A 5G NSA phone never attaches to 5G: reading an EN-DC attach from a real capture

In a detailed account of a 5G Non-Standalone (EN-DC) attach, researchers have dissected a real 40-frame capture from an open5gs test network. This walkthrough reveals that the Entity (UE) initiates the attach process on the LTE leg, with the 5G core arriving later as a secondary connection. The UE sets the DCNR bit in its initial Attach Request frame, signaling the negotiation of dual connectivity.

In frame 13, the eNB acknowledges the EN-DC attach with NR security capabilities, marking the connection as dual. The attach accept (frame 19) builds bearers and installs seven measurement identities, with measId 7 specifically bound to the NR measurement object (band n78). The UE's first measurement report (frame 24) transmits NR PCI 0, indicating a signal strength of -91 to -90 dBm SS-RSRP.

Following the attach, the eNB sends the X2 SgNB Addition Request in the subsequent frame, prompting the gNB to respond with an acknowledgement containing the NR configuration for the UE. The bearers transition to the NR radio leg in two steps: first, an RRC Reconfiguration releases LTE DRB 1 and re-adds it on the NR secondary cell group, allowing PDCP to relocate to the gNB. Finally, the S1AP E-RAB Modification (frames 31-32) reroutes the S1-U downlink to the gNB.

Interestingly, only measId 7 reports include NR data in frames 24 and the periodic bundles from frames 33-40, while the other measId 1 and 2 reports do not reference NR. The lab capture used in this analysis has an EEA0 null cipher with EIA2 integrity for AS security, and lacks NAS authentication. Moreover, the B1 threshold is set at the RSRP floor, allowing EN-DC to establish with any detected NR cell.