{
  "id": 16811455,
  "title": "A 5G NSA phone never attaches to 5G: reading an EN-DC attach from a real capture",
  "url": "https://urgent.news/2026/10/27/a-5g-nsa-phone-never-attaches-to-5g-reading-an-en-dc-attach-from-a",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-27T22:51:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/eventhelix/a-5g-nsa-phone-never-attaches-to-5g-reading-an-en-dc-attach-from-a-real-capture-3o9p"
  },
  "original_language": "en",
  "account": "In a detailed account of a 5G Non-Standalone (EN-DC) attach, researchers have dissected a real 40-frame capture from an open5gs test network. This walkthrough reveals that the Entity (UE) initiates the attach process on the LTE leg, with the 5G core arriving later as a secondary connection. The UE sets the DCNR bit in its initial Attach Request frame, signaling the negotiation of dual connectivity.\n\nIn frame 13, the eNB acknowledges the EN-DC attach with NR security capabilities, marking the connection as dual. The attach accept (frame 19) builds bearers and installs seven measurement identities, with measId 7 specifically bound to the NR measurement object (band n78). The UE's first measurement report (frame 24) transmits NR PCI 0, indicating a signal strength of -91 to -90 dBm SS-RSRP.\n\nFollowing the attach, the eNB sends the X2 SgNB Addition Request in the subsequent frame, prompting the gNB to respond with an acknowledgement containing the NR configuration for the UE. The bearers transition to the NR radio leg in two steps: first, an RRC Reconfiguration releases LTE DRB 1 and re-adds it on the NR secondary cell group, allowing PDCP to relocate to the gNB. Finally, the S1AP E-RAB Modification (frames 31-32) reroutes the S1-U downlink to the gNB.\n\nInterestingly, only measId 7 reports include NR data in frames 24 and the periodic bundles from frames 33-40, while the other measId 1 and 2 reports do not reference NR. The lab capture used in this analysis has an EEA0 null cipher with EIA2 integrity for AS security, and lacks NAS authentication. Moreover, the B1 threshold is set at the RSRP floor, allowing EN-DC to establish with any detected NR cell.",
  "summary": "In 5G Non-Standalone (Option 3, or EN-DC), there is no 5G core. The UE attaches to the 4G EPC through an LTE anchor eNB, and 5G arrives later as a secondary leg that the eNB asks a nearby gNB to add. A new walkthrough reads that whole flow from a real 40-frame capture taken on the LTE leg of an open5gs test network. What the capture shows EN-DC is negotiated during the attach, long before it is…",
  "key_points": [
    "UE initiates EN-DC attach on LTE leg, 5G core arrives later",
    "UE sets DCNR bit in initial Attach Request frame",
    "NR data reported by measId 7 in frames 24 and 33-40"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}