. 23
( 132 .)


Command UE to SGSN 0
Response SGSN to UE 0
Response UE to SGSN 1

• Uncon¬rmed information transfer (UI frame) is used to transfer information to higher
layers that does not need acknowledgements and in this respect no veri¬cation of the
sequence numbers, N(U), is performed. This means that a frame could be lost with no
noti¬cation given to the higher layer. The information may or may not be encrypted.
This is indicated by the E bit. If it is set to logic 1 then the information is encrypted.
The protected mode (PM) bit indicates whether the CRC checks across the header
and payload or just the header. If it is set to logic 1 it indicates that the payload is
also protected.
• Unnumbered (U frame) provides additional LLC functions. It does not contain any
sequence numbers. The poll/¬nal (P/F) bit is referred to as the poll bit if this is a
command frame and the ¬nal bit if this is a response frame. The P bit is set to logic 1
to request a response frame from the receiver. The F bit is set to a logic 1 to indicate
that this is a reply to a poll request command.

It can be seen from Figure 4.15 that the I and S frames have two further bits, S1 and S2,
and also that the U frame has four M bits. These bits are used for control and response
functions and Figure 4.16 highlights the values these ¬elds can have. If a ¬eld has a value
which is not de¬ned, then the frame is rejected.
The function of the I frame is to transfer sequentially numbered frames containing
information for higher layers across the logical link between the SGSN and the mobile
station. Referring to Figure 4.16(a), it can be seen that there are four command/responses
and these are brie¬‚y described below:

• The receive ready (RR) command/response is used by a receiver to indicate that it is
ready to receive an I frame. It is also used to acknowledge received I frames.
• The acknowledgement (ACK) command/response is used to acknowledge a single or
multiple I frames up to and including the last frame received, N(R) ’1.
• The selective acknowledgement (SACK) command/response supervisory frame is also
used to acknowledge I frames. In this case the information ¬eld contains a list of the
frames that have been received successfully so that the sender needs to retransmit only
the missing frames.
• The receive not ready (RNR) command/response is used to indicate that the entity is
unable to accept incoming I frames at this time.

Command Response M4 M3 M2 M1
DM 0 0 0 1
DISC 0 1 0 0
Command Response S1 S2 UA 0 1 1 0
RR RR 00 SABM 0 1 1 1
ACK ACK 01 FRMR 1 0 0 0
RNR RNR 10 XID XID 1 0 1 1
SACK SACK 11 NULL 0 0 0 0
a) I and S Frames b) U Frames

Figure 4.16 I frame command/response

Referring to Figure 4.16(b), for the unnumbered frames it can be seen that there are four
M bits and seven combinations. Unlike the I and S frames above, these are not identical
for command and response. The combinations are brie¬‚y described below:

• Set asynchronous balanced mode (SABM) is used to place the addressed mobile device
or SGSN into ABM (i.e. acknowledged) mode of operation. ABM mode of operation
ensures that each entity assumes responsibility for its own data ¬‚ow and error recovery.
Both of the entities act as data source and data sink, allowing information to ¬‚ow in
two directions.
• The disconnect (DISC) command is used to terminate an ABM connection.
• The unnumbered acknowledgement (UA) response is used to acknowledge receipt of
the SABM or DISC commands.
• The disconnect mode (DM) response informs its peer that it is unable to perform ABM
mode of operation at this time.
• The frame reject (FRMR) response is used to indicate to the sender that a frame has
been rejected and simply resending the particular frame will not suf¬ce. This may occur
if a control ¬eld is unde¬ned or not implemented.
• The exchange identi¬cation (XID) command/response is used to negotiate and renegoti-
ate LLC layer parameters. An entity will send an XID command with a set of parameters
for a particular application; the receiver can accept the values or offer different values
in the XID response. The parameters may include such things as maximum information
size for U and UI frames, timer timeouts, maximum number of retransmissions and
window size.
• The NULL command is used to indicate a cell update.

Figure 4.17, illustrates how data is transferred in both unacknowledged and acknowledged
modes. In unacknowledged mode the information is simply transferred in a UI frame.
When information is transferred in the acknowledged mode, the I+S frame is used and
this will be acknowledged by either an S frame if information is not being sent in the
reverse direction, or an I+S frame, which is piggybacking an acknowledgement for data
received with the data being sent. For acknowledged mode the data transfer is preceded
by the SABM command which is required to actually establish the acknowledged mode
of operation. Figure 4.18 shows examples of the signalling required for establishing,
releasing and renegotiating LLC procedures. Standard primitives are used between the
Layer 3 and the logical control layer. These primitives are request (REQ), indication
(IND), response (RES) and con¬rm (CNF).
Figure 4.19 shows both an uplink and downlink LLC trace across the Abis, which
is carrying an IP packet. The 03 C2 0D is the LLC header and indicates that this par-
ticular frame is using SAPI 3 and the UI header. The 65 00 06 83 indicates that this
is an unacknowledged single segment SN-PDU which is destined for NSAPI 5. Also
highlighted in the ¬gure are the source and destination IP addresses (0A 01 02 7B
C0 A8 01 02) and the TCP port numbers (04 0F 00 14), indicating that this is an
FTP session.

Originator Receiver
layer 3 LLC LLC layer 3


Unacknowledged Information Transfer

Originator Receiver
layer 3 LLC LLC layer 3



S or I + S

Acknowledged Information Transfer

Figure 4.17 LLC data transfer Ciphering algorithm
The ciphering algorithm shown in Figure 4.20 is used to provide both integrity and con-
¬dentiality for user data between the mobile device and the SGSN. It can be used in both
the downlink and uplink as well as in the downlink for point-to-multipoint group trans-
missions. The algorithm provides security over the information and the CRC but does
not cover the actual header. Both I and UI frames can be encrypted. Encryption of the I
frame is based on whether ciphering has been assigned to the TLLI whereas encryption
of the UI frame is based on this assignment as well as the setting of the E bit in the UI
header by upper layer protocols. The key (Kc) is 64 bits in length and is generated in
the GPRS authentication procedure. The direction is 1 bit and indicates whether this is
an uplink or downlink packet. The input is 32 bits in length and derived from the LLC
frame number, which is N(S) for I frames and N(U) for UI frames. This protects against
replay of previously sent frames.

4.6.4 Radio Link Control/Media Access Control (RLC/MAC)
The main role of the RLC/MAC layer is to segment uplink LLC packets for transfer over
the radio link from the mobile device through to the BSC. At the BSC these LLC packets
are then reassembled and relayed through to the BSSGP for transfer to the SGSN. In

Originator Receiver
layer 3 LLC LLC layer 3



ABM Establishment Procedure

Originator Receiver
layer 3 LLC LLC layer 3


UA or UM

ABM Release Procedure

Originator Receiver
layer 3 LLC LLC layer 3



Renegotiation of LLC parameters

Figure 4.18 Example LLC control procedures

the downlink a similar mechanism occurs, with the BSC receiving the LLC packets via
the BSSGP and segmenting them into the RLC/MAC blocks for transfer to the mobile
device. The RLC/MAC layer can transfer the RLC data blocks in both acknowledged and
unacknowledged mode. The packet control unit (PCU), which is usually located within
the BSC, is responsible for the RLC/MAC tasks. These include the segmentation and
reassembly of the LLC frames.

• Acknowledged mode: when acknowledged mode is used a selective ARQ mechanism
coupled with block sequence numbering (BSN) is used to ensure correct transfer of

Uplink Downlink
Conn:4 Line:1 TS:2 Subch:3
Conn:4 Line:1 TS:2 Subch:3
LLC UI format (586)
LLC UI format (58)
43 C6 45 65 00 09 91 45 00 02 40 C0 C4 40
03 C2 0D 65 00 06 83 45 00 00 30 1F 07 40
00 7E 06 59 56 C0 A8 01 02 0A 01 02 7B 00
00 80 06 FB 23 0A 01 02 7B C0 A8 01 02 04
14 04 0F 48 48 C9 CE 00 17 A5 1E 50 10 40
0F 00 14 00 17 A5 1D 48 48 C9 CE 70 12 21
E8 CC 88 00 00 D0 CF 11 E0 A1 B1 1A E1 00
80 C9 1F 00 00 02 04 02 18 01 01 04 02 5F
00 00 00 00 00 00 00 00 00 00 00 00 00 00
13 9F
00 3E 00 03
Spare (X)
00 FE FF 09 00 06 00 00 00 00 00 00 00 00
- ok
00 00 00 09 00 00 00 7B 02 00 00 00 00 00
First Segment Ind. (F)
00 00 10 00 00 89 02 00 00 01 00 00 00 FE
- First segment of N-PDU
FF FF FF 00 00 00 00 76 02 EC A5 C1 00 71
SN-PDU Type (T)
00 09 04 00 00 08 12 BF 00 00 00 00 00 00
10 00 00 00 00 51 42 3B
More (M)
- Last segment of N-PDU
Spare (X)
- ok
- Dynamically allocated NSAPI: 5 (5h)
First segment Ind. (F)
- First segment of N-PDU
- No data compression
SN-PDU Type (T)
- No protocol control info compression
More (M)
Segment Number
- Last segment of N-PDU
- Current segment: 0 (0h)
N-PDU Number
- Dynamically allocated NSAPI: 5 (5h)
- UNACK mode: 1667 (683h)
Data Segment
- No data compression
Source address :
- No protocol control info compression
Destination address :


. 23
( 132 .)