_incl = 0 (0x0)
16.  
    oct6_incl = 0 (0x0)
17.  
    oct7_incl = 0 (0x0)
18.  
    oct8_incl = 0 (0x0)
19.  
    oct9_incl = 0 (0x0)
20.  
    oct10_incl = 0 (0x0)
21.  
    oct11_incl = 0 (0x0)
22.  
    oct12_incl = 0 (0x0)
23.  
    oct13_incl = 0 (0x0)
24.  
    oct14_incl = 0 (0x0)
25.  
    oct15_incl = 0 (0x0)
26.  
    access_point //接入apn ims
27.  
    num_acc_pt_val = 4 (0x4)
28.  
    acc_pt_name_val[ 0] = 3 (0x3) (length)
29.  
    acc_pt_name_val[ 1] = 105 (0x69) (i)
30.  
    acc_pt_name_val[ 2] = 109 (0x6d) (m)
31.  
    acc_pt_name_val[ 3] = 115 (0x73) (s)
32.  
    pdn_addr //分配的ip地址
33.  
    pdn_addr_len = 9 (0x9)
34.  
    pdn_type = 2 (0x2) (IPv6)
35.  
    ipv6_interface_id = 0x000000000000001 (0:0:0:1)
36.  
    trans_id_incl = 1 (0x1)
37.  
    trans_id
38.  
    length = 1 (0x1)
39.  
    ti_flag = 0 (0x0)
40.  
    ti_value = 0 (0x0)
41.  
    qos_incl = 0 (0x0)
42.  
    llc_sapi_incl = 0 (0x0)
43.  
    radio_priority_incl = 0 (0x0)
44.  
    pkt_flow_id_incl = 0 (0x0)
45.  
    apn_ambr_incl = 0 (0x0)
46.  
    esm_cause_incl = 1 (0x1)
47.  
    esm_cause
48.  
    esm_cause = 51 (0x33) (PDN type IPv6 only allowed)
49.  
    prot_config_incl = 1 (0x1)
50.  
    prot_config
51.  
    ext = 1 (0x1)
52.  
    conf_prot = 0 (0x0)
53.  
    num_recs = 0 (0x0)
54.  
    num_recs2 = 2 (0x2)
55.  
    sm_container[ 0]
56.  
    container_id = 3 (0x3) (DNS Server IPv6 Address)
57.  
    container_len = 16 (0x10)
58.  
    address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
59.  
    sm_container[ 1]
60.  
    container_id = 1 (0x1) (P-CSCF IPV6 Address)
61.  
    container_len = 16 (0x10)
62.  
    address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
63.  
    connectivity_type_incl = 0 (0x0)
64.  
    wlan_offload_acceptability_incl = 0 (0x0)
65.  
    nbifom_incl = 0 (0x0)
66.  
    header_compression_config_inclu = 0 (0x0)
67.  
    ctrl_plane_only_ind_incl = 0 (0x0)
68.  
    ext_prot_config_incl = 0 (0x0)
69.  
    serv_plmn_rate_ctrl_incl = 0 (0x0)
70.  
    ext_apn_ambr_incl = 0 (0x0)
71.  
    ext_eps_qos_incl = 0 (0x0)

最后終端給網絡發送一個完成附着的響應，attach complete 消息中沒有攜帶任何具體信息，可以理解為給Mme的禮貌性的回應。

至此，關於lte注冊流程應該算是有個簡單的了解了。