F1AP Message Trace

This page reconstructs the complete F1AP exchange between DU and CU-CP from a real packet capture on a running OCUDU gNB. Every F1AP frame in the trace appears in capture order; the diagram is generated directly from the pcap, so each arrow corresponds to exactly one wire-level F1AP message.

Click any message arrow or label to open the detail panel on the right - it shows what the message carries, the procedure it triggers, the relevant 3GPP TS 38.473 section and OCUDU source file, and the actual ASN.1 decode of the captured frame.

A more freeform interactive view of the same trace lives at Trace Studio, where you can scrub through the capture, filter by protocol, and switch between three view modes.

Full F1AP Trace

sequenceDiagram
    autonumber
    participant DU as f1ap_du_impl
    participant CU as f1ap_cu_impl
    Note over DU,CU: F1 Setup (t = 21.383 s)
    DU->>CU: F1SetupRequest
    CU->>DU: F1SetupResponse
    Note over DU,CU: RRC attach + NAS authentication (t = 59.634 s)
    DU->>CU: InitialULRRCMessageTransfer
    CU->>DU: DLRRCMessageTransfer #1
    DU->>CU: ULRRCMessageTransfer #1
    CU->>DU: DLRRCMessageTransfer #2
    DU->>CU: ULRRCMessageTransfer #2
    CU->>DU: DLRRCMessageTransfer #3
    DU->>CU: ULRRCMessageTransfer #3
    CU->>DU: DLRRCMessageTransfer #4
    Note over DU,CU: UE Context setup + capability exchange (t = 60.251 s)
    DU->>CU: ULRRCMessageTransfer #4
    CU->>DU: UEContextSetupRequest
    DU->>CU: UEContextSetupResponse
    DU->>CU: ULRRCMessageTransfer #5
    CU->>DU: DLRRCMessageTransfer #5
    DU->>CU: ULRRCMessageTransfer #6
    CU->>DU: DLRRCMessageTransfer #6
    DU->>CU: ULRRCMessageTransfer #7
    Note over DU,CU: PDU Session Setup (t = 60.760 s)
    DU->>CU: ULRRCMessageTransfer #8
    CU->>DU: UEContextModificationRequest #1
    DU->>CU: UEContextModificationResponse #1
    CU->>DU: DLRRCMessageTransfer #7
    DU->>CU: ULRRCMessageTransfer #9
    Note over DU,CU: Mid-session NAS (t = 76.653 s)
    DU->>CU: ULRRCMessageTransfer #10
    Note over DU,CU: Deregistration + release (t = 77.206 s)
    DU->>CU: ULRRCMessageTransfer #11
    CU->>DU: UEContextModificationRequest #2
    DU->>CU: UEContextModificationResponse #2
    CU->>DU: DLRRCMessageTransfer #8
    DU->>CU: ULRRCMessageTransfer #12
    DU->>CU: ULRRCMessageTransfer #13
    DU->>CU: ULRRCMessageTransfer #14
    CU->>DU: DLRRCMessageTransfer #9
    CU->>DU: UEContextReleaseCommand
    DU->>CU: UEContextReleaseComplete

Reading the trace

• Two ID allocations. When the UE first appears, the DU allocates a gnb_du_ue_f1ap_id (frame 5) and the CU allocates a gnb_cu_ue_f1ap_id (frame 6). These two IDs identify the UE on the F1 link until the context is released at frame 60.
• NAS messages always triple-hop. Every NAS PDU appears three times on the F1 link in each direction: once as RRC over the air (UE↔DU), once as F1AP between DU and CU, and once again as NGAP between CU and AMF (visible on the NGAP Message Trace page).
• Two distinct security mode completes. Frame 19 is the NAS-layer Security Mode Complete (carried inside an ULInformationTransfer); frame 24 is the RRC-layer Security Mode Complete that arrives after UEContextSetupResponse brings SRB1/2 up. The first protects NAS; the second protects RRC.
• F1AP RTT is sub-millisecond. F1 Setup takes 336 µs; the full UEContextSetupRequest / UEContextSetupResponse round trip takes 1.2 ms. DU and CU are co-located in this trace - the loopback path explains the numbers.
• Release is symmetric to attach. The final 11 frames (50-60) mirror the attach sequence in reverse: drop the DRB via UEContextModificationRequest, send RRC Reconfiguration to the UE, deliver the NAS Deregistration accept, then tear down the whole UE context with UEContextReleaseCommand.

For the NGAP side of the same UE attach, see the NGAP Message Trace.