. 30
( 132 .)


4.9.2 Session management
Once the mobile device has registered with the mobile network, it cannot start to send and
receive data over the packet core until it has established a session, which is known as hav-
ing a packet data protocol context (PDP context). A mobile device has to be in the ready
mode to activate a PDP context; however, the PDP context will continue to be present if
the mobile device moves to the standby state. This is to allow a subscriber to retain the
same IP address, even if they have not generated or received any traf¬c for some time.
This process of PDP context activation results in the mobile device obtaining an IP
address. This IP address can be given either by the operator™s network or by an external
network. To obtain an IP address the user may select a particular service on the mobile
device by scrolling through a menu. For example, the menu may have ˜Internet™ or ˜home
Intranet™ as an item. This request for a connection will be passed through the network
to the SGSN. The SGSN has to locate the correct GGSN, which will be used to route
the data to the correct external network. Note that there may be more than one GGSN
connected to the external network for load sharing and redundancy. To ¬nd the GGSN, the
SGSN will contact a DNS server within the operator™s private network; the DNS server
will return the IP address of the GGSN where the particular connection (known as an
access point ) is located. A GGSN can have a number of access points, i.e. connections,
to different external networks. The SGSN can now contact the GGSN and ask for a PDP
context to be granted for this user. Figure 4.40, illustrates this process.
The PDP context ensures that a GPRS Tunnel is set up between the SGSN and GGSN
for the sole use of this user. An IP address for the mobile device will also be given to
the mobile station at this time. It should be noted that the GGSN may not be in the same
network as the SGSN. This is the case when the mobile is in a visited or V-PLMN and may
wish to connect to an access point in its H-PLMN. Figure 4.41 illustrates the end points

Source address : LLC and RLC, protected data
Source address :
Dest address : - delay class 4 (best effort)
Dest address :
- precedence class: normal
- Version number: 1 (1h) priority
- Version number: 1 (1h)
- Protocol type: 1 (1h) - peak throughput : up to 256
- Protocol type: 1 (1h)
- Extension header flag: 0 (0h) 000 octet/s
- Extension header flag: 0
- Sequence number flag: 1 (1h) - mean throughput : best effort
- N-PDU number flag: 0 (0h) - traffic class : subscribed
- Sequence number flag: 1 (1h)
- Message Type: 51 (SGSN CONTEXT - delivery order: with delivery
- N-PDU number flag: 0 (0h)
RESPONSE) order ('yes')
- Message Type: 50 (SGSN
- Header Length: 117 (75h) - delivery of erroneous SDUs:
- Tunnel endpoint id: 0 not delivered
- Header Length: 30 (1eh)
(00000000h) - maximum SDU size: 1500
- Tunnel endpoint id: 0
- Sequence number: 13 (dh) - maximum bit rate for uplink:
- No extension header 2048 kbps
- Sequence number: 13 (dh)
Cause - maximum bit rate for downlink:
- No extension header
- acceptance: request accepted 2048 kbps
Routeing Area Identity
IMSI - residual BER: 1*10-5
- MCC : 511
- MCC : 511 - SDU error ratio: 1*10-6
- MNC : 044
- NMSI : 232134628909 - transfer delay: subscribed (MS
- LAC : 38 (0026h)
Tunnel Endpoint Iden CP only)
- RAC : 1 (01h)
- id: 13 (0000000Dh) - traffic handling priority:
MM Context subscribed
- TLLI : foreign TLLI
- length : 17 (0011h) - guaranteed bit rate for
- security mode : GSM key and uplink: subscribed (MS only)
MS Validated : no
triplets - guaranteed bit rate for
Tunnel Endpoint Iden CP
- CKSN : 1 (01h) downlink: subscribed (MS only)
- id: 0 (00000000h)
- Used Cipher : GEA/2 - QoS REQ
SGSN Address for Control Plane
- KC : FF 03 91 AC 02 8F E5 54 - length 4 (04h)
- length: 4 (4h)
- split PG Cycle value: 7 - allocation/retention priority
- Ipv4 Address:
- DRX cycle length coefficient not 0 (00h)
specified - subscribed reliability class
- split pg cycle on CCCH not - subscribed delay class
NEW SGSN supported - precedence class: subscribed
- max. 2 sec non-DRX mode after - peak throughput : subscribed
Source address :
transfer state peak throughput
Dest address :
- MS Network capability: - mean throughput : Subscribed
- Encryption algorithm GEA/1 - QoS NEG
- Version number: 1 (1h)
available - length 4 (04h)
- Protocol type: 1 (1h)
- SM capabilities via dedicated - allocation/retention priority
- Extension header flag: 0
channels supported 0 (00h)
- SM capabilities via GPRS - unacknowledged GTP;
- Sequence number flag: 1 (1h)
channels supported acknowledged LLC and RLC,
- N-PDU number flag: 0 (0h)
- Use of default alphabet over protected data
- Message Type: 52 (SGSN
UCS2 prefered - delay class 4 (best effort)
- Capab. of ellipsis notation and - precedence class: normal
- Header Length: 19 (13h)
phase 2 error handling priority
- Tunnel endpoint id: 13
- The ME does not support SoLSA - peak throughput : up to 256
- Mobile station supporting 000 octet/s
- Sequence number: 13 (dh)
earlier versions of the protocol - mean throughput : best effort
- No extension header
- Mobile station does not support - SND : 0 (0000h)
BSS packet flow procedures - SNU : 4 (0004h)
- acceptance: request accepted
- encryption algorithm GEA/2 - send N-PDU : 0 (00h)
Tunnel Endpoint Iden Data II
available - receive N-PDU : 4 (04h)
- NSAPI: 5(5h)
- encryption algorithm GEA/3 not - uplink TEI Control Plane:
- id: 11 (0000000Bh)
available 16777296 (01000050h)
SGSN Address for user traffic
- encryption algorithm GEA/4 not - uplink TEI Data I: 15802628
- length: 4 (4h)
available (00F12104h)
- Ipv4 Address:
- encryption algorithm GEA/5 not - PDP Context Identifier: 10
available (0Ah)
- encryption algorithm GEA/6 not - PDP type organisation :
available reserved value 10 (0Ah)
- encryption algorithm GEA/7 not - PDP type number : 3 (03h)
available - PDP address length: 2 (02h)
- container length : 0 (00h) - PDP address: : 040A
PDP Context - GGSN address for control
- length: 67 (0043h) plane:
- NSAPI: 5 (05h) - length 10 (0Ah)
- order : No - address: : [Abridged]
- VAA : No - GGSN address for User Traffic:
- SAPI: 5 (05h) - length 108 (6Ch)
- QoS Sub - address: : [Abridged]
- length 12 (0Ch) - transaction identifier 0
- allocation/retention priority 2 (000h)
(02h) Unknown IE: 0 (0h)
- unacknowledged GTP; acknowledged

Figure 4.39 Inter SGSN trace. Reproduced by permission of NetHawk Oyj

io HLR
tio External
sc Network
ub GPRS Backbone
Mobile S Corp1
Station BSC

Name L
ookup GGSN
DNS Lookup Table
Access Point GGSN IP Address External
Corp1 Network

Figure 4.40 PDP context activation

GSM Backbone


Intranet 1

GPRS Backbone Operator 1
Station BSC Intranet 2

Intranet 3
GTP tunnel
GRX nn Internet

SGSN GGSN Intranet
GPRS Backbone Operator 2

Figure 4.41 GTP tunnel

of the tunnel between SGSN and GGSN in the local network, and also a tunnel through
the global roaming exchange (GRX) to another PLMN network in a different country.
Note also that the GGSNs can have a number of access points to external networks.
Once a PDP context has been activated, the user can then use the services provided
by the particular access point. For example, if the user with a device possessing the

appropriate application software connected to the access point ˜Internet™ then they would
be able to ˜surf the web™. Suppose the user requests a web page from a server, ˜get page
request www.orbitage.com/default.htm™. The web server will respond with the web page,
and the destination IP address from the web server™s point of view will be the mobile
device which made the initial request. This IP address will be routed back across the
Internet to the GGSN. The GGSN now needs to send it to the correct SGSN for ¬nal
delivery to the mobile device. It does this by cross-referencing the IP address with all of
the tunnel identi¬ers it has; hopefully there will be a match. The tunnel identi¬er actually
comprises the IMSI of the mobile device and is therefore unique. As long as the IP
address arriving at the GGSN is also unique, there should be no problem with mapping
one onto the other.
The GPRS tunnel now transfers the IP packet to the SGSN. Once the data arrives at the
SGSN, the IP packet is removed from the GPRS tunnel. The SGSN now needs to resolve
the IP address into the P-TMSI address of the mobile device. The unique connection
from the SGSN to the mobile device is known as the temporary logical link identi¬er
(TLLI) and comprises the P-TMSI of the mobile device. The TLLI uniquely identi¬es the
mobile device within an RA. It is sent in all packet transfers. The SGSN has a database
of P-TMSI to IMSI mapping which will identify the correct mobile device to which it
should deliver the response.
Figure 4.42 shows how the IP packet is transported from the web server back to the
mobile device. The GTP header (containing the IMSI) is routed to the correct SGSN via
the underlying protocol (another IP network). Once the packet reaches the SGSN, the
GTP header is discarded and a new TLL header is added. It is possible that between the
SGSN and mobile device, the IP packet may be broken into smaller sections and carried
by separate LLC frames. It is actually the SNDCP that deals with this segmentation
and reassembly.


. 30
( 132 .)