INDEX

1. LTE Architecture
2. LTE Attach procedure & call flow-
3. Carrier Aggregation-
4. Handover in LTE
5. QOS(Quality of services)
6. QCI (QoS Class Identifier)
7. ARP (Allocation and Retention Priority):
8. GBR (guaranteed bit rate)
9. NON-GBR:
10. MBR (UL/DL):
11. TAU(Tracking area update):
12. RACH-
13. IMS call flow or SIP sequence
14. What is Cell Reselection?
15. What is CSFB [Circuit Switch FallBack]?
16. What is SRVCC [ Single Radio Voice Call Continuity]?
17. Entities of IMS Architecture
18. Explain IMS Registration Process
19. Explain RRC states
20. Explain RACH procedure
21. Explain Session Initiation Protocol
22. SIP MESSAGES
23. Explain the purpose of IPSec
24. Powers in LTE
25. What is MRF?
26. Is Antenna a Passive or Active Element and why?
27. What are the parameters to be monitored for Throughput?
28. Explain Channel Grid (Mapping) in Detail?
29. What is CDRX?
30. Explain functionality of different channels in LTE?
31. Modulation Scheme Supported for Uplink and Downlink?
32. What is Integrity Key / Ciphering Key?
33. What is use of NV Browser in QXDM?
34. Describe LTE power on procedure.
35. What MIB contain
36. what SIB1&2 contain
37. what is contention resolution
38. describe attach procedure
39. describe IMS registration procedure
40. . Physical Channels in LTE?
41. QoS
42. Bearer
43. . LTE Security?
44. . Functions of RLC?
45. . What are the Modes of RLC?
46. SIP protocols in LTE?
47. What are the Functions of RRC?
48. Explain ARQ & HARQ.
49. Reference signals in LTE?
50. PLMN selection procedure.
51. HPLMN or the highest priority EHPLMN
52. Difference between dB and dBm
53. What is PSS & SSS.?
54. Explain different HANDOVER events like A1, A2, A3, A4, A5 & B1, B2.
55. What are different types of Rach in LTE?
56. When TAU is initiated and types of TAU
57. In 2g and 3g architecture which entity handles packet request
58. Which technology is better LTE or CDMA?
59. Which are the basic entities in LTE?
60. Draw resource block in frequency and time domain and explain
61. What is SRB and DRB? Explain their functions.
62. How many SRB are there in LTE and WCDMA?
63. Draw IMS architecture.
64. Channels in LTE.
65. What is difference between LTE and LTE -advance technology?
66. Rach procedure with all IES
1. LTE Architecture-An LTE network consists of LTE entities (UE and eNB) and EPC
entities (S-GW, P-GW, MME, HSS, PCRF, SPR, OCS and OFCS). A PDN is an
internal or external IP domain of the operator that a UE wants to communicate
with, and provides the UE with services such as the Internet or IP Multimedia
Subsystem (IMS)

LTE entities-

EPC entities-
LTE interfaces-
* Difference between LTE, UMTS & GSM:

S. No. LTE UMTS GSM

1 For Data services For packet switched (PS) For packet switched (PS)
EPC(MME+ SGW+ PGW+ operations SGSN and GGSN will operations SGSN and
HSS) will be used. serve the purpose GGSN will serve the
purpose

2. For voice services either For Circuit switched (CS) For Circuit switched (CS)
CSFB or VoLTE will be used. operations MSC and GMSC along operations MSC along
with database modules such as with database modules
VLR, HLR will be available such as VLR, HLR will be
available

3. EUTRAN consists of eNodeB RAN(Radio access network) Base station

only. consists of RNC(Radio network subsystem(BSS) consists
controller) + NodeB of BSC(The Base Station
Controller) + BTS(The
Base Transceiver Station)

4. Frame duration is 10ms Frame duration is about 10ms Frame duration is about
4.615ms

5. OFDMA/SC-FDMA CDMA FDMA/TDMA

6. RRC states: RRC states: RRC states:

Idle CELL_DCH Idle
Connected CELL_FACH Dedicated
CELL_PCH
URA_PCH
2. LTE Attach procedure & call flow-
The User turns on the UE and attempts initial attach to the network. Immediately after being
turned on, the UE is in EMM-Deregistered, ECM-Idle and RRC-Idle state. After performing PLMN
and cell search, it synchronizes to a cell and sends an “Attach Request (UE ID = IMSI)” message
that includes IMSI as UE ID to the MME. Then, it enters EMM-Registered, ECM-Connected and
RRC-Connected state.

a. Initial acquisition- Frequency acquisition & cell acquisition process happens during Initial
acquisition. Initial acquisition message also contains PBCH decoding result.
 During frequency acquisition it scans all the supported bands & their frequencies & selects
one of them.
For cell acquisition it decodes PSS(primary synchronization signal) & SSS(secondary
synchronization signal) and based on their values it calculates PCI(physical cell Identity)
 PCI= 3*SSS + PSS where PSS =Cell number(0-2) & SSS= Cell group ID(0-167)

b. MIB(master information block)- MIB carries Downlink bandwidth information, SFN

number etc.

c. SIB(system information block) 1- SIB 1 contains PLMN, tracking area code, cell barring
information & scheduling information of other SIBs.
 PLMN(Public land mobile network)= MCC(mobile country code of three digit) +
MNC(Mobile Network code of either 2 or 3 digit).
 Barred cell
Barred cell is a cell on which a UE is not allowed to camp on. A cell is barred if it is so
indicated in the system information.
  Reserved cell
Reserved cell is a cell on which camping is not allowed for all UEs, except for particular
UEs, if so indicated in the system information.
 If the cell is barred UE can’t camp on that cell.
 If the cell is not barred & not reserved for operator use then UE can camp on that cell
easily.
 If the cell is not barred & reserved for operator use then, only those UE belonging to
access class identifier 11 & 15 can camp on that cell.

d. SIB 2- It contains configuration info of the channels like BCCH, PCCH.

e. Attach request- Attach request is a NAS message which triggers RRC connection request.
It has GUTI, Attach type, tracking area ID & PDN connectivity request.
f. RRC connection request- It’s an RRC message which contains RRC connection
establishment cause.

g. RACH-
There are four messages which comes under RACH process
MSG1(LTE random access request)- It contains Information like PRACH power, RA-RNTI,
Duplex mode etc.
MSG2(LTE random access response)- It has Important parameters such as Timing
advance(TA) & RACH procedure type.

MSG3(LTE UE identification message)- This message carries modulation type & TPC.

MSG4(LTE contention resolution message)- It has contention result

h. RRC connection setup- This message configures all user plane protocol layer(MAC,
physical, RLC, PDCP), channels, & reference signal.

i. RRC connection setup complete- This message contains MME id of registered MME.
  mmegi(MME group id)- Used to select MME group from an MME pool.
 mmec(MME code)- Used to select particular MME from an MME group.

j. SIB3- This message has intra-frequency cell reselection info. The parameters in this
message will be used as a condition for reselection.

k. SIB5- This message contains Inter frequency reselection Info.

l. Authentication request- It has authentication parameters like AUTN & RAND.

m. Authentication response- Authentication response is an NAS EMM level message which
response from UE.

n. Security mode command(NAS)- This message contains ciphering(encryption) & integrity

protection algorithm

 EEA- EUTRAN encryption algorithm

 EIA- EUTRAN integrity algorithm
o. Security mode complete(NAS)- This EMM message is a response to Security mode
command.

p. ESM information request- It’s a NAS EMM message generated from Network which asks
UE for selected access point name(APN).

q. ESM information response- It gives the information about selected APN

r. UE capability enquiry- Through this message network enquires about UE capability,
supported bands of different RAT, feature group indicator(FGI) and supported DRB.

s. UE capability Information- It responds to capability enquiry message with information

about different RAT(Radio Access Technology) & related information.

t. Security mode command(RRC)- This message contains RRC level security mode
command.

u. Security mode complete(RRC)- This message has response to the security mode
command message.
v. RRC configuration reconfiguration- This message is for reconfiguration of user plane(RLC,
PDCP, MAC, Physical) layers, Radio bearers & reference signal.
w. RRC connection reconfiguration complete- This message contains response to RRC
reconfiguration complete.
x. Attach accept- It contains a lot of information like:
 Attach Type:

 TAU timer:

 TAI(tracking area ID) list: [ TAI= PLMN(MCC+MNC) + TAC(tracking area code)]

y. Activate default EPS bearer context-

 Access point name:

 QCI value:

 PDN address:

z. Attach complete- It contains “activate default EPS bearer accept” message.

3. Carrier Aggregation- In LTE Advanced to achieve very high data rates it is necessary to increase
the transmission bandwidths & to achieve this goal carrier aggregation is used. Using LTE
Advanced carrier aggregation, it is possible to utilize more than one carrier and in this way
increase the overall transmission bandwidth.
->These channels or carriers may be in the same band, or they may be in different bands.
->Carrier aggregation is supported by both formats of LTE, namely the FDD and TDD variants.
Types of CA-
->There are two types of aggregation based on the direction of propagation of signals.
-ULCA (uplink carrier aggregation), UE->NW
-DLCA (downlink carrier aggregation), NW->UE
->Based on technique used for aggregation there are three types of aggregation
-Intra-band: This form of carrier aggregation uses a single band. There are two main
formats for this type of carrier aggregation:
Contiguous: The Intra-band contiguous carrier aggregation is the easiest form of LTE
carrier aggregation to implement. Here the carriers are adjacent to each other.
Contiguous CA requires only one transceiver as it treats multi-carrier signal as single
signal.
Non-contiguous: Non-contiguous intra-band carrier aggregation is somewhat more
complicated than contiguous. No longer can the multi-carrier signal be treated as a single
signal and therefore two transceivers are required. This adds significant complexity,
particularly to the UE where space, power and cost are prime considerations.
 -Inter-band non-contiguous: This form of carrier aggregation uses different bands. UE
needs multiple transceivers in order to perform support such aggregations.
* CA details can be seen in serving cell measurement info:

4. Handover in LTE: When an UE moves from one cell to other cell or signal strength of serving
cell is less than the neighboring cell LTE performs handover, similarly there are few more
conditions for handover. LTE doesn’t support soft handover, it supports only hard handover.
* Difference between handover, cell selection, cell reselection & redirection.
-> Handover occurs when UE is in RRC connected mode & remains in connected mode after
handover.
-> Cell selection: It happens during initial acquisition process using SSS & PSS.
-> Cell reselection: It happens when an UE is in RRC idle mode & moves in a coverage area of poor
signal strength. The RRC after cell reselection is in idle state.
-> Cell redirection: When UE changes its RAT, cell redirection happens. In redirection UE goes
from connected state to idle state.

There are few more types of handover:

- Inter-frequency handover
- Intra-frequency handover
- Inter-RAT handover
- Intra RAT handover
- X2 handover
5. QOS(Quality of services): LTE QoS allows both LTE compliant subscribers and services to be
differentiated. Premium subscribers can be prioritized over basic subscribers. Real time services
can be prioritized over non real time services. As the network load will increase, prioritization
determines which subscribers and performing well and which are not performing.
Like other systems, LTE QoS also impacts admission control decisions. Connections with
guaranteed QoS require larger resources. These connections will be blocked in case of insufficient
resources.
QoS is applied between UE and PDN gateway within LTE network.
QoS Parameters
 QCI
 ARP
 GBR
 NON-GBR
 MBR
 APN-AMBR
 UE-AMR
6. QCI (QoS Class Identifier): QCI is an integer from 1 to 9 which indicates nine
different QoS performance characteristics of each IP packet. QCI values are
standardized to reference specific QoS characteristics, and each QCI contains
standardized performance characteristics (values), such as resource type
(GBR or non-GBR), priority (1~9)
7. ARP (Allocation and Retention Priority):
When a new EPS bearer is needed in an LTE network with insufficient resources, an LTE entity
(e.g. P-GW, S-GW or eNB) decides, based on ARP (an integer ranging from 1 to 15, with 1 being
the highest level of priority), whether to:
Remove the existing EPS bearer and create a new one (e.g. removing an EPS bearer with low
priority ARP to create one with high priority ARP); or refuse to create a new one.
So, the ARP is considered only when deciding whether to create a new EPS bearer or not.
8. GBR (guaranteed bit rate)
This parameter is used for a GBR type bearer, and indicates the bandwidth
(bit rate) to be guaranteed by the LTE network.

9. NON-GBR: It is applied to a non-GBR bearer with no guaranteed

bandwidth.

10. MBR (UL/DL):

MBR is used for a GBR type bearer, and indicates the maximum bit rate
allowed in the LTE network. Any packets arriving at the bearer after the
specified MBR is exceeded will be discarded.
11. TAU(Tracking area update): When UE detects that it has entered a new TA (Tracking Area)
that is not in the reported TAI list or the periodic TA update timer has expired.
TAU is of two types:
- Periodic TAU: This TAU happens when the periodic TA update timer has expired.
- Aperiodic TAU: This kind of TAU occurs when certain conditions are met, such as:
 When UE detects that it has entered a new TA (Tracking Area) that is not in the
reported list.
 When the RRC layer in the UE informs the UE's NAS layer that an RRC connection
failure (in either E-UTRAN or UTRAN) has occurred.
 The RRC connection was released with release cause "load re-balancing TAU
required".
 For a UE supporting CS fallback, or configured to support IMS voice, or both, a change
of the UE's usage setting or voice domain preference for E-UTRAN.
12. RACH- The total number of RACH preambles available in LTE is 64. These preambles are
shared among users for initial access and handover.
- Contention based: When users have a reserved signature to access the system, they are said to
be using Contention Free Random Access (CFRA).
- Non contention based: On the contrary, when users don't have a reserved signature for access
they are said to use Contention Based Random Access. CFRA is typically used during handover. A
number of the 64 preambles are normally reserved for handover only.
The 64 preambles are not implicitly communicated to the UEs by the eNodeB but rather, the UE
is informed about the process of how to generate them via parameters broadcast in SIB2. These
parameters are:
a) RootConfigurationIndex
In LTE, there are 838 root Zadoff-Chu sequences available for preambles. The length of each root
sequence is 839. RootConfigurationIndex, informs the UE via SIB2 which sequence is to be used.
b) ZeroCorrelationZoneConfig.
One root sequence can generate several preambles by cyclic shift. One or more root sequences
are needed to generate all preambles in a cell. The UE starts with the broadcasted root index and
apply cyclic shifts to generate preambles. ZeroCorrelationZoneConfig points to a table where the
cyclic shift is obtained from.
13. IMS call flow or SIP sequence:
IMS register request: UE sends IMS registration request with user agent, from/to, via information
with nonce value empty

Network response(Unauthorized): Network sends unauthorized response with nonce value.

IMS register request: UE sends SIP register message with nonce & cnonce value

IMS register response(Authorized): Network sends register response with response code 200.

Subscribe: UE sends subscribe request with route information.

Subscribe response: Network sends subscribe response with Record-route & routing ID:
Notify: UE sends notify request with Subscription state:

Notify response:

Invite: In invite message UE sends IP address, mode change capability & RTP map information.

Trying: Network sends trying message in response to the invite message:

Session progress: This message is also a response to the invite message, It contains Server
information.

IMS SIP PRACK:

IMS SIP PRACK RESPONSE:

Ringing:

SIP INVITE response:

SIP acknowledgement:

IMS VoLTE session setup: It contains information like- Direction of call (MO/MT),
originating/Terminating URI & result of session setup.

IMS VoLTE session end: This message contains VoLTE session end cause:

SIP BYE: This message contains reason of call disconnect:

14. What is Cell Reselection?

Ans) * UE in IDLE mode, wakes up at the end of every DRx cycle to measure the
signal of its Serving cell(Qrxlevmeas) and calculate received signal strength
(SrxLev) and received signal Quality(Squal) to decide whether it should stay or move to
another cell.
* If SrxLev is greater than specified threshold value ,the UE stays in current serving
cell, and if not, it triggers a "CELL RESELECTION" procedure.(The threshold value is
specified through SIB 3).
* There are 2 methods for selection of a cell:
 i) Cell Ranking.( For Intra-Freq cell reselection & Inter-
Freq cell reselection with same cell priorities)
ii) Priority based.
* Following are the scenarios of "CELL RESELECTION":
1) LTE-LTE Intra Frequency Cell Reselection.
 If SrxLev > S-IntraSearchP [SIB 3] or
Squal > S-IntraSearchQ [SIB 3]......{ received
signal quality}
Then UE may not perform Intra-frequency measurements.
If the serving cell's evaluation result does NOT meet above criteria, UE
perform intra frequency measurement.
If neither of s-IntraSearchP nor s-IntraSearchQ is specified, UE applies the
default value (s-IntraSearchP = Infinity, s-IntraSearchQ = 0). It implies that
if neither of s-IntraSearchP and s-IntraSearchQ are specified, UE always
perform intra frequency measurement
In IntraFrequency cell reselection, among the neighboring cells with
SrxLev greater than threshold, the cell with the Highest SrxLev is selected
by means of "Cell Ranking" method.

2) LTE to LTE Non Intra Frequency Cell Reselection.

 If SrxLev > S-NonIntraSearchP [SIB 3] or

Squal > S-NonIntraSearchQ [SIB 3].

Then UE may not perform Non Intra-frequency measurements.

If the serving cell's evaluation result does not meet above criteria, UE
perform non intra frequency measurement.
If neither of s-NonIntraSearchP nor s-NonIntraSearchQ is specified, UE
applies the default value (s-NonIntraSearchP = Infinity, s-
NonIntraSearchQ = 0). It implies that if neither of s-NonIntraSearchP and
s-NonIntraSearchQ are specified, UE always perform non intra frequency
measurement.
In NonIntraFrequency cell reselection, among the neighboring cells with
SrxLev greater than threshold, the cell with the Highest SrxLev is selected
by means of "Cell Ranking" method only when priorities of both serving
and target cell is same.and if incase of different priorities then Priority
based method is used for reselection.

3) WCDMA to LTE Cell Reselection.

UE must measure the LTE frequencies and detect the available LTE cell in order
to perform cell reselection to LTE.
UE measures two physical properties called for WCDMA signal. One is CPICH
RSCP and CPICH EcNo. RSCP determines SrxLev and EcNo determines Squal.

Srxlev = Qrxlevemeas - qRxLevMin. Qrxlevemeas is RSCP level measured by UE

and qRxLevMin is the value specified in SIB.

Squal = Qqualmeas - qQualMin. Qqualmeas is EcNo level measured by UE and

qQualMin is the value specified in SIB.

In following condition, detection measurements of lower priority LTE frequency

is not required.
Srxlev > s-PrioritySearch1 (SIB 19 of WCDMA)
Squal > s-PrioritySearch2 (SIB 19 of WCDMA)

In following condition, UE should detect for both lower and higher priority LTE
frequencies.
Srxlev <= s-PrioritySearch1 (SIB 19 of WCDMA)
Squal <= s-PrioritySearch2 (SIB 19 of WCDMA)

 High Priority WCDMA cell to Low priority LTE cell:

If SrxLev< s-PrioritySearch1 and Squal <s-PrioritySearch2 then
measurements of Low Priority LTE freqs are done.

And the reselection is performed when:

SrxLev(serving cell) < threshServingLow
{threshServingLow is serving cell threshold when performing high
priority to low priority cell reselection}

and SrxLev (Target cell) > threshXLow P

{threshXLowP is target cell threshold when performing high priority
to low priority cell reselection}

 Low Priority WCDMA cell to High Priority LTE cell:

If LTE frequency is of higher priority, measurements are always
performed and at a time 4 LTE frequencies can be measured.

And the reselection is performed when:

SrxLev(serving cell) < threshServingHigh
{threshServingHigh is serving cell threshold when performing low
priority to high priority cell reselection}

and SrxLev (Target cell) > threshXHighP

{threshXHighP is target cell threshold when performing low priority
to high priority cell reselection}
 4) LTE to WCDMA Cell Reselection.

 High Priority LTE to Low Priority WCDMA Cell:

When LTE cell has higher priority than WCDMA, it would stay in LTE
cell but it performs measurement for the low priority WCDMA if UE is
under the following condition :

Srxlev of the serving cell < sNonIntraSearchP (SIB3)

where Srxlev = Qrxlevmeas - qRxLevMin (SIB1)

where Qrxlevemeas = measured RSRP level, qRxLevMin =
minimum RSRP level for camping.

If UE in LTE cell is under the following condition with the

duration longer than tReselectionUtra (SIB6) it should reselect
to WCDMA cell.
Srxlev ofLTE cell (serving cell) < threshServingLow (SIB3)
where Srxlev = Qrxlevmeas - qRxLevMin (SIB1)
where Qrxlevemeas = measured RSCP level, qRxLevMin =
minimum RSCP level for camping

 Low Priority LTE to High Priority WCDMA Cell:

When LTE cell has lower priority than WCDMA.The UE
always have to perform measurements on WCDMA cell. How
often UE has to measure for WCDMA depends on condition:

Srxlev of the serving cell < sNonIntraSearchP (SIB3)

If no parameter is set (meaning in default condition), detection
of WCDMA cell should be performed at least every 60 seconds.

If UE in LTE cell is under the following condition with the

duration longer than tReselectionUtra (SIB6), it should reselect
to WCDMA cell.

Srxlev of WCDMA cell > threshXHighP (SIB6),

where Srxlev = Qrxlevmeas - qRxLevMin (SIB1),
where Qrxlevemeas = measured RSCP level, qRxLevMin =
minimum RSCP level for camping
15. What is CSFB [Circuit Switch FallBack]?

Ans) * LTE is an all-IP network with no CS support. To support voice

communication operators have many options.
  Voice Over LTE
 Voice Over WiFi
 CS Fallback

* When the CSFB UE is turned on, it registers itself in the two networks: LTE and legacy network
(CS).

And to allow quick transfer to the legacy network (either 2G or 3G) when necessary, the LTE
network needs to know the location of the UE.

For this, the MME, which tracks the location of the UE in the LTE network, continuously provides
location information to the legacy MSC, using the new SGs interface.

* When a UE or mobile phone starts a voice call the network move the UE to a legacy UMTS (3G)
or GSM (2G) network. The UE use the legacy network to initiate the call and complete the call.
After the call is over UE again move back to the LTE network.

* When in legacy network (3G/2G) the UE can have PS data sessions. PS data is supported in 2G
network only when DTM (Dual Transfer Mode) is supported. When UE supports DTM it can have
both voice and data simultaneously.

*The network must support the SGs(between MSC & MME) interface to support CS Fallback.

* LTE MO CS Fallback Call Flow

Initially UE is registered on EUTRAN network and is idle state. This is the precondition.
When UE starts the call it goes from idle to active state. The eNodeB now redirect the UE to a
legacy network.

This is done through the RRC Connection Release message. This message contains the IE
“REDIRECTED CARRIER INFO” It also has the details about the target UARFCN(WCDMA)
or ARFCN(GSM).

When UE receives this message it tune into the target network. Let’s consider the target network
is UTRAN.

In the target network the UE reads the MIB (Master Information Block) and other required
System Information Blocks

The next step is to start the RRC connection procedure to initiate the voice call in UTRAN
network.
LTE MT CS Fallback Call Flow

In case of MT call, our UE is registered and is in LTE network. It receives a “CS SERVICE
NOTIFICATION” EPS mobility management message for an incoming call. The LTE network
will redirect the UE to UMTS network to complete the call.

CS Service Notification message: This message is sent by the network when a paging request
with CS call indicator was received via SGs for a UE, and a NAS signaling connection is already
established for the UE.

In response to this the UE sends the “EXTENDED SERVICE REQUEST”message. In this

message it mention the service type as “mobile terminating CS fallback”.

Also, it sets that the CSFB request is accepted by the UE.

After receiving this message, the UE prepares itself for CSFB procedure. It starts the timer T3417.

The network then sends the RRC Connection Release message with “redirected carrier info”.

The UE does a IRAT Redirection. After moving to WCDMA it reads the MIB and necessary SIBs.

Then it triggers the RRC Connection Request with cause “terminating conversational call”.

* If you have active data connection while performing CSFB then there are two options:

 The data are also transferred to the legacy network, or

 The data are temporarily suspended, until I return to the LTE network.

* After the end of CSFB call :

 The upper layers forcing the 'reselection' to LTE so that the UE enters idle mode in legacy
network.
 The operator send LTE 'redirection' information in RRC connection release message of
legacy 3G network after the call is finished. This will result again in reselection to LTE.
 The lower layers reselect to LTE if the reselection criterion is satisfied. In most cases,
operators have their parameters set such that the reselection to LTE happen if there is a
good LTE coverage area overlapping the legacy network.
 And specifically in case of "MO CSFB" call the UE performs Tracking Area Update as
soon as it returns to LTE network.
16. What is SRVCC[ Single Radio Voice Call Continuity]?

Ans) The SRVCC is a handover process of a voice call previously started in the LTE (VoLTE
call) to the legacy network for call continuity.

It is a call transfer method (handover), when an LTE user has an active voice session in IMS
and is moving to areas without LTE coverage, but with legacy 2G/3G coverage.

The main advantage is that the call will not drop and will only be transferred to the CS domain
of the legacy networks.

If in the above case the UE moves out of LTE coverage area with an active call (but goes to a
legacy 2G/3G coverage), the continuity of this active voice call must be maintained. In this case,
the SRVCC is used, the procedure where the context of an active voice call on the IMS is
transferred to the CS legacy network.

If the SRVCC is not supported, the call is dropped as soon as it leaves the LTE coverage area.

If the SRVCC is supported, a set of messages are exchanged, and the voice call is transferred
(handover) from LTE IMS to CS domain

There are two versions of SRVCC:

 SRVCC handover to GSM or UMTS, defined by 3GPP;

 SRVCC Handover to 1xRTT networks defined by the 3GPP2.

To allow SRVCC both the UE and LTE networks, as also the legacy, must support SRVCC. For
this, a new special SV interface is introduced between the MME and the MSC, which runs on
GTPv2 protocol.

To support SRVCC, the IMS network should also include an application server, called SCC AS
(Server Centralization and Continuity Application Server).

This application server manages the signaling required for the SRVCC process.

SRVCC Procedure:
*Realizing that its LTE signal level begins to decrease, the UE with an active IMS voice session
signals it to the eNodeB, initiating the SRVCC handover.

*The eNodeB then identifies the best available network to receive the service, and sends the
handover request (specifying that it is the SRVCC type) to the MME.

*The new voice call request is then sent to the IMS, using a SR STN (Session Transfer Number
for SRVCC) - a unique number that is generated by each UE, and is stored in HSS.

*This unique number is sent by the MME to the HSS when the UE firts comes into contact with
the network.

*Upon receiving the STN SR number, the SCC AS believes that the corresponding call should be
transferred to a different network network, and starts the redirecting process for the transfer point
(handover) to the legacy network.

*After resource preparation is completed, the MME confirms the handover request, previously
provided by the eNodeB.

*The eNodeB then transmits this acknowledgment to the UE, while still providing the required
information about the target network.

*In the final stages, the UE is detected in legacy networks, and the call is re-established in it.

*This is the completion of the SRVCC handover.

*Voice packets and also packets that are not voice can be transferred using this method, but the
data rates will be limited by the capabilities of the legacy networks.

17. Entities of IMS Architecture?

Ans)  The different entities in IMS architecture are

1) P-CSCF: * Proxy- Call Session Control Function.

* The P-CSCF is the user to network proxy. In this respect all SIP signalling to and
from the user runs via the P-CSCF whether in the home or a visited network.

*When any user registers with the IMS network, the registration signalling will pass
through the P-CSCF.

*The P-CSCF supports several important functions:

 • Validates the correctness of SIP messages with IMS UEs according to SIP
standard rules.
• Ensures the security of the messages between UEs and the IMS network using
IPsec or TLS security associations.
• Authenticates and asserts the identity of the UE.
• Compresses the messages ensuring the efficient transmission of SIP messages
over narrowband channels.

*The P-CSCF may support Policy Enforcement capabilities for authorizing media plane
resources, bandwidth, and QoS management.

*In addition, the P-CSCF can also generate charging information to be collected by
charging network nodes.

2) I-CSCF: *Interrogating Call Session Control Function.

* The I-CSCF is a SIP proxy located in the edge of an administrative IMS domain. Its IP
address is published in the Domain Name System (DNS) of the domain so that remote
servers can find and use it as a forwarding point (e.g., registering) for SIP packets to this
IMS domain.

*The I-CSCF implements a Diameter interface to the HSS (Home Subscriber Server), and
queries the HSS to retrieve the address of the S-CSCF for an UE to perform SIP
registration.

* Being a SIP proxy, the I-CSCF forwards SIP message requests and responses to the S-
CSCF. Additionally, the I-CSCF may encrypt parts of the SIP messages securing any
sensitive information.

*Typically the IMS network includes a number of I-CSCF nodes for the purpose of
scalability and redundancy. The I-CSCF is usually located in the IMS home network.

3) S-CSCF : *Serving Call Session Control Function.

* The S-CSCF is a central function of the signalling plane in the IMS core network.

*A S-CSCF node acts as a SIP registrar, and in some cases as a SIP redirect server. It is
responsible for processing the location registration of each UE, user authentication and call
routing and processing.

*Similar to the I-CSCF, the S-CSCF supports Diameter Cx and Dx interfaces to the HSS
to download the authentication information and user profile of the registering UEs from
the HSS for authentication purpose.
*All of the SIP signalling from/to the IMS UEs traverses their serving S-CSCF allocated
during the registration process.

*The S-CSCF also provides SIP message routing and services triggering. It also enforces
the policy of the network operator and keep users from performing unauthorized
operations.

*The S-CSCF is always located in the home network

4) SLF : * Subscriber Location Function

* The subscriber location function, or SLF is an entity within an IP

multimedia subsystem that provides information about the home subscriber
server (HSS) that is associated with a particular user profile. It is generally
implemented using a database. If the home domain contains more than one
HSS, I-CSCF and S-CSCF will communicate with SLF and find the appropriate
HSS based on user profile

5) HSS : * Home Subscriber Server.

* The IMS HSS or home subscriber server is the main subscriber database used
within IMS.
*The IMS HSS provides details of the subscribers to the other entities within the
IMS network, enabling users to be granted access or not dependent upon their
status.
*When a subscriber registers onto an IMS network, the subscription data is
retrieved from the HSS by the Serving-CSCF, S-CSCF that has been assigned to
the subscriber.

*Subscription data is transferred from the HSS to the S-CSCF

Charging subscription data is sent from the HSS to the P-CSCF via the S-CSCF.

*IMS public user identity data which is also kept in the S-CSCF is forwarded to the
user equipment

*Service subscription data is forwarded from the HSS to the SIP-AS via the S-
CSCF. This enables charging for the services to be managed.

6) Breakout gateway control function, BGCF: This entity within the IMS architecture
selects the network in which a PSTN breakout is to occur. If this is to occur in the same
network as the BGCF, then the BGCF selects a media gateway control function, MGCF

7)Media gateway control function, MGCF: This entity interworks the SIP signalling.
It manages the distribution of sessions across multiple media gateways.
 8)Media server function control, MSCF: This manages the use of resources on media
servers.

9)SIP applications server, SIP-AS: The SIP-AS is a service execution platform on

which one or more services are deployed.

18. Explain IMS Registration Process?

Ans) The first place all IMS message go through is P- CSCF. Roughly there are several different
ways of finding (discovering) P-CSCF as listed below.
 PCO (Protocol Configuration Option) in Activate default EPS bearer context request
 DHCP process.
 UE provisioning (Configuration Files or variables stored in UE)
 UICC(USIM/ISIM)

If the IMS is serviced via a mobile network (e.g, LTE), it would be more likely for a UA to find
P-CSCF IP address via PCO or some predefined configuration in UE.

*The P-CSCF IP address obtained is stored.

* The subscriber extracts the user public identify from the ISIM module of the USIM.
* The SIP terminal allocates the subscriber side client and server ports. These ports will be
included in the “REGISTER” message sent to the P-CSCF.

* The subscriber sends a “REGISTER” message to inform the network that the specified user
public identify is available at the IP address indicated in the Contact Header. The User Equipment
(UE) also adds a via header to record that the message had traversed the UE. The “REGISTER”
message also includes the server and client ports. The message itself is sent on the standard SIP
port 5060. The SIP “REGISTER” message also includes the private identity of the user. This identity
will be used by the S-CSCF and HSS to identify the user.
* The P-CSCF receives the “REGISTER” message and uses the DNS to translate from the domain
name to the IP address of the home network.(IP address of the I-CSCF)
* The “REGISTER” message will be routed to the IP address of the I-CSCF obtained from the DNS
response. Now the integrity protection flag is set to false to signify that the user has not been
authenticated.
*The I-CSCF queries the HSS using "User Authorization Request" message to assign this user a
S-CSCF by providing the user's private identity present in the “REGISTER” message . The HSS
replies with the S-CSCF name and S-CSCF capabilities in "User Authorization Answer" message.
* I-CSCF selects the S-CSCF based on the S-CSCF capabilities. The I-CSCF forwards the “REGISTER”
message to the selected S-CSCF.
*The selected S-CSCF sends user's private identity in "Media Authentication Request " message
to the HSS , to which the HSS replies with the Random number (RAND), Authentication token
(AUT), signed result (XRES), Cipher key (CK) and Integrity Key (IK) in "Media Authentication
Answer" message.
* The S-CSCF slects and saves the selected authentication vectors.
* The user is currently not authenticated, so the registration request is rejected. The terminal is
challenged to authenticate the user. RAND, AUTN, CK and IK are passed in the WWW-
Authenticate header in the “401 UNAUTHORIZED” message by S-CSCF to I-CSCF.
* The I-CSCF Passes the “401 UNAUTHORIZED” message to the P-CSCF. CK and IK are also carried
along.
* The P-CSCF saves the ciphering and integrity keys. These keys will be needed for establishing
the IPSec security association. The P-CSCF allocates the subscriber side client and server ports.
These ports will be included in the “401 UNAUTHORIZED” message sent to the Subscriber.
* P-CSCF passes the RAND and AUTN values to the subscriber. The CK and IK are removed from
the WWW-Authenticate header. The P-CSCF side client and server ports are also included in the
message. The message itself is sent on the standard SIP port 5060.
*The subscriber Authenticate the IMS network by verifying the authentication token (AUTN). Also
compute the RES value that will be passed back to the IMS network for user authentication
*Now the IPSec SA is being established between the UE and P-CSCF for all the client and server
ports of UE and P-CSCF.
* The Subscriber has now established the IPSec security associations with the P-CSCF. At this
point, the SIP “REGISTER” message is sent again. This time the message is protected by IPSec and
the message is addressed to the P-CSCF server port passed in the “401 UNAUTHORIZED”
message. The message contains the RES in the Authorization header.
*The P-CSCF Pass the “REGISTER” message to the I-CSCF. This time the Authorization header
indicates that integrity protection is enabled.
*The I-CSCF queries the HSS in "User Authorization Request" to assign this user a S-CSCF using
the user's private identity and the HSS in response replies with the S-CSCF names and capabilities
in the "User Authorization Answer" message.
*The I-CSCF selects the S-CSCF based on its capabilities and then finally the integrity protected
“REGISTER” message is sent to the S-CSCF.
*Upon receiving the “REGISTER” message the S-CSCF queries the HSS to provide all the
subscriber related information in "Server Assignmet Request" and it receives all the subscriber
related information in "Server Assignment Answer" message.
*The S-CSCF now compares the "RES" reported in “REGISTER” message by UE with the "XRES"
received during "Media Authorizaton Answer" message from HSS.
*If matched the S-CSCF replies back with success in "200 OK" message.
*This success "200 OK" message is relayed back to the UE via I-CSCF and P-CSCF. And finally the
registration of the UE in IMS is achieved.
Q) What are the diiferent headers used in Registration Procedure?
Ans) f( From) :- ID of the initiator of the REGISTER message.

t (To):- ID of the user to be registered; identical to ‘f’ header.

tag:- Used for identification , if multiple requests are originated by the same UE.
  Cseq( Command Sequence):- Consists of Sequence number and a method.It is
initialized at the start of the call and incremented for each new request except for
“CANCEL” and “ ACK” requests.

Call Id(i):- Unique identifier to identify messages belonging to that call.All messages
within this session will have the same Call-Id.

via(v):- Records the route taken by the Request, so the originator can be reached for
RESPONSES to this request.

contact (m):- IP address ,port,and unique device identifier where the UE can be reached
for further REQUESTS.
{**via header tells other elements where to send the RESPONSE, whereas the contact
header tells other elements where to send the further REQUESTS..**So if a party sends
RESPONSE to a REQUEST it sends it to the via header’s address but if a party sends a
REQUEST it will send it to contact header’s address.}

Max-Forwards:- Limits the number of hops a request can transit on the way to its
destination and is decremented by 1 at each hop.

P-Access-Network-Info:- Indicates the RAN technology used to send the REQUEST.

Global Cell ID is also present.

Route:- It indicates the IP address of the next hop or next destination where the
REQUEST message will be forwarded.

Content-Length(l):- Size of the message body in bytes. This field is set to zero ‘0’ for
REGISTER message as it only contains headers.

Expires:- Indicates the duration where the REQUEST remains valid in seconds. If Expire
header is not present, the REGISTER message expires in 3600 seconds( default).

19. Explain RRC states?

Ans) *There are 2 RRC states defined for the UE. When a UE is powered ON it will be in the
RRC IDLE state until the RRC connection is established.

*A UE is in RRC_CONNECTED when an RRC connection is established.

*RRC_IDLE:
The radio is inactive but IP address is assigned and tracked by the network. UE is known in EPC
but not known to eNB (LTE base station)
Major procedures defined in IDLE mode:
PLMN Selection: Detect PLMN of cells and identify the cell to clamp on.
Cell Selection and Reselection : Performs neighboring cell measurement and
do reselection.
CSG cell selection and reselection
Cell Reservations and Access Restrictions
Tracking Area Registration
Broadcast message reception: Acquire MIB and SIB
Paging: Monitors the paging channel
DRX reception

*RRC_CONNECTED:
The radio is active and UE is known to both EPC and eNB.
Mobility is controlled by Network.
Major procedures defined in CONNECTED mode:
Control Plane
eNB context and RRC connection
Network can transmit and/or receive data to/from UE
Neighbor cell measurement
User Plane
UE can transmit and/or receive data to/from network
Monitors control signaling channel
Reports CQI and feedback information to eNB.
Connected Mode DRX
 20. Explain RACH procedure?
Ans) Random Access Procedure: In order to be synchronized with the network, RACH
procedure is used.
Suppose a UE wants to access the network, so first it will try to attach or synchronize with the
network. In LTE a separate channel PRACH ( Physical Random Access Channel) is provided for
initial access to the network.

* Need to perform Random Access Procedure:

As per specifications, RACH can be performed in below mentioned scenarios :-

 Initial Access - UE is trying to access the network in RRC idle state.

 During RRC connection re-establishment procedure.
 Handover
 When uplink synchronization is lost :- It means from a certain duration network has not received
anything from UE in uplink.
 When UE does not have any PUCCH resources available for SR(Scheduling Request) .
 When timing advance is needed for positioning purpose in RRC connected state for UE.

To initiate the procedure UE lower layes will send a Random Access Request(RACH Request)
after receiving request from UE RRC.

When to send RACH :

It is decided on the basis of parameters received in SIB2 PRACH configurations.
UE can use 6 Resource blocks for sending the RACH Request.

1.PRACH Config Index - There is a mapping from which UE can find the available sub frames
where it can send a RACH.

2.PRACH Frequency Offset - This value is also received in SIB2 by UE. It governs which
frequency resource UE can use for the RACH Req.
Example: If the value of PRACH Freq Offset is 10. UE can use the 6 PRB's starting from PRB
10 for RACH Request.

What RACH contains:

1.Preamble Index :- There are total of 64 preambles available which are divided into two
groups Group A and Group B. UE decides the preamble index from a group on the basis of
parameters received in SIB2:-

numberofRaPreambles :- eNodeB sends this value in SIB2 which denotes the total number of
preambles available for UE to send a Rach Request.

SizeOfRaPreamblesGroupA: - It represents the number of preambles available within Group

A.

So number of preamble in Group B = numberofRaPreambles - sizeOfRaPreamblesGroupA

MessageSizeGroupA: - It is used for selecting a preamble from a group. Its value is in bits.

Now UE needs to decide the group from which it needs the preamble. Group is decided on the
basis of size of MSG 3(RRC connection request).

If Msg3 size > messageSizeGroupA, preamble will be selected from Group B

else preamble will be selected from Group A
This is how UE decides the Group. From the selected group, randomly UE selects a preamble
index.

Power used to send RACH:

UE need to decide the power which will be used for RACH Request transmission. Power is
decided on the factors received in SIB2 as:-

1.preambleInitialReceivedtargetPower:- Power factor which will be used for first transmission

of Rach Request. Value varies from -120dBm to -90 dBm.

2.powerRampingStep:- This is mainly used when eNodeB is not able to detect the Rach
Request then UE will re transmit the RACH Request by increasing the power
to powerRampingStep factor.

Power used for Rach Request transmission =

preambleInitialReceivedTargetPower + DELTA_PREAMBLE +
(PREAMBLE_TRANSMISSION_COUNTER – 1) *powerRampingStep

EXAMPLE: First Transmission of Rach Request:-

PREAMBLE_TRANSMISSION_COUNTER = 1
For preamble format 0, DELTA_PREAMBLE = 0
Power used = -100 + 0 + (1- 1) *2
= -100

Suppose eNodeB is not able to receive it

Second transmission of Rach request:-
PREAMBLE_TRANSMISSION_COUNTER = 2
Power used = -100 + 0 + (2-1) * 2
= -98

UE will send the RACH Request containing these values in the specified subframe by using the
specified resources.

 eNodeB’s behavior after receiving RACH from UE:

 1. Allocation of temporary RNTI (Radio Network temporary Identifier): After
receiving RACH Request, enodeB allocates a temporary identity to the UE which is
made permanent after successful RACH procedure. The permanent identity is called as
CRNTI (Cell RNTI). This TC-RNTI is transmitted to the UE as part of RACH
Response which will be used for further communication between the UE and the
network.

2. Timing Advance: - After receiving RACH Request, eNodeB PHY (Physical layer)
calculates the timing advance which is transmitted to the UE as part of response
message.

*As part of Rach response, absolute Timing advance value is transmitted.

3. Allocate uplink Resources (UL GRANT):- eNodeB will provide the required
information in Random Access Response (RAR) message for UE to send the MSG3(
RRC Connection Request) .

21. Explain Session Initiation Protocol?

ANS) Numerous protocols have been authored that carry various forms of real-
time multimedia session data such as voice, video, or text messages. The Session
Initiation Protocol (SIP) works in concert with these protocols by enabling Internet
endpoints (called user agents) to discover one another and to agree on a characterization of
a session they would like to share. For locating prospective session participants, and for
other functions, SIP enables the creation of an infrastructure of network hosts (called proxy
servers) to which user agents can send registrations, invitations to sessions, and other
requests.
SIP is an agile, general-purpose tool for creating, modifying, and terminating sessions
that works independently of underlying transport protocols and without dependency on the
type of session that is being established.
 SIP is an application-layer control protocol that can establish, modify, and
terminate multimedia sessions (conferences) such as Internet telephony calls.
SIP can also invite participants to already existing sessions, such as multicast
conferences. Media can be added to (and removed from) an existing session.

SIP supports five facets of establishing and terminating multimedia

Communications:

*User location: determination of the end system to be used for

 communication;

*User availability: determination of the willingness of the called

party to engage in communications;

*User capabilities: determination of the media and media parameters

to be used;

*Session setup: "ringing", establishment of session parameters at

both called and calling party;

*Session management: including transfer and termination of sessions,

modifying session parameters, and invoking services.

SIP is rather a component that can be used with other IETF protocols to
build a complete multimedia architecture. Typically, these architectures will
include protocols such as the Real-time Transport Protocol (RTP)for transporting
real-time data and providing QoS feedback, the Real-Time streaming protocol
(RTSP)for controlling delivery of streaming media, the Media Gateway Control
Protocol (MEGACO)for controlling gateways to the Public Switched Telephone
Network (PSTN), and the Session Description Protocol (SDP)for describing
multimedia sessions. Therefore, SIP should be used in conjunction with other
protocols in order to provide complete services to the users.

SIP works with both IPv4 and IPv6.

Following Figure shows a typical example of a SIP message exchange between

two users, Alice and Bob. (Each message is labeled with the letter "F" and a
number for reference.)
In this, Alice Uses a SIP application to call Bob on his SIP phone over the
Internet.
This typical arrangement is often referred to as the "SIP trapezoid".
The first line of the text-encoded message contains the method name
“INVITE”.
The details of the session, such as the type of media, codec, or sampling rate,
are not described using SIP. Rather, the body of a SIP message contains a
description of the session, encoded in some other protocol format. One such
format is the Session Description Protocol (SDP). This SDP message is carried
by the SIP message.
The INVITE is sent to the SIP server that serves Alice's domain. The address
of the that SIP server could have been configured in Alice's softphone, or it
could have been discovered by DHCP.
The proxy server receives the INVITE request and sends a 100 (Trying)
response back.
The 100 (Trying) response indicates that the INVITE has been received and that
the proxy is working on her behalf to route the INVITE to the destination. Responses in SIP
use a three-digit code followed by a descriptive phrase.
Bob's SIP phone receives the INVITE and alerts Bob to the incoming call from
Alice so that Bob can decide whether to answer the call and Bob’s phone sends
180 Ringing response
When Alice's softphone receives the 180 (Ringing) response, it passes this
information to Alice, perhaps using an audio ringback tone or by displaying a
message on Alice's screen.

Bob decides to answer the call. When he picks up the handset, his SIP phone sends a 200 (OK)
response to indicate that the call has been answered. The 200 (OK) contains a message body with
the SDP media description of the type of session that Bob is willing to establish with Alice.
Finally, Alice's softphone sends an acknowledgement message, ACK, to Bob's SIP phone to
confirm the reception of the final response (200 (OK)).
This completes the INVITE/200/ACK three-way handshake used to establish
SIP sessions.
Alice and Bob's media session has now begun, and they send media packets
using the format to which they agreed in the exchange of SDP. In general, the
end-to-end media packets take a different path from the SIP signalling messages.

During the session, either Alice or Bob may decide to change the
characteristics of the media session. This is accomplished by sending a re-
INVITE containing a new media description. This re-INVITE references the
existing dialog so that the other party knows that it is to modify an existing
session instead of establishing a new session. The other party sends a 200 (OK)
to accept the change.
The requestor responds to the 200 (OK) with an ACK. If the other party does
not accept the change, he sends an error response such as 488 (Not Acceptable
Here), which also receives an ACK. However, the failure of the re-INVITE
does not cause the existing call to fail , the session continues using the
previously negotiated characteristics.

If Bob did not wish to answer the call or was busy on
another call, an error response would have been sent instead of the
200 (OK), which would have resulted in no media session being
established.

At the end of the call, Bob disconnects (hangs up) first and
generates a BYE message. This BYE is routed directly to Alice's
softphone, again bypassing the proxies. Alice confirms receipt of
the BYE with a 200 (OK) response, which terminates the session and
the BYE transaction. No ACK is sent

22. SIP MESSAGES:

A SIP message is either a request from a client to a server, or a
response from a server to a client.

Both Request and Response messages use the basic format of , even though the syntax differs
in character set and syntax specifics.
 Both types of messages consist of a start-line, one or more header fields, an
empty line indicating the end of the header fields, and an optional message-body.

generic-message = start-line
*message-header
CRLF
 [ message-body ]
start-line = Request-Line / Status-Line

The start-line, each message-header line, and the empty line MUST be terminated by a carriage-
return line-feed sequence (CRLF). Note that the empty line MUST be present even if the message-
body is not.

REQUESTS
SIP requests are distinguished by having a Request-Line for a start-line. A Request-Line
contains a method name, a Request-URI, and the protocol version separated by a single space “SP”
character.
Request-Line = Method SP Request-URI SP SIP-Version CRLF

** Method: This specification defines six methods: REGISTER for

registering contact information, INVITE, ACK, and CANCEL for
setting up sessions, BYE for terminating sessions, and
OPTIONS for querying servers about their capabilities.
**Request-URI: The Request-URI is a SIP URI that indicates
the user or service to which this request is being addressed.

SIP elements MAY support Request-URIs with schemes other than "sip" and
"sips", for example the "tel" URI.SIP elements MAY translate non-SIP URIs
using any mechanism at their disposal, resulting in SIP URI, SIPS URI.

RESPONSES
SIP responses are distinguished from requests by having a Status-Line
as their start-line.
A Status-Line consists of the protocol version followed by a numeric Status-
Code and its associated textual phrase, with each element separated by a single
“SP” character.
Status-Line = SIP-Version SP Status-Code SP Reason-Phrase CRLF

The Status-Code is a 3-digit integer result code that indicates the outcome of an
attempt to understand and satisfy a request. The Reason-Phrase is intended to
give a short textual description of the Status-Code. The Status-Code is intended
for use by automata, whereas the Reason-Phrase is intended for the human user.

The first digit of the Status-Code defines the class of response. The last two
digits do not have any categorization role. For this reason, any response with a
status code between 100 and 199 is referred to as a "1xx response", any response
with a status code between 200 and 299 as a "2xx response", and so on.
SIP/2.0 allows six values for the first digit:
 **1xx: Provisional -- request received, continuing to process the
request;

**2xx: Success -- the action was successfully received, understood,

and accepted;

**3xx: Redirection -- further action needs to be taken in order to

complete the request;

**4xx: Client Error -- the request contains bad syntax or cannot be

fulfilled at this server;

**5xx: Server Error -- the server failed to fulfill an apparently

valid request;

**6xx: Global Failure -- the request cannot be fulfilled at any server.

23. Explain the purpose of IPSec?

ANS) IPSec is an Internet Engineering Task Force (IETF) standard suite of
protocols that provides data authentication, integrity, and confidentiality
as data is transferred between communication points across IP networks.
 IPSec provides data security at the IP packet level.
 It uses Cryptography to provide Security.

*The main components of IPSec are mentioned below.

Authentication Header or sometimes called as AH
Encapsulating Security Payload or ESP
Internet Key Exchange Protocols or IKE

*IPsec involves two security services:

 Authentication Header (AH): This authenticates the sender and it discovers any changes in
data during transmission.
 Encapsulating Security Payload (ESP): This not only performs authentication for the
sender but also encrypts the data being sent.

Authentication header is used for authentication, and also for data integrity protection.
Authentication Header cannot encrypt the data inside the packet. However ESP could do both
authentication as well as encryption together.
There are two modes of IPsec:

 Tunnel Mode: This will take the whole IP packet to form secure communication between
two places, or gateways.
In tunnel mode ipsec encrypts the entire ip packet along with its headers and then generates a
new header to stick on top of the encrypted ip packet.

 Transport Mode: This only encapsulates the IP payload (not the entire IP packet as in tunnel
mode) to ensure a secure channel of communication.

IPSec transport mode is very much similar to the tunnel mode with two major differences.
 It does not change the original IP header
 Also it does not create a new IP header

**PURPOSE OF IPSec:
IPSEC provides confidentiality in communication with the help of encryption
IPSEC provides integrity in communication by checking data modification, which is done
through message authentication codes (MAC)
IPSEC provides authentication of both the parties in the communication
IPSEC protects the IP packets from analysis, which means you can’t say who communication
with whom is by simply looking at the packet.

24. Powers in LTE?

Ans) **RSSI(Received Signal Strength Indicator)
RSSI is the total power UE observes across the whole band. This includes main single & co-
channel Non Serving cell, adjacent channel interference and even the thermal noise within
specified band.
RSSI provides information about total received wideband power including all interference and
thermal noise.
RSSI is calculated as linear average of total power measured across OFDMA symbols which
contains Reference Symbols for Antenna Port in the measured BandWidth over “N” resource
blocks.
RSSI includes Power from:-
1) Co-channel Serving Cells {cells using same set of channels}
2) Non Serving cells {Neighbouring cells}
3) Adjacent Channel Interference
4) Thermal Noise
RSSI = Noise + Serving cell power + interference power
*RSSI = Stot + Itot + Ntot;
Where Stot = x*N*RSRP ;
Where N= no. of RBs & x = [RE/RB]
So the RSSI in absence of Noise & Interference will be,
RSSI = x* N* RSRP.
 The RSSI in terms of RSRP & RSRQ is,
RSSI = N* [RSRP/RSRQ]

** RSRP (Reference Signal Received Power)

RSRP is the average of Reference Signal Power across Specified BandWidth in the no. of
Resource Elements.
It is also defined as linear average of the power contributions of the REs that carry Cell-Specific
Reference Signals within considered measurement frequency Bandwidth.
RSRP is calculated for useful part of OFDMA symbol and not considering cyclic prefix.
Antenna Connector of the UE is considered as Reference Point.
RSRP measurements are mapped to integer values ranging from 0-97 before including in the
RRC messages.
While measuring RSRP , UE measures the power of multiple Resource Elements used to transfer
the Reference Signal and then takes an average of them. [ “1” OFDMA symbol carries “2” REs
carrying Reference Signal ]. Reference Signals are positioned in OFDMA symbols ‘0’ & ‘4’ in
time domain.
The reporting range of RSRP is defined from -140dbm to -44dBm with 1dBm resolution. These
are mapped from 0-97 where {0 = -140dBm & 97 = -44dBm}.
And usable signal usually ranges from -75dBm close in to a cell site to -120dBm at cell edge.
Usages of RSRP.
1) Cell Selection
2) Cell Reselection
3) Handover
4) Estimating path loss for power calculations
5) Mobility measurements.

RSRP in terms of RSSI:

 RSRP(dBm) = RSSI(dBm) – 10 log (12*N)
Where N = no. of Resource Blocks.
Following table shows no.of RBs present in particular BW measurement;
BandWidth 1.4MHz 3MHz 5MHz 10MHz 15MHz 20MHz
RBs 6 15 25 50 75 100

** RSRQ ( Reference Signal Received Quality)

 RSRQ is a better metric to get details about channel quality and whole BandWidth.
It indicates the quality of Received Reference Signal.
It provides additional information when RSRP is not sufficient to make a reliable handover or
cell reselection decision {RSRP & RSRQ both are used in handover procedure}. But both must be
measured over the same Bandwidth.
Reporting range of RSRQ ranges from -3dB to -19.5dB which is mapped onto integer values
ranging 0 to 34.
The reference point for RSRQ measurement is also the Antenna connector of UE.
RSRQ depends upon the Serving cell power and the no. of Transmitting Antennas.
RSRQ is used for:
1) Cell Selection
2) Cell Reselection
3) Handover
4) Mobility measurements.

RSRQ in terms of RSRP and RSSI :

RSRQ = {N*[RSRP/RSSI]} OR RSRQ = { [RSRP]/[RSSI/N] }.

**SINR (Signal to Interference& Noise Ratio)

SINR is given as :
SINR = {S/ I + N}
Where S = power of measured usable signal
I = Average interference power
 N = Background Noise
All above parameters are measured over the same Bandwidth.
SINR is a measure of signal quality, defined by UE vendor and not 3GPP. It is not reported to
network.
SINR quantifies the better relationship between RF conditions & throughput.
UE typically uses SINR to calculate CQI (Channel Quality Indicator).
Relation between SINR and RSRQ:
SINR = {1/(1/[12*RSRQ]) – x}
Where x = [RE/RB].

** BER (Bit Error Rate)

BER stands for Bit Error Rate measurement.
 It is the ratio of number of bits received in error at the receiver to the total number of bits
transmitted from transmitter.
BER =(Received bits in error/Total number of send bits)

** BLER (Block Error Rate)

BLER stands for Block Error Rate measurement.
It is the receiver measurement used in conformance testing of GPRS/EGPRS mobiles.
 Retransmission is done for the blocks which are received in error.
 BLER is the ratio of received erroneous blocks to the total number of data blocks transmitted.
BLER = (Received data blocks in error/Total number of transmitted blocks)

25. What is MRF?

Ans) MRF ( Media Resource Function)
The Media Resource Function (MRF) provides media related functions such as media
manipulation and playing of tones and announcements.
 MRF Features supporting:
- Announcement playback Voice/video Recording
- DTMF user interactivity
- Conferencing
- Tromboning
- Announcements management
- VoiceXML scripts facility

Each MRF is further divided into a media resource function controller (MRFC) and a Media
Resource Function Processor (MRFP).

 The MRFC is a signalling plane node that interprets information coming from an AS and S-
CSCF to control the MRFP
 The MRFP is a media plane node used to mix, source or process media streams. It can also
manage access right to shared resources.

MRFC Functions:
- Manages the availability of MRFP resources
- Hides to the AS for the MRFP resources
- A SIP proxy only involved into initial INVITE

MRFP:
- Interprets & processes the commands sent by the AS
- Manages the media stream
- Performs the media processing

The Media Resource Broker (MRB) is a functional entity that is responsible for both collection
of appropriate published MRF information and supplying of appropriate MRF information to
consuming entities such as the AS. MRB can be used in two modes:

 Query mode: AS queries the MRB for media and sets up the call using the response of MRB
 In-Line Mode: AS sends a SIP INVITE to the MRB. The MRB sets up the call
26. Is Antenna a Passive or Active Element and why?

 Antenna element is passive device but the antenna system may be active or passive
 Antenna element is passive device because it does not require power supply to work

27. What are the parameters to be monitored for Throughput?

The following are the parameters are monitored for throughput:-

 Bandwidth
 Channel quality
 Network load.
 A. Bandwidth: - According to 3GPP specifications LTE channel bandwidth can be 1.4, 3, 5, 10, 15, 20
MHz. The wider bandwidth the higher throughput.
B. Channel quality: - Radio conditions impact user bit rates. The better radio conditions the higher
throughput is available and vice versa.
C. Network load: - Available radio resources are divided among active subscribers. So the more
subscribers are active and receive/transmit data the less resources are allocated to a given
subscriber. It also depends on subscriber and connection priorities.

28. Explain Channel Grid (Mapping) in Detail?

LTE technology works based on three channel types viz. logical channel, transport channel and physical
channels. These channels are used by lower layers to provide services to the upper layers.
The access points to the Layer L2/L3 are transport channels. They get mapped to physical channels. These
physical channels will have different modulation code rate.
Logical channels are of two types, one carrying control information and the other carrying traffic information.
These gets mapped to transport channels as shown in the figure. The left side is downlink channel mapping
and right side is uplink channel mapping.

Physical Channels :-
 PDSCH - Stands for Physical Downlink Shared Channel, mainly used to carry high speed
data/multimedia information.
 PDCCH - Stands for Physical Downlink Control Channel, mainly used to carry UE specific control
information. It will have QPSK modulation used.
 CCPCH - Stands for Common Control Physical Channel, carries cell-wide control information. QPSK is
used.

Transport Channels
• Downlink and Uplink transport channels carry L2/L3 information.
• It also configures LTE PHY layer.
• It sends status information such as packet error and CQI to upper layers.
• Also supports peer-peer signalling between higher layers.
  Explain different layers and what is the importance of each layer and how they are being
controlled?

Physical Layer :-
 Physical Layer carries all information from the MAC transport channels over the air interface.
 Takes care of the link adaptation (AMC), power control, cell search (for initial synchronization and
handover purposes) and other measurements for the RRC layer.
Medium Access Layer:-
 MAC channel is responsible for mapping between logical channels & transport channels.

Radio Link Control(RLC):-

 RLC layer is responsible for transfer of upper layer PDUs, error correction through ARQ, segmentation

Radio Resource Control(RRC):-

The main function of RRC sublayer include:-
 broadcast of System Information related to the non-access stratum (NAS),
 broadcast of System Information related to the access stratum (AS),
 Paging, establishment, maintenance and release of an RRC connection between the UE and E-UTRAN,
Security functions including key management, establishment, configuration, maintenance and release
of point to point Radio Bearers.

Packet Data Convergence Control:-

PDCP Layer is responsible for Header compression and decompression of IP data, Transfer of data (user plane
or control plane), Maintenance of PDCP Sequence Numbers (SNs), In-sequence delivery of upper layer PDUs
at re-establishment of lower layers, Duplicate elimination of lower layer SDUs at re-establishment of lower
layers for radio bearers mapped on RLC AM, Ciphering and deciphering of user plane data and control plane
data, Integrity protection and integrity verification of control plane data, Timer based discard, duplicate
discarding, PDCP is used for SRBs and DRBs mapped on DCCH and DTCH type of logical channels.
Non –access stratum(NAS):-
 The non-access stratum (NAS) protocols form the highest stratum of the control plane between the
user equipment (UE) and MME.
 NAS protocols support the mobility of the UE and the session management procedures to establish
and maintain IP connectivity between the UE and a PDN GW.

29. What is CDRX?

 Connected Mode DRX (CDRX)
 LTE had RRC mode DRX which is also known as Connected Mode DRX (CDRX).
 The purpose of the DRX is to conserve the battery power. During RRC connected state when there is
no data transmission in either direction (UL/DL) UE goes into the DRX mode. It starts monitoring the
PDCCH channel discontinuously in other words UE is in sleep and wake cycle.
 30. Explain functionality of different channels in LTE?
 Channels in LTE network:-
There are three types of channel in LTE
A. Physical Channels:- These are transmission channels that carry user data and control message.
B. Transport Channels:- The physical layer transport channels provides information transfer to Medium
Access control layer(MAC Layer).
C. Logical Channels:- These channels provides the services for MAC layer within the LTE protocol
structure.

A. Physical channels types:-

 Physical Broadcast channel(PBCH):-
The physical channels carries system information for UEs requiring to access the network. It only carries what
is termed Master Information Block.The modulation scheme is always QPSK.
 Physical control format Indicator channel(PCFICH):-
PCFICH informs the UE about the format of the signal being received. It indicates the number of OFDM symbols
used for the PDCCH whether 1,2,or 3.
The information within PCFICH is important because the UE does not have prior information about the size of
control region.
 Physical Downlink Control channel(PDCCH):-
PDCCH contains a message known as the downlink control information.
Physical Uplink Control Channel(PUCCH):-
PUCCH provides the various control signalling requirements.

B. Transport Channels:-
 Broadcast Channel(BCCH):-
The LTE transport channel maps to broadcast control channel.
 Downlink shared channel(DL-SCH):-
This transport channel is main channel for downlink data transfer.
 Multicast channel(MCH):-
This transport channel is used to transmit MCCH information to set up a multicast transmission.
 Uplink shared channel:-
This channel is main channel for uplink data transfer. It is used by many logical channels.
 Random Access channels:-
This is used for random access requirements.

C.Logical Channels:-
 Broadcast control channel:-
This control channel provides system information to all mobile terminals connected to the eNodeB.
 Paging Control channel:-
This control channel is used for paging information when searching a unit on network.
 Common control channel:-
This channel is used for Random access information.
  Multicast Control Channel:-
This control channel is used for information needed for multicast reception.
 Dedicated control Channel:-
This control channel is used for carrying user specific control information.
EX: - for controlling action including power control, handover etc.
 Dedicated Traffic channels:-
This traffic channel is used for the transmission of user data.
 Multicast traffic channel:-
This channel is used for the transmission of multicast data.

31. Modulation Scheme Supported for Uplink and Downlink?

Orthogonal frequency division multiple-access (OFDMA) is used for the downlink, and SC- FDMA is used for
the uplink as multiple-access schemes in the LTE system.
In LTE (4G) to avoid multipath fading we use OFDMA technique in downlink. The main drawback of OFDMA is
high peek to average power ratio i.e. its drain the battery performance so we use SCFDMA in Uplink.

32. What is Integrity Key / Ciphering Key?

Ciphering
Ciphering in wireless network is based on a very simple algorithm and on a secret ciphering key. The ciphering
key generally remains identical for a communication or a data session. The same random number as for
authentication and the same secret key Kas a specific algorithm. In GSM, the calculation algorithm is
called A3 and the ciphering key is called Kc At the end of the authentication process each station can compute
the ciphering key without transmitting it over the air. A specific algorithm generates a keystream block with
the ciphering key and the sequence number. It is called algorithm A3 in GSM. The keystream block has the
same length as the message. Each bit of the message is then Xored with each bit of the keystream block. As
two successive Xor with the same sequence give back the original sequence, ciphering and deciphering are the
same process.

Integrity
In cellular systems, each data (speech, user data or signalling) is numbered with a so-call sequence number,
which is regularly incremented. Integrity uses a similar process based on an integrity key that is calculated by
means of a specific algorithm and the random number RAND. The source of the message computes an
authentication code with a specific algorithm, the integrity key and a regularly incremented counter. It
concatenates the authentication code to the transmitted message. The recipient computes the authentication
with the same method and the data it has in its memory and checks the received code and the computed code
are the same.

33. What is use of NV Browser in QXDM?

• NV browser is mainly used to change the device parameter values in 2G, 3G, 4G,
• It also shows the technology which currently used by UE,
• It also shows the preferred network type of UE.
 34. Describe LTE power on procedure.

i) Power-Up Test
ii) Frequency & Time and Frame Synchronization
iii) Decode System Information Message
iv) Select Prefered Network
v) Perform RACH Process
vi) RRC Connection Setup

35. What MIB contain

MIB contains the following information:-

i) Bandwidth
ii) System frame number
iii) PHICH

36. what SIB1&2 contain

SIB 1 contains the following information:-

i) Tracking Area code
ii) PLMN
iii) Cell selection info
iv) Frequency band indicator
v) Scheduling information of SIBs
SIB 2 is the most important SIB in LTE and it contains the following information:-
i) RACH
ii) Bcch, Pcch, Pusch, pdsch, pucch configuration
iii) Sounding RS configuration
iv) UE timers

37. what is contention resolution

When a UE transmit a PRACH Preamble, it transmits with a specific pattern and this specific pattern is called a
"Signature". In each LTE cell, total 64 preamble signatures are available and UE select randomly one of these
signatures.
There is such a possibility. It means the same PRACH preamble from multiple UE reaches the NW at the same
time. This kind of PRACH collision is called "Contention" and the RACH process that allows this type of
"Contention" is called "Contention based" RACH Process. In this kind of contention based RACH process,
Network would go through additional process at later step to resolve these contention and this process is
called "Contention Resolution" step.
two UEs sent PRACH. In this case, both of the UE will receive the same T_C-RNTI and resource allocation
from network and as a result, both UE would send L2/L3 message through the same resource allocation
(meaning with the same time/frequency location) to NW. One possibility is that these two signal act as
interference to each other and NW decode neither of them. In this case, none of the UE would have any
response (HARQ ACK) from NW and they all think that RACH process has failed and go back to initial process.
The other possibility would be that NW could successfully decode the message from only one UE and failed
to decode it from the other UE. In this case, the UE with the successful L2/L3 decoding on NW side will get
the HARQ ACK from Network. This HARQ ACK process for L2/L3 message is called "contention resolution"
process.

38. describe attach procedure

Step 1. The UE initiates the attach procedure by transmitting an attach request to the eNodeB.
Step 2. The eNodeB derives the MME from the RRC parameters carrying the old GUMMEI and the indicated
Selected Network.
Step 3. If the UE identifies itself with GUTI and the MME has changed since detach, the new MME uses the
GUTI received from the UE to derive the old MME/SGSN address, and send an Identification Request to the
old MME/SGSN to request the IMSI.
Step 4. If the UE is unknown in both the old MME/SGSN and new MME, the new MME sends an Identity
Request to the UE to request the IMSI. The UE responds with Identity Response (IMSI).
Step 5a. If no UE context for the UE exists anywhere in the network, if the Attach Request (sent in step 1) was
not integrity protected, or if the check of the integrity failed, then authentication and NAS security setup to
activate integrity protection and NAS ciphering are mandatory.
Step 5b. The ME Identity shall be retrieved from the UE.
Step 6. If the UE has set the Ciphered Options Transfer Flag in the Attach Request message, the Ciphered
Options i.e. PCO or APN or both, shall now be retrieved from the UE.
Step 7. If there are active bearer contexts in the new MME for this particular UE (i.e. the UE re-attaches to the
same MME without having properly detached before), the new MME deletes these bearer contexts by sending
Delete Session Request (LBI) messages to the GWs involved.
Step 8. If the MME has changed since the last detach, or if there is no valid subscription context for the UE in
the MME, the MME sends an Update Location Request message to the HSS.
Step 9. The HSS sends Cancel Location (IMSI, Cancellation Type) to the old MME.
Step 10. If there are active bearer contexts in the old MME/SGSN for this particular UE, the old MME/SGSN
deletes these bearer contexts by sending Delete Session Request (LBI) messages to the GWs involved.
Step 11. The HSS acknowledges the Update Location message by sending an Update Location Ack message to
the new MME.
Step 12. For an Emergency Attach situation, the MME applies the parameters from MME Emergency
Configuration Data for the emergency bearer establishment performed in this step and any potentially stored
IMSI related subscription data are ignored by the MME.
Step 13. The Serving GW creates a new entry in its EPS Bearer table and sends a Create Session Request
message to the PDN GW indicated by the PDN GW address received in the previous step.
Step 14. If dynamic PCC is deployed and the Handover Indication is not present, the PDN GW performs an IP-
CAN Session Establishment procedure.
Step 15. The PGW creates a new entry in its EPS bearer context table and generates a Charging Id.
Step 16. If the MS Info Change Reporting Action (Start) or the CSG Information Reporting Action (Start) are
received for this bearer context, then the SGW stores this for the bearer context and the SGW reports to that
PGW whenever a UE’s location and/or User CSG information change occurs that meets the PGW request.
 Step 17. If an APN Restriction is received, then the MME shall store this value for the Bearer Context and the
MME shall check this received value with the stored value for the Maximum APN Restriction to ensure there
are no conflicts between values.
Step 18. The eNodeB sends the RRC Connection Reconfiguration message including the EPS Radio Bearer
Identity to the UE, and the Attach Accept message will be sent along to the UE.
Step 19. The UE sends the RRC Connection Reconfiguration Complete message to the eNodeB.
Step 20. The eNodeB sends the Initial Context Response message to the new MME.
Step 21. The UE sends a Direct Transfer message to the eNodeB, which includes the Attach Complete message.
Step 22. The eNodeB forwards the Attach Complete message to the new MME in an Uplink NAS Transport
message.
Step 23. Upon reception of both, the Initial Context Response message in step 20 and the Attach Complete
message in step 22, the new MME sends a Modify Bearer Request message to the Serving GW.
Step 23a. If the Handover Indication is included in step 23, the Serving GW sends a Modify Bearer Request
(Handover Indication) message to the PDN GW to prompt the PDN GW to tunnel packets from non 3GPP IP
access to 3GPP access system and immediately start routing packets to the Serving GW for the default and any
dedicated EPS bearers established.
Step 23b. The PDN GW acknowledges by sending Modify Bearer Response to the Serving GW.
Step 24. The Serving GW acknowledges by sending Update Bearer Response (EPS Bearer Identity) message to
the new MME.
Step 25. After the MME receives Modify Bearer Response (EPS Bearer Identity) message, if Request Type does
not indicate handover and an EPS bearer was established and the subscription data indicates that the user is
allowed to perform handover to non-3GPP accesses, and if the MME selected a PDN GW that is different from
the PDN GW identity which was indicated by the HSS in the PDN subscription context, the MME shall send a
Notify Request including the APN and PDN GW identity to the HSS for mobility with non-3GPP accesses. The
message shall include information that identifies the PLMN in which the PDN GW is located.
Step 26. The HSS stores the APN and PDN GW identity pair and sends a Notify Response to the MME.

39. describe IMS registration procedure

(1) GPRS Attach: The terminal registers to the GPRS Network.

(2) PDP Context Activation: An IP address is assigned to the terminal.
(3) Unauthenticated IMS Registration Attempt: The terminal attempts an IMS registration but is challenged by
the IMS network to authenticate itself.
(4) IPSec Security Association Establishment: The terminal establishes a protected session with the IMS
network.
(5) Authenticated IMS Registration: Registration is reattempted. This time the terminal is successfully
authenticated and accepted.

Q.1.
40. Physical Channels in LTE?
Physical Channels:
Define whereas something transmitted over the air. Data and signalling messages are carried on physical channels b
etween the different levels of the physical layer. Physical channels are divided into two parts:
Physical Data Channels
Physical Control Channels
Physical Data Channels:
Physical downlink shared channel (PDSCH)
Carries user specific data (DL Payload).
Carries Random Access Response Message in case of PDSCH mapped to RACH channel.

Physical broadcast channel (PBCH)

It carries system information for UE’s requiring to access network.
Such as MIB (Master information block)

Physical multicast channel (PMCH)

This channel type is used to carry MCH and mainly used for MBMS Services.

Physical uplink shared channel (PUSCH)

This physical channel is used for Uplink data transmission by the UE. They may also carry the uplink control information
sometimes.
This channel is the counterpart of PDSCH channel in Uplink

Physical random access channel (PRACH)

This Uplink physical channel is used for random access procedure called RACH procedure.
UE does RACH procedure to get the Uplink synchronization

Physical Control Channels:

Physical control format indicator channel (PCFICH)

It inform UE about the format of received signal.

Physical hybrid ARQ indicator channel (PHICH)

It shows the Hybrid ARQ status.
If it indicate 0 – ACK if 1 – NACK

Physical downlink control channel (PDCCH)

To carry scheduling information like downlink resource, uplink power control.

Physical uplink control channel (PUCCH)

PUCCH provides the various control signaling. These signaling are known as Scheduling request, Downlink data
ACK/NACK and CQI information.
Q.2.Explain QoS in LTE?
41. QoS
There are premium subscribers who always want to have better user experience on their 4G LTE device. These users are
willing to pay more for high bandwidth and better network access on their devices. In LTE Network QoS is implemented
between UE and PDN Gateway and is applied to a set of bearers. 'Bearer' is basically a virtual concept and is a set of
network configuration to provide special treatment to set of traffic e.g. VoIP packets are prioritized by network
compared to web browser traffic.

42. Bearer
Bearer is just a virtual concept. It defines how the UE data is treated when it travels across the network. Network might
treat some data in a special way and treat others normally.
Some flow of data might be provided guaranteed bit rate while other may face low transfer. E.g. Person A will always
get at least 256 Kbps download speed on his LTE phone while for person B there is no guaranteed bit rate and might face
extremely bad download speed at times

-Default Bearer
When LTE UE attaches to the network for the first time, it will be assigned default bearer which remains as long as UE is
attached.
Default bearer is best effort service.
Each default bearer comes with an IP address. UE can have additional default bearers as well.
Each default bearer will have a separate IP address.
QCI 5 to 9 (Non- GBR) can be assigned to default bearer.
Default bearer is one of the main bearer which is created at the time of initial attach procedure or at the time of new
PDN connection.
Default bearer is a non-GBR bearer and provide always on IP connectivity.

-Dedicated Bearer
Dedicated bearers provides dedicated tunnel to one or more specific traffic (i.e. VoIP, video etc.)
Dedicated bearer acts as an additional bearer on top of default bearer.
It does not require separate IP address due to the fact that only additional default bearer needs an IP address and
therefore dedicated bearer is always linked to one of the default bearer established previously.
GBR provides guaranteed bit rate and is associated with parameters like GBR and MBR
GBR: The minimum guaranteed bit rate per EPS bearer. Specified independently for uplink and downlink
MBR: The maximum guaranteed bit rate per EPS bearer. Specified independently for uplink and downlink
Non-GBR bearer does not provide guaranteed bit rate and has parameter like A- AMBR and UE- AMBR
A-AMBR: APN Aggregate maximum bit rate is the maximum allowed total non-GBR throughput to specific APN. It is
specified interdependently for uplink and downlink
UE -AMBR: UE Aggregate maximum bit rate is the maximum allowed total non-GBR throughput among all APN to a
specific UE.
Dedicated bearer can be GBR or non-GBR .For services like volte we need to provide better user experience and this is
where dedicated bearer would come handy.
Dedicated bearer uses “Traffic flow templates (TFT)” to give special treatment to specific services dedicated bearer is
created when the requested service can't be fulfilled through default bearer. Some services required a high level of qos
like voice call. So network create a dedicated bearer with required qos.
Dedicated bearer may be Non-GBR or GBR depend of qci (qos class identifier) value.
Dedicated bearer can be created/release based on requirement but default bearer is created only all on IP connectivity
and released only at the time of detach/PDN disconnection.

43. LTE Security?

NAS Security:
The purpose of NAS security is to securely deliver NAS signaling messages between a UE and an MME in the control
plane using NAS security keys.
The NAS security keys are derived from KASME and new keys are generated every time EPS AKA is performed (every time
a new KASME is generated).
After the NAS security setup is completed, the UE and the MME get to share a NAS encryption key (KNASenc) and a NAS
integrity key (KNASint), which are used in encryption and integrity protection, respectively, of NAS messages before
transmitting.

AS Security:
The purpose of AS security is to securely deliver RRC messages between a UE and an eNB in the control plane and IP
packets in the user plane using AS security keys.
The AS security keys are derived from KeNB and new keys are generated every time a new radio link is established (that
is, when RRC state moves from idle to connected).
After the AS security setup is completed, the UE and the eNB get to share an RRC integrity key (K RRCint), RRC encryption
key (KRRCenc) and user plane encryption key (KUPenc).
Encryption and integrity protection using these keys are performed at the PDCP layer.
KRRCint and KRRCenc are used to securely deliver RRC messages in the control plane through an SRB (Signaling Radio Bearer)
over radio links.
The RRC messages are integrity protected using KRRCint and encrypted using KRRCenc at the PDCP layer before being sent.
KUPenc is used to securely deliver IP packets in the user plane through a DRB (Data Radio Bearer) over radio links.
The IP packets are encrypted using KUPenc at the PDCP layer before being sent.

44. Functions of RLC?

RLC protocol layer exists in UE & eNodeb, it is part of LTE air interface control and user planes.
The main services and functions of the RLC sublayer include:
Transfer of upper layer PDUs
Error Correction through ARQ (only for AM data transfer)
Concatenation, segmentation and reassembly of RLC SDUs (only for UM and AM data transfer)
Re-segmentation of RLC data PDUs (only for AM data transfer)
In sequence delivery of upper layer PDUs (only for UM and AM data transfer)
Duplicate detection (only for UM and AM data transfer)
Protocol error detection and recovery
RLC SDU discard (only for UM and AM data transfer)
RLC re-establishment

45. What are the Modes of RLC?

RLC operates in three modes:-
Transparent mode(TM)
In Transparent Mode (TM), PDUs are transferred with little interaction by RLC. No header is attached to the PDU.
The functions performed by TM RLC are: Segmentation and Reassembly, SDU Discard
Unacknowledged Mode (UM)
In Unacknowledged Mode (UM), RLC provides slightly more reliable service than in Transparent Mode.
A small header, which contains information about segmentation, concatenation, and the sequence number, is attached
to each PDU.
The functions performed by UM RLC are: Sequence Number Check, Segmentation and Reassembly,
Concatenation/Padding
Acknowledge Mode (AM)
The Acknowledged Mode (AM) protocol is a complex protocol that provides reliable service. Both positive and negative
acknowledgment are supported.
The functions performed by AM RLC are: Segmentation and Reassembly, Concatenation/Padding, Error Correction,
Ciphering,
In the uplink it provides buffer status report, segmentation and concatenation, ARQ (for AM mode). In the downlink it
does re-ordering, assembly and ARQ (for AM mode).
Retransmission & Re-segmentation of RLC data PDUs (Only for AM).

46. SIP protocols in LTE?

Session Initiation Protocol (SIP)
Session Initiation Protocol (SIP) is one of the most common protocols used in VoIP technology.
SIP is a signaling protocol used to create, modify, and terminate a multimedia session over the Internet Protocol. A
session is nothing but a simple call between two endpoints. An endpoint can be a smartphone, a laptop, or any device
that can receive and send multimedia content over the Internet.
1xx = Informational SIP Responses
100 Trying – Extended search is being perform so a forking proxy must send a 100 trying response.
180 Ringing – The Destination User Agent has received the INVITE message and is alerting the user of call.
181 Call Is Being Forwarded – Optional, send by Server to indicate a call is being forwarded.
182 Queued – Destination was temporarily unavailable, the server has queued the call until destination is available.
183 Session Progress – This response may be used to send extra information for a call which is still being set up.
199 Early Dialog Terminated – Send by the User Agent Server to indicate that an early dialog has been terminated.

2xx = Success Responses

200 OK – Shows that the request was successful
202 accepted – Indicates that the request has been accepted for processing, mainly used for referrals.
204 No Notification – Indicates that the request was successful but no response will be received.

3xx = Redirection Responses

300 Multiple Choices – The address resolved to one of several options for the user or client to choose between.
301 Moved Permanently – The original Request URI is no longer valid, the new address is given in the Contact header.
302 Moved Temporarily – The client should try at the address in the Contact field.
305 Use Proxy – The Contact field details a proxy that must be used to access the requested destination.
380 Alternative Service – The call failed, but alternatives are detailed in the message body.

4xx = Request Failures

400 Bad Request – The request could not be understood due to malformed syntax.
401 Unauthorized – The request requires user authentication. This response is issued by UASs and registrars.
402 Payment Required – (Reserved for future use) .
403 Forbidden – The server understood the request, but is refusing to fulfill it.
404 Not Found – The server has definitive information that the user does not exist at the (User not found).

47. What are the Functions of RRC?

Broadcast of system information

RRC Connection Control. Without RRC connection UE cannot send any data on network.
Mobility Management.
RRC State:
RRC IDLE state, UE is known in EPC and has IP address but not known in E-UTRAN/eNB. UE can receive
broadcast/multicast data, monitors a paging channel to detect incoming calls, performs neighbor cell measurements
and cell selection/reselection and acquires system information.
RRC CONNECTED state, UE known in EPC and E-UTRAN/eNB.
UE location is known at the cell level, Mobility is UE-assisted, network-controlled

48. Explain ARQ & HARQ.

ARQ

 ARQ stands for Automatic Repeat Request. This is the protocol used at data link layer. It uses CRC to
determine whether the packet received is correct or not.
 If the packet is received correctly receiver send ACK to the transmitter, but if the packet is received
incorrectly receiver send NACK to the transmitter.
 After receiving NACK transmitter re-transmits the same packet again.

HARQ

The hybrid-ARQ mechanism provides very fast retransmissions which is suitable for high speeds used
in LTE
 Works at PHY layer but controlled by MAC layer.
 If the received data has an error then the Receiver buffers the data and requests a re-transmission from
the sender.
 When the receiver receives the re-transmitted data, it then combines it with buffered data prior to
channel decoding and error detection. This helps the performance of the re-transmissions.
  The sending entity buffers the transmitted data until an ACK is received, because if NACK is received
then it has to re-transmit the data.

49. Reference signals in LTE?

Reference Signals

There are two types of reference signals for uplink in LTE.

 The first is Demodulation Reference Signals (DM-RS) which are used to enable coherent signal
demodulation at the eNodeB. These signals are time multiplexed with uplink data and are
transmitted on the fourth or third SC-FDMA symbol of an uplink slot for normal or extended CP,
respectively, using the same bandwidth as the data.
 The second is Sounding Reference Signal (SRS) which is used to allow channel dependent (i.e.
frequency selective) uplink scheduling as the DM-RS cannot be used for this purposes since they are
assigned over the assigned bandwidth to a UE. The SRS is introduced as a wider band reference signal
typically transmitted in the last SC-FDMA symbol of a 1 ms sub frame
 User data transmission is not allowed in this block, which results in about 7% reduction in uplink
capacity. The SRS is an optional feature and is highly configurable to control overhead--it can be turned
off in a cell. Users with different transmission bandwidth share this sounding channel in the frequency
domain.

50. PLMN selection procedure.

ANS:-PLMN stands for Public Land Mobile Network. The LTE compliant UE is responsible for selecting a PLMN
for subsequent cell selection. A PLMN is identified by its PLMN identity broadcast within SIB-1. A single cell
can belong to multiple PLMNs, so SIB-1 may broadcast a list of PLMN identities.
• Following are two steps for PLMN selection:

STEP-1:The LTE UE NAS layer requests AS layer to report available PLMN.

STEP-2:The LTE NAS layer is responsible for selecting a PLMN from these list of reported PLMN.

• STEP-1: Let us see how NAS layer gets requested information from AS layer:

 UE scans all the RF channels within its supported RF bands

 UE searches for strongest cell carrier and reads SIs to identify PLMN
 PLMN are reported to NAS as high quality if RSRP>=-110dBm
 PLMN not meeting high quality criteria are reported along with their RSRP to NAS
 UE can optimize PLMN search procedure using stored information such as RF carriers and cell
parameters.

NAS layer can stop search at any instant .

• STEP-2: NAS layer selects PLMN from reported list. It utilizes USIM information for PLMN selection:

 IMSI defines Home PLMN (i.e. HPLMN)

 HPLMN selector with access technology: Defines priorities of each RAT associated with HPLMN.
 User controlled PLMN selector with access technology allows end user to prioritise the PLMN and
RAT
 Operator controlled PLMN selector with access technology allows the operator to prioritise the
PLMN and access technology.
 Forbidden PLMNs: Defines PLMN which UE does not automatically attempt to access. Forbidden
PLMNs are added to the list when network will reject an ATTACH REQUEST using cause value as
'PLMN not allowed'.
 EHPLMN(Equivalent HPLMN) defines set of PLMN which are equivalent to PLMN with which LTE UE
is registering. This list can be treated or deleted during the ATTACH or TRACKING AREA UPDATE
procedures. EHPLMN are ordered in terms of their priority.
 PLMN automatic and manual selection types
 PLMN can either be selected manually or automatically as described below:
 In the case of automatic selection, the LTE UE selects the PLMN and RAT(Radio Access Technology)
using following order of priority:

51. HPLMN or the highest priority EHPLMN

 2. PLMN and RAT combinations defined within User controlled PLMN selector

3. PLMN and RAT combinations defined within operator controlled PLMN selector

4. Other PLMN reported as high quality PLMN, selected in random order.

5. Other PLMN selected in order of decreasing signal quality

The LTE UE searches all supported access technologies before PLMN selection using last two steps 4 and 5
mentioned above.

• In the case of manual selection, UE presents end user with available PLMN, listing them in the order

52. Difference between dB and dBm

ANS:- 1. dB is used to quantify ratio between two intensity or power values while dBm is used to express
an absolute value of power.

2. dB is a dimensionless unit while dBm is an absolute unit.

3. dB is relative often relative to the power of the input signal while dBm is always relative to 1 mW signal.

53. What is PSS & SSS.?

ANS:-PSS (primary synchronization signal) and SSS (secondary synchronization signal)
PSS which is located in the last OFDM symbol of first time slots of the first sub frame of radio
frame .This enables UE to be synchronized on sub frame level.
The PSS is repeated in sub frame 5, which means UE is synchronized on 5ms basic. since each sub
frame is 1ms from PSS, UE is also able to obtain physical layer identity (0 to 2)
SSS (secondary synchronization signal) are also located in the same sub frame of PSS .but in the
symbol before PSS.
From SSS, UE is able to obtain Physical layer cell identity group & physical layer identity.
PCI= 3*(SSS)+(PSS)

54. Explain different HANDOVER events like A1, A2, A3, A4, A5 & B1, B2.
ANS: - There are total 7events which trigger measurement reports.
S intra –system events [A1-A5]
Z inter-system events [B1-B2]
A1:- This is triggered when serving cell becomes better than a threshold (Measserv-hyst >
threshold)
A2:- This is triggered when serving cell becomes worse than a threshold (Measserv-hyst <
threshold)
A3:- This is triggered when neighboring cell becomes better than the serving cell by an offset
.Offset can be +VE or –VE.
A4:- It is triggered when a neighboring cell becomes better than a threshold.
A5:- It is triggered when serving cell becomes worse than threshold-1, while a neighboring
cell becomes better than threshold-2.
B1:- It is triggered when a neighboring inter-system cell becomes better than threshold.
B2:- It is triggered when serving cell becomes worse than threshold-1 while neighboring inter-
system cell becomes better than threshold-2.

55. What are different types of Rach in LTE?

Ans: There are two type of RACH in LTE.
1) Contention based 2) Non Contention based

56. When TAU is initiated and types of TAU.

Ans: TAU occurs when UE experience GPRS-attach or E-UTRAN attach.
 When UE detects it has entered into new tracking area that is not in its TAIs.
 When tracking area update timer expired.
 When UE changes one of RAT(Radio access Technology)
 After completing CS fall back, instead of sending attach request UE send TAU request.

57. In 2g and 3g architecture which entity handles packet request.

Ans: In 2G GPRS & EDGE handle packet request, while in 3G SGSN handle packet request.

58. Which technology is better LTE or CDMA?

Ans: LTE.
 LTE uses all IP network architecture.
 It support MIMO.
 Higher data rate.
 Handover is much smooth than CDMA.
59. Which are the basic entities in LTE?
Ans: Basically LTE architecture divided into 3 entity.
1. UE: user equipment
2. E-UTRAN: It consist of more than 1 eNodeB that are connected to each other.
3. Core network: consist of MME, HSS, PGW, and SGW.
60. Draw resource block in frequency and time domain and explain.
Ans:
1. FDD frame structure:

 Time duration for one frame is 10 Ms.

 Number of sub frame in one frame is 10.
 Number of time slots in one sub frame is 2 and each time slot is called as resource
block.
 Each resource block consist of 12 subcarrier with 180kHz and 7 resource elements
so total 12*7=84

61. What is SRB and DRB? Explain their functions.

Ans: In LTE there are two main types of bearer, namely the SRB (Signalling Radio Bearer) and the DRB
(Dedicated Radio Bearer).
 1. SRB: It is used to transfer RRC and NAS messages. In LTE there are 3 SRB. SRB0, SRB1, SRB2.
2. DRB: It is used to carry the data associated with an EPS bearer. In LTE there are 8 DRBs.
62. How many SRB are there in LTE and WCDMA?
Ans: in LTE there are 3 SRB.
1. SRB 0: It is used to transfer RRC message which use CCCH channel. SRB0 uses transparent mode in RLC.
2. SRB 1: It is used to transfer RRC message which use DCCH channel. SRB1 uses acknowledgment mode
in RLC.
3. SRB 2: It is used to transfer RRC message which use DCCH channel and encapsulates NAS message.
SRB2 also uses acknowledgment mode in RLC.

63. Draw IMS architecture.

Ans:

64. Channels in LTE.

Ans:
3G LTE channel types
There are three categories into which the various data channels may be grouped.

 Physical channels: These are transmission channels that carry user data and control
messages.
 Transport channels: The physical layer transport channels offer information transfer to
Medium Access Control (MAC) and higher layers.
 Logical channels: Provide services for the Medium Access Control (MAC) layer within the
LTE protocol structure.
3G LTE physical channels
The LTE physical channels vary between the uplink and the downlink as each has different
requirements and operates in a different manner.

 Downlink:

o Physical Broadcast Channel (PBCH): This physical channel carries system

information for UEs requiring to access the network. It only carries what is termed
Master Information Block, MIB, messages.
o Physical Control Format Indicator Channel (PCFICH): As the name implies the
PCFICH informs the UE about the format of the signal being received. It indicates
the number of OFDM symbols used for the PDCCHs,

o Physical Downlink Control Channel (PDCCH) : The main purpose of this physical
channel is to carry mainly scheduling information of different types:
 Downlink resource scheduling
 Uplink power control instructions
 Uplink resource grant
 Indication for paging or system information
o Physical Hybrid ARQ Indicator Channel (PHICH): As the name implies, this channel
is used to report the Hybrid ARQ status. It carries the HARQ ACK/NACK signal
indicating whether a transport block has been correctly received.

 Uplink:

o Physical Uplink Control Channel (PUCCH): The Physical Uplink Control Channel,
PUCCH provides the various control signalling requirements.
 Physical Uplink Shared Channel (PUSCH) : This physical channel found on the LTE uplink is
the Uplink counterpart of PDSCH
 Physical Random Access Channel (PRACH): This uplink physical channel is used for random
access functions. This is the only non-synchronised transmission that the UE can make within
LTE.
LTE transport channels
The LTE transport channels vary between the uplink and the downlink as each has different
requirements and operates in a different manner. Physical layer transport channels offer
information transfer to medium access control (MAC) and higher layers.

 Downlink:

o Broadcast Channel (BCH) : The LTE transport channel maps to Broadcast Control
Channel (BCCH)
o Downlink Shared Channel (DL-SCH): This transport channel is the main channel for
downlink data transfer. It is used by many logical channels.
o Paging Channel (PCH) : To convey the PCCH
o Multicast Channel (MCH): This transport channel is used to transmit MCCH
information to set up multicast transmissions.

 Uplink:

o Uplink Shared Channel (UL-SCH): This transport channel is the main channel for
uplink data transfer. It is used by many logical channels.
o Random Access Channel (RACH): This is used for random access requirements.

LTE logical channels

The logical channels cover the data carried over the radio interface. The Service Access Point, SAP
between MAC sublayer and the RLC sublayer provides the logical channel.

 Control channels: these LTE control channels carry the control plane information:

o Broadcast Control Channel (BCCH): This control channel provides system

information to all mobile terminals connected to the EnodeB.
o Paging Control Channel (PCCH): This control channel is used for paging
information when searching a unit on a network.
o Common Control Channel (CCCH): This channel is used for random access
information, e.g. for actions including setting up a connection.
 o Multicast Control Channel (MCCH): This control channel is used for Information
needed for multicast reception.
o Dedicated Control Channel (DCCH): This control channel is used for carrying
user-specific control information, e.g. for controlling actions including power
control, handover, etc...

 Traffic channels: These LTE traffic channels carry the user-plane data:

o Dedicated Traffic Channel (DTCH): This traffic channel is used for the transmission
of user data.
o Multicast Traffic Channel (MTCH): This channel is used for the transmission of
multicast data.

65. What is difference between LTE and LTE -advance technology?

Ans:
Specifications LTE LTE Advanced

Standard 3GPP Release 9 3GPP Release 10

supports 1.4MHz, 3.0MHz, 5MHz, 70MHz Downlink(DL), 40MHz

Bandwidth 10MHz, 15MHz, 20MHz Uplink(UL)

300 Mbps Downlink(DL) 4x4MIMO 1Gbps Downlink(DL), 500 Mbps

Data rate and 20MHz, 75 Mbps Uplink(UL) Uplink(UL)

Spectral 16.3 for 4x4 MIMO in the downlink, 30 for 8x8 MIMO in the
Efficiency(peak 4.32 for 64QAM SISO case in the downlink, 15 for 4x4 MIMO in
b/s/Hz) Uplink the Uplink

Hybrid OFDMA(DL), SC-

Access technique OFDMA (DL),DFTS-OFDM (UL) FDMA(UL)
carrier aggregation Not supported Supported

66. Rach procedure with all IES

Ans:
Two types of RACH process: Contention-based and Contention-free.
 Contention based: The same PRACH preamble from multiple UE reaches the NW at the same
time. This kind of PRACH collision is called "Contention" and the RACH process that allows
this type of "Contention" is called "Contention based" RACH Process.

 Contention free: In this case Network will allocate these preamble signature so that it would
not collide. This kind of RACH process is called "Contention Free" RACH procedure. To initiate
the "Contention Free" RACH process.

1. UE sends Rach Request in MSG1 to EnodeB.

2. EnodeB sends Rach Response in MSG2 to UE with Temp_C_RNTI.
3. UE sends UE Identification Message in MSG3 to EnodeB.
4. EnodeB sends Contention Resolution Message in MSG4 to UE.