3GPP TS 24.008

3GPP TS 24.008 V18.4.
0 (2023-09)
Technical Specification
3rd Generation Partnership Project;
Technical Specification Group Core Network and Terminals;
Mobile radio interface Layer 3 specification;
Core network protocols; Stage 3
(Release 18)
The present document has been developed within the 3rd Generation Partnership Project (3GPP TM) and may be further elaborated for the purposes of 3GPP.
The present document has not been subject to any approval process by the 3GPP Organisational Partners and shall not be implemented.
This Specification is provided for future development work within 3GPP only. The Organisational Partners accept no liability for any use of this Specification.
Specifications and reports for implementation of the 3GPP TM system should be obtained via the 3GPP Organisational Partners' Publications Offices.
Release 18 3 3GPP TS 24.008 V18.4.0 (2023-09)
Keywords
UMTS, GSM, radio, layer 3, stage 3, network,
LTE
3GPP
Postal address
3GPP support office address

650 Route des Lucioles - Sophia Antipolis
Valbonne - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Internet
http://www.3gpp.org
Copyright Notification
No part may be reproduced except as authorized by written permission.

The copyright and the foregoing restriction extend to reproduction in all media.
© 2023, 3GPP Organizational Partners (ARIB, ATIS, CCSA, ETSI, TSDSI, TTA, TTC).
All rights reserved.
UMTS™ is a Trade Mark of ETSI registered for the benefit of its members
3GPP™ is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners
LTE™ is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners
GSM® and the GSM logo are registered and owned by the GSM Association
ETSI
Release 18 4 3GPP TS 24.008 V18.4.0 (2023-09)
Contents
Foreword...........................................................................................................................................................
Introduction.......................................................................................................................................................
1 Scope.......................................................................................................................................................
1.1 Scope of the Technical Specification................................................................................................................
1.2 Application to the interface structures...............................................................................................................
1.3 Structure of layer 3 procedures..........................................................................................................................
1.4 Test procedures..................................................................................................................................................
1.5 Use of logical channels in A/Gb mode..............................................................................................................
1.6 Overview of control procedures........................................................................................................................
1.6.1 List of procedures.........................................................................................................................................30
1.7 Applicability of implementations......................................................................................................................
1.7.1 Voice Group Call Service (VGCS) and Voice Broadcast Service (VBS)...................................................32
1.7.2 General Packet Radio Service (GPRS)........................................................................................................32
1.7.2.1 Packet services in GSM (A/Gb mode only)...........................................................................................32
1.7.2.2 Packet services in Iu mode (Iu mode only)............................................................................................33
1.8 Handling of NAS signalling low priority indication.........................................................................................
1.9 Restrictions........................................................................................................................................................
2 References...............................................................................................................................................
2.1 Definitions and abbreviations............................................................................................................................
2.1.1 Random values.............................................................................................................................................42
2.1.2 Vocabulary...................................................................................................................................................42
3 Radio Resource management procedures...............................................................................................
4 Elementary procedures for Mobility Management.................................................................................
4.1 General...............................................................................................................................................................
4.1.1 MM and GMM procedures..........................................................................................................................48
4.1.1.1 Types of MM and GMM procedures.....................................................................................................48
4.1.1.1.1 Integrity Checking of Signalling Messages in the Mobile Station (Iu mode only)..........................50
4.1.1.1.1a Integrity protection for emergency call (Iu mode only)...................................................................52
4.1.1.2 MM-GMM co-ordination for GPRS MS's.............................................................................................52
4.1.1.2.1 GPRS MS operating in mode A or B in a network that operates in mode I.....................................52
4.1.1.2.2 GPRS MS operating in mode A or B in a network that operates in mode II....................................53
4.1.1.2A Coordination between GMM and EMM................................................................................................54
4.1.1.2B Coordination between GMM and 5GMM..............................................................................................54
4.1.1.3 Core Network System Information for MM (Iu mode only).................................................................54
4.1.1.4 Core Network System Information for GMM (Iu mode only)...............................................................54
4.1.1.4.1 General..............................................................................................................................................54
4.1.1.4.2 Control of Network Mode of Operation I.........................................................................................54
4.1.1.5 Access class control...............................................................................................................................55
4.1.1.6 Specific requirements for MS configured to use timer T3245...............................................................56
4.1.1.6A Specific requirements for the MS when receiving non-integrity protected reject messages.................56
4.1.1.7 Handling of NAS level mobility management congestion control........................................................62
4.1.1.8 Handling of security related parameters at switch on and switch off....................................................63
4.1.1.9 Equivalent PLMNs list...........................................................................................................................63
4.1.1.10 Dedicated core network..........................................................................................................................63
4.1.2 MM sublayer states......................................................................................................................................64
4.1.2.1 MM sublayer states in the mobile station...............................................................................................64
4.1.2.1.1 Main states........................................................................................................................................64
4.1.2.1.2 Substates of the MM IDLE state......................................................................................................67
4.1.2.2 The update Status...................................................................................................................................69
4.1.2.3 MM sublayer states on the network side................................................................................................69
4.1.3 GPRS mobility management (GMM) sublayer states..................................................................................71
4.1.3.1 GMM states in the MS...........................................................................................................................71
4.1.3.1.1 Main states........................................................................................................................................71
4.1.3.1.2 Substates of state GMM-DEREGISTERED....................................................................................72
ETSI
Release 18 5 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.3.1.3 Substates of state GMM-REGISTERED..........................................................................................72

4.1.3.2 GPRS update status................................................................................................................................75
4.1.3.3 GMM mobility management states on the network side........................................................................75
4.1.3.3.1 Main States.......................................................................................................................................76
4.1.3.3.2 Substates of state GMM-REGISTERED..........................................................................................76
4.2 Behaviour of the MS in MM Idle state, GMM-DEREGISTERED state and GMM-REGISTERED state.......
4.2.1 Primary Service State selection....................................................................................................................77
4.2.1.1 Selection of the Service State after Power On.......................................................................................77
4.2.1.2 Other Cases............................................................................................................................................78
4.2.2 Detailed Description of the MS behaviour in MM IDLE State...................................................................78
4.2.2.1 Service State, NORMAL SERVICE......................................................................................................78
4.2.2.2 Service State, ATTEMPTING TO UPDATE........................................................................................79
4.2.2.3 Service State, LIMITED SERVICE.......................................................................................................79
4.2.2.4 Service State, NO IMSI..........................................................................................................................80
4.2.2.5 Service State, SEARCH FOR PLMN, NORMAL SERVICE...............................................................80
4.2.2.6 Service State, SEARCH FOR PLMN....................................................................................................81
4.2.2.7 Service State, RECEIVING GROUP CALL (NORMAL SERVICE)...................................................81
4.2.2.8 Service State, RECEIVING GROUP CALL (LIMITED SERVICE)....................................................81
4.2.2.9 Service State, eCALL INACTIVE.........................................................................................................82
4.2.3 Service state when back to state MM IDLE from another state..................................................................82
4.2.4 Behaviour in state GMM-DEREGISTERED..............................................................................................83
4.2.4.1 Primary substate selection......................................................................................................................83
4.2.4.1.1 Selection of the substate after power on or enabling the MS's GPRS capability.............................83
4.2.4.1.2 Other Cases.......................................................................................................................................84
4.2.4.2 Detailed description of the MS behaviour in state GMM-DEREGISTERED.......................................84
4.2.4.2.1 Substate, NORMAL-SERVICE.......................................................................................................84
4.2.4.2.2 Substate, ATTEMPTING-TO-ATTACH.........................................................................................84
4.2.4.2.3 Substate, LIMITED-SERVICE........................................................................................................85
4.2.4.2.4 Substate, NO-IMSI...........................................................................................................................85
4.2.4.2.5 Substate, NO-CELL..........................................................................................................................85
4.2.4.2.6 Substate, PLMN-SEARCH..............................................................................................................85
4.2.4.2.7 Substate, ATTACH-NEEDED.........................................................................................................85
4.2.4.2.8 Substate, SUSPENDED (A/Gb mode only).....................................................................................85
4.2.4.3 Substate when back to state GMM-DEREGISTERED from another GMM state................................85
4.2.5 Behaviour in state GMM-REGISTERED....................................................................................................86
4.2.5.1 Detailed description of the MS behaviour in state GMM-REGISTERED............................................86
4.2.5.1.1 Substate, NORMAL-SERVICE.......................................................................................................86
4.2.5.1.2 Substate, SUSPENDED (A/Gb mode only).....................................................................................86
4.2.5.1.3 Substate, UPDATE-NEEDED..........................................................................................................87
4.2.5.1.4 Substate, ATTEMPTING-TO-UPDATE.........................................................................................87
4.2.5.1.5 Substate, NO-CELL-AVAILABLE.................................................................................................88
4.2.5.1.6 Substate, LIMITED-SERVICE........................................................................................................88
4.2.5.1.7 Substate, ATTEMPTING-TO-UPDATE-MM.................................................................................88
4.2.5.1.8 Substate, PLMN-SEARCH..............................................................................................................88
4.3 MM common procedures...................................................................................................................................
4.3.1 TMSI reallocation procedure.......................................................................................................................88
4.3.1.0 General...................................................................................................................................................88
4.3.1.1 TMSI reallocation initiation by the network..........................................................................................89
4.3.1.2 TMSI reallocation completion by the mobile station.............................................................................89
4.3.1.3 TMSI reallocation completion in the network.......................................................................................89
4.3.1.4 Abnormal cases in the mobile station....................................................................................................89
4.3.1.5 Abnormal cases on the network side......................................................................................................90
4.3.2 Authentication procedure.............................................................................................................................90
4.3.2a Authentication procedure used for a UMTS authentication challenge..................................................90
4.3.2b Authentication Procedure used for a GSM authentication challenge.....................................................91
4.3.2.1 Authentication request by the network...................................................................................................91
4.3.2.2 Authentication response by the mobile station.......................................................................................91
4.3.2.3 Authentication processing in the network..............................................................................................92
4.3.2.3a 128-bit circuit-switched GSM ciphering key.........................................................................................92
4.3.2.4 Ciphering key sequence number............................................................................................................92
4.3.2.5 Authentication not accepted by the network..........................................................................................93
ETSI
Release 18 6 3GPP TS 24.008 V18.4.0 (2023-09)
4.3.2.5.1 Authentication not accepted by the MS............................................................................................94

4.3.2.6 Abnormal cases......................................................................................................................................95
4.3.2.6.1 MS behaviour towards a network that has failed the authentication procedure...............................97
4.3.2.7 Handling of keys at intersystem change from Iu mode to A/Gb mode..................................................97
4.3.2.7a Use of established security contexts.......................................................................................................98
4.3.2.8 Handling of keys at intersystem change from A/Gb mode to Iu mode..................................................99
4.3.2.9 Void......................................................................................................................................................100
4.3.2.10 Derivation of keys at SRVCC or vSRVCC handover from S1 mode..................................................100
4.3.2.10.0 General............................................................................................................................................100
4.3.2.10.1 PDN connection with integrity protection......................................................................................100
4.3.2.10.2 PDN connection without integrity protection.................................................................................100
4.3.2.11 Derivation of keys at SRVCC handover from Iu mode to Iu mode.....................................................100
4.3.2.12 Derivation of keys at SRVCC handover from Iu mode to A/Gb mode...............................................102
4.3.2.13 Derivation of keys at CS to PS SRVCC handover from A/Gb mode to Iu mode................................103
4.3.2.14 Derivation of keys at 5G-SRVCC from NG-RAN to UTRAN............................................................105
4.3.2.14.1 PDU session with integrity protection............................................................................................105
4.3.2.14.2 PDU session without integrity protection.......................................................................................105
4.3.3 Identification procedure.............................................................................................................................105
4.3.3.0 General.................................................................................................................................................105
4.3.3.1 Identity request by the network............................................................................................................105
4.3.3.2 Identification response by the mobile station.......................................................................................105
4.3.3.3 Abnormal cases in the mobile station..................................................................................................106
4.3.3.4 Abnormal cases on the network side....................................................................................................106
4.3.4 IMSI detach procedure...............................................................................................................................106
4.3.4.0 General.................................................................................................................................................106
4.3.4.1 IMSI detach initiation by the mobile station........................................................................................107
4.3.4.2 IMSI detach procedure in the network.................................................................................................107
4.3.4.3 IMSI detach completion by the mobile station....................................................................................107
4.3.4.4 Abnormal cases....................................................................................................................................107
4.3.5 Abort procedure.........................................................................................................................................108
4.3.5.1 Abort procedure initiation by the network...........................................................................................108
4.3.5.2 Abort procedure in the mobile station..................................................................................................108
4.3.6 MM information procedure........................................................................................................................108
4.3.6.1 MM information procedure initiation by the network..........................................................................108
4.3.6.2 MM information procedure in the mobile station................................................................................109
4.4 MM specific procedures..................................................................................................................................
4.4.1 Location updating procedure.....................................................................................................................109
4.4.2 Periodic updating.......................................................................................................................................111
4.4.3 IMSI attach procedure................................................................................................................................112
4.4.4 Generic Location Updating procedure.......................................................................................................112
4.4.4.1 Location updating initiation by the mobile station...............................................................................112
4.4.4.1a Network Request for Additional mobile station Capability Information.............................................113
4.4.4.2 Identification request from the network...............................................................................................113
4.4.4.3 Authentication by the network.............................................................................................................113
4.4.4.4 Security mode setting by the network..................................................................................................113
4.4.4.5 Location Update Attempt Counter.......................................................................................................113
4.4.4.6 Location updating accepted by the network.........................................................................................114
4.4.4.7 Location updating not accepted by the network...................................................................................116
4.4.4.8 Release of RR connection after location updating...............................................................................117
4.4.4.9 Abnormal cases on the mobile station side..........................................................................................118
4.4.5 Void............................................................................................................................................................120
4.4.6 Void............................................................................................................................................................120
4.4.7 eCall inactivity procedure..........................................................................................................................120
4.5 Connection management sublayer service provision......................................................................................
4.5.1 MM connection establishment...................................................................................................................121
4.5.1.1 MM connection establishment initiated by the mobile station.............................................................121
ETSI
Release 18 7 3GPP TS 24.008 V18.4.0 (2023-09)
4.5.1.2 Abnormal cases....................................................................................................................................125

4.5.1.3 MM connection establishment initiated by the network......................................................................127
4.5.1.3.1 Mobile Terminating CM Activity...................................................................................................127
4.5.1.3.2 Mobile Originating CM Activity $(CCBS)$..................................................................................127
4.5.1.3.3 Paging response in Iu mode (Iu mode only)...................................................................................128
4.5.1.3.4 Paging response for CS fallback.....................................................................................................129
4.5.1.4 Abnormal cases....................................................................................................................................129
4.5.1.5 MM connection establishment for emergency calls.............................................................................129
4.5.1.5a MM connection establishment for emergency calls for CS fallback...................................................130
4.5.1.6 Call re-establishment............................................................................................................................130
4.5.1.6.1 Call re-establishment, initiation by the mobile station...................................................................131
4.5.1.6.2 Abnormal cases...............................................................................................................................133
4.5.1.7 Forced release during MO MM connection establishment..................................................................133
4.5.1.8 MM connection establishment due to SRVCC or vSRVCC handover................................................134
4.5.1.9 MM connection establishment due to Dual Radio Voice Call Continuity (DRVCC) access transfer.134
4.5.2 MM connection information transfer phase...............................................................................................134
4.5.2.1 Sending CM messages.........................................................................................................................135
4.5.2.2 Receiving CM messages......................................................................................................................135
4.5.2.3 Abnormal cases....................................................................................................................................135
4.5.3 MM connection release..............................................................................................................................135
4.5.3.1 Release of associated RR connection...................................................................................................135
4.5.3.2 Uplink release in a voice group call.....................................................................................................136
4.6 Receiving a MM STATUS message by a MM entity.....................................................................................
4.7 Elementary mobility management procedures for GPRS services..................................................................
4.7.1 General.......................................................................................................................................................136
4.7.1.1 Lower layer failure...............................................................................................................................136
4.7.1.2 Ciphering of messages (A/Gb mode only)...........................................................................................136
4.7.1.2a Integrity protection of layer 3 signalling messages (A/Gb mode only and when integrity protection is
required)...............................................................................................................................................137
4.7.1.2a.1 General............................................................................................................................................137
4.7.1.2a.2 Integrity checking of GMM signalling messages in the MS..........................................................137
4.7.1.2a.3 Integrity checking of layer 3 signalling messages in the network..................................................137
4.7.1.2a.4 Establishment of integrity protection of layer 3 signalling messages............................................138
4.7.1.2a.5 Optional establishment of integrity protection in the user plane....................................................139
4.7.1.2a.6 Change of security keys..................................................................................................................139
4.7.1.3 P-TMSI signature.................................................................................................................................139
4.7.1.4 Radio resource sublayer address handling...........................................................................................140
4.7.1.4.1 Radio resource sublayer address handling (A/Gb mode only).......................................................140
4.7.1.5 P-TMSI handling..................................................................................................................................141
4.7.1.5.1 P-TMSI handling in A/Gb mode....................................................................................................141
4.7.1.5.2 P-TMSI handling in Iu mode..........................................................................................................142
4.7.1.5.3 Void................................................................................................................................................142
4.7.1.5.4 Void................................................................................................................................................142
4.7.1.6 Change of network mode of operation.................................................................................................142
4.7.1.6.1 Change of network mode of operation in A/Gb mode (A/Gb mode only).....................................142
4.7.1.6.2 Change of network mode of operation in Iu mode (Iu mode only)................................................142
4.7.1.6.3 Change of network mode of operation at Iu mode to A/Gb mode inter-system change................143
4.7.1.6.4 Change of network mode of operation at A/Gb mode to Iu mode inter-system change................143
4.7.1.7 Intersystem change between A/Gb mode and Iu mode........................................................................144
4.7.1.7a Intersystem change from S1 mode to A/Gb mode or S1 mode to Iu mode with ISR activated...........145
4.7.1.7b Intersystem change from S1 mode to A/Gb mode or S1 mode to Iu mode for eCall only MS capable of
eCall over IMS.....................................................................................................................................146
4.7.1.7c Return to packet idle mode for eCall only MS capable of eCall over IMS.........................................146
4.7.1.8 List of forbidden PLMNs for GPRS service........................................................................................146
4.7.1.8a Establishment of the PS signalling connection (Iu mode only)...........................................................147
4.7.1.9 Release of the PS signalling connection (Iu mode only)......................................................................147
4.7.1.10 Handling of 3GPP PS data off..............................................................................................................148
4.7.2 GPRS Mobility management timers and UMTS PS signalling connection control..................................149
4.7.2.1 READY timer behaviour......................................................................................................................149
4.7.2.1.1 READY timer behaviour (A/Gb mode only).................................................................................149
4.7.2.1.2 Handling of READY timer in the MS in Iu mode and S1 mode....................................................150
ETSI
Release 18 8 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.2.1.2a Handling of READY timer in the network in Iu mode and S1 mode.............................................150

4.7.2.2 Periodic routing area updating.............................................................................................................151
4.7.2.3 PMM-IDLE mode and PMM-CONNECTED mode (Iu mode only)...................................................153
4.7.2.4 Handling of Force to standby in Iu mode (Iu mode only)...................................................................153
4.7.2.5 RA Update procedure for Signalling Connection Re-establishment (Iu mode only)...........................153
4.7.2.6 Cell Update triggered by low layers.....................................................................................................153
4.7.2.7 Handling of timer T3302......................................................................................................................154
4.7.2.8 Handling of timer T3324 (A/Gb mode, Iu mode and S1 mode)..........................................................154
4.7.2.9 Power saving mode..............................................................................................................................155
4.7.2.10 Extended idle-mode DRX cycle...........................................................................................................156
4.7.2.11 Interaction between power saving mode and extended idle mode DRX cycle....................................156
4.7.2.12 Extended coverage for GSM................................................................................................................156
4.7.3 GPRS attach procedure..............................................................................................................................157
4.7.3.1 GPRS attach procedure for GPRS services..........................................................................................159
4.7.3.1.1 GPRS attach procedure initiation...................................................................................................159
4.7.3.1.2 GMM common procedure initiation...............................................................................................160
4.7.3.1.3 GPRS attach accepted by the network............................................................................................161
4.7.3.1.4 GPRS attach not accepted by the network......................................................................................164
4.7.3.1.4a GPRS attach for emergency bearer services not accepted by the network (UTRAN Iu mode only)
........................................................................................................................................................169
4.7.3.1.4b Attach for initiating a PDN connection for emergency bearer services not accepted by the network
(UTRAN Iu mode only).................................................................................................................170
4.7.3.1.5 Abnormal cases in the MS..............................................................................................................170
4.7.3.1.6 Abnormal cases on the network side..............................................................................................173
4.7.3.2 Combined GPRS attach procedure for GPRS and non-GPRS services...............................................174
4.7.3.2.1 Combined GPRS attach procedure initiation..................................................................................175
4.7.3.2.2 GMM Common procedure initiation..............................................................................................175
4.7.3.2.3 Combined GPRS attach accepted by the network..........................................................................175
4.7.3.2.4 Combined GPRS attach not accepted by the network....................................................................177
4.7.4 GPRS detach procedure.............................................................................................................................182
4.7.4.0 General.................................................................................................................................................182
4.7.4.1 MS initiated GPRS detach procedure...................................................................................................183
4.7.4.1.1 MS initiated GPRS detach procedure initiation..............................................................................183
4.7.4.1.2 MS initiated GPRS detach procedure completion for GPRS services only...................................183
4.7.4.1.3 MS initiated combined GPRS detach procedure completion.........................................................184
4.7.4.2 Network initiated GPRS detach procedure..........................................................................................187
4.7.4.2.1 Network initiated GPRS detach procedure initiation.....................................................................187
4.7.4.2.2 Network initiated GPRS detach procedure completion by the MS................................................187
4.7.4.2.3 Network initiated GPRS detach procedure completion by the network.........................................192
4.7.5 Routing area updating procedure...............................................................................................................193
4.7.5.1 Normal and periodic routing area updating procedure.........................................................................196
4.7.5.1.1 Normal and periodic routing area updating procedure initiation....................................................197
4.7.5.1.3 Normal and periodic routing area updating procedure accepted by the network...........................199
4.7.5.1.4 Normal and periodic routing area updating procedure not accepted by the network.....................205
4.7.5.1.4a Routing area updating procedure for initiating a PDN connection for emergency bearer services
not accepted by the network (UTRAN Iu mode only)...................................................................211
4.7.5.2 Combined routing area updating procedure.........................................................................................217
4.7.5.2.0 General............................................................................................................................................217
4.7.5.2.1 Combined routing area updating procedure initiation....................................................................217
4.7.5.2.3 Combined routing area updating procedure accepted by the network...........................................219
4.7.5.2.4 Combined routing area updating not accepted by the network......................................................222
ETSI
Release 18 9 3GPP TS 24.008 V18.4.0 (2023-09)

4.7.6 P-TMSI reallocation procedure..................................................................................................................228
4.7.6.0 General.................................................................................................................................................228
4.7.6.1 P-TMSI reallocation initiation by the network.....................................................................................228
4.7.6.2 P-TMSI reallocation completion by the MS........................................................................................228
4.7.6.3 P-TMSI reallocation completion by the network.................................................................................228
4.7.6.3A Abnormal cases in the MS...................................................................................................................228
4.7.7 Authentication and ciphering procedure....................................................................................................230
4.7.7a Authentication and ciphering procedure used for UMTS authentication challenge............................230
4.7.7b Authentication and ciphering procedure used for GSM authentication challenge...............................231
4.7.7c Change of the ciphering algorithm at PS Handover.............................................................................231
4.7.7.1 Authentication and ciphering initiation by the network.......................................................................231
4.7.7.2 Authentication and ciphering response by the MS...............................................................................233
4.7.7.3 Authentication and ciphering completion by the network...................................................................235
4.7.7.3a 128-bit packet-switched GSM ciphering key.......................................................................................236
4.7.7.3b 128-bit packet-switched GSM integrity key (in A/Gb mode and only if MS supports integrity
protection)............................................................................................................................................236
4.7.7.4 GPRS ciphering key sequence number................................................................................................237
4.7.7.5 Authentication not accepted by the network........................................................................................238
4.7.7.5.1 Authentication not accepted by the MS..........................................................................................239
4.7.7.6 Abnormal cases....................................................................................................................................239
4.7.7.6.1 MS behaviour towards a network that has failed the authentication procedure.............................243
4.7.7.7 Use of established security contexts.....................................................................................................244
4.7.7.8 Handling of keys at intersystem change from Iu mode to A/Gb mode................................................245
4.7.7.9 Handling of keys at intersystem change from A/Gb mode to Iu mode................................................245
4.7.7.10 Handling of keys at intersystem change from S1 mode to Iu mode or A/Gb mode............................246
4.7.8 Identification procedure.............................................................................................................................248
4.7.8.1 Identification initiation by the network................................................................................................248
4.7.8.2 Identification response by the MS........................................................................................................248
4.7.8.3 Identification completion by the network............................................................................................248
4.7.8.3a Abnormal cases in the MS...................................................................................................................248
4.7.9 Paging procedure........................................................................................................................................250
4.7.9.1 Paging for GPRS services....................................................................................................................250
4.7.9.1.1 Paging for GPRS services using P-TMSI.......................................................................................250
4.7.9.1.2 Paging for GPRS services using IMSI...........................................................................................251
4.7.9.2 Paging for non-GPRS services.............................................................................................................252
4.7.10 Receiving a GMM STATUS message by a GMM entity..........................................................................252
4.7.11 Void............................................................................................................................................................252
4.7.12 GMM Information procedure.....................................................................................................................252
4.7.12.1 GMM information procedure initiation by the network.......................................................................252
4.7.12.2 GMM information procedure in the mobile station.............................................................................252
4.7.13 Service Request procedure (Iu mode only)................................................................................................252
4.7.13.1 Service Request procedure initiation....................................................................................................254
4.7.13.2 GMM common procedure initiation....................................................................................................255
4.7.13.3 Service request procedure accepted by the network............................................................................255
4.7.13.4 Service request procedure not accepted by the network......................................................................256
4.7.13.4a Service request procedure for initiating a PDN connection for emergency bearer services not accepted
by the network (UTRAN Iu mode only)..............................................................................................260
4.7.13.5 Abnormal cases in the MS...................................................................................................................261
4.7.14 Void............................................................................................................................................................264
4.7.15 GMM eCall inactivity procedure...............................................................................................................264
5 Elementary procedures for circuit-switched Call Control....................................................................
5.1 Overview.........................................................................................................................................................
5.1.1 General.......................................................................................................................................................265
5.1.2 Call Control States.....................................................................................................................................273
5.1.2.1 Call states at the mobile station side of the interface...........................................................................273
5.1.2.1.1 Null (State U0)................................................................................................................................273
5.1.2.1.2 MM Connection pending (U0.1)....................................................................................................273
ETSI
Release 18 10 3GPP TS 24.008 V18.4.0 (2023-09)
5.1.2.1.2a CC prompt present (U0.2) $(CCBS)$............................................................................................273

5.1.2.1.2b Wait for network information (U0.3) $(CCBS)$...........................................................................273
5.1.2.1.2c CC-Establishment present (U0.4) $(CCBS)$.................................................................................273
5.1.2.1.2d CC-Establishment confirmed (U0.5) $(CCBS)$............................................................................273
5.1.2.1.2e Recall present (U0.6) $(CCBS)$....................................................................................................273
5.1.2.1.3 Call initiated (U1)...........................................................................................................................273
5.1.2.1.4 Mobile originating call proceeding (U3)........................................................................................274
5.1.2.1.5 Call delivered (U4).........................................................................................................................274
5.1.2.1.6 Call present (U6)............................................................................................................................274
5.1.2.1.7 Call received (U7)..........................................................................................................................274
5.1.2.1.8 Connect Request (U8)....................................................................................................................274
5.1.2.1.9 Mobile terminating call confirmed (U9).........................................................................................274
5.1.2.1.10 Active (U10)...................................................................................................................................274
5.1.2.1.11 Disconnect request (U11)...............................................................................................................274
5.1.2.1.12 Disconnect indication (U12)...........................................................................................................274
5.1.2.1.13 Release request (U19).....................................................................................................................274
5.1.2.1.14 Mobile originating modify (U26)...................................................................................................274
5.1.2.1.15 Mobile terminating modify (U27)..................................................................................................274
5.1.2.2 Network call states...............................................................................................................................275
5.1.2.2.1 Null (State N0)................................................................................................................................275
5.1.2.2.2 MM connection pending (N0.1).....................................................................................................275
5.1.2.2.2a CC connection pending (N0.2) $(CCBS)$.....................................................................................275
5.1.2.2.2b Network answer pending (N0.3) $(CCBS)$...................................................................................275
5.1.2.2.2c CC-Establishment present (N0.4) $(CCBS)$.................................................................................275
5.1.2.2.2d CC-Establishment confirmed (N0.5) $(CCBS)$............................................................................275
5.1.2.2.2e Recall present (N0.6) $(CCBS)$....................................................................................................275
5.1.2.2.3 Call initiated (N1)...........................................................................................................................275
5.1.2.2.4 Mobile originating call proceeding (N3)........................................................................................275
5.1.2.2.5 Call delivered (N4).........................................................................................................................275
5.1.2.2.6 Call present (N6)............................................................................................................................275
5.1.2.2.7 Call received (N7)..........................................................................................................................276
5.1.2.2.8 Connect request (N8)......................................................................................................................276
5.1.2.2.9 Mobile terminating call confirmed (N9).........................................................................................276
5.1.2.2.10 Active (N10)...................................................................................................................................276
5.1.2.2.11 Not used..........................................................................................................................................276
5.1.2.2.12 Disconnect indication (N12)...........................................................................................................276
5.1.2.2.13 Release request (N19).....................................................................................................................276
5.1.2.2.14 Mobile originating modify (N26)...................................................................................................276
5.1.2.2.15 Mobile terminating modify (N27)..................................................................................................276
5.1.2.2.16 Connect Indication (N28)...............................................................................................................276
5.2 Call establishment procedures.........................................................................................................................
5.2.1 Mobile originating call establishment........................................................................................................277
5.2.1.1 Call initiation........................................................................................................................................278
5.2.1.2 Receipt of a setup message...................................................................................................................278
5.2.1.3 Receipt of a CALL PROCEEDING message......................................................................................280
5.2.1.4 Notification of progressing mobile originated call...............................................................................280
5.2.1.4.1 Notification of interworking in connection with mobile originated call establishment.................280
5.2.1.4.2 Call progress in the PLMN/ISDN environment.............................................................................281
5.2.1.5 Alerting.................................................................................................................................................281
5.2.1.6 Call connected......................................................................................................................................281
5.2.1.7 Call rejection........................................................................................................................................282
5.2.1.8 Transit network selection.....................................................................................................................282
5.2.1.9 Traffic channel assignment at mobile originating call establishment..................................................282
5.2.1.10 Call queuing at mobile originating call establishment.........................................................................283
5.2.1.11 Speech Codec Selection.......................................................................................................................283
5.2.1.12 Cellular Text telephone Modem (CTM) selection...............................................................................284
5.2.2 Mobile terminating call establishment.......................................................................................................284
5.2.2.1 Call indication......................................................................................................................................284
5.2.2.2 Compatibility checking........................................................................................................................285
5.2.2.3 Call confirmation..................................................................................................................................285
5.2.2.3.1 Response to SETUP........................................................................................................................285
ETSI
Release 18 11 3GPP TS 24.008 V18.4.0 (2023-09)
5.2.2.3.2 Receipt of CALL CONFIRMED and ALERTING by the network...............................................286

5.2.2.3.3 Call failure procedures....................................................................................................................287
5.2.2.3.4 Called mobile station clearing during mobile terminating call establishment...............................287
5.2.2.4 Notification of interworking in connection with mobile terminating call establishment.....................287
5.2.2.5 Call accept............................................................................................................................................287
5.2.2.6 Active indication..................................................................................................................................288
5.2.2.7 Traffic channel assignment at mobile terminating call establishment.................................................288
5.2.2.8 Call queuing at mobile terminating call establishment........................................................................288
5.2.2.9 User connection attachment during a mobile terminating call.............................................................289
5.2.2.10 Speech Codec Selection.......................................................................................................................289
5.2.2.11 Cellular Text telephone Modem (CTM) selection...............................................................................289
5.2.3 Network initiated MO call $(CCBS)$.......................................................................................................289
5.2.3.1 Initiation...............................................................................................................................................289
5.2.3.2 CC-Establishment present....................................................................................................................289
5.2.3.2.1 Recall Alignment Procedure...........................................................................................................291
5.2.3.3 CC-Establishment confirmation...........................................................................................................292
5.2.3.4 Recall present.......................................................................................................................................292
5.2.3.5 Traffic channel assignment during network initiated mobile originating call establishment..............293
5.2.4 Call establishment for SRVCC or vSRVCC..............................................................................................293
5.2.4.1 General.................................................................................................................................................293
5.2.4.2 Call activation for SRVCC...................................................................................................................293
5.2.4.2a Call activation for vSRVCC.................................................................................................................295
5.2.4.2b Multimedia CAT and vSRVCC handover...........................................................................................296
5.2.4.3 Traffic channel assignment and user connection attachment...............................................................296
5.2.4.4 State verification..................................................................................................................................296
5.3 Signalling procedures during the "active" state...............................................................................................
5.3.1 User notification procedure........................................................................................................................296
5.3.2 Call rearrangements...................................................................................................................................297
5.3.3 Codec Change Procedure...........................................................................................................................297
5.3.4 Support of Dual Services...........................................................................................................................297
5.3.4.1 Service Description..............................................................................................................................297
5.3.4.2 Call establishment................................................................................................................................297
5.3.4.2.1 Mobile Originating Establishment..................................................................................................297
5.3.4.2.2 Mobile Terminating Establishment................................................................................................298
5.3.4.3 Changing the Call Mode......................................................................................................................299
5.3.4.3.1 Initiation of in-call modification.....................................................................................................299
5.3.4.3.2 Successful completion of in-call modification...............................................................................299
5.3.4.3.3 Change of the channel configuration..............................................................................................300
5.3.4.3.4 Failure of in-call modification........................................................................................................300
5.3.4.4 Abnormal procedures...........................................................................................................................301
5.3.5 User initiated service level up- and downgrading (A/Gb mode and GERAN Iu mode only)...................302
5.3.5.1 Initiation of service level up- and downgrading...................................................................................302
5.3.5.2 Successful completion of service level up- and downgrading.............................................................302
5.3.5.3 Rejection of service level up- and downgrading..................................................................................302
5.3.5.4 Time-out recovery................................................................................................................................302
5.3.6 Support of multimedia calls.......................................................................................................................303
5.3.6.1 Service description...............................................................................................................................303
5.3.6.2 Call establishment................................................................................................................................303
5.3.6.2.1 Mobile originated multimedia call establishment...........................................................................303
5.3.6.2.2 Mobile terminating multimedia call...............................................................................................304
5.3.6.2.2.1 Fallback to speech.....................................................................................................................305
5.3.6.3 In-call modification in the "active" state..............................................................................................305
5.3.6.3.1 Void................................................................................................................................................305
5.3.6.3.2 Void................................................................................................................................................305
5.3.6.3.3 Void................................................................................................................................................305
5.3.6.4 Multimedia CAT during the alerting phase of a mobile originated call..............................................305
5.3.6.5 DTMF transmission during a multimedia call.....................................................................................306
5.3.6.6 vSRVCC handover to a circuit-switched multimedia call...................................................................306
5.4 Call clearing.....................................................................................................................................................
5.4.1 Terminology...............................................................................................................................................307
5.4.2 Exception conditions..................................................................................................................................307
ETSI
Release 18 12 3GPP TS 24.008 V18.4.0 (2023-09)
5.4.3 Clearing initiated by the mobile station.....................................................................................................307

5.4.3.1 Initiation of call clearing......................................................................................................................307
5.4.3.2 Receipt of a DISCONNECT message from the mobile station...........................................................307
5.4.3.3 Receipt of a RELEASE message from the network.............................................................................308
5.4.3.4 Receipt of a RELEASE COMPLETE message from the mobile station.............................................308
5.4.3.5 Abnormal cases....................................................................................................................................308
5.4.4 Clearing initiated by the network...............................................................................................................308
5.4.4.1 Clearing initiated by the network: mobile does not support "Prolonged Clearing Procedure"............308
5.4.4.1.1 Clearing when tones/announcements provided....................................................................................308
5.4.4.1.2 Clearing when tones/announcements not provided........................................................................309
5.4.4.1.3 Completion of clearing...................................................................................................................309
5.4.4.2 Clearing initiated by the network: mobile supports "Prolonged Clearing Procedure".........................310
5.4.4.2.1 Clearing when tones/announcements provided and the network does not indicate that "CCBS
activation is possible".....................................................................................................................310
5.4.4.2.2 Clearing when the network indicates that "CCBS activation is possible"......................................310
5.4.4.2.3 Clearing when tones/announcements are not provided and the network does not indicate that
"CCBS activation is possible"........................................................................................................312
5.4.4.2.4 Receipt of a RELEASE message from the mobile station.............................................................312
5.4.4.2.5 Completion of clearing...................................................................................................................313
5.4.5 Call clearing for SRVCC from CS to PS...................................................................................................313
5.5 Miscellaneous procedures................................................................................................................................
5.5.1 In-band tones and announcements.............................................................................................................313
5.5.2 Call collisions.............................................................................................................................................314
5.5.3 Status procedures.......................................................................................................................................314
5.5.3.1 Status enquiry procedure......................................................................................................................314
5.5.3.2 Reception of a STATUS message by a CC entity................................................................................314
5.5.3.2.1 STATUS message with incompatible state....................................................................................314
5.5.3.2.2 STATUS message with compatible state.......................................................................................314
5.5.4 Call re-establishment, mobile station side.................................................................................................315
5.5.4.1 Indication from the mobility management sublayer.............................................................................315
5.5.4.2 Reaction of call control........................................................................................................................315
5.5.4.3 Completion of re-establishment...........................................................................................................315
5.5.4.4 Unsuccessful outcome..........................................................................................................................315
5.5.5 Call re-establishment, network side...........................................................................................................315
5.5.5.1 State alignment.....................................................................................................................................315
5.5.6 Progress......................................................................................................................................................316
5.5.7 DTMF protocol control procedure.............................................................................................................316
5.5.7.1 Start DTMF request by the mobile station...........................................................................................316
5.5.7.2 Start DTMF response by the network..................................................................................................316
5.5.7.3 Stop DTMF request by the mobile station...........................................................................................317
5.5.7.4 Stop DTMF response by the network..................................................................................................317
5.5.7.5 Sequencing of subsequent start DTMF requests by the mobile station...............................................317
6 Support for packet services...................................................................................................................
6.1 GPRS Session management.............................................................................................................................
6.1.1 General.......................................................................................................................................................318
6.1.2 Session management states........................................................................................................................318
6.1.2.1 Session management states in the MS..................................................................................................319
6.1.2.1.1 PDP-INACTIVE.............................................................................................................................319
6.1.2.1.2 PDP-ACTIVE-PENDING..............................................................................................................319
6.1.2.1.3 PDP-INACTIVE-PENDING..........................................................................................................319
6.1.2.1.4 PDP-ACTIVE.................................................................................................................................319
6.1.2.1.5 PDP-MODIFY_PENDING............................................................................................................319
6.1.2.1.6 MBMS-ACTIVE-PENDING.........................................................................................................319
6.1.2.1.7 MBMS-ACTIVE............................................................................................................................319
6.1.2.2 Session management states on the network side..................................................................................321
6.1.2.2.1 PDP-INACTIVE.............................................................................................................................321
6.1.2.2.2 PDP-ACTIVE-PENDING..............................................................................................................321
6.1.2.2.3 PDP-INACTIVE-PENDING..........................................................................................................321
6.1.2.2.4 PDP-ACTIVE.................................................................................................................................321
6.1.2.2.5 PDP-MODIFY-PENDING.............................................................................................................321
6.1.2.2.6 MBMS-ACTIVE-PENDING.........................................................................................................322
ETSI
Release 18 13 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.2.2.7 MBMS-INACTIVE-PENDING.....................................................................................................322
6.1.2.2.8 MBMS-ACTIVE............................................................................................................................322
6.1.2A PDP address allocation...............................................................................................................................323
6.1.2A.1 General.................................................................................................................................................323
6.1.2A.1.1 Interworking with PDN based on IP...............................................................................................323
6.1.2A.1.2 Interworking with PDN based on PPP...........................................................................................323
6.1.2A.2 IP address allocation via NAS signalling.............................................................................................324
6.1.3 Session Management procedures...............................................................................................................324
6.1.3.0 General.................................................................................................................................................324
6.1.3.1 PDP context activation.........................................................................................................................324
6.1.3.1.1 Successful PDP context activation initiated by the mobile station.................................................325
6.1.3.1.2 Successful PDP context activation requested by the network........................................................328
6.1.3.1.3 Unsuccessful PDP context activation initiated by the MS.............................................................328
6.1.3.1.3.1 General......................................................................................................................................328
6.1.3.1.3.2 Handling of network rejection due to SM cause #26................................................................329
6.1.3.1.3.3 Handling of network rejection due to SM cause other than SM cause #26..............................331
6.1.3.1.3A Void................................................................................................................................................334
6.1.3.1.4 Unsuccessful PDP context activation requested by the network....................................................334
6.1.3.1.5 Abnormal cases...............................................................................................................................334
6.1.3.1.6 Handling Activate PDP context request for MS configured for dual priority................................336
6.1.3.2 Secondary PDP Context Activation Procedure....................................................................................337
6.1.3.2.1 Successful Secondary PDP Context Activation Procedure Initiated by the MS............................337
6.1.3.2.1a Successful Secondary PDP Context Activation Procedure Requested by the network..................338
6.1.3.2.2 Unsuccessful Secondary PDP Context Activation Procedure initiated by the MS........................339
6.1.3.2.2.1 General......................................................................................................................................339
6.1.3.2.2a Unsuccessful secondary PDP context activation requested by the network...................................342
6.1.3.2.3 Abnormal cases...............................................................................................................................343
6.1.3.3 PDP context modification procedure...................................................................................................346
6.1.3.3.1 Network initiated PDP Context Modification................................................................................347
6.1.3.3.2 MS initiated PDP Context Modification accepted by the network.................................................348
6.1.3.3.3 MS initiated PDP Context Modification not accepted by the network..........................................349
6.1.3.3.3.1 General......................................................................................................................................349
6.1.3.3.3a Network initiated PDP Context Modification not accepted by the MS..........................................353
6.1.3.3.4 Abnormal cases...............................................................................................................................353
6.1.3.4 PDP context deactivation procedure....................................................................................................358
6.1.3.4.1 PDP context deactivation initiated by the MS................................................................................358
6.1.3.4.2 PDP context deactivation initiated by the network.........................................................................359
6.1.3.4.3 Abnormal cases...............................................................................................................................361
6.1.3.4a Void......................................................................................................................................................362
6.1.3.5 Void......................................................................................................................................................362
6.1.3.5a Notification procedure..........................................................................................................................362
6.1.3.5a.1 General............................................................................................................................................362
6.1.3.5a.2 Notification procedure initiation by the network............................................................................362
6.1.3.5a.3 Notification procedure in the MS...................................................................................................363
6.1.3.6 Receiving a SM STATUS message by a SM entity.............................................................................363
6.1.3.7 Protocol configuration options.............................................................................................................364
6.1.3.8 MBMS context activation....................................................................................................................364
6.1.3.8.1 Successful MBMS context activation.............................................................................................365
6.1.3.8.2 Unsuccessful MBMS context activation requested by the MS......................................................365
6.1.3.8.2.1 General......................................................................................................................................365
6.1.3.8.3 Unsuccessful MBMS context activation requested by the network...............................................367
6.1.3.8.4 Abnormal cases...............................................................................................................................368
6.1.3.9 MBMS context deactivation.................................................................................................................368
6.1.3.9.1 MBMS context deactivation initiated by the network....................................................................369
6.1.3.9.2 Abnormal cases...............................................................................................................................369
ETSI
Release 18 14 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.3.10 MBMS protocol configuration options................................................................................................369

6.1.3.11 Handling of APN based congestion control.........................................................................................369
6.1.3.11A Handling of group specific session management congestion control..................................................370
6.1.3.12 Handling session management request for MS configured for dual priority.......................................370
6.1.3.13 Handling of network rejection not due to APN based congestion control...........................................371
6.1.3.14 Handling of WLAN offload control.....................................................................................................371
6.2 void..................................................................................................................................................................
6.3 Coordination between SM and GMM for supporting ISR..............................................................................
6.4 MSISDN notification procedure......................................................................................................................
7 Examples of structured procedures.......................................................................................................
8 Handling of unknown, unforeseen, and erroneous protocol data.........................................................
8.1 General.............................................................................................................................................................
8.2 Message too short............................................................................................................................................
8.3 Unknown or unforeseen transaction identifier................................................................................................
8.3.1 Call Control................................................................................................................................................373
8.3.2 Session Management..................................................................................................................................374
8.4 Unknown or unforeseen message type............................................................................................................
8.5 Non-semantical mandatory information element errors..................................................................................
8.5.1 Radio resource management......................................................................................................................376
8.5.2 Mobility management................................................................................................................................376
8.5.3 Call control.................................................................................................................................................376
8.5.4 GMM mobility management......................................................................................................................376
8.5.5 Session management..................................................................................................................................376
8.6 Unknown and unforeseen IEs in the non-imperative message part.................................................................
8.6.1 IEIs unknown in the message.....................................................................................................................377
8.6.2 Out of sequence IEs...................................................................................................................................377
8.6.3 Repeated IEs..............................................................................................................................................377
8.7 Non-imperative message part errors................................................................................................................
8.7.1 Syntactically incorrect optional IEs...........................................................................................................377
8.7.2 Conditional IE errors..................................................................................................................................377
8.8 Messages with semantically incorrect contents...............................................................................................
9 Message functional definitions and contents........................................................................................
9.1 Messages for Radio Resources management...................................................................................................
9.2 Messages for mobility management................................................................................................................
9.2.1 Authentication reject..................................................................................................................................380
9.2.2 Authentication request...............................................................................................................................381
9.2.2.1 Authentication Parameter AUTN.........................................................................................................381
9.2.3 Authentication response.............................................................................................................................381
9.2.3.1 Authentication Response Parameter.....................................................................................................382
9.2.3.2 Authentication Response Parameter (extension)..................................................................................382
9.2.3a Authentication Failure................................................................................................................................382
9.2.3a.1 Authentication Failure parameter.........................................................................................................382
9.2.4 CM Re-establishment request....................................................................................................................383
9.2.4.1 Location area identification..................................................................................................................383
9.2.4.2 Mobile Station Classmark....................................................................................................................383
9.2.4.3 Device properties..................................................................................................................................383
9.2.5 CM service accept......................................................................................................................................383
9.2.5a CM service prompt $(CCBS)$...................................................................................................................384
9.2.6 CM service reject.......................................................................................................................................384
9.2.6.1 T3246 value..........................................................................................................................................385
9.2.7 CM service abort........................................................................................................................................385
9.2.8 Abort..........................................................................................................................................................385
9.2.9 CM service request.....................................................................................................................................386
9.2.9.2 Priority..................................................................................................................................................386
9.2.9.3 Additional update parameters...............................................................................................................386
9.2.10 Identity request...........................................................................................................................................387
9.2.11 Identity response........................................................................................................................................387
9.2.12 IMSI detach indication...............................................................................................................................388
ETSI
Release 18 15 3GPP TS 24.008 V18.4.0 (2023-09)

9.2.13 Location updating accept...........................................................................................................................388
9.2.13.1 Follow on proceed................................................................................................................................389
9.2.13.2 CTS permission....................................................................................................................................389
9.2.13.3 Equivalent PLMNs...............................................................................................................................389
9.2.13.4 Emergency Number List......................................................................................................................389
9.2.13.5 Per MS T3212......................................................................................................................................389
9.2.13.6 Non-3GPP NW provided policies........................................................................................................389
9.2.14 Location updating reject.............................................................................................................................390
9.2.14.1 T3246 value..........................................................................................................................................390
9.2.15 Location updating request..........................................................................................................................390
9.2.15.1 Location area identification..................................................................................................................391
9.2.15.3 Mobile Station Classmark for Iu mode................................................................................................391
9.2.15.6 MS network feature support.................................................................................................................391
9.2.15a MM information.........................................................................................................................................392
9.2.15a.1 Full name for network..........................................................................................................................392
9.2.15a.2 Short name for network........................................................................................................................392
9.2.15a.3 Local time zone....................................................................................................................................392
9.2.15a.4 Universal time and local time zone......................................................................................................392
9.2.15a.5 LSA Identity.........................................................................................................................................393
9.2.15a.6 Network Daylight Saving Time...........................................................................................................393
9.2.16 MM Status..................................................................................................................................................393
9.2.17 TMSI reallocation command.....................................................................................................................393
9.2.18 TMSI reallocation complete.......................................................................................................................394
9.2.19 MM Null....................................................................................................................................................394
9.3 Messages for circuit-switched call control......................................................................................................
9.3.1 Alerting......................................................................................................................................................395
9.3.1.1 Alerting (network to mobile station direction).....................................................................................395
9.3.1.1.1 Facility............................................................................................................................................396
9.3.1.1.2 Progress indicator...........................................................................................................................396
9.3.1.1.3 User-user.........................................................................................................................................396
9.3.1.2 Alerting (mobile station to network direction).....................................................................................396
9.3.1.2.1 Facility............................................................................................................................................397
9.3.1.2.2 User-user.........................................................................................................................................397
9.3.1.2.3 SS version.......................................................................................................................................397
9.3.2 Call confirmed............................................................................................................................................397
9.3.2.1 Repeat indicator....................................................................................................................................398
9.3.2.2 Bearer capability 1 and bearer capability 2..........................................................................................398
9.3.2.3 Cause....................................................................................................................................................399
9.3.2.4 CC Capabilities....................................................................................................................................399
9.3.2.5 Stream Identifier...................................................................................................................................399
9.3.2.6 Supported Codecs.................................................................................................................................399
9.3.3 Call proceeding..........................................................................................................................................399
9.3.3.2 Bearer capability 1 and bearer capability 2..........................................................................................400
9.3.3.3 Facility..................................................................................................................................................400
9.3.3.4 Progress Indicator.................................................................................................................................400
9.3.3.5 Priority granted.....................................................................................................................................400
9.3.3.6 Network Call Control Capabilities.......................................................................................................400
9.3.4 Congestion control.....................................................................................................................................400
9.3.4.1 Cause....................................................................................................................................................401
9.3.5 Connect......................................................................................................................................................401
9.3.5.1 Connect (network to mobile station direction).....................................................................................401
9.3.5.1.1 Facility............................................................................................................................................401
9.3.5.1.3 User-user.........................................................................................................................................401
9.3.5.2 Connect (mobile station to network direction).....................................................................................401
9.3.5.2.1 Facility............................................................................................................................................402
ETSI
Release 18 16 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.5.2.2 User-user.........................................................................................................................................402
9.3.5.2.3 SS version.......................................................................................................................................402
9.3.5.2.4 Stream Identifier.............................................................................................................................402
9.3.6 Connect acknowledge................................................................................................................................402
9.3.7 Disconnect..................................................................................................................................................403
9.3.7.1 Disconnect (network to mobile station direction)................................................................................403
9.3.7.1.1 Facility............................................................................................................................................403
9.3.7.1.3 User-user.........................................................................................................................................403
9.3.7.1.4 Allowed actions $(CCBS)$............................................................................................................403
9.3.7.2 Disconnect (mobile station to network direction)................................................................................404
9.3.7.2.1 Facility............................................................................................................................................404
9.3.7.2.2 User-user.........................................................................................................................................404
9.3.7.2.3 SS version.......................................................................................................................................404
9.3.8 Emergency setup........................................................................................................................................404
9.3.8.1 Bearer capability..................................................................................................................................405
9.3.8.4 Emergency category.............................................................................................................................405
9.3.9 Facility.......................................................................................................................................................405
9.3.9.1 Facility (network to mobile station direction)......................................................................................405
9.3.9.2 Facility (mobile station to network direction)......................................................................................406
9.3.9.2.1 SS version.......................................................................................................................................406
9.3.10 Hold............................................................................................................................................................407
9.3.11 Hold Acknowledge....................................................................................................................................407
9.3.12 Hold Reject................................................................................................................................................407
9.3.13 Modify........................................................................................................................................................408
9.3.13.1 Low layer compatibility.......................................................................................................................408
9.3.13.2 High layer compatibility.......................................................................................................................408
9.3.13.3 Reverse call setup direction..................................................................................................................408
9.3.13.4 Void......................................................................................................................................................409
9.3.13.5 Network-initiated Service Upgrade indicator.......................................................................................409
9.3.14 Modify complete........................................................................................................................................409
9.3.14.3 Reverse call setup direction..................................................................................................................409
9.3.15 Modify reject..............................................................................................................................................409
9.3.16 Notify.........................................................................................................................................................410
9.3.17 Progress......................................................................................................................................................410
9.3.17.1 User-user..............................................................................................................................................411
9.3.17.2 Progress indicator.................................................................................................................................411
9.3.17a CC-Establishment $(CCBS)$....................................................................................................................411
9.3.17a.1 Void......................................................................................................................................................412
9.3.17a.2 Setup container.....................................................................................................................................412
9.3.17b CC-Establishment confirmed $(CCBS)$...................................................................................................412
9.3.17b.1 Repeat indicator....................................................................................................................................412
9.3.17b.2 Bearer capability 1 and bearer capability 2..........................................................................................413
9.3.17b.3 Cause....................................................................................................................................................413
9.3.17b.4 Supported Codecs.................................................................................................................................413
9.3.18 Release.......................................................................................................................................................413
9.3.18.1 Release (network to mobile station direction)......................................................................................413
9.3.18.1.1 Cause..............................................................................................................................................413
9.3.18.1.2 Second cause...................................................................................................................................413
9.3.18.1.3 Facility............................................................................................................................................413
9.3.18.1.4 User-user.........................................................................................................................................414
9.3.18.2 Release (mobile station to network direction)......................................................................................414
9.3.18.2.1 Cause..............................................................................................................................................414
9.3.18.2.2 Second cause...................................................................................................................................414
9.3.18.2.3 Facility............................................................................................................................................414
ETSI
Release 18 17 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.18.2.4 User-user.........................................................................................................................................414
9.3.18.2.5 SS version.......................................................................................................................................415
9.3.18a Recall $(CCBS)$........................................................................................................................................415
9.3.18a.1 Recall Type..........................................................................................................................................415
9.3.18a.2 Facility..................................................................................................................................................415
9.3.19 Release complete........................................................................................................................................415
9.3.19.1 Release complete (network to mobile station direction)......................................................................415
9.3.19.1.1 Cause..............................................................................................................................................416
9.3.19.1.2 Facility............................................................................................................................................416
9.3.19.1.3 User-user.........................................................................................................................................416
9.3.19.2 Release complete (mobile station to network direction)......................................................................416
9.3.19.2.1 Cause..............................................................................................................................................417
9.3.19.2.2 Facility............................................................................................................................................417
9.3.19.2.3 User-user.........................................................................................................................................417
9.3.19.2.4 SS version.......................................................................................................................................417
9.3.20 Retrieve......................................................................................................................................................417
9.3.21 Retrieve Acknowledge...............................................................................................................................418
9.3.22 Retrieve Reject...........................................................................................................................................418
9.3.23 Setup..........................................................................................................................................................419
9.3.23.1 Setup (mobile terminated call establishment)......................................................................................419
9.3.23.1.1 BC repeat indicator.........................................................................................................................420
9.3.23.1.2 Bearer capability 1 and bearer capability 2....................................................................................421
9.3.23.1.3 Facility............................................................................................................................................421
9.3.23.1.4a Called party BCD number..............................................................................................................421
9.3.23.1.5 Called party subaddress..................................................................................................................421
9.3.23.1.6 LLC repeat indicator.......................................................................................................................421
9.3.23.1.7 Low layer compatibility I...............................................................................................................421
9.3.23.1.8 Low layer compatibility II..............................................................................................................421
9.3.23.1.9 HLC repeat indicator......................................................................................................................421
9.3.23.1.10 High layer compatibility i...............................................................................................................421
9.3.23.1.11 High layer compatibility ii..............................................................................................................422
9.3.23.1.12 User-user.........................................................................................................................................422
9.3.23.1.13 Redirecting party BCD number......................................................................................................422
9.3.23.1.14 Redirecting party subaddress..........................................................................................................422
9.3.23.1.15 Priority............................................................................................................................................422
9.3.23.1.16 Alert $(Network Indication of Alerting in the MS)$......................................................................422
9.3.23.1.17 Network Call Control Capabilities.................................................................................................422
9.3.23.1.18 Cause of No CLI.............................................................................................................................422
9.3.23.1.19 Backup bearer capability................................................................................................................422
9.3.23.2 Setup (mobile originating call establishment)......................................................................................422
9.3.23.2.1 BC repeat indicator.........................................................................................................................423
9.3.23.2.2 Facility............................................................................................................................................424
9.3.23.2.3 LLC repeat indicator.......................................................................................................................424
9.3.23.2.4 Low layer compatibility I...............................................................................................................424
9.3.23.2.5 Low layer compatibility II..............................................................................................................424
9.3.23.2.6 HLC repeat indicator......................................................................................................................424
9.3.23.2.7 High layer compatibility i...............................................................................................................424
9.3.23.2.8 High layer compatibility ii..............................................................................................................424
9.3.23.2.9 User-user.........................................................................................................................................424
9.3.23.2.10 SS version.......................................................................................................................................424
9.3.23.2.11 CLIR suppression...........................................................................................................................424
9.3.23.2.12 CLIR invocation.............................................................................................................................425
9.3.23.2.13 CC Capabilities...............................................................................................................................425
9.3.23.2.14 Stream Identifier.............................................................................................................................425
9.3.23.2.15 Bearer capability 1 and bearer capability 2....................................................................................425
9.3.23.2.16 Supported Codecs...........................................................................................................................425
9.3.23.2.17 Redial..............................................................................................................................................425
9.3.23a Start CC $(CCBS)$....................................................................................................................................425
9.3.23a.1 CC Capabilities....................................................................................................................................425
9.3.24 Start DTMF................................................................................................................................................426
ETSI
Release 18 18 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.25 Start DTMF Acknowledge.........................................................................................................................426

9.3.25.1 Keypad facility.....................................................................................................................................426
9.3.26 Start DTMF reject......................................................................................................................................426
9.3.27 Status..........................................................................................................................................................427
9.3.27.1 Auxiliary states.....................................................................................................................................427
9.3.28 Status enquiry.............................................................................................................................................427
9.3.29 Stop DTMF................................................................................................................................................428
9.3.30 Stop DTMF acknowledge..........................................................................................................................428
9.3.31 User information........................................................................................................................................429
9.3.31.1 User-user..............................................................................................................................................429
9.3.31.2 More data..............................................................................................................................................429
9.4 GPRS Mobility Management Messages..........................................................................................................
9.4.1 Attach request............................................................................................................................................429
9.4.1.1 Old P-TMSI signature..........................................................................................................................431
9.4.1.2 Requested READY timer value...........................................................................................................431
9.4.1.3 TMSI status..........................................................................................................................................431
9.4.1.4 PS LCS Capability...............................................................................................................................431
9.4.1.5 UE network capability..........................................................................................................................431
9.4.1.6 Mobile station classmark 2...................................................................................................................431
9.4.1.9 Additional mobile identity...................................................................................................................431
9.4.1.10 Additional old routing area identification............................................................................................431
9.4.1.11 Voice domain preference and UE's usage setting................................................................................431
9.4.1.13 P-TMSI type.........................................................................................................................................432
9.4.1.15 Old location area identification............................................................................................................432
9.4.1.16 Additional update type.........................................................................................................................432
9.4.1.17 TMSI based NRI container..................................................................................................................432
9.4.1.18 T3324 value..........................................................................................................................................432
9.4.1.19 T3312 extended value..........................................................................................................................432
9.4.1.20 Extended DRX parameters...................................................................................................................432
9.4.2 Attach accept..............................................................................................................................................432
9.4.2.1 P-TMSI signature.................................................................................................................................435
9.4.2.2 Negotiated READY timer value..........................................................................................................435
9.4.2.3 Allocated P-TMSI................................................................................................................................435
9.4.2.4 MS identity...........................................................................................................................................435
9.4.2.5 GMM cause..........................................................................................................................................435
9.4.2.6 T3302 value..........................................................................................................................................435
9.4.2.7 Cell Notification (A/Gb mode only)....................................................................................................435
9.4.2.9 Network feature support.......................................................................................................................435
9.4.2.11 Requested MS Information..................................................................................................................435
9.4.2.12 T3319 value..........................................................................................................................................435
9.4.2.13 T3323 value..........................................................................................................................................435
9.4.2.14 T3312 extended value..........................................................................................................................436
9.4.2.15 Additional network feature support......................................................................................................436
9.4.2.16 T3324 value..........................................................................................................................................436
9.4.2.18 User Plane integrity indicator...............................................................................................................436
9.4.2.19 Replayed MS network capability.........................................................................................................436
9.4.2.20 Replayed MS radio access capability...................................................................................................436
9.4.2.21 DCN-ID................................................................................................................................................436
9.4.2.22 PLMN identity of the CN operator......................................................................................................436
9.4.3 Attach complete.........................................................................................................................................436
9.4.3.1 Inter RAT handover information..........................................................................................................437
9.4.3.2 E-UTRAN inter RAT handover information.......................................................................................437
9.4.4 Attach reject...............................................................................................................................................437
ETSI
Release 18 19 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.4.1 T3302 value..........................................................................................................................................437

9.4.4.2 T3346 value..........................................................................................................................................438
9.4.5 Detach request............................................................................................................................................438
9.4.5.1 Detach request (mobile terminated detach)..........................................................................................438
9.4.5.1.1 GMM cause..........................................................................................................................................438
9.4.5.2 Detach request (mobile originating detach).........................................................................................438
9.4.5.2.1 P-TMSI...........................................................................................................................................439
9.4.5.2.2 P-TMSI signature...........................................................................................................................439
9.4.6 Detach accept.............................................................................................................................................439
9.4.6.1 Detach accept (mobile terminated detach)...........................................................................................439
9.4.6.2 Detach accept (mobile originating detach)...........................................................................................439
9.4.7 P-TMSI reallocation command..................................................................................................................440
9.4.7.1 P-TMSI signature.................................................................................................................................440
9.4.7.2 DCN-ID................................................................................................................................................440
9.4.8 P-TMSI reallocation complete...................................................................................................................440
9.4.9 Authentication and ciphering request........................................................................................................441
9.4.9.1 Authentication Parameter RAND.........................................................................................................441
9.4.9.2 GPRS ciphering key sequence number................................................................................................442
9.4.9.3 Authentication Parameter AUTN.........................................................................................................442
9.4.9.5 Integrity algorithm................................................................................................................................442
9.4.9.6 Message authentication code................................................................................................................442
9.4.9.7 Replayed MS Radio Access Capability...............................................................................................442
9.4.10 Authentication and ciphering response......................................................................................................442
9.4.10.1 Authentication Response Parameter.....................................................................................................443
9.4.10.2 IMEISV................................................................................................................................................443
9.4.10.3 Authentication Response Parameter (extension)..................................................................................443
9.4.10a Authentication and Ciphering Failure........................................................................................................443
9.4.10a.1 Authentication Failure parameter.........................................................................................................444
9.4.11 Authentication and ciphering reject...........................................................................................................444
9.4.12 Identity request...........................................................................................................................................444
9.4.13 Identity response........................................................................................................................................445
9.4.14 Routing area update request.......................................................................................................................445
9.4.14.1 Old P-TMSI signature..........................................................................................................................448
9.4.14.2 Requested READY timer value...........................................................................................................448
9.4.14.3 DRX parameter....................................................................................................................................448
9.4.14.4 TMSI status..........................................................................................................................................448
9.4.14.5 P-TMSI (Iu mode only)........................................................................................................................448
9.4.14.6 MS network capability.........................................................................................................................448
9.4.14.7 PDP context status................................................................................................................................448
9.4.14.9 MBMS context status...........................................................................................................................448
9.4.14.10 Additional mobile identity...................................................................................................................448
9.4.14.11 Additional old routing area identification............................................................................................448
9.4.14.17 P-TMSI type.........................................................................................................................................449
9.4.14.20 Old location area identification............................................................................................................449
9.4.14.22 TMSI based NRI container..................................................................................................................449
9.4.14.23 T3324 value..........................................................................................................................................449
9.4.14.24 T3312 extended value..........................................................................................................................449
9.4.15 Routing area update accept........................................................................................................................450
9.4.15.1 P-TMSI signature.................................................................................................................................453
ETSI
Release 18 20 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.15.2 Allocated P-TMSI................................................................................................................................453

9.4.15.3 MS identity...........................................................................................................................................453
9.4.15.4 List of Receive N-PDU Numbers.........................................................................................................453
9.4.15.5 Negotiated READY timer value..........................................................................................................453
9.4.15.6 GMM cause..........................................................................................................................................453
9.4.15.7 T3302 value..........................................................................................................................................453
9.4.15.8 Cell Notification (A/Gb mode only)....................................................................................................453
9.4.15.14 Requested MS Information..................................................................................................................454
9.4.15.15 T3319 value..........................................................................................................................................454
9.4.15.16 T3323 value..........................................................................................................................................454
9.4.15.17 T3312 extended value..........................................................................................................................454
9.4.15.18 Additional network feature support......................................................................................................454
9.4.15.19 T3324 value..........................................................................................................................................454
9.4.15.23 Replayed MS Radio Access Capability...............................................................................................455
9.4.15.24 DCN-ID................................................................................................................................................455
9.4.16 Routing area update complete....................................................................................................................455
9.4.16.1 List of Receive N-PDU Numbers.........................................................................................................456
9.4.16.2 Inter RAT handover information..........................................................................................................456
9.4.16.3 E-UTRAN inter RAT handover information.......................................................................................456
9.4.17 Routing area update reject..........................................................................................................................456
9.4.17.1 T3302 value..........................................................................................................................................456
9.4.17.2 T3346 value..........................................................................................................................................456
9.4.18 GMM Status...............................................................................................................................................457
9.4.19 GMM Information.....................................................................................................................................457
9.4.19.1 Full name for network..........................................................................................................................457
9.4.19.2 Short name for network........................................................................................................................458
9.4.19.3 Local time zone....................................................................................................................................458
9.4.19.4 Universal time and local time zone......................................................................................................458
9.4.19.5 LSA Identity.........................................................................................................................................458
9.4.19.6 Network Daylight Saving Time...........................................................................................................458
9.4.20 Service Request (Iu mode only).................................................................................................................458
9.4.20.3 Uplink data status.................................................................................................................................459
9.4.21 Service Accept (Iu mode only)..................................................................................................................459
9.4.22 Service Reject (Iu mode only)...................................................................................................................460
9.4.22.1 T3346 value..........................................................................................................................................460
9.5 GPRS Session Management Messages............................................................................................................
9.5.1 Activate PDP context request....................................................................................................................460
9.5.1.1 Access point name................................................................................................................................461
9.5.1.3 Request type.........................................................................................................................................461
9.5.1.5 NBIFOM container..............................................................................................................................462
9.5.1.6 Extended protocol configuration options.............................................................................................462
9.5.1.7 Extended QoS.......................................................................................................................................462
9.5.2 Activate PDP context accept......................................................................................................................462
9.5.2.1 PDP address..........................................................................................................................................463
ETSI
Release 18 21 3GPP TS 24.008 V18.4.0 (2023-09)

9.5.2.3 Packet Flow Identifier..........................................................................................................................463
9.5.2.4 SM cause..............................................................................................................................................464
9.5.2.5 Connectivity type.................................................................................................................................464
9.5.2.6 WLAN offload indication....................................................................................................................464
9.5.2.9 Extended QoS.......................................................................................................................................464
9.5.3 Activate PDP context reject.......................................................................................................................464
9.5.3.2 Back-off timer value.............................................................................................................................465
9.5.3.3 Re-attempt indicator.............................................................................................................................465
9.5.4 Activate Secondary PDP Context Request................................................................................................465
9.5.4.1 TFT.......................................................................................................................................................466
9.5.4.6 Extended QoS.......................................................................................................................................467
9.5.5 Activate Secondary PDP Context Accept..................................................................................................467
9.5.5.6 Extended QoS.......................................................................................................................................468
9.5.6 Activate Secondary PDP Context Reject...................................................................................................468
9.5.7 Request PDP context activation.................................................................................................................469
9.5.8 Request PDP context activation reject.......................................................................................................470
9.5.9 Modify PDP context request (Network to MS direction)..........................................................................471
9.5.9.1 PDP address..........................................................................................................................................471
9.5.9.4 TFT.......................................................................................................................................................472
9.5.9.8 Extended QoS.......................................................................................................................................472
9.5.10 Modify PDP context request (MS to network direction)...........................................................................472
9.5.10.1 Requested LLC SAPI...........................................................................................................................473
9.5.10.2 Requested new QoS.............................................................................................................................473
9.5.10.3 New TFT..............................................................................................................................................473
9.5.10.8 Extended QoS.......................................................................................................................................474
9.5.11 Modify PDP context accept (MS to network direction)............................................................................474
ETSI
Release 18 22 3GPP TS 24.008 V18.4.0 (2023-09)

9.5.12 Modify PDP context accept (Network to MS direction)............................................................................475
9.5.12.1 Negotiated QoS....................................................................................................................................475
9.5.12.2 Negotiated LLC SAPI..........................................................................................................................475
9.5.12.3 New radio priority................................................................................................................................475
9.5.12.9 Extended QoS.......................................................................................................................................476
9.5.13 Modify PDP Context Reject......................................................................................................................476
9.5.14 Deactivate PDP context request.................................................................................................................477
9.5.14.1 Tear down indicator.............................................................................................................................478
9.5.14.4 T3396 value..........................................................................................................................................478
9.5.14.6 Void......................................................................................................................................................478
9.5.15 Deactivate PDP context accept..................................................................................................................478
9.5.15.3 Void......................................................................................................................................................479
9.5.15a Request Secondary PDP Context Activation.............................................................................................479
9.5.15a.1 TFT.......................................................................................................................................................480
9.5.15a.2 Protocol configuration options.............................................................................................................480
9.5.15a.3 WLAN offload indication....................................................................................................................480
9.5.15a.4 NBIFOM container..............................................................................................................................480
9.5.15a.5 Extended protocol configuration options.............................................................................................480
9.5.15a.6 Extended QoS.......................................................................................................................................480
9.5.15b Request Secondary PDP Context Activation Reject..................................................................................481
9.5.15b.1 Protocol configuration options.............................................................................................................481
9.5.15b.2 NBIFOM container..............................................................................................................................481
9.5.15b.3 Extended protocol configuration options.............................................................................................481
9.5.16 Void............................................................................................................................................................481
9.5.16a Notification................................................................................................................................................481
9.5.17 Void............................................................................................................................................................482
9.5.18 Void............................................................................................................................................................482
9.5.19 Void............................................................................................................................................................482
9.5.20 Void............................................................................................................................................................482
9.5.21 SM Status...................................................................................................................................................482
9.5.22 Activate MBMS Context Request..............................................................................................................482
9.5.23 Activate MBMS Context Accept...............................................................................................................483
9.5.24 Activate MBMS Context Reject................................................................................................................484
9.5.25 Request MBMS Context Activation..........................................................................................................484
9.5.25.1 Linked NSAPI......................................................................................................................................485
ETSI
Release 18 23 3GPP TS 24.008 V18.4.0 (2023-09)

9.5.26 Request MBMS Context Activation Reject...............................................................................................485
10 General message format and information elements coding..................................................................
10.1 Overview.........................................................................................................................................................
10.2 Protocol Discriminator....................................................................................................................................
10.3 Skip indicator and transaction identifier..........................................................................................................
10.3.1 Skip indicator.............................................................................................................................................486
10.3.2 Transaction identifier.................................................................................................................................488
10.4 Message Type..................................................................................................................................................
10.5 Other information elements.............................................................................................................................
10.5.1 Common information elements..................................................................................................................492
10.5.1.1 Cell identity..........................................................................................................................................492
10.5.1.2 Ciphering Key Sequence Number........................................................................................................493
10.5.1.3 Location Area Identification................................................................................................................493
10.5.1.4 Mobile Identity.....................................................................................................................................495
10.5.1.5 Mobile Station Classmark 1.................................................................................................................500
10.5.1.8 Spare Half Octet...................................................................................................................................522
10.5.1.9 Descriptive group or broadcast call reference......................................................................................522
10.5.1.10 Group Cipher Key Number..................................................................................................................523
10.5.1.10a PD and SAPI $(CCBS)$......................................................................................................................524
10.5.1.11 Priority Level........................................................................................................................................525
10.5.1.12 Core Network System Information (Iu mode only).............................................................................525
10.5.1.12.1 CN Common GSM-MAP NAS system information......................................................................525
10.5.1.12.2 CS domain specific system information.........................................................................................526
10.5.1.12.3 PS domain specific system information.........................................................................................526
10.5.1.13 PLMN list.............................................................................................................................................527
10.5.1.14 NAS container for PS HO....................................................................................................................528
10.5.2 Radio Resource management information elements..................................................................................530
10.5.3 Mobility management information elements.............................................................................................530
10.5.3.1 Authentication parameter RAND.........................................................................................................530
10.5.3.1.1 Authentication Parameter AUTN (UMTS and EPS authentication challenge)..............................530
10.5.3.2 Authentication Response parameter.....................................................................................................531
10.5.3.2.1 Authentication Response Parameter (extension) (UMTS authentication challenge only).............532
10.5.3.2.2 Authentication Failure parameter (UMTS and EPS authentication challenge)..............................532
10.5.3.3 CM service type...................................................................................................................................533
10.5.3.4 Identity type..........................................................................................................................................533
10.5.3.5 Location updating type.........................................................................................................................534
10.5.3.5a Network Name.....................................................................................................................................534
10.5.3.6 Reject cause..........................................................................................................................................536
10.5.3.7 Follow-on Proceed...............................................................................................................................537
10.5.3.8 Time Zone............................................................................................................................................537
10.5.3.9 Time Zone and Time............................................................................................................................538
10.5.3.10 CTS permission....................................................................................................................................539
10.5.3.11 LSA Identifier......................................................................................................................................540
10.5.3.12 Daylight Saving Time..........................................................................................................................540
10.5.3.15 Void......................................................................................................................................................542
10.5.3.16 MM Timer............................................................................................................................................542
10.5.4 Call control information elements..............................................................................................................543
10.5.4.1 Extensions of codesets.........................................................................................................................543
10.5.4.2 Locking shift procedure.......................................................................................................................544
10.5.4.3 Non-locking shift procedure.................................................................................................................544
10.5.4.4 Auxiliary states.....................................................................................................................................545
10.5.4.4a Backup bearer capability......................................................................................................................546
10.5.4.4a.1 Static conditions for the backup bearer capability IE contents.......................................................555
10.5.4.5 Bearer capability..................................................................................................................................555
ETSI
Release 18 24 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.4.5.1 Static conditions for the bearer capability IE contents...................................................................570

10.5.4.5a Call Control Capabilities......................................................................................................................570
10.5.4.6 Call state...............................................................................................................................................571
10.5.4.7 Called party BCD number....................................................................................................................572
10.5.4.8 Called party subaddress........................................................................................................................574
10.5.4.9 Calling party BCD number..................................................................................................................575
10.5.4.10 Calling party subaddress......................................................................................................................576
10.5.4.11 Cause....................................................................................................................................................577
10.5.4.11a CLIR suppression.................................................................................................................................582
10.5.4.11b CLIR invocation...................................................................................................................................583
10.5.4.12 Congestion level...................................................................................................................................583
10.5.4.13 Connected number................................................................................................................................583
10.5.4.14 Connected subaddress..........................................................................................................................584
10.5.4.15 Facility..................................................................................................................................................584
10.5.4.16.1 Static conditions for the high layer compatibility IE contents.......................................................586
10.5.4.17 Keypad facility.....................................................................................................................................586
10.5.4.19 More data..............................................................................................................................................586
10.5.4.20 Notification indicator...........................................................................................................................587
10.5.4.21 Progress indicator.................................................................................................................................587
10.5.4.21a Recall type $(CCBS)$....................................................................................................................588
10.5.4.21b Redirecting party BCD number......................................................................................................589
10.5.4.21c Redirecting party subaddress..........................................................................................................589
10.5.4.22a Reverse call setup direction..................................................................................................................590
10.5.4.22b SETUP Container $(CCBS)$...............................................................................................................591
10.5.4.23 Signal....................................................................................................................................................591
10.5.4.24 SS Version Indicator............................................................................................................................592
10.5.4.25 User-user..............................................................................................................................................592
10.5.4.26 Alerting Pattern $(NIA)$.....................................................................................................................593
10.5.4.27 Allowed actions $(CCBS)$..................................................................................................................594
10.5.4.29 Network Call Control Capabilities.......................................................................................................595
10.5.4.30 Cause of No CLI..................................................................................................................................596
10.5.4.31 Void......................................................................................................................................................596
10.5.4.32 Supported codec list.............................................................................................................................596
10.5.4.33 Service category...................................................................................................................................597
10.5.4.34 Redial...................................................................................................................................................598
10.5.4.35 Network-initiated Service Upgrade indicator.......................................................................................598
10.5.5 GPRS mobility management information elements...................................................................................599
10.5.5.1 Attach result.........................................................................................................................................599
10.5.5.2 Attach type...........................................................................................................................................599
10.5.5.3 Ciphering algorithm.............................................................................................................................600
10.5.5.3a Integrity algorithm................................................................................................................................601
10.5.5.4 TMSI status..........................................................................................................................................601
10.5.5.5 Detach type...........................................................................................................................................602
10.5.5.6 DRX parameter....................................................................................................................................602
10.5.5.7 Force to standby...................................................................................................................................604
10.5.5.8 P-TMSI signature.................................................................................................................................605
10.5.5.8a P-TMSI signature 2..............................................................................................................................605
10.5.5.9 Identity type 2.......................................................................................................................................606
10.5.5.10 IMEISV request....................................................................................................................................606
10.5.5.11 Receive N-PDU Numbers list..............................................................................................................607
10.5.5.12 MS network capability.........................................................................................................................608
10.5.5.12a MS Radio Access capability................................................................................................................613
10.5.5.13 Spare.....................................................................................................................................................632
10.5.5.14 GMM cause..........................................................................................................................................632
10.5.5.15 Routing area identification...................................................................................................................633
10.5.5.15a Routing area identification 2................................................................................................................635
ETSI
Release 18 25 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.5.16 Spare.....................................................................................................................................................635
10.5.5.17 Update result........................................................................................................................................635
10.5.5.18 Update type..........................................................................................................................................636
10.5.5.19 A&C reference number........................................................................................................................637
10.5.5.20 Service type..........................................................................................................................................637
10.5.5.21 Cell Notification...................................................................................................................................638
10.5.5.23A Additional network feature support......................................................................................................640
10.5.5.24 Inter RAT information container..........................................................................................................641
10.5.5.25 Requested MS information...................................................................................................................642
10.5.5.27 E-UTRAN inter RAT information container.......................................................................................642
10.5.5.29 P-TMSI type.........................................................................................................................................644
10.5.5.30 Location Area Identification 2.............................................................................................................644
10.5.5.31 Network resource identifier container..................................................................................................644
10.5.5.35 DCN-ID................................................................................................................................................651
10.5.6 Session management information elements...............................................................................................653
10.5.6.1 Access point name................................................................................................................................653
10.5.6.2 Network service access point identifier...............................................................................................654
10.5.6.3.1 General............................................................................................................................................654
10.5.6.3.2 APN rate control parameters..........................................................................................................674
10.5.6.3.3 Additional APN rate control parameters for exception data..........................................................675
10.5.6.3.4 Small data rate control parameters.................................................................................................676
10.5.6.3.5 Additional small data rate control parameters for exception data..................................................676
10.5.6.3.6 Initial small data rate control parameters........................................................................................676
10.5.6.3.7 Initial additional small data rate control for exception data parameters.........................................676
10.5.6.3.8 Initial APN rate control parameters................................................................................................676
10.5.6.3.9 Initial additional APN rate control for exception data parameters.................................................676
10.5.6.3.10 PVS IPv4 Address..........................................................................................................................676
10.5.6.3.11 PVS IPv6 Address..........................................................................................................................677
10.5.6.3.12 PVS name.......................................................................................................................................678
10.5.6.3A Extended protocol configuration options.............................................................................................679
10.5.6.4 Packet data protocol address................................................................................................................680
10.5.6.5 Quality of service.................................................................................................................................681
10.5.6.5A Re-attempt indicator.............................................................................................................................691
10.5.6.5B Extended quality of service..................................................................................................................692
10.5.6.6 SM cause..............................................................................................................................................692
10.5.6.6A SM cause 2...........................................................................................................................................693
10.5.6.7 Linked TI..............................................................................................................................................694
10.5.6.8 Spare.....................................................................................................................................................694
10.5.6.9 LLC service access point identifier......................................................................................................694
10.5.6.10 Tear down indicator.............................................................................................................................695
10.5.6.12 Traffic Flow Template.........................................................................................................................696
10.5.6.13 Temporary Mobile Group Identity (TMGI).........................................................................................704
10.5.6.14 MBMS bearer capabilities....................................................................................................................704
10.5.6.16 Enhanced network service access point identifier................................................................................706
10.5.6.17 Request type.........................................................................................................................................706
10.5.6.18 Notification indicator...........................................................................................................................707
10.5.6.19 Connectivity type.................................................................................................................................708
10.5.6.20 WLAN offload acceptability................................................................................................................708
ETSI
Release 18 26 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.7 GPRS Common information elements.......................................................................................................709

10.5.7.2 Radio priority.......................................................................................................................................710
10.5.7.3 GPRS Timer.........................................................................................................................................711
10.5.7.4 GPRS Timer 2......................................................................................................................................711
10.5.7.4a GPRS Timer 3......................................................................................................................................712
10.5.7.5 Radio priority 2....................................................................................................................................712
10.5.7.7 Uplink data status.................................................................................................................................714
11 List of system parameters.....................................................................................................................
11.1 Timers and counters for radio resource management......................................................................................
11.2 Timers of mobility management......................................................................................................................
11.2.1 Timer T3240 and Timer T3241.................................................................................................................720
11.2.2 Timers of GPRS mobility management.....................................................................................................722
11.2.3 Timers of GPRS session management.......................................................................................................734
11.3 Timers of circuit-switched call control............................................................................................................
Annex A (informative): Example of subaddress information element coding........................................742
Annex B (normative): Compatibility checking...........................................................................................743
B.1 Introduction...........................................................................................................................................
B.2 Calling side compatibility checking.....................................................................................................
B.2.1 Compatibility checking of the CM SERVICE REQUEST message...............................................................
B.2.2 Compatibility/Subscription checking of the SETUP message........................................................................
B.3 Called side compatibility checking.......................................................................................................
B.3.1 Compatibility checking with addressing information......................................................................................
B.3.2 Network-to-MS compatibility checking..........................................................................................................
B.3.3 User-to-User compatibility checking...............................................................................................................
B.4 High layer compatibility checking........................................................................................................
Annex C (normative): Low layer information coding principles.............................................................745
C.1 Purpose..................................................................................................................................................
C.2 Principles..............................................................................................................................................
C.2.1 Definition of types of information...................................................................................................................
C.2.2 Examination by network..................................................................................................................................
C.2.3 Location of type I information.........................................................................................................................
C.2.4 Location of types II and III information..........................................................................................................
C.2.5 Relationship between bearer capability and low layer compatibility information elements...........................
Annex D (informative): Examples of bearer capability information element coding............................747
D.1 Coding for speech for a full rate support only mobile station..............................................................
D.1.1 Mobile station to network direction.................................................................................................................
D.1.2 Network to mobile station direction................................................................................................................
D.2 An example of a coding for modem access with V22-bis, 2,4 kbit/s, 8 bit no parity...........................
D.2.1 Mobile station to network direction, data compression allowed.....................................................................
D.2.2 Network to mobile station direction, data compression possible....................................................................
D.3 An example of a coding for group 3 facsimile (9,6 kbit/s, transparent)...............................................
D.3.1 Mobile station to network direction.................................................................................................................
D.3.2 Network to mobile station direction................................................................................................................
Annex E (informative): Comparison between call control procedures specified in 3GPP TS 24.008 and
ITU-T Recommendation Q.931...................................................................752
ETSI
Release 18 27 3GPP TS 24.008 V18.4.0 (2023-09)
Annex F (informative): A/Gb mode specific cause values for radio resource management..................756
Annex G (informative): 3GPP specific cause values for mobility management......................................757
G.1 Causes related to MS identification......................................................................................................

G.2 Cause related to subscription options...................................................................................................
G.3 Causes related to PLMN specific network failures and congestion/Authentication Failures...............
G.4 Causes related to nature of request.......................................................................................................
G.5 Causes related to invalid messages.......................................................................................................
G.6 Additional cause codes for GMM.........................................................................................................
Annex H (informative): 3GPP specific cause values for call control........................................................761
H.1 Normal class.........................................................................................................................................

H.1.1 Cause No. 1 "unassigned (unallocated) number"............................................................................................
H.1.2 Cause No. 3 "no route to destination".............................................................................................................
H.1.3 Cause No. 6 "channel unacceptable"...............................................................................................................
H.1.4 Cause No. 8 "operator determined barring"....................................................................................................
H.1.4a Cause No. 13 "call completed elsewhere".......................................................................................................
H.1.5 Cause No.16 "normal call clearing"................................................................................................................
H.1.6 Cause No.17 "user busy".................................................................................................................................
H.1.7 Cause No. 18 "no user responding".................................................................................................................
H.1.8 Cause No. 19 "user alerting, no answer".........................................................................................................
H.1.9 Cause No. 21 "call rejected"............................................................................................................................
H.1.10 Cause No. 22 "number changed".....................................................................................................................
H.1.10a Cause No. 24 "call rejected due to feature at the destination".......................................................................
H.1.11 Cause No. 25 "pre-emption"............................................................................................................................
H.1.12 Cause No. 26 "non-selected user clearing"......................................................................................................
H.1.13 Cause No. 27 "destination out of order"..........................................................................................................
H.1.14 Cause No. 28 "invalid number format (incomplete number)".........................................................................
H.1.15 Cause No. 29 "facility rejected"......................................................................................................................
H.1.16 Cause No. 30 "response to STATUS ENQUIRY"..........................................................................................
H.1.17 Cause No. 31 "normal, unspecified"................................................................................................................
H.2 Resource unavailable class...................................................................................................................
H.2.1 Cause No. 34 "no circuit/channel available"...................................................................................................
H.2.2 Cause No. 38 "network out of order"..............................................................................................................
H.2.3 Cause No. 41 "temporary failure"...................................................................................................................
H.2.4 Cause No. 42 "switching equipment congestion"............................................................................................
H.2.5 Cause No. 43 "access information discarded".................................................................................................
H.2.6 Cause No. 44 "requested circuit/channel not available"..................................................................................
H.2.7 Cause No. 47 "resource unavailable, unspecified"..........................................................................................
H.3 Service or option not available class.....................................................................................................
H.3.1 Cause No. 49 "quality of service unavailable"................................................................................................
H.3.2 Cause No. 50 "Requested facility not subscribed"..........................................................................................
H.3.3 Cause No. 55 "Incoming calls barred within the CUG"..................................................................................
H.3.4 Cause No. 57 "bearer capability not authorized".............................................................................................
H.3.5 Cause No. 58 "bearer capability not presently available"...............................................................................
H.3.6 Cause No. 63 "service or option not available, unspecified"..........................................................................
H.3.7 Cause No. 68 "ACM equal to or greater than ACMmax"...............................................................................
H.4 Service or option not implemented class..............................................................................................
H.4.1 Cause No. 65 "bearer service not implemented".............................................................................................
H.4.2 Cause No. 69 "Requested facility not implemented"......................................................................................
H.4.3 Cause No. 70 "only restricted digital information bearer capability is available"..........................................
H.4.4 Cause No. 79 "service or option not implemented, unspecified"....................................................................
ETSI
Release 18 28 3GPP TS 24.008 V18.4.0 (2023-09)
H.5 Invalid message (e.g., parameter out of range) class............................................................................

H.5.1 Cause No. 81 "invalid transaction identifier value"........................................................................................
H.5.2 Cause No. 87 "user not member of CUG".......................................................................................................
H.5.3 Cause No. 88 "incompatible destination"........................................................................................................
H.5.4 Cause No. 91 "invalid transit network selection"............................................................................................
H.5.5 Cause No. 95 "semantically incorrect message".............................................................................................
H.6 Protocol error (e.g., unknown message) class......................................................................................
H.6.1 Cause No. 96 "invalid mandatory information"..............................................................................................
H.6.2 Cause No. 97 "message type non-existent or not implemented".....................................................................
H.6.3 Cause No. 98 "message type not compatible with protocol state"..................................................................
H.6.4 Cause No. 99 "information element non-existent or not implemented"..........................................................
H.6.5 Cause No. 100 "conditional IE error"..............................................................................................................
H.6.6 Cause No. 101 "message not compatible with protocol state"........................................................................
H.6.7 Cause No. 102 "recovery on timer expiry"......................................................................................................
H.6.8 Cause No. 111 "protocol error, unspecified"...................................................................................................
H.7 Interworking class.................................................................................................................................
H.7.1 Cause No. 127 "interworking, unspecified"....................................................................................................
Annex I (informative): GPRS specific cause values for GPRS Session Management............................767
I.1 Causes related to nature of request.......................................................................................................

I.2 Causes related to invalid messages.......................................................................................................
I.3 Void......................................................................................................................................................
Annex J (informative): Algorithm to encode frequency list information elements................................771
Annex K (informative): Default Codings of Information Elements.........................................................772
K.1 Common information elements............................................................................................................

K.2 Radio Resource management information elements............................................................................
K.3 Mobility management information elements........................................................................................
K.4 Call control information elements........................................................................................................
Annex L (normative): Establishment cause (Iu mode only)......................................................................775
L.1 Mapping of NAS procedure to RRC establishment cause(Iu mode only)............................................

Annex M (normative): Additional Requirements for backward compatibility with PCS 1900 for NA
revision 0 ME................................................................................................779
Annex N (normative): Ranking of reject causes for Location Registration (MM and GMM) in a shared
network..........................................................................................................779
Annex O (normative): 3GPP capability exchange protocol......................................................................781
O.1 Scope.....................................................................................................................................................
O.2 User-user protocol contents..................................................................................................................
O.3 Information element identifier..............................................................................................................
O.4 Information elements............................................................................................................................
O.4.1 Personal ME identifier.....................................................................................................................................
O.4.2 Radio environment capability..........................................................................................................................
O.4.3 UE capability version......................................................................................................................................
ETSI
Release 18 29 3GPP TS 24.008 V18.4.0 (2023-09)
O.4.4 IM Status..........................................................................................................................................................
O.5 Handling of unknown, unforeseen, and erroneous protocol data.........................................................
O.5.1 General.............................................................................................................................................................
O.5.2 Not supported IEs, unknown IEIs....................................................................................................................
O.5.3 Repeated IEs....................................................................................................................................................
O.5.4 Syntactically incorrect IEs...............................................................................................................................
O.5.5 Semantically incorrect IEs...............................................................................................................................
Annex P (normative): Mobility management for IMS voice termination...............................................787
P.1 Introduction...........................................................................................................................................
P.2 Activation of mobility management for IMS voice termination..........................................................
P.3 Inter-system change between A/Gb mode and Iu mode.......................................................................
P.4 Inter-system change between A/Gb mode and S1 mode......................................................................
P.5 Inter-system change between Iu mode and S1 mode............................................................................
Annex Q (normative): Application specific Congestion control for Data Communication (ACDC) (Iu
mode only).....................................................................................................789
Annex R (informative): Change History.....................................................................................................790
ETSI
Release 18 30 3GPP TS 24.008 V18.4.0 (2023-09)
Foreword
This Technical Specification has been produced by the 3rd Generation Partnership Project (3GPP).
The contents of the present document are subject to continuing work within the TSG and may change following formal
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an
identifying change of release date and an increase in version number as follows:
Version x.y.z
where:
x the first digit:
1 presented to TSG for information;
2 presented to TSG for approval;
3 or greater indicates TSG approved document under change control.
y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections,
updates, etc.
z the third digit is incremented when editorial only changes have been incorporated in the document.
Introduction
The present document includes references to features which are not part of the Phase 2+ Release 96 of the GSM
Technical specifications. All subclauses which were changed as a result of these features contain a marker (see table
below) relevant to the particular feature.
The following table lists all features that were introduced after GSM Release 96.
Feature Designator
BA Range IE handling $(impr-BA-range-handling)$
Advanced Speech Call Item $(ASCI)$
Call Completion Busy Subscriber $(CCBS)$
Mobile Assisted Frequency Allocation $(MAFA)$
Network Indication of Alerting in MS $(NIA)$
ETSI
Release 18 31 3GPP TS 24.008 V18.4.0 (2023-09)
1 Scope
The present document specifies the procedures used at the radio interface core network protocols within the 3 rd
generation mobile telecommunications system and the digital cellular telecommunications system.
It specifies the procedures used at the radio interface (Reference Point Um or Uu, see 3GPP TS 24.002 [15] or
3GPP TS 23.002 [127]) for Call Control (CC), Mobility Management (MM), and Session Management (SM).
When the notations for "further study" or "FS" or "FFS" are present in this TS they mean that the indicated text is not a
normative portion of the present document.
These procedures are defined in terms of messages exchanged over the control channels of the radio interface. The
control channels are described in 3GPP TS 44.003 [16] and 3GPP TS 25.301 [128].
The structured functions and procedures of this protocol and the relationship with other layers and entities are described
in general terms in 3GPP TS 24.007 [20].
The present document specifies functions, procedures and information which apply to GERAN Iu mode. However,
functionality related to GERAN Iu mode is neither maintained nor enhanced.
1.1 Scope of the Technical Specification

The procedures currently described in this TS are for the call control of circuit-switched connections, session
management for GPRS services, mobility management and radio resource management for circuit-switched and GPRS
services.
3GPP TS 24.010 [21] contains functional procedures for support of supplementary services.
3GPP TS 24.011 [22] contains functional procedures for support of point-to-point short message services.
3GPP TS 24.012 [23] contains functional description of short message - cell broadcast.
3GPP TS 44.060 [76] contains procedures for radio link control and medium access control (RLC/MAC) of packet data
physical channels.
3GPP TS 44.071 [23a] contains functional descriptions and procedures for support of location services.
NOTE: "layer 3" includes the functions and protocols described in the present document. The terms "data link
layer" and "layer 2" are used interchangeably to refer to the layer immediately below layer 3.
1.2 Application to the interface structures

The procedures defined in the present document apply to the interface structures defined in 3GPP TS 44.003 [16] and
3GPP TS 25.301 [128]. They use the functions and services provided by lower layers defined in 3GPP TS 44.005 [18]
and 3GPP TS 44.006 [19] or 3GPP TS 25.331 [23c], 3GPP TS 25.322 [19b] and 3GPP TS 25.321 [19a].
3GPP TS 24.007 [20] gives the general description of layer 3 (A/Gb mode) and Non Access Stratum (Iu mode and S1
mode) including procedures, messages format and error handling.
1.3 Structure of layer 3 procedures

A building block method is used to describe the layer 3 procedures.
The basic building blocks are "elementary procedures" provided by the protocol control entities of the three sublayers,
i.e. radio resource management, mobility management and connection management sublayer.
Complete layer 3 transactions consist of specific sequences of elementary procedures. The term "structured procedure"
is used for these sequences.
ETSI
Release 18 32 3GPP TS 24.008 V18.4.0 (2023-09)
1.4 Test procedures

Test procedures of the GSM radio interface signalling are described in 3GPP TS 51.010 [39] and
3GPP TS 51.02x series.
1.5 Use of logical channels in A/Gb mode

The logical control channels are defined in 3GPP TS 45.002 [32]. In the following those control channels are
considered which carry signalling information or specific types of user packet information:
i) Broadcast Control CHannel (BCCH): downlink only, used to broadcast Cell specific information;
ii) Synchronization CHannel (SCH): downlink only, used to broadcast synchronization and BSS identification
information;
iii) Paging CHannel (PCH): downlink only, used to send page requests to Mobile Stations (MSs);
iv) Random Access CHannel (RACH): uplink only, used to request a Dedicated Control CHannel;
v) Access Grant CHannel (AGCH): downlink only, used to allocate a Dedicated Control CHannel;
vi) Standalone Dedicated Control CHannel (SDCCH): bi-directional;
vii)Fast Associated Control CHannel (FACCH): bi-directional, associated with a Traffic CHannel;
viii) Slow Associated Control CHannel (SACCH): bi-directional, associated with a SDCCH or a Traffic CHannel;
ix) Cell Broadcast CHannel (CBCH): downlink only used for general (not point to point) short message
information;
x) Notification CHannel (NCH): downlink only, used to notify mobile stations of VBS (Voice Broadcast Service)
calls or VGCS (Voice Group Call Service) calls.
Two service access points are defined on signalling layer 2 which are discriminated by their Service Access Point
Identifiers (SAPI) (see 3GPP TS 44.006 [19]):
i) SAPI 0: supports the transfer of signalling information including user-user information;
ii) SAPI 3: supports the transfer of user short messages.
Layer 3 selects the service access point, the logical control channel and the mode of operation of layer 2
(acknowledged, unacknowledged or random access, see 3GPP TS 44.005 [18] and 3GPP TS 44.006 [19]) as required
for each individual message.
1.6 Overview of control procedures

1.6.1 List of procedures
The following procedures are specified in the present document:
a) Clause 4 specifies elementary procedures for Mobility Management:
- mobility management common procedures (subclause 4.3):
- TMSI reallocation procedure (subclause 4.3.1);
- authentication procedure (subclause 4.3.2);
- identification procedure (subclause 4.3.3);
- IMSI detach procedure (subclause 4.3.4);
- abort procedure (subclause 4.3.5);
ETSI
Release 18 33 3GPP TS 24.008 V18.4.0 (2023-09)
- MM information procedure (subclause 4.3.6).
- mobility management specific procedures (subclause 4.4):
- location updating procedure (subclause 4.4.1);
- periodic updating (subclause 4.4.2);
- IMSI attach procedure (subclause 4.4.3);
- generic location updating procedure (subclause 4.4).
- connection management sublayer service provision:
- mobility management connection establishment (subclause 4.5.1);
- mobility management connection information transfer phase (subclause 4.5.2);
- mobility management connection release (subclause 4.5.3).
- GPRS specific mobility management procedures (subclause 4.7):
- GPRS attach procedure (subclause 4.7.3);
- GPRS detach procedure (subclause 4.7.4);
- GPRS routing area updating procedure (subclause 4.7.5).
- GPRS common mobility management procedures (subclause 4.7):
- GPRS P-TMSI reallocation procedure (subclause 4.7.6);
- GPRS authentication and ciphering procedure (subclause 4.7.7);
- GPRS identification procedure (subclause 4.7.8);
- GPRS information procedure (subclause 4.7.12).
b) Clause 5 specifies elementary procedures for circuit switched Call Control comprising the following elementary
procedures:
- mobile originating call establishment (subclause 5.2.1);
- mobile terminating call establishment (subclause 5.2.2);
- signalling procedures during the active state (subclause 5.3):
- user notification procedure (subclause 5.3.1);
- call rearrangements (subclause 5.3.2);
- DTMF protocol control procedure (subclause 5.5.7);
- in-call modification (subclause 5.3.4).
- call clearing initiated by the mobile station (subclause 5.4.3);
- call clearing initiated by the network (subclause 5.4.4);
- miscellaneous procedures:
- in-band tones and announcements (subclause 5.5.1);
- status enquiry procedure (subclause 5.5.3);
- call re-establishment procedure (subclause 5.5.4).
ETSI
Release 18 34 3GPP TS 24.008 V18.4.0 (2023-09)
d) Clause 6 specifies elementary procedures for session management:
- GPRS session management procedures (subclause 6.1):
- PDP context activation (subclauses 6.1.3.1 and 6.1.3.2);
- PDP context modification (subclause 6.1.3.3);
- PDP context deactivation (subclause 6.1.3.4).
- MBMS context activation (subclause 6.1.3.8);
- MBMS context deactivation (subclause 6.1.3.9).
The elementary procedures can be combined to form structured procedures. Examples of such structured procedures are
given in clause 7. This part of the present document is only provided for guidance to assist implementations.
Clause 8 specifies actions to be taken on various error conditions and also provides rules to ensure compatibility with
future enhancements of the protocol.
1.7 Applicability of implementations

The applicability of procedures of the present document for the mobile station is dependent on the services and
functions which are to be supported by a mobile station.
1.7.1 Voice Group Call Service (VGCS) and Voice Broadcast Service
(VBS)
Voice Group Call Service and Voice Broadcast Service are applicable in A/Gb mode only.
For mobile stations supporting the Voice Group Call Service or the Voice Broadcast Service, it is explicitly mentioned
throughout the present document if a certain procedure is applicable only for such a service and, if necessary, how
mobile stations not supporting such a service shall behave.
For VGCS and VBS, the following possible mobile station implementations exist:
- support of listening to voice broadcast calls (VBS listening);
- support of originating a voice broadcast call (VBS originating);
- support of listening to voice group calls (VGCS listening);
- support of talking in voice group calls (VGCS talking. This always includes the implementation for VGCS
listening);
- support of originating a voice group call (VGCS originating. This always includes the implementation for VGCS
talking).
Apart from the explicitly mentioned combinations, all possible combinations are optional and supported by the present
document.
The related terms are used in the present document, if information on these implementation options is required.
1.7.2 General Packet Radio Service (GPRS)
1.7.2.1 Packet services in GSM (A/Gb mode only)

For mobile stations supporting the General Packet Radio Service (GPRS), it is explicitly mentioned throughout the
technical specification if a certain procedure is applicable only for such a service and, if necessary, how mobile stations
not supporting such a service shall behave.
A GPRS MS may operate in one of the following MS operation modes, see 3GPP TS 23.060 [74]:
ETSI
Release 18 35 3GPP TS 24.008 V18.4.0 (2023-09)
- MS operation mode A;
- MS operation mode B; or
- MS operation mode C.
The MS operation mode depends on the services that the MS is attached to, i.e., only GPRS or both GPRS and non-
GPRS services, and upon the MS's capabilities to operate GPRS and other GSM services simultaneously. Mobile
stations that are capable to operate GPRS services are referred to as GPRS MSs.
NOTE: Other GSM technical specifications may refer to the MS operation modes A, B, and C as GPRS class-A
MS, GPRS class-B MS, and GPRS class-C MS.
It should be noted that it is possible that for a GPRS MS, the GMM procedures currently described in the ETS do not
support combinations of VGCS, VBS and GPRS. The possible interactions are not studied yet.
1.7.2.2 Packet services in Iu mode (Iu mode only)

An MS attached to packet switched domain may operate in one of the following MS operation modes, see
3GPP TS 23.060 [74]:
- CS/PS mode of operation; or
- PS mode of operation.
The terms 'CS/PS mode of operation' and 'PS mode of operation' are not used in the present document with some
exceptions. Instead the terms 'MS operation mode A' and 'MS operation mode C' are used.
In network operation mode I and II (see 3GPP TS 23.060 [74]), an MS in CS/PS mode of operation shall use the same
procedures as for a GPRS MS operating in MS operation mode A, unless it is explicitly stated for A/Gb mode only or
Iu mode only.
In network operation mode I and II, an MS in PS mode of operation shall use the same procedures as for a GPRS MS
operating in MS operation mode C, unless it is explicitly stated for A/Gb mode only or Iu mode only.
1.8 Handling of NAS signalling low priority indication

An MS configured for NAS signalling low priority (see 3GPP TS 24.368 [135], 3GPP TS 31.102 [112]) indicates this
by including the Device properties IE in the appropriate NAS message and setting the low priority indicator to "MS is
configured to NAS signalling low priority" except for the following cases in which the MS shall set the low priority
indicator to "MS is not configured for NAS signalling low priority":
- the MS is performing an attach for emergency bearer services;
- the MS has a PDN connection for emergency bearer services established and is performing mobility
management procedures, or is establishing a PDN connection for emergency bearer services;
- the MS configured for dual priority is requested by the upper layers to establish a PDN connection with the low
priority indicator set to "MS is not configured for NAS signalling low priority";
- the MS configured for dual priority is performing session management procedures related to the PDN connection
established with low priority indicator set to "MS is not configured for NAS signalling low priority";
- the MS configured for dual priority has a PDN connection established by setting the low priority indicator to
"MS is not configured for NAS signalling low priority" and is performing mobility management procedures;
- the MS is establishing or re-establishing an MM connection for an emergency call;
- the MS is an MS configured to use AC11 – 15 in selected PLMN; or
- the MS is responding to paging.
The network may use the NAS signalling low priority indication for NAS level mobility management congestion
control on a per core network node basis and APN based congestion control.
ETSI
Release 18 36 3GPP TS 24.008 V18.4.0 (2023-09)
If the NAS signalling low priority indication is provided in an ACTIVATE PDP CONTEXT REQUEST message, the
SGSN stores the NAS signalling low priority indication within the default PDP context activated due to this request.
1.9 Restrictions
Independently of what is stated elsewhere in this and other 3GPP specifications, mobile station support for PBCCH and
PCCCH is optional for A/Gb-mode of operation. The network shall never enable PBCCH and PCCCH. This makes use
of network operation mode III obsolete.
2 References
The following documents contain provisions which, through reference in this text, constitute provisions of the present
document.
- References are either specific (identified by date of publication, edition number, version number, etc.) or
non-specific.
- For a specific reference, subsequent revisions do not apply.
- For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same
Release as the present document.
[1] Void.
[2] Void.
[2a] 3GPP TR 21.905 "Vocabulary for 3GPP Specifications"
[3] 3GPP TS 22.002: "Circuit Bearer Services (BS) supported by a Public Land Mobile Network
(PLMN)".
[4] 3GPP TS 22.003: "Teleservices supported by a Public Land Mobile Network (PLMN)".
[5] 3GPP TS 42.009, Release 4: "Security aspects".
[5a] 3GPP TS 33.102: "3G security; Security architecture".
[6] Void.
[7] 3GPP TS 42.017, Release 4: "Subscriber Identity Modules (SIM); Functional characteristics".
[8] 3GPP TS 22.101: "Service aspects; Service principles".
[8a] 3GPP TS 22.001: "Principles of circuit telecommunication services supported by a Public Land
Mobile Network (PLMN)".
[8b] 3GPP TS 23.038: "Alphabets and language-specific information".
[9] Void.
[9a] 3GPP TS 23.108: "Mobile radio interface layer 3 specification core network protocols; Stage 2
(structured procedures)".
[10] 3GPP TS 23.003: "Numbering, addressing and identification".
[11] Void.
[12] 3GPP TS 23.014: "Support of Dual Tone Multi-Frequency (DTMF) signalling".
[12a] ETSI ES 201 235-2, v1.2.1: "Specification of Dual Tone Multi-Frequency (DTMF); Transmitters
and Receivers; Part 2: Transmitters".
ETSI
Release 18 37 3GPP TS 24.008 V18.4.0 (2023-09)
[13] 3GPP TS 43.020: "Security-related network functions".
[14] 3GPP TS 23.122: "Non-Access-Stratum functions related to Mobile Station (MS) in idle mode".
[15] 3GPP TS 24.002: "GSM-UMTS Public Land Mobile Network (PLMN) access reference
configuration".
[16] 3GPP TS 44.003: "Mobile Station - Base Station System (MS - BSS) interface; Channel structures
and access capabilities".
[17] Void.
[18] 3GPP TS 44.005: "Data Link (DL) layer; General aspects".
[19] 3GPP TS 44.006: "Mobile Station - Base Station System (MS - BSS) interface; Data Link (DL)
layer specification".
[19a] 3GPP TS 25.321: "Medium Access Control (MAC) protocol specification".
[19b] 3GPP TS 25.322: "Radio Link Control (RLC) protocol specification".
[19c] 3GPP TS 25.413: "UTRAN Iu interface Radio Access Network Application Part (RANAP)
signalling".
[20] 3GPP TS 24.007: "Mobile radio interface signalling layer 3; General aspects".
[21] 3GPP TS 24.010: "Mobile radio interface layer 3; Supplementary services specification; General
aspects".
[22] 3GPP TS 24.011: "Point-to-Point (PP) Short Message Service (SMS) support on mobile radio
interface".
[23] 3GPP TS 24.012: "Short Message Service Cell Broadcast (SMSCB) support on the mobile radio
interface".
[23a] 3GPP TS 44.071: "Location Services (LCS); Mobile radio interface layer 3 specification."
[23b] 3GPP TS 44.031 "Location Services LCS); Mobile Station (MS) - Serving Mobile Location Centre
(SMLC); Radio Resource LCS Protocol (RRLP)".
[23c] 3GPP TS 25.331: "Radio Resource Control (RRC) protocol specification"
[24] 3GPP TS 24.080: "Mobile radio Layer 3 supplementary service specification; Formats and
coding".
[25] 3GPP TS 24.081: "Line identification supplementary services; Stage 3".
[26] Void.
[27] 3GPP TS 24.083: "Call Waiting (CW) and Call Hold (HOLD) supplementary services; Stage 3".
[28] 3GPP TS 24.084: "MultiParty (MPTY) supplementary services; Stage 3".
[29] Void.
[30] Void.
[31] Void.
[32] 3GPP TS 45.002: "Multiplexing and multiple access on the radio path".
[33] 3GPP TS 45.005: "Radio transmission and reception".
[34] 3GPP TS 45.008: "Radio subsystem link control".
[35] Void.
[36] 3GPP TS 27.001: "General on Terminal Adaptation Functions (TAF) for Mobile Stations (MS)".
ETSI
Release 18 38 3GPP TS 24.008 V18.4.0 (2023-09)
[36a] 3GPP TS 27.060: "Mobile Station (MS) supporting Packet Switched Services ".
[37] 3GPP TS 29.002: "Mobile Application Part (MAP) specification".
[38] 3GPP TS 29.007: "General requirements on interworking between the Public Land Mobile
Network (PLMN) and the Integrated Services Digital Network (ISDN) or Public Switched
Telephone Network (PSTN)".
[39] 3GPP TS 51.010: "Mobile Station (MS) conformance specification".
[40] Void.
[41] ISO/IEC 646 (1991): "Information technology - ISO 7-bit coded character set for information
interchange".
[42] ISO/IEC 6429: "Information technology - Control functions for coded character sets".
[43] ISO 8348 (1987): "Information technology -- Open Systems Interconnection -- Network Service
Definition".
[44] ITU-T Recommendation E.163: "Numbering plan for the international telephone service".
[45] ITU-T Recommendation E.164: "The international public telecommunication numbering plan".
[46] ITU-T Recommendation E.212: "The international identification plan for mobile terminals and
mobile users".
[47] ITU-T Recommendation F.69 (1993): "The international telex service - Service and operational
provisions of telex destination codes and telex network identification codes".
[48] ITU-T Recommendation I.330: "ISDN numbering and addressing principles".
[49] ITU-T Recommendation Q.920 (1993): "ISDN user-network interface data link layer - General
aspects".
[50] ITU-T Recommendation Q.930 (1993): "ISDN user-network interface layer 3 - General aspects".
[51] ITU-T Recommendation I.500 (1993): "General structure of the ISDN interworking
recommendations".
[52] ITU-T Recommendation T.50: "International Reference Alphabet (IRA) (Formerly International
Alphabet No. 5 or IA5) - Information technology - 7-bit coded character set for information
interchange".
[53] ITU Recommendation Q.931: "ISDN user-network interface layer 3 specification for basic
control".
[54] ITU-T Recommendation V.21: "300 bits per second duplex modem standardized for use in the
general switched telephone network".
[55] ITU-T Recommendation V.22: "1200 bits per second duplex modem standardized for use in the
general switched telephone network and on point-to-point 2-wire leased telephone-type circuits".
[56] ITU-T Recommendation V.22bis: "2400 bits per second duplex modem using the frequency
division technique standardized for use on the general switched telephone network and on point-
to-point 2-wire leased telephone-type circuits".
[57] Void.
[58] ITU-T Recommendation V.26ter: "2400 bits per second duplex modem using the echo
cancellation technique standardized for use on the general switched telephone network and on
point-to-point 2-wire leased telephone-type circuits".
[59] ITU-T Recommendation V.32: "A family of 2-wire, duplex modems operating at data signalling
rates of up to 9600 bit/s for use on the general switched telephone network and on leased
telephone-type circuits".
ETSI
Release 18 39 3GPP TS 24.008 V18.4.0 (2023-09)
[60] ITU-T Recommendation V.110: "Support by an ISDN of data terminal equipments with V-Series
type interfaces".
[61] ITU-T Recommendation V.120: "Support by an ISDN of data terminal equipment with V-Series
type interfaces with provision for statistical multiplexing".
[62] ITU-T Recommendation X.21: "Interface between Data Terminal Equipment (DTE) and Data
Circuit-terminating Equipment (DCE) for synchronous operation on public data networks".
[63] Void.
[64] Void.
[65] ITU-T Recommendation X.30: "Support of X.21, X.21 bis and X.20 bis based Data Terminal
Equipments (DTEs) by an Integrated Services Digital Network (ISDN)".
[66] ITU-T Recommendation X.31: "Support of packet mode terminal equipment by an ISDN".
[67] Void.
[68] Void.
[69] ITU-T Recommendation X.121: "International numbering plan for public data networks".
[70] ETSI ETS 300 102-1: "Integrated Services Digital Network (ISDN); User-network interface
layer 3; Specifications for basic call control".
[71] Void.
[72] ISO/IEC 10646: "Information technology -- Universal Multiple-Octet Coded Character Set
(UCS)".
[73] 3GPP TS 22.060: "General Packet Radio Service (GPRS); Service Description; Stage 1".
[74] 3GPP TS 23.060: "General Packet Radio Service (GPRS); Service Description; Stage 2".
[75] Void.
[75a] 3GPP TS 43.318: "Generic Access Network (GAN); Stage 2".
[76] 3GPP TS 44.060: "General Packet Radio Service (GPRS); Mobile Station (MS) - Base Station
System (BSS) interface; Radio Link Control/Medium Access Control (RLC/MAC) protocol".
[76b] 3GPP TS 44.318: "Generic Access Network (GAN); Mobile GAN interface layer 3 specification;
Stage 3".
[77] Void.
[78] 3GPP TS 44.065: "Mobile Station (MS) - Serving GPRS Support Node (SGSN); Subnetwork
Dependent Convergence Protocol (SNDCP)".
[78a] 3GPP TS 44.064: "Mobile Station - Serving GPRS Support Node (MS-SGSN) Logical Link
Control (LLC) Layer Specification".
[79] ITU Recommendation I.460: "Multiplexing, rate adaption and support of existing interfaces".
[80] 3GPP TS 26.111: "Codec for Circuit Switched Multimedia Telephony Service; Modifications to
H.324".
[81] 3GPP TS 23.107: "Quality of Service (QoS) concept and architecture".
[82] 3GPP TS 43.022: "Functions related to Mobile Station (MS) in idle mode and group receive
mode".
[83] 3GPP TS 26.103: "Speech Codec List for GSM and UMTS".
[84] 3GPP TS 44.018: "Mobile radio interface layer 3 specification, Radio Resource Control Protocol".
ETSI
Release 18 40 3GPP TS 24.008 V18.4.0 (2023-09)
[85] 3GPP TS 48.008: "Mobile-services Switching Centre – Base Station System (MSC – BSS)
interface; layer 3 specification".
[86] 3GPP TS 48.018: "General Packet Radio Service (GPRS); Base Station System (BSS) - Serving
GPRS Support Node (SGSN); BSS GPRS Protocol (BSSGP)".
[87] 3GPP TS 43.055: "Dual Transfer Mode (DTM); Stage 2".
[88] 3GPP TS 23.067: "enhanced Multi-Level Precedence and Pre-emption service (eMLPP); Stage 2".
[88a] 3GPP TS 23.093: "Technical realization of Completion of Calls to Busy Subscriber (CCBS);
Stage 2".
[89] 3GPP TS 22.042: "Network Identity and Time Zone (NITZ), Stage 1".
[90] 3GPP TS 23.040: "Technical realization of Short Message Service (SMS)".
[91] 3GPP TS 44.056: "GSM Cordless Telephony System (CTS), (Phase 1) CTS Radio Interface Layer
3 Specification".
[92] 3GPP TS 23.226: "Global Text Telephony; Stage 2"
[93] 3GPP TS 26.226: "Cellular Text Telephone Modem (CTM), General Description"
[94] 3GPP TS 23.236: "Intra Domain Connection of RAN Nodes to Multiple CN Nodes"
[95] 3GPP TS 24.229: "IP Multimedia Call Control Protocol based on SIP and SDP"
[96] 3GPP TS 23.205: "Bearer-independent circuit-switched core network; Stage 2".
[97] 3GPP TS 23.172: "UDI/RDI Fallback and Service Modification; Stage 2".
[98] 3GPP TS 25.304: "UE Procedures in Idle Mode and Procedures for Cell Reselection in Connected
Mode"
[99] IETF RFC 4291 (February 2006): "Internet Protocol Version 6 (IPv6) Addressing Architecture".
[100] 3GPP TS 29.207, Release 6: "Policy control over Go interface".
[101] 3GPP TS 21.111: "USIM and IC card requirements".
[102] IETF RFC 1661 (July 1994): "The Point-to-Point Protocol (PPP)".
[103] IETF RFC 3232 (January 2002): "Assigned Numbers: RFC 1700 is Replaced by an On-line
Database".
[179][180][181][104] 3GPP TS 23.034: "High Speed Circuit Switched Data (HSCSD) – Stage 2".
[105] 3GPP TS 23.271: "Functional stage 2 description of Location Services (LCS)".
[106] 3GPP TS 23.246: "Multimedia Broadcast/Multicast Service (MBMS); Architecture and Functional
Description".
[107] IETF RFC 3376 (October 2002): "Internet Group Management Protocol, Version 3".
[108] IETF RFC 2710 (October 1999): "Multicast Listener Discovery (MLD) for IPv6".
[109] 3GPP TS 23.251: "Network Sharing; Architecture and Functional Description".
[110] 3GPP TS 25.346: "Introduction of the Multimedia Broadcast Multicast Service (MBMS) in the
Radio Access Network"
[111] 3GPP TS 44.118, Release 11: "Radio Resource Control (RRC) protocol; Iu mode".
[112] 3GPP TS 31.102: "Characteristics of the USIM Application".
[113] 3GPP TS 43.129: "Packet-switched handover for GERAN A/Gb mode; Stage 2".
ETSI
Release 18 41 3GPP TS 24.008 V18.4.0 (2023-09)
[114] 3GPP TS 23.009: "Handover procedures".
[115] 3GPP TR 23.903: "Redial solution for voice-video switching".
[116] 3GPP TS 24.279: "Combining Circuit Switched (CS) and IP Multimedia Subsystem (IMS)
services, stage 3"
[117] ITU-T Recommendation H.324 Amendment 1: "New Annex K "Media Oriented Negotiation
Acceleration Procedure" and associated changes to Annex".
[118] ITU-T Recommendation H.324 Amendment 2: "New Annex L on text conversation and associated
changes; corrections and clarifications to Annex K".
[119] ITU-T Recommendation H.245: "Control protocol for multimedia communication"
[120] 3GPP TS 24.301: "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS);
Stage 3".
[121] 3GPP TS 36.304: "Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE)
procedures in idle mode".
[122] 3GPP TS 23.401: "GPRS enhancements for E-UTRAN access".
[123] 3GPP TS 33.401: "3GPP System Architecture Evolution; Security architecture".
[124] 3GPP TS 24.303: "Mobility management based on Dual-Stack Mobile IPv6; Stage 3".
[125] 3GPP TS 24.327: "Mobility between 3GPP WLAN Interworking and 3GPP systems; GPRS and
3GPP I-WLAN aspects; Stage 3".
[126] 3GPP TS 23.216: "Single Radio Voice Call Continuity (SRVCC); Stage 2".
[127] 3GPP TS 23.002: "Network architecture".
[128] 3GPP TS 25.301: "Radio interface protocol architecture".
[129] 3GPP TS 36.331: "Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource
Control (RRC); Protocol specification".
[130] 3GPP TS 29.061: "Interworking between the Public Land Mobile Network (PLMN) supporting
packet based services and Packet Data Networks (PDN)".
[131] 3GPP TS 23.221: "Architectural requirements".
[132] 3GPP TS 23.090: "Unstructured Supplementary Service Data (USSD); Stage 2".
[133] 3GPP TS 23.272: "Circuit Switched Fallback in Evolved Packet System; Stage 2".
[133A] 3GPP TS 23.682: "Architecture enhancements to facilitate communications with packet data
networks and applications".
[134] 3GPP TS 24.167: "3GPP IMS Management Object (MO); Stage 3".
[135] 3GPP TS 24.368: "Non-Access Stratum (NAS) configuration Management Object (MO)".
[136] 3GPP TS 24.237: "IP Multimedia Subsystem (IMS) Service Continuity; Stage 3".
[137] IETF RFC 3261 (June 2002): "SIP: Session Initiation Protocol".
[138] 3GPP TS 22.011: "Service accessibility".
[139] IETF RFC 3633 (December 2003): "IPv6 Prefix Options for Dynamic Host Configuration
Protocol (DHCP) version 6".
[140] 3GPP TS 23.012: "Location management procedures".
[141] 3GPP TS 24.022: "Radio Link Protocol (RLP) for circuit switched bearer and teleservices".
ETSI
Release 18 42 3GPP TS 24.008 V18.4.0 (2023-09)
[142] ITU-T Recommendation X.1: "International user classes of service in, and categories of access to,
public data networks and Integrated Services Digital Networks (ISDNs)".
[143] ITU-T Recommendation X.25: "Interface between Data Terminal Equipment (DTE) and Data
Circuit-terminating Equipment (DCE) for terminals operating in the packet mode and connected to
public data networks by dedicated circuit".
[144] ITU-T Recommendation X.213: "Information technology – Open Systems Interconnection –

Network service definition".
[145] ITU-T Recommendation I.334: "Principles relating ISDN numbers/sub-addresses to the OSI
reference model network layer addresses".
[146] ITU-T Recommendation H.223: "Multiplexing protocol for low bit rate multimedia
communication".
[147] ITU-T Recommendation V.34: "A modem operating at data signalling rates of up to 33 600 bit/s
for use on the general switched telephone network and on leased point-to-point 2-wire telephone-
type circuits".
[148] IETF RFC 3810 (June 2004): "Multicast Listener Discovery Version 2 (MLDv2) for IPv6".
[149] 3GPP TS 29.018: "General Packet Radio Service (GPRS); Serving GPRS Support Node (SGSN) -
Visitors Location Register (VLR); Gs interface layer 3 specification".
[150] 3GPP TS 29.272: "Evolved Packet System (EPS); Mobility Management Entity (MME) and
Serving GPRS Support Node (SGSN) related interfaces based on Diameter protocol".
[151] 3GPP TS 45.008: "Radio subsystem link control".
[152] 3GPP TS 29.010: "Information element mapping between Mobile Station - Base Station System
(MS - BSS) and Base Station System - Mobile-services Switching Centre (BSS - MSC); Signalling
Procedures and the Mobile Application Part (MAP)".
[153] 3GPP TS 36.306: "Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE)
radio access capabilities".
[154] 3GPP TS 24.105: "Application specific Congestion control for Data Communication (ACDC)
Management Object (MO)".
[155] 3GPP TS 23.161: "Network-Based IP Flow Mobility (NBIFOM); Stage 2".
[156] 3GPP TS 24.302: "Access to the 3GPP Evolved Packet Core (EPC) via non-3GPP access
networks; Stage 3".
[157] 3GPP TS 45.001: "Physical layer on the radio path; General description".
[158] 3GPP TS 24.161: " Network-Based IP Flow Mobility (NBIFOM); Stage 3".
[159] 3GPP TS 43.064: "Overall description of the GPRS Radio Interface; Stage 2".
[160] 3GPP TS 23.167: "IP Multimedia Subsystem (IMS) emergency sessions".
[161] 3GPP TS 26.267: "eCall Data Transfer; In-band modem solution; General description".
[162] 3GPP TS 24.250: "Protocol for Reliable Data Service; Stage 3".
[163] 3GPP TS 24.292: "IP Multimedia (IM) Core Network (CN) subsystem; Centralized Services
(ICS); Stage 3".
[164] 3GPP TS 29.292: "Interworking between the IP Multimedia (IM) Core Network (CN) Subsystem
(IMS) and MSC Server for IMS Centralized Services (ICS)".
[165] 3GPP TS 49.031: "Location Services (LCS); Base Station System Application Part LCS Extension
(BSSAP-LE)".
[166] 3GPP TS 23.501: "System Architecture for the 5G System; Stage 2".
ETSI
Release 18 43 3GPP TS 24.008 V18.4.0 (2023-09)
[167] 3GPP TS 24.501: "Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3".
[168] IETF RFC 3629 (November 2003): "UTF-8, a transformation format of ISO 10646".
[169] IETF RFC 5905 (June 2010): "Network Time Protocol Version 4: Protocol and Algorithms
Specification".
[170] 3GPP TS 33.501: "Security architecture and procedures for 5G System".
[171] 3GPP TS 24.193: "Access Traffic Steering, Switching and Splitting; Stage 3".
[172] IETF RFC 7858 (May 2016): "Specification for DNS over Transport Layer Security (TLS)".
[173] IETF RFC 8094 (February 2017): "DNS over Datagram Transport Layer Security (DTLS)".
[174] IET RFC 6056 (January 2011): "Recommendations for Transport-Protocol Port Randomization".
[175] IETF RFC 1035 (November 1987):"DOMAIN NAMES - IMPLEMENTATION AND

SPECIFICATION".
[176] IETF RFC 7469 (April 2015):"Public Key Pinning Extension for HTTP".
[177] ITU-T Recommendation X.690 (2002) | ISO/IEC 8825-1:2002,

Information technology - ASN.1 encoding rules:
Specification of Basic Encoding Rules (BER), Canonical
Encoding Rules (CER) and Distinguished Encoding Rules
(DER).
[178] 3GPP TS 24.502: "Access to the 3GPP 5G System (5GS) via non-3GPP access networks;
Stage 3".
[179] IETF RFC 1334 (October 1992): "PPP Authentication Protocols".
[180] IETF RFC 1994 (August 1996): "PPP Challenge Handshake Authentication Protocol (CHAP)".
[181] IETF RFC 1332 (May 1992): "The PPP Internet Protocol Control Protocol (IPCP)".
[182] 3GPP TS 23.548: "5G System Enhancements for Edge Computing; Stage 2".
[183] 3GPP TS 38.304: "NR; User Equipment (UE) procedures in Idle mode and RRC Inactive state".
[184] 3GPP TS 23.558: "Architecture for enabling Edge Applications; Stage 2".
[185] 3GPP TS 24.174: "Support of multi-device and multi-identity in the IP Multimedia Subsystem
(IMS); Stage 3".
[186] IETF RFC 7542: "The Network Access Identifier".
2.1 Definitions and abbreviations

For the purposes of the present document, the abbreviations defined in 3GPP TR 21.905 [2a] and the followings apply:
CAT Customized Alerting Tone

CHAP Challenge Handshake Authentication Protocol
DRVCC Dual Radio Voice Call Continuity
eDRX Extended idle-mode DRX cycle
IP-CAN IP-Connectivity Access Network
HNB Home Node B
IoT Internet of Things
Kc 64-bit GSM ciphering key
Kc128 128-bit GSM ciphering key
Kint 128-bit GSM integrity key
L-GW Local PDN Gateway
ETSI
Release 18 44 3GPP TS 24.008 V18.4.0 (2023-09)
LHN-ID Local Home Network Identifier

LIPA Local IP Access
MSD Minimum Set of emergency related Data
MTU Maximum Transfer Unit
NB-IoT Narrowband IoT
NR New Radio
PAP Password Authentication Protocol
PSM Power Saving Mode
PVS Provisioning Server
SIPTO Selected IP Traffic Offload
S-NSSAI Single Network Slice Selection Assistance Information
SDNAEPC Secondary DN authentication and authorization over EPC
SNPN Stand-alone Non-Public Network
TMGI Temporary Mobile Group Identity
2.1.1 Random values

In a number of places in the present document, it is mentioned that some value must take a "random" value, in a given
range, or more generally with some statistical distribution. Such cases interest only the Mobile Station.
It is required that there is a low probability that two MSs in the same conditions (including the case of two MSs of the
same type from the same manufacturer) will choose the same value. Moreover, it is required that, if it happens that two
MSs in similar conditions choose the same value, the probability of their choices being identical at the next occasion is
the same as if their first choices had been different.
The meaning of such a specification is that any statistical test for these values, done on a series of similar events, will
obtain a result statistically compatible with the specified distribution. This shall hold even in the cases where the tests
are conducted with a subset of possible events, with some common parameters. Moreover, basic tests of independence
of the values within the series shall pass.
Data against which correlation with the values shall not be found are the protocol state, or the IMSI, or identities or
other unrelated information broadcast by the network, or the current TDMA frame number.
2.1.2 Vocabulary
For the purposes of the present document, the following terms and definitions apply:
- A GSM security context is established and stored in the MS and the network as a result of a successful
execution of a GSM authentication challenge. The GSM security context for the CS domain consists of the GSM
ciphering key and the ciphering key sequence number. The GSM security context for the PS domain consists of
the GPRS GSM ciphering key and the GPRS ciphering key sequence number.
- A UMTS security context is established and stored in the MS and the network as a result of a successful
execution of a UMTS authentication challenge. The UMTS security context for the CS domain consists of the
UMTS ciphering key, the UMTS integrity key, the GSM ciphering key, the ciphering key sequence number and
the GSM Kc128 (if an A5 ciphering algorithm that requires a 128-bit ciphering key is in use). The UMTS security
context for the PS domain consists of the GPRS UMTS ciphering key, the GPRS UMTS integrity key, the GPRS
GSM ciphering key, the GPRS ciphering key sequence number, the GPRS GSM Kc128 (if a GEA ciphering
algorithm that requires a 128-bit ciphering key is in use) and the GPRS GSM Kint (if a GIA integrity algorithm
that requires a 128-bit integrity key is in use).
- An MS is attached for emergency bearer services if it has successfully completed an attach for emergency
bearer services or if it has only a PDN connection for emergency bearer services established.
- idle mode: In this mode, the mobile station is not allocated any dedicated channel; it listens to the CCCH and the
BCCH;
- group receive mode: (Only applicable for mobile stations supporting VGCS listening or VBS listening) In this
mode, the mobile station is not allocated a dedicated channel with the network; it listens to the downlink of a
voice broadcast channel or voice group call channel allocated to the cell. Occasionally, the mobile station has to
listen to the BCCH of the serving cell as defined in 3GPP TS 43.022 [82] and 3GPP TS 45.008 [34];
ETSI
Release 18 45 3GPP TS 24.008 V18.4.0 (2023-09)
- dedicated mode: In this mode, the mobile station is allocated at least two dedicated channels, only one of them
being a SACCH;
- EAB: Extended Access Barring, see 3GPP TS 22.011 [138].
- group transmit mode: (Only applicable for mobile stations supporting VGCS talking) In this mode, one mobile
station of a voice group call is allocated two dedicated channels, one of them being a SACCH. These channels
can be allocated to one mobile station at a time but to different mobile stations during the voice group call;
- packet idle mode: (only applicable for mobile stations supporting GPRS) In this mode, mobile station is not
allocated any radio resource on a packet data physical channel; it listens to the BCCH and the CCCH, see
3GPP TS 44.060 [76].
- packet transfer mode: (only applicable for mobile stations supporting GPRS) In this mode, the mobile station is
allocated radio resource on one or more packet data physical channels for the transfer of LLC PDUs.
- main DCCH: In dedicated mode and group transmit mode, only two channels are used as DCCH, one being a
SACCH, the other being a SDCCH or a FACCH; the SDCCH or FACCH is called here "the main DCCH";
- A channel is activated if it can be used for transmission, in particular for signalling, at least with UI frames. On
the SACCH, whenever activated, it must be ensured that a contiguous stream of layer 2 frames is sent;
- A TCH is connected if circuit mode user data can be transferred. A TCH cannot be connected if it is not
activated. A TCH which is activated but not connected is used only for signalling, i.e. as a DCCH;
- The data link of SAPI 0 on the main DCCH is called the main signalling link. Any message specified to be sent
on the main signalling link is sent in acknowledged mode except when otherwise specified;
- The term "to establish" a link is a short form for "to establish the multiframe mode" on that data link. It is
possible to send UI frames on a data link even if it is not established as soon as the corresponding channel is
activated. Except when otherwise indicated, a data link layer establishment is done without an information field.
- "channel set" is used to identify TCHs that carry related user information flows, e.g., in a multislot
configuration used to support circuit switched connection(s), which therefore need to be handled together.
- A temporary block flow (TBF) is a physical connection used by the two RR peer entities to support the uni-
directional transfer of LLC PDUs on packet data physical channels, see 3GPP TS 44.060 [76].
- RLC/MAC block: A RLC/MAC block is the protocol data unit exchanged between RLC/MAC entities, see
3GPP TS 44.060 [76].
- A GMM context is established when a GPRS attach procedure is successfully completed.
- Network operation mode
The network operation modes I and II are defined in 3GPP TS 23.060 [74].
The network operation mode shall be indicated as system information. For proper operation, the network
operation mode should be the same in each cell of one routing area.
- GAN mode: See 3GPP TS 43.318 [75a].
- GPRS MS operation mode
The three different GPRS MS operation modes A, B, and C are defined in 3GPP TS 23.060 [74].
- RR connection: A RR connection is a dedicated physical circuit switched domain connection used by the two
RR or RRC peer entities to support the upper layers' exchange of information flows.
- PS signalling connection is a peer to peer Iu mode connection between MS and CN packet domain node.
- Inter-system change is a change of an MS from A/Gb mode to Iu mode of operation or vice versa, or from S1
mode to A/Gb mode or Iu mode of operation.
- GPRS: Packet services for systems which operate the Gb or Iu-PS interfaces.
- GSM ciphering key: A 64-bit CS GSM ciphering key
ETSI
Release 18 46 3GPP TS 24.008 V18.4.0 (2023-09)
- GSM Kc128: A 128-bit CS GSM ciphering key
- GPRS GSM ciphering key: A 64-bit PS GSM ciphering key
- GPRS GSM Kc128: A 128-bit PS GSM ciphering key
- GPRS GSM Kint: A 128-bit PS GSM integrity key.
- The label (A/Gb mode only) indicates this section or paragraph applies only to a system which operates in A/Gb
mode, i.e. with a functional division that is in accordance with the use of an A or a Gb interface between the
radio access network and the core network. For multi system case this is determined by the current serving radio
access network.
- The label (Iu mode only) indicates this section or paragraph applies only to a system which operates in UTRAN
Iu mode , i.e. with a functional division that is in accordance with the use of an Iu-CS or Iu-PS interface between
the radio access network and the core network. For multi system case this is determined by the current serving
radio access network.
- In A/Gb mode,... Indicates this paragraph applies only to a system which operates in A/Gb mode. For multi
system case this is determined by the current serving radio access network.
- In Iu mode,... Indicates this paragraph applies only to a system which operates in UTRAN Iu mode. For multi
system case this is determined by the current serving radio access network.
- In A/Gb mode and GERAN Iu mode,... Indicates this paragraph applies only to a system which operates in
A/Gb mode or GERAN Iu mode. For multi system case this is determined by the current serving radio access
network.
- In UTRAN Iu mode,... Indicates this paragraph applies only to a system which operates in UTRAN Iu mode.
For multi system case this is determined by the current serving radio access network.
- In a shared network,... Indicates this paragraph applies only to a shared network. For the definition of shared
network see 3GPP TS 23.122 [14].
NOTE: A shared network is applicable to GERAN and UTRAN, however, according to this definition, a multi-
operator core network (MOCN) with common GERAN is not considered a shared network in
3GPP TS 23.122 [14] and in the present specification.
- Multi-Operator Core Network (MOCN) with common GERAN: a network in which different core network
operators are connected to a shared GERAN broadcasting only a single, common PLMN identity.
- Chosen PLMN: The same as selected PLMN as specified in 3GPP TS 23.122 [14].
- A default PDP context is a PDP context activated by the PDP context activation procedure that establishes a
PDN connection. The default PDP context remains active during the lifetime of the PDN connection.
- A PDP context for emergency bearer services is a default PDP context which was activated with request type
"emergency", or any secondary PDP contexts associated to this default PDP context.
- Non-emergency PDP context: Any PDP context which is not a PDP context for emergency bearer services.
- SIM, Subscriber Identity Module (see 3GPP TS 42.017 [7]).
- USIM, Universal Subscriber Identity Module (see 3GPP TS 21.111 [101]).
- MS, Mobile Station. The present document makes no distinction between MS and UE.
- MS configured for dual priority: An MS which provides dual priority support is configured for NAS signalling
low priority and also configured to override the NAS signalling low priority indicator (see
3GPP TS 24.368 [135], 3GPP TS 31.102 [112]).
- Cell Notification is an (optimised) variant of the Cell Update Procedure which uses the LLC NULL frame for
cell change notification which does not trigger the restart of the READY timer
- DTM: Dual Transfer Mode, see 3GPP TS 44.018 [84] and 3GPP TS 43.055 [87]
ETSI
Release 18 47 3GPP TS 24.008 V18.4.0 (2023-09)
- The term "eCall only" applies to a mobile station which is in the eCall only mode, as described in
3GPP TS 22.101 [8].
- "removal of eCall only restriction" means that all the limitations as described in 3GPP TS 22.101 [8] for the
eCall only mode do not apply any more.
- "SMS-only service": A subset of services which includes only short message service. The MS can request
"SMS-only service" in order to obtain SMS.
- Access domain selection: The process to select whether the CS domain or the IMS/IP-CAN is used to transmit
the call control signalling between MS and core network. Definition derived from 3GPP TS 23.221 [131].
- APN based congestion control: Congestion control in session management where the network can reject
session management requests from MSs or deactivate PDP contexts when the associated APN is congested.
- NAS level mobility management congestion control: Congestion control mechanism in the network in
mobility management. "NAS level mobility management congestion control" consists of "subscribed APN based
congestion control" and "general NAS level mobility management congestion control".
- General NAS level mobility management congestion control: The type of congestion control that is applied at
a general overload or congestion situation in the network, e.g. lack of processing resources.
- Group specific session management congestion control: Type of congestion control at session management
level that is applied to reject session management requests from MSs belonging to a particular group when one
or more group congestion criteria as specified in 3GPP TS 23.060 [74] are met.
- Subscribed APN based congestion control: Congestion control in mobility management where the network
can reject attach requests from MSs with a certain APN in the subscription.
- Mapped P-TMSI: A P-TMSI which is mapped from a GUTI previously allocated to the MS by an MME.
Mapping rules are defined in 3GPP TS 23.003 [10]. Definition derived from 3GPP TS 23.401 [122].
- Native P-TMSI: A P-TMSI previously allocated by an SGSN. Definition derived from 3GPP TS 23.401 [122].
- Valid LAI: A LAI that is not deleted LAI.
- EMM Combined UE Waiting Flag: See 3GPP TS 29.018 [149].
- Power Saving Mode: Power saving mode allows the MS to reduce its power consumption. When power saving
mode is active in the MS, the MS is registered to the network and in PMM-IDLE mode (in Iu mode), EMM-
IDLE mode (in S1 mode) or the READY timer is not running (in A/Gb mode) but the AS layer is deactivated.
Definition derived from 3GPP TS 23.060 [74] and 3GPP TS 23.401 [122].
- ACDC: Application specific Congestion control for Data Communication, see 3GPP TS 22.011 [138].
- Highest ranked ACDC category: The ACDC category with the lowest value as defined in
3GPP TS 24.105 [154].
- Extended idle-mode DRX cycle: Extended idle-mode DRX cycle allows the MS to reduce its power
consumption in PMM-IDLE mode (in Iu mode) or when the READY timer is not running (in A/Gb mode) or in
EMM-IDLE mode (in S1 mode). Extended idle-mode DRX cycle is associated with the eDRX cycle value.
Definition derived from 3GPP TS 23.060 [74] and 3GPP TS 23.401 [122].
- EC-GSM-IoT: Extended coverage in GSM for IoT is a feature which enables extended coverage operation.
See 3GPP TS 43.064 [159].
For the purposes of the present document, the following terms and definitions given in 3GPP TS 23.401 [122],
subclause 3.2, apply:
DCN-ID
Globally Unique MME Identifier (GUMMEI)
Globally Unique Temporary Identity (GUTI)
Idle Mode Signalling Reduction (ISR)
M-Temporary Mobile Subscriber Identity (M-TMSI)
NarrowBand-IoT
PDN connection
ETSI
Release 18 48 3GPP TS 24.008 V18.4.0 (2023-09)
Tracking Area Identity (TAI)

Temporary Identity used in Next update (TIN)
For the purposes of the present document, the following terms and definitions given in 3GPP TS 24.301 [120] apply:
CSG cell
CSG ID
CSG selection
EMM
EMM-IDLE mode
EPS
ESM
In NB-S1 mode
In WB-S1 mode
LIPA PDN connection
MO MMTEL voice call is started
MO MMTEL video call is started
MO SMSoIP is started
MS configured to use AC11 – 15 in selected PLMN: see UE configured to use AC11 – 15 in selected PLMN
PDN connection for emergency bearer services
S1 mode
SIPTO at the local network PDN connection
SIPTO at the local network PDN connection with collocated L-GW
SIPTO at the local network PDN connection with stand-alone GW
CS fallback
SMS over SGs
Current EPS security context

Mapped security context
eKSI
CK' and IK'
NAS downlink COUNT
NAS uplink COUNT
Multi-Operator Core Network (MOCN)

Network Sharing non-supporting MS: see non-supporting UE.
Network Sharing supporting MS: see supporting UE.
Country
EHPLMN
HPLMN
Suitable Cell
VPLMN
SRVCC
vSRVCC
CS to PS SRVCC
For the purposes of the present document, the following terms and definitions given in 3GPP TS 23.251 [109] and
3GPP TS 44.018 [84] apply:
Common PLMN
ETSI
Release 18 49 3GPP TS 24.008 V18.4.0 (2023-09)
Additional PLMN
Network sharing
Local Home Network Identifier
RAN rules handling parameter
move-traffic-to-WLAN indication
move-traffic-from-WLAN indication
Dedicated core network
NBIFOM
multi-access PDN connection
eCall over IMS
Minimum Set of Data (MSD)
NG-RAN
5GCN
5GMM
5GS
5GSM
DNN
DNN based congestion control
In NB-N1 mode
In WB-N1 mode
N1 mode
Service-level-AA
Restricted local operator services
For the purposes of the present document, the following terms and definitions given in 3GPP TS 23.038 [8b] apply:
<CR>
3 Radio Resource management procedures

See 3GPP TS 44.018 [84].
ETSI
Release 18 50 3GPP TS 24.008 V18.4.0 (2023-09)
4 Elementary procedures for Mobility Management
4.1 General
This clause describes the procedures used for mobility management for non-GPRS services and for GPRS-services at
the radio interface (Reference Point Um and Uu).
The main function of the Mobility Management sublayer is to support the mobility of user terminals, such as informing
the network of its present location and providing user identity confidentiality.
A further function of the MM sublayer is to provide connection management services to the different entities of the
upper Connection Management (CM) sublayer (see 3GPP TS 24.007 [20]).
There are two sets of procedures defined in this chapter:
- MM procedures for non-GPRS services (performed by the MM entity of the MM sublayer); and
- GMM procedures for GPRS services (performed by the GMM entity of the MM sublayer), see
3GPP TS 24.007 [20].
All the MM procedures described in this clause can only be performed if a RR connection has been established between
the MS and the network. Else, the MM sublayer has to initiate the establishment of a RR connection (see
3GPP TS 44.018 [84] subclause 3.3 and 3GPP TS 25.331 [23c]).
In A/Gb mode, the GMM procedures described in this clause, use services provided by the RR sublayer without prior
RR connection establishment.
In Iu mode: all the GMM procedures described in this clause can only be performed if a PS signalling connection has
been established between the MS and the network. Else, the GMM sublayer has to initiate the establishment of a PS
signalling connection (see 3GPP TS 25.331 [23c]).
GMM procedures are mandatory and applicable only for GPRS MSs and networks supporting those MSs. For GPRS
MSs which are IMSI attached for both GPRS and non-GPRS services, some MM procedures are replaced by GMM
combined procedures provided that the network operates in network operation mode I, i.e. is supporting combined
GMM procedures. GMM combined procedures are not applicable for the GPRS MS operation mode C but are
mandatory for the GPRS MS operation modes A and B and networks supporting network operation mode I, see
3GPP TS 23.060 [74].
4.1.1 MM and GMM procedures
4.1.1.1 Types of MM and GMM procedures

Depending on how they can be initiated, three types of MM procedures can be distinguished:
1) MM common procedures:
A MM common procedure can always be initiated whilst a RR connection exists. The procedures belonging to
this type are:
Initiated by the network:
- TMSI reallocation procedure;
- authentication procedure;
- identification procedure;
- MM information procedure;
- abort procedure.
ETSI
Release 18 51 3GPP TS 24.008 V18.4.0 (2023-09)
However, abort procedure is used only if an MM connection is being established or has already been established i.e. not
during MM specific procedures or during IMSI detach procedure, see subclause 4.3.5.
Initiated by the mobile station:
- IMSI detach procedure (with the exceptions specified in subclause 4.3.4).
2) MM specific procedures:
A MM specific procedure can only be initiated if no other MM specific procedure is running or no MM

connection exists. The procedures belonging to this type are:
- normal location updating procedure;
- periodic updating procedure;
- IMSI attach procedure; and
- eCall inactivity procedure.
3) MM connection management procedures:
These procedures are used to establish, maintain and release a MM connection between the mobile station and the
network, over which an entity of the upper CM layer can exchange information with its peer. A MM connection
establishment can only be performed if no MM specific procedure is running. More than one MM connection may be
active at the same time.
Depending on how they can be initiated, three types of GMM procedures can be distinguished:
1) GMM common procedures:
In Iu mode, a GMM common procedure can always be initiated whilst a PS signalling connection exists.
The procedures belonging to this type are:
Initiated by the network when a GMM context has been established:
- P-TMSI (re-) allocation;
- GPRS authentication and ciphering;
- GPRS identification;
- GPRS information.
2) GMM specific procedures:
Initiated by the network and used to detach the IMSI in the network for GPRS services and/or non-GPRS
services and to release a GMM context:
- GPRS detach.
Initiated by the MS and used to attach or detach the IMSI in the network for GPRS services and/or non-
GPRS services and to establish or release a GMM context:
- GPRS attach and combined GPRS attach;
- GPRS detach and combined GPRS detach;
- eCall inactivity procedure.
Initiated by the MS when a GMM context has been established:
- normal routing area updating and combined routing area updating;
- periodic routing area updating.
ETSI
Release 18 52 3GPP TS 24.008 V18.4.0 (2023-09)
3) GMM connection management procedures (Iu mode only):
Initiated by the MS and used to establish a secure connection to the network and/or to request the resource
reservation for sending data:
Service Request.
The Service Request procedure can only be initiated if no MS initiated GMM specific procedure is ongoing.
4.1.1.1.1 Integrity Checking of Signalling Messages in the Mobile Station (Iu mode only)
In Iu mode only, integrity protected signalling is mandatory with one exception regarding emergency calls (see
subclause 4.1.1.1.1a). In Iu mode only, all layer 3 protocols shall use integrity protected signalling once the security
mode procedure has been successfully activated in the network and the MS. Integrity protection of all layer 3 signalling
messages is the responsibility of lower layers. It is the network which activates integrity protection. This is done using
the security mode control procedure (3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
The supervision that integrity protection is activated shall be the responsibility of the MM and GMM layer in the MS
(see 3GPP TS 33.102 [5a]). In order to do this, the lower layers shall provide the MM and GMM layer with an
indication on when the integrity protection is activated in the MS (i.e. one indication to the MM layer when a security
mode control procedure for the CS domain is processed successfully and one indication to the GMM layer when a
security mode control procedure for the PS domain is processed successfully).
The CS and PS domains in the network and the MM and GMM layers in the MS, are not aware of whether integrity
protection has been started in the lower layers by the other domain. It is mandatory for the network to initiate one
security mode control procedure for the CS domain and one for the PS domain.
Except the messages listed below, no layer 3 signalling messages shall be processed by the receiving MM and GMM
entities or forwarded to the CM entities, unless the network has activated the integrity protection for that domain.
- MM messages:
- AUTHENTICATION REQUEST
- AUTHENTICATION REJECT
- IDENTITY REQUEST
- LOCATION UPDATING ACCEPT (at periodic location update with no change of location area or
temporary identity, and, any Per MS T3212 value is not changed)
- LOCATION UPDATING REJECT (if the cause is not #25)
- CM SERVICE ACCEPT, if the following two conditions apply:
- no other MM connection is established; and
- the CM SERVICE ACCEPT is the response to a CM SERVICE REQUEST with CM SERVICE

TYPE IE set to 'emergency call establishment'
- CM SERVICE REJECT (if the cause is not #25)
- ABORT
- GMM messages:
- AUTHENTICATION & CIPHERING REQUEST
- AUTHENTICATION & CIPHERING REJECT
- IDENTITY REQUEST
- ATTACH REJECT (if the cause is not #25)
ETSI
Release 18 53 3GPP TS 24.008 V18.4.0 (2023-09)
- ROUTING AREA UPDATE ACCEPT, if any of the following conditions applies:
- the MS performs periodic routing area updating with:
- no change in routing area or temporary identities;
- no change in T3312 extended value;
- no change in Network feature support value; and
- extended DRX parameters IE not included.
- the GMM entity in the MS has received an ATTACH ACCEPT message with neither ciphering nor
integrity protection applied in response to an ATTACH REQUEST message with attach type set to
"emergency attach"; or
- the MS has performed intersystem change from S1 mode to Iu mode with a PDN connection for
emergency bearer services for which the "null integrity protection algorithm" EIA0 has been used
while in S1 mode.
- ROUTING AREA UPDATE REJECT (if the cause is not #25)
- SERVICE REJECT (if the cause is not #25)
- DETACH ACCEPT (for non power-off)
- ATTACH ACCEPT, if the ATTACH ACCEPT is the response to an ATTACH REQUEST with attach
type set to "emergency attach".
- SERVICE ACCEPT, if any of the following conditions applies:
integrity protection applied in response to an ATTACH REQUEST message, with attach type set to
while in S1 mode.
- CC messages:
- all CC messages, if the following two conditions apply:
- no other MM connection is established; and
- the MM entity in the MS has received a CM SERVICE ACCEPT message with no ciphering or
integrity protection applied as response to a CM SERVICE REQUEST message, with CM SERVICE
TYPE set to 'Emergency call establishment’ sent to the network;
- the MM connection was established locally due to the SRVCC handover of a PDN connection for
while in S1 mode or for which integrity protection has not been activated while in Iu mode; or
- the MM connection was established locally due to the 5G-SRVCC handover from NG-RAN to
UTRAN of an emergency PDU session for which the "null integrity protection algorithm" 5G-IA0 has
been used while in N1 mode.
- SM messages:
- all SM messages, if any of the following conditions applies:
integrity protection applied in response to an ATTACH REQUEST message, with attach type set to
ETSI
Release 18 54 3GPP TS 24.008 V18.4.0 (2023-09)
while in S1 mode.
Once integrity protection is activated, the receiving layer 3 entity in the MS shall not process any layer 3 signalling
messages unless they have been successfully integrity checked by the lower layers. If any signalling messages, having
not successfully passed the integrity check, are received, then the lower layers in the MS shall discard that message (see
3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]). If any layer 3 signalling message is received, in either PS or CS
domains, as not integrity protected even though the integrity protection has been activated in the MS by that domain in
the network, then the lower layers shall discard this message (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
Integrity checking on the network side is performed by the RNC and is described in 3GPP TS 25.331 [23c] and
3GPP TS 44.118 [111].
4.1.1.1.1a Integrity protection for emergency call (Iu mode only)

The network should initiate the security mode procedure for an emergency call, in the same way as it would for any
other call except in the cases defined in sub-clause "Security Procedures Not Applied" in 3GPP TS 33.102 [5a].
For the establishment of a MM connection for an emergency call when no other MM connection is established (e.g. for
an emergency call initiated without a SIM/USIM no other MM connections can exist) the decision on whether or not to
apply the security procedures shall be made by the network as defined in the subclause "Emergency Call Handling" in
3GPP TS 33.102 [5a]. If the MM connection was established locally due to the SRVCC handover of a PDN connection
for emergency bearer services for which the "null integrity protection algorithm" EIA0 has been used while in S1 mode
or for which integrity protection has not been activated while in Iu mode, the network need not apply the security
procedures for this call. If the MM connection was established locally due to the 5G-SRVCC handover from NG-RAN
to UTRAN of an emergency PDU session for which the "null integrity protection algorithm" 5G-IA0 has been used
while in N1 mode, the network need not apply the security procedures for this call.
For an attach for emergency bearer services, (e.g. initiated without a SIM/USIM) the decision on whether or not to
apply the security procedures shall be made by the network as defined in the subclause "Emergency Call Handling" in
3GPP TS 33.102 [5a]. After intersystem change from S1 mode to Iu mode with a PDN connection for emergency bearer
services for which the "null integrity protection algorithm" EIA0 has been used while in S1 mode, the network need not
apply the security procedures for this connection.
For an initial registration for emergency services, (e.g. initiated without a SIM/USIM) the decision on whether or not to
apply the security procedures shall be made by the network as defined in the clause J.2 of 3GPP TS 33.501 [170]. After
5G-SRVCC handover from NG-RAN to UTRAN with an emergency PDU session for which the "null integrity
protection algorithm" 5G-IA0 has been used while in N1 mode, the network need not apply the security procedures for
this connection.
4.1.1.2 MM-GMM co-ordination for GPRS MS's
4.1.1.2.1 GPRS MS operating in mode A or B in a network that operates in mode I

If the network operates in mode I, GPRS MSes that operate in mode A or B and wish to be or are simultaneously IMSI
attached for GPRS and non-GPRS services, shall use the combined GPRS attach and the combined and periodic routing
area updating procedures instead of the corresponding MM specific procedures IMSI attach and normal and periodic
location area updating.
A GPRS MS operating in mode A or B in a network that operates in mode I, shall perform the combined GPRS attach
or routing area update procedure regardless the value of the ATT flag.
If a GPRS MS is operating in mode A or B in a network that operates in mode I the IMSI detach shall be performed by
the GMM using the combined GPRS detach procedure.
A GPRS MS operating in mode A or B in a network that operates in mode I, shall perform the combined GPRS detach
procedure regardless the value of the ATT flag.
A GPRS MS operating in mode A or B in network that operates in mode I, shall use the combined GMM specific
procedures in place of the MM specific procedures unless the re-activation of the MM specific procedures is explicitly
ETSI
Release 18 55 3GPP TS 24.008 V18.4.0 (2023-09)
described, so all conditions describing when to trigger an MM specific procedure listed in subclauses 4.3 and 4.4 shall
not apply.
A GPRS MS operating in mode A or B in a network that operates in mode I should not use any MM timers relating to
MM specific procedures, (e.g. T3210, T3211, T3212, T3213) unless the re-activation of the MM specific procedures is
explicitly described. If the MM timers are already running, the MS should not react on the expiration of the timers.
NOTE 1: Whenever GMM performs a combined GMM procedure, a GPRS MS enters the MM state MM
LOCATION UPDATING PENDING in order to prevent the MM from performing a location area
updating procedure.
If the authentication procedure is performed by MM and the authentication is rejected by the network (i.e. upon receive
of AUTHENTICATION REJECT), the MS shall in addition set the GPRS update status to GU3 ROAMING NOT
ALLOWED and shall, if available, delete the P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence
number stored. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS services until switching off or
the SIM/USIM is removed. The MS shall abort any GMM procedure and shall enter state GMM-DEREGISTERED. If
S1 mode is supported in the MS, the MS shall handle the EMM parameters EPS update status, GUTI, last visited
registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when the EPS authentication is not
accepted by the network.
If the PS or CS domain is barred because of domain specific access control, a GPRS MS operating in mode A or B in a
network that operates in mode I shall act as if in network operation mode II and access to the barred domain shall be
stopped entirely. If the MS detects that a domain is barred, this shall not trigger any MM or GMM specific procedure.
A GPRS MS operating in mode A or B in a network that operates in mode I shall perform a normal location updating
procedure (in order to remove the Gs association in the MSC/VLR) when the following conditions are fulfilled:
- the GPRS MS has camped on a cell where the PS domain is barred and the CS domain is unbarred; and
- T3312, T3311, T3302, or T3330 expires; and
- for the last attempt to update the registration of the location area a combined GMM procedure was performed.
Additionally the MS shall treat the expiry of T3312 when the PS domain changes from barred to unbarred, analogous to
the descriptions for the cases when the timer expires out of coverage or in a cell that does not support GPRS (see
subclause 4.7.2.2).
If timer T3312 expires and both the PS and CS domain are barred, then a GPRS MS operating in mode A or B in a
network that operates in mode I shall treat the expiry of T3312 when the GPRS MS detects that the PS or CS domain
becomes unbarred, analogous to the descriptions for the cases when the timer expires out of coverage (see
subclause 4.7.2.2).
If the PS domain is barred and timer T3312 expires during an ongoing CS connection, then a GPRS MS operating in
mode A or B in a network that operates in mode I shall treat the expiry of T3312 when the MM state MM-IDLE is
entered, analogous to the descriptions for the cases when the timer expires out of coverage or in a cell that does not
support GPRS (see subclause 4.7.2.2), or in a cell where the PS domain is barred.
A GPRS MS operating in mode A or B in a network that operates in mode I shall perform a combined routing area
update procedure indicating "combined RA/LA updating with IMSI attach" (in order to establish the Gs association in
the MSC/VLR) when the following conditions are fulfilled:
- the GPRS MS detects that CS or PS domain or both change from barred to unbarred;
- as a result of the change of the domain specific barring status, both domains are unbarred; and
- for the last attempt to update the registration of the location area an MM specific procedure was performed (see
subclause 4.7.5.2.1) or for the last attempt to update the registration of the routing area a normal routing area
update was performed.
A GPRS MS operating in mode A or B on a PLMN which is part of "forbidden PLMNs for GPRS service" list in a
network that is operating in mode I shall act as if in network operation mode II and proceed with appropriate MM
procedures.
ETSI
Release 18 56 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.1.2.2 GPRS MS operating in mode A or B in a network that operates in mode II

If the network operates in mode II, a GPRS MS that operates in mode A or B and wishes to be or is simultaneously
IMSI attached for GPRS and non-GPRS services, shall use the MM specific procedures listed in subclauses 4.3 and 4.4
and the GMM specific procedures listed in subclauses 4.7.3, 4.7.4 and 4.7.5. The applicability of periodic location
updating is further specified in subclause 4.4.2 and the periodic routing area updating is specified in subclause 4.7.2.2.
If the GPRS MS, which operates in mode A or B, wishes to be IMSI attached for GPRS and "SMS-only service"or is
simultaneously IMSI attached for GPRS and non-GPRS services in order to obtain GPRS services and "SMS-only
service", then the GPRS MS shall first complete the GMM specific procedure before performing the MM specific
procedures. If this GPRS MS receives in the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT message
the Additional network feature support IE indicating "SMS via GPRS supported", then the GPRS MS shall not perform
the MM specific procedure until a new ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT message
indicating "SMS via GPRS not supported" or the GPRS MS does not wish to be IMSI attached only for GPRS and
"SMS-only service".
If the authentication procedure is performed by MM and the authentication is rejected by the network (i.e upon receive
of AUTHENTICATION REJECT), the MS shall in addition set the GPRS update status to GU3 ROAMING NOT
ALLOWED and shall, if available, delete the P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence
number stored. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS services until switching off or
the SIM/USIM is removed. The MS shall abort any GMM procedure and shall enter state GMM-DEREGISTERED. If
S1 mode is supported in the MS, the MS shall handle the EMM parameters EPS update status, GUTI, last visited
registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when the EPS authentication is not
accepted by the network.
If the PS or CS domain is barred because of domain specific access control, a GPRS MS operating in mode A or B in a
network that operates in mode II shall use the MM specific procedures or GMM specific procedures, respectively, in the
domain which is unbarred. If the MS detects that a domain changes from barred to unbarred, it shall behave as specified
in subclauses 4.3.4.4, 4.4.4.9, 4.5.1.2, 4.7.3.1.5, 4.7.4.1.4, 4.7.5.1.5, and 4.7.13.5.
4.1.1.2A Coordination between GMM and EMM

See subclause 5.1.4 in 3GPP TS 24.301 [120].
4.1.1.2B Coordination between GMM and 5GMM

See subclause 5.1.5 in 3GPP TS 24.501 [167].
4.1.1.3 Core Network System Information for MM (Iu mode only)

In the network broadcast system information some of the system information is used by MM.
At reception of new system information, the RRC layer in the MS delivers the contents of the CN common system
information and the CS domain specific system information to the MM layer in the MS.
The Core Network system information is included in specific information elements within some RRC messages sent to
MS (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]). In the Core Network system information the Common
system information part and the CS domain specific system information part contains settings of parameters controlling
MM functionality. No MM messages contain the Core Network System Information.
4.1.1.4 Core Network System Information for GMM (Iu mode only)
4.1.1.4.1 General
In the network broadcast system information some of the system information is used by GMM.
At reception of new system information, the RRC layer in the MS delivers the contents of the CN common system
information and the PS domain specific system information to the GMM layer in the MS.
The Core Network system information is included in specific information elements within some RRC messages sent to
MS (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]). In the Core Network system information the Common
ETSI
Release 18 57 3GPP TS 24.008 V18.4.0 (2023-09)
system information part and the PS domain specific system information part contains settings of parameters controlling
GMM functionality. No GMM messages contain the Core Network System Information.
4.1.1.4.2 Control of Network Mode of Operation I

The behaviour of the MS with respect to NMO I is determined by the combination of PS domain specific system
information IE as defined in subclause 10.5.1.12.3 and the setting of the parameter "NMO_I_Behaviour" in the NAS
configuration Management Object as specified in 3GPP TS 24.368 [135] or in USIM file NASCONFIG as specified in
3GPP TS 31.102 [112]:
- if the parameter "NMO_I_Behaviour" in the NAS configuration Management Object is set to the value of "1",
the bit 2 "NMO I" of system information as described in figure 10.5.1.12.3/table 10.5.1.12.3 is applied; or
- if the parameter "NMO_I_Behaviour" in the NAS configuration Management Object is set to the value of zero or
is not provisioned, the bit 1 "NMO" of system information as described in figure 10.5.1.12.3/table 10.5.1.12.3 is
applied.
4.1.1.5 Access class control

The network can restrict the access for certain groups of mobile stations. These groups are also known as access classes.
The restriction can apply for access to both domains (common access class control or EAB, depending on EAB
configuration) or to one domain only (domain specific access control) (see 3GPP TS 23.122 [14]).
Additionally, the network can alleviate the access restriction in both domains or domain specifically, and allow
restricted mobile stations to respond to paging messages or to perform generic location updating, or GPRS attach or
routing area updating procedure.
A network operator can also restrict some MSs to access the network for location registration, although via common
access class control or domain specific access class control the MSs are permitted to access the network for other
purposes. Therefore, for each access to the network the mobile station shall determine from the information received via
the system information broadcast whether access is allowed or not:
- For paging response the mobile station shall evaluate the control information for common access control (as
specified in 3GPP TS 44.018 [84], 3GPP TS 44.060 [76], and 3GPP TS 25.331 [23c]), the control information
for EAB (as specified in 3GPP TS 44.018 [84], and 3GPP TS 25.331 [23c]), domain specific access control (as
specified in 3GPP TS 44.018 [84] and 3GPP TS 25.331 [23c]), and the specific control information for paging
response (as specified in 3GPP TS 25.331 [23c]; see "Paging Permission with Access Control").
- For generic location updating, GPRS attach and routing area updating procedures the mobile station shall
evaluate the control information for:
- common access control (as specified in 3GPP TS 44.018 [84], 3GPP TS 44.060 [76], and
3GPP TS 25.331 [23c]);
- domain specific access control (as specified in 3GPP TS 44.018 [84] and 3GPP TS 25.331 [23c]);
- specific control information for location registration (as specified in 3GPP TS 25.331 [23c]; see "Paging
Permission with Access Control"); and
- EAB as specified for A/Gb mode in 3GPP TS 44.018 [84], and for Iu mode in 3GPP TS 25.331 [23c].
The same control information shall also be taken into account, when the present document requires the mobile
station to initiate a generic location updating, or GPRS attach or routing area updating procedure when it detects
that a domain changes from barred to unbarred (see e.g. subclauses 4.1.1.2.1 and 4.1.1.2.2).
- For GPRS attach and routing area updating procedures in Iu mode, the mobile station shall evaluate the control
information for:
- ACDC if the mobile station supports ACDC (as specified in 3GPP TS 25.331 [23c]).
The same control information shall also be taken into account, when the present document requires the mobile
station to initiate a GPRS attach or routing area updating procedure in Iu mode when it detects that PS domain
changes from barred to unbarred (see e.g. subclauses 4.1.1.2.1 and 4.1.1.2.2).
ETSI
Release 18 58 3GPP TS 24.008 V18.4.0 (2023-09)
- For all other purposes the mobile station shall evaluate the control information for common access control as
specified in 3GPP TS 44.018 [84], 3GPP TS 44.060 [76], and 3GPP TS 25.331 [23c], the control information for
EAB (as specified in 3GPP TS 44.018 [84], and 3GPP TS 25.331 [23c]), domain specific access control (as
specified in 3GPP TS 44.018 [84] and 3GPP TS 25.331 [23c]) and in Iu mode for PS domain if the mobile
station supports ACDC, the control information for ACDC (as specified in 3GPP TS 25.331 [23c]).
4.1.1.6 Specific requirements for MS configured to use timer T3245

The following requirement applies for an MS that is configured to use timer T3245 (see 3GPP TS 24.368 [135] or
3GPP TS 31.102 [112]):
When the MS adds a PLMN identity to the "forbidden PLMN list" or the "forbidden PLMNs for GPRS service" list or
sets the SIM/USIM as invalid for non-GPRS services or GPRS services or both, and timer T3245 is not running, the MS
shall start timer T3245 with a random value, uniformly drawn from the range between 12h and 24h.
Upon expiry of the timer T3245, the MS shall erase the "forbidden PLMN list" and the "forbidden PLMNs for GPRS
service" list and set the SIM/USIM to valid for non-GPRS services and GPRS services. When the lists are erased, the
MS performs a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].
If the MS is switched off when the timer T3245 is running, the MS shall behave as follows when the MS is switched on
and the SIM/USIM in the MS remains the same:
- let t1 be the time remaining for T3245 timeout at switch off and let t be the time elapsed between switch off and
switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than
t, then the MS will follow the behaviour as defined in the paragraph above upon expiry of the timer T3245. If the
MS is not capable of determining t, then the MS shall restart the timer with the value t1.
4.1.1.6A Specific requirements for the MS when receiving non-integrity protected

reject messages
This subclause specifies the requirements for an MS that is not configured to use timer T3245 (see
3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) and receives a LOCATION UPDATING REJECT, CM SERVICE
REJECT, ABORT, ATTACH REJECT, ROUTING AREA UPDATE REJECT or SERVICE REJECT message without
integrity protection with specific MM or GMM causes.
NOTE 1: Additional MS requirements for this case, requirements for other MM or GMM causes, and requirements
for the case when the MS receives a successfully integrity checked reject message are specified in
subclauses 4.4.4.7, 4.5.1.1, 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4.
The present subclause is applicable to A/Gb mode and Iu mode. In A/Gb mode,
- for the CS domain, as integrity protection is not supported, all messages received by the MS are considered to be
received "before the network has activated the integrity protection"; and
- for the PS domain, if integrity protection is not required (see subclause 4.7.1.2a.), all messages received by the
MS are considered to be received "before the network has activated the integrity protection".
The MS may maintain a list of PLMN-specific attempt counters and a list of PLMN-specific PS-attempt counters. The
maximum number of possible entries in each list is implementation dependent.
Additionally, the MS may maintain one counter for "SIM/USIM considered invalid for non-GPRS services" events and
one counter for "SIM/USIM considered invalid for GPRS services" events.
If the MS maintains the above lists of attempt counters and the event counters, a MS supporting N1 mode, shall store
them in its non-volatile memory. The UE shall erase the lists and reset the event counters to zero when the UICC
containing the USIM is removed. The counter values shall not be affected by the activation or deactivation of power
saving mode.
The MS may also maintain a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location
areas for GPRS services". If the MS is in a location area which is included in the list of "forbidden location areas for
non-GPRS services", the MS shall not initiate any MM procedure. If the MS is in a location area which is included in
the list of "forbidden location areas for GPRS services", the MS shall not initiate any GMM, SM, SMS or SS procedure
for GPRS services.
ETSI
Release 18 59 3GPP TS 24.008 V18.4.0 (2023-09)
If the MS receives a LOCATION UPDATING REJECT message without integrity protection with MM cause value #2,
#3, #6, #11, #12, #13 or #15 before the network has activated the integrity protection for the CS domain, the MS shall
start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer
is not running, and take the following actions:
1) if the MM cause value received is #3 or #6, and
a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the
counter has a value less than an MS implementation-specific maximum value, the MS shall:
i) delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the location
update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the
SIM/USIM according to subclause 4.1.2.2);
delete the list of equivalent PLMNs;
in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if
not already incremented over the same RRC connection;
in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events;
store the current LAI in the list of "forbidden location areas for roaming"; and
search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022 [82] and
3GPP TS 25.304 [98] or 3GPP TS 36.304 [121]; or
ii) proceed as specified in subclause 4.4.4.7 and;
and
b) else the MS shall proceed as specified in subclause 4.4.4.7;
2) if the MM cause value received is #2, and
a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the
counter has a value less than an MS implementation-specific maximum value, the MS shall:
i) delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the location
update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the
SIM/USIM according to subclause 4.1.2.2);
if the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden
location areas for GPRS services", proceed as follows:
if the current LAI is already included in the list of "forbidden location areas for GPRS services" or the
MS is not operating in MS operation mode A or B, store the current LAI in the list of "forbidden
location areas for roaming"; otherwise store the current LAI in the list of "forbidden location areas for
non-GPRS services"; and
attempt to select a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or
3GPP TS 36.304 [121], different from the cell where the LOCATION UPDATING REJECT was
received; or
NOTE 2: The cell on which the reject was received could still be a suitable cell.
ETSI
Release 18 60 3GPP TS 24.008 V18.4.0 (2023-09)
ii) proceed as specified in subclause 4.4.4.7 and;
and
b) else the MS shall proceed as specified in subclause 4.4.4.7;
3) if the MM cause value received is #12, #13 or #15, the MS shall additionally proceed as specified in
subclause 4.4.4.7;
4) if the MM cause value received is #11 and the MS is in its HPLMN or in a PLMN that is within the EHPLMN
list (if the EHPLMN list is present):
the MS shall delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the
location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the
SIM/USIM according to subclause 4.1.2.2). Additionally, the MS shall store the current LAI in the list of
"forbidden location areas for roaming"; and
the MS shall search for a suitable cell in another location area or a tracking area according to
3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121]; and
5) if the MM cause value received is #11 and if the MS is not in its HPLMN or in a PLMN that is within the
EHPLMN list (if the EHPLMN list is present), in addition to the MS requirements specified in subclause 4.4.4.7,
- if the MS maintains a list of PLMN-specific attempt counters and the PLMN-specific attempt counter for the
PLMN sending the reject message has a value less than an MS implementation-specific maximum value, the
MS shall increment the PLMN-specific attempt counter for the PLMN.
If the MS receives a CM SERVICE REJECT or ABORT message with MM cause value #6 without integrity protection
before the network has activated the integrity protection for the CS domain, the MS shall start timer T3247 with a
random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and
a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter
has a value less than an MS implementation-specific maximum value, the MS shall:
i) proceed as specified in subclauses 4.5.1.1 or 4.3.5.2 respectively with the exception that the MS shall not
consider the SIM/USIM as invalid for non-GPRS services and;
in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not
already incremented over the same RRC connection;
reset the location update attempt counter;
store the current LAI in the list of "forbidden location areas for roaming"; and
3GPP TS 25.304 [98] or 3GPP TS 36.304 [121]; or
ii) proceed as specified in subclauses 4.5.1.1 or 4.3.5.2 respectively and;
in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not
already incremented over the same RRC connection;
in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and
b) else the MS shall proceed as specified in subclause 4.5.1.1 or 4.3.5.2 respectively.
If the MS receives an ATTACH REJECT or ROUTING AREA UPDATE REJECT message without integrity
protection with GMM cause value #3, #6, #7, #8, #11, #12, #13, #14 or #15 before the network has activated the
ETSI
Release 18 61 3GPP TS 24.008 V18.4.0 (2023-09)
integrity protection for the PS domain, the MS shall start timer T3247 with a random value uniformly drawn from the
range between 30 minutes and 60 minutes, if the timer is not running, and shall take the following actions:
6) if the GMM cause value received is #3, #6, or #8, and
a) if the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter
i) set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to
subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key
sequence number;
increment the counter for "SIM/USIM considered invalid for GPRS services" events;
if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the
counter has a value less than an MS implementation-specific maximum value, set the update status to U3
ROAMING NOT ALLOWED, delete any TMSI, LAI and ciphering key sequence number. If the MS is
operating in MS operation mode A and an RR connection exists, the MS shall abort the RR connection,
unless an emergency call is ongoing. In Iu mode, the MS shall increment the counter for "SIM/USIM
considered invalid for non-GPRS services" events, if not already incremented over the same RRC
connection. In A/Gb mode, the MS shall increment the counter for "SIM/USIM considered invalid for
non-GPRS services" events;
if a GPRS attach or routing area updating procedure was performed, reset the GPRS attach attempt
counter or the routing area updating attempt counter, respectively;
if S1 mode is supported by the MS, handle the EMM parameters attach attempt counter or tracking area
updating attempt counter, EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and
KSI as specified in 3GPP TS 24.301 [120] for the case when an EPS attach or tracking area update
procedure is rejected with the EMM cause of the same value in a NAS message without integrity
protection;
store the current LAI in the list of "forbidden location areas for roaming" and enter the state GMM-
DEREGISTERED.LIMITED-SERVICE; and
3GPP TS 25.304 [98] or 3GPP TS 36.304 [121]; or
ii) proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4;
increment the counter for "SIM/USIM considered invalid for GPRS services" events; and
if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the
counter has a value less than an MS implementation-specific maximum value:
in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events,
if not already incremented over the same RRC connection
in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services"
events; and
b) else the MS shall proceed as specified in subclause 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4;
7) if the GMM cause value received is #7, and
a) if the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter
i) set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to
subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key
sequence number;
ETSI
Release 18 62 3GPP TS 24.008 V18.4.0 (2023-09)
increment the counter for "SIM/USIM considered invalid for GPRS services" events;
- if a GPRS attach or routing area updating procedure was performed, reset the GPRS attach attempt
counter or the routing area updating attempt counter, respectively;
if S1 mode is supported by the MS, handle the EMM parameters attach attempt counter or tracking area
updating attempt counter, EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and
KSI as specified in 3GPP TS 24.301 [120] for the case when an EPS attach or tracking area update
procedure is rejected with the EMM cause of the same value in a NAS message without integrity
protection;
enter the state GMM-DEREGISTERED.LIMITED-SERVICE;
if the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden
if the current LAI is already included in the list of "forbidden location areas for non-GPRS services"
or the MS is operating in MS operation mode C, store the current LAI in the list of "forbidden location
areas for roaming"; otherwise store the current LAI in the list of "forbidden location areas for GPRS
services"; and
attempt to select a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or
3GPP TS 36.304 [121], different from the cell where the ATTACH REJECT or ROUTING AREA
UPDATING REJECT was received; or
NOTE 3: The cell on which the reject was received could still be a suitable cell.
ii) proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4; and
increment the counter for "SIM/USIM considered invalid for GPRS services" events; and
b) else the MS shall proceed as specified in subclause 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4;
8) if the GMM cause value received is #12, #13 or #15, the MS shall additionally proceed as specified in
subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4;
9) if the GMM cause value received is #11 or #14 and the MS is in its HPLMN or in a PLMN that is within the
EHPLMN list (if the EHPLMN list is present):
- the MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according
to subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key
sequence number. The MS shall delete the list of equivalent PLMNs. Additionally, if a GPRS attach or the
routing area updating procedure was performed, the MS shall reset the GPRS attach attempt counter or the
routing area updating attempt counter respectively;
- for GMM cause value #11, the MS shall store the current LAI in the list of "forbidden location areas for
roaming", and enter the state GMM-DEREGISTERED.LIMITED-SERVICE;
- for GMM cause value #14, the MS shall enter the state GMM-DEREGISTERED.LIMITED-SERVICE. If
the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location
areas for GPRS services", proceed as follows:
if the current LAI is already included in the list of "forbidden location areas for non-GPRS services" or
the MS is operating in MS operation mode C, store the current LAI in the list of "forbidden location areas
for roaming"; otherwise store the current LAI in the list of "forbidden location areas for GPRS services";
- if S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status,
GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter or tracking area updating attempt
counter as specified in 3GPP TS 24.301 [120] for the case when the procedure is rejected with the EMM
cause with the same value without integrity protection; and
- the MS shall search for a suitable cell in another location area or in another tracking area according to
3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121].
ETSI
Release 18 63 3GPP TS 24.008 V18.4.0 (2023-09)
10)if the GMM cause value received is #11 and the MS is not in its HPLMN or in a PLMN that is within the
EHPLMN list (if the EHPLMN list is present), the MS shall additionally proceed as specified in subclauses
4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4:
- Furthermore, if the MS maintains a list of PLMN-specific attempt counters and the PLMN-specific attempt
counter for the PLMN sending the reject message has a value less than an MS implementation-specific
maximum value, the MS shall increment the PLMN-specific attempt counter for the PLMN.
11)if the GMM cause value received is #14 and the MS is not in its HPLMN or in a PLMN that is within the
EHPLMN list (if the EHPLMN list is present), the MS shall additionally proceed as specified in
subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, and 4.7.5.2.4:
- Furthermore, if the MS maintains a list of PLMN-specific PS-attempt counters and the PLMN-specific PS-
attempt counter for the PLMN sending the reject message has a value less than an MS implementation-
specific maximum value, the MS shall increment the PLMN-specific PS-attempt counter for the PLMN.
- If the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden
if the current LAI is already included in the list of "forbidden location areas for non-GPRS services" or
the MS is operating in MS operation mode C, store the current LAI in the list of "forbidden location areas
for roaming"; otherwise store the current LAI in the list of "forbidden location areas for GPRS services"
and the MS shall enter the state GMM-DEREGISTERED.LIMITED-SERVICE.
If the MS receives a SERVICE REJECT message without integrity protection with GMM cause value #3, #6, #7, #8,
#11, #12, #13 or #15 before the network has activated the integrity protection for the PS domain, the MS shall start
timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is
not running, and proceed as specified under items 6, 7, 8, 9 and 10 above.
Upon expiry of timer T3247, the MS shall:
- erase the list of "forbidden location areas for regional provision of service" and the list of "forbidden location
areas for roaming";
- set the SIM/USIM to valid for non-GPRS services, if
- the MS does not maintain a counter for "SIM/USIM considered invalid for non-GPRS services" events; or
- the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and this
counter has a value less than an MS implementation-specific maximum value.
- set the SIM/USIM to valid for GPRS services, if
- the MS does not maintain a counter for "SIM/USIM considered invalid for GPRS services" events; or
- the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and this counter
has a value less than an MS implementation-specific maximum value.
- erase the list of "forbidden location areas for non-GPRS services" and the list of "forbidden location areas for
GPRS services", if the MS maintains these lists;
- if the MS maintains a list of PLMN-specific attempt counters, for each PLMN-specific attempt counter that has a
value greater than zero and less than an MS implementation-specific maximum value, remove the respective
PLMN from the extension of the "forbidden PLMNs" list;
- if the MS maintains a list of PLMN-specific PS-attempt counters, for each PLMN-specific PS-attempt counter
that has a value greater than zero and less than an MS implementation-specific maximum value, remove the
respective PLMN from the "forbidden PLMNs for GPRS service" list. If the resulting "forbidden PLMNs for
GPRS service" list is empty and the MS is supporting S1 mode, the MS re-enables the E-UTRA capability as
specified in 3GPP TS 24.301 [120] for the case when timer T3247 expires;
- if the MS is supporting S1 mode, perform the actions as specified in 3GPP TS 24.301 [120] for the case when
timer T3247 expires;
- if the MS is supporting N1 mode, perform the actions as specified in 3GPP TS 24.501 [167] for the case when
timer T3247 expires; and
ETSI
Release 18 64 3GPP TS 24.008 V18.4.0 (2023-09)
- initiate a location updating procedure, GPRS attach procedure or routing area updating procedure, if still needed,
dependent on MM state and update status, and GMM state and GPRS update status, or perform a PLMN
selection according to 3GPP TS 23.122 [14].
If the MS maintains a list of PLMN-specific attempt counters and PLMN-specific PS-attempt counters, when the MS is
switched off, the MS shall, for each PLMN-specific attempt counter that has a value greater than zero and less than the
MS implementation-specific maximum value, remove the respective PLMN from the forbidden PLMN list. When the
SIM/USIM is removed, the MS should perform this action.
NOTE 4: If the respective PLMN was stored in the extension of the "forbidden PLMNs" list, then according to
3GPP TS 23.122 [14] the MS will delete the contents of this extension when the MS is switched off or the
SIM/USIM is removed.
4.1.1.7 Handling of NAS level mobility management congestion control

The network may detect GMM or MM signalling congestion and perform NAS level mobility management congestion
control. PS domain NAS level mobility management congestion control consists of general NAS level mobility
management congestion control and subscribed APN based congestion control. CS domain NAS level mobility
management congestion control consists of general NAS level mobility management congestion control.
Under NAS level mobility management congestion control the network may reject mobility management signalling
requests from MSs as specified in 3GPP TS 23.060 [74]. The network should not reject requests for emergency bearer
services.
When subscribed APN based congestion control is active for a particular APN, the network may reject attach request
from MSs with subscription to this APN.
In mobility management the network may detect NAS signalling congestion. The network may start or stop performing
the subscribed APN based congestion control based on mobility management level criteria such as:
- rate of mobility management NAS messages from a group of MSs with a subscription to a particular APN
exceeds or falls below certain thresholds; or
- setting in network management.
When the NAS level mobility management congestion control is active, the network may include a value for the
mobility management back-off timer T3246 or T3346 in the reject messages. The MS starts the mobility management
back-off timer with the value received in the mobility management reject messages. To avoid that large numbers of
MSs simultaneously initiate deferred requests, the network should select the value for the mobility management back-
off timer for the rejected MSs so that timeouts are not synchronised.
For subscribed APN based congestion control the value of timer T3346 for a particular APN may be APN dependent.
If the timer T3346 is running when the MS enters state GMM-DEREGISTERED, the MS remains switched on, and the
SIM/USIM in the MS remains the same, then timer T3346 is kept running until it expires or it is stopped.
If the MS is switched off when the timer T3246 or T3346 is running, the MS shall behave as follows for each running
timer when the MS is switched on and the SIM/USIM in the MS remains the same:
- let t1 be the time remaining until timeout at switch off and let t be the time elapsed between switch off and
t, then the timer need not be restarted. If the MS is not capable of determining t, then the MS shall restart the
timer with the value t1; and
- if prior to switch off, timer T3346 was started due to a NAS request message (ATTACH REQUEST, ROUTING
AREA UPDATE REQUEST or SERVICE REQUEST) which contained the low priority indicator set to "MS is
configured for NAS signalling low priority", then if timer T3346 is restarted at switch on, the MS configured for
low priority shall handle mobility management requests as indicated in subclauses 4.7.3.1.5, 4.7.5.1.5
and 4.7.13.5.
If the MS enters a new PLMN while timer T3246 is running, and the new PLMN is not equivalent to the PLMN where
the MS started timer T3246, the MS shall stop timer T3246 when initiating mobility management procedures in the new
PLMN.
ETSI
Release 18 65 3GPP TS 24.008 V18.4.0 (2023-09)
If the MS enters a new PLMN while timer T3346 is running, and the new PLMN is not equivalent to the PLMN where
the MS started timer T3346, the MS shall stop timer T3346 when initiating mobility management procedures in the new
PLMN.
At an inter-system change from S1 mode to A/Gb mode or from Iu mode to A/Gb mode within the same RA, if the
timer T3346 is running and the TIN indicates "RAT-related TMSI", the MS shall set the GPRS update status to GU2
NOT UPDATED and enter state GMM-REGISTERED.ATTEMPTING-TO-UPDATE.
After change in RAI, if the timer T3346 is running and GPRS update status is GU1 UPDATED then MS shall set the
GPRS update status to GU2 NOT UPDATED and enter state GMM-REGISTERED.ATTEMPTING-TO-UPDATE.
After change in LAI, if the timer T3246 is running and MM update status is U1 UPDATED then MS shall set the MM
update status to U2 NOT UPDATED and enter state MM IDLE, ATTEMPTING TO UPDATE.
4.1.1.8 Handling of security related parameters at switch on and switch off

At switch on, an ME supporting UTRAN Iu mode shall proceed as follows:
- if a USIM is inserted, the ME shall read the STARTCS and STARTPS value from the USIM. If STARTCS and/or
STARTPS read from the USIM are greater than or equal to the maximum value of STARTCS and STARTPS
provided on the USIM (see 3GPP TS 31.102 [112]) or the CKSN or GPRS CKSN stored on the USIM indicates
"no key available", the ME shall set the START value in the volatile memory of the ME for the corresponding
core network domain(s) to zero. In addition if the read STARTCS and/or STARTPS are greater than or equal to the
maximum value, the ME shall delete the corresponding CKSN or GPRS CKSN from the ME and the USIM. The
ME shall set the STARTCS and STARTPS value on the USIM to the maximum value of STARTCS and STARTPS
provided on the USIM (see 3GPP TS 31.102 [112]); and
- if a SIM is inserted, the ME shall read the STARTCS and STARTPS value from the non-volatile memory. If
STARTCS and/or STARTPS read from the non-volatile memory are greater than or equal to the default value
specified in 3GPP TS 33.102 [5a], subclause 6.8.2.4 or the CKSN or GPRS CKSN stored on the SIM indicates
"no key available", the ME shall set the START value in the volatile memory of the ME for the corresponding
core network domain(s) to zero. In addition if the read STARTCS and/or STARTPS are greater than or equal to the
default value, the ME shall delete the corresponding CKSN or GPRS CKSN from the ME. The ME shall set the
STARTCS and STARTPS value in the non-volatile memory to the default value specified in 3GPP TS 33.102 [5a],
subclause 6.8.2.4.
NOTE: The lower layer handles the STARTCS and STARTPS value stored in the volatile memory of the ME as
specified in 3GPP TS 25.331 [23c].
Only at switch off, an ME supporting UTRAN Iu mode shall proceed for each of the two domains, CS and PS, as
follows:
- if since switch on the ME performed an authentication procedure for the respective domain and stored the new
security context on the USIM or SIM, and the new security context was not taken into use, the ME shall set the
START value for this domain on the USIM or, if a SIM is inserted, in the non-volatile memory to zero; and
- otherwise, if a security context for the respective domain is stored on the USIM or SIM, i.e. the CKSN or GPRS
CKSN stored on the USIM or SIM is different from "no key available", the ME shall store the current START
value used by the lower layer for this domain on the USIM or, if a SIM is inserted, in the non-volatile memory.
4.1.1.9 Equivalent PLMNs list

The mobile equipment shall store a list of "equivalent PLMNs". These PLMNs shall be regarded by the MS as
equivalent to each other for PLMN selection and cell selection/re-selection. The same list is used by 5GMM, EMM,
GMM and MM (see 3GPP TS 24.501 [167] and 3GPP TS 24.301 [120]).
The list of equivalent PLMNs is replaced or deleted at the end of each location updating procedure, routing area
updating procedure and GPRS attach procedure. The stored list consists of a list of equivalent PLMNs as downloaded
by the network plus the PLMN code of the registered PLMN that downloaded the list. The stored list shall not be
deleted when the MS is switched off. The stored list shall be deleted if the SIM/USIM is removed or when an MS
attached for emergency bearer services enters the state GMM-DEREGISTERED. The maximum number of possible
entries in the stored list is 16.
ETSI
Release 18 66 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.1.10 Dedicated core network

The network may reject mobility management signalling requests from MSs due to dedicated core network as specified
in 3GPP TS 23.060 [74]. When the network rejects mobility management signalling requests due to dedicated core
network, the mechanism for general NAS level mobility management congestion control as specified in
subclause 4.1.1.7 shall be followed.
4.1.2 MM sublayer states

The description of the states for the MM sublayer is organized as follows. The main states for the MS side, related to
the procedures, are described in subclause 4.1.2.1.1. The MM IDLE state is subdivided in substates for the description
of the behaviour in idle mode (subclause 4.1.2.1.2). This behaviour depends on an update status, described in
subclause 4.1.2.2. The states for the network side are described in subclause 4.1.2.3.
4.1.2.1 MM sublayer states in the mobile station

In this subclause, the possible states for the MM sublayer in the mobile station is described. In figure 4.1 of the present
document, an overview of the MM sublayer protocol is given.
4.1.2.1.1 Main states

0 NULL
The mobile station is inactive (e.g. power down). Important parameters are stored. Only manual action by the
user may transfer the MM sublayer to another state.
3 LOCATION UPDATING INITIATED
A location updating procedure has been started and the MM awaits a response from the network. The timer
T3210 is running.
5 WAIT FOR OUTGOING MM CONNECTION
The MM connection establishment has been started, and the MM awaits a response from the network. The
timer T3230 is running.
6 MM CONNECTION ACTIVE
The MM sublayer has a RR connection to its peer entity on the network side. One or more MM connections
are active.
7 IMSI DETACH INITIATED
The IMSI detach procedure has been started. The timer T3220 is running.
8 PROCESS CM SERVICE PROMPT
The MM sublayer has a RR connection to its peer entity on the network side. The Mobile Station has
received a CM SERVICE PROMPT message but has not yet responded $(CCBS)$.
9 WAIT FOR NETWORK COMMAND
The MM sublayer has a RR connection to its peer entity in the network, but no MM connection is
established. The mobile station is passive, awaiting further commands from the network. The timer T3240
may be running.
10 LOCATION UPDATE REJECTED
A location updating procedure has been rejected and RR connection release is awaited. The timer T3240 is
running.
ETSI
Release 18 67 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 4.1a/3GPP TS 24.008: Overview mobility management protocol/MS Side
ETSI
Release 18 68 3GPP TS 24.008 V18.4.0 (2023-09)
21 22
MM CONNECTION RR Connection WAIT FOR RR
ACTIVE CONNECTION
( Group TX MODE ) ( Group TX MODE )
established
Uplink
Uplink Uplink
release
access access
rejected requested
RR gone to RR gone to
Group Transmit
Dedicated
mode 19
mode
MM-IDLE
RR connection RR connection
released, gone released, gone
6 to group receive to Group Receive
MM CONNECTION Mode mode
ACTIVE
5
WAIT FOR
OUTGOING
MM CONNECTION
Send CM service
request
or
Notification Response
Additions to Figure 4.1a/3GPP TS 24.008
13. WAIT FOR RR CONNECTION (LOCATION UPDATING)
The MM sublayer has requested RR connection establishment for starting the location updating procedure.
14. WAIT FOR RR CONNECTION (MM CONNECTION)
The MM sublayer has requested RR connection establishment for dedicated mode for starting the MM
connection establishment.
15. WAIT FOR RR CONNECTION (IMSI DETACH)
The MM sublayer has requested RR connection establishment for starting the IMSI detach procedure.
ETSI
Release 18 69 3GPP TS 24.008 V18.4.0 (2023-09)
17. WAIT FOR REESTABLISH
A lower layer failure has occurred and re-establishment may be performed from the disturbed CM layer
entities.
18. WAIT FOR RR ACTIVE
The MM sublayer has requested activation of the RR sublayer.
19. MM IDLE
There is no MM procedure running and no RR connection exists except that a local MM context may exist
when the RR sublayer is in Group Receive mode. This is a compound state, and the actual behaviour of the
mobile station to Connection Management requests is determined by the actual substate as described
hereafter.
20. WAIT FOR ADDITIONAL OUTGOING MM CONNECTION.
The MM connection establishment for an additional MM connection has been started, and the MM awaits
response from the network.
21. MM CONNECTION ACTIVE (GROUP TRANSMIT MODE)
(Only applicable for mobile stations supporting VGCS talking:) The MM sublayer has a RR connection on
the VGCS channel to its peer entity on the network side. Only one MM connection is active.
22. WAIT FOR RR CONNECTION (GROUP TRANSMIT MODE)
(Only applicable for mobile stations supporting VGCS talking:) The MM sublayer has requested to perform
an uplink access on the VGCS channel.
23. LOCATION UPDATING PENDING
(Only applicable for GPRS MS operation modes A and B; not shown in figure 4.1a) A location updating has
been started using the combined GPRS attach procedure or the combined GPRS routing area updating
procedure.
24. IMSI DETACH PENDING
(Only applicable for GPRS MS operation modes A and B; not shown in figure 4.1a) An IMSI detach for non-
GPRS services has been started using the combined GPRS detach procedure at not switching off.
25. RR CONNECTION RELEASE NOT ALLOWED
(Only applicable for mobile stations supporting RRLP procedures (see 3GPP TS 44.031 [23b]) or LCS
procedures over RRC (see 3GPP TS 25.331 [23c])). All MM connections are released by their CM entities,
but the RR connection is maintained by the network due to an ongoing RRLP procedure or LCS procedure
over RRC.
4.1.2.1.2 Substates of the MM IDLE state

For the description of the behaviour of the MS the MM IDLE state is subdivided in several substates, also called the
service states. The service state pertains to the whole MS (ME alone if no SIM/USIM is inserted, or ME plus
SIM/USIM). The service state depends on the update status (see subclause 4.1.2.2) and on the selected cell.
19.1 NORMAL SERVICE
Valid subscriber data are available, update status is U1, a cell is selected that belongs to the LA where the
subscriber is registered.
In this state, all requests from the CM layers are treated normally.
ETSI
Release 18 70 3GPP TS 24.008 V18.4.0 (2023-09)
19.2 ATTEMPTING TO UPDATE
Valid subscriber data are available, update status is U2 and a cell is selected. Requests from upper layers are
accepted. Emergency call requests are treated normally, otherwise the request triggers first a location
updating attempt in the selected cell, and then triggers the needed procedure only in case of successful
location updating, otherwise the request is rejected.
19.3 LIMITED SERVICE
Valid subscriber data are available, update status is U3, and a cell is selected, which is known not to be able
to provide normal service. Only emergency services are offered.
19.4 NO IMSI
No valid subscriber data (no SIM/USIM, or the SIM/USIM is not considered valid by the ME), and a cell is
selected. Only emergency services are offered.
19.5 NO CELL AVAILABLE
No cell can be selected. This state is entered after a first intensive search failed (state 19.7). Cells are
searched at a low rhythm.
This state is also entered when S1 mode is activated in the MS and current cell is an E-UTRAN cell. No services,
except those provided by CS fallback and SMS over SGs, are offered.
19.6 LOCATION UPDATE NEEDED
Valid subscriber data are available, and for some reason a location updating must be done as soon as possible
(for instance update status is U1 but the selected cell is not in the registered LA, or the timer has expired).
This state is usually of no duration, but can last, e.g. due to access class control, (see subclause 4.1.1.2.1).
19.7 PLMN SEARCH
The mobile station is searching for PLMNs, and the conditions for state 19.8 are not met. This state is ended
when either a cell is selected (the new state is 19.1, 19.3 or 19.6), or when it is concluded that no cell is
available for the moment (the new state is 19.5).
19.8 PLMN SEARCH, NORMAL SERVICE
Valid subscriber data are available, update status is U1, a cell is selected which belongs to the LA where the
subscriber is registered, and the mobile station is searching for PLMNs. This state is ended when either a cell
is selected (the new state is 19.1, 19.3 or 19.6), or when it is concluded that no cell is available for the
moment (the new state is 19.5).
19.9 RECEIVING GROUP CALL (NORMAL SERVICE)
Only applicable for mobile stations supporting VGCS listening or VBS listening. Valid subscriber data are
available, update status is U1, a VGCS channel or VBS channel is received in a cell that belongs to the LA
where the subscriber is registered.
In this state, only requests from the GCC or BCC layers are treated.
19.10 RECEIVING GROUP CALL (LIMITED SERVICE)
Only applicable for mobile stations supporting VGCS listening or VBS listening. Valid subscriber data are
available, update status is U3, a VGCS channel or VBS channel is received in a cell which is known not to be
able to provide normal service.
In this state, only requests from the GCC or BCC layers for the reception of VGCS or VBS calls are treated
and group call emergency services are offered.
19.11 eCALL INACTIVE
Valid subscriber data are available, update status is U4, and a cell is selected, which is expected to be able to
provide normal service. Only emergency services and test/reconfiguration calls (see 3GPP TS 22.101 [8]) can
be initiated by the mobile station. This state is applicable only to an eCall only mobile station (as determined
ETSI
Release 18 71 3GPP TS 24.008 V18.4.0 (2023-09)
by information configured in USIM). The state is entered by the mobile station in order to avoid MM activity
and MM signalling in the absence of an emergency call or test/reconfiguration call. The state is ended when
an emergency services or test/reconfiguration calls[8] is initiated by the mobile station, the new state depends
on the result of the procedure when returning to MM-IDLE described in subclause 4.2.3.
4.1.2.2 The update Status

In parallel with the sublayer states described in subclause 4.1.2.1 and which control the MM sublayer protocol, an
update status exists.
The update status pertains to a specific subscriber embodied by a SIM/USIM. This status is defined even when the
subscriber is not activated (SIM/USIM removed or connected to a switched-off ME). It is stored in a non volatile
memory in the SIM/USIM. The update status is changed only as a result of a location updating procedure attempt (with
the exception of an authentication failure and of some cases of CM service rejection). In some cases, the update status is
changed as a result of a GPRS attach, GPRS routing area update, service request network initiated GPRS detach
procedure or due to change in LAI while timer T3246 running.
U1 UPDATED
The last location updating attempt was successful (correct procedure outcome, and the answer was
acceptance from the network). With this status, the SIM/USIM contains also the LAI of the LA where the
subscriber is registered, and possibly valid TMSI, GSM ciphering key, UMTS integrity key, UMTS
ciphering key and ciphering key sequence number. Furthermore, if the ME supports any A5 ciphering
algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME may contain a valid GSM
Kc128. The "Location update status" stored on the SIM/USIM shall be "updated".
U2 NOT UPDATED
The last location updating attempt made failed procedurally (no significant answer was received from the
network, including the cases of failures or congestion inside the network).
For this status, the SIM/USIM can contain a valid LAI of the location area to which the subscriber was
registered, and possibly also a valid TMSI, GSM ciphering key, UMTS integrity key, UMTS ciphering key
and ciphering key sequence number. For compatibility reasons, all these fields shall be set to the "deleted"
value if the LAI is deleted. However the presence of other values shall not be considered an error by the
mobile station. Furthermore, if the ME supports any A5 ciphering algorithm that requires a 128-bit ciphering
key and a USIM is in use, then the ME shall delete the GSM Kc128 stored if the LAI is deleted. The "Location
update status" stored on the SIM/USIM shall be "not updated".
U3 ROAMING NOT ALLOWED
The last location updating attempt run correctly, but the answer from the network was negative (because of
roaming or subscription restrictions).
For this status, the SIM/USIM can contain a valid LAI, TMSI, GSM ciphering key, UMTS integrity key,
UMTS ciphering key or ciphering key sequence number. For compatibility reasons, all these fields shall be
set to the "deleted" value if the LAI is deleted. However the presence of other values shall not be considered
an error by the mobile station. Furthermore, if the ME supports any A5 ciphering algorithm that requires a
128-bit ciphering key and a USIM is in use, then the ME shall delete the GSM Kc128 stored if the LAI is
deleted. The "Location update status" stored on the SIM/USIM shall be "Location Area not allowed".
U4 UPDATING DISABLED
Location updating has been disabled.
For this status, the SIM/USIM does not contain any valid LAI, TMSI, GSM ciphering key, UMTS integrity
key, UMTS ciphering key or ciphering key sequence number. For compatibility reasons, all these fields shall
be set to the "deleted" value at the moment the status is set to eCALL INACTIVE. However the presence of
other values shall not be considered an error by the mobile station. Furthermore, if the ME supports any A5
ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME shall delete the
GSM Kc128 stored at the moment the status is set to eCALL INACTIVE. The "Location update status" stored
on the SIM/USIM shall be "not updated".
ETSI
Release 18 72 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.2.3 MM sublayer states on the network side

1. IDLE
The MM sublayer is not active except possibly when the RR sublayer is in Group Receive mode.
2. WAIT FOR RR CONNECTION
The MM sublayer has received a request for MM connection establishment from the CM layer. A RR
connection to the mobile station is requested from the RR sublayer (i.e. paging is performed).
3. MM CONNECTION ACTIVE
The MM sublayer has a RR connection to a mobile station. One or more MM connections are active, or no
MM connection is active but an RRLP procedure or LCS procedure over RRC is ongoing.
4. IDENTIFICATION INITIATED
The identification procedure has been started by the network. The timer T3270 is running.
5. AUTHENTICATION INITIATED
The authentication procedure has been started by the network. The timer T3260 is running.
6. TMSI REALLOCATION INITIATED
The TMSI reallocation procedure has been started by the network. The timer T3250 is running.
7. SECURITY MODE INITIATED
In Iu mode, the security mode setting procedure has been requested to the RR sublayer. In A/Gb mode, the
cipher mode setting procedure has been requested to the RR sublayer.
8a. WAIT FOR MOBILE ORIGINATED MM CONNECTION
A CM SERVICE REQUEST message is received and processed, and the MM sublayer awaits the "opening
message" of the MM connection.
8b. WAIT FOR NETWORK ORIGINATED MM CONNECTION
A CM SERVICE PROMPT message has been sent by the network and the MM sublayer awaits the "opening
message" of the MM connection $(CCBS)$.
9. WAIT FOR REESTABLISHMENT
The RR connection to a mobile station with one or more active MM connection has been lost. The network
awaits a possible re-establishment request from the mobile station.
10. WAIT OF A GROUP CALL
Only applicable in case for mobile station supporting VGCS talking. The MM sublayer has received a
request for establishing a VGCS from the GCC sublayer. The request for establishing a VGCS channels is
given to the RR sublayer.
11. GROUP CALL ACTIVE
Only applicable in case of mobile station supporting VGCS talking. A VGCS channel is established by the
RR sublayer. An RR connection to the talking mobile station can be established by the RR sublayer on the
VGCS channel. The MM sublayer is active but no sending of MM message between the network and the
mobile station has occurred.
12. MM CONNECTION ACTIVE (GROUP CALL)
Only applicable in case of mobile station supporting VGCS talking. The MM sublayer has a RR connection
to the talking mobile station on the VGCS channel. Only one MM connection is active.
13. WAIT FOR BROADCAST CALL
ETSI
Release 18 73 3GPP TS 24.008 V18.4.0 (2023-09)
Only applicable in case of VBS. The MM sublayer has received a request for a VBS establishment from the
BCC sublayer. The request for establishment of VBS channels is given to the RR sublayer.
14. BROADCAST CALL ACTIVE
Only applicable in case of VBS. A VBS channel is established by the RR sublayer. The MM sublayer is
active but no explicit MM establishment between the Network and the mobile station has occurred.
4.1.3 GPRS mobility management (GMM) sublayer states

In this subclause, the GMM protocol of the MS and the network are described by means of two different state machines.
In subclause 4.1.3.1, the states of the GMM entity in the MS are introduced. The behaviour of the MS depends on a
GPRS update status that is described in subclause 4.1.3.2. The states for the network side are described in
subclause 4.1.3.3.
4.1.3.1 GMM states in the MS

In this subclause, the possible GMM states are described of a GMM entity in the mobile station. subclause 4.1.3.1.1
summarises the main states of a GMM entity, see figure 4.1b of the present document. The substates that have been
defined are described in subclause 4.1.3.1.2 and subclause 4.1.3.1.3.
However, it should be noted that this subclause does not include a description of the detailed behaviour of the MS in the
single states and does not cover abnormal cases. Thus, figure 4.1b of the present document is rather intended to give an
overview of the state transitions than to be a complete state transition diagram. A detailed description of the behaviour
of the MS is given in subclause 4.2. Especially, with respect to the behaviour of the MS in abnormal cases it is referred
to subclause 4.7.
4.1.3.1.1 Main states
4.1.3.1.1.1 GMM-NULL
The GPRS capability is disabled in the MS. No GPRS mobility management function shall be performed in this state.
4.1.3.1.1.2 GMM-DEREGISTERED
The GPRS capability has been enabled in the MS, but no GMM context has been established. In this state, the MS may
establish a GMM context by starting the GPRS attach or combined GPRS attach procedure.
4.1.3.1.1.3 GMM-REGISTERED-INITIATED
A GPRS attach or combined GPRS attach procedure has been started and the MS is awaiting a response from the
network.
4.1.3.1.1.4 GMM-REGISTERED
A GMM context has been established, i.e. the GPRS attach or combined GPRS attach procedure has been successfully
performed. In this state, the MS may activate PDP contexts, MBMS contexts, may send and receive user data and
signalling information and may reply to a page request. Furthermore, cell and routing area updating are performed.
4.1.3.1.1.5 GMM-DEREGISTERED-INITIATED
The MS has requested release of the GMM context by starting the GPRS detach or combined GPRS detach procedure.
This state is only entered if the MS is not being switched off at detach request.
4.1.3.1.1.6 GMM-ROUTING-AREA-UPDATING-INITIATED
A routing area updating procedure has been started and the MS is awaiting a response from the network.
ETSI
Release 18 74 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.3.1.1.7 GMM-SERVICE-REQUEST-INITIATED (Iu mode only)
A service request procedure has been started and the MS is awaiting a response from the network.
4.1.3.1.2 Substates of state GMM-DEREGISTERED

The GMM-DEREGISTERED state is subdivided into several substates as explained below. The substates pertain to the
whole MS (ME alone if no SIM/USIM is inserted, or ME plus SIM/USIM). The selection of the appropriate substate
depends on the GPRS update status, see subclause 4.1.3.2, and on the selected cell.
4.1.3.1.2.1 GMM-DEREGISTERED.NORMAL-SERVICE
Valid subscriber data is available, a suitable cell has been found and the PLMN or LA is not in the forbidden list. In
this state, a request for GPRS attach is performed using the stored temporary mobile subscriber identity for GPRS (P-
TMSI), routing area identification (RAI) and GPRS ciphering key sequence number in case of GU1. If the GPRS
update status is GU2, the IMSI shall be used to attach for GPRS services.
4.1.3.1.2.2 GMM-DEREGISTERED.LIMITED-SERVICE
Valid subscriber data is available, and a cell is selected, which is known not to be able to provide normal service.
4.1.3.1.2.3 GMM-DEREGISTERED.ATTACH-NEEDED
Valid subscriber data is available and for some reason a GPRS attach must be performed as soon as possible. This state
is usually of no duration, but can last, e.g. due to access class control (see subclause 4.1.1.2.1).
4.1.3.1.2.4 GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH
A cell is selected, a previous GPRS attach was rejected or failed due to a missing response from the network. The
execution of further attach procedures depends on the GPRS attach attempt counter. No GMM procedure except GPRS
attach shall be initiated by the MS in this substate.
4.1.3.1.2.5 GMM-DEREGISTERED.NO-IMSI
No valid subscriber data is available (no SIM/USIM, or the SIM/USIM is not considered valid by the ME) and a cell
has been selected.
4.1.3.1.2.6 GMM-DEREGISTERED.NO-CELL-AVAILABLE
No cell can be selected. This substate is entered after a first intensive search failed (substate PLMN SEARCH). Cells
are searched for at a low rhythm. No services are offered.
4.1.3.1.2.7 GMM-DEREGISTERED.PLMN-SEARCH
The mobile station is searching for PLMNs. This substate is left either when a cell has been selected (the new substate
is NORMAL-SERVICE or LIMITED-SERVICE) or when it has been concluded that no cell is available at the moment
(the new substate is NO-CELL-AVAILABLE).
4.1.3.1.2.8 GMM-DEREGISTERED.SUSPENDED (A/Gb mode only)
The MS shall enter this substate when entering dedicated mode and the MS limitations make it unable to communicate
on GPRS channels. The MS shall leave this substate when leaving dedicated mode.
4.1.3.1.3 Substates of state GMM-REGISTERED

The state GMM-REGISTERED is subdivided into several substate as explained below. The substates pertain to the
whole MS (ME alone if no SIM/USIM is inserted, or ME plus SIM/USIM).
4.1.3.1.3.1 GMM-REGISTERED.NORMAL-SERVICE
User data and signalling information may be sent and received.
ETSI
Release 18 75 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.3.1.3.2 GMM-REGISTERED.SUSPENDED (A/Gb mode only)
The MS shall enter this substate when entering dedicated mode and when the MS limitations makes it unable to
communicate on GPRS channels. In this substate, no user data should be sent and no signalling information shall be
sent. The MS shall leave this substate when leaving dedicated mode.
4.1.3.1.3.3 GMM-REGISTERED.UPDATE-NEEDED
The MS has to perform a routing area updating procedure, but its access class is not allowed in the cell due to access
class control (see subclause 4.1.1.2.1). The procedure will be initiated as soon as access is granted (this might be due to
a cell-reselection or due to change of the access classes allowed in the current cell). No GMM procedure except routing
area updating shall be initiated by the MS in this substate. In this substate, no user data and no signalling information
shall be sent.
4.1.3.1.3.4 GMM-REGISTERED.ATTEMPTING-TO-UPDATE
A routing area updating procedure failed due to a missing response from the network. The MS retries the procedure
controlled by timers and a GPRS attempt counter. No GMM procedure except routing area updating shall be initiated by
the MS in this substate. No data shall be sent or received.
4.1.3.1.3.5 GMM-REGISTERED.NO-CELL-AVAILABLE
GPRS coverage has been lost or PSM is active in the MS. If PSM is active, the MS can deactivate PSM at any time by
activating the AS layer when the MS needs to send mobile originated signalling or user data. Otherwise, the MS shall
not initiate any GMM procedures except of cell (and PLMN) reselection.
ETSI
Release 18 76 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 4.1b/3GPP TS 24.008:GMM main states in the MS
4.1.3.1.3.6 GMM-REGISTERED.LIMITED-SERVICE
A cell is selected, which is known not to be able to provide normal service. The MS will remain in this sub-state until a
cell is selected which is able to provide normal service.
4.1.3.1.3.7 GMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM
A combined routing area updating procedure or a combined GPRS attach procedure was successful for GPRS services
only. The MS retries the procedure controlled by timers and a GPRS attempt counter. User data and signalling
information may be sent and received.
4.1.3.1.3.8 GMM-REGISTERED.IMSI-DETACH-INITIATED
The MS performs a combined GPRS detach procedure for non-GPRS services only (detach type "IMSI Detach"). This
state is entered if the MS is attached for GPRS and non-GPRS services in a network that operates in network mode I
and wants to detach for non-GPRS services only. User data and signalling information may be sent and received.
4.1.3.1.3.9 GMM-REGISTERED.PLMN-SEARCH
The mobile station is searching for PLMNs. This substate is left either when a cell has been selected (the new substate
is NORMAL-SERVICE or LIMITED-SERVICE) or when it has been concluded that no cell is available at the moment
(the new substate is NO-CELL-AVAILABLE).
ETSI
Release 18 77 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.3.2 GPRS update status

In addition to the GMM sublayer states described so far, a GPRS update status exists.
The GPRS update status pertains to a specific subscriber embodied by a SIM/USIM. This status is defined even when
the subscriber is not activated (SIM/USIM removed or connected to a switched off ME). It is stored in a non volatile
memory in the SIM/USIM. The GPRS update status is changed only after execution of a GPRS attach, combined GPRS
attach, network initiated GPRS detach, authentication, service request, paging for GPRS services using IMSI, routing
area updating, combined routing area updating procedure or due to change in RAI while timer T3346 running.
GU1: UPDATED
The last GPRS attach or routing area updating attempt was successful (correct procedure outcome, and the
answer was accepted by the network). The SIM/USIM contains the RAI of the routing area (RA) to which the
subscriber was attached, and possibly a valid P-TMSI, GPRS GSM ciphering key, GPRS UMTS ciphering key,
GPRS UMTS integrity key and GPRS ciphering key sequence number. Furthermore, if the ME supports any
GEA ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME may contain a
valid GPRS GSM Kc128. Furthermore, if the ME supports any GIA integrity algorithm that requires a 128-bit
integrity key and a USIM is in use, then the ME may contain a valid GPRS GSM Kint.
GU2: NOT UPDATED
The last GPRS attach or routing area updating attempt failed procedurally, e.g. no response was received from
the network. This includes the cases of failures or congestion inside the network.
In this case, the SIM/USIM can contain the RAI of the routing area (RA) to which the subscriber was attached,
and possibly also a valid P-TMSI, GPRS GSM ciphering key, GPRS UMTS ciphering key, GPRS UMTS
integrity key and GPRS ciphering key sequence number. For compatibility reasons, all these fields shall be set to
the "deleted" value if the RAI is deleted. However, the presence of other values shall not be considered an error
by the MS. Furthermore, if the ME supports any GEA ciphering algorithm that requires a 128-bit ciphering key
and a USIM is in use, then the ME shall delete the GPRS GSM Kc128 stored if the RAI is deleted. Furthermore, if
the ME supports any GIA integrity algorithm that requires a 128-bit integrity key and a USIM is in use, then the
ME shall delete the GPRS GSM Kint stored if the RAI is deleted.
GU3: ROAMING NOT ALLOWED
The last GPRS attach or routing area updating attempt was correctly performed, but the answer from the network
was negative (because of roaming or subscription restrictions).
In this case, the SIM/USIM can contain the RAI of the routing area (RA) to which the subscriber was attached,
and possibly also a valid P-TMSI, GPRS GSM ciphering key, GPRS UMTS ciphering key, GPRS UMTS
integrity key or GPRS ciphering key sequence number. For compatibility reasons, all these fields shall be set to
the value "deleted" if the RAI is deleted. However, the presence of other values shall not be considered an error
by the MS. Furthermore, if the ME supports any GEA ciphering algorithm that requires a 128-bit ciphering key
and a USIM is in use, then the ME shall delete the GPRS GSM Kc128 stored if the RAI is deleted. Furthermore, if
the ME supports any GIA integrity algorithm that requires a 128-bit integrity key and a USIM is in use, then the
ME shall delete the GPRS GSM Kint stored if the RAI is deleted.
If the MS is attached for emergency bearer services, the MS shall not store the GMM parameters described in this
subclause on the SIM/USIM or in non-volatile memory. Instead the MS shall temporarily store these parameters locally
in the ME and the MS shall delete these parameters when the MS is detached.
4.1.3.3 GMM mobility management states on the network side

In this subsubclause, the possible states are described for the GMM on the network side. Subclause 4.1.3.3.1
summarises the main states. The corresponding substates are described in subclause 4.1.3.3.2.
However, it should be noted that this subclause does not include a description of the detailed behaviour of the network
in the single states and does not cover abnormal cases. Thus, figure 4.1c/3GPP TS 24.008 is rather intended to give an
overview of the state transitions than to be a complete state transition diagram. A detailed description of the behaviour
of the MS is given in subclause 4.2. Especially, with respect to the behaviour of the MS in abnormal cases it is referred
to subclause 4.7.
ETSI
Release 18 78 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.3.3.1 Main States
4.1.3.3.1.1 GMM-DEREGISTERED
The network has no GMM context or the GMM context is marked as detached, the MS is detached. In this state, the
network may answer to a GPRS attach or combined GPRS attach procedure initiated by the MS.
4.1.3.3.1.2 GMM-COMMON-PROCEDURE-INITIATED
A common GMM procedure, as defined in subclause 4.1.1, has been started. The network is awaiting the answer from
the MS.
4.1.3.3.1.3 GMM-REGISTERED
The GMM context has been established and the GPRS attach procedure has been successfully performed.
4.1.3.3.1.4 GMM-DEREGISTERED-INITIATED
The network has started a GPRS detach procedure and is awaiting the answer from the MS.
GMM-
DE-REGISTERED-
INITIATED
- DETACH accepted - Network initiated

- Lower layer failure DETACH requested
- MS initiated
DETACH requested
RAU rejected
implicit DETACH
GMM- GMM-
DE-REGISTERED REGISTERED
- ATTACH procedure
successful
- COMMON procedure - COMMON procedure

requested requested
- COMMON procedure - COMMON procedure

failed successful
- Lower layer failure - ATTACH procedure
successful
GMM-COMMON-
PROCEDURE-INITIATED
Figure 4.1c/3GPP TS 24.008: GMM main states on the network side
4.1.3.3.2 Substates of state GMM-REGISTERED

The state GMM-REGISTERED is subdivided into two substates as explained below.
4.1.3.3.2.1 GMM-REGISTERED.NORMAL-SERVICE
User data and signalling information may be sent and received.
ETSI
Release 18 79 3GPP TS 24.008 V18.4.0 (2023-09)
4.1.3.3.2.2 GMM-REGISTERED.SUSPENDED (A/Gb mode only)
In this substate, the lower layers shall be prevented of sending user data or signalling information.
4.2 Behaviour of the MS in MM Idle state, GMM-

DEREGISTERED state and GMM-REGISTERED state
In this subclause, the detailed behaviour of the MS in the main states MM IDLE, GMM-DEREGISTERED and GMM-
REGISTERED is described. Subclauses 4.2.1 to 4.2.3 refer to the state MM IDLE, whereas subclauses 4.2.4 and 4.2.5
refer to the states GMM-DEREGISTERED and GMM-REGISTERED, respectively.
The MM IDLE state is entered when none of the MM procedures are running and no RR connection exists. It is left
when one of the MM procedures are triggered or a RR connection is established.
The specific behaviour in the MM IDLE state depends on the service state of the mobile station as described in
subclause 4.1.2.1.2. The service state depends in particular on the update status which is defined in subclause 4.1.2.2.
How an appropriate service state is chosen after power on is described in subclause 4.2.1, and the specific behaviour of
the mobile station in MM IDLE state is described in subclause 4.2.2. The service state chosen when the MM IDLE state
is returned to from any state except NULL state is described in subclause 4.2.3.
It should be noted that transitions between the various MM idle states are caused by (e.g.):
- results of procedures on RR connected mode (see subclause 4.2.3);
- insertion or removal of the SIM/USIM;
- cell selection/reselection (see also 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98]);
- PLMN search;
- loss of coverage.
How various MM procedures affects the service state and the update status is described in the detailed descriptions of
the procedures in subclauses 4.3 to 4.5.
4.2.1 Primary Service State selection
4.2.1.1 Selection of the Service State after Power On.

For an eCall only mobile station (as determined by information configured in the USIM), Timers T3242 and T3243 are
considered to have expired at power-on. When mobility management is activated after power-on, the service state is
19.7 PLMN SEARCH. The detailed processing in this state is described in detail in 3GPP TS 23.122 [14],
3GPP TS 43.022 [82], 3GPP TS 45.008 [34] and 3GPP TS 25.304 [98], where procedures for power on and selection of
PLMN is described in detail. If the "Location update status" stored on the SIM/USIM is different from "updated", then
the mobile shall act as if the "Location update status" stored on the SIM/USIM is "not updated".
The service state when the PLMN SEARCH state is left depends on the outcome of the search and on the presence of
the SIM/USIM:
- if no cell has been found, the state is NO CELL AVAILABLE, until a cell is found;
- if no SIM/USIM is present the state is NO IMSI;
- for an eCall only mobile station (as determined by information configured in USIM), the state is eCALL
INACTIVE.
- if the mobile station has been continuously activated since loosing coverage and then returns to coverage, and if
the selected cell is in the location area where the mobile station is registered and the timer T3212 has not
expired, then the state is NORMAL SERVICE;
- if the selected cell is in the location area where the mobile station is registered and IMSI ATTACH is not
required and timer T3212 has not expired, then the state is NORMAL SERVICE;
ETSI
Release 18 80 3GPP TS 24.008 V18.4.0 (2023-09)
- if the mobile station is in automatic network selection mode and the selected cell is in a forbidden PLMN, is in a
forbidden LA, or is a CSG cell whose CSG ID and associated PLMN identity are not in the Allowed CSG list or
in the Operator CSG list stored in the MS, then the mobile station enters the LIMITED SERVICE state;
- if the mobile station is in manual network selection mode and no cell of the selected PLMN has been found, or
the cell that is found in the selected PLMN is a CSG cell whose CSG ID and associated PLMN identity are not
in the Allowed CSG list or in the Operator CSG list stored in the MS, then the mobile station enters the
LIMITED SERVICE state;
- otherwise, the mobile station enters the LOCATION UPDATE NEEDED state.
4.2.1.2 Other Cases

The state PLMN SEARCH is also entered in the following cases:
- in state NO IMSI, a SIM/USIM is inserted;
- in any state except NO IMSI, NO CELL AVAILABLE, NORMAL SERVICE and RECEIVING GROUP CALL
(NORMAL SERVICE) after the user has asked for a PLMN selection;
- in any state except NO IMSI and NO CELL AVAILABLE, coverage is lost;
- roaming is denied;
- optionally, when the mobile station is in the ATTEMPTING TO UPDATE state and is in Automatic Network
Selection mode and location update attempt counter is greater than or equal to 4.
The service state when the PLMN SEARCH is left depends on the outcome of the search and on the presence of the
SIM/USIM as specified in subclause 4.2.1.1.
4.2.2 Detailed Description of the MS behaviour in MM IDLE State.

In the MM IDLE state the mobile station shall behave according to the service state. In the following subclauses the
behaviour is described for the non transient service states. It should be noted that after procedures in RR connected
mode, e.g. location updating procedures, subclause 4.2.3 applies which specifies the selection of the MM idle state.
Furthermore when in sub-state NORMAL SERVICE, if a PLMN selection is requested, the MS enters sub-state
SEARCH FOR PLMN, NORMAL SERVICE.
4.2.2.1 Service State, NORMAL SERVICE

When in state MM IDLE and service state NORMAL SERVICE, the mobile station shall:
- provided that T3246 is not running, perform normal location updating when a new location area is entered;
- perform location updating procedure at expiry of timer T3211 or T3213;
- perform periodic updating at expiration of timer T3212;
- perform IMSI detach;
- provided that T3246 is not running, support requests from the CM layer;
- support request for emergency calls;
- respond to paging; and
- for an eCall only mobile station (as determined by information configured in USIM), perform the eCall inactivity
procedure at expiry of timer T3242 or timer T3243.
In addition, mobile stations supporting VGCS listening or VBS listening shall:
- indicate notifications to the GCC or BCC sublayer;
- respond to notification if the GCC or BCC sublayer requests the reception of a voice group or broadcast call for
which no channel description has been received in the notification by the RR sublayer;
ETSI
Release 18 81 3GPP TS 24.008 V18.4.0 (2023-09)
- request the RR sublayer to receive a voice group or broadcast call if the GCC or BCC sublayer requests the
reception of a voice group or broadcast call for which a channel description has been received in the notification
by the RR sublayer and then go to the service state RECEIVING GROUP CALL (NORMAL SERVICE).
4.2.2.2 Service State, ATTEMPTING TO UPDATE

When in state MM IDLE and service state ATTEMPTING TO UPDATE the mobile station shall:
- perform location updating procedure at expiry of timer T3211, T3213 or T3246;
- perform normal location updating when entering a new PLMN, if timer T3246 is running and the new PLMN is
not equivalent to the PLMN where the MS started timer T3246;
- perform normal location updating when the location area identification of the serving cell changes, if timer
T3246 is not running;
- if entry into this state was caused by c) or d) or f) (with cause different from "abnormal release, unspecified") or
g) (with cause "retry upon entry into a new cell") of subclause 4.4.4.9, then location updating shall be performed
when a new cell is entered;
- if entry into this state was caused by e) or f) (with cause "abnormal release, unspecified"), g) (with cause
different from "retry upon entry into a new cell"), i) or j) of subclause 4.4.4.9, then location updating shall not be
performed because a new cell is entered;
- perform normal location updating at expiry of timer T3212;
- not perform IMSI detach unless timer T3246 is running and the location area of the current cell is same as the
stored location area;
- support request for emergency calls;
- use other request from CM layer as triggering of normal location updating procedure (if the location updating
procedure is successful, then the request for MM connection is accepted, see subclause 4.5.1), if timer T3246 is
not running;
- respond to paging, if the location area of the current cell is same as the stored location area;
- respond to paging (with IMSI) ; and
- indicate notifications to the GCC or BCC sublayer for which a channel description has been received in the
notification by the RR sublayer;
- reject requests of the GCC or BCC sublayer to respond to notifications for which no channel description has
been received in the notification by the RR sublayer;
by the RR sublayer and then go to the service state RECEIVING GROUP CALL (LIMITED SERVICE).
4.2.2.3 Service State, LIMITED SERVICE

When in state MM IDLE and service state LIMITED SERVICE the mobile station shall:
- not perform periodic updating;
- not perform IMSI detach;
- reject any requests from CM entities for MM connections except for emergency calls;
ETSI
Release 18 82 3GPP TS 24.008 V18.4.0 (2023-09)
- perform normal location updating when a cell is entered which may provide normal service (e.g. location area
not in one of the forbidden LAI lists.); and
When in state MM IDLE and service state LIMITED SERVICE the mobile station may:
- respond to paging (with IMSI);
4.2.2.4 Service State, NO IMSI

When in state MM IDLE and service state NO IMSI the mobile station shall (see subclause 3.2, 3GPP TS 43.022 [82]
and 3GPP TS 45.008 [34]):
- not start any normal location updating attempt;
- not perform IMSI detach if powered down;
- reject any request from CM entities for MM connections except for emergency calls;
- not respond to paging;
- only perform default cell selection.
- not indicate notifications to the GCC or BCC layer.
4.2.2.5 Service State, SEARCH FOR PLMN, NORMAL SERVICE

When in state MM IDLE and service state SEARCH FOR PLMN, NORMAL SERVICE the mobile station shall:
- if timer T3211 or T3213 expires in this state perform a location updating procedure at the latest if and when back
to NORMAL SERVICE state and if the cell is not changed;
- if timer T3212 expires in this state perform a periodic location updating procedure at the latest if and when back
to NORMAL SERVICE state;
- support requests from the CM layer;
- listen as far as possible to paging, and respond; and
procedure at expiry of timer T3242 or T3243.
- listen as far as possible to notifications and indicate notifications to the GCC or BCC layer;
ETSI
Release 18 83 3GPP TS 24.008 V18.4.0 (2023-09)
by the RR sublayer.
4.2.2.6 Service State, SEARCH FOR PLMN

When in state MM IDLE and service state SEARCH FOR PLMN the mobile station shall:
- not start any normal location updating attempt;
- not perform IMSI detach if powered down;
- reject any request from CM entities for MM connections except emergency calls;
- not respond to paging.
4.2.2.7 Service State, RECEIVING GROUP CALL (NORMAL SERVICE)

Only applicable for mobile stations supporting VGCS listening or VBS listening:
When in state MM IDLE and service state RECEIVING GROUP CALL (NORMAL SERVICE), the mobile station
shall:
- perform normal location updating when a new location area is entered;
- perform location updating procedure at expiry of timer T3211 or T3213;
- perform periodic updating at expiration of timer T3212;
- support requests from the GCC or BCC layers;
- indicate notifications or paging information to the GCC or BCC layer;
- request the RR sublayer to receive another voice group or broadcast call if the GCC or BCC sublayer requests
the reception of a voice group or broadcast call for which a channel description has been received in the
notification by the RR sublayer.
4.2.2.8 Service State, RECEIVING GROUP CALL (LIMITED SERVICE)

Only applicable for mobile stations supporting VGCS listening or VBS listening:
When in state MM IDLE and service state RECEIVING GROUP CALL (LIMITED SERVICE), the mobile station
shall:
- reject any requests from CM entities for MM connections except for emergency calls;
- perform normal location updating when a cell is entered which may provide normal service (e.g. location area
not in one of the forbidden LAI lists.);
- it may respond to paging (with IMSI);
ETSI
Release 18 84 3GPP TS 24.008 V18.4.0 (2023-09)
4.2.2.9 Service State, eCALL INACTIVE

When in state MM IDLE and service state eCALL INACTIVE, the mobile station shall:
- reject any requests from CM entities for MM connections except for emergency calls and calls to a non-
emergency MSISDN for test and terminal reconfiguration services;
- not perform normal location updating; and
- not respond to paging.
4.2.3 Service state when back to state MM IDLE from another state
When returning to MM IDLE, e.g., after a location updating procedure, the mobile station selects the cell as specified in
3GPP TS 43.022 [82] and 3GPP TS 25.304 [98]. With one exception, this is a normal cell selection.
An eCall only mobile station (as determined by information configured in USIM), shall start timer T3242 if the return
to MM IDLE state is the result of an emergency services call and shall start timer T3243 if the return to MM IDLE state
is the result of a call to a non-emergency MSISDN for test and terminal reconfiguration services, as described in
subclause 4.4.7.
If this return to idle state is not subsequent to a location updating procedure terminated with reception of cause
"Roaming not allowed in this location area", the service state depends on the result of the cell selection procedure, on
the update status of the mobile station, on the location data stored in the mobile station and on the presence of the
SIM/USIM:
- if no cell has been found, the state is NO CELL AVAILABLE, until a cell is found;
- if no SIM/USIM is present, or if the inserted SIM/USIM is considered invalid by the MS, the state is NO IMSI;
- for an eCall only mobile station (as determined by information configured in USIM), if timer T3242 or timer
T3243 has expired and service state PLMN SEARCH is not required, the state is eCALL INACTIVE and the
eCall inactivity procedure is performed as described in subclause 4.4.7;
- if the selected cell is in the location area where the MS is registered, then the state is NORMAL SERVICE; it
shall be noted that this also includes an abnormal case described in subclause 4.4.4.9;
- (Only applicable for mobile stations supporting VGCS listening or VBS listening.) if the mobile stations was in
the service state RECEIVING GROUP CALL (NORMAL SERVICE) or RECEIVING GROUP CALL
(LIMITED SERVICE) before the location updating procedure and the selected cell is in the location area where
the mobile station is registered, then the state is RECEIVING GROUP CALL (NORMAL SERVICE);
- if the selected cell is in a location area where the mobile station is not registered but in which the MS is allowed
to attempt a location update, then the state is LOCATION UPDATE NEEDED;
- if the selected cell is in a location area where the mobile station is not allowed to attempt a location update, then
the state is LIMITED SERVICE;
- if the selected cell is a CSG cell whose CSG ID and associated PLMN identity are not in the Allowed CSG list
or in the Operator CSG list stored in the MS, then the state is LIMITED SERVICE;
ETSI
Release 18 85 3GPP TS 24.008 V18.4.0 (2023-09)
- (Only applicable for MSs supporting VGCS listening or VBS listening.) if the MSs was in the service state
RECEIVING GROUP CALL (NORMAL SERVICE) or RECEIVING GROUP CALL (LIMITED SERVICE)
before the location updating procedure and the selected cell is in the location area where the MS is not allowed
to attempt a location update, then the state is RECEIVING GROUP CALL (LIMITED SERVICE);
- after some abnormal cases occurring during an unsuccessful location updating procedure, as described in
subclause 4.4.4.9, the state is ATTEMPTING TO UPDATE.
In case of a return from a location updating procedure to which was answered "Roaming not allowed in this location
area", the service state PLMN SEARCH is entered as specified in subclause 4.2.1.2.
4.2.4 Behaviour in state GMM-DEREGISTERED

The state GMM-DEREGISTERED is entered when:
- the MS is switched on;
- the GPRS capability has been enabled in the MS;
- a GPRS detach or combined GPRS detach procedure has been performed;
- a GMM procedure has failed (except routing area updating, see subclause 4.7.5); or
- the MS attached for emergency bearer services is in PMM-IDLE mode and its periodic routing area update timer
expires (see subclause 4.7.2.2).
The selection of the appropriate substate of GMM-DEREGISTERED after switching on is described in

subclause 4.2.4.1. The specific behaviour of the MS in state GMM-DEREGISTERED is described in subclause 4.2.4.2.
The substate chosen when the GMM-DEREGISTERED state is returned to from another state except state GMM-
NULL is described in subclause 4.2.4.3.
It should be noted that transitions between the various substates of GMM-DEREGISTERED are caused by (e.g.):
- insertion or removal of the SIM/USIM;
- PLMN search;
- loss/regain of coverage; or
- change of RA.
How various GMM procedures affect the GMM-DEREGISTERED substates and the GPRS update status is described
in the detailed description of the GMM procedures in subclause 4.7.
4.2.4.1 Primary substate selection
4.2.4.1.1 Selection of the substate after power on or enabling the MS's GPRS capability
When the MS is switched on, the substate shall be PLMN-SEARCH in case the SIM/USIM is inserted and valid. See
3GPP TS 23.122 [14] and 3GPP TS 45.008 [34] for further details.
When the GPRS capability in an activated MS has been enabled, the selection of the GMM-DEREGISTERED substate
depends on the MM state and the GPRS update status.
The substate chosen after PLMN-SEARCH, in case of power on or after enabling of the GPRS capability is:
- if the cell is not supporting GPRS, the substate shall be NO-CELL-AVAILABLE;
- if no SIM/USIM is present the substate shall be NO-IMSI;
- if a suitable cell supporting GPRS has been found and the PLMN or LA is not in the forbidden list, then the
substate shall be NORMAL-SERVICE;
ETSI
Release 18 86 3GPP TS 24.008 V18.4.0 (2023-09)
- if the selected cell supporting GPRS is in a forbidden PLMN, is in a forbidden LA, or is a CSG cell with a CSG
ID and associated PLMN identity that are not in Allowed CSG list or in the Operator CSG list stored in the MS ,
then the MS shall enter the substate LIMITED-SERVICE;
- if the MS is in manual network selection mode and no cell supporting GPRS of the selected PLMN has been
found, the MS shall enter the substate NO-CELL-AVAILABLE.
4.2.4.1.2 Other Cases

When the MM state is IDLE, the GMM substate PLMN-SEARCH shall also be entered in the following cases:
- when a SIM/USIM is inserted in substate NO-IMSI;
- when the user has asked for a PLMN selection in any substate except NO IMSI and NO CELL AVAILABLE ;
- when coverage is lost in any substate except NO IMSI and NO CELL AVAILABLE ;
- Roaming is denied;
- optionally, when the MS is in automatic network selection mode and the maximum allowed number of
consecutive unsuccessful attach attempts controlled by the GPRS attach attempt counter (subclause 4.7.3) have
been performed.
4.2.4.2 Detailed description of the MS behaviour in state GMM-DEREGISTERED

In state GMM-DEREGISTERED, the MS shall behave according to the substate. In the following subclauses, the
behaviour is described for the non transient substates.
4.2.4.2.1 Substate, NORMAL-SERVICE

The MS:
- shall initiate GPRS attach or combined GPRS attach procedure if timer T3346 is not running. If timer T3346 is
running, then MS shall initiate an GPRS attach or combined GPRS attach procedure on the expiry of timer
T3346; and
- may initiate GPRS attach for emergency bearer services (UTRAN Iu mode only) even if timer T3346 is running.
4.2.4.2.2 Substate, ATTEMPTING-TO-ATTACH

The MS:
- shall initiate GPRS attach on the expiry of timers T3311, T3302, or T3346;
- shall initiate GPRS attach when entering a new PLMN, if timer T3346 is running and the new PLMN is not
equivalent to the PLMN where the MS started timer T3346, the PLMN identity of the new cell is not in one of
the forbidden PLMN lists and the location area this cell is belonging to is not in one of the lists of forbidden
LAs;
- may initiate GPRS attach for emergency bearer services (UTRAN Iu mode only) even if timer T3346 is running;
- shall initiate GPRS attach when the routing area of the serving cell has changed, if timer T3346 is not running,
the PLMN identity of the new cell is not in one of the forbidden PLMN lists and the location area this cell is
belonging to is not in one of the lists of forbidden LAs;
- shall if entry into this state was caused by b) or d) with cause "Retry upon entry into a new cell" of
subclause 4.7.3.1.5, perform GPRS attach when a new cell is entered;
- shall if entry into this state was caused by c) or d) with cause different from "Retry upon entry into a new cell" of
subclause 4.7.3.1.5, not perform GPRS attach when a new cell is entered;
- shall use requests for non-GPRS services from CM layers to trigger the combined GPRS attach procedure, if
timer T3346 is not running and the network operates in network operation mode I. Depending on which of the
ETSI
Release 18 87 3GPP TS 24.008 V18.4.0 (2023-09)
timers T3311 or T3302 is running the MS shall stop the relevant timer and act as if the stopped timer has
expired; and
- may initiate GPRS attach upon request of the upper layers to establish a PDN connection for emergency bearer
services (UTRAN Iu mode only).
4.2.4.2.3 Substate, LIMITED-SERVICE

The MS:
- shall initiate GPRS attach when a cell is entered which may provide normal service (e.g. location area is not in
one of the forbidden lists); and
- may initiate GPRS attach for emergency bearer services (UTRAN Iu mode only).
4.2.4.2.4 Substate, NO-IMSI

The MS:
- shall perform default cell selection; and
4.2.4.2.5 Substate, NO-CELL

The MS shall:
- perform cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] and shall choose an
appropriate substate.
4.2.4.2.6 Substate, PLMN-SEARCH

The MS shall perform PLMN selection. If a new PLMN is selected, the MS shall reset the GPRS attach attempt counter
and initiate the GPRS attach procedure (see subclause 4.7.3.1).
If the selected cell is known not to be able to provide normal service, the MS may initiate GPRS attach for emergency
bearer services (UTRAN Iu mode only).
4.2.4.2.7 Substate, ATTACH-NEEDED

The MS shall start a GPRS attach procedure if still needed as soon as the access class control allows network contact in
the selected cell.
The MS may initiate GPRS attach for emergency bearer services (UTRAN Iu mode only).
4.2.4.2.8 Substate, SUSPENDED (A/Gb mode only)

The MS:
- shall not send any user data; and
- shall not send any signalling information.
4.2.4.3 Substate when back to state GMM-DEREGISTERED from another GMM

state
When returning to state GMM-DEREGISTERED, the MS shall select a cell as specified in 3GPP TS 43.022 [82] and
3GPP TS 25.304 [98].
The substate depends on the result of the cell selection procedure, the outcome of the previously performed GMM
specific procedures, on the GPRS update status of the MS, on the location area data stored in the MS and on the
presence of the SIM/USIM:
ETSI
Release 18 88 3GPP TS 24.008 V18.4.0 (2023-09)
- if no cell has been found, the substate is NO-CELL-AVAILABLE, until a cell is found;
- if no SIM/USIM is present or if the inserted SIM/USIM is considered invalid by the MS, the substate shall be
NO-IMSI;
- if a suitable cell supporting GPRS has been found and the PLMN or LA is not in the forbidden list, the substate
shall be NORMAL-SERVICE;
- if a GPRS attach shall be performed (e.g. network requested reattach), the substate shall be ATTEMPTING-TO-
ATTACH;
- if a PLMN reselection (according to 3GPP TS 23.122 [14]) is needed, the substate shall be PLMN SEARCH;
- if the selected cell is known not to be able to provide normal service, the substate shall be LIMITED-SERVICE.
4.2.5 Behaviour in state GMM-REGISTERED

The state GMM-REGISTERED is entered when:
- a GMM context is established, i.e. the MS is IMSI attached for GPRS services only or for GPRS and non-GPRS
services.
The specific behaviour of the MS in state GMM-REGISTERED is described in subclause 4.2.5.1. The primary substate
when entering the state GMM-REGISTERED is always NORMAL-SERVICE.
It should be noted that transitions between the various substates of GMM-REGISTERED are caused by (e.g.):
- change of RA;
- loss/regain of coverage.
How various GMM procedures affect the GMM-REGISTERED substates is described in the detailed description of the
procedures in subclause 4.7.
4.2.5.1 Detailed description of the MS behaviour in state GMM-REGISTERED

In state GMM-REGISTERED, the MS shall behave according to the substate as explained below.
4.2.5.1.1 Substate, NORMAL-SERVICE

The MS shall:
- perform cell selection/reselection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98];
- initiate normal routing area updating;
- perform periodic routing area updating except when attached for emergency bearer services (see
subclause 4.7.2.2); and
- receive and transmit user data and signalling information.
GPRS MSs in operation modes C or A shall answer to paging requests.
GPRS MS in operation mode B may answer to paging requests.
4.2.5.1.2 Substate, SUSPENDED (A/Gb mode only)

The MS:
- shall not send any user data;
- shall not send any signalling information; and
ETSI
Release 18 89 3GPP TS 24.008 V18.4.0 (2023-09)
- shall not perform cell-updates.
4.2.5.1.3 Substate, UPDATE-NEEDED

The MS shall:
- not send any user data;
- not send any signalling information, unless for a routing area update procedure upon request of the upper layers
to establish a PDN connection for emergency bearer services (UTRAN Iu mode only);
- perform cell selection/reselection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98]; and
- choose the appropriate new substate depending on the GPRS update status as soon as the access class control
allows network contact in the selected cell.
4.2.5.1.4 Substate, ATTEMPTING-TO-UPDATE

The MS:
- shall not send any user data;
- shall initiate routing area updating procedure on the expiry of timers T3311, T3302 or T3346;
- shall initiate routing area updating procedure when entering a new PLMN, if timer T3346 is running and the new
PLMN is not equivalent to the PLMN where the MS started timer T3346, the PLMN identity of the new cell is
not in one of the forbidden PLMN lists and the location area this cell is belonging to is not in one of the lists of
forbidden LAs;
- shall initiate routing area updating procedure when the routing area of the serving cell has changed, if timer
T3346 is not running, the PLMN identity of the new cell is not in one of the forbidden PLMN lists and the
location area this cell is belonging to is not in one of the lists of forbidden LAs;
- shall, if entry into this state was caused by b) or d) with cause "Retry upon entry into a new cell" of
subclause 4.7.5.1.5, initiate routing area updating procedure when a new cell is entered;
- shall, if entry into this state was caused by c) or d) with cause different from "Retry upon entry into a new cell"
of subclause 4.7.5.1.5, not initiate routing area updating procedure when a new cell is entered;
- shall use request for non-GPRS services from CM layers to trigger the combined routing area updating
procedure, if timer T3346 is not running and the network operates in network operation mode I. Depending on
which of the timers T3311 or T3302 is running the MS shall stop the relevant timer and act as if the stopped
timer has expired;
- may use a request for an MMTEL voice call or MMTEL video call from the upper layers to initiate routing area
updating procedure (Iu mode only), if timer T3346 is not running;
- may initiate routing area updating procedure upon request of the upper layers to establish a PDN connection for
emergency bearer services (UTRAN Iu mode only);
- shall initiate routing area updating procedure upon request of the upper layers to establish a PDN connection
without the NAS signalling low priority indication as specified in subclause 4.7.5.1.5, item j), if timer T3346 is
running due to a NAS request message (ROUTING AREA UPDATE REQUEST or SERVICE REQUEST)
which contained the low priority indicator set to "MS is configured for NAS signalling low priority" and timer
T3302 and timer T3311 are not running;
- may detach locally and initiate GPRS attach for emergency bearer services even if timer T3346 is running;
- shall initiate routing area updating procedure in response to paging; and
- shall not initiate the signalling procedure for GPRS detach unless the routing area of the current cell is same as
the stored routing area. Optionally, the MS may perform local GPRS detach.
ETSI
Release 18 90 3GPP TS 24.008 V18.4.0 (2023-09)
4.2.5.1.5 Substate, NO-CELL-AVAILABLE

The MS shall perform cell selection/reselection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98]. If PSM is
active, the MS can deactivate PSM at any time by activating the AS layer when the MS needs to send mobile originated
signalling or user data.
4.2.5.1.6 Substate, LIMITED-SERVICE

The MS:
- shall perform cell selection/reselection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98];
- may respond to paging (with IMSI); and
4.2.5.1.7 Substate, ATTEMPTING-TO-UPDATE-MM

The MS shall:
- perform cell selection/reselection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98];
- receive and transmit user data and signalling information;
- initiate routing area update indicating "combined RA/LA updating with IMSI attach" on the expiry of timers
T3311 or T3302;
- initiate routing area update indicating "combined RA/LA updating with IMSI attach" when the routing area of
the serving cell has changed and the location area this cell is belonging to is not in the list of forbidden LAs.
GPRS MSs in operation modes C or A shall answer to paging requests.
GPRS MS in operation mode B may answer to paging requests.
4.2.5.1.8 Substate, PLMN-SEARCH

When the MM state is IDLE, the GMM substate PLMN-SEARCH may be entered if the MS is in automatic network
selection mode and the maximum allowed number of consecutive unsuccessful routing area update attempts controlled
by the GPRS routing area updating attempt counter (subclause 4.7.5) have been performed. If a new PLMN is selected,
the MS shall reset the routing area updating attempt counter and perform the routing area updating procedure.
If the selected cell is known not to be able to provide normal service, the MS may initiate GPRS attach for emergency
bearer services (UTRAN Iu mode only).
4.3 MM common procedures

As described in subclause 4.1.1, a MM common procedure can be initiated at any time whilst a RR connection exists
between the network and the mobile station.
4.3.1 TMSI reallocation procedure
4.3.1.0 General
The purpose of the TMSI reallocation procedure is to provide identity confidentiality, i.e. to protect a user against being
identified and located by an intruder (see 3GPP TS 42.009 [5], 3GPP TS 43.020 [13] and 3GPP TS 33.102 [5a]).
If the identity confidentiality service is applied for an IMSI, a Temporary Mobile Subscriber Identity (TMSI) is used for
identification within the radio interface signalling procedures.
In a network supporting the feature 'Intra domain connection of RAN nodes to multiple CN nodes' a TMSI shall be
allocated to each IMSI attached mobile station. See 3GPP TS 23.236 [94], subclause 4.3.
ETSI
Release 18 91 3GPP TS 24.008 V18.4.0 (2023-09)
The structure of the TMSI is specified in 3GPP TS 23.003 [10]. The TMSI has significance only within a location area.
Outside the location area it has to be combined with the Location Area Identifier (LAI) to provide for an unambiguous
identity.
Usually the TMSI reallocation is performed at least at each change of a location area. (Such choices are left to the
network operator).
The reallocation of a TMSI can be performed either by a unique procedure defined in this subclause or implicitly by a
location updating procedure using the TMSI. The implicit reallocation of a TMSI is described together with that
procedure.
If a TMSI provided by a mobile station is unknown in the network e.g. due to a data base failure, the network may
require the mobile station to provide its International Mobile Subscriber Identity (IMSI). In this case the identification
procedure (see subclause 4.3.3) should be used before the TMSI reallocation procedure may be initiated.
The TMSI reallocation can be initiated by the network at any time whilst a RR connection exists between the network
and the mobile station.
NOTE 1: Usually the TMSI reallocation is performed in ciphered mode.
NOTE 2: Normally the TMSI reallocation will take place in conjunction with another procedure, e.g. at location
updating or at call setup (see 3GPP TS 29.002 [37]).
NOTE 3: The explicit TMSI reallocation procedure is started by the network only if the mobile station is updated in
the current location area or if a location updating procedure is ongoing for that particular mobile station,
or if the network wishes to send a non-broadcast LAI according to 3GPP TS 23.236 [94] to the mobile
station.
4.3.1.1 TMSI reallocation initiation by the network

The network initiates the TMSI reallocation procedure by sending a TMSI REALLOCATION COMMAND message to
the mobile station and starts the timer T3250.
The TMSI REALLOCATION COMMAND message contains a new combination of TMSI and LAI allocated by the
network or a LAI and the IMSI if the used TMSI shall be deleted. Usually the TMSI-REALLOCATION COMMAND
message is sent to the mobile station using a RR connection in ciphered mode (see 3GPP TS 43.020 [13] and
3GPP TS 33.102 [5a]).
4.3.1.2 TMSI reallocation completion by the mobile station

Upon receipt of the TMSI REALLOCATION COMMAND message the mobile station:
a) shall stores the Location Area Identifier (LAI) in the SIM/USIM;
b) shall enter the sub-state NORMAL SERVICE if the MS is in the sub-state ATTEMPTING TO UPDATE;
c) if the received identity is the IMSI of the relevant mobile station, shall delete any TMSI;
d) if the received identity is a TMSI, shall store the TMSI in the SIM/USIM; and
e) shall send a TMSI REALLOCATION COMPLETE message to the network.
4.3.1.3 TMSI reallocation completion in the network.

Upon receipt of the TMSI REALLOCATION COMPLETE message, the network stops the timer T3250 and either
considers the new TMSI as valid or, if an IMSI was sent to the mobile station, considers the old TMSI as deleted.
If the RR connection is no more needed, then the network will request the RR sublayer to release it (see
3GPP TS 44.018 [84] subclause 3.5 and 3GPP TS 25.331 [23c]).
4.3.1.4 Abnormal cases in the mobile station

The following abnormal cases can be identified:
ETSI
Release 18 92 3GPP TS 24.008 V18.4.0 (2023-09)
a) RR connection failure:
The mobile station shall consider the new TMSI and new LAI, if any, as valid and the old TMSI and old LAI as
deleted as soon as a TMSI REALLOCATION COMMAND message or another message containing a new
TMSI (e.g. LOCATION UPDATING ACCEPT message) is correctly received. Any RR connection failure at a
later stage shall not have any impact on the TMSI and LAI storage.
4.3.1.5 Abnormal cases on the network side

If the RR connection is lost before the TMSI REALLOCATION COMPLETE message is received, the network
shall release all MM connections, if any. Furthermore, the network should consider both the old and the new
TMSI as occupied for a certain recovery time.
During this period the network:
- may use the IMSI for paging or network originated transactions on the CM layer. Upon response from the
mobile station the TMSI reallocation procedure shall be restarted;
- may consider the new TMSI as valid if it is used by the mobile station; or
- may use the identification procedure followed by a new TMSI reallocation procedure, if the mobile station
uses the old TMSI (see subclause 4.3.3).
Other implementations are possible, e.g. the network may page with the old TMSI.
b) Expiry of timer T3250:
The TMSI reallocation procedure is supervised by the timer T3250 (see example in figure 4.1). At expiry of
timer T3250 the network may release the RR connection. In this case, the network shall abort the reallocation
procedure release all MM connections if any, and follow the rules for the case a as described above.
Figure 4.1/3GPP TS 24.008: TMSI reallocation sequence
4.3.2 Authentication procedure
4.3.2a Authentication procedure used for a UMTS authentication challenge

The purpose of the authentication procedure is fourfold (see 3GPP TS 33.102 [5a]):
First to permit the network to check whether the identity provided by the mobile station is acceptable or not;
Second to provide parameters enabling the mobile station to calculate a new UMTS ciphering key;
Third to provide parameters enabling the mobile station to calculate a new UMTS integrity key;
Fourth to permit the mobile station to authenticate the network.
The cases where the authentication procedure should be used are defined in 3GPP TS 33.102 [5a].
The UMTS authentication procedure is always initiated and controlled by the network. However, there is the possibility
for the MS to reject the UMTS authentication challenge sent by the network.
The MS shall support the UMTS authentication challenge, if a USIM is inserted.
ETSI
Release 18 93 3GPP TS 24.008 V18.4.0 (2023-09)
A UMTS security context is established in the MS and the network when a UMTS authentication challenge is
performed in A/Gb mode or in Iu mode. After a successful UMTS authentication, the UMTS ciphering key, the UMTS
integrity key, the GSM ciphering key and the ciphering key sequence number, are stored both in the network and the
MS. Furthermore, in A/Gb mode both the ME and the network may derive and store a GSM Kc128 as part of the UMTS
security context as described in the subclause 4.3.2.3a.
4.3.2b Authentication Procedure used for a GSM authentication challenge

The purpose of the authentication procedure is twofold (see 3GPP TS 43.020 [13]):
First to permit the network to check whether the identity provided by the mobile station is acceptable or not;
Second to provide parameters enabling the mobile station to calculate a new GSM ciphering key.
The cases where the authentication procedure should be used are defined in 3GPP TS 42.009 [5].
The authentication procedure is always initiated and controlled by the network. GSM authentication challenge shall be
supported by a ME supporting GERAN or UTRAN.
A GSM security context is established in the MS and the network when a GSM authentication challenge is performed in
A/Gb mode or in Iu mode. However, in Iu mode the MS shall not accept a GSM authentication challenge, if a USIM is
inserted. After a successful GSM authentication, the GSM ciphering key and the ciphering key sequence number, are
stored both in the network and the MS.
4.3.2.1 Authentication request by the network

The network initiates the authentication procedure by transferring an AUTHENTICATION REQUEST message across
the radio interface and starts the timer T3260. The AUTHENTICATION REQUEST message contains the parameters
necessary to calculate the response parameters (see 3GPP TS 43.020 [13] (in case of GSM authentication challenge)
and 3GPP TS 33.102 [5a] (in case of an UMTS authentication challenge)).
In a GSM authentication challenge, the AUTHENTICATION REQUEST message also contains the GSM ciphering key
sequence number allocated to the key which may be computed from the given parameters.
In a UMTS authentication challenge, the AUTHENTICATION REQUEST message also contains the ciphering key
sequence number allocated to the key set of UMTS ciphering key, UMTS integrity key and GSM ciphering key which
may be computed from the given parameters. Furthermore, the ciphering key sequence number is also linked to a GSM
Kc128 if after the authentication procedure the network in A/Gb mode selects an A5 ciphering algorithm that requires a
128-bit ciphering key.
4.3.2.2 Authentication response by the mobile station

The mobile station shall be ready to respond upon an AUTHENTICATION REQUEST message at any time whilst a
RR connection exists. With exception of the cases described in subclause 4.3.2.5.1, it shall process the challenge
information and send back an AUTHENTICATION RESPONSE message to the network.
If a SIM is inserted in the MS, the MS shall ignore the Authentication Parameter AUTN IE if included in the
AUTHENTICATION REQUEST message and shall proceed as in case of a GSM authentication challenge. It shall not
perform the authentication of the network described in subclause 4.3.2.5.1.
In a GSM authentication challenge, the new GSM ciphering key calculated from the challenge information shall
overwrite the previous GSM ciphering key and any previously stored UMTS ciphering key and UMTS integrity key
shall be deleted. The new GSM ciphering key shall be stored on the SIM/USIM together with the ciphering key
sequence number.
In a UMTS authentication challenge, the new UMTS ciphering key, the new GSM ciphering key and the new UMTS
integrity key calculated from the challenge information shall overwrite the previous UMTS ciphering key, GSM
ciphering key and UMTS integrity key. The new UMTS ciphering key, GSM ciphering key and UMTS integrity key are
stored on the USIM together with the ciphering key sequence number. Furthermore, in A/Gb mode when after the
authentication procedure an A5 ciphering algorithm that requires a 128-bit ciphering key is taken into use, then a new
GSM Kc128 shall also be calculated as described in the subclause 4.3.2.3a.
ETSI
Release 18 94 3GPP TS 24.008 V18.4.0 (2023-09)
The SIM/USIM will provide the mobile station with the authentication response, based upon the authentication
challenge given from the ME. A UMTS authentication challenge will result in the USIM passing a RES to the ME. A
GSM authentication challenge will result in the SIM/USIM passing a SRES to the ME.
A ME supporting UMTS authentication challenge may support the following procedure:
In order to avoid a synchronisation failure, when the mobile station receives an AUTHENTICATION REQUEST
message, the mobile station shall store the received RAND together with the RES returned from the USIM in the
volatile memory and associate it with CS domain. When the MS receives a subsequent AUTHENTICATION
REQUEST message, if the stored RAND value for the CS domain is equal to the new received value in the
AUTHENTICATION REQUEST message, then the mobile station shall not pass the RAND to the USIM, but shall
immediately send the AUTHENTICATION RESPONSE message with the stored RES for the CS domain. If, for the CS
domain, there is no valid stored RAND in the mobile station or the stored RAND is different from the new received
value in the AUTHENTICATION REQUEST message, the mobile station shall pass the RAND to the USIM, shall
override any previously stored RAND and RES with the new ones and start, or reset and restart timer T3218.
The RAND and RES values stored in the mobile station shall be deleted and timer T3218, if running, shall be stopped:
- upon receipt of a SECURITY MODE COMMAND (Iu mode only),

CIPHERING MODE COMMAND (A/Gb mode only),
CM_SERVICE_ACCEPT,
CM_SERVICE_REJECT,
LOCATION_UPDATING_ACCEPT
or AUTHENTICATION REJECT message;
- upon expiry of timer T3218; or
- if the mobile station enters the MM state MM IDLE or NULL.
4.3.2.3 Authentication processing in the network

Upon receipt of the AUTHENTICATION RESPONSE message, the network stops the timer T3260 and checks the
validity of the response (see 3GPP TS 43.020 [13] in case of a GSM authentication challenge respective
3GPP TS 33.102 [5a] in case of an UMTS authentication challenge).
Upon receipt of the AUTHENTICATION FAILURE message, the network stops the timer T3260. In Synch failure
case, the core network may renegotiate with the HLR/AuC and provide the MS with new authentication parameters.
4.3.2.3a 128-bit circuit-switched GSM ciphering key

The ME and the network may derive and store a 128-bit circuit-switched GSM ciphering key or GSM Kc 128 from an
established UMTS security context. If the GSM Kc128 exists, then it is also part of the UMTS security context.
The ME with a USIM in use shall compute a new GSM Kc128 using the UMTS ciphering key and the UMTS integrity
key from an established UMTS security context as specified in 3GPP TS 33.102 [5a]. The new GSM Kc128 shall be
stored only in the ME. The ME shall overwrite the existing GSM Kc128 with the new GSM Kc128. The ME shall delete
the GSM Kc128 at switch off, when the USIM is disabled as well as under the conditions identified in the
subclause 4.1.2.2 and 4.3.2.4. The ME with a USIM in use shall apply the GSM Kc128 when in A/Gb mode an A5
ciphering algorithm that requires a 128-bit ciphering key is taken into use.
The network shall compute the GSM Kc128 using the UMTS integrity key and the UMTS ciphering key from an
established UMTS security context as specified in 3GPP TS 33.102 [5a] only when in A/Gb mode an A5 ciphering
algorithm that requires a 128-bit ciphering key is to be used.
4.3.2.4 Ciphering key sequence number

The security parameters for authentication and ciphering are tied together in sets.
In a GSM authentication challenge, from a challenge parameter RAND both the authentication response parameter
SRES and the GSM ciphering key can be computed given the secret key associated to the IMSI.
In a UMTS authentication challenge, from a challenge parameter RAND, the authentication response parameter RES
and the UMTS ciphering key and the UMTS integrity key can be computed given the secret key associated to the IMSI.
ETSI
Release 18 95 3GPP TS 24.008 V18.4.0 (2023-09)
In addition, in the USIM a GSM ciphering key can be computed from the UMTS ciphering key and the UMTS integrity
key by means of an unkeyed conversion function. Furthermore, in A/Gb mode if an A5 ciphering algorithm that
requires a 128-bit ciphering key is taken into use, then a GSM Kc128 shall also be calculated as described in the
subclause 4.3.2.3a.
In order to allow start of ciphering on a RR connection without authentication, the ciphering key sequence numbers are
introduced. The ciphering key sequence number is managed by the network in the way that the AUTHENTICATION
REQUEST message contains the ciphering key sequence number allocated to the GSM ciphering key (in case of a GSM
authentication challenge) or the UMTS ciphering key and the UMTS integrity key (in case of a UMTS authentication
challenge) which may be computed from the RAND parameter carried in that message.
If an authentication procedure has been completed successfully and a ciphering key sequence number is stored in the
network, the network shall include a different ciphering key sequence number in the AUTHENTICATION REQUEST
message when it intiates a new authentication procedure.
The mobile station stores the ciphering key sequence number with the GSM ciphering key (in case of a GSM
authentication challenge) and the UMTS ciphering key and the UMTS integrity key (in case of a UMTS authentication
challenge) and indicates to the network in the first message (LOCATION UPDATING REQUEST, CM SERVICE
REQUEST, PAGING RESPONSE, CM RE-ESTABLISHMENT REQUEST) which ciphering key sequence number
the stored GSM ciphering key (in case of a GSM authentication challenge) or set of UMTS ciphering, UMTS integrity,
derived GSM ciphering key, and potentially the derived GSM Kc128 (in case of a UMTS authentication challenge) has.
When the deletion of the ciphering key sequence number is described this also means that the associated GSM
ciphering key, the UMTS ciphering key and the UMTS integrity key shall be considered as invalid and also the GSM
Kc128 shall be deleted if any (i.e. the established GSM security context or the UMTS security context is no longer valid).
In A/Gb mode, the network may choose to start ciphering with the stored GSM ciphering key or GSM Kc 128 (under the
restrictions given in 3GPP TS 42.009 [5]) if the stored ciphering key sequence number and the one given from the
mobile station are equal.
NOTE 1: The decision of starting ciphering with the GSM ciphering key or the GSM Kc128 depends on whether the
network indicates in the CIPHERING MODE COMMAND message an A5 ciphering algorithm which
requires a 64 or 128-bit ciphering key as specified in 3GPP TS 33.102 [5a].
In Iu mode, the network may choose to start ciphering and integrity with the stored UMTS ciphering key and UMTS
integrity key (under the restrictions given in 3GPP TS 42.009 [5] and 3GPP TS 33.102 [5a]) if the stored ciphering key
sequence number and the one given from the mobile station are equal.
NOTE 2: In some specifications the term KSI (Key Set Identifier) might be used instead of the term ciphering key
sequence number.
4.3.2.5 Authentication not accepted by the network

If the authentication response (RES or SRES) is not valid, the network response depends upon the type of identity used
by the mobile station in the first message, that is:
- the TMSI was used; or
- the IMSI was used.
If the TMSI has been used, the network may decide to initiate the identification procedure. If the IMSI given by the
mobile station then differs from the one the network had associated with the TMSI, the authentication should be
restarted with the correct parameters. If the IMSI provided by the MS is the expected one (i.e. authentication has really
failed), the network should send an AUTHENTICATION REJECT message to the mobile station.
If the IMSI has been used, or the network decides not to try the identification procedure, an AUTHENTICATION
REJECT message should be transferred to the mobile station.
After having sent this message, all MM connections in progress (if any) are released and the network should initiate the
RR connection release procedure described in subclause 3.5.of 3GPP TS 44.018 [84] (A/Gb mode only),
3GPP TS 25.331 [23c] (UTRAN Iu mode only), or in 3GPP TS 44.118 [111] (GERAN Iu mode only).
Upon receipt of an AUTHENTICATION REJECT message,
ETSI
Release 18 96 3GPP TS 24.008 V18.4.0 (2023-09)
a) if the message has been successfully integrity checked by the lower layers, the mobile station shall set the update
status in the SIM/USIM to U3 ROAMING NOT ALLOWED, delete from the SIM/USIM the stored TMSI, LAI
and ciphering key sequence number. The SIM/USIM shall be considered as invalid until switching off or the
SIM/USIM is removed. If the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS
services", then the MS shall set this counter to MS implementation-specific maximum value. If the MS maintains
a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to MS
implementation-specific maximum value.
b) if the message is received without integrity protection, then the MS shall start timer T3247 with a random value
uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running (see
subclause 4.1.1.6A). Additionally, the MS shall:
- if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the
counter has a value less than an MS implementation-specific maximum value, proceed as specified in
subclause 4.1.1.6A, list item 1.a) for the case a LOCATION UPDATING REJECT message is received
without integrity protection. Additionally, if the MS maintains a counter for "SIM/USIM considered invalid
for GPRS services", then the MS shall increment this counter; and
- otherwise proceed as specified under list item a) above for the case that the message has been successfully
checked by the lower layers.
List item b) above is also applicable, if the message is received in A/Gb mode.
If the AUTHENTICATION REJECT message is received in the state IMSI DETACH INITIATED the mobile station
shall follow subclause 4.3.4.3.
If the AUTHENTICATION REJECT message is received in any other state the mobile station shall abort any MM
specific, MM connection establishment or call re-establishment procedure, stop any of the timers T3210, T3230, T3214
or T3216 (if they were running), release all MM connections (if any), start timer T3240 and enter the state WAIT FOR
NETWORK COMMAND, expecting the release of the RR connection. If the RR connection is not released within a
given time controlled by the timer T3240, the mobile station shall abort the RR connection. In both cases, either after a
RR connection release triggered from the network side or after a RR connection abort requested by the MS-side, the MS
enters state MM IDLE, substate NO IMSI.
4.3.2.5.1 Authentication not accepted by the MS

In a UMTS authentication challenge, the authentication procedure is extended to allow the MS to check the authenticity
of the core network. Thus allowing, for instance, detection of false base station.
Following a UMTS authentication challenge, the MS may reject the core network, on the grounds of an incorrect
AUTN parameter (see 3GPP TS 33.102 [5a]). This parameter contains two possible causes for authentication failure:
a) MAC code failure:
If the MS considers the MAC code (supplied by the core network in the AUTN parameter) to be invalid, it
shall send an AUTHENTICATION FAILURE message to the network, with the reject cause 'MAC failure'.
The MS shall then follow the procedure described in subclause 4.3.2.6 (c).
b) SQN failure:
If the MS considers the SQN (supplied by the core network in the AUTN parameter) to be out of range, it
shall send a AUTHENTICATION FAILURE message to the network, with the reject cause 'Synch failure'
and a re-synchronization token AUTS provided by the USIM (see 3GPP TS 33.102 [5a]). The MS shall then
follow the procedure described in subclause 4.3.2.6 (d).
In UMTS, an MS with a USIM inserted shall reject the authentication challenge if no Authentication Parameter AUTN
IE was present in the AUTHENTICATION REQUEST message (i.e. a GSM authentication challenge has been received
when the MS expects a UMTS authentication challenge). In such a case, the MS shall send the AUTHENTICATION
FAILURE message to the network, with the reject cause "GSM authentication unacceptable". The MS shall then follow
the procedure described in subclause 4.3.2.6 (c).
If the MS returns an AUTHENTICATION_FAILURE message to the network, the MS shall delete any previously
stored RAND and RES and shall stop timer T3218, if running.
ETSI
Release 18 97 3GPP TS 24.008 V18.4.0 (2023-09)
4.3.2.6 Abnormal cases

(a) RR connection failure:
Upon detection of a RR connection failure before the AUTHENTICATION RESPONSE message is received,
the network shall release all MM connections (if any) and abort any ongoing MM specific procedure.
(b) Expiry of timer T3260:
The authentication procedure is supervised on the network side by the timer T3260. At expiry of this timer the
network may release the RR connection. In this case the network shall abort the authentication procedure and
any ongoing MM specific procedure, release all MM connections if any, and initiate the RR connection release
procedure described in subclause 3.5 of 3GPP TS 44.018 [84] (A/Gb mode only), 3GPP TS 25.331 [23c]
(UTRAN Iu mode only), or in 3GPP TS 44.118 [111] (GERAN Iu mode only).
(c) Authentication failure (reject cause "MAC failure" or "GSM authentication unacceptable"):
The MS shall send an AUTHENTICATION FAILURE message, with reject cause "MAC failure" or "GSM
authentication unacceptable" according to subclause 4.3.2.5.1, to the network and start timer T3214.
Furthermore, the MS shall stop any of the retransmission timers that are running (e.g. T3210, T3220 or T3230).
Upon the first receipt of an AUTHENTICATION FAILURE message from the MS with reject cause "MAC
failure" or "GSM authentication unacceptable", the network may initiate the identification procedure described
in subclause 4.3.3. This is to allow the network to obtain the IMSI from the MS. The network may then check
that the TMSI originally used in the authentication challenge corresponded to the correct IMSI. Upon receipt of
the IDENTITY REQUEST message from the network, the MS shall send the IDENTITY RESPONSE message.
NOTE: Upon receipt of an AUTHENTICATION FAILURE message from the MS with reject cause "MAC
failure" or "GSM authentication unacceptable", the network may also terminate the authentication
procedure (see subclause 4.3.2.5).
If the TMSI/IMSI mapping in the network was incorrect, the network should respond by sending a new
AUTHENTICATION REQUEST message to the MS. Upon receiving the new AUTHENTICATION REQUEST
message from the network, the MS shall stop the timer T3214, if running, and then process the challenge
information as normal. If theTMSI/IMSI mapping in the network was correct, the network should terminate the
authentication procedure by sending an AUTHENTICATION REJECT message.
If the network is validated successfully (an AUTHENTICATION REQUEST message that contains a valid SQN
and MAC is received), the MS shall send the AUTHENTICATION RESPONSE message to the network and
shall start any retransmission timers (e.g. T3210, T3220 or T3230), if they were running and stopped when the
MS received the first failed AUTHENTICATION REQUEST message.
If the MS receives the second AUTHENTICATION REQUEST message while T3214 is running, and the MAC
value cannot be resolved or the message contains a GSM authentication challenge, the MS shall follow the
procedure specified in this subclause (c), starting again from the beginning. If the SQN is invalid, the MS shall
proceed as specified in (d).
It can be assumed that the source of the authentication challenge is not genuine (authentication not accepted by
the MS) if any of the following occur:
- the timer T3214 expires;
- the MS detects any combination of the authentication failures: "MAC failure", "invalid SQN", and "GSM
authentication unacceptable", during three consecutive authentication challenges. The authentication
challenges shall be considered as consecutive only, if the authentication challenges causing the second and
third authentication failure are received by the MS, while the timer T3214 or T3216 started after the previous
authentication failure is running.
The MS shall stop timer T3214, if the timer is running and the MS detects an RR connection failure or the
network releases the RR connection.
When it has been deemed by the MS that the source of the authentication challenge is not genuine (i.e.
authentication not accepted by the MS), the MS shall behave as described in subclause 4.3.2.6.1.
ETSI
Release 18 98 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 4.2/3GPP TS 24.008: Authentication Failure Procedure

(reject cause "MAC failure" or "GSM authentication unacceptable")
(d) Authentication failure (reject cause "synch failure"):
The MS shall send an AUTHENTICATION FAILURE message, with reject cause "synch failure", to the
network and start the timer T3216. Furthermore, the MS shall stop any of the retransmission timers that are
running (e.g. T3210, T3220 or T3230). Upon the first receipt of an AUTHENTICATION FAILURE message
from the MS with the reject cause "synch failure", the network shall use the returned AUTS parameter from the
authentication failure parameter IE in the AUTHENTICATION FAILURE message, to re-synchronise. The re-
synchronisation procedure requires the VLR/MSC to delete all unused authentication vectors for that IMSI and
obtain new vectors from the HLR. When re-synchronisation is complete, the network shall initiate the
authentication procedure. Upon receipt of the AUTHENTICATION REQUEST message, the MS shall stop the
timer T3216, if running.
NOTE: Upon receipt of two consecutive AUTHENTICATION FAILURE messages from the MS with reject
cause "synch failure", the network may terminate the authentication procedure by sending an
AUTHENTICATION REJECT message.
If the network is validated successfully (a new AUTHENTICATION REQUEST message is received which
contains a valid SQN and MAC) while T3216 is running, the MS shall send the AUTHENTICATION
RESPONSE message to the network and shall start any retransmission timers (e.g. T3210, T3220 or T3230), if
they were running and stopped when the MS received the first failed AUTHENTICATION REQUEST message.
If the MS receives the second AUTHENTICATION REQUEST message while T3216 is running, and the MAC
value cannot be resolved or the message contains a GSM authentication challenge, the MS shall proceed as
specified in (c); if the SQN is invalid, the MS shall follow the procedure specified in this subclause (d), starting
again fom the beginning.
The MS shall deem that the network has failed the authentication check and behave as described in
subclause 4.3.2.6.1, if any of the following occurs:
ETSI
Release 18 99 3GPP TS 24.008 V18.4.0 (2023-09)
The MS shall stop timer T3216, if the timer is running and the MS detects an RR connection failure or the
network releases the RR connection.
When it has been deemed by the MS that the source of the authentication challenge is not genuine (i.e.
authentication not accepted by the MS), the MS shall behave as described in subclause 4.3.2.6.1.
Figure 4.2a/3GPP TS 24.008: Authentication Failure Procedure (reject cause "Synch failure")
Upon receipt of an AUTHENTICATION REJECT message, the mobile station shall perform the actions as
specified in subclause 4.3.2.5. If an MS has an MM connection for an emergency call established or is
establishing an MM connection for an emergency call when timer T3214 or T3216 expires, the MS shall not
deem that the network has failed the authentication check and not behave as described in subclause 4.3.2.6.1.
4.3.2.6.1 MS behaviour towards a network that has failed the authentication procedure
If the MS deems that the network has failed the authentication check, then it shall request RR or RRC to release the RR
connection and the PS signalling connection, if any, and bar the active cell or cells (see 3GPP TS 25.331 [23c],
3GPP TS 25.304 [98] and 3GPP TS 44.018 [84]). The MS shall start any retransmission timers (e.g. T3210, T3220 or
T3230), if they were running and stopped when the MS received the first AUTHENTICATION REQUEST message
containing an invalid MAC or invalid SQN, or no AUTN when a UMTS authentication challenge was expected.
4.3.2.7 Handling of keys at intersystem change from Iu mode to A/Gb mode

At inter-system change from Iu mode to A/Gb mode, ciphering may be started (see 3GPP TS 44.018 [84]) without any
new authentication procedure. Deduction of the appropriate security key for ciphering in A/Gb mode, depends on the
current GSM/UMTS security context stored in the MS and the network.
The ME shall handle the GSM ciphering key and a potential GSM Kc128 according to table 4.3.2.7.1.
ETSI
Release 18 100 3GPP TS 24.008 V18.4.0 (2023-09)
Table 4.3.2.7.1/3GPP TS 24.008: Inter-system change from Iu mode to A/Gb mode
Security context established in MS and At inter-system change to A/Gb mode:

network in Iu mode
GSM security context An ME shall apply the stored GSM ciphering key that was
received from the GSM security context residing in the SIM/USIM
during the latest successful ciphering mode setting or security
mode control procedure before the inter-system change.
UMTS security context If an A5 algorithm is taken into use that requires a 64-bit
ciphering key, then an ME shall apply the stored GSM ciphering
key that was derived by the USIM from the UMTS ciphering key
and the UMTS integrity key and provided by the USIM during the
latest successful ciphering mode setting or security mode control
procedure before the inter-sytem change.
If an A5 algorithm is taken into use that requires a 128-bit
ciphering key, then an ME shall apply the GSM Kc128 derived by
the ME from the UMTS ciphering key and the UMTS integrity key
(see 3GPP TS 33.102 [5a]) provided by USIM during the lastest
successful ciphering mode setting or security mode control
procedure before the inter-system change (see
subclause 4.3.2.3a).
NOTE: A USIM with UMTS security context, passes the UMTS ciphering key, the UMTS integrity key and the
derived GSM ciphering key to the ME independent on the current radio access being UTRAN or
GERAN.
4.3.2.7a Use of established security contexts

In A/Gb mode, in the case of an established GSM security context, the GSM ciphering key shall be loaded from the
SIM/USIM and taken into use by the ME when any valid CIPHERING MODE COMMAND is received during an RR
connection (the definition of a valid CIPHERING MODE COMMAND message is given in 3GPP TS 44.018 [84]
subclause 3.4.7.2).
In A/Gb mode, in the case of an established UMTS security context, the GSM ciphering key shall be loaded from the
USIM and taken into use by the MS when a valid CIPHERING MODE COMMAND is received during an RR
connection (the definition of a valid CIPHERING MODE COMMAND message is given in 3GPP TS 44.018 [84]
subclause 3.4.7.2) which indicates an A5 ciphering algorithm that requires a 64-bit ciphering key. The network shall
derive a GSM ciphering key from the UMTS ciphering key and the UMTS integrity key by using the conversion
function named "c3" defined in 3GPP TS 33.102 [5a].
In A/Gb mode, in the case of an established UMTS security context, the UMTS ciphering key and the UMTS integrity
key shall be loaded from the USIM in order for the ME to derive the GSM Kc128 (see 3GPP TS 33.102 [5a]) and shall be
taken into use by the ME when a valid CIPHERING MODE COMMAND is received during an RR connection (the
definition of a valid CIPHERING MODE COMMAND message is given in 3GPP TS 44.018 [84] subclause 3.4.7.2)
which indicates an A5 ciphering algorithm that requires a 128-bit ciphering key. The network shall derive a GSM Kc 128
from the UMTS ciphering key and the UMTS integrity as defined in 3GPP TS 33.102 [5a].
In Iu mode, in the case of an established GSM security context, the ME shall derive a UMTS ciphering key and a
UMTS integrity key from the GSM ciphering key by using the conversion functions named "c4" and "c5" defined in
3GPP TS 33.102 [5a]. The GSM ciphering key shall be loaded from the SIM/USIM and the derived UMTS ciphering
key and UMTS integrity key shall be taken into use by the MS when a valid SECURITY MODE COMMAND
indicating CS domain is received during an RR connection (the definition of a valid SECURITY MODE COMMAND
message is given in 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]). The network shall derive a UMTS ciphering
key and a UMTS integrity key from the GSM ciphering key by using the conversion functions named "c4" and "c5"
defined in 3GPP TS 33.102 [5a].
In Iu mode, in the case of an established UMTS security context, the UMTS ciphering key and UMTS integrity key
shall be loaded from the USIM and taken into use by the MS when a valid SECURITY MODE COMMAND indicating
CS domain is received during a RR connection (the definition of a valid SECURITY MODE COMMAND message is
given in 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
ETSI
Release 18 101 3GPP TS 24.008 V18.4.0 (2023-09)
In Iu mode and A/Gb mode, if the MS received a valid SECURITY MODE COMMAND indicating CS domain in Iu
mode or a valid CIPHERING MODE COMMAND in A/Gb mode before the network initiates a new Authentication
procedure and establishes a new GSM/UMTS security context, the new keys are taken into use in the MS when a new
valid SECURITY MODE COMMAND indicating CS domain in Iu mode, or a new valid CIPHERING MODE
COMMAND in A/Gb mode, is received during the RR connection. In case of Iu mode to Iu mode handover, A/Gb
mode to A/Gb mode handover, or inter-system change to A/Gb mode, the MS and the network shall continue to use the
key from the old key set until a new valid SECURITY MODE COMMAND indicating CS domain in Iu mode, or a new
valid CIPHERING MODE COMMAND in A/Gb mode, is received during the RR connection. In case of inter-system
change to Iu mode, the MS and the network shall continue to use the keys from the old key set until the second valid
SECURITY MODE COMMAND indicating CS domain is received during the RR connection.
NOTE 1: If the MS received a valid SECURITY MODE COMMAND indicating CS domain in Iu mode or a valid
CIPHERING MODE COMMAND in A/Gb mode before the inter-system change to Iu mode occurs, the
first SECURITY MODE COMMAND message after the inter-system change, which indicates CS domain
and includes only an Integrity protection mode IE, is initiated by the UTRAN without receipt of a
corresponding RANAP security mode control procedure from the MSC/VLR. The only purpose of this
SECURITY MODE COMMAND message is to activate the integrity protection, but not to load a new
key set from the SIM/USIM (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
NOTE 2: If the MS did not receive any valid SECURITY MODE COMMAND indicating CS domain in Iu mode
or any valid CIPHERING MODE COMMAND in A/Gb mode before the inter-system change to Iu mode
occurs, the first SECURITY MODE COMMAND message after the inter-system change, which indicates
CS domain, is initiated by the UTRAN on receipt of a RANAP security mode control procedure from the
MSC/VLR. The purpose of this SECURITY MODE COMMAND message is to load a key set from the
SIM/USIM and to activate either integrity protection or ciphering and integrity protection (see
3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
4.3.2.8 Handling of keys at intersystem change from A/Gb mode to Iu mode

At inter-system change from A/Gb mode to Iu mode, ciphering and integrity may be started (see
3GPP TS 25.331 [23c]) without any new authentication procedure. Deduction of the appropriate security keys for
ciphering and integrity check in Iu mode, depends on the current GSM/UMTS security context stored in the MS and the
network.
The ME shall handle the UMTS ciphering key and the UMTS integrity key according to table 4.3.2.8.1.
Table 4.3.2.8.1/3GPP TS 24.008: Inter-system change from A/Gb mode to Iu mode
Security context established in MS and At inter-system change to Iu mode:

network in A/Gb mode
GSM security context An ME shall derive the UMTS ciphering key and the UMTS
integrity key from the stored GSM ciphering key that was
provided by the SIM/USIM during the latest successful ciphering
mode setting or security mode control procedure before the inter-
system change. The conversion functions named "c4" and "c5" in
3GPP TS 33.102 [5a] are used for this purpose.
UMTS security context An ME shall apply the stored UMTS ciphering key and the stored
UMTS integrity key that were received from the UMTS security
context residing in the USIM during the latest successful
ciphering mode setting or security mode control procedure before
the inter-system change.
NOTE: A USIM with UMTS security context, passes the UMTS ciphering key, the UMTS integrity key and the
derived GSM ciphering key to the ME independent on the current radio access being UTRAN or
GERAN.
ETSI
Release 18 102 3GPP TS 24.008 V18.4.0 (2023-09)
4.3.2.9 Void
4.3.2.10 Derivation of keys at SRVCC or vSRVCC handover from S1 mode
4.3.2.10.0 General
NOTE: The keys CKSRVCC and IKSRVCC apply for both SRVCC and vSRVCC.
4.3.2.10.1 PDN connection with integrity protection

At PS to CS domain change from S1 mode due to SRVCC or vSRVCC handover of a PDN connection for which the
"null integrity protection algorithm" EIA0 has not been used (see 3GPP TS 23.216 [126]), when the MS receives the
command to perform handover, the MS shall derive a UMTS security context for the CS domain from the current EPS
security context.
The MS shall set the CKSN of the derived UMTS security context to the value of the eKSI of the EPS security context
and derive security keys CKSRVCC and IKSRVCC as specified in 3GPP TS 33.401 [123]. The ME shall also derive the
security key GSM ciphering key Kc from CKSRVCC and IKSRVCC using the conversion function c3 as specified in
3GPP TS 33.102 [5a]. The MS shall apply these derived security keys, handle the STARTCS value as specified in
3GPP TS 25.331 [23c] and replace an already established UMTS security context for the CS domain, if any, in the
USIM, when the SRVCC or vSRVCC handover from S1 mode has been completed successfully.
NOTE: Because of deriving a new UMTS security context for the CS domain, a new GSM ciphering key needs
also to be derived from the new derived UMTS security keys for the CS domain (i.e. CKSRVCC and
IKSRVCC). Note that the new GSM ciphering key is also part of the new UMTS security context for the CS
domain as well, as any old GSM ciphering key stored in the USIM and in the ME, belongs to an old
UMTS security context for the CS domain and can no longer be used.
The network shall replace an already established UMTS security context for the CS domain, if any, when the SRVCC
or vSRVCC handover from S1 mode has been completed successfully.
If the SRVCC or vSRVCC handover from S1mode has not been completed successfully, the MS and the network shall
delete the new derived GSM or UMTS security context for the CS domain. Additionally, the network shall delete the
already established GSM or UMTS security context for the CS domain, if the CKSN of the already established GSM or
UMTS security context is equal to the CKSN of the new derived GSM or UMTS security context for the CS domain.
4.3.2.10.2 PDN connection without integrity protection

At PS to CS domain change from S1 mode due to SRVCC handover of a PDN connection for emergency bearer
services for which the "null integrity protection algorithm" EIA0 has been used while in S1 mode, the MS and the
network shall not perform key derivation.
4.3.2.11 Derivation of keys at SRVCC handover from Iu mode to Iu mode

At PS to CS domain change from Iu mode to Iu mode due to SRVCC handover of a PDN connection for which integrity
protection has been activated, ciphering and integrity may be started (see 3GPP TS 25.331 [23c]) without any new
authentication procedure. Deduction of the appropriate security keys for ciphering and integrity check in Iu mode,
depends on the current GSM or UMTS security context for the PS domain stored in the MS and the network.
The ME shall handle the UMTS ciphering key and the UMTS integrity key according to table 4.3.2.11.1.
ETSI
Release 18 103 3GPP TS 24.008 V18.4.0 (2023-09)
Table 4.3.2.11.1/3GPP TS 24.008: SRVCC handover from Iu mode to Iu mode
Security context for the PS domain At inter-system change to Iu mode:

established in MS and network in Iu mode
GSM security context An ME shall derive the GSM ciphering key (Kc’) from the stored
GPRS GSM ciphering key, which was provided by the SIM/USIM
during the latest successful authentication, and the NONCE
received in the command to perform handover (see
3GPP TS 25.331 [23c]) using the key derivation function
specified in 3GPP TS 33.102 [5a]. The ME shall use the derived
GSM ciphering key (Kc’) to derive the UMTS security keys UMTS
ciphering key (CK’) and UMTS integrity key (IK’). The conversion
functions named "c4" and "c5" in 3GPP TS 33.102 [5a] are used
for this purpose. The MS shall set the CKSN of the derived GSM
security context for the CS domain to the value of the GPRS
CKSN of the GSM security context for PS domain. Furthermore,
the ME shall apply the new derived UMTS security keys and
replace an already established GSM security context for the CS
domain, if any, in the SIM/USIM, when the SRVCC handover
from Iu mode has been completed successfully. Furthermore, the
MS shall handle the STARTCS value as specified in
3GPP TS 25.331 [23c]).
UMTS security context An ME shall derive the UMTS security keys UMTS ciphering key
(CK’) and UMTS integrity key (IK’) from the GPRS UMTS
ciphering key and the GPRS UMTS integrity key, which were
received from the UMTS security context for the PS domain
residing in the USIM, and the NONCE received in the command
to perform handover (see 3GPP TS 25.331 [23c]) as specified in
3GPP TS 33.102 [5a]. The ME shall use the derived UMTS
security keys to derive the GSM ciphering key (Kc’) using the
"c3" conversion function as specified in 3GPP TS 33.102 [5a].
The MS shall set the CKSN of the derived UMTS security context
for the CS domain to the value of the KSI of the UMTS security
context for PS domain. Furthermore, the ME shall apply the
derived UMTS security keys and replace an already established
UMTS security context for the CS domain, if any, in the USIM,
when the SRVCC handover from Iu mode has been completed
successfully. Furthermore, the MS shall handle the STARTCS
value as specified in 3GPP TS 25.331 [23c]).
NOTE 1: For the case of an established UMTS security context for the PS domain, because of deriving a new
UMTS security context for the CS domain, a new GSM ciphering key needs to be derived from the new
derived UMTS security keys (i.e. CK' and IK'). Note that the new GSM ciphering key is also part of the
new UMTS security context for the CS domain, and therefore any old GSM ciphering key stored in the
USIM and in the ME belongs to an old UMTS security context for the CS domain and can no longer be
taken into use.
The network shall replace an already established GSM or UMTS security context for the CS domain, if any, when the
SRVCC handover from Iu mode to Iu mode has been completed successfully.
If the SRVCC handover from Iu mode to Iu mode has not been completed successfully, the MS and the network shall
delete the new derived GSM or UMTS security context for the CS domain. Additionally, the network shall delete the
already established GSM or UMTS security context for the CS domain, if the CKSN of the already established GSM or
UMTS security context is equal to the CKSN of the new derived GSM or UMTS security context for the CS domain.

At PS to CS domain change from Iu mode to Iu mode due to SRVCC handover of a PDN connection for emergency
bearer services for which integrity protection has not been activated before the SRVCC handover, the MS and the
network shall not perform key derivation.
ETSI
Release 18 104 3GPP TS 24.008 V18.4.0 (2023-09)
4.3.2.12 Derivation of keys at SRVCC handover from Iu mode to A/Gb mode

At PS to CS domain change from Iu mode to A/Gb mode due to SRVCC handover of a PDN connection for which
integrity protection has been activated, ciphering may be started (see 3GPP TS 44.018 [84]) without any new
authentication procedure. Deduction of the appropriate security key for ciphering in A/Gb mode, depends on the current
GSM or UMTS security context for the PS domain stored in the MS and the network.
The ME shall handle the GSM ciphering key according to table 4.3.2.12.1.
Table 4.3.2.12.1/3GPP TS 24.008: SRVCC handover from Iu mode to A/Gb mode
Security context for the PS domain At inter-system change to A/Gb mode:

established in MS and network in Iu mode
GSM security context An ME shall derive the GSM ciphering key (Kc’) from the stored
GPRS GSM ciphering key, which was provided by the SIM/USIM
during the latest successful authentication, and the NONCE
received in the command to perform handover (see
specified in 3GPP TS 33.102 [5a]. The MS shall set the CKSN of
the derived GSM security context for the CS domain to the value
of the GPRS CKSN of the GSM security context for PS domain.
Furthermore, the ME shall apply the new derived GSM ciphering
key and replace an already established GSM security context for
the CS domain, if any, in the SIM/USIM when the SRVCC
handover from Iu mode has been completed successfully.
UMTS security context An ME shall derive the UMTS security keys UMTS ciphering key
(CK’) and UMTS integrity key (IK’) from the GPRS UMTS
ciphering key and GPRS UMTS integrity key, which were
received from the UMTS security context for the PS domain
residing in the USIM, and the NONCE received in the command
to perform handover (see 3GPP TS 25.331 [23c]) as specified in
3GPP TS 33.102 [5a]. The ME shall use the derived UMTS
security keys to derive the GSM ciphering key (Kc’) using the
Furthermore, the MS shall set the CKSN of the derived UMTS
security context for the CS domain to the value of the KSI of the
UMTS security context for PS domain.
If an A5 algorithm is taken into use that requires a 64-bit long
ciphering key, then the ME shall apply the new derived GSM
ciphering key.
If an A5 algorithm is taken into use that requires a 128-bit long
ciphering key, then the ME shall use the derived UMTS security
keys CK' and IK' to derive a GSM Kc128 (see
3GPP TS 33.102 [5a]). After that, the ME shall apply the new
derived GSM Kc128.
Furthermore, the ME shall replace an already established UMTS
security context for the CS domain, if any, in the USIM, when the
SRVCC handover from Iu mode has been completed
successfully.
The network shall replace an already established GSM or UMTS security context for the CS domain, if any, when the
SRVCC handover from Iu mode to A/Gb mode has been completed successfully.
If the SRVCC handover from Iu mode to A/Gb mode has not been completed successfully, the MS and the network
shall delete the new derived GSM or UMTS security context for the CS domain. Additionally, the network shall delete
the already established GSM or UMTS security context for the CS domain, if the CKSN of the already established
GSM or UMTS security context is equal to the CKSN of the new derived GSM or UMTS security context for the CS
domain.
ETSI
Release 18 105 3GPP TS 24.008 V18.4.0 (2023-09)

At PS to CS domain change from Iu mode to A/Gb mode due to SRVCC handover of a PDN connection for emergency
bearer services for which integrity protection has not been activated while in Iu mode, the MS and the network shall not
perform key derivation.
4.3.2.13 Derivation of keys at CS to PS SRVCC handover from A/Gb mode to Iu

mode
At change from A/Gb mode to Iu mode due to CS to PS SRVCC handover (see 3GPP TS 23.216 [126]), the MS shall
derive a UMTS security context for the PS domain from the current GSM or UMTS security context for the CS domain.
At change from A/Gb mode to Iu mode due to CS to PS SRVCC handover, ciphering may be started and integrity
protection shall be started (see 3GPP TS 25.331 [23c]) without any new authentication procedure. Derivation of the
appropriate security keys for ciphering and integrity protection for the PS domain in Iu mode depends on the current
GSM or UMTS security context for the CS domain stored in the MS and the network.
The ME shall handle the PS UMTS ciphering key and the PS UMTS integrity key according to table 4.3.2.13.1.
ETSI
Release 18 106 3GPP TS 24.008 V18.4.0 (2023-09)
Table 4.3.2.13.1/3GPP TS 24.008: CS to PS SRVCC handover from A/Gb mode to Iu mode
Security context for the CS domain At inter-system change to Iu mode:

established in MS and network in A/Gb
mode
GSM security context An ME shall derive the GPRS ciphering key (Kc') from the stored
GSM ciphering key, which was provided by the SIM/USIM during
the latest successful authentication, and the NONCEMSC received
in the command to perform handover (see
specified in 3GPP TS 33.102 [5a]. The ME shall set the GPRS
CKSN' of the derived GPRS security context (Kc') for the PS
domain to the value of the GSM CKSN of the GSM security
context for CS domain. The ME shall use the derived GPRS
ciphering key (Kc') to derive the PS UMTS security keys PS
UMTS ciphering key (CK') and PS UMTS integrity key (IK') for
the PS domain. The conversion functions named "c4" and "c5" in
3GPP TS 33.102 [5a] are used for this purpose. The ME shall
associate the derived keys PS UMTS ciphering key (CK') and PS
UMTS integrity key (IK') for the PS domain with a KSI' which shall
be set to the value of the GPRS CKSN of the derived GPRS
security context (Kc') for the PS domain. Furthermore, the ME
shall apply the new derived PS UMTS security keys (CK', IK')
and replace an already established GPRS security context for the
PS domain, if any, by overwriting the stored GPRS Kc and GPRS
CKSN with the derived GPRS Kc' and GPRS CKSN' in both the
ME and the SIM/USIM, when the CS to PS SRVCC handover
has been completed successfully. Furthermore, the MS shall
handle the STARTPS value as specified in 3GPP TS 33.102 [5a]
and 3GPP TS 25.331 [23c].
UMTS security context An ME shall derive the PS UMTS security keys PS UMTS
ciphering key (CK') and PS UMTS integrity key (IK') from the CS
UMTS ciphering key and the CS UMTS integrity key, which were
received from the UMTS security context for the CS domain
residing in the USIM, and the NONCEMSC received in the
command to perform handover (see 3GPP TS 25.331 [23c]) as
specified in 3GPP TS 33.102 [5a]. The ME shall set the KSI' of
the derived PS UMTS security context (CK' and IK') for the PS
domain to the value of the KSI of the CS UMTS security context
for the CS domain. The ME shall use the derived PS UMTS
security keys (CK' and IK') to derive the GPRS ciphering key
(Kc') using the "c3" conversion function as specified in
3GPP TS 33.102 [5a]. The ME shall set the CKSN' associated
with the derived GPRS ciphering key (Kc') to the value of the KSI
of the derived PS UMTS security context (CK' and IK') for the PS
domain. Furthermore, the ME shall apply the derived PS UMTS
security keys (CK' and IK') and replace an already established
UMTS security context for the PS domain, if any, by overwriting
the stored UMTS PS CK, UMTS PS IK, UMTS PS KSI, GPRS
Kc,and GPRS CKSN with the derived UMTS PS CK', UMTS PS
IK', UMTS PS KSI', GPRS Kc' and GPRS CKSN', in both the ME
and the USIM, when the CS to PS SRVCC handover has been
completed successfully. Furthermore, the MS shall handle the
STARTPS value as specified in 3GPP TS 33.102 [5a] and
3GPP TS 25.331 [23c].
The network shall replace an already established GSM or UMTS security context for the PS domain, if any, when the
CS to PS SRVCC handover from A/Gb mode to Iu mode has been completed successfully.
If the CS to PS SRVCC handover from A/Gb mode to Iu mode has not been completed successfully, the MS and the
network shall delete the new derived GSM or UMTS security context for the PS domain. Additionally, the network
shall delete the already established GSM or UMTS security context for the PS domain, if the GPRS CKSN of the
already established GSM or UMTS security context is equal to the GPRS CKSN of the new derived GSM or UMTS
security context for the PS domain.
ETSI
Release 18 107 3GPP TS 24.008 V18.4.0 (2023-09)
4.3.2.14 Derivation of keys at 5G-SRVCC from NG-RAN to UTRAN
4.3.2.14.1 PDU session with integrity protection

At 5G-SRVCC from NG-RAN to UTRAN handover of a PDU session for which the "null integrity protection
algorithm" 5G-IA0 has not been used (see 3GPP TS 23.216 [126]), when the MS receives the command to perform
handover, the MS shall derive a new KASME_SRVCC from KAMF as specified in 3GPP TS 33.501 [170].
The MS shall set the CKSN of the derived UMTS security context to the value of the eKSI associated with the new
KASME_SRVCC and derive security keys CKSRVCC and IKSRVCC from the new KASME_SRVCC as specified in
3GPP TS 33.401 [123]. The MS shall apply these derived security keys, handle the STARTCS value as specified in
3GPP TS 25.331 [23c] and replace an already established UMTS security context for the CS domain, if any, in the
USIM, when the 5G-SRVCC handover from NG-RAN to UTRAN has been completed successfully.
The network shall replace an already established UMTS security context for the CS domain, if any, when the 5G-
SRVCC handover from NG-RAN to UTRAN has been completed successfully.
If the 5G-SRVCC handover from NG-RAN to UTRAN has not been completed successfully, the MS and the network
shall delete the new derived UMTS security context for the CS domain. Additionally, the network shall delete the
already established UMTS security context for the CS domain, if the CKSN of the already established UMTS security
context is equal to the CKSN of the new derived UMTS security context for the CS domain.
4.3.2.14.2 PDU session without integrity protection

At the 5G-SRVCC from NG-RAN to UTRAN handover of an emergency PDU connection for which the "null integrity
protection algorithm" 5G-IA0 has been used while in N1 mode, the MS and the network shall not perform key
derivation.
4.3.3 Identification procedure
4.3.3.0 General
The identification procedure is used by the network to request a mobile station to provide specific identification
parameters to the network e.g. International Mobile Subscriber Identity (IMSI), International Mobile Equipment
Identity (IMEI). IMEI and IMSI definition and structure are specified in 3GPP TS 23.003 [10].
4.3.3.1 Identity request by the network

The network initiates the identification procedure by sending an IDENTITY REQUEST message to the mobile station
and starting the timer T3270 (see figure 4.3). The IDENTITY REQUEST message specifies the requested identification
parameters in the Identity type information element.
4.3.3.2 Identification response by the mobile station

The mobile station shall be ready to respond to an IDENTITY REQUEST message at any time whilst a RR connection
exists.
Upon receipt of the IDENTITY REQUEST message the mobile station shall send an IDENTITY RESPONSE message.
The IDENTITY RESPONSE message shall contain the identification parameters as requested by the network.
Upon receipt of the IDENTITY REQUEST message with the Identity type IE indicating that P-TMSI, RAI and P-TMSI
signature are being requested, an MS that supports S1 mode shall handle the IDENTITY RESPONSE message as
follows:
- If the TIN indicates "GUTI" and the MS holds a valid GUTI allocated by an MME, the MS shall map the GUTI
into a P-TMSI, P-TMSI signature and RAI as specified in 3GPP TS 23.003 [10]. The MS shall indicate the P-
TMSI in the Mobile identity IE. In addition, the MS shall include the mapped RAI in the Routing area
identification IE and the mapped P-TMSI signature in the P-TMSI signature IE. In addition, the MS shall include
the P-TMSI type IE with P-TMSI type set to "mapped P-TMSI".
ETSI
Release 18 108 3GPP TS 24.008 V18.4.0 (2023-09)
- If the TIN indicates "P-TMSI" or "RAT-related TMSI" and the MS holds a valid P-TMSI and RAI, the MS shall
indicate the P-TMSI in the Mobile identity IE and shall indicate the RAI in the Routing area identification IE. In
addition, the MS shall include the P-TMSI type IE with P-TMSI type set to "native P-TMSI". If the MS holds a
valid P-TMSI signature, it shall include it in the P-TMSI signature IE.
If the MS does not support S1 mode, it shall handle the IDENTITY RESPONSE message as follows:
- If the MS holds a valid P-TMSI and RAI, the MS shall indicate the P-TMSI in the Mobile identity IE and shall
indicate the RAI in the Routing area identification IE. In addition, the MS shall include the P-TMSI type IE with
P-TMSI type set to "native P-TMSI". If the MS holds a valid P-TMSI signature, it shall include it in the P-TMSI
signature IE.
Upon receipt of the IDENTITY RESPONSE message, the network shall stop timer T3270.
4.3.3.3 Abnormal cases in the mobile station

The following abnormal case can be identified:
a) Requested identity is not available
If the MS cannot encode the requested identity in the IDENTITY RESPONSE message, e.g. because no valid
SIM is available, then it shall encode the identity type as "no identity".

Upon detection of a RR connection failure before the IDENTITY RESPONSE message is received, the network
shall release all MM connections (if any) and abort any ongoing MM specific procedure.
b) Expiry of timer T3270:
The identification procedure is supervised by the network by the timer T3270. At expiry of the timer T3270 the
network may release the RR connection. In this case, the network shall abort the identification procedure and any
ongoing MM specific procedure, release all MM connections if any, and initiate the RR connection release
procedure as described in 3GPP TS 44.018 [84] subclause 3.5, 3GPP TS 25.331 [23c] (UTRAN Iu mode only),
or in 3GPP TS 44.118 [111] (GERAN Iu mode only).
Figure 4.3/3GPP TS 24.008: Identification sequence
4.3.4 IMSI detach procedure
4.3.4.0 General
The IMSI detach procedure may be invoked by a mobile station if the mobile station is deactivated or if the Subscriber
Identity Module (see 3GPP TS 42.017 [7] and 3GPP TS 31.102 [112]) is detached from the mobile station or as part of
the eCall inactivity procedure defined in subclause 4.4.7.
In A/Gb mode and GERAN Iu mode, the network indicates whether the IMSI detach/attach procedures are required by
using the ATT flag which is broadcast in the L3-RR SYSTEM INFORMATION TYPE 3 message on the BCCH (see
3GPP TS 44.018 [84] subclause 10.5.2.11). The mobile station shall use the value of the ATT flag that was broadcast
when the mobile station was in the MM IDLE state.
ETSI
Release 18 109 3GPP TS 24.008 V18.4.0 (2023-09)
In UTRAN Iu mode, the network indicates whether the IMSI detach/attach procedures are required by using the ATT
flag which is included in the CS domain specific system information element (see subclause 10.5.1.12.2). The mobile
station shall use the latest received value of the ATT flag.
If a RR connection exists and the ATT flag indicates that the IMSI detach/attach procedures are not required, the MM
sublayer will release locally any ongoing MM connections before releasing the RR connection. If an MM specific
procedure is active, the release of the RR connection may be delayed until the MM specific procedure is complete.
The IMSI detach procedure causes the mobile station to be indicated as inactive in the network.
The mobile station is allowed to initiate the IMSI detach procedure even if the timer T3246 is running.
The network proceeds with the IMSI detach procedure even if NAS level mobility management congestion control is
active.
4.3.4.1 IMSI detach initiation by the mobile station

The IMSI detach procedure consists only of the IMSI DETACH INDICATION message sent from the mobile station to
the network. The mobile station then starts timer T3220 and enters the MM sublayer state IMSI DETACH INITIATED.
If no RR connection exists, the MM sublayer within the mobile station will request the RR sublayer to establish a RR
connection. If establishment of the RR connection is not possible because a suitable cell is not (or not yet) available
then, the mobile station shall try for a period of at least 5 seconds and for not more than a period of 20 seconds to find a
suitable cell. If a suitable cell is found during this time then, the mobile station shall request the RR sublayer to establish
an RR connection, otherwise the IMSI detach is aborted. For:
- a shared GERAN in A/Gb mode, if the MS is a GERAN network sharing supporting MS, the chosen PLMN
identity shall be indicated to the GERAN in the IMSI DETACH INDICATION message using the Skip Indicator
IE as specified in subclause 10.3.1 and;
- a shared UTRAN, the chosen PLMN identity shall be indicated to the UTRAN in the RRC INITIAL DIRECT
TRANSFER message (see 3GPP TS 25.331 [23c]).
If a RR connection exists, the MM sublayer will release locally any ongoing MM connections before the IMSI
DETACH INDICATION message is sent.
The IMSI detach procedure may not be started if a MM specific procedure is active. If possible, the IMSI detach
procedure is then delayed until the MM specific procedure is finished, else the IMSI detach is omitted.
4.3.4.2 IMSI detach procedure in the network

When receiving an IMSI DETACH INDICATION message, the network may set an inactive indication for the IMSI.
No response is returned to the mobile station. After reception of the IMSI DETACH INDICATION message the
network shall release locally any ongoing MM connections, and start the normal RR connection release procedure (see
3GPP TS 44.018 [84] subclause 3.5 (A/Gb mode only), 3GPP TS 25.331 [23c] (UTRAN Iu mode only), or in
3GPP TS 44.118 [111] (GERAN Iu mode only)).
Only applicable for a network supporting VGCS: If an IMSI DETACH INDICATION message is received from the
talking mobile station in a group call while the network is in service state MM CONNECTION ACTIVE (GROUP
TRANSMIT MODE), the network shall release locally the ongoing MM connection and then go to the service state
GROUP CALL ACTIVE.
4.3.4.3 IMSI detach completion by the mobile station

Timer T3220 is stopped when the RR connection is released. The mobile station should, if possible, delay the local
release of the channel to allow a normal release from the network side until T3220 timeout. If this is not possible (e.g.
detach at power down) the RR sublayer on the mobile station side should be aborted.

ETSI
Release 18 110 3GPP TS 24.008 V18.4.0 (2023-09)
a) Lower layer failure
If the establishment of an RR connection is unsuccessful, or the RR connection is lost, the IMSI detach is aborted by
the mobile station.
b) Access barred because of access class control or EAB
The signalling procedure for IMSI detach shall not be started. The MS starts the signalling procedure as soon as
possible and if still necessary, i.e. when the barred state is removed or because of a cell change, or performs a
local detach immediately or after an implementation dependent time.
Figure 4.4/3GPP TS 24.008: IMSI detach sequence
4.3.5 Abort procedure

The abort procedure may be invoked by the network to abort any on-going MM connection establishment or already
established MM connection. The mobile station shall treat ABORT message as compatible with current protocol state
only if it is received when at least one MM connection exists or an MM connection is being established.
4.3.5.1 Abort procedure initiation by the network

The abort procedure consists only of the ABORT message sent from the network to the mobile station. Before the
sending of the ABORT message the network shall locally release any ongoing MM connection. After the sending the
network may start the normal RR connection release procedure.
The Cause information element indicates the reason for the abortion. The following cause values may apply:
# 6: Illegal ME
#17: Network failure
4.3.5.2 Abort procedure in the mobile station

At the receipt of the ABORT message the mobile station shall abort any MM connection establishment or call re-
establishment procedure and release all MM connections (if any). If cause value #6 is received the mobile station shall
delete any TMSI, LAI and ciphering key sequence number stored in the SIM/USIM, set the update status to ROAMING
NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2) and consider the SIM/USIM invalid
until switch off or the SIM/USIM is removed. If the message has been successfully integrity checked by the lower
layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall
set this counter to MS implementation-specific maximum value. As a consequence the mobile station enters state MM
IDLE, substate NO IMSI after the release of the RR connection.
The mobile station shall then wait for the network to release the RR connection - see subclause 4.5.3.1.
4.3.6 MM information procedure

The MM information message support is optional in the network.
The MM information procedure may be invoked by the network at any time during an RR connection.
4.3.6.1 MM information procedure initiation by the network

The MM information procedure consists only of the MM INFORMATION message sent from the network to the
mobile station. During an RR connection, the network shall send none, one, or more MM INFORMATION messages to
the mobile station. If more than one MM INFORMATION message is sent, the messages need not have the same
content.
ETSI
Release 18 111 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE: The network may be able to select particular instants where it can send the MM INFORMATION
message without adding delay to, or interrupting, any CM layer transaction, e.g. immediately after the
AUTHENTICATION REQUEST message.
4.3.6.2 MM information procedure in the mobile station

When the mobile station (supporting the MM information message) receives an MM INFORMATION message, it shall
accept the message and optionally use the contents to update appropriate information stored within the mobile station.
If the mobile station does not support the MM information message the mobile station shall ignore the contents of the
message and return an MM STATUS message with cause #97.
4.4 MM specific procedures

A MM specific procedure can only be started if no other MM specific procedure is running or no MM connection exists
between the network and the mobile station. The end of the running MM specific procedure or the release of all MM
connections have to be awaited before a new MM specific procedure can be started.
During the lifetime of a MM specific procedure, if a MM connection establishment is requested by a CM entity, this
request will either be rejected or be delayed until the running MM specific procedure is terminated (this depends on the
implementation).
Any MM common procedure (except IMSI detach) may be initiated during a MM specific procedure.
Unless it has specific permission from the network (follow-on proceed) the mobile station side should await the release
of the RR connection used for a MM specific procedure before a new MM specific procedure or MM connection
establishment is started.
NOTE: The network side may use the same RR connection for MM connection management.
4.4.1 Location updating procedure

The location updating procedure is a general procedure which is used for the following purposes:
- normal location updating (described in this subclause);
- periodic updating (see subclause 4.4.2); or
- IMSI attach (see subclause 4.4.3).
The normal location updating procedure is used to update the registration of the actual Location Area of a mobile
station in the network. The location updating type information element in the LOCATION UPDATING REQUEST
message shall indicate normal location updating. The conditions under which the normal location updating procedure is
used by a mobile station in the MM IDLE state are defined for each service state in subclause 4.2.2.
Only applicable for mobile stations supporting VGCS listening or VBS listening: A mobile station in RR group receive
mode is in the MM IDLE state, substate RECEIVING GROUP CALL (NORMAL SERVICE) or RECEIVING GROUP
CALL (LIMITED SERVICE). To perform a location updating, the MS in RR group receive mode shall leave the group
receive mode, establish an independent dedicated RR connection to perform the location updating as described above
and return to the RR group receive mode afterwards.
The MS shall also start the normal location updating procedure:
a) if the network indicates that the mobile station is unknown in the VLR as a response to MM connection
establishment request;
b) void
c) when the MS, configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a GERAN or
UTRAN cell in network operation mode II and timer T3423 has expired or is in the GERAN or UTRAN cell in
network operation mode II when timer T3423 expires;
NOTE 1: Timer T3423 is specified in 3GPP TS 24.301 [120].
ETSI
Release 18 112 3GPP TS 24.008 V18.4.0 (2023-09)
d) when the MS, configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a GERAN or
UTRAN cell after intersystem change from S1 mode to Iu or A/Gb mode, if timer T3346 is running, and the
location area of the current cell is the same as the stored location area;
NOTE 2: If inter-system change is due to a mobile originating CS call, the location updating procedure can be
performed after the RR connection is released unless the MS moves back to E-UTRAN.
e) when the MS is both IMSI attached for GPRS and non-GPRS services and enters a new routing area where the
network operates in network operation mode I and timer T3346 is running.
f) when the network is operating in network operation mode I, timer T3346 is running, timer T3246 is not running,
and due to manual CSG selection the MS has selected a CSG cell whose CSG identity and associated PLMN
identity are not included in the Allowed CSG list or in the Operator CSG list of the MS;
g) when due to a manual CSG selection the MS has selected a CSG cell whose CSG identity and associated PLMN
identity are not included in the MS's Allowed CSG list or in the MS's Operator CSG list;
h) when the network is operating in network operation mode I, T3346 is running, update status is not U1
UPDATED and the user manually selects the current PLMN; or
i) when the MS is configured to use CS fallback and SMS over SGs, or SMS over SGs only, and the TIN indicates
"GUTI", enters a GERAN or UTRAN cell after intersystem change from S1 mode to Iu or A/Gb mode in NMO
II and timer T3412 is not running.
If the MS, configured to use CS fallback and SMS over SGs, enters a GERAN or UTRAN cell, after intersystem change
from S1 mode to Iu or A/Gb mode due to CS fallback, and the location area of the current cell is not available, the MS
may initiate the location updating procedure.
When the MS supporting N1 mode in MS operation modes A or B moves from NG-RAN coverage to GERAN
coverage, or from NG-RAN coverage to UTRAN coverage, and the network operates in network operation mode II, the
MS may intiate the normal location updating procedure.
To limit the number of consecutive unsuccessful location updating attempts made, an attempt counter is used. The
detailed handling of the attempt counter is described in subclauses 4.4.4.5 to 4.4.4.9.
The mobile equipment shall contain a list of "forbidden location areas for roaming", as well as a list of "forbidden
location areas for regional provision of service". These lists shall be erased when the MS is switched off or when the
SIM/USIM is removed, and periodically (with period in the range 12 to 24 hours). When the lists are erased, the MS
performs a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98]. The location area identification
received on the BCCH that triggered the location updating request shall be added to the suitable list whenever a
LOCATION AREA UPDATING REJECT message is received with the cause "Roaming not allowed in this location
area", "Location Area not allowed", or "No suitable cells in Location Area". The lists shall accommodate each 10 or
more location area identifications. When the list is full and a new entry has to be inserted, the oldest entry shall be
deleted.
In a shared network, the MS shall choose one of the PLMN identities as specified in 3GPP TS 23.122 [14]. The MS
shall construct the Location Area Identification of the cell from this chosen PLMN identity and the LAC received on the
BCCH. If the constructed LAI is different from the stored LAI, the MS shall initiate the location updating procedure.
For:
- a shared GERAN, in A/Gb mode, the chosen PLMN identity shall be indicated to the GERAN in the
LOCATION UPDATING REQUEST message using the Skip Indicator IE as specified in subclause 10.3.1.
For GERAN Iu mode, network sharing is not supported.
Whenever a LOCATION UPDATING REJECT message with the cause "PLMN not allowed" is received by the MS,
the PLMN identity used to construct the LAI which triggered the location updating procedure shall be stored in the
"forbidden PLMN list" and if the MS is configured to use timer T3245 (see 3GPP TS 24.368 [135] or
3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in subclause 4.1.1.6. Whenever a
LOCATION UPDATING REJECT message is received by the MS with the cause "Roaming not allowed in this
location area", "Location Area not allowed", or "No suitable cells in Location Area", the constructed LAI which
triggered the location updating procedure shall be stored in the suitable list.
ETSI
Release 18 113 3GPP TS 24.008 V18.4.0 (2023-09)
The cell selection processes in the different states are described in 3GPP TS 43.022 [82] and 3GPP TS 45.008 [34].
The location updating procedure is always initiated by the mobile station.
In the case that the mobile station is initiating an emergency call but, due to cell re-selection or redirection by the
network, it moves to a different LAI then the mobile station may delay the location updating procedure in the new LA
until after the emergency call is completed.
4.4.2 Periodic updating

Periodic updating may be used to notify periodically the availability of the mobile station to the network. Periodic
updating is performed by using the location updating procedure. The location updating type information element in the
LOCATION UPDATING REQUEST message shall indicate periodic updating.
The procedure is controlled by the timer T3212 in the mobile station. The MS indicates in the MS network feature
support IE whether it supports the extended value for timer T3212. If the MS receives the Per MS T3212 IE in the
LOCATION UPDATING ACCEPT message, the MS shall use this IE to determine the value of T3212 instead of the
value of T3212 that is broadcast. If the MS does not receive the Per MS T3212 IE in the LOCATION UPDATING
ACCEPT message, the MS shall use the value of T3212 that is broadcast . If the timer is not already started, the timer is
started each time the mobile station enters the MM IDLE substate NORMAL SERVICE or ATTEMPTing TO
UPDATE. When the MS leaves the MM Idle State the timer T3212 shall continue running until explicitly stopped.
The timer is stopped (shall be set to its initial value for the next start) when:
- a LOCATION UPDATING ACCEPT or LOCATION UPDATING REJECT message is received;
- an AUTHENTICATION REJECT message is received;
- the first MM message is received, or security mode setting is completed in the case of MM connection
establishment, except when the most recent service state is LIMITED SERVICE;
- the mobile station has responded to paging and thereafter has received the first correct layer 3 message except
RR message;
- the mobile station is deactivated (i.e. equipment powered down or SIM/USIM removed).
When the timer T3212 expires, the location updating procedure is started and the timer shall be set to its initial value for
the next start. If the mobile station is in other state than MM Idle when the timer expires the location updating
procedure is delayed until the MM Idle State is entered.
The conditions under which the periodic location updating procedure is used by a mobile station in the MM IDLE state
are defined for each service state in subclause 4.2.2.
If the mobile station is in service state NO CELL AVAILABLE, LIMITED SERVICE, PLMN SEARCH or PLMN
SEARCH-NORMAL SERVICE when the timer expires the location updating procedure is delayed until this service
state is left.
In A/Gb mode and GERAN Iu mode, the (periodic) location updating procedure is not started if the BCCH information
at the time the procedure is triggered indicates that periodic location shall not be used. The timeout value is broadcasted
in the L3-RR SYSTEM INFORMATION TYPE 3 message on the BCCH, in the Control channel description IE, see
3GPP TS 44.018 [84] subclause 10.5.2.11.
In UTRAN Iu mode, the (periodic) location updating procedure is not started if the information on BCCH or in the last
received dedicated system information at the time the procedure is triggered indicates that periodic location shall not be
used. The timeout value is included in the CS domain specific system information element.
The T3212 timeout value shall not be changed in the NO CELL AVAILABLE, LIMITED SERVICE, PLMN SEARCH
and PLMN SEARCH-NORMAL SERVICE states.
If the MS, configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a GERAN or UTRAN cell
after intersystem change from S1 mode to Iu or A/Gb mode in NMO II, the TIN indicates "GUTI", and the location area
of the current cell is the same as the stored location area, the MS shall start timer T3212, with a value set to the shorter
of the values of the remaining value of timer T3412, and the broadcast T3212 timeout value.
ETSI
Release 18 114 3GPP TS 24.008 V18.4.0 (2023-09)
When the MS supporting N1 mode in MS operation modes A or B moves from NG-RAN coverage to GERAN
coverage, or from NG-RAN coverage to UTRAN coverage, the network operates in network operation mode II, the
location area of the current cell is the same as the stored location area, the broadcast value of T3212 does not indicate
"deactivated" and the T3212 has expired, the MS may intiate the periodic location updating procedure.
When a change of the broadcast T3212 timeout value has to be taken into account and the timer is running (at change of
the serving cell or, change of the broadcast value of T3212), the MS shall behave as follows: let t1 be the new T3212
timeout value and let t be the current timer value at the moment of the change to the new T3212 timeout value; then the
timer shall be restarted with the value t modulo t1.
When the mobile station is activated, or when a change of the broadcast T3212 timeout value has to be taken into
account and the timer is not running, the mobile station shall behave as follows: let t1 be the new T3212 timeout value,
the new timer shall be started at a value randomly, uniformly drawn between 0 and t1.
4.4.3 IMSI attach procedure

The IMSI attach procedure is the complement of the IMSI detach procedure (see subclause 4.3.4). It is used to indicate
the IMSI as active in the network.
In A/Gb mode and GERAN Iu mode, the network indicates whether the IMSI attach/detach procedures are required by
using the ATT flag which is broadcast in the L3-RR SYSTEM INFORMATION TYPE 3 message (see
3GPP TS 44.018 [84] subclause 10.5.2.11).
In UTRAN Iu mode, the network indicates whether the IMSI attach/detach procedures are required by using the ATT
flag which is included in the CS domain specific system information element (see subclause 10.5.1.12.2).
The IMSI attach procedure is invoked if the ATT flag indicates that the IMSI detach/attach procedures are required and
an IMSI is activated in a mobile station (i.e. activation of a mobile station with plug-in SIM/USIM, insertion of a card
in a card-operated mobile station etc.) within coverage area from the network or a mobile station with an IMSI activated
outside the coverage area enters the coverage area. The IMSI attach procedure is used only if the update status is U1
UPDATED and if the stored location area identification is the same as the one which is actually broadcasted on the
BCCH of the current serving cell.
shall use the IMSI attach procedure only if the update status is U1 UPDATED and the stored location area identification
is equal to the combination of the chosen PLMN identity and the LAC received on the BCCH. Otherwise a normal
location updating procedure (see subclause 4.4.1) is invoked independently of the ATT flag indication.
The IMSI attach procedure is performed by using the location updating procedure (see subclause 4.4.1). The location
updating type information element in the LOCATION UPDATING REQUEST message shall in this case indicate IMSI
attach.
4.4.4 Generic Location Updating procedure
4.4.4.1 Location updating initiation by the mobile station

Any timer used for triggering the location updating procedure (e.g. T3211, T3212) is stopped if running.
As no RR connection exists at the time when the location updating procedure has to be started, the MM sublayer within
the mobile station will request the RR sublayer to establish a RR connection and enter state WAIT FOR RR
CONNECTION (LOCATION UPDATE). The procedure for establishing an RR connection is described in
3GPP TS 44.018 [84] subclause 3.3 and 3GPP TS 25.331 [23c].
The mobile station initiates the location updating procedure by sending a LOCATION UPDATING REQUEST
message to the network, starts the timer T3210 and enters state LOCATION UPDATING INITIATED. The location
updating type information element shall indicate what kind of updating is requested.
If the MS is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and the
selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs, the MS shall include the IMSI in
the Mobile identity IE in the LOCATION UPDATING REQUEST message.
ETSI
Release 18 115 3GPP TS 24.008 V18.4.0 (2023-09)
If the mobile station is configured to use CS fallback and SMS over SGs, or SMS over SGs only, and TIN indicates
"RAT-related TMSI" the mobile station shall set the TIN to "P-TMSI" unless the mobile station had already received
the EMM cause #18 during a combined attach procedure (see subclause 5.5.1.3.4.3 of 3GPP TS 24.301 [120]) or a
combined tracking area updating procedure (see subclause 5.5.3.3.4.3 of 3GPP TS 24.301 [120]) on the same PLMN,
but not disabled the E-UTRAN capability.
4.4.4.1a Network Request for Additional mobile station Capability Information

In A/Gb mode, the network may initiate the classmark interrogation procedure, for example, to obtain further
information on the mobile station's encryption capabilities.
4.4.4.2 Identification request from the network

The network may initiate the identification procedure, e.g. if the network is unable to get the IMSI based on the TMSI
and LAI used as identification by the mobile station (see subclause 4.3.3).
4.4.4.3 Authentication by the network

The authentication procedure (see subclause 4.3.2) may be initiated by the network upon receipt of the LOCATION
UPDATING REQUEST message from the mobile station. (See the cases defined in 3GPP TS 42.009 [5]).
4.4.4.4 Security mode setting by the network

In A/Gb mode, the security mode setting procedure (see 3GPP TS 44.018 [84] subclause 3.4.7) may be initiated by the
network, e.g., if a new TMSI has to be allocated.
In Iu mode, the security mode control procedure (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]) may be
initiated by the network, e.g., if a new TMSI has to be allocated.
4.4.4.5 Location Update Attempt Counter

To limit the number of consecutive unsuccessful location updating attempts, an location update attempt counter is used.
The location update attempt counter counts the number of consecutive unsuccessful location updating attempts.
The location update attempt counter shall be incremented as specified in subclause 4.4.4.9.
The location update attempt counter shall be reset when:
- the mobile station is powered on;
- a SIM/USIM is inserted;
- a location updating procedure is successfully completed;
- a location updating procedure is rejected with cause:
a) #11, #12, #13, #15 or #25 (see subclause 4.4.4.7);
b) #22 and T3346 value IE indicating neither zero nor deactivated (see subclause 4.4.4.7);
- a normal or periodic routing area updating procedure or combined routing updating is not accepted by the
network with cause #11, #12, #13, #15 or #25 (see subclause 4.7.5.1.4 and 4.7.5.2.4);
- GPRS attach or combined GPRS attach procedure is not accepted by the network with cause #11, #12, #13, or
#15 (see subclause 4.7.3.1.4 and 4.7.3.2.4);
- service request procedure is not accepted by the network with cause #12, #13, or #15 (see subclause 4.7.13.4);
- network initiated GPRS detach procedure is completed with cause #12, #13, or #15 (see subclause 4.7.4.2.2);
- combined GPRS attach or combined routing area updating procedure is successful for GPRS and non-GPRS
services; or
ETSI
Release 18 116 3GPP TS 24.008 V18.4.0 (2023-09)
- a new PLMN is selected.
and additionally when the mobile station is in the state MM IDLE sub-state ATTEMPTING to UPDATE:
- a new location area is entered;
- expiry of timer T3212;
- a location updating procedure is triggered upon entering MM IDLE after the release of the last MM connection,
as defined in subclause 4.5.3.1;
- a location updating procedure is triggered by CM sublayer requests; or
- timer T3246 is started.
The location update attempt counter shall be used when deciding whether to re-attempt a location updating procedure
after expiry of timer T3211 as specified in subclause 4.4.4.9.
4.4.4.6 Location updating accepted by the network

If the location updating is accepted by the network a LOCATION UPDATING ACCEPT message is transferred to the
mobile station.
In case the identity confidentiality service is active (see subclauses 4.3.1 and 4.4.4.4), the TMSI reallocation may be
part of the location updating procedure. The TMSI allocated is then contained in the LOCATION UPDATING
ACCEPT message together with the location area identifier LAI. The network shall in this case start the supervision
timer T3250 as described in subclause 4.3.1.
In a shared network, if the MS is a network sharing supporting MS, the network shall indicate in the LAI the PLMN
identity of the CN operator that has accepted the location updating; if the MS is a network sharing non-supporting MS,
the network shall indicate the PLMN identity of the common PLMN (see 3GPP TS 23.251 [109]).
In a multi-operator core network (MOCN) with common GERAN, the network shall indicate in the LAI the common
PLMN identity (see 3GPP TS 23.251 [109]).
If the network wishes to prolong the RR connection to allow the mobile station to initiate MM connection establishment
(for example if the mobile station has indicated in the LOCATION UPDATING REQUEST that it has a follow-on
request pending) the network shall send "follow on proceed" in the LOCATION UPDATING ACCEPT and start timer
T3255.
If the mobile station has indicated "CS fallback mobile terminating call" in the LOCATION UPDATING REQUEST
message, the network shall maintain the RR connection for an implementation dependent duration to allow for mobile
terminating call establishment. If the mobile station has also indicated in the LOCATION UPDATING REQUEST
message that it has a follow-on request pending, it is implementation dependent whether the network proceeds with the
mobile terminating call establishment or allows for a mobile initiated MM connection establishment.
The mobile station receiving a LOCATION UPDATING ACCEPT message shall store the received location area
identification LAI, stop timer T3210, reset the location update attempt counter and set the update status in the
SIM/USIM to UPDATED. If the message contains an IMSI, the mobile station is not allocated any TMSI, and shall
delete any TMSI in the SIM/USIM accordingly. If the message contains a TMSI, the mobile station is allocated this
TMSI, and shall store this TMSI in the SIM/USIM and a TMSI REALLOCATION COMPLETE shall be returned to
the network. If neither IMSI nor TMSI is received in the LOCATION UPDATING ACCEPT message, the old TMSI if
any available shall be kept.
If the MS has initiated the location updating procedure due to manual CSG selection and receives a LOCATION
UPDATING ACCEPT message, and the MS sent the LOCATION UPDATING REQUEST message in a CSG cell, the
MS shall check if the CSG ID and associated PLMN identity of the cell are contained in the Allowed CSG list. If not,
the MS shall add that CSG ID and associated PLMN identity to the Allowed CSG list and the MS may add the HNB
Name (if provided by lower layers) to the Allowed CSG list if the HNB Name is present in neither the Operator CSG
list nor the Allowed CSG list.
If the LAI or PLMN identity contained in the LOCATION UPDATING ACCEPT message is a member of the list of
"forbidden location areas for regional provision of service", the list of "forbidden location areas for roaming" or the
"forbidden PLMN list" then such entries shall be deleted.
ETSI
Release 18 117 3GPP TS 24.008 V18.4.0 (2023-09)
If the MS receives the LOCATION UPDATING ACCEPT message from a PLMN for which a PLMN-specific attempt
counter is maintained (see subclause 4.1.1.6A), then the MS shall reset this counter. If the MS maintains a counter for
"SIM/USIM considered invalid for non-GPRS services", then the MS shall reset this counter.
The network may also send a list of "equivalent PLMNs" in the LOCATION UPDATING ACCEPT message. Each
entry of the list contains a PLMN code (MCC+MNC). If the location updating procedure is initiated during a CS
fallback procedure and the network is configured to support the return to the last registered E-UTRAN PLMN after CS
fallback as specified in 3GPP TS 23.272 [133], and the PLMN identity which is provided as part of the RAI contained
in the ROUTING AREA UPDATE ACCEPT message differs from the last registered E-UTRAN PLMN identity, the
network shall include the last registered E-UTRAN PLMN identity in the list of "equivalent PLMNs" in the
LOCATION UPDATING ACCEPT message.
NOTE 1: The network can determine a location updating procedure is initiated during a CS fallback procedure as
specified in 3GPP TS 23.272 [133].
NOTE 2: The last registered E-UTRAN PLMN identity can be derived by the network as specified in
3GPP TS 23.272 [133].
The mobile station shall store the list, as provided by the network, except that any PLMN code that is already in the
"forbidden PLMN list" shall be removed from the "equivalent PLMNs" list before it is stored by the mobile station. If
the mobile station is supporting S1 mode, it shall also remove any PLMN code that is already in the list of "forbidden
PLMNs for GPRS service" before storing the list. In addition the mobile station shall add to the stored list the PLMN
code of the registered PLMN that sent the list. All PLMNs in the stored list shall be regarded as equivalent to each other
for PLMN selection, cell selection/re-selection and handover. The stored list in the mobile station shall be replaced on
each occurrence of the LOCATION UPDATING ACCEPT message. If no list is contained in the message, then the
stored list in the mobile station shall be deleted. The list shall be stored in the mobile station while switched off so that
it can be used for PLMN selection after switch on.
After that, the mobile station shall act according to the presence of the "Follow-on proceed" information element in the
LOCATION UPDATING ACCEPT; if this element is present and the mobile station has a CM application request
pending, it shall send a CM SERVICE REQUEST to the network and proceed as in subclause 4.5.1.1. Otherwise, it
shall start timer T3240 and enter state WAIT FOR NETWORK COMMAND.
Furthermore, the network may grant authorisation for the mobile station to use GSM-Cordless Telephony System (CTS)
in the Location Area and its immediate neighbourhood. The mobile should memorise this permission in non-volatile
memory. If the "CTS permission" IE is not present in the message, the mobile is not authorised to use GSM-CTS, and
shall accordingly delete any memorised permission.
NOTE 3: The interaction between CTS and GPRS procedures are not yet defined.
The network may also send a Local Emergency Numbers List with local emergency numbers in the LOCATION
UPDATING ACCEPT, by including the Emergency Number List IE. The mobile equipment shall store the Local
Emergency Numbers List, as provided by the network. The Local Emergency Numbers List stored in the mobile
equipment shall be replaced on each receipt of the Emergency Number List IE. The received Local Emergency
Numbers List shall be provided to the upper layers.
The emergency number(s) received in the Emergency Number List IE are valid only in networks in the same country as
the cell on which this IE is received. If no list is contained in the LOCATION UPDATING ACCEPT message, then the
stored Local Emergency Numbers List in the mobile equipment shall be kept, except if the mobile equipment has
successfully registered to a PLMN in a country different from that of the PLMN that sent the Local Emergency
Numbers List.
The mobile equipment shall use the stored Local Emergency Numbers Lt of emergency numbers received from the
network in addition to the emergency numbers stored on the SIM/USIM or ME to detect that the number dialled is an
emergency number.
NOTE 4: The mobile equipment may use the Local Emergency Numbers List to assist the end user in determining
whether the dialled number is intended for an emergency service or for another destination, e.g. a local
directory service. The possible interactions with the end user are implementation specific.
NOTE 5: An MS that supports procedures specified in 3GPP TS 24.302 [156], can get additional local emergency
numbers through those procedures, which can be used based on operator policy (see
3GPP TS 24.302 [156]) to detect that the number dialled is an emergency number.
ETSI
Release 18 118 3GPP TS 24.008 V18.4.0 (2023-09)
The Local Emergency Numbers List shall be deleted at switch off and removal of the SIM/USIM. The mobile
equipment shall be able to store up to ten local emergency numbers received from the network.
4.4.4.7 Location updating not accepted by the network

If the location updating cannot be accepted, the network sends a LOCATION UPDATING REJECT message to the
mobile station. The mobile station receiving a LOCATION UPDATING REJECT message containing a reject cause
other than MM cause value #25 or the message is integrity protected, shall stop the timer T3210, store the reject cause,
start the timer T3240, enter state LOCATION UPDATING REJECTED, await the release of the RR connection
triggered by the network, and for all causes except #12, #15, #22 and #25 deletes the list of "equivalent PLMNs".
If the LOCATION UPDATING REJECT message containing the MM cause value #25 was received without integrity
protection, then the MS shall discard the message.
If the location updating is rejected due to general NAS level mobility management congestion control, the network shall
set the MM cause value to #22 "congestion" and assign a back-off timer T3246 (see 3GPP TS 23.012 [140]).
Upon the release of the RR connection, the mobile station shall take the following actions depending on the stored
reject cause:
# 2: (IMSI unknown in HLR);
# 3: (Illegal MS); or
# 6: (Illegal ME).
The mobile station shall set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM
according to subclause 4.1.2.2), and delete any TMSI, stored LAI and ciphering key sequence number and shall
consider the SIM/USIM as invalid for non-GPRS services until switch-off or the SIM/USIM is removed or the
timer T3245 expires as described in subclause 4.1.1.6. If the message has been successfully integrity checked by
the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services",
then the MS shall set this counter to MS implementation-specific maximum value.
# 11: (PLMN not allowed);
The mobile station shall delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM,
reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it
in the SIM/USIM according to subclause 4.1.2.2). The mobile station shall store the PLMN identity in the
"forbidden PLMN list" and if the MS is configured to use timer T3245 (see 3GPP TS 24.368 [135] or
3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in subclause 4.1.1.6. If the
message has been successfully integrity checked by the lower layers and the MS maintains a PLMN-specific
attempt counter for that PLMN, then the MS shall set this counter to the MS implementation-specific maximum
value.
The MS shall perform a PLMN selection when back to the MM IDLE state according to 3GPP TS 23.122 [14].
An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to performing a
PLMN selection from this list according to 3GPP TS 23.122 [14].
# 12: (Location Area not allowed);
The mobile station shall delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM,
reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it
in the SIM/USIM according to subclause 4.1.2.2).
The mobile station shall store the LAI in the list of "forbidden location areas for regional provision of service".
The MS shall perform a cell selection when back to the MM IDLE state according to 3GPP TS 43.022 [82] and
3GPP TS 25.304 [98].
NOTE 1: The cell selection procedure is not applicable for an MS in GAN mode.
# 13: (Roaming not allowed in this location area).
ETSI
Release 18 119 3GPP TS 24.008 V18.4.0 (2023-09)
The mobile station shall reset the location update attempt counter, and set the update status to ROAMING NOT
ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2).
The mobile station shall store the LAI in the list of "forbidden location areas for roaming".
The mobile station shall perform a PLMN selection instead of a cell selection when back to the MM IDLE state
according to 3GPP TS 23.122 [14].
An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to performing a
# 15: (No Suitable Cells In Location Area).
The mobile station shall reset the location update attempt counter, set the update status to ROAMING NOT
The mobile station shall search for a suitable cell in another location area or a tracking area according to
# 22: (Congestion).
If the T3246 value IE is present in the LOCATION UPDATING REJECT message and the value indicates that
this timer is neither zero nor deactivated, the mobile station shall proceed as described below, otherwise it shall
be considered as an abnormal case and the behaviour of the MS for this case is specified in subclause 4.4.4.9.
The mobile station shall abort the location updating procedure, reset the location update attempt counter, set the
MM update status to U2 NOT UPDATED and change to state MM IDLE sub-state ATTEMPTING TO
UPDATE.
The MS shall stop timer T3246 if it is running.
If the LOCATION UPDATING REJECT message is integrity protected, the mobile station shall start timer
T3246 with the value provided in the T3246 value IE.
If the LOCATION UPDATING REJECT message is not integrity protected, the mobile station shall start timer
T3246 with a random value from the default range specified in table 11.1.
The mobile station stays in the current serving cell and applies the normal cell reselection process. The MM
connection establishment is started, if still necessary, when timer T3246 expires or is stopped.
# 25: (Not authorized for this CSG ).
Cause #25 is only applicable in UTRAN Iu mode and when received from a CSG cell. Other cases are
considered as abnormal cases and the specification of the mobile station behaviour is given in subclause 4.4.4.9.
The MS shall reset the location update attempt counter, and set the update status to ROAMING NOT
If the CSG ID and associated PLMN identity of the cell where the MS has sent the LOCATION UPDATING
REQUEST message are contained in the Allowed CSG list stored in the MS, the MS shall remove the entry
corresponding to this CSG ID and associated PLMN identity from the Allowed CSG list.
If the CSG ID and associated PLMN identity of the cell where the MS has sent the LOCATION UPDATING
REQUEST message are contained in the Operator CSG list, the MS shall proceed as specified in 3GPP TS
23.122 [14] subclause 3.1A.
The MS shall search for a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].
Other values are considered as abnormal cases and the specification of the mobile station behaviour in those cases is
given in subclause 4.4.4.9.
ETSI
Release 18 120 3GPP TS 24.008 V18.4.0 (2023-09)
4.4.4.8 Release of RR connection after location updating

When the Location updating procedure is finished (see subclauses 4.4.4.6 and 4.4.4.7) the mobile station shall (except
in the case where the mobile has a follow-on CM application request pending and has received the follow-on proceed
indication, see subclause 4.4.4.6) set timer T3240 and enter the state WAIT FOR NETWORK COMMAND, expecting
the release of the RR connection. The network may decide to keep the RR connection for network initiated
establishment of a MM connection, or to allow for mobile initiated MM connection establishment.
Any release of the RR connection shall be initiated by the network according to subclause 3.5 in 3GPP TS 44.018 [84],
and 3GPP TS 25.331 [23c]. If the RR connection is not released within a given time controlled by the timer T3240, the
mobile station shall abort the RR connection. In both cases, either after a RR connection release triggered from the
network side or after a RR connection abort requested by the MS-side, the MS shall return to state MM IDLE.
At transition to state MM IDLE, substates NORMAL SERVICE or RECEIVING GROUP CALL (NORMAL
SERVICE) or ATTEMPTING TO UPDATE either timer T3212 or timer T3211 is started as described in
subclause 4.4.4.9, or, timer T3246 is started as described in subclauses 4.4.4.7, 4.4.4.9 and 4.5.1.1.
If the MS receives the "Extended wait time" for CS domain from the lower layers when no location updating or CM
service request procedure is ongoing, the MS shall ignore the "Extended wait time".
4.4.4.9 Abnormal cases on the mobile station side

The different abnormal cases that can be identified are the following:
a) Access barred because of access class control or EAB
The location updating procedure is not started. The mobile station stays in the current serving cell and applies
normal cell reselection process. The procedure is started as soon as possible and if still necessary (when the
barred state is ended or because of a cell change).
b) The answer to random access is an IMMEDIATE ASSIGNMENT REJECT message (A/Gb mode only)
The location updating is not started. The mobile station stays in the chosen cell and applies normal cell selection
process. The waiting timer T3122 is reset when a cell change occurs. The procedure is started as soon as possible
after T3122 timeout if still necessary.
c) Random access failure (A/Gb mode only)
Timer T3213 is started. When it expires the procedure is attempted again if still necessary.
NOTE 1: As specified in 3GPP TS 45.008 [34], a cell reselection then takes place, with return to the cell inhibited
for 5 seconds if there is at least one other suitable cell. Typically the selection process will take the
mobile station back to the cell where the random access failed after 5 seconds.
If at the expiry of timer T3213 a new cell has not been selected due to the lack of valid information (see
3GPP TS 45.008 [34]), the mobile station may as an option delay the repeated attempt for up to 8 seconds to
allow cell re-selection to take place. In this case the procedure is attempted as soon as a new cell has been
selected or the mobile station has concluded that no other cell can be selected.
If random access failure occurs for two successive random access attempts for location updating the mobile
station proceeds as specified below.
d) RR connection failure
The procedure is aborted and the mobile station proceeds as specified below.
e) T3210 timeout
The procedure is aborted, the RR connection is aborted and the MS proceeds as specified below.
f) RR release without "Extended Wait Time" received from lower layers before the normal end of procedure
The procedure is aborted and the mobile station proceeds as specified below, except in the following
implementation option case f.1.
ETSI
Release 18 121 3GPP TS 24.008 V18.4.0 (2023-09)
f.1)RR release in Iu mode (i.e. RRC connection release) with, for example, cause "Normal", "User inactivity" or
"Directed signalling connection re-establishment" (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111])
The location updating procedure shall be initiated again, if the following conditions apply:
i) The original location updating procedure was initiated over an existing RRC connection; and
ii) No SECURITY MODE COMMAND message and no Non-Access Stratum (NAS) messages relating to
the CS signalling connection (e.g. CS authentication procedures, see subclause 4.3.2), were received after the
LOCATION UPDATING REQUEST message was transmitted.
NOTE 2: The RRC connection release cause that triggers the re-initiation of the location updating procedure is
implementation specific.
g) Location updating reject, other causes than those treated in subclause 4.4.4.7, and cases of MM cause values #22
and #25, if considered as abnormal cases according to subclause 4.4.4.7
Upon reception of the cause codes #22, # 95, # 96, # 97, # 99 and # 111 the MS should set the location update
attempt counter to 4. The MS waits for release of the RR connection as specified in subclause 4.4.4.8.
The MS shall proceed as described below.
h) RR connection establishment failure without "Extended Wait Time" received from lower layers (Iu mode only)
The procedure is aborted and the mobile station proceeds as specified below.
NOTE 3: Case h) covers all cases when the signalling connection cannot be established, including random access
failure and access reject. As the RRC protocol has error specific retransmission mechanisms (see
3GPP TS 25.331 [23c]), there is no need to distinguish between the different error cases within MM.
i) "Extended wait time" for CS domain from the lower layers
The MS shall abort the location updating procedure and stop timer T3210 if still running.
If the LOCATION UPDATING REQUEST message contained the low priority indicator set to "MS is
configured for NAS signalling low priority", the MS shall start timer T3246 with the "Extended wait time" value
and reset the location update attempt counter.
In other cases the MS shall ignore the "Extended wait time".
Additionally, the MS shall set the MM update status to U2 NOT UPDATED and change to state MM IDLE sub-
state ATTEMPTING TO UPDATE. The MS stays in the current serving cell and applies normal cell reselection
process. The location updating procedure is started, if still necessary, when timer T3246 expires or is stopped,
and the MS proceeds as specified below.
j) Timer T3246 is running
The location updating procedure shall not be initiated unless the MS is establishing an emergency call or the MS
is an MS configured to use AC11 – 15 in selected PLMN. The MS stays in the current serving cell and applies
normal cell reselection process. The location updating procedure is started, if still necessary, when timer T3246
expires or is stopped.
In cases d) to i) (except in the case f.1 and except in the case i) when timer T3246 is started) above, and, for repeated
failures as defined in c) above, the mobile station proceeds as follows. Timer T3210 is stopped if still running. The RR
Connection is aborted in case of timer T3210 timeout. The location update attempt counter is incremented. The next
actions depend on the Location Area Identities (stored and received from the BCCH of the current serving cell) and the
value of the location update attempt counter.
– the update status is UPDATED, and the stored LAI is equal to the one received on the BCCH from the current
serving cell and the location update attempt counter is smaller than 4:
The mobile station shall keep the update status to UPDATED, the MM IDLE sub-state after the RR connection
release is NORMAL SERVICE. The mobile station shall memorize the location updating type used in the
location updating procedure. It shall start timer T3211 when the RR connection is released. When timer T3211
or T3246 expires the location updating procedure is triggered again with the memorized location updating type;
ETSI
Release 18 122 3GPP TS 24.008 V18.4.0 (2023-09)
– either the update status is different from UPDATED, or the stored LAI is different from the one received on the
BCCH from the current serving cell, or the location update attempt counter is greater or equal to 4:
When the RR connection is released the mobile station shall delete any LAI, TMSI, ciphering key sequence
number stored in the SIM/USIM, and set the update status to NOT UPDATED. A mobile station which is not a
GPRS MS shall also delete the list of equivalent PLMNs. The mobile station shall enter the MM IDLE sub-state
ATTEMPTING TO UPDATE (see subclause 4.2.2.2 for the subsequent actions) or optionally the MM IDLE
sub-state PLMN SEARCH (see subclause 4.2.1.2) in order to perform a PLMN selection according to
3GPP TS 23.122 [14]. If the location update attempt counter is smaller than 4, the mobile station shall memorize
that timer T3211 is to be started when the RR connection is released, otherwise it shall memorize that timer
T3212 is to be started when the RR connection is released.

a) RR connection failure
If a RR connection failure occurs during a common procedure integrated with the location updating procedure, the
behaviour of the network should be according to the description of that common procedure.
If a RR connection failure occurs when a common procedure does not exist, the location updating procedure towards
the mobile station should be aborted.
b) protocol error
If the LOCATION UPDATING REQUEST message is received with a protocol error, the network should, if possible,
return a LOCATION UPDATING REJECT message with one of the following Reject causes:
#96: Mandatory information element error
#99: Information element non-existent or not implemented
#100: Conditional IE error
#111: Protocol error, unspecified
Having sent the response, the network should start the channel release procedure (see subclause 3.5).
Figure 4.5/3GPP TS 24.008: Location updating sequence
4.4.5 Void
4.4.6 Void
4.4.7 eCall inactivity procedure

The eCall inactivity procedure is applicable only to an eCall only mobile station (as determined by information
configured in USIM). The procedure shall be started when:
- the mobile station is in any MM Idle state except NO IMSI, NO CELL AVAILABLE or PLMN SEARCH;
- the mobile station is in GMM-NULL or GMM-DEREGISTERED state; and
- one of the following conditions applies:
- timer T3242 expires or is found to have already expired and T3243 is not running;
ETSI
Release 18 123 3GPP TS 24.008 V18.4.0 (2023-09)
- timer T3243 expires or is found to have already expired and T3242 is not running; or
- timer T3242 and timer T3243 expire or are found to have already expired.
The mobile station shall then stop other running timers (e.g. T3211, T3212, T3213) and shall perform the IMSI detach
procedure if required by the serving network and if the update state is U1. The mobile station then enters MM Idle
eCALL INACTIVE state and the mobile station shall delete any LAI, TMSI, ciphering key sequence number stored in
the SIM/USIM and set the update state to U4 Updating Disabled.
While in eCALL INACTIVE state, the mobile station maintains awareness of a potential serving cell in a potential
serving network but initiates no MM signalling with the network and ignores any paging requests.
The mobile station shall leave eCALL INACTIVE state only when one of the following events occur:
- if the SIM or USIM is removed, the mobile station enters the NO IMSI state;
- if coverage is lost, the mobile station enters PLMN SEARCH state;
- if the mobile station is deactivated (e.g. powered off) by the user: the mobile station enters the NULL state;
- if there is a CM request for an emergency services call: the mobile station should follow the procedure for return
to state MM-IDLE in subclause 4.2.3 and attempt a location update. The MS then uses the MM and CM
procedures to establish the emergency call at the earliest opportunity; or
NOTE 1: If an eCall only device has not successfully completed a location update procedure, PSAP callback will
not be possible due to its calling line identity being unavailable at the PSAP.
NOTE 2: An eCall only device uses the CS domain to originate an emergency services call when in A/Gb or Iu
mode, even if the device is capable of eCall over IMS.
- if there is a CM request for a call to an HPLMN designated non-emergency MSISDN for the purpose of
accessing test and terminal reconfiguration services: the mobile station follows the procedure for return to state
MM-IDLE in subclause 4.2.3 and attempts a normal location update. Once this is complete, further MM and CM
procedures are used to establish the non-emergency call.
NOTE 3: An eCall only device uses the CS domain to originate a call to an HPLMN designated non-emergency
MSISDN for the purpose of accessing test and terminal reconfiguration services when in A/Gb or Iu
mode, even if the device is capable of eCall over IMS.
4.5 Connection management sublayer service provision

The concept of MM connection is introduced in this subclause. This concept is mainly a descriptive tool: The
establishment of an MM connection by the network can be local (i.e. it is achieved by the transmission of the first CM
layer message and without the transmission of any MM layer messages) or can be achieved by the transmission of a CM
SERVICE PROMPT message (eg. in the case of certain ring back services). The release of an MM connection by the
network or by the mobile station is always local, i.e. these purposes can be achieved without sending any MM messages
over the radio interface. (On the contrary, establishment of an MM connection by the mobile station requires the
sending of MM messages over the radio interface. An exception is VGCS, where an MM connection will be established
as result of an uplink access procedure (see subclause 3.7.2.1.1in 3GPP TS 44.018 [84]).)
The Mobility Management (MM) sublayer is providing connection management services to the different entities of the
upper Connection management (CM) sublayer (see 3GPP TS 24.007 [20]). It offers to a CM entity the possibility to use
an MM connection for the exchange of information with its peer entity. An MM connection is established and released
on request from a CM entity. Different CM entities communicate with their peer entity using different MM connections.
Several MM connections may be active at the same time.
An MM connection requires an RR connection. All simultaneous MM connections for a given mobile station use the
same RR connection.
In the following subclauses, the procedures for establishing, re-establishing, maintaining, and releasing an MM
connection are described, usually separately for the mobile station and the network side.
ETSI
Release 18 124 3GPP TS 24.008 V18.4.0 (2023-09)
4.5.1 MM connection establishment
4.5.1.1 MM connection establishment initiated by the mobile station

Upon request of a CM entity to establish an MM connection the MM sublayer first decides whether to accept, delay, or
reject this request:
- An MM connection establishment may only be initiated by the mobile station when the following conditions are
fulfilled:
- Its update status is UPDATED.
- The MM sublayer is in one of the states MM IDLE, RR CONNECTION RELEASE NOT ALLOWED or
MM connection active but not in MM connection active (Group call).
An exception from this general rule exists for emergency calls (see subclause 4.5.1.5). A further exception is
defined in the following clause.
- If an MM specific procedure is running at the time the request from the CM sublayer is received, and the
LOCATION UPDATING REQUEST message has been sent, the request will either be rejected or delayed,
depending on implementation, until the MM specific procedure is finished and, provided that the network has
not sent a "follow-on proceed" indication, the RR connection is released. If the LOCATION UPDATING
REQUEST message has not been sent, the mobile station may include a "follow-on request" indicator in the
message. The mobile station shall then delay the request until the MM specific procedure is completed, when it
may be given the opportunity by the network to use the RR connection: see subclause 4.4.4.6.
In order to establish an MM connection, the mobile station proceeds as follows:
a) If no RR connection exists, the MM sublayer requests the RR sublayer to establish an RR connection and enters
MM sublayer state WAIT FOR RR CONNECTION (MM CONNECTION). This request contains an
establishment cause and a CM SERVICE REQUEST message. When the establishment of an RR connection is
indicated by the RR sublayer, the MM sublayer of the mobile station starts timer T3230, gives an indication to
the CM entity that requested the MM connection establishment, and enters MM sublayer state WAIT FOR
OUTGOING MM CONNECTION.
b) If an RR connection is available, the MM sublayer of the mobile station sends a CM SERVICE REQUEST
message to the network, starts timer T3230, stops and resets timer T3241, gives an indication to the CM entity
that requested the MM connection establishment, and enters:
- MM sublayer state WAIT FOR OUTGOING MM CONNECTION, if no MM connection is active;
- MM sublayer state WAIT FOR ADDITIONAL OUTGOING MM CONNECTION, if at least one MM

connection is active;
- If an RR connection exists but the mobile station is in the state WAIT FOR NETWORK COMMAND then
any requests from the CM layer that are received will either be rejected or delayed until this state is left.
c) Only applicable for mobile stations supporting VGCS talking:
If a mobile station which is in the MM sublayer state MM IDLE, service state RECEIVING GROUP CALL
(NORMAL SERVICE), receives a request from the GCC sublayer to perform an uplink access, the MM sublayer
requests the RR sublayer to perform an uplink access procedure and enters MM sublayer state WAIT FOR RR
CONNECTION (GROUP TRANSMIT MODE).
When a successful uplink access is indicated by the RR sublayer, the MM sublayer of the mobile station gives an
indication to the GCC sublayer and enters MM sublayer state MM CONNECTION ACTIVE (GROUP
TRANSMIT MODE).
When an uplink access reject is indicated by the RR sublayer, the MM sublayer of the mobile station gives an
indication to the GCC sublayer and enters the MM sublayer state MM IDLE, service state RECEIVING GROUP
CALL (NORMAL SERVICE).
In the network, if an uplink access procedure is performed, the RR sublayer in the network provides an
indication to the MM sublayer together with the mobile subscriber identity received in the TALKER
ETSI
Release 18 125 3GPP TS 24.008 V18.4.0 (2023-09)
INDICATION message. The network shall then enter the MM sublayer state MM CONNECTION ACTIVE
(GROUP TRANSMIT MODE).
d) When the MS is IMSI attached for CS services via EMM combined procedures, as described in
3GPP TS 24.301 [120], and the MS is camping on an E-UTRAN cell, and if T3246 is not running, the MM
sublayer requests EMM to initiate a service request procedure for CS fallback. The MM connection
establishment is delayed until the MS changes to a GERAN or UTRAN cell.
If the MS enters a GERAN or UTRAN cell, then the MS shall initiate the MM connection establishment and
send a CM SERVICE REQUEST message. The MS shall include the Additional update parameters information
element indicating "CS fallback mobile originating call". If the MS determines that it is in a different location
area than the stored location area, the MS shall first initiate a normal location updating procedure regardless of
Network Mode of Operation. If the location area of the current cell is not available, the MS may initiate a normal
location updating procedure directly. The MM connection establishment is delayed until successful completion
of the normal location updating procedure. Additionally the MS performs routing area updating as specified in
subclause 4.7.5. If the normal location updating procedure is initiated, the MS shall indicate the "follow-on
request pending", shall include the Additional update parameters information element indicating"CS fallback
mobile originating call", and shall not include the MS network feature support information element in the
LOCATION UPDATING REQUEST message.
In case a, b and d, the CM SERVICE REQUEST message contains the:
- mobile identity according to subclause 10.5.1.4;
- mobile station classmark 2;
- ciphering key sequence number; and
- CM service type identifying the requested type of transaction (e.g. mobile originating call establishment,
emergency call establishment, short message service, supplementary service activation, location services).
A MS supporting eMLPP may optionally include a priority level in the CM SERVICE REQUEST message.
For MM connection establishment involving a shared GERAN network in A/Gb mode, if the MS is a GERAN network
sharing supporting MS, the chosen PLMN identity shall be indicated to the GERAN in the CM SERVICE REQUEST
message using the Skip Indicator IE as specified in subclause 10.3.1.
A collision may occur when a CM layer message is received by the mobile station in MM sublayer state WAIT FOR
OUTGOING MM CONNECTION or in WAIT FOR ADDITIONAL OUTGOING MM CONNECTION. In this case
the MM sublayer in the MS shall establish a new MM connection for the incoming CM message as specified in
subclause 4.5.1.3.
Upon receiving a CM SERVICE REQUEST message, the network shall analyse its content. The type of semantic
analysis may depend on other on going MM connection(s). Depending on the type of request and the current status of
the RR connection, the network may start any of the MM common procedures and RR procedures.
In A/Gb mode, the network may initiate the classmark interrogation procedure, for example, to obtain further
information on the mobile station's encryption capabilities.
The identification procedure (see subclause 4.3.3) may be invoked for instance if a TMSI provided by the mobile
station is not recognized.
The network may invoke the authentication procedure (see subclause 4.3.2) depending on the CM service type.
In A/Gb mode, the network decides also if the ciphering mode setting procedure shall be invoked (see subclause 3.4.7
in 3GPP TS 44.018 [84]).
In Iu mode, the network decides also if the security mode control procedure shall be invoked (see
3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
NOTE 1: If the CM_SERVICE_REQUEST message contains a priority level the network may use this to perform
queuing and pre-emption as defined in 3GPP TS 23.067 [88].
In A/Gb mode, the MS shall consider the MM connection establishment to be completed when:
- receiving an indication from the RR sublayer that the ciphering mode setting procedure is completed; or
ETSI
Release 18 126 3GPP TS 24.008 V18.4.0 (2023-09)
- receiving a CM SERVICE ACCEPT message.
In Iu mode, the MS shall consider the MM connection establishment to be completed when
- receiving an indication from the RR sublayer that the security mode control procedure is completed, except for
the case when it is the first security mode control procedure after successful inter-system change received in MM
sublayer state WAIT FOR ADDITIONAL OUTGOING MM CONNECTION; or
- receiving a CM SERVICE ACCEPT message.
The procedures in subclause 4.1.1.1.1 shall always have precedence over this subclause.
In Iu mode, during a MM connection establishment for all services, except for emergency call (see subclause 4.1.1.1.1),
the security mode control procedure with activation of integrity protection shall be invoked by the network unless
integrity protection is already started (see subclause 4.1.1.1.1).
The MM connection establishment is completed, timer T3230 shall be stopped, the CM entity that requested the MM
connection shall be informed, and MM sublayer state MM CONNECTION ACTIVE is entered. The MM connection is
considered to be active.
If the service request cannot be accepted, the network returns a CM SERVICE REJECT message to the mobile station.
The reject cause information element (see subclause 10.5.3.6 and annex G) indicates the reason for rejection. The
following cause values may apply:
#4: IMSI unknown in VLR
#6: Illegal ME
#17: Network failure
#22: Congestion
#25 Not authorized for this CSG
#32: Service option not supported
#33: Requested service option not subscribed
#34: Service option temporarily out of order
If the service request is rejected due to general NAS level mobility management congestion control, the network shall
If no other MM connection is active, the network may start the RR connection release (see subclause 3.5 of
3GPP TS 44.018 [84] (A/Gb mode only), 3GPP TS 25.331 [23c] (UTRAN Iu mode only), or in 3GPP TS 44.118 [111]
(GERAN Iu mode only) when the CM SERVICE REJECT message is sent.
If a CM SERVICE REJECT message is received by the mobile station, timer T3230 shall be stopped, the requesting
CM sublayer entity informed. Then the mobile station shall proceed as follows:
- If the cause value is not #4 or #6 or #25 received from a CSG cell and the MS is in UTRAN Iu mode, the MM
sublayer returns to the previous state (the state where the request was received). Other MM connections shall not
be affected by the CM SERVICE REJECT message.
- If cause value #4 is received, the mobile station aborts any MM connection, deletes any TMSI, LAI and
ciphering key sequence number in the SIM/USIM, changes the update status to NOT UPDATED (and stores it in
the SIM/USIM according to subclause 4.1.2.2), and enters the MM sublayer state WAIT FOR NETWORK
COMMAND. If subsequently the RR connection is released or aborted, this will force the mobile station to
initiate a normal location updating). Whether the CM request shall be memorized during the location updating
procedure, is a choice of implementation.
- If cause value #6 is received, the mobile station aborts any MM connection, deletes any TMSI, LAI and
ciphering key sequence number in the SIM/USIM, changes the update status to ROAMING NOT ALLOWED
(and stores it in the SIM/USIM according to subclause 4.1.2.2), and enters the MM sublayer state WAIT FOR
NETWORK COMMAND. The mobile station shall consider the SIM/USIM as invalid for non-GPRS services
ETSI
Release 18 127 3GPP TS 24.008 V18.4.0 (2023-09)
until switch-off or the SIM/USIM is removed. If the message has been successfully integrity checked by the
lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then
the MS shall set this counter to MS implementation-specific maximum value.
- If cause value #22 is received, the T3246 value IE is present in the CM SERVICE REJECT message and the
value indicates that this timer is neither zero nor deactivated, the MS shall check whether the CM SERVICE
REJECT message with cause #22 is integrity protected and shall stop timer T3246 if it is running. If the message
is integrity protected, the MS shall start timer T3246 with the value provided in the T3246 value IE. Otherwise,
the MS shall start timer T3246 with a random value from the default range specified in table 11.1.The MS stays
in the current serving cell and applies normal cell reselection process. The service request procedure may be
started by CM layer, if it is still necessary, when timer T3246 expires or is stopped.
If cause value #22 is received, the T3246 value IE is not present in the CM SERVICE REJECT message or if the
T3246 value IE the value indicates that this timer is zero or deactivated, the same actions as on timer expiry in
subclause 4.5.1.2 shall be taken by the mobile station.
- If cause value #25 is received from a CSG cell and the MS is in UTRAN Iu mode, the MS shall check whether
the CM SERVICE REJECT message with cause #25 is integrity protected. If the message is not integrity
protected, the MS shall discard the message. Otherwise, the MS shall abort any MM connection, remove the
entry corresponding to the CSG ID and associated PLMN identity of the cell where the MS has sent the CM
SERVICE REQUEST message from the Allowed CSG list if the CSG ID and associated PLMN identity are
contained in the Allowed CSG list, and enter the MM sublayer state WAIT FOR NETWORK COMMAND. If
the CSG ID and associated PLMN identity of the cell where the MS has sent the CM SERVICE REQUEST
message is contained in the Operator CSG list, the MS shall proceed as specified in 3GPP TS 23.122 [14]
subclause 3.1A. Subsequently, after the RR connection is released or aborted, the MS applies normal cell
reselection process.
If cause value #25 is received and the cell is not a CSG cell or the MS is not in UTRAN Iu mode, the MS shall
discard the CM SERVICE REJECT message.

Mobile station side:
a) RR connection failure without "Extended Wait Time" received from lower layers or IMSI deactivation
If an RR connection failure occurs, except in the following implementation option case a.1, or the IMSI is
deactivated during the establishment of an MM connection, the MM connection establishment is aborted, timers
T3230 is stopped, and an indication is given to the CM entity that requested the MM connection establishment.
This shall be treated as a rejection for establishment of the new MM connection, and the MM sublayer shall
release all active MM connections.
a.1) RR connection failure in Iu mode (i.e. RRC connection release) with, for example, cause "Normal", "User
inactivity" or "Directed signalling connection re-establishment" (see 3GPP TS 25.331 [23c] and
3GPP TS 44.118 [111])
The MM connection establishment procedure shall be initiated again, if the following conditions apply:
i) The original MM connection establishment was initiated over an existing RRC connection; and
ii) No SECURITY MODE COMMAND message and no Non-Access Stratum (NAS) messages relating to the
CS signalling connection (e.g. CS authentication procedures, see subclause 4.3.2), were received after the
CM SERVICE REQUEST message was transmitted.
NOTE 1: The RRC connection release cause that triggers the re-initiation of the MM connection establishment
procedure is implementation specific.
b) T3230 expiry
If T3230 expires (i.e. no response is given but a RR connection is available) the MM connection establishment is
aborted and the requesting CM sublayer is informed. If no other MM connection exists then the mobile station
shall proceed as described in subclause 4.5.3.1 for release of the RR connection. Otherwise the mobile station
shall return to the MM sublayer state where the request of an MM connection was received, i.e. to MM sublayer
state MM connection active. Other ongoing MM connections (if any) shall not be affected.
ETSI
Release 18 128 3GPP TS 24.008 V18.4.0 (2023-09)
c) Reject cause values #95, #96, #97, #99, #100, #111 received
The same actions as on timer expiry shall be taken by the mobile station.
d) Random access failure or RR connection establishment failure without "Extended Wait Time" received from
lower layers
If the mobile station detects a random access failure or RR connection establishment failure during the
establishment of an MM connection, it aborts the MM connection establishment and gives an indication to the
CM entity that requested the MM connection establishment.
NOTE 2: Further actions of the mobile station depend on the RR procedures and MM specific procedures during
which the abnormal situation has occurred and are described together with those procedures.
e) Access barred because of access class control or EAB
The MM connection establishment shall not be initiated. The MS stays in the current serving cell and applies
normal cell reselection process. The MM connection establishment may be initiated by CM layer if it is still
necessary, i.e. when access is granted or because of a cell change.
f) Indication that a CS fallback to GERAN or UTRAN has failed
If EMM indicates that the CS fallback to GERAN or UTRAN failed, the MM sublayer shall abort the MM
connection establishment and inform the requesting CM sublayer.
g) "Extended wait time" for CS domain from the lower layers
The MS shall abort the MM connection establishment and stop timer T3230 if still running.
If the CM SERVICE REQUEST message contained the low priority indicator set to "MS is configured for NAS
signalling low priority", the MS shall start timer T3246 with the "Extended wait time" value.
The MM connection establishment is started, if still necessary, when timer T3246 expires or is stopped.
h) Timer T3246 is running
The MM connection establishment shall not be initiated unless the MS is establishing an emergency call or the
MS is an MS configured to use AC11 – 15 in selected PLMN. The MS stays in the current serving cell and
applies normal cell reselection process. The MM connection establishment is started, if still necessary, when
timer T3246 expires or is stopped.
Network side:
The actions to be taken upon RR connection failure within a MM common procedure are described together with
that procedure. A RR connection failure occurring outside such MM common procedures, shall trigger the
release of all active MM connections if any.
b) Invalid message or message content
Upon reception of an invalid initial message or a CM SERVICE REQUEST message with invalid content, a CM
SERVICE REJECT message shall be returned with one of the following appropriate Reject cause indications:
# 95: Semantically incorrect message
# 96: Mandatory information element error
# 97: Message type non-existent or not implemented
# 99: Information element non-existent or not implemented
# 100: Conditional IE error
# 111: Protocol error, unspecified
ETSI
Release 18 129 3GPP TS 24.008 V18.4.0 (2023-09)
When the CM SERVICE REJECT message has been sent, the network may start RR connection release if no
other MM connections exist or if the abnormal condition also has influence on the other MM connections.
4.5.1.3 MM connection establishment initiated by the network
4.5.1.3.1 Mobile Terminating CM Activity

When a CM sublayer entity in the network requests the MM sublayer to establish a MM connection, the MM sublayer
will request the establishment of an RR connection to the RR sublayer if no RR connection to the desired mobile station
exists. The MM sublayer is informed when the paging procedure is finished (see 3GPP TS 44.018 [84] subclause 3.3.2
and 3GPP TS 25.331 [23c]) and the mobile station shall enter the MM state WAIT FOR NETWORK COMMAND and
stop the timer T3246 if running.
In A/Gb mode, when an RR connection is established (or if it already exists at the time the request is received), the MM
sublayer may initiate any of the MM common procedures (except IMSI detach); it may request the RR sublayer to
perform the RR classmark interrogation procedure, and/or the security mode setting procedure.
In Iu mode, when an RR connection is established (or if it already exists at the time the request is received), the MM
sublayer may initiate any of the MM common procedures (except IMSI detach); it may request the RR sublayer to
perform the security mode control procedure.
When all MM and RR procedures are successfully completed which the network considers necessary, the MM sublayer
will inform the requesting mobile terminating CM sublayer entity on the success of the MM connection establishment.
If an RR connection already exists and no MM specific procedure is running, the network may also establish a new
mobile terminating MM connection by sending a CM message with a new PD/TI combination.
If the MS receives the first CM message in the MM states WAIT FOR NETWORK COMMAND or RR
CONNECTION RELEASE NOT ALLOWED, the MS shall stop and reset the timers T3240 and T3241 and shall enter
the MM state MM CONNECTION ACTIVE.
In A/Gb mode, if the establishment of an RR connection is unsuccessful, or if any of the MM common procedures or
the security mode setting fail, this is indicated to the CM layer with an appropriate error cause.
In Iu mode, if the establishment of an RR connection is unsuccessful, or if any of the MM common procedures or the
security mode control fail, this is indicated to the CM layer with an appropriate error cause.
If an RR connection used for a MM specific procedure exists to the mobile station, the CM request may be rejected or
delayed depending on implementation. When the MM specific procedure has been completed, the network may use the
same RR connection for the delayed CM request.
Only applicable in case of VGCS talking:
In the MM CONNECTION ACTIVE (GROUP TRANSMIT MODE) the mobile station is in RR Group transmit mode.
There shall be only one MM connection active.
When in MM CONNECTION ACTIVE (GROUP TRANSMIT MODE) state, the MM sublayer in the network shall
reject the request for the establishment of another MM connection by any CM layer.
If the RR sublayer in the network indicates a request to perform a transfer of the mobile station from RR connected
mode to RR Group transmit mode which will result in a transition from MM CONNECTION ACTIVE state to MM
CONNECTION ACTIVE (GROUP TRANSMIT MODE) state in the MM sublayer, the MM sublayer shall not allow
the transition if more than one MM connection is active with the mobile station.
ETSI
Release 18 130 3GPP TS 24.008 V18.4.0 (2023-09)
4.5.1.3.2 Mobile Originating CM Activity $(CCBS)$

When a CM sublayer entity in the network requests the MM sublayer to establish a MM connection, the MM sublayer
will request the establishment of an RR connection to the RR sublayer if no RR connection to the desired mobile station
exists. The MM sublayer is informed when the paging procedure is finished (see 3GPP TS 44.018 [84] subclause 3.3.2
and 3GPP TS 25.331 [23c]) and the mobile station shall enter the MM state WAIT FOR NETWORK COMMAND.
In A/Gb mode, when an RR connection is established (or if it already exists at the time the request is received), the MM
sublayer may initiate any of the MM common procedures (except IMSI detach), it may request the RR sublayer to
perform the RR classmark interrogation procedure and/or the security mode setting procedure.
In Iu mode, when an RR connection is established (or if it already exists at the time the request is received), the MM
sublayer may initiate any of the MM common procedures (except IMSI detach), it may request the RR sublayer to
perform the security mode control procedure.
The network should use the information contained in the Mobile Station Classmark Type 2 IE on the mobile station's
support for "Network Initiated MO CM Connection Request" to determine whether to:
not start this procedure (eg if an RR connection already exists), or,
to continue this procedure, or,
to release the newly established RR connection.
In the case of a "Network Initiated MO CM Connection Request" the network shall use the established RR connection
to send a CM SERVICE PROMPT message to the mobile station.
If the mobile station supports "Network Initiated MO CM Connection Request", the MM sublayer of the MS gives an
indication to the CM entity identified by the CM SERVICE PROMPT message and enters the MM sublayer state
PROCESS CM SERVICE PROMPT. In the state PROCESS CM SERVICE PROMPT the MM sublayer waits for
either the rejection or confirmation of the recall by the identified CM entity. Any other requests from the CM entities
shall either be rejected or delayed until this state is left.
When the identified CM entity informs the MM sublayer, that it has send the first CM message in order to start the CM
recall procedure the MM sublayer enters the state MM CONNECTION ACTIVE.
If the identified CM entity indicates that it will not perform the CM recall procedure and all MM connections are
released by their CM entities the MS shall proceed according to subclause 4.5.3.1.
If the CM SERVICE PROMPT message is received by the MS in MM sublayer states WAIT FOR OUTGOING MM
CONNECTION or in WAIT FOR ADDITIONAL OUTGOING MM CONNECTION then the mobile station shall send
an MM STATUS message with cause " Message not compatible with protocol state".
A mobile that does not support "Network Initiated MO CM Connection Request" shall return an MM STATUS message
with cause #97 "message type non-existent or not implemented" to the network.
If the mobile station supports "Network Initiated MO CM Connection Request" but the identified CM entity in the
mobile station does not provide the associated support, then the mobile station shall send an MM STATUS message
with cause "Service option not supported". In the case of a temporary CM problem (eg lack of transaction identifiers)
then the mobile station shall send an MM STATUS message with cause "Service option temporarily out of order".
If an RR connection already exists and no MM specific procedure is running, the network may use it to send the CM
SERVICE PROMPT message.
In A/Gb mode, if the establishment of an RR connection is unsuccessful, or if any of the MM common procedures or
the security mode setting fail, this is indicated to the CM layer in the network with an appropriate error cause.
In Iu mode, if the establishment of an RR connection is unsuccessful, or if any of the MM common procedures or the
security mode control fail, this is indicated to the CM layer in the network with an appropriate error cause.
If an RR connection used for a MM specific procedure exists to the mobile station, the "Network Initiated MO CM
Connection Request" may be rejected or delayed depending on implementation. When the MM specific procedure has
been completed, the network may use the same RR connection for the delayed "Network Initiated MO CM Connection
Request".
ETSI
Release 18 131 3GPP TS 24.008 V18.4.0 (2023-09)
4.5.1.3.3 Paging response in Iu mode (Iu mode only)

The network may initiate the paging procedure for CS services when the MS is IMSI attached for CS services. To
initiate the procedure, the MM entity requests the RR sublayer to initiate paging (see 3GPP TS 25.331 [23c],
3GPP TS 25.413 [19c] and 3GPP TS 44.118 [111]) for CS services.
At reception of a paging message, the RR sublayer in the MS shall deliver a paging indication to the MM sublayer if the
paging was initiated by the MM entity in the network (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]) and the
MS shall stop the timer T3246, if running. The MS shall respond with the PAGING RESPONSE message defined in
3GPP TS 44.018 [84], subclause 9.1.25. For reasons of backward compatibility the paging response shall use the RR
protocol discriminator.
If the MS receives a paging request for CS services during an ongoing MM procedure, and the MS has already
requested the establishment of a radio connection, the MS shall ignore the paging request and the MS and the network
shall continue the MM procedure.
4.5.1.3.4 Paging response for CS fallback

The network may initiate the paging procedure for CS services when the MS is IMSI attached for CS services via EMM
combined procedures, as described in 3GPP TS 24.301 [120].
At reception of an indication of paging for CS services from EMM, the MS shall stop timer T3246, if it is running. The
MM sublayer in the MS requests EMM to perform the service request procedure for CS fallback.
After the MS changes to a GERAN or UTRAN cell, the MS shall:
- In A/Gb mode: ask for the establishment of an RR connection and proceed as if a paging has been received in
the lower layers;
- In Iu mode: ask for the establishment of an RRC connection and respond with the PAGING RESPONSE
message defined in 3GPP TS 44.018 [84], subclause 9.1.25. For reasons of backward compatibility the paging
response shall use the RR protocol discriminator.
If the MS determines, before sending the response to paging, that it is in a different location area than the stored
location area, the MS shall initiate a normal location updating procedure first, regardless of Network Mode of
Operation. Additionally the MS performs routing area updating as specified in subclause 4.7.5. If the location area of
the current cell is not available, the MS may initiate a normal location updating procedure directly.
When initiating the location updating procedure, the MS shall indicate "CS fallback mobile terminating call" in the
Additional update parameters IE and the MS shall not include the MS network feature support IE. The MM connection
establishment is delayed until successful completion of the normal location updating procedure. After the completion of
the normal location updating procedure, the MS shall not send the PAGING RESPONSE message.
NOTE: For the race condition when the mobile station has a CM application request pending, the mobile station
also indicates that it has a follow-on request pending.

The behaviour upon abnormal events is described together with the relevant RR procedure or MM common procedure.
In addition, the following abnormal events can be identified:
a) Indication that a CS fallback to GERAN or UTRAN has failed
If EMM indicates that the CS fallback to GERAN or UTRAN failed, the MM sublayer shall abort the paging
response procedure.
b) Paging message for an MS which is IMSI attached for GPRS and for non-GPRS services in order to obtain
GPRS services and "SMS-only service"
An MS that received the GPRS-SMS indicator set to "0" at the last combined GPRS attach or combined routing
area updating procedure may ignore the paging for CS services.
ETSI
Release 18 132 3GPP TS 24.008 V18.4.0 (2023-09)
An MS that requested "SMS-only service" in the combined GPRS attach procedure or combined routing area
updating procedure may ignore the paging for CS services.
NOTE: A network that is compliant with the earlier versions of the protocol will implicitly indicate to the MS that
the delivery of SMS via GPRS is always supported, i.e. as GPRS-SMS indicator set to "0", even if it does
not provide this support to the MS. The MS can learn whether SMS over GPRS is provided by using the
mechanism defined in 3GPP TS 24.011 [22], subclause 2.6. If the MS learns that SMS over GPRS is
provided, the MS can ignore paging for CS services.
4.5.1.5 MM connection establishment for emergency calls

A MM connection for an emergency call may be established in all states of the mobility management sublayer which
allow MM connection establishment for a normal originating call. In addition, establishment may be attempted in all
service states where a cell is selected (see subclause 4.2.2) but not in the MM CONNECTION ACTIVE state (GROUP
TRANSMIT MODE) state. However, as a network dependent option, a MM connection establishment for emergency
call may be rejected in some of the states.
When a user requests an emergency call establishment the mobile station will send a CM SERVICE REQUEST
message to the network with a CM service type information element indicating emergency call establishment. If the
network does not accept the emergency call request, e.g., because IMEI was used as identification and this capability is
not supported by the network, the network will reject the request by returning a CM SERVICE REJECT message to the
mobile station.
The reject cause information element indicates the reason for rejection. The following cause values may apply:
#3 "Illegal MS"
#4 "IMSI unknown in VLR"
#5 "IMEI not accepted"
#6 " Illegal ME"
#17 "Network failure"
#22 "Congestion"
#25 "Not authorized for this CSG"
#32 "Service option not supported"
#34 "Service option temporarily out of order"
With the above defined exceptions, the procedures described for MM connection establishment in subclauses 4.5.1.1
and 4.5.1.2 shall be followed.
NOTE: Normally, the mobile station will be identified by an IMSI or a TMSI. However, if none of these
identifiers is available in the mobile station, then the mobile station shall use the IMEI for identification
purposes. The network may in that case reject the request by returning a CM SERVICE REJECT message
with reject cause: #5 "IMEI not accepted".
4.5.1.5a MM connection establishment for emergency calls for CS fallback

When the MS is in NO CELL AVAILABLE state, camped on an E-UTRAN cell, and IMSI attached for CS services via
EMM combined procedures, as described in 3GPP TS 24.301 [120], the MM sublayer requests EMM to initiate a
service request procedure for mobile originating CS fallback emergency call, irrespective of whether timer T3246 is
running. The MM connection establishment is delayed until the mobile station changes to a GERAN or UTRAN cell.
After this point, the behaviour specified in subclause 4.5.1.5 applies.
When the MS is not IMSI attached for CS services via EMM combined procedures, as described in
3GPP TS 24.301 [120], and the MS is camping on an E-UTRAN cell, the MS shall perform any cell selection to
GERAN or UTRAN (see 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98]). The MM connection establishment is
delayed until the MS changes to a GERAN or UTRAN cell. After this point, the behaviour specified in
subclause 4.5.1.5 applies.
ETSI
Release 18 133 3GPP TS 24.008 V18.4.0 (2023-09)
4.5.1.6 Call re-establishment

The re-establishment procedure allows a MS to resume a connection in progress after a radio link failure, possibly in a
new cell and possibly in a new location area. The conditions in which to attempt call re-establishment or not depend on
the call control state, see subclause 5.5.4 and, whether or not a cell allowing call re-establishment has been found (as
described in 3GPP TS 45.008 [34]). MM connections are identified by their protocol discriminators and transaction
identifiers: these shall not be changed during call re-establishment.
The re-establishment takes place when a lower layer failure occurs and at least one MM connection is active (i.e. the
mobile station's MM sublayer is either in state 6 "MM CONNECTION ACTIVE" or state 20 "WAIT FOR
ADDITIONAL OUTGOING MM CONNECTION").
NOTE: During a re-establishment attempt the mobile station does not return to the MM IDLE state; thus no
location updating is performed even if the mobile is not updated in the location area of the selected cell.
No call re-establishment shall be performed for voice group and broadcast calls.
4.5.1.6.1 Call re-establishment, initiation by the mobile station

NOTE: The network is unable to initiate call re-establishment.
If at least one request to re-establish an MM connection is received from a CM entity as a response to the indication that
the MM connection is interrupted (see subclause 4.5.2.3.) the mobile station initiates the call re-establishment
procedure. If several CM entities request re-establishment only one re-establishment procedure is initiated. If any CM
entity requests re-establishment, then re-establishment of all transactions belonging to all Protocol Discriminators that
permit Call Re-establishment shall be attempted.
Upon request of a CM entity to re-establish an MM connection the MM sublayer requests the RR sublayer to establish
an RR connection and enters MM sublayer state WAIT FOR REESTABLISH. This request contains an establishment
cause and a CM RE-ESTABLISHMENT REQUEST message. When the establishment of an RR connection is
indicated by the RR sublayer, the MM sublayer of the mobile station starts timer T3230, gives an indication to all CM
entities that are being re-established, and remains in the MM sublayer state WAIT FOR REESTABLISH.
The CM RE-ESTABLISHMENT REQUEST message contains the
- mobile identity according to subclause 10.5.1.4;
- mobile station classmark 2;
- ciphering key sequence number.
NOTE: Whether or not a CM entity can request re-establishment depends upon the Protocol Discriminator. The
specifications for Short Message Service (3GPP TS 24.011 [22]), Call Independent Supplementary
Services (3GPP TS 24.010 [21]) and Location Services (3GPP TS 44.071 [23a]) do not currently specify
any re-establishment procedures.
For a shared GERAN in A/Gb mode, if the MS is a GERAN network sharing supporting MS, the chosen PLMN
identity shall be indicated to the GERAN in the CM RE-ESTABLISHMENT REQUEST message using the Skip
Indicator IE as specified in subclause 10.3.1.
Upon receiving a CM RE-ESTABLISHMENT REQUEST message, the network shall analyse its content. Depending
on the type of request, the network may start any of the MM common procedures and RR procedures.
The network may initiate the classmark interrogation procedure, for example, to obtain further information on the
mobile station's encryption capabilities.
The identification procedure (see subclause 4.3.3) may be invoked.
The network may invoke the authentication procedure (see subclause 4.3.2).
In A/Gb mode, the network decides if the security mode setting procedure shall be invoked (see 3GPP TS 44.018 [84]
subclause 3.4.7).
An indication from the RR sublayer that the security mode setting procedure is completed, or reception of a CM
SERVICE ACCEPT message, shall be treated as a service acceptance indication by the mobile station.
ETSI
Release 18 134 3GPP TS 24.008 V18.4.0 (2023-09)
In Iu mode, the network decides if the security mode control procedure shall be invoked (see 3GPP TS 25.331 [23c] and
3GPP TS 44.118 [111]). An indication from the RR sublayer that the security mode control procedure is completed, or
reception of a CM SERVICE ACCEPT message, shall be treated as a service acceptance indication by the mobile
station.
The MM connection re-establishment is completed, timer T3230 shall be stopped, all CM entities associated with the
re-establishment shall be informed, and MM sublayer state MM CONNECTION ACTIVE is re-entered. All the MM
connections are considered to be active.
If the network cannot associate the re-establishment request with any existing call for that mobile station, a CM
SERVICE REJECT message is returned with the reject cause:
#38 "call cannot be identified"
If call re-establishment cannot be performed for other reasons, a CM SERVICE REJECT is returned, the appropriate
reject cause may be any of the following (see annex G):
#4 "IMSI unknown in VLR";
#6 "illegal ME";
#17 "network failure";
#22 "congestion";
#25 "not authorized for this CSG";
#32 "service option not supported";
#34 "service option temporarily out of order".
If the service request is rejected due to general NAS level mobility management congestion control, the network shall
Whatever the reject cause a mobile station receiving a CM SERVICE REJECT as a response to the CM RE-
ESTABLISHMENT REQUEST shall stop T3230, release all MM connections and proceed as described in
subclause 4.5.3.1. In addition:
- if cause value #4 is received, the mobile station deletes any TMSI, LAI and ciphering key sequence number in
the SIM/USIM, changes the update status to NOT UPDATED (and stores it in the SIM/USIM according to
subclause 4.1.2.2), and enters the MM sublayer state WAIT FOR NETWORK COMMAND. If subsequently the
RR connection is released or aborted, this will force the mobile station to initiate a normal location updating. The
CM re-establishment request shall not be memorized during the location updating procedure.
- if cause value #6 is received, the mobile station deletes any TMSI, LAI and ciphering key sequence number in
the SIM/USIM, changes the update status to ROAMING NOT ALLOWED (and stores it in the SIM/USIM
according to subclause 4.1.2.2), and enters the MM sublayer state WAIT FOR NETWORK COMMAND. The
MS shall consider the SIM/USIM as invalid for non-GPRS services until switch-off or the SIM/USIM is
removed.
- If cause value # 22 is received, the T3246 value IE is present in the CM SERVICE REJECT message and the
value indicates that this timer is neither zero nor deactivated, the MS shall abort the re-establishment, release any
MM connections, and proceed as specified in subclause 4.5.3.1. The MS shall stop timer T3246 if it is running.
If the CM SERVICE REJECT message is integrity protected, the MS shall start timer T3246 with the value
provided in the T3246 value IE. If the CM SERVICE REJECT message is not integrity protected, the MS shall
start timer T3246 with a random value from the default range specified in table 11.1. The MS stays in the current
serving cell and applies the normal cell reselection process. The CM RE-ESTABLISHMENT REQUEST
procedure should not be restarted when timer T3246 expires or is stopped.
If cause value #22 is received, the T3246 value IE is not present in the CM SERVICE REJECT message or if the
value provided in the T3246 value IE indicates that this timer is zero or deactivated, the MS shall abort the re-
establishment, release any MM connections, and proceed as specified in subclause 4.5.3.1.
- if cause value #25 is received from a CSG cell and the mobile station is in UTRAN Iu mode, the MS shall check
whether the CM SERVICE REJECT message with cause #25 is integrity protected. If the message is not
ETSI
Release 18 135 3GPP TS 24.008 V18.4.0 (2023-09)
integrity protected, the MS shall discard the message. Otherwise, the MS shall remove the entry corresponding
to the CSG ID and associated PLMN identity of the cell where the MS has sent the CM SERVICE REQUEST
message from the Allowed CSG list if the CSG ID and associated PLMN identity are contained in the Allowed
CSG list, and enter the MM sublayer state WAIT FOR NETWORK COMMAND. If the CSG ID and associated
PLMN identity of the cell where the MS has sent the CM SERVICE REQUEST message is contained in the
Operator CSG list, the MS shall proceed as specified in 3GPP TS 23.122 [14] subclause 3.1A.
If cause value #25 is received and the cell is not a CSG cell or the MS is not in UTRAN Iu mode, the MS shall
discard the CM SERVICE REJECT message.
4.5.1.6.2 Abnormal cases

Mobile station side:
a) Random access failure or RR connection establishment failure
If the mobile station detects a random access failure or RR connection establishment failure during the re-
establishment of an MM connection, the re-establishment is aborted and all MM connections are released.
b) RR connection failure
If a RR connection failure occurs, timer T3230 is stopped, the re-establishment is aborted and all active MM
connections are released.
c) IMSI deactivation
If the IMSI deactivated during the re-establishment attempt then timer T3230 is stopped, the re-establishment is
aborted and all MM connections are released.
d) T3230 expires
If T3230 expires (i.e. no response is given but a RR connection is available) the re-establishment is aborted, all
active MM connections are released and the mobile station proceeds as described in subclause 4.5.3.1.
e) Reject causes #96, #97, #99, #100, #111 received
The mobile station shall perform the same actions as if timer T3230 had expired.
Network side:
If a RR connection failure occurs after receipt of the CM RE-ESTABLISHMENT REQUEST the network shall
release all MM connections.
b) Invalid message content
Upon reception an invalid initial of message or a CM RE-ESTABLISHMENT REQUEST message with invalid
content, a CM SERVICE REJECT message shall be returned with one of the following appropriate Reject cause
indications:
#96: Mandatory information element error
#99: Information element non-existent or not implemented
#100: Conditional IE error
#111: Protocol error, unspecified
When the CM SERVICE REJECT message has been sent, the network shall release the RR connection.
4.5.1.7 Forced release during MO MM connection establishment

If the mobile station's CM layer initiated the MM connection establishment but the CM layer wishes to abort the
establishment prior to the completion of the establishment phase, the mobile station shall send a CM SERVICE
ETSI
Release 18 136 3GPP TS 24.008 V18.4.0 (2023-09)
ABORT message any time after the completion of the RR connection and not after the first CM message (e.g. SETUP)
is sent.
If the first CM message has already been sent, the normal release procedure defined by the appropriate CM protocol
applies and the CM SERVICE ABORT shall not be sent.
Sending of the CM SERVICE ABORT message is only allowed during the establishment of the first MM connection,
where no other MM connection exists in parallel. If parallel MM connections exist already, a new connection
establishment cannot be aborted and normal MM connection release according to subclause 4.5.3 applies after MM
connection establishment.
Upon transmission of the CM SERVICE ABORT message the mobile station shall stop timer T3230 and shall follow
the procedures specified in subclause 4.5.3.1.
Upon receipt of the CM SERVICE ABORT message the network shall abort ongoing processes, release the appropriate
resources, and unless another MM connection establishment is pending or an RRLP procedure (see
3GPP TS 44.031 [23b]) or LCS procedure over RRC (see 3GPP TS 25.331 [23c]) is ongoing, initiate a normal release
of the RR connection.
4.5.1.8 MM connection establishment due to SRVCC or vSRVCC handover

An MM connection can be established locally in the MS due to an SRVCC or vSRVCC handover (see
3GPP TS 23.216 [126]), i.e. without dedicated MM signalling. That is the case when the MS has:
- a voice media stream carried over the PS domain that is handed over to the CS domain in A/Gb mode or Iu mode
via SRVCC;
- a voice media stream and a video media stream of a single session carried over the PS domain in S1 mode that is
handed over to the CS domain in Iu mode via vSRVCC;
- a voice media stream and a video media stream of a single session carried over the PS domain in S1 mode but
only the voice media stream is handed over to the CS domain in A/Gb mode via SRVCC; or
- a voice media stream carried over the PS domain in N1 mode that is handed over to the CS domain in Iu mode
via 5G-SRVCC handover from NG-RAN to UTRAN.
An MS in MM state MM IDLE shall establish the MM connection locally when it receives an indication from lower
layers that either a voice only SRVCC handover or a voice and video SRVCC handover was completed successfully.
After completing MM connection establishment, the MM layer shall indicate "MM connection establishment due to
SRVCC handover" or "MM connection establishment due to vSRVCC handover" to the upper layer and shall enter state
MM CONNECTION ACTIVE.
4.5.1.9 MM connection establishment due to Dual Radio Voice Call Continuity

(DRVCC) access transfer
The MM Connection establishment procedures for a dual radio voice call continuity (DRVCC) access transfer follow
the procedures described in subclause 4.5.1.1 with the following additions:
Upon request from the upper layers to set up a DRVCC call, the MS shall initiate the MM connection establishment and
send a CM SERVICE REQUEST message. The MS shall include the Additional update parameters information element
indicating "DRVCC call". If the MS determines that it is in a different location area than the stored location area, the
MS shall first initiate a normal location updating procedure regardless of Network Mode of Operation. The MS shall
indicate "follow-on request pending", shall include the Additional update parameters information element indicating
"DRVCC call", and shall not include the MS network feature support information element in the LOCATION
UPDATING REQUEST message.
The network may use the "DRVCC call" indication to decide whether to initiate any of the MM common procedures.
If the MS and the network have an established GSM security context or UMTS security context, the MS and the
network may take the key(s) of the established security context into use as specified in subclause 4.3.2.7a.
ETSI
Release 18 137 3GPP TS 24.008 V18.4.0 (2023-09)
4.5.2 MM connection information transfer phase

After the MM connection has been established, it can be used by the CM sublayer entity for information transfer.
According to the protocol architecture described in 3GPP TS 24.007 [20], each CM entity will have its own MM
connection. These different MM connections are identified by the protocol discriminator PD and, additionally, by the
transaction identifier TI.
All MM common procedures may be initiated at any time while MM connections are active. Except for Short Message
Control which uses a separate layer 2 low priority data link, no priority mechanism is defined between the CM, MM
and RR sublayer messages.
4.5.2.1 Sending CM messages

A CM sublayer entity, after having been advised that a MM connection has been established, can request the transfer of
CM messages. The CM messages passed to the MM sublayer are then sent to the other side of the interface with the PD
and TI set according to the source entity.
4.5.2.2 Receiving CM messages

Upon receiving a CM message, the MM sublayer will distribute it to the relevant CM entity according to the PD value
and TI value. However, if the received CM message is the first for the MM connection (identified by PD and TI), the
MM sublayer will in addition indicate to the CM entity that a new MM connection has been established.

RR connection failure:
If the RR connection failure occurs during a RR or MM common procedure, the consequent actions are
described together with that procedure.
In other cases, the following applies:
- Mobile station:
The MM sublayer shall indicate to all CM entities associated with active MM connections that the MM
connection is interrupted, the subsequent action of the MM sublayer (call re-establishment, see 4.5.1.6, or
local release) will then depend on the decisions by the CM entities.
- Network:
The MM sublayer shall locally release all active MM connections. As an option the network may delay the
release of all or some of the MM connections to allow the mobile station to initiate call re-establishment.
4.5.3 MM connection release

An established MM connection can be released by the local CM entity. The release of the CM connection will then be
done locally in the MM sublayer, i.e. no MM message are sent over the radio interface for this purpose.
4.5.3.1 Release of associated RR connection

If all MM connections are released by their CM entities, and no RRLP procedure (see 3GPP TS 44.031 [23b]) and no
LCS procedure over RRC (see 3GPP TS 25.331 [23c]) is ongoing, the mobile station shall set timer T3240 and enter the
state WAIT FOR NETWORK COMMAND, expecting the release of the RR connection.
If all MM connections are released by their CM entities and an RRLP procedure or LCS procedure over RRC is
ongoing, the MS shall start the timer T3241 and enter the state RR CONNECTION RELEASE NOT ALLOWED.
If the MS is expecting the release of the RR connection in MM state WAIT FOR NETWORK COMMAND and an
RRLP procedure or LCS procedure over RRC is started, the MS shall stop the timer T3240, start the timer T3241 and
enter the state RR CONNECTION RELEASE NOT ALLOWED.
ETSI
Release 18 138 3GPP TS 24.008 V18.4.0 (2023-09)
If the MS is in MM state RR CONNECTION RELEASE NOT ALLOWED and the ongoing RRLP procedure or LCS
procedure over RRC is finished, the MS shall stop the timer T3241, reset and start the timer T3240 and shall enter the
state WAIT FOR NETWORK COMMAND.
If the MS receives the "Extended wait time" for CS domain from the lower layers when no location updating or CM
service request procedure is ongoing, the MS shall ignore the "Extended wait time".
In the network, if the last MM connection is released by its user, the MM sublayer may decide to release the RR
connection. The RR connection may be maintained by the network, e.g. in order to establish another MM connection.
If the RR connection is not released within a given time controlled by the timer T3240 or T3241, the mobile station
shall abort the RR connection. In both cases, either after a RR connection release triggered from the network side or
after a RR connection abort requested by the MS-side, the MS shall return to MM IDLE state; the service state
depending upon the current update status as specified in subclause 4.2.3. If the UE determines a service state in which a
Location Update procedure is required, the UE shall reset the location update attempt counter and immediately start the
Location Updating procedure as specified in subclause 4.4.4.
4.5.3.2 Uplink release in a voice group call

(Only applicable for mobile stations supporting VGCS talking:)
If a mobile station which is in the MM sublayer state MM CONNECTION ACTIVE (GROUP TRANSMIT MODE)
receives a request from the GCC sublayer to perform an uplink release, the MM sublayer requests the RR sublayer to
perform an uplink release procedure and enters the MM sublayer state RECEIVING GROUP CALL (NORMAL
SERVICE).
4.6 Receiving a MM STATUS message by a MM entity.

If the MM entity of the mobile station receives a MM STATUS message no state transition and no specific action shall
be taken as seen from the radio interface, i.e. local actions are possible.
With the exceptions described for the responses to the CM SERVICE PROMPT message, the actions to be taken on
receiving a MM STATUS message in the network are an implementation dependent option.
4.7 Elementary mobility management procedures for GPRS

services
4.7.1 General
This subclause describes the basic functions offered by the mobility management (GMM) sublayer at the radio interface
(reference point Um/UU). The functionality is described in terms of timers and procedures. During GMM procedures,
procedures of CM layer services via the PS domain, e.g. SM, SMS, and SS, are suspended.
4.7.1.1 Lower layer failure

The lower layers shall indicate a logical link failure or an RR sublayer failure or an RRC sublayer failure to the GMM
sublayer. The failure indicates an error that cannot be corrected by the lower layers.
4.7.1.2 Ciphering of messages (A/Gb mode only)

If ciphering is to be applied on a GMM context, all GMM messages shall be ciphered except the following messages:
-- ATTACH REQUEST;
-- ATTACH REJECT;
-- AUTHENTICATION AND CIPHERING REQUEST;
-- AUTHENTICATION AND CIPHERING RESPONSE;
ETSI
Release 18 139 3GPP TS 24.008 V18.4.0 (2023-09)
-- AUTHENTICATION AND CIPHERING FAILURE;
-- AUTHENTICATION AND CIPHERING REJECT;
-- IDENTITY REQUEST;
-- IDENTITY RESPONSE;
-- ROUTING AREA UPDATE REQUEST; and
-- ROUTING AREA UPDATE REJECT.
4.7.1.2a Integrity protection of layer 3 signalling messages (A/Gb mode only and
when integrity protection is required)
4.7.1.2a.1 General
The requirements in subclause 4.7.1.2a are only applicable for MSs and networks supporting EC-GSM-IoT (see
3GPP TS 43.064 [159]).
For the MS, integrity protected signalling is mandatory for the GMM messages and SM messagres once a valid UMTS
security context exists and has been taken into use. For the network, integrity protected signalling is mandatory for the
GMM messages and SM messages once authentication and ciphering procedure is initiated by the network. Integrity
protection of all GMM signalling messages and SM messages is the responsibility of the LLC layer. In addition, the
GMM layer protects the AUTHENTICATION AND CIPHERING REQUEST message and the AUTHENTICATION
AND CIPHERING RESPONSE message by a message authentication code (MAC) calculated at the GMM layer when
an authentication takes place in the Authentication and Ciphering procedure. This message authentication code is
included in the AUTHENTICATION AND CIPHERING REQUEST message and the AUTHENTICATION AND
CIPHERING RESPONSE message. The GMM layer is always using the new UMTS security context derived from the
AKA taking place in the Authentication and Ciphering procedure when calculating the message authentication code
(MAC) at GMM layer.
The GMM layer activates integrity protection in the LLC layer by providing an indication when integrity protection
shall be started.
Integrity protection is initiated in the MS upon request from the network. This is done using the authentication and
ciphering procedure at the GMM layer (3GPP TS 43.020 [13] and 3GPP TS 44.064 [78a]).
Details of the integrity protection and verification of GMM signalling messages are specified in 3GPP TS 43.020 [13].
4.7.1.2a.2 Integrity checking of GMM signalling messages in the MS

Except the messages listed below, no GMM signalling messages shall be processed by the receiving GMM entity in the
MS or forwarded to the SM entity, unless the use of integrity protection has been successfully negotiated:
- GMM messages:
- IDENTITY REQUEST (only if the requested identification parameter is IMSI)
- ATTACH REJECT (if the cause is not #25)
- AUTHENTICATION AND CIPHERING REJECT
- ROUTING AREA UPDATE REJECT (if the cause is not #25)
- DETACH ACCEPT (for non power-off)
NOTE: These messages are accepted by the MS without integrity protection, as in certain situations they are sent
by the network before integrity protection can be activated.
All SM messages shall be integrity protected.
Once the integrity protection has been successfully negotiated, the receiving GMM or SM entity in the MS shall not
process any GMM signalling messages unless they have been successfully integrity checked by the LLC layer. If GMM
ETSI
Release 18 140 3GPP TS 24.008 V18.4.0 (2023-09)
signalling messages, having not successfully passed the integrity check, are received, then the LLC layer in the MS
discards that message. The processing of the AUTHENTICATION AND CIPHERING REQUEST message, at
authentication, that has not successfully passed the integrity check at GMM layer is specified in subclause 4.7.7.2. If
any GMM or SM signalling message is received without integrity protection even though integrity protection has been
successfully negotiated, then the GMM layer shall discard this message.
4.7.1.2a.3 Integrity checking of layer 3 signalling messages in the network

Except the messages listed below, no GMM signalling messages shall be processed by the receiving GMM entity in the
network or forwarded to the SM entity, unless integrity protection has been successfully negotiated:
- GMM messages:
- ATTACH REQUEST;
- IDENTITY RESPONSE (if requested identification parameter is IMSI);
- AUTHENTICATION AND CIPHERING FAILURE;
- DETACH REQUEST;
- DETACH ACCEPT.
All SM messages are integrity protected.
Once a valid UMTS security context exists, until integrity protection has been successfully negotiated, the receiving
GMM entity in the network shall process the following GMM signalling messages, even if the MAC included in the
LLC frame carrying the GMM message fails the integrity check or cannot be verified in the LLC layer, as the UMTS
security context is not available in the network:
- ATTACH REQUEST;
- IDENTITY RESPONSE (if requested identification parameter is IMSI);
- AUTHENTICATION AND CIPHERING FAILURE;
- DETACH REQUEST (if sent before integrity protection has been activated);
- DETACH ACCEPT;
- ROUTING AREA UPDATE REQUEST;
NOTE: These messages are processed by the GMM layer even when the MAC fails the integrity check or cannot
be verified, as in certain situations they can be sent by the MS protected with an UMTS security context
that is no longer available in the network.
If an ATTACH REQUEST message fails the integrity check, the network shall authenticate the subscriber before
processing the attach request any further.
If a ROUTING AREA UPDATE REQUEST message fails the integrity check, the network shall initiate an re-
authentication of the subscriber by initiating an authentication and ciphering procedure.
Once integrity protection has been successfully negotiated, the receiving GMM or SM entity in the network shall not
process any GMM or SM signalling messages unless they have been successfully integrity checked by the LLC layer. If
any GMM or SM signalling message, having not successfully passed the integrity check, is received, then the LLC layer
in the network discards that message. The processing of the AUTHENTICATION AND CIPHERING RESPONSE
message when authentication is taking place, that has not successfully passed the integrity check at GMM layer is
specified in subclause 4.7.7.3. If any GMM or SM signalling message is received, as not integrity protected even though
integrity protection has been successfully negotiated, then the GMM layer shall discard this message.
4.7.1.2a.4 Establishment of integrity protection of layer 3 signalling messages

Establishment of integrity protection of layer 3 signalling messages and optionally user plane data is done during the
attach procedure. The MS shall indicate support for integrity protection in the MS network capability IE included in the
ATTACH REQUEST message and the ROUTING AREA UPDATE REQUEST message to the network.
ETSI
Release 18 141 3GPP TS 24.008 V18.4.0 (2023-09)
When an MS sends an ATTACH REQUEST message or a ROUTING AREA UPDATE REQUEST message, then if
the MS has no UMTS security context, it shall send the ATTACH REQUEST or the ROUTING AREA UPDATE
REQUEST message without integrity protection to the network. If the network supports integrity protection, then the
network activates integrity protection by initiating an authentication and ciphering procedure. The network selects an
integrity algorithm among the supported integrity algorithms indicated by the MS in the MS network capability IE.
After successful completion of the authentication and ciphering procedure, all layer 3 signalling messages sent between
the MS and network are integrity protected in the LLC layer using the new UMTS security context.
When an MS sends an ATTACH REQUEST message or a ROUTING AREA UPDATE REQUEST message, then if
the MS has a UMTS security context, it shall send the ATTACH REQUEST or the ROUTING AREA UPDATE
REQUEST message integrity protected with the current UMTS security context to the network. The MS shall include
the CKSN indicating the current UMTS security context value in the initial ATTACH REQUEST message or a
ROUTING AREA UPDATE REQUEST message. The MS shall use the integrity algorithm identified by the stored
integrity algorithm identifier. The network shall check whether the CKSN included in the initial ATTACH REQUEST
message or the ROUTING AREA UPDATE REQUEST message belongs to an UMTS security context available in the
network, and if yes, then the network re-establishes integrity protection of layer 3 signalling messages in the LLC layer:
- by replying with a GMM message (ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT) that is
integrity protected in LLC layer by using the current UMTS security context. From this time onward, all layer 3
signalling messages exchanged between the MS and the network are sent integrity protected, except for the
messages specified in subclause 4.7.1.2a; or
- by initiating an authentication and ciphering procedure. This procedure can be used by the network to select a
new integrity algorithm different from the one currently used by the MS.
NOTE: Even if the message authentication code protecting the ATTACH REQUEST or the ROUTING AREA
UPDATE message in the LLC layer cannot be verified in the network due to the integrity key and the
integrity algorithm in the LLC layer at the network not having been configured yet for this MS, the
network progresses the attach procedure and the routing atra updating procedure at the GMM layer
anyway without having to run a new authentication and ciphering procedure if the network decides to re-
use the same encryption- and integrity keys and the same ciphering and integrity algorithms and not run a
re-authentication.
4.7.1.2a.5 Optional establishment of integrity protection in the user plane

If an MS supports integrity protection of user plane data, then the MS shall indicate in the MS network capability IE to
the network that it supports integrity protection of user plane data when it sends an ATTACH REQUEST message or a
ROUTING AREA UPDATE REQUEST message. If the network supports integrity protection of the user plane data,
then the network shall indicate in the ATTACH ACCEPT message or the ROUTING AREA UPDATE ACCEPT
message to the MS that integrity protection of user plane data shall be used.
4.7.1.2a.6 Change of security keys

When the network initiates a re-authentication to create a new UMTS security context, the AUTHENTICATION AND
CIPHERING REQUEST message and AUTHENTICATION AND CIPHERING RESPONSE message exchanged
during the authentication and ciphering procedure are integrity protected with the new UMTS security context at GMM
layer by including a MAC. The AUTHENTICATION AND CIPHERING REQUEST message and
AUTHENTICATION AND CIPHERING RESPONSE message may be also integrity protected at the LLC layer using
the current UMTS security context, if any. Both UE and network shall continue to use the current UMTS security
context, until the network initiates a re-authentication in the authentication and ciphering procedure. The
AUTHENTICATION AND CIPHERING REQUEST message sent by the network includes the CKSN of the new
UMTS security context to be used. The SGSN shall send the AUTHENTICATION AND CIPHERING REQUEST
message integrity protected with the new UMTS security context at GMM layer by including a MAC, but unciphered.
When the UE responds with an AUTHENTICATION AND CIPHERING RESPONSE message, it shall send the
message integrity protected with the new UMTS security context at GMM layer by including a MAC, but unciphered.
The UE shall take the new UMTS security context and the indicated integrity algorithm and encryption algorithm
received in the AUTHENTICATION AND CIPHERING REQUEST message, into use in the LLC layer after sending
the AUTHENTICATION AND CIPHERING RESPONSE message. The network shall take the new UMTS security
context and the indicated integrity algorithm and encryption algorithm sent in the AUTHENTICATION AND
CIPHERING REQUEST message, into use in the LLC layer in the network after receiving the AUTHENTICATION
AND CIPHERING RESPONSE message and a successful check of the RES.
ETSI
Release 18 142 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.1.3 P-TMSI signature

The network may assign a P-TMSI signature to an MS in an attach, routing area update, or P-TMSI reallocation
procedure. Only in combination with a valid P-TMSI, this P-TMSI signature is used by the MS for authentication and
identification purposes in the subsequent attach, routing area update or detach procedure. If the MS has no valid P-
TMSI it shall not use the P-TMSI signature in the subsequent attach, routing area update or detach procedure. Upon
successful completion of the subsequent attach or routing area update procedure, the used P-TMSI signature shall be
deleted. Upon completion of an MS initiated detach procedure, the used P-TMSI signature shall be deleted. Upon
completion of a network initiated detach procedure the P-TMSI signature shall be kept, unless explicitly specified
otherwise in subclause 4.7.4.2.2.
4.7.1.4 Radio resource sublayer address handling

In A/Gb mode, while a packet TMSI (P-TMSI) is used in the GMM sublayer for identification of an MS, a temporary
logical link identity (TLLI) is used for addressing purposes at the RR sublayer.
In Iu mode a Radio Network Temporary Identity (RNTI) identifies a user between the MS and the UTRAN or GERAN.
The relationship between RNTI and IMSI is known only in the MS and in the UTRAN, see 3GPP TS 25.301 [128].
4.7.1.4.1 Radio resource sublayer address handling (A/Gb mode only)

This subclause describes how the RR addressing is managed by GMM. For the detailed coding of the different TLLI
types and how a TLLI can be derived from a P-TMSI, see 3GPP TS 23.003 [10].
If the MS is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and is
entering a new PLMN which is neither the registered PLMN nor in the list of equivalent PLMNs, the MS should
proceed as specified for case ii) below and use a randomly selected random TLLI for the transmission of the ATTACH
REQUEST message.
For all other cases, the MS shall determine the TLLI as follows:
For an MS not supporting S1 mode, two cases can be distinguished:
- a valid P-TMSI is available in the MS; or
- no valid P-TMSI is available in the MS.
i) valid P-TMSI available
If the MS has stored a valid P-TMSI, the MS shall derive a foreign TLLI from that P-TMSI and shall use it for
transmission of the:
- ATTACH REQUEST message of any GPRS combined/non-combined attach procedure; other GMM
messages sent during this procedure shall be transmitted using the same foreign TLLI until the ATTACH
ACCEPT message or the ATTACH REJECT message is received; and
- ROUTING AREA UPDATE REQUEST message of a combined/non-combined RAU procedure if the MS

has entered a new routing area, or if the GPRS update status is not equal to GU1 UPDATED. Other GMM
messages sent during this procedure shall be transmitted using the same foreign TLLI, until the ROUTING
AREA UPDATE ACCEPT message or the ROUTING AREA UPDATE REJECT message is received.
After a successful GPRS attach or routing area update procedure, independent of whether a new P-TMSI is
assigned, if the MS has stored a valid P-TMSI then the MS shall derive a local TLLI from the stored P-TMSI
and shall use it for addressing at lower layers.
NOTE 1: Although the MS derives a local TLLI for addressing at lower layers, the network should not assume that
it will receive only LLC frames using a local TLLI. Immediately after the successful GPRS attach or
routing area update procedure, the network must be prepared to continue accepting LLC frames from the
MS still using the foreign TLLI.
ii) no valid P-TMSI available
When the MS has not stored a valid P-TMSI, i.e. the MS is not attached to GPRS, the MS shall use a randomly
selected random TLLI for transmission of the:
ETSI
Release 18 143 3GPP TS 24.008 V18.4.0 (2023-09)
- ATTACH REQUEST message of any combined/non-combined GPRS attach procedure.
The same randomly selected random TLLI value shall be used for all message retransmission attempts and for
the cell updates within one attach attempt.
Upon receipt of an ATTACH REQUEST message, the network shall assign a P-TMSI to the MS. The network
derives a local TLLI from the assigned P-TMSI, and transmits the assigned P-TMSI to the MS.
Upon receipt of the assigned P-TMSI, the MS shall derive the local TLLI from this P-TMSI and shall use it for
addressing at lower layers.
NOTE 2: Although the MS derives a local TLLI for addressing at lower layers, the network should not assume that
it will receive only LLC frames using a local TLLI. Immediately after the successful GPRS attach, the
network must be prepared to continue accepting LLC frames from the MS still using the random TLLI.
In both cases the MS shall acknowledge the reception of the assigned P-TMSI to the network. After receipt of the
acknowledgement, the network shall use the local TLLI for addressing at lower layers.
For an MS supporting S1 mode, the following five cases can be distinguished:
a) the TIN indicates "P-TMSI" or "RAT-related TMSI" and the MS holds a valid P-TMSI and a RAI;
b) the TIN indicates "GUTI" and the MS holds a valid GUTI allocated by an MME;
c) the TIN is deleted and the MS holds a valid P-TMSI and RAI;
d) the TIN is deleted and the MS holds a valid GUTI allocated by an MME, but no valid P-TMSI and RAI; or
e) none of the previous cases is fulfilled.
In case a) the MS shall derive a foreign TLLI from the P-TMSI and proceed as specified for case i) above.
In case b), the MS shall derive a P-TMSI from the GUTI and then a foreign TLLI from this P-TMSI and proceed as
specified for case i) above.
NOTE 3: The mapping of the GUTI to the P-TMSI is specified in 3GPP TS 23.003 [10].
In case c) the MS shall derive a foreign TLLI from the P-TMSI and proceed as specified for case i) above.
In case d) the MS shall derive a P-TMSI from the GUTI and then a foreign TLLI from this P-TMSI and proceed as
specified for case i) above.
In case e) the MS shall proceed as as specified for case ii) above.
For transmission of an ATTACH REQUEST message, or a ROUTING AREA UPDATE REQUEST message after a
routing area change, the MS also provides the lower layers with the DCN-ID according to the following rules:
a) if a DCN-ID for the PLMN code of the selected PLMN is available in the MS, the MS shall provide this DCN-
ID to the lower layers; or
b) if no DCN-ID for the PLMN code of the selected PLMN is available but a Default_DCN_ID value is available
in the MS, as specified in 3GPP TS 24.368 [135] or in USIM file NASCONFIG as specified in
3GPP TS 31.102 [112], the MS shall provide the Default_DCN_ID value to the lower layers.
4.7.1.5 P-TMSI handling
4.7.1.5.1 P-TMSI handling in A/Gb mode

If a new P-TMSI is assigned by the network the MS and the network shall handle the old and the new P-TMSI as
follows:
Upon receipt of a GMM message containing a new P-TMSI the MS shall consider the new P-TMSI and new RAI and
also the old P-TMSI and old RAI as valid in order to react to paging requests and downlink transmission of LLC
frames. For uplink transmission of LLC frames the new P-TMSI shall be used.
ETSI
Release 18 144 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE: For the case of multiple consecutive P-TMSI REALLOCATION COMMAND messages, the old P-TMSI
is the latest P-TMSI included by the network in a previous message different from the multiple
consecutive P-TMSI REALLOCATION COMMAND messages.
The MS shall consider the old P-TMSI and old RAI as invalid as soon as an LLC frame is received with the local TLLI
derived from the new P-TMSI.
Upon the transmission of a GMM message containing a new P-TMSI the network shall consider the new P-TMSI and
new RAI and also the old P-TMSI and old RAI as valid in order to be able to receive LLC frames from the MS.
The network shall consider the old P-TMSI and old RAI as invalid as soon as an LLC frame is received with the local
TLLI derived from the new P-TMSI.
4.7.1.5.2 P-TMSI handling in Iu mode

If a new P-TMSI is assigned by the network the MS and the network shall handle the old and the new P-TMSI as
follows:
Upon receipt of a GMM message containing a new P-TMSI the MS shall consider the new P-TMSI and new RAI as
valid. Old P-TMSI and old RAI are regarded as invalid.
The network shall consider the old P-TMSI and old RAI as invalid as soon as an acknowledge message (e.g. ATTACH
COMPLETE, ROUTING AREA UPDATE COMPLETE and P-TMSI REALLOCATION COMPLETE) is received.
4.7.1.5.3 Void
4.7.1.5.4 Void
4.7.1.6 Change of network mode of operation

In the following tables below the abbreviations 'A/Gb mode I' and 'A/Gb mode II' are used for network operation mode
I and II in A/Gb mode.
In the following tables below the abbreviations 'Iu mode I' and 'Iu mode II' are used for network operation modes I and
II in Iu mode.
4.7.1.6.1 Change of network mode of operation in A/Gb mode (A/Gb mode only)
Whenever an MS moves to a new RA, the procedures executed by the MS depend on the network mode of operation in
the old and new routing area.
In case the MS is in state GMM REGISTERED or GMM ROUTING AREA UPDATING INITIATED and is in
operation mode A or B, the MS shall execute according to table 4.7.1.6.1-1:
Table 4.7.1.6.1-1/3GPP TS 24.008: Mode A or B
Network operation Procedure to execute

mode change
I  II (***) Normal Location Update(*),
followed by a Normal Routing Area Update
II  I Combined Routing Area Update with IMSI attach(**)
(*) Intended to remove the Gs association in the MSC/VLR.
(**) Intended to establish the Gs association in the MSC/VLR.
(***) If the MS that needs only GPRS services and "SMS-only service" moves to a new routing area, see
subclause 4.1.1.2.2.
Further details are implementation issues.
ETSI
Release 18 145 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.1.6.2 Change of network mode of operation in Iu mode (Iu mode only)

Whenever an MS moves to a new RA, the procedures executed by the MS depend on the network mode of operation in
the old and new routing area.
In case the MS is in state GMM-REGISTERED or GMM-ROUTING-AREA-UPDATING-INITIATED and is in

operation mode A, the MS shall execute:
Table 4.7.1.6.4/3GPP TS 24.008: Mode A

mode change
I  II (***) Normal Location Update(*),
followed by a Normal Routing Area Update
II  I Combined Routing Area Update with IMSI attach(**)
4.7.1.6.3 Change of network mode of operation at Iu mode to A/Gb mode inter-system

change
Whenever an MS moves to a new RA supporting the A/Gb mode radio interface, the procedures executed by the MS
depend on the network mode of operation in the old and new routing area.

operation mode:
a) A in Iu mode, an MS that changes to GPRS operation mode A or B in A/Gb mode shall execute:
Table 4.7.1.6.5/3GPP TS 24.008: Mode A in Iu mode changing to GPRS mode A or B in A/Gb mode

mode change
Iu mode I  A/Gb mode I Combined Routing Area Update
Iu mode II  A/Gb mode I Combined Routing Area Update with IMSI attach(**)
Iu mode I  A/Gb mode II Normal Location Update(*),
(***) followed by a Normal Routing Area Update
b) C in Iu mode, the MS shall change to GPRS operation mode C in A/Gb mode and shall execute the normal
Routing Area Update procedure.
c) CS in Iu mode, the MS shall execute the normal Location Update procedure.
ETSI
Release 18 146 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.1.6.4 Change of network mode of operation at A/Gb mode to Iu mode inter-system

change
Whenever an MS moves to a new RA supporting the Iu mode radio interface, the procedures executed by the MS
depend on the network mode of operation in the old and new routing area.

operation mode:
a) A or B in A/Gb mode, the MS shall change to operation mode A in Iu mode and shall execute:
Table 4.7.1.6.8/3GPP TS 24.008: Mode A or B in A/Gb mode changing to mode A in Iu mode
Network operation mode Procedure to execute

change
A/Gb mode I  Iu mode I Combined Routing Area Update
A/Gb mode II  Iu mode I Combined Routing Area Update with IMSI attach(**)
A/Gb mode I  Iu mode II Normal Location Update(*),
A/Gb mode II  Iu mode II Normal Location Update if a new LA is entered,

b) C in A/Gb mode, an MS that changes to operation mode C in Iu mode shall execute a Normal Routing Area
Update.
4.7.1.7 Intersystem change between A/Gb mode and Iu mode

For the Iu mode to A/Gb mode and A/Gb mode to Iu mode intersystem change the following cases can be
distinguished:
a) Intersystem change between cells belonging to different RA's:
The procedures executed by the MS depends on the network mode of operation in the old and new RA. If a
change of the network operation mode has occurred in the new RA, then the MS shall behave as specified in
subclause 4.7.1.6. If no change of the network operation mode has occurred in the new RA, then the MS shall
initiate the normal or combined routing area updating procedure depending on the network operation mode in the
current RA.
b) Intersystem change between cells belonging to the same RA:
1) If the READY timer is running in the MS in A/Gb mode before or after the inter-system change occurs,or the
MS is in PMM-CONNECTED mode in Iu mode, before the inter-system change occurs then the MS shall
perform a normal or combined routing area updating procedure depending on the network mode of operation
in the current RA.
2) If the READY timer is not running in the MS in A/Gb mode before the inter-system change occurs, or the
MS is in PMM-IDLE mode in Iu mode before the inter-system change and the READY timer is not running
in the MS in A/Gb mode after the intersystem change, then, unless a routing area updating procedure is
required according to case c) or case b) 3) below or according to subclause 4.7.5.1 and 4.7.5.2.1, the MS shall
not perform a routing area updating procedure until uplink user data or signalling information needs to be
sent from the MS to the network.
ETSI
Release 18 147 3GPP TS 24.008 V18.4.0 (2023-09)
- If the MS is in the same access network(i.e. A/Gb mode or Iu mode), as when it last sent user data or
signalling messages, the procedures defined for that access system shall be followed. This shall be
sending of an LLC PDU in an A/Gb mode cell or initiating the service request procedure in an Iu mode
cell.
- If the MS is in a different access network (i.e. A/Gb mode or Iu mode), as when it last sent user data or
signalling messages, the normal or combined routing area updating procedure shall be performed
depending on the network operation mode in the current RA, before the sending of user data or signalling
messages. If the signalling message is a DETACH REQUEST indicating "power off", the routing area
updating procedure need not to be performed.
- If the periodic routing area update timer expires the MS shall initiate the periodic routing area updating
procedure.
3) If the READY timer is not running in the MS in A/Gb mode or the MS is in PMM-IDLE mode in Iu mode,
then the MS shall perform a normal or combined routing area updating procedure depending on the network
mode of operation in the current RA if the MS is required to perform routing area updating for IMS voice
termination as specified in annex P.3.
4) If the READY timer is not running in the network in A/Gb mode or the network is in PMM-IDLE mode in Iu
mode, then the network shall page the MS if downlink user data or signalling information needs to be sent
from the network to the MS. This shall include both A/Gb mode and Iu mode cells.
- If the MS receives the paging indication in the same access network (i.e. A/Gb mode or Iu mode), as
when it last sent user data or signalling information, the MS shall send any LLC PDU in a A/Gb mode
cell or shall initiate the service request procedure indicating service type "paging response" in an Iu mode
cell.
- If the MS receives the paging indication in a different access network (i.e. A/Gb mode or Iu mode), as
when it last sent user data or signalling information, the MS shall perform a normal or combined routing
area updating procedure depending on the network operation mode in the current RA.
c) Intersystem handover from A/Gb mode to Iu mode during a CS connection:
After the successful completion of the handover from an A/Gb mode cell to an Iu mode cell, an MS which has
performed the GPRS suspension procedure in Gb mode (see 3GPP TS 44.018 [84]) (i.e. an MS in MS operation
mode B or an DTM MS in a A/Gb mode cell that does not support DTM) shall perform a normal routing area
updating procedure in the Iu mode cell in order to resume the GPRS services in the network, before sending any
other signalling messages or user data.
4.7.1.7a Intersystem change from S1 mode to A/Gb mode or S1 mode to Iu mode with
ISR activated
If ISR is activated and the MS returns from S1 mode to a cell belonging to a RA which is different from the RA where
the MS is registered, the MS initiates a normal or combined routing area updating procedure depending on the network
operation mode in the current RA.
If ISR is activated and the MS returns from S1 mode to a cell belonging to the RA where the MS is registered, the
following cases can be distinguished:
a) Inter-system change due to PS handover:
If the PS handover is to A/Gb mode, the MS initiates a normal or combined routing area updating procedure
depending on the network operation mode in the current RA.
b) Inter-system change not due to PS handover:
1) If the READY timer is running in the MS after the inters-ystem change occurs, then the MS shall perform a
normal or combined routing area updating procedure depending on the network mode of operation in the
current RA.
2) If the READY timer is not running in the MS in A/Gb mode or the MS is in PMM-IDLE mode in Iu mode
after the intersystem change occurs, unless a routing area updating procedure is required according to
ETSI
Release 18 148 3GPP TS 24.008 V18.4.0 (2023-09)
subclause 4.7.5.1 and 4.7.5.2.1, the MS shall not perform a routing area updating procedure until uplink user
data or signalling information needs to be sent from the MS to the network.
- If the MS is in the same access network, (i.e. A/Gb mode or Iu mode), as when it last sent user data or
signalling messages in a cell belonging to the RA where the MS is registered, the procedures defined for
that access system shall be followed. This shall be sending of an LLC PDU in a A/Gb mode cell or
initiating the SERVICE REQUEST procedure in an Iu mode cell.
- If the MS is in a different access network (i.e. A/Gb mode or Iu mode), as when it last sent user data or
signalling messages in a cell belonging to the RA where the MS is registered, the normal or combined RA
update procedure shall be performed depending on the network operation mode in the current RA, before
the sending of user data or signalling messages. If the signalling message is a DETACH REQUEST
indicating "power off", the routing area updating procedure need not be performed.
- If the periodic routing area update timer expires the MS shall initiate the periodic RA update procedure.
3) If the READY timer is not running in the network in A/Gb mode or the network is in PMM-IDLE mode in Iu
mode, then the network shall page the MS if downlink user data or signalling information needs to be sent
from the network to the MS. This shall include both A/Gb mode and Iu mode cells.
- If the MS receives the paging indication in the same access network (i.e. A/Gb mode or Iu mode), as
when it last sent user data or signalling information in a cell belonging to the RA where the MS is
registered, the MS shall send any LLC PDU in a A/Gb mode cell or shall initiate the service request
procedure indicating service type "paging response" in an Iu mode cell.
- If the MS receives the paging indication in a different access network (i.e. A/Gb mode or Iu mode), as
when it last sent user data or signalling information in a cell belonging to the RA where the MS is
registered, the MS shall perform normal or combined routing area updating procedure shall be performed
depending on the network operation mode in the current RA.
4.7.1.7b Intersystem change from S1 mode to A/Gb mode or S1 mode to Iu mode for
eCall only MS capable of eCall over IMS
If an eCall only MS (as determined by information configured in USIM) capable of eCall over IMS returns from S1
mode to A/Gb or Iu mode, the MS shall:
a) if timer T3444 is running, start timer T3242 with the time left on timer T3444, and stop timer T3444;
b) if timer T3445 is running, start timer T3243 with the time left on timer T3445, and stop timer T3445;
c) if the MS is attached for GPRS services only and timer T3444 or timer T3445 is running:
- perform a combined routing area updating procedure with IMSI attach if the network operates in network
operation mode I; and
- perform a routing area updating procedure and a location area updating procedure if the network operates in
network operation mode II; and
d) if the MS is attached for both GPRS services and non-GPRS services and timer T3444 or timer T3445 is
running:
- perform a combined routing area updating procedure if the network operates in network operation mode I;
and
- perform a routing area updating procedure and a location are updating procedure if the network operates in
network operation mode II.
NOTE: Timers T3444 and T3445 are specified in 3GPP TS 24.301 [120].
4.7.1.7c Return to packet idle mode for eCall only MS capable of eCall over IMS
If an eCall only MS (as determined by information configured in USIM) capable of eCall over IMS returns to packet
idle mode following the release of a call to an HPLMN designated non-emergency MSISDN or URI for test or terminal
ETSI
Release 18 149 3GPP TS 24.008 V18.4.0 (2023-09)
reconfiguration service which was handed over from S1 mode and timer T3243 is not running, the MS shall start timer
T3243.
4.7.1.8 List of forbidden PLMNs for GPRS service

The Mobile Equipment shall contain a list of "forbidden PLMNs for GPRS service". This lists shall be erased when the
MS is switched off or when the SIM/USIM is removed or upon the expiry of the timer T3245 as described in
subclause 4.1.1.6. The PLMN identification received on the BCCH shall be added to the list whenever a GPRS attach or
routing area update is rejected by the network with the cause "GPRS services not allowed in this PLMN" or whenever a
GPRS detach is initiated by the network with the cause "GPRS services not allowed in this PLMN".
In a shared network, the MS shall choose one of the PLMN identities as specified in 3GPP TS 23.122 [14]. The PLMN
identity selected for a GPRS attach procedure, or the PLMN identity used to construct the RAI that triggered the routing
area updating procedure shall be added to the list of "forbidden PLMNs for GPRS service" whenever such a procedure
is rejected by the network with the cause "GPRS services not allowed in this PLMN". Whenever a GPRS detach is
initiated by the network with the cause "GPRS services not allowed in this PLMN", the PLMN identity that was
selected for GPRS attach procedure or routing area update procedure shall be added to the list of "forbidden PLMNs for
GPRS service".
The maximum number of possible entries in this list is implementation dependent, but must be at least one entry. When
the list is full and a new entry has to be inserted, the oldest entry shall be deleted.
4.7.1.8a Establishment of the PS signalling connection (Iu mode only)

In order to route the NAS message to an appropriate SGSN, the MS NAS provides the lower layers with the routing
parameter according to the following rules:
a) if the TIN indicates "P-TMSI" or "RAT-related TMSI", and the MS holds a valid P-TMSI, the MS NAS shall
provide the lower layers with the P-TMSI;
b) if the TIN indicates "GUTI" and the MS holds a valid GUTI allocated by an MME, the MS NAS shall provide
the lower layers with the P-TMSI mapped from the GUTI (see 3GPP TS 23.003 [10]);
c) if the TIN is not available and the MS holds a valid P-TMSI, the MS NAS shall provide the lower layers with the
P-TMSI; or
d) if the TIN is not available and the MS holds a valid GUTI allocated by an MME, but no valid P-TMSI, the MS
NAS shall provide the lower layers with the P-TMSI mapped from the GUTI (see 3GPP TS 23.003 [10]).
When an ATTACH REQUEST message, or a ROUTING AREA UPDATE REQUEST message after a routing area
change, is sent to establish a PS signalling connection, the MS NAS also provides the lower layers with the DCN-ID
according to the following rules:
a) if a DCN-ID for the PLMN code of the selected PLMN is available in the MS, this DCN-ID the MS NAS shall
provide this DCN-ID to the lower layers; or
b) if no DCN-ID for the PLMN code of the selected PLMN is available but a Default_DCN_ID value is available
in the MS, as specified in 3GPP TS 24.368 [135] or in USIM file NASCONFIG as specified in
3GPP TS 31.102 [112], the Default_DCN_ID value MS NAS shall provide the Default_DCN_ID value to the
lower layers.
4.7.1.9 Release of the PS signalling connection (Iu mode only)

In Iu mode, to allow the network to release the PS signalling connection (see 3GPP TS 25.331 [23c] and
3GPP TS 44.118 [111]) the MS:
a) shall start the timer T3340 if the MS receives any of the reject cause values #11, #12, #13, #15 or #25;
b) shall start the timer T3340 if the network indicates "no follow-on proceed" in the ROUTING AREA UPDATE
ACCEPT or ATTACH ACCEPT message and user plane radio access bearers have not been setup;
ETSI
Release 18 150 3GPP TS 24.008 V18.4.0 (2023-09)
c) shall start the timer T3340 if the MS receives a DETACH ACCEPT message and the MS has set the detach type
to "IMSI detach" in the DETACH REQUEST message and user plane radio access bearers have not been set up;
or
d) may start the timer T3340 if the MS receives any of the reject cause values #3, #6, #7 or #8 or if it receives an
AUTHENTICATION AND CIPHERING REJECT message.
Upon expiry of T3340, the MS shall release the established PS signalling connection (see 3GPP TS 25.331 [23c] and
3GPP TS 44.118 [111]).
Upon release of the established PS signalling connection, if timer T3243 is not running, the MS shall start timer T3243
when:
- the MS is an eCall only MS (as determined by information configured in USIM);
- the MS is capable of eCall over IMS; and
- the PS signalling connection that was released had been established for a call to an HPLMN designated non-
emergency MSISDN or URI for test or terminal reconfiguration service which was handed over from S1 mode.
In case b, if the MS has signalling pending, then it shall request a new PS signalling connection for further signalling.
In case b and c,
- upon an indication from the lower layers that radio accesss bearer(s) is set up, the MS shall stop timer T3340 and
may send uplink signalling via the existing PS signalling connection or user data via radio access bearer(s). If the
MS is establishing a PDN connection for emergency bearer services or the MS is initiating a service request
procedure to send user data for emergency bearer services, the MS shall send the uplink signalling via the
existing PS signalling connection;
- upon receipt of a REQUEST PDP CONTEXT ACTIVATION message, MODIFY PDP CONTEXT REQUEST
message, DEACTIVATE PDP CONTEXT REQUEST message, REQUEST SECONDARY PDP CONTEXT
ACTIVATION message or REQUEST MBMS CONTEXT ACTIVATION message, the MS shall stop timer
T3340 and may send uplink signalling via the existing PS signalling connection. If the MS is establishing a PDN
connection for emergency bearer services or the MS is initiating a service request procedure to send user data for
emergency bearer services, the MS shall send the uplink signalling via the existing PS signalling connection; or
- upon receipt of a DETACH REQUEST message, the MS shall stop timer T3340 and respond to the network
initiated GPRS detach as specified in subclause 4.7.4.2.
If the MS receives the "Extended wait time" for PS domain from the lower layers when no attach, routing area updating
or service request procedure is ongoing, the MS shall ignore the "Extended wait time".
If the MS needs to perform PLMN selection, the MS may release the established PS signalling connection (see
3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
4.7.1.10 Handling of 3GPP PS data off

An MS, which supports 3GPP PS data off (see 3GPP TS 23.060 [74]), can be configured with up to two lists of 3GPP
PS data off exempt services as specified in 3GPP TS 24.368 [135] or in the EF3GPPPSDATAOFF USIM file as specified in
3GPP TS 31.102 [112]:
- a list of 3GPP PS data off exempt services to be used in the HPLMN or EHPLMN (if the EHPLMN list is
present); and
- a list of 3GPP PS data off exempt services to be used in the VPLMN.
If only the list of 3GPP PS data off exempt services to be used in the HPLMN or EHPLMN (if the EHPLMN list is
present) is configured at the MS, this list shall be also used in the VPLMN.
If the MS supports 3GPP PS data off, the MS shall provide the 3GPP PS data off UE status in the protocol
configuration options IE during PDP context activation procedure (see subclause 6.1.3.1).
The network informs the MS about the support of 3GPP PS data off during PDP context activation procedure as
specified in subclause 6.1.3.1. If 3GPP data off support is not indicated in the protocol configuration options IE in the
ETSI
Release 18 151 3GPP TS 24.008 V18.4.0 (2023-09)
ACTIVATE PDP CONTEXT ACCEPT message, the MS shall not indicate any change of 3GPP PS data off UE status
for the PDN connection established by the PDP context activation procedure; otherwise the MS shall indicate change of
the 3GPP PS data off UE status for the PDN connection by using the PDP context modification procedure as specified
in subclause 6.1.3.3. If the network does not provide indication of support of 3GPP PS data off during PDP context
activation procedure, the MS behaviour for non-exempt service requests from the network is implementation dependent.
When the 3GPP PS data off UE status is "activated":
a) the MS does not send uplink IP packets except:
- for those services indicated in the list of 3GPP PS data off exempt services to be used in the HPLMN or
EHPLMN (if the EHPLMN list is present) as specified in 3GPP TS 24.368 [135] when the MS is in its
HPLMN or EHPLMN (if the EHPLMN list is present);
- for those services indicated in the list of 3GPP PS data off exempt services to be used in the HPLMN or
EHPLMN (if the EHPLMN list is present) when the MS is in the VPLMN, if only the list of 3GPP PS data
off exempt services to be used in the HPLMN or EHPLMN (if the EHPLMN list is present) is configured to
the MS as specified in 3GPP TS 24.368 [135];
- for those services indicated in the list of 3GPP PS data off exempt services to be used in the VPLMN when
the MS is in the VPLMN, if the list of 3GPP PS data off exempt services to be used in the VPLMN is
configured to the MS as specified in 3GPP TS 24.368 [135];
- for those services indicated in the EF3GPPPSDATAOFF USIM file as specified in 3GPP TS 31.102 [112]; and
- any uplink traffic due to procedures specified in 3GPP TS 24.229 [13D]; and
b) the MS does not send uplink non-IP user data packets.
Otherwise the MS sends uplink user data packets without restriction.
NOTE: If the MS supports 3GPP PS data off, uplink IP packets are filtered as specified in 3GPP TS 24.229 [13D]
in subclause B.3.1.5.
4.7.2 GPRS Mobility management timers and UMTS PS signalling

connection control
4.7.2.1 READY timer behaviour
4.7.2.1.1 READY timer behaviour (A/Gb mode only)

The READY timer, T3314 is used in the MS and in the network per each assigned P-TMSI to control the cell updating
procedure.
When the READY timer is running or has been deactivated the MS shall perform cell update each time a new cell is
selected (see 3GPP TS 43.022 [82]). If a routing area border is crossed, a routing area updating procedure shall be
performed instead of a cell update.
When the READY timer has expired:
- the MS shall perform the routing area updating procedure when a routing area border is crossed;
- the MS shall not perform a cell update when a new cell is selected.
- the network shall page the MS if down-link user data or signalling information needs to be sent to the MS.
All other GMM procedures are not affected by the READY timer.
ETSI
Release 18 152 3GPP TS 24.008 V18.4.0 (2023-09)
The READY timer is started:
- in the MS when the GMM entity receives an indication from lower layers that an LLC frame other than LLC
NULL frame has been transmitted on the radio interface; and
- in the network when the GMM entity receives an indication from lower layers that an LLC frame other than
LLC NULL frame has been successfully received by the network.
Within GMM signalling procedures the network includes a "force to standby" information element, in order to indicate
whether or not the READY timer shall be stopped when returning to the GMM-REGISTERED state. If the "force to
standby" information element is received within more than one message during a ongoing GMM specific procedure, the
last one received shall apply. If the READY timer is deactivated and the network indicates "force to standby" with the
"force to standby" information element, this shall not cause a modification of the READY timer.
The READY timer is not affected by state transitions to and from the GMM-REGISTERED.SUSPENDED sub-state.
The value of the READY timer may be negotiated between the MS and the network using the GPRS attach or GPRS
- If the MS wishes to indicate its preference for a READY timer value it shall include the preferred values into the
ATTACH REQUEST and/or ROUTING AREA UPDATE REQUEST messages. The preferred values may be
smaller, equal to or greater than the default values or may be equal to the value requesting the READY Timer
function to be deactivated.
- Regardless of whether or not a timer value has been received by the network in the ATTACH REQUEST or
ROUTING AREA UPDATE REQUEST messages, the network may include a timer value for the READY timer
(different or not from the default value) into the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT
messages, respectively. If the READY Timer value was included, it shall be applied for the GMM context by the
network and by the MS.
- When the MS proposes a READY Timer value and the Network does not include any READY Timer Value in
its answer, then the value proposed by the MS shall be applied for the GMM context by the Network and by the
MS.
- When neither the MS nor the Network proposes a READY Timer value into the ATTACH
REQUEST/ATTACH ACCEPT or ROUTING AREA UPDATE REQUEST/ROUTING AREA UPDATE
ACCEPT message, then the default value shall be used.
If the negotiated READY timer value indicates that the ready timer function is deactivated, the READY timer shall
always run without expiry. If the negotiated READY timer value indicates that the ready timer function is deactivated,
and within the same procedure the network indicates "force to standby" with the "force to standby" information
element, the READY timer shall always run without expiry. If the negotiated READY timer value is set to zero, the
READY timer shall be stopped immediately.
To account for the LLC frame uplink transmission delay, the READY timer value should be slightly shorter in the
network than in the MS. This is a network implementation issue.
If a new READY timer value is negotiated, the MS shall upon the reception of the ATTACH ACCEPT or ROUTING
AREA UPDATE ACCEPT message perform an initial cell update (either by transmitting a LLC frame or, if required, a
ATTACH COMPLETE or ROUTING AREA UPDATE COMPLETE message), in order to apply the new READY
timer value immediately. If both the network and the MS support the Cell Notification, the initial cell update shall use
any LLC frame except the LLC NULL frame. If the new READY timer value is set to zero or if the network indicates
"force to standby" with the "force to standby" IE, the initial cell update should not be done.
4.7.2.1.2 Handling of READY timer in the MS in Iu mode and S1 mode

The READY timer is not applicable for Iu mode in S1 mode.
Upon completion of a successful GPRS attach or routing area updating procedure in Iu mode, the MS shall stop the
READY timer, if running.
Upon completion of a successful EPS attach or tracking area updating procedure, the MS shall stop the READY timer,
if running.
ETSI
Release 18 153 3GPP TS 24.008 V18.4.0 (2023-09)
In Iu mode, an MS may indicate a READY timer value to the network in the ATTACH REQUEST and the ROUTING
AREA UPDATE REQUEST messages.
If a READY timer value is received by an MS capable of both Iu mode and A/Gb mode in the ATTACH ACCEPT or
the ROUTING AREA UPDATE ACCEPT message, then the MS shall store the received value in order to use it at an
intersystem change from Iu mode to A/Gb mode.
4.7.2.1.2a Handling of READY timer in the network in Iu mode and S1 mode

The READY timer is not applicable for Iu mode in S1 mode.
Upon completion of a successful GPRS attach or routing area updating procedure, the network shall stop the READY
timer, if running.
When the SGSN is informed by the HLR/HSS that the MS performed an EPS attach or by the MME that the UE is
performing a tracking area updating procedure, the SGSN shall stop the READY timer, if running.
4.7.2.2 Periodic routing area updating

The periodic routing area updating procedure is used to periodically notify the availability of the MS to the network.
The procedure is controlled in the MS by timer T3312. The value of timer T3312 is sent by the network to the MS in the
messages ATTACH ACCEPT and ROUTING AREA UPDATE ACCEPT. The value of timer T3312 shall be unique
within a RA.
If the value of timer T3312 received by the MS in A/Gb mode or received in Iu mode in a message with integrity
protection contains an indication that the timer is deactivated or the timer value is zero, then timer T3312 is deactivated
and the MS shall not perform the periodic routing area updating procedure.
In Iu mode, if the value of timer T3312 is received in a message without integrity protection and the indicated value is
larger than the last received value, or the indicated value is "deactivated" or zero, the MS shall use the last received
value. If there is no last received value, then the MS shall use the default value.
In A/Gb mode, the timer T3312 is reset and started with its initial value, when the READY timer is stopped or expires.
Timer T3312 is stopped and shall be set to its initial value for the next start when the READY timer is started. If after a
READY timer negotiation the READY timer value is set to zero, timer T3312 is reset and started with its initial value.
If the initial READY timer value is zero, the timer T3312 is reset and started with its initial value, when the ROUTING
AREA UPDATE REQUEST message is transmitted.
In Iu mode, timer T3312 is reset and started with its initial value, when the MS changes from PMM-CONNECTED to
PMM-IDLE mode. Timer T3312 is stopped when the MS enters PMM-CONNECTED mode.
If the MS is attached for emergency bearer services, when timer T3312 expires, the MS shall not initiate a periodic
routing area updating procedure, but shall locally detach from the network. When the MS is camping on a suitable cell,
it may re-attach to regain normal service.
If the MS is not attached for emergency bearer services, when timer T3312 expires, the periodic routing area updating
procedure shall be started and timer T3312 shall be set to its initial value for the next start.
If the MS is in a state other than GMM-REGISTERED.NORMAL-SERVICE when timer T3312 expires, the periodic
routing area updating procedure is delayed until the MS returns to GMM-REGISTERED.NORMAL-SERVICE.
In A/Gb mode, if the MS in MS operation mode B is in the state GMM-REGISTERED.SUSPENDED when timer
T3312 expires the periodic routing area updating procedure is delayed until the state is left.
If ISR is activated, the MS shall keep both timer T3412 and timer T3312. The two separate timers run in the MS for
updating the MME and the SGSN independently. The MS shall start timer T3323 if timer T3312 expires, and timer
T3346 is running or the MS is in one of the following states:
- GMM-REGISTERED.NO-CELL-AVAILABLE;
- GMM-REGISTERED.PLMN-SEARCH;
- GMM-REGISTERED.UPDATE-NEEDED; or
ETSI
Release 18 154 3GPP TS 24.008 V18.4.0 (2023-09)
- GMM-REGISTERED.LIMITED-SERVICE.
The MS shall initiate the routing area updating procedure and stop timer T3323 when the MS enters the state GMM-
REGISTERED.NORMAL-SERVICE before timer T3323 expires. After expiry of timer T3323 the MS shall deactivate
ISR by setting its TIN to "GUTI".
If timer T3323 expires, the MS shall memorize that it has to initiate a routing area updating procedure when it returns to
state GMM-REGISTERED.NORMAL-SERVICE.
The network supervises the periodic routing area updating procedure by means of the mobile reachable timer.
If the MS is not attached for emergency bearer services, the mobile reachable timer shall be longer than timer T3312. In
this case, by default, the mobile reachable timer is 4 minutes greater than timer T3312.
NOTE 1: According to subclause 4.7.5.1.5, if a periodic routing area updating procedure fails repeatedly, it can
take more than 7 minutes before the MS starts using MM specific procedures.
The network may include timer T3312 extended value IE in the ATTACH ACCEPT message or ROUTING AREA
UPDATE ACCEPT message only if the MS indicates support of the timer T3312 extended value in the MS network
feature support IE.
If the network includes the timer T3312 extended value IE in the ATTACH ACCEPT message or ROUTING AREA
UPDATE ACCEPT message, the network shall use the timer T3312 extended value IE as the value of timer T3312.
If ISR is not activated, when the mobile reachable timer expires, typically the network stops sending paging messages
to the mobile and may take other appropriate actions.
If the MS is attached for emergency bearer services, the SGSN shall set the mobile reachable timer with a value equal to
timer T3312. When the mobile reachable timer expires, the SGSN shall locally detach the MS.
In A/Gb mode, the mobile reachable timer is reset and started with the value as indicated above, when the READY
timer is stopped or expires. The mobile reachable timer is stopped when the READY timer is started.
In A/Gb mode, if after a READY timer negotiation the READY timer value is set to zero, the mobile reachable timer is
reset and started with its initial value. If the initial READY timer value is zero, the mobile reachable timer is reset and
started with its initial value, when the ROUTING AREA UPDATE REQUEST message is received.
In Iu mode, the mobile reachable timer is reset and started with the value as indicated above, when the MS changes
from PMM-CONNECTED to PMM-IDLE mode. The mobile reachable timer is stopped when the MS enters PMM-
CONNECTED mode.
If ISR is activated, upon expiry of the mobile reachable timer the network shall start the implicit detach timer. By
default, the implicit detach timer is 4 minutes greater than timer T3323. If the implicit detach timer expires before the
MS contacts the network, the network shall implicitly detach the MS and deactivate ISR.
If ISR is not activated, upon expiry of the mobile reachable timer the network may start the implicit detach timer. The
value of the implicit detach timer is network dependent. If the implicit detach timer expires before the MS contacts the
network, the network shall implicitly detach the MS.
If the network includes the T3324 value IE in the ATTACH ACCEPT message or ROUTING AREA UPDATE
ACCEPT message and if the MS is not attached for emergency bearer services and has no PDN connection for
emergency bearer services, the network shall set the active timer to a value equal to the value of timer T3324.
If the MS has established a PDN connection for emergency bearer services after receiving the timer T3324 value IE in
the ATTACH ACCEPT message or ROUTING AREA UPDATE ACCEPT message, the active timer shall not be
started.
When the active timer expires, typically the network stops sending paging messages to the mobile and may take other
appropriate actions.
In A/Gb mode, the active timer is reset and started with the value as indicated above, when the READY timer is stopped
or expires. The active timer is stopped when the READY timer is started.
In Iu mode, the active timer is reset and started with the value as indicated above, when the MS changes from PMM-
CONNECTED to PMM-IDLE mode. The active timer is stopped when the MS enters PMM-CONNECTED mode.
ETSI
Release 18 155 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 2: ISR is not activated when the network includes the T3324 value IE in the ATTACH ACCEPT message or
ROUTING AREA UPDATE ACCEPT message.
If the SGSN includes timer T3346 in the ROUTING AREA UPDATE REJECT message or the SERVICE REJECT
message and timer T3346 is greater than timer T3312, the SGSN sets the mobile reachable timer and the implicit detach
timer such that the sum of the timer values is greater than timer T3346.
NOTE 3: According to subclause 4.7.5.1.5, if a periodic routing area updating procedure fails repeatedly, it can
take more than 7 minutes before the MS starts using MM specific procedures.
If the MS is both IMSI attached for GPRS and non-GPRS services, and if the MS lost coverage of the registered PLMN
and timer T3312 expires or timer T3323 expires, then:
a) if the MS returns to coverage in a cell that supports GPRS and that indicates that the network is in network
operation mode I, then the MS shall either perform the combined routing area update procedure indicating
"combined RA/LA updating with IMSI attach"; or
b) if the MS returns to coverage in a cell in the same RA that supports GPRS and that indicates that the network is
in network operation mode II, then the MS shall perform the periodic routing area updating procedure indicating
"Periodic updating"; or
c) if the MS was both IMSI attached for GPRS and non-GPRS services in network operation mode I and the MS
returns to coverage in a cell in the same LA that does not support GPRS, then the MS shall perform the periodic
location updating procedure. In addition, the MS shall perform a combined routing area update procedure
indicating "combined RA/LA updating with IMSI attach" when the MS enters a cell that supports GPRS and that
indicates that the network is in network operation mode I; or
d) if the MS returns to coverage in a new RA, the description given in subclause 4.7.5 applies.
If this subclause specifies that the MS shall perform a periodic routing area updating procedure, but subclause 4.7.5
specifies the MS shall perform a normal or combined routing area updating procedure, the description in
subclause 4.7.5 takes precedence.
If the MS is both IMSI attached for GPRS and non-GPRS services in a network that operates in network operation
mode I, and if the MS has camped on a cell that does not support GPRS, and timer T3312 expires or timer T3323
expires, then the MS shall start an MM location updating procedure. In addition, the MS shall perform a combined
routing area update procedure indicating "combined RA/LA updating with IMSI attach" when the MS enters a cell that
supports GPRS and indicates that the network is in operation mode I.
If timer T3312 expires or timer T3323 expires during an ongoing CS connection, then a MS operating in MS operation
mode B shall treat the expiry of T3312 when the MM state MM-IDLE is entered, analogous to the descriptions for the
cases when the timer expires out of coverage or in a cell that does not support GPRS.
In A/Gb mode, timer T3312 and timer T3323 shall not be stopped when a GPRS MS enters state GMM-
REGISTERED.SUSPENDED.
4.7.2.3 PMM-IDLE mode and PMM-CONNECTED mode (Iu mode only)

An MS shall enter PMM-CONNECTED mode when a PS signalling connection for packet switched domain is
established between the MS and the network. The MS shall not perform periodic routing area update in PMM-
CONNECTED mode.
An MS shall enter PMM-IDLE mode when the PS signalling connection for packet switched domain between the MS
and the network has been released. The MS shall perform periodic routing area update in PMM-IDLE mode.
4.7.2.4 Handling of Force to standby in Iu mode (Iu mode only)

Force to standby is not applicable for Iu mode.
The network shall always indicate Force to standby not indicated in the Force to standby information element.
The Force to standby information element shall be ignored by the MS.
ETSI
Release 18 156 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.2.5 RA Update procedure for Signalling Connection Re-establishment (Iu mode

only)
When the MS receives an indication from the lower layers that the RRC connection has been released with cause
"Directed signalling connection re-establishment", see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111], then the MS
shall enter PMM-IDLE mode and initiate immediately a normal routing area update procedure (the use of normal or
combined procedure depends on the network operation mode in the current serving cell) regardless whether the routing
area has been changed since the last update or not. This routing area update procedure shall also be performed or
continued if the MS has performed an inter-system change towards GSM, irrespective whether the READY timer is
running or the MS is in PMM-IDLE or PMM-CONNECTED mode.
4.7.2.6 Cell Update triggered by low layers

A Cell Update may be requested by the low layers, see 3GPP TS 44.060 [76]. In this case the Cell Update shall be
performed even if the READY timer is not running. If both the network and the MS support the Cell Notification, then
the MS shall use the LLC NULL frame to perform the Cell Update.
4.7.2.7 Handling of timer T3302

The value of timer T3302 can be sent by the network to the MS in the ATTACH ACCEPT message, ROUTING AREA
UPDATE ACCEPT message, ATTACH REJECT message, and ROUTING AREA UPDATE REJECT message. The
MS shall apply this value, if the value is different from "deactivated" in the routing area registered by the MS, until a
new value is received. The default value of this timer is used in the following cases:
- ATTACH ACCEPT message, ATTACH REJECT message, or ROUTING AREA UPDATE REJECT message
is received without a value specified;
- ROUTING AREA UPDATE ACCEPT message is received without a value specified, and the update type in the
ROUTING AREA UPDATE REQUEST message is not set to "periodic updating";
- In Iu mode, if the network provides a value in a non-integrity protected Iu mode GMM message and the MS is
not attaching for emergency services or not attached for emergency services;
- In A/Gb mode and if the MS supports integrity protection, if the network provides a value in a non-integrity
protected GMM message;
- the network indicates that the timer is "deactivated";
- the MS does not have a stored value for this timer;
- a new PLMN which is not in the list of equivalent PLMNs has been entered, the routing area updating fails and
the routing area updating attempt counter is equal to 5; or
- a new PLMN which is not in the list of equivalent PLMNs has been entered, the attach procedure fails, and the
attach attempt counter is equal to 5.
4.7.2.8 Handling of timer T3324 (A/Gb mode, Iu mode and S1 mode)

An MS supporting PSM may request the network to assign a value for T3324 by including a requested timer value in:
- the ATTACH REQUEST or ROUTING AREA UPDATE REQUEST message (in A/Gb mode and Iu mode ); or
- the ATTACH REQUEST or TRACKING AREA UPDATE REQUEST message (in S1 mode).
The value of timer T3324 can be sent by the network to the MS in:
- the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT message (in A/Gb mode and Iu mode ); and
- the ATTACH ACCEPT or TRACKING AREA UPDATE ACCEPT message (in S1 mode).
NOTE: Besides the value requested by the MS, the network can take local configuration into account when
selecting a value for T3324 (see 3GPP TS 23.682 [133A], subclause 4.5.4).
ETSI
Release 18 157 3GPP TS 24.008 V18.4.0 (2023-09)
In A/Gb mode and Iu mode, the MS shall apply the received T3324 value in the RA identified by the RAI contained in
the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT message, until a new value is received, T3324 is
deactivated or a new PLMN is selected. The timer T3324 is deactivated if:
- the last attach or routing area updating attempt was not completed successfully;
- the network does not include a value for timer T3324 in the last ATTACH ACCEPT or ROUTING AREA
UPDATE ACCEPT message received by the MS; or
- the indicated value of the timer is "deactivated".
In A/Gb mode and Iu mode, timer T3324 is reset and started with its initial value, when the MS changes from PMM-
CONNECTED mode to PMM-IDLE mode (in Iu mode) or when the READY timer is stopped or expires (in A/Gb
mode). Timer T3324 is stopped when the MS enters PMM-CONNECTED mode or GMM-DEREGISTERED state or
the READY timer is started.
In S1 mode, the MS shall apply the received T3324 value in all tracking areas of the list of tracking areas assigned to
the MS, until a new value is received, T3324 is deactivated or a new PLMN is selected. The timer T3324 is deactivated
if:
- the last attach or tracking area updating attempt was not completed successfully;
- the network does not include a value for timer T3324 in the last ATTACH ACCEPT or TRACKING AREA
UPDATE ACCEPT message received by the MS; or
- the indicated value of the timer is "deactivated".
In S1 mode, timer T3324 is reset and started with its initial value, when the MS changes from EMM-CONNECTED
mode to EMM-IDLE mode. Timer T3324 is stopped when the MS enters EMM-CONNECTED mode or EMM-
DEREGISTERED state.In A/Gb mode and Iu mode, when timer T3324 expires the MS may activate PSM as specified
in subclause 4.7.2.9.
In S1 mode, when timer T3324 expires the MS may activate PSM as specified in 3GPP TS 24.301 [120],
subclause 5.3.11.
In A/Gb mode and Iu mode, if timer T3324 expires during an ongoing CS connection, the MS shall take action on the
expiry of timer T3324 as described in subclause 4.7.2.9 when the MM state MM-IDLE is entered.
4.7.2.9 Power saving mode

The MS can request the use of power saving mode (PSM) during an attach or routing area updating procedures (see
3GPP TS 23.682 [133A] and 3GPP TS 23.060 [74]). The MS shall not request the use of PSM during:
- an attach for emergency bearer services procedure;
- a routing area updating procedure for initiating a PDN connection for emergency bearer services; or
- a routing area updating procedure when the MS has a PDN connection established for emergency bearer
services.
The network accepts the use of PSM by providing a specific value for timer T3324 when accepting the attach or routing
area updating procedure. The MS may use PSM only if the network has provided the T3324 value IE during the last
attach or routing area updating procedure with a value different from "deactivated".
Upon expiry of the timer T3324 or if the T3324 value provided by the network is zero, the MS may deactivate the AS
layer and activate PSM by entering the state GMM-REGISTERED.NO-CELL-AVAILABLE if:
a) the MS is not attached for emergency bearer services;
b) the MS has no PDN connection for emergency bearer services;
c) the MS is in PMM-IDLE mode (in Iu mode) or the READY timer is not running (in A/Gb mode);
d) the MS is in the GMM-REGISTERED.NORMAL-SERVICE state; and
e) no RR connection exists.
ETSI
Release 18 158 3GPP TS 24.008 V18.4.0 (2023-09)
If conditions a, b, c and e are fulfilled, but the MS is in a state other than GMM-REGISTERED.NORMAL-SERVICE
when timer T3324 expires, the MS may activate PSM when the MS returns to state GMM-REGISTERED.NORMAL-
SERVICE.
If conditions a, b, c and d are fulfilled, but an RR connection exists, the MS may activate PSM when the RR connection
has been released.
An MS that has already been allocated timer T3324 with a value different from "deactivated" and the timer T3324 has
expired, may activate PSM if it receives an "Extended wait time" from lower layers.
When PSM is activated all NAS timers are stopped and associated procedures aborted except for timers T3312, T3346,
T3396, any backoff timers, and the timer T controlling the periodic search for HPLMN or EHPLMN (if the EHPLMN
list is present) or higher prioritized PLMNs (see 3GPP TS 23.122 [14]).
If the MS is attached for emergency bearer services or has a PDN connection for emergency bearer services, the MS
shall not activate PSM.
The MS may deactivate PSM at any time (e.g. for transfer of mobile originated signalling or user data, or to initiate a
mobile originated circuit-switched transaction), by activating the AS layer before initiating the necessary GMM or MM
procedures (if any).
4.7.2.10 Extended idle-mode DRX cycle

The MS can request the use of extended idle mode DRX cycle (eDRX) during an attach or routing area updating
procedure by including the extended DRX parameters IE (see 3GPP TS 23.682 [11A] and 3GPP TS 23.060 [74]). The
MS shall not request the use of eDRX during:
- an attach for emergency bearer services procedure; or
- a routing area updating procedure for the MS attached for emergency bearer services.
The MS and the network may negotiate eDRX parameters during a routing area updating procedure when the MS has a
PDP context for emergency bearer services.
The network accepts the request to use eDRX by providing the extended DRX parameters IE when accepting the attach
or the routing area updating procedure. The MS shall use extended idle mode DRX cycle only if it received the
extended DRX parameters IE during the last attach or routing area updating procedure and the MS does not have a PDP
context for emergency bearer services.
NOTE: If the MS wants to keep using eDRX, the MS includes the extended DRX parameters IE in each attach or
If the MS received the extended DRX parameters IE during the last attach or routing area updating procedure, upon the
successful completion of the PDP context deactivation procedure for a PDP context for emergency bearer services, the
MS shall resume eDRX.
If the network has provided the extended DRX parameters IE during the last attach or routing area updating procedure,
upon the successful completion of the PDP context deactivation procedure for a PDP context for emergency bearer
services, the network shall resume eDRX.
If the MS or the network locally deactivates the PDP context for emergency bearer service, the MS or the network shall
not use eDRX until the MS receives eDRX parameters during a routing area updating procedure with PDP context
synchronization or upon successful completion of a service request procedure.
If the MS did not receive the extended DRX parameters IE, or if the MS has a PDP context for emergency bearer
services, the MS shall use the stored DRX parameters, if available.
If the network did not accept the request to use eDRX, or if the MS has a PDP context for emergency bearer services,
the network shall use the stored DRX parameters, if available.
4.7.2.11 Interaction between power saving mode and extended idle mode DRX cycle
The MS can request the use of both PSM and eDRX during an attach or routing area update procedure but it is up to the
network to decide to enable none, one of them or both (see 3GPP TS 23.682 [133A] and 3GPP TS 23.060 [74]).
ETSI
Release 18 159 3GPP TS 24.008 V18.4.0 (2023-09)
If the network accepts the use of both PSM (see subclause 4.7.2.9) and eDRX (see subclause 4.7.2.10), the extended
DRX parameters IE provided to the MS should allow for multiple paging occasions before the active timer expires.
4.7.2.12 Extended coverage for GSM

The MS can support and use the extended coverage in GSM for IoT (EC-GSM-IoT) feature (see
3GPP TS 43.064 [159]). A GPRS MS using EC-GSM-IoT may operate in MS operation mode C only. If the MS uses
one of the four coverage classes of EC-GSM-IoT as defined in 3GPP TS 43.064 [159], the MS shall calculate the value
of the applicable NAS timers as indicated in tables 11.3, 11.3A and 11.2c using a multiplier of 3, unless the timer is
deactivated. The NAS timer value obtained is used as described in the appropriate procedure subclause of this
specification. The NAS timer value shall be calculated at start of a NAS procedure and shall not be re-calculated until
the NAS procedure is completed, restarted or aborted.
The usage of one of the four coverage classes of EC-GSM-IoT by an MS is indicated to the SGSN by lower layers.
When a SGSN that supports EC-GSM-IoT performs NAS signaling with an MS that is using EC-GSM-IoT, the SGSN
shall calculate the value of the applicable NAS timers as indicated in tables 11.4, 11.4a and 11.2d using a multiplier of
3. The NAS timer value shall be calculated at start of a NAS procedure and shall not be re-calculated until the NAS
procedure is completed, restarted or aborted.
In order to deal with use of extensive resources from the network, the operator may prevent specific subscribers from
using enhanced coverage (see 3GPP TS 23.060 [74]). When in A/Gb mode, the MS supporting EC-GSM-IoT shall
indicate support for restriction on use of enhanced coverage. The MS supporting restriction on use of enhanced
coverage indicates "Mobile station supports restriction on use of enhanced coverage" in the MS network capability
information element in the ATTACH REQUEST and ROUTING AREA UPDATE REQUEST message. If the MS
supports restriction on use of enhanced coverage, the SGSN indicates whether the use of enhanced coverage is
restricted or not in the ATTACH ACCEPT message and ROUTING AREA UPDATE ACCEPT message (see
subclause 4.7.3.1 and subclause 4.7.5.1). If the use of enhanced coverage is restricted the MS shall not use enhanced
coverage in the registered PLMN and in any PLMN which is in the list of equivalent PLMNs.
4.7.3 GPRS attach procedure

The GPRS attach procedure is used for the following purposes:
- normal GPRS attach, performed by the MS to IMSI attach for GPRS services only. The normal GPRS attach
procedure shall be used:
- by GPRS MSs in MS operation mode C, independent of the network operation mode;
- by GPRS MSs in MS operation modes A or B if the network operates in network operation mode II; and
- by GPRS MSs in MS operation mode A, independent of the network operation mode, if a circuit-switched
transaction is ongoing;
- combined GPRS attach procedure, used by GPRS MSs in MS operation modes A or B to attach the IMSI for
GPRS and non-GPRS services provided that the network operates in network operation mode I.
- GPRS attach for emergency bearer services, performed by the MS to IMSI or IMEI attach to emergency bearer
services.
The lower layers indicate to NAS that the network does not support emergency bearer services for the MS in limited
service state (see 3GPP TS 25.331 [23c]). This information is taken into account when deciding whether to initiate
attach for emergency bearer services.
With a successful GPRS attach procedure a GMM context is established.
When the timer T3346 is running, MS is allowed to initiate an attach procedure if:
- the MS is an MS configured to use AC11 – 15 in selected PLMN;
- the MS is attaching for emergency bearer services; or
- the MS has timer T3346 running because a request from an MS with the low priority indicator set to "MS is
configured for NAS signalling low priority" was rejected, and the MS needs to attach without the low priority
indicator, or with the low priority indicator set to "MS is not configured for NAS signalling low priority".
ETSI
Release 18 160 3GPP TS 24.008 V18.4.0 (2023-09)
An eCall only mobile station that is not capable of eCall over IMS shall not perform a normal or combined GPRS attach
procedure.
An eCall only mobile station that is capable of eCall over IMS may perform a normal or combined GPRS attach
procedure only upon failure of a routing area updating procedure following intersystem change from S1 mode to A/Gb
or Iu mode.
When the MS moves from NG-RAN coverage to GERAN coverage, or from NG-RAN coverage to UTRAN coverage,
the MS shall perform a normal or combined GPRS attach procedure, if the following applies:
- the MS initiated a registration procedure while in N1 mode; and
- since then the MS did not perform a successful EPS attach or tracking area updating procedure in S1 mode or
GPRS attach or routing area updating procedure in A/Gb mode or Iu mode.
Subclause 4.7.3.1 describes the GPRS attach procedure to attach the IMSI only for GPRS services. The combined
GPRS attach procedure used to attach the IMSI for both GPRS and non-GPRS services is described in
subclause 4.7.3.2. GPRS attach for emergency bearer services is described as part of subclause 4.7.3.1.
If an IMSI attach for non-GPRS services is requested and a GMM context exists, the routing area updating procedure
shall be used as described in subclause 4.7.5.2.
To limit the number of consecutive rejected attach attempts, a GPRS attach attempt counter is introduced. The GPRS
attach attempt counter shall be incremented as specified in subclause 4.7.3.1.5. Depending on the value of the GPRS
attach attempt counter, specific actions shall be performed. The GPRS attach attempt counter shall be reset when:
- the MS is powered on;
- a SIM/USIM is inserted;
- a GPRS attach or combined GPRS attach procedure is successfully completed;
- an attach or combined attach procedure is successfully completed in S1 mode;
- a combined GPRS attach procedure is completed for GPRS services only with cause #2, #16, #17, #22 or #28;
- a GPRS attach or combined GPRS attach procedure is rejected with cause #11, #12, #13, #14 ,#15 or #25;
- a network initiated detach procedure is completed with cause #11, #12, #13, #14, #15 or #25; or
- a new PLMN is selected;
and additionally when the MS is in substate ATTEMPTING-TO-ATTACH:
- a new routing area is entered;
- an attach is triggered by CM sublayer requests;
location areas for regional provision of service". The handling of these lists is described in subclause 4.4.1; the same
lists are used by GMM and MM procedures.
shall construct the Routing Area Identification of the cell from this chosen PLMN identity, and the LAC and the RAC
received on the BCCH. For:
- a shared GERAN, in A/Gb mode, the chosen PLMN identity is indicated to the GERAN in the first RLC data
block of an upper layer PDU (see 3GPP TS 44.060 [76]) when a foreign TLLI or a random TLLI is used by the
network sharing supporting MS for the transmission.
ETSI
Release 18 161 3GPP TS 24.008 V18.4.0 (2023-09)
Whenever an ATTACH REJECT message with the cause "PLMN not allowed" is received by the MS, the chosen
PLMN indentity shall be stored in the "forbidden PLMN list" and if the MS is configured to use timer T3245 (see
3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in
subclause 4.1.1.6. Whenever an ATTACH REJECT message is received by the MS with the cause "Roaming not
allowed in this location area", "Location Area not allowed", or "No suitable cells in Location Area", the LAI that is part
of the constructed RAI shall be stored in the suitable list.
The network informs the MS about the support of specific features, such as LCS-MOLR, MBMS, IMS voice over PS
session, emergency bearer services in Iu mode in the Network feature supporti nformation element. The information is
either explicitly given by sending the Network feature support IE or implicitly by not sending it. The handling in the
network is described in subclause 9.4.2.9. The network can also use the Additional network feature support IE in order
to inform the MS about the support of specific features such as the delivery of SMS via GPRS (GPRS-SMS) or
implicitly by not sending it. The MS may use the support indications for LCS-MOLR, MBMS and GPRS-SMS to
inform the user about the availability of the appropriate services. The MS shall not request the LCS-MOLR or MBMS
services, if the service has not been indicated as available. The indication for MBMS is defined in subclause "MBMS
feature support indication" in 3GPP TS 23.246 [106]. In an MS with IMS voice over PS capability, the IMS voice over
PS session indicator and the emergency bearer services indicator shall be provided to the upper layers. The upper layers
take the IMS voice over PS session indicator into account as specified in 3GPP TS 23.221 [131], subclause 7.2a and
subclause 7.2b, when selecting the access domain for voice sessions or calls in Iu mode. When initiating an emergency
call in Iu mode, the upper layers also take the emergency bearer services indicator into account for the access domain
selection. The MS may use the GPRS-SMS indication in order to obtain SMS.
4.7.3.1 GPRS attach procedure for GPRS services

The GPRS attach procedure is a GMM procedure used by GPRS MSs to IMSI attach for GPRS services. The procedure
is also used by GPRS MSs to IMSI or IMEI attach for emergency bearer services.
The attach type information element shall indicate "GPRS attach". For an MS attaching for emergency bearer services
the attach type information element shall indicate "Emergency attach".
4.7.3.1.1 GPRS attach procedure initiation

In state GMM-DEREGISTERED, the MS initiates the GPRS attach procedure by sending an ATTACH REQUEST
message to the network, starts timer T3310 and enters state GMM-REGISTERED-INITIATED. If timer T3302 is
currently running, the MS shall stop timer T3302. If timer T3311 is currently running, the MS shall stop timer T3311.
If the MS is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and the
selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs, the MS shall include the IMSI in
the Mobile identity IE in the ATTACH REQUEST message.
For all other cases:
If the MS does not support S1 mode:
- the MS capable of both Iu mode and A/Gb mode or only of A/Gb mode shall include a valid P-TMSI, if any is
available, the P-TMSI signature associated with the P-TMSI and the routing area identity associated with the P-
TMSI in the ATTACH REQUEST message. In addition, the MS shall include P-TMSI type IE with P-TMSI
type set to "native P-TMSI". If there is no valid P-TMSI available, the IMSI shall be included instead of the P-
TMSI and P-TMSI signature.
If the MS supports S1 mode:
- if the TIN indicates "GUTI" and the MS holds a valid GUTI allocated by an MME, the MS shall map the GUTI
into the Mobile identity IE, P-TMSI signature IE and Old routing area identification IE. The MS shall also
include P-TMSI type IE with P-TMSI type set to "mapped P-TMSI". Additionally, if the MS holds a valid P-
TMSI and RAI, the MS shall indicate the P-TMSI in the Additional mobile identity IE and the RAI in the
Additional old routing area identification IE.
NOTE: The mapping of the GUTI to the P-TMSI, P-TMSI signature and RAI is specified in
3GPP TS 23.003 [10].
ETSI
Release 18 162 3GPP TS 24.008 V18.4.0 (2023-09)
- If the TIN indicates "P-TMSI" or "RAT-related TMSI" and the MS holds a valid P-TMSI and a RAI, the MS
shall indicate the P-TMSI in the Mobile identity IE and the RAI in the Old routing area identification IE. The
MS shall also include P-TMSI type IE with P-TMSI type set to "native P-TMSI". If a P-TMSI signature is
associated with the P-TMSI, the MS shall include it in the Old P-TMSI signature IE.
- If the TIN is deleted and
- the MS holds a valid P-TMSI and a RAI, the MS shall indicate the P-TMSI in the Mobile identity IE and the
RAI in the Old routing area identification IE. The MS shall also include P-TMSI type IE with P-TMSI type
set to "native P-TMSI". If a P-TMSI signature is associated with the P-TMSI, the MS shall include it in the
Old P-TMSI signature IE; or
- the MS does not hold a valid P-TMSI and RAI, but holds a valid GUTI allocated by an MME, the MS shall
map the GUTI into the Mobile identity IE, P-TMSI signature IE and Old routing area identification IE. The
MS shall also include P-TMSI type IE with P-TMSI type set to "mapped P-TMSI"; or
- the MS does not hold a valid P-TMSI, RAI or GUTI, the MS shall include the IMSI in the Mobile identity
IE.
- Otherwise the MS shall include the IMSI in the Mobile identity IE.
In the cases when the MS maps a GUTI into the Mobile identity IE, P-TMSI signature IE and Old routing area
identification IE, then:
- If a current EPS security exists, the P-TMSI signature shall include a truncated NAS token as specified in
3GPP TS 33.401 [123]. In the GPRS ciphering key sequence number IE, the MS shall indicate the value of the
eKSI associated with the current EPS security context. The MS shall derive CK' and IK' from the K ASME and the
NAS uplink COUNT value corresponding to the NAS token derived and handle the START value as specified in
3GPP TS 25.331 [23c]. Then, the MS shall store the mapped UMTS security context replacing the established
UMTS security context for the PS domain.
- If a current EPS security does not exist, the MS shall set the truncated NAS token included in the P-TMSI
signature to all zeros and the GPRS ciphering key sequence number to "No key is available".
If the MS is attaching for emergency bearer services and does not hold a valid GUTI, P-TMSI or IMSI as described
above, the IMEI shall be included in the Mobile identity IE.
The MS shall also indicate within the DRX parameters whether it supports the split pg cycle option on CCCH. The
optional support of the split pg cycle on CCCH by the network is indicated in SI13 or PSI1. Split pg cycle on CCCH is
applied by both the network and the MS when the split pg cycle option is supported by both (see 3GPP TS 45.002 [32]).
If the MS supports eDRX and requests the use of eDRX, the MS shall include the extended DRX parameters IE in the
ATTACH REQUEST message.
In Iu mode, if the MS wishes to prolong the established PS signalling connection after the GPRS attach procedure (for
example, the MS has any CM application request pending), it may set a follow-on request pending indicator on (see
subclause 4.7.13).
An MS attaching for emergency bearer services shall set the follow-on request pending indicator.
If the MS supports PSM and requests the use of PSM, then the MS shall include the T3324 value IE with a requested
timer value in the ATTACH REQUEST message. When the MS includes the T3324 value IE and the MS indicates
support for extended periodic timer value in the MS network feature support IE, it may also include the T3312 extended
value IE to request a particular T3312 value to be allocated.
In A/Gb mode, if the MS supports the restriction on use of enhanced coverage, then the MS shall set the Restriction on
use of enhanced coverage capability bit to "Mobile station supports restriction of use of enhanced coverage" in the MS
network capability IE of the ATTACH REQUEST message.
If the MS supports dual connectivity of E-UTRA with New Radio (NR), then the MS shall set the Dual connectivity of
E-UTRA with NR capability bit to "Mobile station supports dual connectivity of E-UTRA with NR" in the MS network
capability IE of the ATTACH REQUEST message.
In A/Gb mode, if a UMTS security context is available and if the MS indicates support of integrity protection in the MS
network capability IE included in the ATTACH REQUEST message, then the MS shall derive a GPRS GSM Kint key
ETSI
Release 18 163 3GPP TS 24.008 V18.4.0 (2023-09)
as described in subclause 4.7.7.3b and a GPRS GSM Kc128 key as described in subclause 4.7.7.3a. The MS shall then
assign the GPRS GSM Kint key, the GPRS GSM Kc128 key, the GPRS GSM integrity algorithm and the GPRS GSM
ciphering algorithm (identified by the information in the Ciphering Algorithm IE and Integrity Algorithm IE stored in
the non-volatile ME memory) to the LLC layer, and indicate to the LLC layer that it shall start integrity protection. This
shall be done so that the LLC layer can integrity protect, but not cipher, the ATTACH REQUEST message. The MS
shall include the CKSN in the CKSN IE in the ATTACH REQUEST message. If the MS has no UMTS security context
available, then the MS shall not integrity protect the ATTACH REQUEST message in the LLC layer. In this case the
MS shall set the CKSN IE to the value "no key is available" and send the ATTACH REQUEST unprotected.
4.7.3.1.2 GMM common procedure initiation

If the network receives an ATTACH REQUEST message containing the P-TMSI type IE and the Mobile identity IE
with type of identity indicating "TMSI/P-TMSI/M-TMSI", and the network does not follow the use of the most
significant bit of the LAC as specified in 3GPP TS 23.003 [10] subclause 2.8.2.2.2, the network shall use the P-TMSI
type IE to determine whether the mobile identity included in the Mobile identity IE is a native P-TMSI or a mapped
P-TMSI.
The network may initiate GMM common procedures, e.g. the GMM identification and GMM authentication and
ciphering procedure, depending on the received information such as IMSI, CKSN, old RAI, P-TMSI and P-TMSI
signature.
4.7.3.1.3 GPRS attach accepted by the network

During an attach for emergency bearer services, if not restricted by local regulations, the network shall not check for
mobility and access restrictions, regional restrictions, subscription restrictions, or perform CSG access control when
processing the ATTACH REQUEST message. The network shall not apply subscribed APN based congestion control
during an attach procedure for emergency bearer services.
If the GPRS attach request is accepted by the network, an ATTACH ACCEPT message is sent to the MS.
In A/Gb mode, if the MS indicates support of integrity protection in the MS network capability IE in the ATTACH
REQUEST message, and if the network supports integrity protection, then the network shall store all octets received
from the MS in the MS network capability IE and in the MS Radio Access Capability IE, up to the maximum length
defined for the respective information element.
NOTE 1: The network needs to store the MS network capability IE and the MS Radio Access Capability IE exactly
as received from the MS and network is not allowed to ignore the "higher" octets sent by the MS even if
the network does not support any features indicated in the higher octets. Otherwise the replay check of the
MS network capability and the MS Radio Access Capability will fail in the MS.
In A/Gb mode, if a UMTS security context is available in the network and if the MS indicates support of integrity
protection in the ATTACH REQUEST message and the network supports integrity protection, and if integrity
protection of the ATTACH REQUEST message is successfully verified in the LLC layer in the network, then if the
network decides to re-authenticate the MS or select a new integrity algorithm or ciphering algorithm, the network shall
initiate an authentication and ciphering procedure.
protection in the ATTACH REQUEST message and the network supports integrity protection if integrity protection of
the ATTACH REQUEST message is successfully verified in the LLC layer in the network , the network may decide to
continue using the stored: GPRS GSM Kint integrity key, the GPRS GSM Kc128 ciphering key, the GPRS GSM
ciphering algorithm and the GPRS GSM integrity algorithm in the LLC layer without initiating an authentication and
ciphering procedure. If the MS and network continue to use the same ciphering mode as when the MS was previously
attached to the network, ciphering or no ciphering, the ciphering mode is re-established without the need to run an
authentication and ciphering procedure. The network shall replay the MS network capability IE and the MS radio access
capability IE received from the MS in the ATTACH REQUEST message, by including the MS network capability IE
and the MS radio access capability IE in the ATTACH ACCEPT message to the MS. The GMM layer in the network
shall assign the stored GPRS GSM Kint key, the GPRS GSM Kc128 key, the GPRS GSM integrity algorithm and the
GPRS GSM ciphering algorithm to the LLC layer. The GMM layer in the network shall then indicate to the LLC layer
that it shall start integrity protection and ciphering in the LLC layer before sending the ATTACH ACCEPT message to
the MS. If the integrity protection of the ATTACH REQUEST message is not successfully verified in the LLC layer or
if the ATTACH REQUEST message is received without integrity protection, then the network shall progress the
ETSI
Release 18 164 3GPP TS 24.008 V18.4.0 (2023-09)
ATTACH REQUEST message and initiate an authentication and ciphering procedure in order to authenticate the MS
and activate integrity protection and ciphering in the MS.
protection in the ATTACH REQUEST message and the network supports integrity protection, and if the network is not
able to verify the message authentication code in the LLC layer protecting the ATTACH REQUEST message, due to
the LLC layer at the network not having been configured yet with the integrity key and integrity algorithm for this MS,
then the network shall progress the ATTACH REQUEST message at GMM layer anyway. If the CKSN included in the
ATTACH REQUEST message belongs to an UMTS security context available in the network, then the network may re-
establish integrity protection and ciphering of layer 3 signalling messages in the LLC layer without initiating an
authentication and ciphering procedure.
In A/Gb mode, if the MS indicates support of integrity protection of user plane data in the MS network capability IE in
the ATTACH REQUEST message, and if the network supports and accepts integrity protection of user plane data, then
the network shall indicate integrity protection of user plane data to the MS in the ATTACH ACCEPT message. The MS
shall indicate to the LLC layer to start integrity protection of user plane data after the reception of the ATTACH
ACCEPT message. The same GPRS GSM Kint key and the same GPRS GSM integrity algorithm used for integrity
protection of layer 3 signalling messages shall be used for integrity protection of user plane data in the LLC layer. The
network shall indicate to the LLC layer to start integrity protection of user plane data after sending off the ATTACH
ACCEPT message to the MS. If the network does not indicate to the MS in the ATTACH ACCEPT message that it
accepts the use of integrity protection of user plane, and if the MS does not accept such a network, then the MS shall
detach from the network.
The P-TMSI reallocation may be part of the GPRS attach procedure. When the ATTACH REQUEST includes the IMSI
or IMEI, the SGSN shall allocate the P-TMSI. The P-TMSI that shall be allocated is then included in the ATTACH
ACCEPT message together with the routing area identifier. The network shall, in this case, change to state GMM-
COMMON-PROCEDURE-INITIATED and shall start timer T3350 as described in subclause 4.7.6. Furthermore, the
network may assign a P-TMSI signature for the GMM context which is then also included in the ATTACH ACCEPT
message. If the LAI or PLMN identity that has been transmitted in the ATTACH ACCEPT message is a member of any
of the "forbidden" lists, any such entry shall be deleted. If the attach procedure is for emergency bearer services, the
"forbidden" lists shall remain unchanged. Additionally, the network shall include the radio priority level to be used by
the MS for mobile originated SMS transfer in the ATTACH ACCEPT message.
In a shared network, if the MS is a network sharing supporting MS, the network shall indicate the PLMN identity of the
CN operator that has accepted the GPRS attach request in the RAI contained in the ATTACH ACCEPT message; if the
MS is a network sharing non-supporting MS, the network shall indicate the PLMN identity of the common PLMN (see
3GPP TS 23.251 [109]). If the PLMN identity of the common PLMN included in the RAI does not identify the CN
operator that has accepted the GPRS attach request, the network may include the PLMN identity of the CN operator that
has accepted the GPRS attach request in the ATTACH ACCEPT message.
In a multi-operator core network (MOCN) with common GERAN, the network shall indicate in the RAI the common
PLMN identity (see 3GPP TS 23.251 [109]).
If the common PLMN identity included in the RAI does not identify the CN operator that has accepted the GPRS attach
request, the network may include the PLMN identity of the CN operator that has accepted the GPRS attach request in
the ATTACH ACCEPT message.
If the MS has indicated in the ATTACH REQUEST message that it supports PS inter-RAT handover from GERAN to
UTRAN Iu mode, the network may include in the ATTACH ACCEPT message a request to provide the Inter RAT
information container.
If the MS has included the MS network capability IE or the UE network capability IE or both in the ATTACH
REQUEST message, the network shall store all octets received from the MS, up to the maximum length defined for the
respective information element.
NOTE 2: This information is forwarded to the new SGSN during inter-SGSN handover or to the new MME during
intersystem handover to S1 mode.
If the DRX parameter was included in the DRX Parameter IE in the ATTACH REQUEST message, the network shall
replace any stored DRX parameter with the received parameter and use it for the downlink transfer of signalling and
user data.
ETSI
Release 18 165 3GPP TS 24.008 V18.4.0 (2023-09)
The network shall include the extended DRX parameters IE in the ATTACH ACCEPT message only if the extended
DRX parameters IE was included in the ATTACH REQUEST message, and the network supports and accepts the use
of eDRX.
In A/Gb mode, the Cell Notification information element shall be included in the ATTACH ACCEPT message by the
network which indicates that the Cell Notification is supported by the network.
In Iu mode, the network should prolong the PS signalling connection if the mobile station has indicated a follow-on
request pending in ATTACH REQUEST. The network may also prolong the PS signalling connection without any
indication from the mobile terminal.
The MS, receiving an ATTACH ACCEPT message, stores the received routing area identification, stops timer T3310,
resets the GPRS attach attempt counter, resets the routing area updating attempt counter, resets the service request
attempt counter, enters state GMM-REGISTERED and sets the GPRS update status to GU1 UPDATED.
If the message contains a P-TMSI, the MS shall use this P-TMSI as the new temporary identity for GPRS services. In
this case, an ATTACH COMPLETE message is returned to the network. The MS shall delete its old P-TMSI and shall
store the new one. If no P-TMSI has been included by the network in the ATTACH ACCEPT message, the old P-TMSI,
if any available, shall be kept.
If the message contains a P-TMSI signature, the MS shall use this P-TMSI signature as the new temporary signature for
the GMM context. The MS shall delete its old P-TMSI signature, if any is available, and shall store the new one. If the
message contains no P-TMSI signature, the old P-TMSI signature, if available, shall be deleted.
If the network supports delivery of SMS via GPRS (3GPP TS 23.060 [74]) and this delivery is enabled (see
3GPP TS 29.272 [150]), then the network shall include the Additional network feature support IE in the ATTACH
ACCEPT message and set the GPRS-SMS indicator.
If the network supports the extended protocol configuration options IE and the MS indicated support of the extended
protocol configuration options IE, then the network shall include the Additional network feature support IE in the
ATTACH ACCEPT message and set the ePCO IE indicator to "extended protocol configuration options IE supported".
Upon receiving the ATTACH ACCEPT message an MS supporting S1 mode shall set the TIN to "P-TMSI".
If the network has requested the provision of Inter RAT handover information, the MS shall return an ATTACH
COMPLETE message including the Inter RAT handover information IE to the network.
The network may also send a list of "equivalent PLMNs" in the ATTACH ACCEPT message. Each entry of the list
contains a PLMN code (MCC+MNC). The mobile station shall store the list, as provided by the network, and if the
GPRS attach procedure is not for emergency bearer services, any PLMN code that is already in the "forbidden PLMN"
list shall be removed from the "equivalent PLMNs" list before it is stored by the mobile station. If the mobile station is
operating in MS operation mode C or the mobile station is supporting S1 mode, it shall also remove any PLMN code
that is already in the list of "forbidden PLMNs for GPRS service" before storing the list. In addition the mobile station
shall add to the stored list the PLMN code of the registered PLMN that sent the list. All PLMNs in the stored list shall
be regarded as equivalent to each other for PLMN selection, cell selection/re-selection and handover. The stored list in
the mobile station shall be replaced on each occurrence of the ATTACH ACCEPT message. If no list is contained in the
message, then the stored list in the mobile station shall be deleted. An MS attached for emergency bearer services shall
delete the stored list when the MS enters the state GMM-DEREGISTERED. The list shall be stored in the mobile
station while switched off so that it can be used for PLMN selection after switch on.
The network shall include the T3324 value IE in the ATTACH ACCEPT message only if the T3324 value IE was
included in the ATTACH REQUEST message, and the network supports and accepts the use of PSM.
If the network supports and accepts the use of PSM, and the MS included the T3312 extended value IE in the ATTACH
REQUEST message, then the network shall take into account the T3312 value requested when providing the Periodic
RA update timer IE and the T3312 extended value IE in the ATTACH ACCEPT message.
NOTE 3: Besides the value requested by the MS, the network can take local configuration into account when
selecting a value for T3312 (see 3GPP TS 23.060 [74] subclause 5.3.13.54).
In A/Gb mode, if the MS indicates support for restriction on use of enhanced coverage in the ATTACH REQUEST
message, and the network restricts enhanced coverage for the MS, then the network shall set the RestrictEC bit to
"Enhanced coverage restricted" in the Additional network feature support IE of the ATTACH ACCEPT message.
ETSI
Release 18 166 3GPP TS 24.008 V18.4.0 (2023-09)
In Iu mode, if the network wishes to prolong the PS signalling connection (for example, if the mobile station has
indicated "follow-on request pending" in ATTACH REQUEST message) the network shall indicate the "follow-on
proceed" in the ATTACH ACCEPT message. If the network wishes to release the PS signalling connection, the
network shall indicate "no follow-on proceed" in the ATTACH ACCEPT message.
After that in Iu mode, the mobile station shall act according to the follow-on proceed flag included in the Attach result
information element in the ATTACH ACCEPT message (see subclause 4.7.13).
In A/Gb mode, if the ATTACH ACCEPT message contains the Cell Notification information element, then the MS
shall start to use the LLC NULL frame to perform cell updates. The network receiving an ATTACH COMPLETE
message stops timer T3350, changes to GMM-REGISTERED state and considers the P-TMSI sent in the ATTACH
ACCEPT message as valid.
If the ATTACH ACCEPT message contains the T3312 extended value IE, then the MS shall use the value in T3312
extended value IE as periodic routing area update timer (T3312). If the ATTACH ACCEPT message does not contain
T3312 extended value IE, then the MS shall use the value in the Periodic RA update timer IE as periodic routing area
update timer (T3312).
If the ATTACH ACCEPT message contains the T3324 value IE, then the MS shall use the included timer value for
T3324 as specified in subclause 4.7.2.8.
If the ATTACH ACCEPT message contains the DCN-ID IE, then the MS shall store the included DCN-ID value
together with the PLMN code of the registered PLMN in a DCN-ID list in a non-volatile memory in the ME as
described in 3GPP TS 24.301 [120], annex C.
In a shared network or in a multi-operator core network (MOCN) with common GERAN, if the ATTACH ACCEPT
message contains the DCN-ID IE and the PLMN identity of the CN operator IE, the MS shall store the included DCN-
ID value with the PLMN identity indicated in the PLMN identity of the CN operator IE, and the included DCN-ID
value with the PLMN identity indicated in the RAI in a DCN-ID list in a non-volatile memory in the ME as described in
3GPP TS 24.301 [120], annex C.
If the MS receives the ATTACH ACCEPT message from a PLMN for which a PLMN-specific attempt counter or
PLMN-specific PS-attempt counter is maintained (see subclause 4.1.1.6A), then the MS shall reset these counters. If the
MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall reset this counter.
The network may also send a Local Emergency Numbers List with local emergency numbers in the ATTACH
ACCEPT, by including the Emergency Number List IE. The mobile equipment shall store the Local Emergency
Numbers List, as provided by the network. The Local Emergency Numbers List stored in the mobile equipment shall be
replaced on each receipt of the Emergency Number List IE. The received Local Emergency Numbers List shall be
provided to the upper layers.
the cell on which this IE is received. If no list is contained in the ATTACH ACCEPT message, then the stored Local
Emergency Numbers List in the mobile equipment shall be kept, except if the mobile equipment has successfully
registered to a PLMN in a country different from that of the PLMN that sent the Local Emergency Numbers List.
The mobile equipment shall use the stored Local Emergency Numbers List of emergency numbers received from the
emergency number.
If the MS has initiated the attach procedure due to manual CSG selection and receives an ATTACH ACCEPT message,
and the MS sent the ATTACH REQUEST message in a CSG cell, the MS shall check if the CSG ID and associated
PLMN identity of the cell are contained in the Allowed CSG list. If not, the MS shall add that CSG ID and associated
ETSI
Release 18 167 3GPP TS 24.008 V18.4.0 (2023-09)
PLMN identity to the Allowed CSG list and the MS may add the HNB Name (if provided by lower layers) to the
Allowed CSG list if the HNB Name is present in neither the Operator CSG list nor the Allowed CSG list.
In A/Gb mode, if a UMTS security context is available, if the MS indicates support of integrity protection in the
ATTACH REQUEST message and the network supports integrity protection, then if the MS receives replayed
capabilities IE’s in ATTACH ACCEPT, then the MS shall check if the replayed MS network capability IE and replayed
MS Radio Access Capability IE received in the ATTACH ACCEPT message has not been altered compared to the MS
network capability IE and the MS Radio Access Capability IE that the MS sent to the network in ATTACH REQUEST
message. If the replayed MS network capability IE and the replayed MS Radio Access Capability IE are not the same,
then the MS shall ignore the ATTACH ACCEPT message.
4.7.3.1.4 GPRS attach not accepted by the network

If the attach request cannot be accepted by the network, an ATTACH REJECT message is transferred to the MS. The
MS receiving the ATTACH REJECT message containing a reject cause other than GMM cause value #25 or the
message is integrity protected, shall stop the timer T3310 and for all causes except #7, #12, #14, #15, #22 and #25
deletes the list of "equivalent PLMNs".
If the ATTACH REJECT message containing GMM cause value cause #25 was received without integrity protection,
then the MS shall discard the message.
If the attach request is rejected due to NAS level mobility management congestion control, the network shall set the
GMM cause value to #22 "congestion" and assign a back-off timer T3346.
The MS shall then take one of the following actions depending upon the reject cause:
#3 (Illegal MS);
#6 (Illegal ME);
The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to
subclause 4.1.3.2) and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence
number. The new GMM state is GMM-DEREGISTERED.NO-IMSI. The SIM/USIM shall be considered as
invalid for GPRS services until switching off or the SIM/USIM is removed or the timer T3245 expires as
described in subclause 4.1.1.6. If the message has been successfully integrity checked by the lower layers and
the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this
counter to MS implementation-specific maximum value.
If the MS is IMSI attached, the MS shall in addition set the update status to U3 ROAMING NOT ALLOWED,
shall delete any TMSI, LAI and ciphering key sequence number. If the MS is operating in MS operation mode A
and an RR connection exists, the MS shall abort the RR connection, unless an emergency call is ongoing. The
SIM/USIM shall be considered as invalid also for non-GPRS services until switching off or the SIM/USIM is
removed. If the message has been successfully integrity checked by the lower layers and the MS maintains a
counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this counter to MS
If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status,
GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when the
attach procedure is rejected with the EMM cause with the same value.
#7 (GPRS services not allowed);
number. The SIM/USIM shall be considered as invalid for GPRS services until switching off or the SIM/USIM
is removed. The new state is GMM-DEREGISTERED. If the message has been successfully integrity checked
by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then
NOTE 1: Optionally the MS starts the timer T3340 as described in subclause 4.7.1.9
ETSI
Release 18 168 3GPP TS 24.008 V18.4.0 (2023-09)
#8 (GPRS services and non-GPRS services not allowed);
number. The new GMM state is GMM-DEREGISTERED.NO-IMSI.
NOTE 2: Optionally the MS starts the timer T3340 as described in subclause 4.7.1.9.
The MS shall set the update status to U3 ROAMING NOT ALLOWED, shall delete any TMSI, LAI and
ciphering key sequence number. If the MS is operating in MS operation mode A and an RR connection exists,
the MS shall abort the RR connection, unless an emergency call is ongoing. The SIM/USIM shall be considered
as invalid for GPRS and non-GPRS services until switching off or the SIM/USIM is removed. If the message has
been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM
considered invalid for GPRS services", then the MS shall set this counter to MS implementation-specific
maximum value. If the message has been successfully integrity checked by the lower layers and the MS
maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this
# 11 (PLMN not allowed);
The MS shall delete any RAI, P-TMSI, P-TMSI signature, and GPRS ciphering key sequence number stored,
shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to
subclause 4.1.3.2), shall reset the GPRS attach attempt counter and shall change to state GMM-
DEREGISTERED.
The MS shall store the PLMN identity in the "forbidden PLMN list" and if the MS is configured to use timer
T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed
as described in subclause 4.1.1.6. If the message has been successfully integrity checked by the lower layers and
the MS maintains a PLMN-specific attempt counter for that PLMN, then the MS shall set this counter to the MS
The MS shall start timer T3340 as described in subclause 4.7.1.9.
If no RR connection exists, the MS shall perform the following additional actions immediately. If the MS is
operating in MS operation mode A and an RR connection exists, the MS shall perform these actions when the
RR connection is subsequently released:
- If the MS is IMSI attached, the MS shall set the update status to U3 ROAMING NOT ALLOWED, shall
delete any TMSI, LAI and ciphering key sequence number and shall reset the location update attempt
counter. The new MM state is MM IDLE.
- The MS shall perform a PLMN selection according to 3GPP TS 23.122 [14].
An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to perform a
GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120]
for the case when attach procedure is rejected with the EMM cause with the same value.
# 12 (Location area not allowed);
The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number, shall set
the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to clause 4.1.3.2) and
shall reset the GPRS attach attempt counter. The state is changed to GMM-DEREGISTERED.LIMITED-
SERVICE.
ETSI
Release 18 169 3GPP TS 24.008 V18.4.0 (2023-09)
- The MS shall perform a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].
for the case when the attach procedure is rejected with the EMM cause with the same value.
# 13 (Roaming not allowed in this location area);
SERVICE or optionally to GMM-DEREGISTERED.PLMN-SEARCH.
The MS shall store the LAI in the list of "forbidden location areas for roaming".
# 14 (GPRS services not allowed in this PLMN);
subclause 4.1.3.2) , shall reset the GPRS attach attempt counter and shall change to state GMM-
DEREGISTERED.
The MS shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list and if the MS is
configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start
timer T3245 and proceed as described in subclause 4.1.1.6. A GPRS MS operating in MS operation mode C
shall perform a PLMN selection instead of a cell selection. If the message has been successfully integrity
checked by the lower layers and the MS maintains a PLMN-specific PS-attempt counter for that PLMN, then the
MS shall set this counter to the MS implementation-specific maximum value.
A GPRS MS operating in MS operation mode A or B in network operation mode II, is still IMSI attached for CS
services in the network.
As an implementation option, a GPRS MS operating in operation mode A or B may perform the following
additional action. If no RR connection exists the MS may perform the action immediately. If the MS is operating
in MS operation mode A and an RR connection exists, the MS may only perform the action when the RR
connection is subsequently released:
ETSI
Release 18 170 3GPP TS 24.008 V18.4.0 (2023-09)
- The MS may perform a PLMN selection according to 3GPP TS 23.122 [14].
If an MS in GAN mode performs a PLMN selection, it shall request a PLMN list in GAN (see
3GPP TS 44.318 [76b]) prior to perform a PLMN selection from this list according to 3GPP TS 23.122 [14].
The MS shall not perform the optional PLMN selection in the case where the PLMN providing this reject cause
is:
- On the "User Controlled PLMN Selector with Access Technology" list;
- On the "Operator Controlled PLMN Selector with Access Technology" list;
- On the "PLMN Selector" list for an MS using a SIM/USIM without access technology information storage
(i.e. the "User Controlled PLMN Selector with Access Technology" and the "Operator Controlled PLMN
Selector with Access Technology" data files are not present); or
- A PLMN identified as equivalent to any PLMN, within the same country, contained in the lists above.
# 15 (No Suitable Cells In Location Area);
the GPRS update status to GU3 ROAMING NOT ALLOWED(and shall store it according to clause 4.1.3.2) and
SERVICE.
- The MS shall search for a suitable cell in another location area or a tracking area according to
# 22 (Congestion);
If the T3346 value IE is present in the ATTACH REJECT message and the value indicates that this timer is
neither zero nor deactivated, the MS shall proceed as described below, otherwise it shall be considered as an
abnormal case and the behaviour of the MS for this case is specified in subclause 4.7.3.1.5.
The MS shall abort the attach procedure, reset the GPRS attach attempt counter, set the GPRS update status to
GU2 NOT UPDATED and enter state GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH.
If the ATTACH REJECT message is integrity protected, the MS shall start timer T3346 with the value provided
in the T3346 value IE.
If the ATTACH REJECT message is not integrity protected, the MS shall start timer T3346 with a random value
from the default range specified in table 11.3a.
ETSI
Release 18 171 3GPP TS 24.008 V18.4.0 (2023-09)
The MS stays in the current serving cell and applies the normal cell reselection process. The attach procedure is
started if still needed when timer T3346 expires or is stopped.
If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, and
attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected
with the EMM cause with the same value.
# 25 (Not authorized for this CSG);
considered as abnormal cases and the specification of the mobile station behaviour is given in
subclause 4.1.3.2), reset the GPRS attach attempt counter and enter the state GMM-
DEREGISTERED.LIMITED-SERVICE.
If the CSG ID and associated PLMN identity of the cell where the MS has sent the ATTACH REQUEST
message are contained in the Allowed CSG list stored in the MS, the MS shall remove the entry corresponding to
this CSG ID and associated PLMN identity from the Allowed CSG list.
message are contained in the Operator CSG list stored in the MS, the MS shall proceed as specified in
3GPP TS 23.122 [14] subclause 3.1A.
Other values are considered as abnormal cases. The specification of the MS behaviour in those cases is specified in
4.7.3.1.4a GPRS attach for emergency bearer services not accepted by the network
(UTRAN Iu mode only)
If the attach request for emergency bearer services cannot be accepted by the network, an ATTACH REJECT message
is transferred to the MS. The ATTACH REJECT message includes GMM cause #5 "IMEI not accepted" or one of the
GMM cause values as described in subclause 4.7.3.1.4.
NOTE 1: If GMM cause #11 is sent to a MS of a roaming subscriber attaching for emergency bearer services and
the MS is in automatic network selection mode, it cannot obtain normal service provided by this PLMN.
Upon receiving the ATTACH REJECT message including GMM cause #5, the MS shall enter the state GMM-
DEREGISTERED.NO-IMSI.
Upon receiving the ATTACH REJECT message including one of the other GMM cause values, the MS shall perform
the actions as described in subclause 4.7.3.1.4 with the following addition: the MS shall inform the upper layers of the
failure of the procedure.
NOTE 2: This can result in the upper layers requesting establishment of a CS emergency call (if not already
attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in
3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.
If the attach request for emergency bearer services fails due to abnormal case a) in subclause 4.7.3.1.5, the MS shall
perform the actions as described in subclause 4.7.3.1.5 and inform the upper layers of the failure to access the network.
ETSI
Release 18 172 3GPP TS 24.008 V18.4.0 (2023-09)
If the attach request for emergency bearer services fails due to abnormal cases b), c) or d) in subclause 4.7.3.1.5, the MS
shall perform the actions as described in subclause 4.7.3.1.5 with the following addition: the MS shall inform the upper
layers of the failure of the procedure.
In a shared network, upon receiving the ATTACH REJECT message, the MS shall perform the actions as described in
subclause 4.7.3.1.4, and shall:
a) inform the upper layers of the failure of the procedure; or
b) attempt the attach for emergency bearer services to another PLMN in the shared network.
In a shared network, if the attach request for emergency bearer services fails due to abnormal case a) in
subclause 4.7.3.1.5, the MS shall perform the actions as described in subclause 4.7.3.1.5 and shall:
a) inform the upper layers of the failure to access the network; or
In a shared network, if the attach request for emergency bearer services fails due to abnormal cases b), c) or d) in
subclause 4.7.3.1.5, the MS shall perform the actions as described in subclause 4.7.3.1.5, and shall:
4.7.3.1.4b Attach for initiating a PDN connection for emergency bearer services not
accepted by the network (UTRAN Iu mode only)
If the network cannot accept the attach request for initiating a PDN connection for emergency bearer services with
attach type not set to "emergency attach", the MS shall perform the procedures as described in subclause 4.7.3.1.4. Then
if the MS is in the same selected PLMN where the last attach request was attempted, the MS shall:
attempted in the CS domain) or other implementation specific mechanisms, e.g. procedures specified in
3GPP TS 24.229 [95] that can result in the emergency call being attempted to another IP-CAN.
b) attempt GPRS attach for emergency bearer services.
If the attach request for initiating a PDN connection for emergency bearer services with attach type not set to
"emergency attach" fails due to abnormal case a) in subclause 4.7.3.1.5, the MS shall perform the procedures as
described in subclause 4.7.3.1.5 and inform the upper layers of the failure to access the network.
NOTE 2: This can result in the MS attempting a CS emergency call (if not already attempted in the CS domain) or
other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [95] that can
result in the emergency call being attempted to another IP-CAN.
ETSI
Release 18 173 3GPP TS 24.008 V18.4.0 (2023-09)
If the attach request for initiating a PDN connection for emergency bearer services with attach type not set to
"emergency attach" fails due to abnormal cases b), c) or d) in subclause 4.7.3.1.5, the MS shall perform the procedures
as described in subclause 4.7.3.1.5. Then if the MS is in the same selected PLMN where the last attach request was
attempted, the MS shall:
a) inform the upper layers; or
NOTE 3: This can result in the MS attempting a CS emergency call (if not already attempted in the CS domain) or
other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [95] that can
result in the emergency call being attempted to another IP-CAN.
b) attempt GPRS attach for emergency bearer services.
4.7.3.1.5 Abnormal cases in the MS

a) Access barred because of access class control, EAB or ACDC
The GPRS attach procedure shall not be started. The MS stays in the current serving cell and applies normal cell
reselection process. The GPRS attach procedure is started as soon as possible, i.e. when access is granted or
because of a cell change.
If access is barred because of access class control, ACDC is applicable to the request from the upper layers and
the MS supports ACDC, then the GPRS attach procedure shall be started.
If access is barred for a certain ACDC category, a request with a higher ACDC category is received from the
upper layers and the MS supports ACDC, then the GPRS attach procedure shall be started.
If an access request for an uncategorized application is barred due to ACDC, a request with a certain ACDC
category is received from the upper layers and the MS supports ACDC, then the GPRS attach procedure shall be
started.
b) Lower layer failure without "Extended Wait Time" received from lower layers before the ATTACH ACCEPT or
ATTACH REJECT message is received
The procedure shall be aborted and the MS shall proceed as described below, except in the following
implementation option cases b.1 and b.2.
b.1) Release of PS signalling connection in Iu mode before the completion of the GPRS attach procedure
If the release of the PS signalling connection occurs before completion of the GPRS attach procedure, then the
GPRS attach procedure shall be initiated again, if the following conditions apply:
i) The original GPRS attach procedure was initiated over an existing PS signalling connection; and
ii) The GPRS attach procedure was not due to timer T3310 expiry; and
iii) No SECURITY MODE COMMAND message and no Non-Access Startum (NAS) messages relating to
the PS signalling connection (e.g. PS authentication procedure, see subclause 4.7.7) were received after the
ATTACH REQUEST message was transmitted.
b.2) RR release in Iu mode (i.e. RRC connection release) with, for example, cause "Normal", or "User inactivity"
(see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111])
The GPRS attach procedure shall be initiated again, if the following conditions apply:
i) The original GPRS attach procedure was initiated over an existing RRC connection; and
ii) The GPRS attach procedure was not due to timer T3310 expiry; and
iii) No SECURITY MODE COMMAND message and no Non-Access Stratum (NAS) messages relating to
ATTACH REQUEST message was transmitted.
ETSI
Release 18 174 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 1: The RRC connection release cause that triggers the re-initiation of the GPRS attach procedure is
c) T3310 time-out
On the first expiry of the timer, the MS shall reset and restart timer T3310 and shall retransmit the ATTACH
REQUEST message. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3310, the MS
shall abort the GPRS attach procedure and, in Iu mode, release the PS signalling connection (see
3GPP TS 25.331 [23c]). The MS shall proceed as described below.
d) ATTACH REJECT, other causes than those treated in subclause 4.7.3.1.4, and cases of GMM cause values #22
and #25, if considered as abnormal cases according to subclause 4.7.3.1.4
If the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency
bearer services with attach type not set to "emergency attach", upon reception of the cause codes # 95, # 96, #
97, # 99 and # 111 the MS should set the GPRS attach attempt counter to 5.
e) Change of cell within the same RA (A/Gb mode only)
If a cell change occurs within the same RA when the MS is in state GMM-REGISTERED-INITIATED, then the
cell update procedure shall be performed before completion of the attach procedure.
f) Change of cell into a new routing area
If a cell change into a new routing area occurs before an ATTACH ACCEPT or ATTACH REJECT message has
been received, the GPRS attach procedure shall be aborted and re-initiated immediately. If a routing area border
is crossed when the ATTACH ACCEPT message is received but before an ATTACH COMPLETE message is
sent, the GPRS attach procedure shall be aborted and the routing area updating procedure shall be initiated. If a
P-TMSI was allocated during the GPRS attach procedure, this P-TMSI shall be used in the routing area updating
procedure. If a P-TMSI signature was allocated together with the P-TMSI during the GPRS attach procedure,
this P-TMSI signature shall be used in the routing area updating procedure.
g) Mobile originated detach required
If the MS is in state GMM-REGISTERED-INITIATED, the GPRS attach procedure shall be aborted and the
GPRS detach procedure shall be performed (see subclause 4.7.4.1).
h) Detach procedure collision
If the MS receives a DETACH REQUEST message from the network in state GMM-REGISTERED-
INITIATED with detach type "re-attach not required" and no cause code, or "re-attach not required"' and the
cause code is not #2 "IMSI unknown in HLR", the GPRS detach procedure shall be progressed and the GPRS
attach procedure shall be aborted. Otherwise the GPRS attach procedure shall be progressed and the DETACH
REQUEST message shall be ignored.
i) "Extended wait time" for PS domain from the lower layers
If the ATTACH REQUEST message contained the low priority indicator set to "MS is configured for NAS
signalling low priority", the MS shall start timer T3346 with the "Extended wait time" value and reset the attach
attempt counter.
The MS shall abort the attach procedure, stay in the current serving cell, change the state to GMM-
DEREGISTERED.ATTEMPTING-TO-ATTACH and apply the normal cell reselection process.
The MS shall not start the GPRS attach procedure unless the MS needs to attach for emergency bearer services
or the MS is an MS configured to use AC11 – 15 in selected PLMN or the MS needs to attach without the NAS
signalling low priority indication and if the timer T3346 was started due to rejection of a NAS request message
(e.g. ATTACH REQUEST, ROUTING AREA UPDATE REQUEST or SERVICE REQUEST) which contained
the low priority indicator set to "MS is configured for NAS signalling low priority". The MS stays in the current
serving cell and applies normal cell reselection process.
ETSI
Release 18 175 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 2: It is considered an abnormal case if the MS needs to initiate an attach procedure while timer T3346 is
running independent on whether timer T3346 was started due to an abnormal case or a non successful
case.
In cases b, c, d, i and j, the MS shall proceed as follows:
- Timer T3310 shall be stopped if still running.
- For the cases b, c, d, and i when the "Extended wait time" is ignored, if the attach request is neither for
emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type
not set to "emergency attach", the GPRS attach attempt counter shall be incremented.
- If the GPRS attach attempt counter is less than 5:
- for the cases i and j, the GPRS attach procedure is started, if still necessary, when timer T3346 expires or is
stopped.
- for the cases b, c, d, and i when the "Extended wait time" is ignored, if the attach request is neither for
emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach
type not set to "emergency attach", timer T3311 is started and the state is changed to GMM-
DEREGISTERED.ATTEMPTING-TO-ATTACH.
- If the GPRS attach attempt counter is greater than or equal to 5:
- the MS shall delete any RAI, P-TMSI, P-TMSI signature, list of equivalent PLMNs, and GPRS ciphering key
sequence number, shall set the GPRS update status to GU2 NOT UPDATED, shall start timer T3302. The
state is changed to GMM-DEREGISTERED. ATTEMPTING-TO-ATTACH or optionally to GMM-
DEREGISTERED.PLMN-SEARCH (see subclause 4.2.4.1.2) in order to perform a PLMN selection
- If S1 mode is supported by the MS, the MS shall in addition handle the EMM parameters EMM state, EPS
update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for
the abnormal case when a normal attach procedure fails and the attach attempt counter is equal to 5.
4.7.3.1.6 Abnormal cases on the network side

If a low layer failure occurs before the message ATTACH COMPLETE has been received from the MS and a
new P-TMSI (or a new P-TMSI and a new P-TMSI signature) has been assigned, the network shall consider both
the old and new P-TMSI each with its corresponding P-TMSI-signature as valid until the old P-TMSI can be
considered as invalid by the network (see subclause 4.7.1.5) or the GMM context which has been marked as
detached in the network is released, and shall not resent the message ATTACH ACCEPT. During this period the
network may:
- use the identification procedure followed by a P-TMSI reallocation procedure if the old P-TMSI is used by
the MS in a subsequent message.
b) Protocol error
If the ATTACH REQUEST message is received with a protocol error, the network shall return an ATTACH
REJECT message with one of the following reject causes:
#96: Mandatory information element error;
#99: Information element non-existent or not implemented;
#100: Conditional IE error;
#111: Protocol error, unspecified.
c) T3350 time-out
ETSI
Release 18 176 3GPP TS 24.008 V18.4.0 (2023-09)
On the first expiry of the timer, the network shall retransmit the ATTACH ACCEPT message and shall reset and
restart timer T3350.
This retransmission is repeated four times, i.e. on the fifth expiry of timer T3350, the GPRS attach procedure
shall be aborted. If a new P-TMSI or a new P-TMSI together with a new P-TMSI signature were allocated in the
ATTACH ACCEPT message, the network shall consider both the old and new P-TMSI each together with the
corresponding P-TMSI signatures as valid until the old P-TMSI can be considered as invalid by the network (see
subclause 4.7.1.5) or the GMM context which has been marked as detached in the network is released. During
this period the network acts as specified for case a.
d.1) ATTACH REQUEST received after the ATTACH ACCEPT message has been sent and before the ATTACH
COMPLETE message is received
- If one or more of the information elements in the ATTACH REQUEST message differ from the ones received
within the previous ATTACH REQUEST message, the previously initiated GPRS attach procedure shall be
aborted if the ATTACH COMPLETE message has not been received and the new GPRS attach procedure shall
be progressed, or
- If the information elements do not differ, then the ATTACH ACCEPT message shall be resent and the timer
T3350 shall be restarted if an ATTACH COMPLETE message is expected. In that case, the retransmission
counter related to T3350 is not incremented.
d.2) More than one ATTACH REQUEST received and no ATTACH ACCEPT or ATTACH REJECT message
has been sent
- If one or more of the information elements in the ATTACH REQUEST message differs from the ones received
within the previous ATTACH REQUEST message, the previously initiated GPRS attach procedure shall be
aborted and the new GPRS attach procedure shall be progressed;
- If the information elements do not differ, then the network shall continue with the previous attach procedure and
shall not treat any further this ATTACH REQUEST message.
e) ATTACH REQUEST received in state GMM-REGISTERED
If an ATTACH REQUEST message is received in state GMM-REGISTERED the network may initiate the
GMM common procedures; if it turned out that the ATTACH REQUEST message was send by an MS that has
already been attached, the GMM context, PDP contexts and MBMS contexts, if any, are deleted and the new
ATTACH REQUEST is progressed.
f) ROUTING AREA UPDATE REQUEST message received before ATTACH COMPLETE message.
Timer T3350 shall be stopped. The allocated P-TMSI shall be considered as valid and the routing area updating
procedure shall be progressed as described in subclause 4.7.5.
g) DETACH REQUEST message received before ATTACH COMPLETE message.
The network shall abort the attach procedure and shall progress the detach procedure as described in
subclause 4.7.4.1.
ETSI
Release 18 177 3GPP TS 24.008 V18.4.0 (2023-09)
MS Network
ATTACH REQUEST
Start T3310
ATTACH ACCEPT If P-TMSI and/or

Stop T3310 TMSI allocated
Start T3350
If P-TMSI and/or ATTACH COMPLETE

TMSI allocated Stop T3350
or
ATTACH REQUEST
Start T3310
ATTACH REJECT
Stop T3310
Figure 4.7.3/1 3GPP TS 24.008: GPRS attach procedure and combined GPRS attach procedure
4.7.3.2 Combined GPRS attach procedure for GPRS and non-GPRS services
The combined GPRS attach procedure is a GMM procedure used by a GPRS MS operating in MS operation modes A or
B for IMSI attach for GPRS and non-GPRS services if the network operates in network operation mode I.
If a GPRS MS operating in MS operation modes A or B is already attached for non-GPRS services by use of the MM
specific IMSI attach procedure, but additionally wishes to perform an IMSI attach for GPRS services, the combined
GPRS attach procedure shall also be used.
The attach type information element shall indicate "combined GPRS/IMSI attach". In this case, the messages ATTACH
ACCEPT, ATTACH COMPLETE, and ATTACH REJECT used by the combined GPRS attach procedure carry
information for both the GPRS and the non-GPRS services.
A GPRS MS in MS operation mode A shall perform the normal GPRS/IMSI attach procedure during an ongoing
circuit-switched transaction.
4.7.3.2.1 Combined GPRS attach procedure initiation

If the MS is in GMM state GMM-DEREGISTERED and in MM state MM IDLE, the MS initiates the combined GPRS
attach procedure by sending an ATTACH REQUEST message to the network, starts timer T3310 and enters state
GMM-REGISTERED-INITIATED and MM LOCATION UPDATING PENDING. If timer T3302 is currently running,
the MS shall stop timer T3302. If timer T3311 is currently running, the MS shall stop timer T3311.
The MS shall set the Mobile identity IE, old RAI and P-TMSI signature in the ATTACH REQUEST message as
specified in subclause 4.7.3.1.1. Furthermore the MS shall include the TMSI status IE if no valid TMSI is available.
If the MS initiates a combined GPRS attach procedure for GPRS services and "SMS-only service", the MS shall
indicate "SMS only" in the Additional update type IE.
If the MS has stored a valid LAI and the MS supports EMM combined procedures, the MS shall include it in the Old
location area identification IE in the ATTACH REQUEST message.
If the MS has stored a valid TMSI, the MS shall include the TMSI based NRI container IE in the ATTACH REQUEST
message.
ETSI
Release 18 178 3GPP TS 24.008 V18.4.0 (2023-09)
In Iu mode, if the MS wishes to prolong the established PS signalling connection after the GPRS attach (for example,
the MS has any CM application request pending), it may set a follow-on request pending indicator on (see
subclause 4.7.13).
4.7.3.2.2 GMM Common procedure initiation

The network may initiate GMM common procedures, e.g. the GMM identification and GMM authentication and
ciphering procedure, depending on the received information such as IMSI, CKSN, old RAI, P-TMSI and P-TMSI
signature.
4.7.3.2.3 Combined GPRS attach accepted by the network

Depending on the value of the attach result IE received in the ATTACH ACCEPT message, two different cases can be
distinguished:
Case 1) The attach result IE value indicates "combined GPRS attach": IMSI attach for GPRS and non-GPRS
services have been successful.
Case 2) The attach result IE value indicates "GPRS only": IMSI attach for GPRS services has been successful but
IMSI attach for non-GPRS services has not been successful.
indicated "follow-on request pending" in ATTACH REQUEST message) the network shall indicate the "follow-on
proceed" in the ATTACH ACCEPT message. If the network wishes to release the PS signalling connection, the
network shall indicate "no follow-on proceed" in the ATTACH ACCEPT message.
After that in Iu mode, the mobile station shall act according to the follow-on proceed flag included in the Attach result
information element in the ATTACH ACCEPT message (see subclause 4.7.13).
4.7.3.2.3.1 Combined attach successful for GPRS and non-GPRS services
The description for IMSI attach for GPRS services as specified in subclause 4.7.3.1.3 shall be followed. In addition, the
following description for IMSI attach for non-GPRS services applies.
The TMSI reallocation may be part of the combined GPRS attach procedure. The TMSI allocated is then included in the
ATTACH ACCEPT message together with the location area identification (LAI). The network shall, in this case,
change to state GMM-COMMON-PROCEDURE-INITIATED and shall start timer T3350 as described in
subclause 4.7.6.
The MS, receiving an ATTACH ACCEPT message, stores the received location area identification, stops timer T3310,
reset the location update attempt counter and sets the update status to U1 UPDATED. If the message contains an IMSI,
the mobile station is not allocated any TMSI, and shall delete any TMSI accordingly. If the message contains a TMSI,
the MS shall use this TMSI as the new temporary identity. The MS shall delete its old TMSI and shall store the new
TMSI. In this case, an ATTACH COMPLETE message is returned to the network. If neither a TMSI nor an IMSI has
been included by the network in the ATTACH ACCEPT message, the old TMSI, if any available, shall be kept. The
new MM state is MM IDLE, the new GMM state is GMM-REGISTERED.
If the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events (see
subclause 4.1.1.6A), then the MS shall reset this counter.
If the network has requested the provision of Inter RAT handover information, the MS shall return an ATTACH
COMPLETE message including the Inter RAT handover information IE to the network.
If the MS is not configured for NAS signalling low priority then the MS may stop timer T3246 if running.
Any timer used for triggering the location update procedure (e.g T3211, T3212) shall be stopped if running.
The network receiving an ATTACH COMPLETE message stops timer T3350, changes to state GMM-REGISTERED.
NOTE: Upon receiving an ATTACH COMPLETE message, the SGSN sends a BSSAP+-TMSI-
REALLOCATION-COMPLETE message as specified in 3GPP TS 29.018 [149].
ETSI
Release 18 179 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.3.2.3.2 Combined attach successful for GPRS services only
Apart from the actions on the routing area updating attempt counter, the description for IMSI attach for GPRS services
as specified in subclause 4.7.3.1.3 shall be followed. In addition, the following description for IMSI attach for non-
GPRS services applies.
The SGSN shall use GMM cause #28 "SMS provided via GPRS in this routing area" in the ATTACH ACCEPT
message only if the MS requested "SMS-only service" by including the Additional update type IE in the ATTACH
REQUEST message.
The MS receiving the ATTACH ACCEPT message takes one of the following actions depending on the GMM cause:
#2 (IMSI unknown in HLR)
The MS shall stop timer T3310 if still running and shall reset the routing area updating attempt counter. The
MS shall set the update status to U3 ROAMING NOT ALLOWED and shall delete any TMSI, LAI and
ciphering key sequence number. The MS shall enter state GMM-REGISTERED.NORMAL-SERVICE. The
new MM state is MM IDLE. The SIM/USIM shall be considered as invalid for non-GPRS services until
switching off or the SIM/USIM is removed. If the message has been successfully integrity checked by the
lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services",
# 16 (MSC temporarily not reachable); or
# 17 (Network failure)
The MS shall stop timer T3310 if still running, and shall enter state MM-IDLE. The routing area updating
attempt counter shall be incremented.
If the routing area updating attempt counter is less than 5, and the stored RAI is equal to the RAI of the
current serving cell and the GMM update status is equal to GU1 UPDATED:
- the MS shall keep the GMM update status GU1 UPDATED and changes state to GMM-
REGISTERED.ATTEMPTING-TO-UPDATE-MM. The MS shall start timer T3311. When timer T3311
expires the combined routing area update procedure indicating "combined RA/LA updating with IMSI
attach" is triggered again.
If the routing area updating attempt counter is greater than or equal to 5:
- the MS shall start timer T3302 and shall change to state GMM-REGISTERED.ATTEMPTING-TO-
UPDATE-MM;
- a GPRS MS operating in MS operation mode A shall then proceed with appropriate MM specific
procedure; a GPRS MS operating in MS operation mode B may then proceed with appropriate MM
specific procedures. The MM sublayer shall act as in network operation mode II as long as the combined
GMM procedures are not successful and no new RA is entered.
# 22 (Congestion)
The MS shall change to state GMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM, shall stop

timer T3310 if still running, and shall enter state MM-IDLE. The MS shall set the routing area updating
attempt counter to 5 and shall start the timer T3302.
# 28 (SMS provided via GPRS in this routing area);
new MM state is MM IDLE.
The MS stays in the current serving cell and applies the normal cell reselection process.
ETSI
Release 18 180 3GPP TS 24.008 V18.4.0 (2023-09)
Other GMM causevalues and the case that no GMM cause IE was received are considered as abnormal cases. The
combined attach procedure shall be considered as failed for non-GPRS services. The behaviour of the MS in those cases
is specified in subclause 4.7.3.2.5.
4.7.3.2.4 Combined GPRS attach not accepted by the network

If the attach request can neither be accepted by the network for GPRS nor for non-GPRS services, an ATTACH
REJECT message is transferred to the MS. The MS receiving the ATTACH REJECT message containing a reject cause
other than GMM cause value #25 or the message is integrity protected, shall stop the timer T3310, and for all causes
except #7, #12, #14, #15, #22 and #25 deletes the list of "equivalent PLMNs".
If the ATTACH REJECT message containing GMM cause value #25 was received without integrity protection, then the
MS shall discard the message.
If the attach request is rejected due to NAS level mobility management congestion control, the network shall set the
GMM cause value to #22 "congestion" and assign a back-off timer T3346.
The MS shall then take one of the following actions depending upon the reject cause:
#3 (Illegal MS);
#6 (Illegal ME), or
The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (shall store it according to
number. The new GMM state is GMM-DEREGISTERED.NO-IMSI. The new MM state is MM IDLE.
ciphering key sequence number. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS
services until switching off or the SIM/USIM is removed or the timer T3245 expires as described in
subclause 4.1.1.6.
If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for
"SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to MS implementation-
specific maximum value. If the message has been successfully integrity checked by the lower layers and the MS
NOTE 1: Optionally the MS starts the timer T3340 as described in subclause 4.7.1.9 for reject cause #8
combined attach procedure is rejected with the EMM cause with the same value.
is removed. The new GMM state is GMM-DEREGISTERED; the MM state is MM IDLE.
specific maximum value.
A GPRS MS operating in MS operation mode A or B which is already IMSI attached for CS services in the
network is still IMSI attached for CS services in the network.
A GPRS MS operating in MS operation mode A or B shall proceed with the appropriate MM specific procedure
according to the MM service state.
ETSI
Release 18 181 3GPP TS 24.008 V18.4.0 (2023-09)
combined attach procedure is rejected with the EMM cause with the same value.
The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number stored,
subclause 4.1.3.2), shall reset the GPRS attach attempt counter and changes to state GMM-DEREGISTERED.
The MS shall set the update status to U3 ROAMING NOT ALLOWED, reset the location update attempt
counter and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM IDLE.
The MS shall perform a PLMN selection according to 3GPP TS 23.122 [14].
An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to perform a PLMN
selection from this list according to 3GPP TS 23.122 [14].
for the case when the combined attach procedure is rejected with the EMM cause with the same value.
The MS shall delete any RAI, P-TMSI, P-TMSI signature GPRS ciphering key sequence number, shall set the
GPRS update status to GU3 ROAMING NOT ALLOWED(and shall store it according to clause 4.1.3.2) and
SERVICE.
The MS shall store the LAI in the list of "forbidden location areas for regional provision of service".
The MS shall perform a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].
SERVICE or optionally to GMM-DEREGISTERED.PLMN-SEARCH.
ETSI
Release 18 182 3GPP TS 24.008 V18.4.0 (2023-09)
DEREGISTERED.
timer T3245 and proceed as described in subclause 4.1.1.6. If the message has been successfully integrity
As an implementation option, a GPRS MS operating in operation mode A or B may perform a PLMN selection
is:
- On the "User Controlled PLMN Selector with Access Technology";
- On the "Operator Controlled PLMN Selector with Access Technology" list;
- On the "PLMN Selector" list for an MS using a SIM/USIM without access technology information storage
(i.e. the "User Controlled PLMN Selector with Access Technology" and the "Operator Controlled PLMN
Selector with Access Technology" data files are not present); or
If the MS does not perform a PLMN selection then a GPRS MS operating in MS operation mode A or B which
is not yet IMSI attached for CS services in the network shall then perform an IMSI attach for non-GPRS services
according to the conditions for the MM IMSI attach procedure (see subclause 4.4.3).
A GPRS MS operating in MS operation mode A or B shall proceed with the appropriate MM specific procedure
according to the MM service state.
SERVICE.
ETSI
Release 18 183 3GPP TS 24.008 V18.4.0 (2023-09)
The MS shall search for a suitable cell in another location area or a tracking area according to
# 22 (Congestion);
If the T3346 value IE is present in the ATTACH REJECT message and the value indicates that this timer is
abnormal case and the behaviour of the MS for this case is specified in subclause 4.7.3.1.5.
The MS shall abort the attach procedure, reset the GPRS attach attempt counter, set the GPRS update status to
GU2 NOT UPDATED and enter state GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH.
If the ATTACH REJECT message is integrity protected, the MS shall start timer T3346 with the value provided
If the ATTACH REJECT message is not integrity protected, the MS shall start timer T3346 with a random value
The MS stays in the current serving cell and applies the normal cell reselection process. The attach procedure is
started, if still necessary, when timer T3346 expires or is stopped.
attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected
with the EMM cause with the same value.
# 25 (Not authorized for this CSG)
subclause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-
message are contained in the Operator CSG list, the MS shall proceed as specified in 3GPP TS 23.122 [14]
subclause 3.1A.
If the MS is IMSI attached for non-GPRS services, the MS shall set the update status to U3 ROAMING NOT
ALLOWED and shall reset the location update attempt counter. The new MM state is MM IDLE.
ETSI
Release 18 184 3GPP TS 24.008 V18.4.0 (2023-09)
Other values are considered as abnormal cases. The specification of the MS behaviour in those cases is specified in

The MS shall proceed as follows:
1) If the combined attach was successful for GPRS services only and the ATTACH ACCEPT message contained a
cause value not treated in subclause 4.7.3.2.3.2 or the GMM Cause IE is not included in the message, the MS
shall proceed as follows:
a) The MS shall stop timer T3310 if still running, and shall enter state MM IDLE. The routing area updating
attempt counter shall be incremented;
b) If the routing area updating attempt counter is less than 5, and the stored RAI is equal to the RAI of the
attach" is triggered again; and
c) If the routing area updating attempt counter is greater than or equal to 5:
UPDATE-MM; and
specific procedures. The MM sublayer shall act as in network operation mode II as long as the combined
GMM procedures are not successful and no new RA is entered; and
2) Otherwise, the abnormal cases specified in subclause 4.7.3.1.5 apply with the following modification.
If the GPRS attach attempt counter is incremented according to subclause 4.7.3.1.5 the next actions depend on the
Location Area Identities (stored on SIM/USIM and the one of the current serving cell) and the value of the attach
attempt counter:
- if the update status is U1 UPDATED, and the stored LAI is equal to the one of the current serving cell and the
attach attempt counter is smaller than 5, then the mobile station shall keep the update status to U1 UPDATED,
the new MM state is MM IDLE substate NORMAL SERVICE;
- if the attach attempt counter is smaller than 5 and, additionally, the update status is different from U1
UPDATED or the stored LAI is different from the one of the current serving cell, then the mobile station shall
delete any LAI, TMSI, ciphering key sequence number stored in the SIM/USIM and list of equivalent PLMNs
and set the update status to U2 NOT UPDATED. The MM state remains MM LOCATION UPDATING
PENDING; or
- if the attach attempt counter is greater or equal to 5, then the mobile station shall delete any LAI, TMSI,
ciphering key sequence number stored in the SIM/USIM and list of equivalent PLMNs and set the update status
to U2 NOT UPDATED.
A GPRS MS operating in MS operation mode A shall then proceed with appropriate MM specific procedure; a
GPRS MS operating in MS operation mode B may then proceed with appropriate MM specific procedures.
The MM sublayer shall act as in network operation mode II as long as the combined GMM procedures are not
successful and no new RA is entered. The new MM state is MM IDLE substate ATTEMPTING TO UPDATE or
optionally MM IDLE substate PLMN SEARCH in order to perform a PLMN selection according to
3GPP TS 23.122 [14].

The abnormal cases specified in subclause 4.7.3.1.6 apply.
ETSI
Release 18 185 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.4 GPRS detach procedure
4.7.4.0 General
The GPRS detach procedure is used:
- to detach the IMSI for GPRS services only. Independent of the network operation mode, this procedure is used
by all kind of GPRS MSs;
- as a combined GPRS detach procedure used by GPRS MSs operating in MS operation mode A or B to detach the
IMSI for GPRS and non-GPRS services or for non-GPRS services only, if the network operates in network
operation mode I and no circuit-switched transaction is ongoing;
- in the case of a network failure condition to indicate to the MS that a re-attach with successive activation of
previously active PDP contexts shall be performed. In this case, the MS may also perform the procedures needed
in order to activate any previously active multicast service(s); or
- to detach the IMSI or IMEI for emergency bearer services.
After completion of a GPRS detach procedure or combined GPRS detach procedure for GPRS and non-GPRS services
the GMM context is released.
An eCall only mobile station that is not capable of eCall over IMS shall not perform any kind of GPRS detach
procedure.
The GPRS detach procedure shall be invoked by the MS if the MS is switched off, the SIM/USIM card is removed from
the MS or if the GPRS or non-GPRS capability of the MS is disabled. The procedure may be invoked by the network to
detach the IMSI for GPRS services. The GPRS detach procedure causes the MS to be marked as inactive in the network
for GPRS services, non-GPRS services or both services.
If the detach procedure is triggered due to SIM/USIM removal, the MS shall indicate "switch off" in the detach type IE.
If a detach is requested by the HLR for an MS that has a PDP context for emergency services, the SGSN shall not send
a DETACH REQUEST message to the MS, and shall follow the procedure described in subclause 6.1.3.4.2 for an MS
that has PDP contexts for emergency bearer services.
When upper layers indicates that emergency bearer services are no longer required, the MS if still attached for
emergency bearer services, may perform a detach followed by a re-attach to regain normal services, if the MS is in or
moves to a suitable cell.
In A/Gb mode, if the GPRS detach procedure is performed, the PDP contexts and the MBMS contexts, if any, are
deactivated locally without peer to peer signalling between the SM and LLC entities in the MS and the network.
In Iu mode, if the GPRS detach procedure is performed, the PDP contexts and the MBMS contexts, if any, are
deactivated locally without peer to peer signalling between the SM entities in the MS and the network.
If the MS supports S1 mode, the MS shall store the TIN in the non-volatile memory in the ME, as described in
3GPP TS 24.301 [120], annex C, for a subsequent attach procedure.
The MS is allowed to initiate the GPRS detach procedure even if the timer T3346 is running.
The network proceeds with the GPRS detach procedure even if NAS level mobility management congestion control is
active.
4.7.4.1 MS initiated GPRS detach procedure
4.7.4.1.1 MS initiated GPRS detach procedure initiation

The GPRS detach procedure is initiated by the MS by sending a DETACH REQUEST message. The detach type
information element may indicate "GPRS detach with switching off", "GPRS detach without switching off", "IMSI
detach", "GPRS/IMSI detach with switching off" or "GPRS/IMSI detach without switching off".
If the MS has a valid P-TMSI, the MS shall include the P-TMSI in the DETACH REQUEST message. The MS shall
also include a valid P-TMSI signature, if available.
ETSI
Release 18 186 3GPP TS 24.008 V18.4.0 (2023-09)
If the MS is not switched off and the MS is in the state GMM_REGISTERED, timer T3321 shall be started after the
DETACH REQUEST message has been sent. If the detach type information element value indicates "IMSI Detach" the
MS shall enter GMM-REGISTERED.IMSI-DETACH_INITIATED, otherwise the MS shall enter the state GMM-
DEREGISTERED-INITIATED. If the detach type information element value indicates "IMSI Detach" or "GPRS/IMSI
Detach", state MM IMSI DETACH PENDING is entered. If the MS to be switched off is not a MS using any of the
coverage classes of EC-GSM-IoT, the MS shall try for a period of 5 seconds to send the DETACH REQUEST message.
If the MS to be switched off is a MS using any of the coverage classes of EC-GSM-IoT, that MS should try for at least a
period of 10 seconds to send the DETACH REQUEST message. If the MS is able to send the DETACH REQUEST
message during this time the MS may be switched off.
If the detach type information element value indicates "GPRS detach without switching off " and the MS is attached for
GPRS and non-GPRS services and the network operates in network operation mode I, then if in the MS the timer T3212
is not already running, the timer T3212 shall be set to its initial value and restarted after the DETACH REQUEST
message has been sent.
4.7.4.1.2 MS initiated GPRS detach procedure completion for GPRS services only
When the DETACH REQUEST message is received by the network, the network shall send a DETACH ACCEPT
message to the MS, if the detach type IE value indicates that the detach request has not been sent due to switching off. If
switching off was indicated, the procedure is completed when the network receives the DETACH REQUEST message.
The network and the MS shall deactivate the PDP contexts, the MBMS contexts and deactivate the logical link(s), if
any.
The MS is marked as inactive in the network for GPRS services; state GMM-DEREGISTERED is entered in the MS
and the network.
In Iu mode, if the detach has been sent due to switching off, then the network shall release the resources in the lower
layers for this MS (see 3GPP TS 25.331 [23c]).
NOTE: When the DETACH REQUEST message is received by the network, and if the detach type IE value
indicates that the detach is not due to power off, the authentication and ciphering procedure as well as the
identification procedure may be performed.
If the MS supports S1 mode and operates in MS operation mode A or B , the MS shall disable the E-UTRA capability
(see 3GPP TS 24.301 [120]).
4.7.4.1.3 MS initiated combined GPRS detach procedure completion

When the DETACH REQUEST message is received by the network, a DETACH ACCEPT message shall be sent to the
MS, if the detach type IE value indicates that the detach request has not been sent due to switching off. Depending on
the value of the detach type IE the following applies:
GPRS/IMSI detach:
The MS is marked as inactive in the network for GPRS and for non-GPRS services. The network and the MS shall
deactivate the PDP contexts, the MBMS contexts and deactivate the logical link(s), if any. The States GMM-
DEREGISTERED and MM NULL are entered in both the MS and the network.
In Iu mode, if the detach has been sent due to switching off, then the network shall release the resources in the lower
layers for this MS (see 3GPP TS 25.331 [23c]).
IMSI detach:
The MS is marked as inactive in the network for non-GPRS services. State MM NULL is entered in the MS and the
network.

a) T3321 time-out
On the first expiry of the timer, the MS shall retransmit the DETACH REQUEST message and shall reset and
restart timer T3321. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3321, the GPRS
detach procedure shall be aborted, the MS shall change to state:
ETSI
Release 18 187 3GPP TS 24.008 V18.4.0 (2023-09)
- MM-NULL if "IMSI detach" was requested;
- GMM-REGISTERED.NORMAL-SERVICE if "IMSI Detach" was requested;
- GMM-DEREGISTERED if "GPRS detach" was requested;
- GMM-DEREGISTERED and MM-NULL if "GPRS/IMSI" detach was requested.
b) Lower layer failure before reception of DETACH ACCEPT message
The detach procedure is aborted and the MS shall change to one of the following states, except in the following
implementation option cases b.1, b.2 and b3:
- MM-NULL if "IMSI detach" was requested;
- GMM-REGISTERED.NORMAL-SERVICE if "IMSI Detach" was requested;
- GMM-DEREGISTERED if "GPRS detach" was requested;
- GMM-DEREGISTERED and MM-NULL if "IMSI/GPRS" detach was requested.
b.1) Release of PS signalling connection before the completion of the GPRS detach procedure
The release of the PS signalling connection before completion of the GPRS detach procedure shall result in the
GPRS detach procedure being initiated again, if the following conditions apply:
i) The original GPRS detach procedure was initiated over an existing PS signalling connection; and
DETACH REQUEST message was transmitted.
b.2) RR release in Iu mode (i.e. RRC connection release) with cause different than "Directed signalling
connection re-establishment", for example, "Normal", or"User inactivity" (see 3GPP TS 25.331 [23c] and
3GPP TS 44.118 [111])
The GPRS detach procedure shall be initiated again, if the following conditions apply:
i) The original GPRS detach procedure was initiated over an exisiting RRC connection; and
DETACH REQUEST message was transmitted.
NOTE: The RRC connection release cause different than "Directed signalling connection re-establishment" that
triggers the re-initiation of the GPRS detach procedure is implementation specific.
b.3) RR release in Iu mode (i.e. RRC connection release) with cause "Directed signalling connection re-
establishment" (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111])
The routing area updating procedure shall be initiated followed by completion of the GPRS detach procedure if
the following conditions apply:
i) The original GPRS detach procedure was not due to SIM removal; and
ii) The original GPRS detach procedure was not due to a rerun of the procedure due to "Directed signalling
connection reestablishment".
c) Detach procedure collision
GPRS detach containing cause "power off":
- If the MS receives a DETACH REQUEST message before the MS initiated GPRS detach procedure has been
completed, this message shall be ignored and the MS initiated GPRS detach procedure shall continue.
GPRS detach containing other causes than "power off":
ETSI
Release 18 188 3GPP TS 24.008 V18.4.0 (2023-09)
- If the MS receives a DETACH REQUEST message before the MS initiated GPRS detach procedure has been
completed, the MS shall treat the message as specified in subclause 4.7.4.2.2 with the following
modifications:
- If the DETACH REQUEST message received by the MS contains detach type "re-attach required", and
the MS initiated detach procedure is with detach type "GPRS detach" or "Combined GPRS/IMSI detach",
the MS need not initiate the GPRS attach or combined GPRS attach procedure.
- If the DETACH REQUEST message received by the MS contains detach type "IMSI detach", and the MS
initiated detach procedure is with detach type "IMSI detach", the MS in operation mode A or B in
network operation mode I need not re-attach to non-GPRS services.
- If the DETACH REQUEST message received by the MS contains detach type "IMSI detach", and the MS
initiated detach procedure is with detach type "GPRS detach" or "combined GPRS/IMSI detach", the MS
shall progress both procedures. The MS in operation mode A or B in network operation mode I need not
re-attach to non-GPRS services.
d) Detach and GMM common procedure collision
- If the MS receives a message used in a GMM common procedure before the GPRS detach procedure has
been completed, this message shall be ignored and the GPRS detach procedure shall continue.
GPRS detach containing other causes than "power off" and containing detach type "IMSI detach":
- If the MS receives a message used in a GMM common procedure before the GPRS detach procedure has
been completed, both the GMM common procedure and the GPRS detach procedure shall continue.
GPRS detach containing other causes than "power off" and containing other detach types than "IMSI detach":
- If the MS receives a P-TMSI REALLOCATION COMMAND, a GMM STATUS, or a GMM

INFORMATION message before the GPRS detach procedure has been completed, this message shall be
ignored and the GPRS detach procedure shall continue.
- If the MS receives an AUTHENTICATION AND CIPHERING REQUEST or IDENTITY REQUEST

message, before the GPRS detach procedure has been completed, the MS shall respond to it as described in
subclauses 4.7.7 and 4.7.8 respectively.
e) Change of cell within the same RA (A/Gb mode only)
If a cell change occurs within the same RA before a DETACH ACCEPT message has been received, then the
cell update procedure shall be performed before completion of the detach procedure.
f) Change of cell into a new routing area
If a cell change into a new routing area occurs before a DETACH ACCEPT message has been received, the
GPRS detach procedure shall be aborted and re-initiated after successfully performing a routing area updating
procedure. If the detach procedure is performed due to the removal of the SIM/USIM or the MS is to be
switched off, the MS shall abort the detach procedure and enter the state GMM-DEREGISTERED.
g) Access barred because of access class control or EAB
The signalling procedure for GPRS detach shall not be started. The MS starts the signalling procedure as soon as
possible and if still necessary, i.e. when the barred state is removed or because of a cell change, or performs a
local detach immediately or after an implementation dependent time.
h) Detach and paging for non-GRPS services procedure collision
If the MS receives a paging for non-GPRS services before the MS initiated combined GPRS detach procedure
with detach type "IMSI detach" or "GPRS/IMSI detach" has been completed, then the paging for non-GPRS
services shall be ignored and the MS initiated combined GPRS detach procedure shall continue.
ETSI
Release 18 189 3GPP TS 24.008 V18.4.0 (2023-09)
MS Network
DETACH REQUEST
Start T3321
DETACH ACCEPT
Stop T3321
or at MS power switch off
DETACH REQUEST
Figure 4.7.4/1 3GPP TS 24.008: MS initiated GPRS detach procedure
For the cases b and f:
- Timer T3321 shall be stopped if still running.

a) Detach request received in a CSG cell for which the MS has no valid CSG subscription
If the MS initiates a detach procedure in a CSG cell the CSG ID of which is not valid for the MS and the detach
procedure is not due to "switch off", the network shall proceed as follows:
- if the detach type is "IMSI detach" and the MS has a PDN connection for emergency bearer services active,
the SGSN shall send a DETACH ACCEPT message and deactivate all non-emergency PDP contexts, if any,
by initiating a PDP context deactivation procedure;
- otherwise, the network shall initiate the detach procedure. The network shall send a DETACH REQUEST
message including the GMM cause value #25 "not authorized for this CSG".
4.7.4.2 Network initiated GPRS detach procedure
4.7.4.2.1 Network initiated GPRS detach procedure initiation

The network initiates the GPRS detach procedure by sending a DETACH REQUEST message to the MS. The
DETACH REQUEST message shall include a detach type IE. In addition, the network may include a cause IE to
specify the reason for the detach request. The network shall start timer T3322. If the detach type IE indicates "re-attach
required", or "re-attach not required" and the cause code is not #2 "IMSI unknown in HLR", the network shall
deactivate the PDP contexts, the MBMS contexts and deactivate the logical link(s), if any, and shall change to state
GMM-DEREGISTERED-INITIATED.
4.7.4.2.2 Network initiated GPRS detach procedure completion by the MS

When receiving the DETACH REQUEST message and the detach type indicates "re-attach required", the MS shall
deactivate the PDP context(s), the MBMS context(s) and deactivate the logical link(s), if any. The MS shall stop the
timer T3346, if it is running. The MS shall also stop timer(s) T3396, if it is running. The MS shall send a DETACH
ACCEPT message to the network and shall enter the state GMM-DEREGISTERED. The MS shall, after the completion
of the GPRS detach procedure, initiate a GPRS attach procedure. The MS should also activate PDP context(s) that were
originally activated by the MS to replace any previously MS activated PDP context(s). The MS should also perform the
procedures needed in order to activate any previously active multicast service(s).
NOTE 1: When the detach type indicates "re-attach required", user interaction is necessary in some cases when the
MS cannot re-activate the PDP/MBMS context(s) automatically.
ETSI
Release 18 190 3GPP TS 24.008 V18.4.0 (2023-09)
A GPRS MS operating in MS operation mode A or B in network operation mode I, which receives an DETACH
REQUEST message with detach type indicating "re-attach required" or "re-attach not required" and no cause code, is
only detached for GPRS services in the network.
When receiving the DETACH REQUEST message and the detach type IE indicates "IMSI detach", the MS shall not
deactivate the PDP/MBMS contexts. The MS shall set the MM update status to U2 NOT UPDATED. An MS in
operation mode A or B in network operation mode I may send a DETACH ACCEPT message to the network, and shall
re-attach to non-GPRS service by performing the combined routing area updating procedure according to
subclause 4.7.5.2, sending a ROUTING AREA UPDATE REQUEST message with Update type IE indicating
"combined RA/LA updating with IMSI attach". An MS in operation mode A that is in an ongoing circuit-switched
transaction shall initiate the combined routing area updating after the circuit-switched transaction has been released. An
MS in operation mode C, or in MS operation mode A or B in network operation mode II, shall send a DETACH
ACCEPT message to the network.
If the detach type IE indicates "IMSI detach", or "re-attach required" then the MS shall ignore the cause code if
received.
If the MS is attached for GPRS and non-GPRS services and the network operates in network operation mode I, then if
in the MS the timer T3212 is not already running, the timer T3212 shall be set to its initial value and restarted if:
- the detach type IE indicates "re-attach required"; or
- the detach type IE indicates "re-attach not required" and no cause code is included.
When receiving the DETACH REQUEST message and the detach type IE indicates "re-attach not required" and no
cause code, or "re-attach not required" and the cause code is not #2 "IMSI unknown in HLR", the MS shall deactivate
the PDP contexts, the MBMS contexts and deactivate the logical link(s), if any. The MS shall then send a DETACH
ACCEPT message to the network and shall change state to GMM-DEREGISTERED.
If the detach type IE indicates "re-attach not required" and no cause code is included,
- the MS shall set the GPRS update status to GU2 NOT UPDATED, delete the GMM parameters P-TMSI, P-
TMSI signature, RAI, and GPRS ciphering key sequence number, and start timer T3302. If the MS is operating
in MS operation mode C, it may enter the state GMM-DEREGISTERED.PLMN-SEARCH in order to perform a
PLMN selection according to 3GPP TS 23.122 [6]; otherwise the MS shall enter the state GMM-
DEREGISTERED.ATTEMPTING-TO-ATTACH; and
- if S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status,
GUTI, last visited registered TAI, TAI list and KSI, as specified in 3GPP TS 24.301 [120] for the case when a
DETACH REQUEST is received with the no EMM cause included and with detach type set to "re-attach not
required".
If the detach type IE indicates "re-attach not required" and a cause code is included, then, depending on the received
cause code, the MS shall act as follows:
#2 (IMSI unknown in HLR);
The MS shall set the update status to U3 ROAMING NOT ALLOWED and shall delete any TMSI, LAI and
ciphering key sequence number. The new MM state is MM IDLE. The SIM/USIM shall be considered as invalid
for non-GPRS services until switching off or the SIM/USIM is removed. If the message has been successfully
integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for
non-GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.
A GPRS MS operating in MS operation mode A or B in network operation mode I, is still IMSI attached for
GPRS services in the network.
#3 (Illegal MS);
#6 (Illegal ME);
number. The MS shall delete the list of equivalent PLMNs. The new GMM state is GMM-
DEREGISTERED.NO-IMSI. The SIM/USIM shall be considered as invalid for GPRS services until switching
off or the SIM/USIM is removed. If the message has been successfully integrity checked by the lower layers and
ETSI
Release 18 191 3GPP TS 24.008 V18.4.0 (2023-09)
the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this
A GPRS MS operating in MS operation mode A or B shall in addition set the update status to U3 ROAMING
NOT ALLOWED, shall delete any TMSI, LAI and ciphering key sequence number. If the MS is operating in
MS operation mode A and an RR connection exists, the MS shall abort the RR connection, unless an emergency
call is ongoing. The SIM/USIM shall be considered as invalid also for non-GPRS services until switching off or
the SIM/USIM is removed. If the message has been successfully integrity checked by the lower layers and the
MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this
GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when a
DETACH REQUEST is received with the EMM cause with the same value and with detach type set to "re-attach
not required".
NOTE 2: The possibility to configure an MS so that the radio transceiver for a specific radio access technology is
not active, although it is implemented in the MS, is out of scope of the present specification.
A GPRS MS operating in MS operation mode A or B which is already IMSI attached for CS services is still
IMSI attached for CS services in the network.
A GPRS MS operating in MS operation mode A or B in network operation mode I shall then proceed with the
appropriate MM specific procedure.
not required".
number. The MS shall delete the list of equivalent PLMNs. The new GMM state is GMM-
not required".
ETSI
Release 18 192 3GPP TS 24.008 V18.4.0 (2023-09)
The MS shall delete any RAI or LAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number,
subclause 4.1.3.2) and shall reset the GPRS attach attempt counter. The MS shall delete the list of equivalent
PLMNs. The new GMM state is GMM-DEREGISTERED.
- A GPRS MS operating in MS operation mode A or B shall set the update status to U3 ROAMING NOT
ALLOWED and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM
IDLE.
for the case when a DETACH REQUEST is received with the EMM cause with the same value and with detach
type set to "re-attach not required".
The MS shall delete any RAI, P-TMSI, P-TMSI signature GPRS ciphering key sequence number, shall set the
GPRS update status to GU3 ROAMING NOT ALLOWED(and shall store it according to clause 4.1.3.2) and
SERVICE.
The MS shall store the LAI in the list of "forbidden location areas for regional provision of service".
shall reset the GPRS attach attempt counter. The MS shall delete the list of equivalent PLMNs. The state is
ETSI
Release 18 193 3GPP TS 24.008 V18.4.0 (2023-09)
changed to GMM-DEREGISTERED.LIMITED-SERVICE or optionally to GMM-DEREGISTERED.PLMN-

SEARCH.
DEREGISTERED.
timer T3245 and proceed as described in subclause 4.1.1.6. If the message has been successfully integrity
A GPRS MS operating in MS operation mode C shall delete the list of equivalent PLMNs and perform a PLMN
selection according to 3GPP TS 23.122 [14].
SERVICE.
ETSI
Release 18 194 3GPP TS 24.008 V18.4.0 (2023-09)
If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state and EPS update status,
The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and store it according to
subclause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-
If the cell where the MS has received the DETACH REQUEST message is a CSG cell and the CSG ID and
associated PLMN identity of the cell are contained in the Allowed CSG list stored in the MS, the MS shall
remove the CSG ID and associated PLMN identity from the Allowed CSG list.
If the cell where the MS has received the DETACH REQUEST message is a CSG cell and the CSG ID and
associated PLMN identity of the cell are contained in the Operator CSG list, the MS shall proceed as specified in
If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state and EPS update status,
NOTE 7: CSG is applicable only for UMTS.
Other cause values shall not impact the update status. Further actions of the MS are implementation dependent.
4.7.4.2.3 Network initiated GPRS detach procedure completion by the network

The network shall, upon receipt of the DETACH ACCEPT message, stop timer T3322. If the detach type IE included in
the DETACH REQUEST message indicates "IMSI detach", or "re-attach not required" and the cause code is #2 "IMSI
unknown in HLR", the network shall not change the current GMM state; otherwise the network shall change state to
GMM-DEREGISTERED.

a) T3322 time-out
On the first expiry of the timer, the network shall retransmit the DETACH REQUEST message and shall start
timer T3322. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3322, the GPRS detach
procedure shall be aborted. If the detach type indicates "IMSI detach", or "re-attach not required" and the cause
code is #2 "IMSI unknown in HLR", the network shall not change the current GMM state; otherwise the network
shall change state to GMM-DEREGISTERED.
ETSI
Release 18 195 3GPP TS 24.008 V18.4.0 (2023-09)
b) Low layer failure
The GPRS detach procedure is aborted. If the detach type indicates "IMSI detach", or "re-attach not required"
and the cause code is #2 "IMSI unknown in HLR", the network shall not change the current GMM state;
otherwise the network shall change state to GMM-DEREGISTERED.
c) GPRS detach procedure collision
If the network receives a DETACH REQUEST message with "switching off" indicated, before the network
initiated GPRS detach procedure has been completed, both procedures shall be considered completed.
If the network receives a DETACH REQUEST message without "switching off" indicated, before the network
initiated GPRS detach procedure has been completed, the network shall send a DETACH ACCEPT message to
the MS.
d) GPRS detach and GPRS attach procedure collision
If the network receives an ATTACH REQUEST message before the network initiated GPRS detach procedure
with type of detach 're-attach not required' has been completed, the network shall ignore the ATTACH
REQUEST message. If the detach type IE value, sent in the DETACH REQUEST message, indicates "re-attach
required" the detach procedure is aborted and the GPRS attach procedure shall be progressed after the PDP
contexts and MBMS contexts, if any, have been deleted. If the detach type IE value, sent in the DETACH
REQUEST message, indicates "IMSI detach" the detach procedure is aborted and the GPRS attach procedure
shall be progressed.
e) GPRS detach and routing area updating procedure collision
GPRS detach containing detach type "re-attach required" or "re-attach not required":
If the network receives a ROUTING AREA UPDATE REQUEST message before the network initiated
GPRS detach procedure has been completed, the detach procedure shall be progressed, i.e. the ROUTING
AREA UPDATE REQUEST message shall be ignored. If the DETACH REQUEST message contains detach
type "re-attach not required" and GMM cause #2 "IMSI unknown in HLR", the network will follow the
procedure as described below for the detach type "IMSI detach".
GPRS detach containing detach type "IMSI detach":
If the network receives a ROUTING AREA UPDATE REQUEST message before the network initiated
GPRS detach procedure has been completed, the network shall abort the detach procedure, shall stop T3322
and shall progress the routing area update procedure.
f) GPRS detach and service request procedure collision
If the network receives a SERVICE REQUEST message before the network initiated GPRS detach procedure
has been completed, the network shall progress the detach procedure. If the GPRS Detach Request message
contains detach type "re-attach not required" and GMM cause #2 "IMSI unknown in HLR", the network will
follow the procedure as described below for the detach type "IMSI detach".
If the network receives a SERVICE REQUEST message before the network initiated GPRS detach procedure
has been completed, the network shall progress both procedures.
ETSI
Release 18 196 3GPP TS 24.008 V18.4.0 (2023-09)
MS Network
DETACH REQUEST
Start T3322
DETACH ACCEPT
Stop T3322
Figure 4.7.4/2 3GPP TS 24.008: Network initiated GPRS detach procedure
4.7.5 Routing area updating procedure

This procedure is used for:
- normal routing area updating to update the registration of the actual routing area of an MS in the network. This
procedure is used by GPRS MSs in MS operation mode C and by GPRS MSs in MS operation modes A or B that
are IMSI attached for GPRS and non-GPRS services if the network operates in network operation mode II;
- combined routing area updating to update the registration of the actual routing and location area of an MS in the
network. This procedure is used by GPRS MSs in MS operation modes A or B that are IMSI attached for GPRS
and non-GPRS services provided that the network operates in network operation mode I;
- periodic routing area updating. This procedure is used by GPRS MSs in MS operation mode C and by GPRS
MSs in MS operation modes A or B that are IMSI attached for GPRS or for GPRS and non-GPRS services
independent of the network operation mode;
- IMSI attach for non-GPRS services when the MS is IMSI attached for GPRS services. This procedure is used by
GPRS MSs in MS operation modes A or B, if the network operates in network operation mode I;
- in A/Gb mode, resuming GPRS services when the RR sublayer indicated a resumption failure after dedicated
mode was left, see 3GPP TS 44.018 [84];
- in A/Gb mode, updating the network with the new MS Radio Access Capability IE when the content of the IE
has changed;
- updating the network with the new DRX parameter IE when the content of the IE has changed;
NOTE 1: Such changes can be used e.g. when the MS activates a PDP context with service requirements that
cannot be met with the current DRX parameter. As PDP context(s) are activated and deactivated, the
GMM context will be updated with an appropriate DRX parameter;
- re-negotiation of the READY timer value;
- Iu mode to A/Gb mode and for A/Gb mode to Iu mode intersystem change, see subclause 4.7.1.7;
- in Iu mode, re-synchronizing the PMM mode of MS and network after RRC connection release with cause
"Directed signalling connection re-establishment", see subclause 4.7.2.5;
- in Iu mode and A/Gb mode after intersystem change from S1 mode, and the GMM receives an indication of
"RRC connection failure" from lower layers due to lower layer failure while in S1 mode;
- S1 mode to Iu mode or S1 mode to A/Gb mode intersystem change and ISR is not activated;
- S1 mode to Iu mode or S1 mode to A/Gb mode intersystem change and ISR is activated, but the MS changes to a
routeing area it has not previously registered with the network;
- indicating to the network that due to a manual CSG selection the MS has selected a CSG cell whose CSG
identity and associated PLMN identity are not included in the MS's Allowed CSG list or in the MS's Operator
CSG list;
ETSI
Release 18 197 3GPP TS 24.008 V18.4.0 (2023-09)
- indicating to the network that the mobile station classmark 2, mobile station classmark 3 or the supported codecs
have changed for a MS supporting SRVCC; or
- indicating the current radio access technology to the network for the support of terminating access domain
selection for voice calls or voice sessions (for details see subclause 4.7.5.1 and subclause 4.7.5.2.1).
While an MS has a PDN connection for emergency bearer services, the MS shall not perform manual CSG selection.
The routing area updating procedure shall also be used by a MS which is attached for GPRS services if a new PLMN is
entered (see 3GPP TS 23.122 [14]), unless the MS is configured for "AttachWithIMSI" as specified in
3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and the new PLMN is neither the registered PLMN nor in the list of
equivalent PLMNs.
An eCall only mobile station that is not capable of eCall over IMS shall not perform a normal or combined routing area
updating procedure.
Subclause 4.7.5.1 describes the routing area updating procedures for updating the routing area only. The combined
routing area updating procedure used to update both the routing and location area is described in subclause 4.7.5.2.
The routing area updating procedure is always initiated by the MS. It is only invoked in state GMM-REGISTERED.
To limit the number of consecutive rejected routing area update attempts, a routing area updating attempt counter is
introduced. The routing area updating attempt counter shall be incremented as specified in subclause 4.7.5.1.5.
Depending on the value of the routing area updating attempt counter, specific actions shall be performed. The routing
area updating attempt counter shall be reset when:
- a GPRS attach or combined GPRS attach procedure is successfully completed;
- a normal or periodic routing area updating or combined routing area updating procedure is successfully
completed;
- a combined GPRS attach procedure or a combined routing area updating procedure is completed for GPRS
services only with cause #2 or #28;
- a normal or periodic routing area updating or combined routing updating procedure is rejected with cause #11,
#12, #13, #14, #15 or #25;
- a new PLMN is selected.
and additionally when the MS is in substate ATTEMPTING-TO-UPDATE:
- a new routing area is entered;
- at request from registration function; or
location areas for regional provision of service". The handling of these lists is described in subclause 4.4.1.
shall construct the Routing Area Identification of the cell from this chosen PLMN identity, and the LAC and the RAC
received on the BCCH. If the constructed RAI is different from the stored RAI, the MS shall initiate the routing area
updating procedure. For:
- a shared GERAN, in A/Gb mode, the chosen PLMN identity is indicated to the GERAN in the first RLC data
block of an upper layer PDU (see 3GPP TS 44.060 [76]) when a foreign TLLI is used by the network sharing
supporting MS for the transmission.
ETSI
Release 18 198 3GPP TS 24.008 V18.4.0 (2023-09)
Whenever a ROUTING AREA UPDATE REJECT message with the cause "PLMN not allowed" is received by the MS,
the chosen PLMN identity shall be stored in the "forbidden PLMN list" and if the MS is configured to use timer T3245
(see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in
subclause 4.1.1.6. Whenever a ROUTING AREA UPDATE REJECT message is received by the MS with the cause
"Roaming not allowed in this location area", "Location Area not allowed", or "No suitable cells in Location Area", the
LAI that is part of the constructed RAI which triggered the routing area updating procedure shall be stored in the
suitable list.
In A/Gb mode, user data transmission in the MS shall be suspended during the routing area updating procedure, except
if the routing area updating procedure is triggered by a PS handover procedure as described in 3GPP TS 43.129 [113];
user data reception shall be possible. User data transmission in the network may be suspended during the routing area
updating procedure.
In Iu mode, user data transmission and reception in the MS shall not be suspended during the routing area updating
procedure. User data transmission in the network shall not be suspended during the routing area updating procedure.
In Iu mode, when a ROUTING AREA UPDATE REQUEST is received by the SGSN over a new PS signalling
connection while there is an ongoing PS signalling connection (network is already in mode PMM-CONNECTED) for
this MS, the network shall progress the routing area updating procedure as normal and release the previous PS
signalling connection when the routing area updating procedure has been accepted by the network.
NOTE 2: The re-establishment of the radio bearers of active PDP contexts is done as described in subclause
"Service Request procedure".
The network informs the MS about the support of specific features, such as LCS-MOLR, MBMS, IMS voice over PS
session, emergency bearer services in Iu mode in the Network feature support information element. The information is
either explicitly given by sending the Network feature support IE or implicitly by not sending it. The handling in the
network is described in subclause 9.4.15.11The network can also use the Additional network feature support IE in order
to inform the MS about the support of specific features such as the delivery of SMS via GPRS (GPRS-SMS) or
implicitly by not sending it. The MS may use the support indications for LCS-MOLR, MBMS and GPRS-SMS to
inform the user about the availability of the appropriate services. The MS shall not request the LCS-MOLR or
MBMSservices, if the service has not been indicated as available. The indication for MBMS is defined in subclause
"MBMS feature support indication" in 3GPP TS 23.246 [106]. In an MS with IMS voice over PS capability, the IMS
voice over PS session indicator and the emergency bearer services indicator shall be provided to the upper layers. The
upper layers take the IMS voice over PS session indicator into account as specified in 3GPP TS 23.221 [131],
subclause 7.2a and subclause 7.2b, when selecting the access domain for voice sessions or calls in Iu mode. When
initiating an emergency call in Iu mode, the upper layers also take the emergency bearer services indicator into account
for the access domain selection. The MS may use the GPRS-SMS indication in order to obtain SMS.
4.7.5.1 Normal and periodic routing area updating procedure

Periodic routing area updating is used to periodically notify the availability of the MS to the network. The value of the
update type IE in the ROUTING AREA UPDATE REQUEST message shall indicate "periodic updating". The
procedure is controlled in the MS by timer T3312. When timer T3312 expires, the periodic routing area updating
procedure is started. Start and reset of timer T3312 is described in subclause 4.7.2.2.
The normal routing area updating procedure is initiated:
- when the MS detects a change of the routing area in state GMM-REGISTERED;
- when the MS determines that GPRS resumption shall be performed;
- when the MS needs to update the network with the new MS Radio Access Capability IE;
- when the MS needs to update the network with the new DRX parameter IE;
- in Iu mode, to re-synchronize the PMM mode of MS and network after RRC connection release with cause
- in Iu mode, to re-synchronize the PMM mode of MS and network after inter-system change not due to PS
handover from PMM-CONNECTED mode in Iu mode to A/Gb mode or S1 mode, if the MS performs an inter -
system change back to Iu mode without sending a ROUTING AREA UPDATE REQUEST message while in
A/Gb mode or a TRACKING AREA UPDATE REQUEST message while in S1 mode;
ETSI
Release 18 199 3GPP TS 24.008 V18.4.0 (2023-09)
- in Iu mode and A/Gb mode, after intersystem change from S1 mode, and the GMM receives an indication of
"RRC connection failure" from lower layers due to lower layer failure while in S1 mode. In this case, if the TIN
indicates "RAT-related TMSI", the MS shall set the TIN to "GUTI" before initiating the routing area updating
procedure;
- in A/Gb mode, after intersystem change from S1 mode if the TIN indicates "RAT-related TMSI", but the MS is
required to perform routing area updating for IMS voice termination as specified in annex P.4;
- when the MS enters GMM-REGISTERED.NORMAL-SERVICE and the TIN indicates "GUTI";
- when the MS has selected a CSG cell whose CSG identity and associated PLMN identity are not included in the
Allowed CSG list;or in the Operator CSG list;
- when the MS supports SRVCC and changes the mobile station classmark 2, mobile station classmark 3 or the
supported codecs;
- when the MS changes the MS network capability information;
- when the UE's usage setting or the voice domain preference for E-UTRAN change in the MS;
- when the MS activates mobility management for IMS voice termination as specified in annex P.2 and the TIN
indicates "RAT-related TMSI";
- upon reception of a paging indication, using P-TMSI, if the timer T3346 is running and the MS is in state GMM-
REGISTERED.ATTEMPTING-TO-UPDATE and the RAI of the current cell is same as the stored RAI;
- in A/Gb mode, after intersystem change from S1 mode via cell change order procedure not due to CS fallback, if
the TIN indicates "RAT-related TMSI"; in this case the MS shall set the TIN to "GUTI" before initiating the
routing area updating procedure;
- in A/Gb or Iu mode in NMO I, after intersystem change from S1 mode due to CS fallback, if the TIN indicates
"GUTI" or if the routing area the MS is in is different from the registered routing area;
- in A/Gb mode, after Inter RAT handover from S1 mode or Iu mode;
- when the MS needs to request the use of PSM or needs to stop the use of PSM;
- when the MS needs to request the use of eDRX or needs to stop the use of eDRX;
- when a change in the PSM usage conditions at the MS requires a different timer T3312 value or different timer
T3324 value;
- when a change in the eDRX usage conditions at the MS requires different extended DRX parameters; or
NOTE 1: A change in the PSM or eDRX usage conditions at the MS can include e.g. a change in the MS
configuration, a change in requirements from upper layers or the battery running low at the MS.
- when the Default_DCN_ID value changes, as specified in 3GPP TS 24.368 [135] or in USIM file NASCONFIG as
NOTE 2: The routing area updating procedure is initiated after deleting the DCN-ID list as specified in
3GPP TS 24.301 [120], annex C.
The ROUTING AREA UPDATE REQUEST message shall always be the first data sent by the MS when a routing area
border is crossed. The routing area identification is broadcast on the broadcast channel(s).
A normal routing area updating shall abort any ongoing GMM procedure. Aborted GMM procedures may be repeated
after the normal routing area updating procedure has been successfully performed. The value of the update type IE
included in the message shall indicate "RA updating".
If the normal routing area updating procedure is initiated due to the reception of the paging indication while timer
T3346 is running, the "follow-on request pending" indication shall be set to 1.
ETSI
Release 18 200 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.5.1.1 Normal and periodic routing area updating procedure initiation

To initiate the normal routing area updating procedure, the MS sends the message ROUTING AREA UPDATE
REQUEST to the network, starts timer T3330 and changes to state GMM-ROUTING-AREA-UPDATING-
INITIATED. If timer T3302 is currently running, the MS shall stop timer T3302. If timer T3311 is currently running,
the MS shall stop timer T3311.
If the MS supports S1 mode, the MS shall handle the P-TMSI IE as follows:
- If the TIN indicates "GUTI" and the MS holds a valid GUTI allocated by an MME, the MS shall map the GUTI
into a P-TMSI, P-TMSI signature and RAI as specified in 3GPP TS 23.003 [10]. The MS shall include the
mapped RAI in the Old routing area identification IE and the mapped P-TMSI signature in the P-TMSI signature
IE. In addition, the MS shall include the P-TMSI type IE with P-TMSI type set to "mapped P-TMSI". When the
routing area updating procedure is initiated in Iu mode, the MS shall also include the mapped P-TMSI in the
P-TMSI IE. Additionally, in Iu mode and A/Gb mode, if the MS holds a valid P-TMSI and RAI, the MS shall
indicate the P-TMSI in the Additional mobile identity IE and the RAI in the Additional old routing area
identification IE.
- If the TIN indicates "P-TMSI" or "RAT-related TMSI" and the MS holds a valid P-TMSI and RAI, the MS shall
indicate the RAI in the Old routing area identification IE. In addition, the MS shall include the P-TMSI type IE
with P-TMSI type set to "native P-TMSI". When the routing area updating procedure is initiated in Iu mode, the
MS shall also include the P-TMSI in the P-TMSI IE.
If the MS does not support S1 mode, the MS shall include the P-TMSI type IE with P-TMSI type set to "native P-
TMSI".
If the MS supports PSM and requests the use of PSM, the MS shall include the T3324 value IE with a requested timer
value in the ROUTING AREA UPDATE REQUEST message. When the MS includes the T3324 value IE and the MS
indicates support for extended periodic timer value in the MS network feature support IE, it may also include the T3312
extended value IE to request a particular T3312 value to be allocated.
If the routing area updating procedure is not initiated by the MS due to an S1 mode to Iu mode or S1 mode to A/Gb
mode intersystem change, or if it is initiated due to such an intersystem change and the TIN indicates "RAT-related
TMSI", the MS shall use the existing UMTS security context for the PS domain. The ROUTING AREA UPDATE
REQUEST message shall contain the P-TMSI signature when received in a previous ATTACH ACCEPT or ROUTING
AREA UPDATE ACCEPT message. If the MS has a valid UMTS security context, the MS shall indicate it in the GPRS
ciphering key sequence number IE.
If the routing area updating procedure is initiated by the MS due to an S1 mode to Iu mode or S1 mode to A/Gb mode
inter-system change in idle mode, or if it is initiated by the MS due to PS to CS domain change from S1 mode due to
SRVCC or vSRVCC handover, and the TIN indicates "GUTI", the MS shall derive a UMTS security context for the PS
domain from the current EPS security context as described in the subclause 4.7.7.10. The ROUTING AREA UPDATE
REQUEST message shall include a P-TMSI signature filled with a NAS token as specified in 3GPP TS 33.401 [123].
Furthermore, the MS shall indicate the eKSI value, which is associated with the derived UMTS security keys, in the
CKSN field of the GPRS GSM ciphering key sequence number IE in the ROUTING AREA UPDATE REQUEST
message.
NOTE: When the MS includes a P-TMSI signature filled with a NAS token, 8 bits of the NAS token will be filled
with bits from the M-TMSI (see 3GPP TS 23.003 [10]).
If the routing area updating procedure is initiated by the MS due to the S1 mode to Iu mode or S1 mode to A/Gb mode
inter-system change in connected mode, the MS shall derive a UMTS security context for the PS domain from the
current EPS security context as described in the subclause 4.7.7.10. Furthermore, the MS shall indicate the eKSI value,
which is associated with the derived UMTS security keys, in the CKSN field of the GPRS GSM ciphering key sequence
number IE in the ROUTING AREA UPDATE REQUEST message.
In Iu mode, if the MS wishes to prolong the established PS signalling connection after the normal routing area updating
procedure (for example, the MS has any CM application request pending), it may set a follow-on request pending
indicator on (see subclause 4.7.13).
In order to indicate the new DRX parameter while in GERAN or UTRAN coverage, the MS shall send the ROUTING
AREA UPDATE REQUEST message containing the DRX parameter in the DRX parameter IE to the network, with the
exception of the case if the MS had indicated its MS specific DRX parameter (3GPP TS 24.301 [120]) to the network
while in E-UTRAN coverage. In this case, when the MS enters GERAN or UTRAN coverage and initiates a routing
ETSI
Release 18 201 3GPP TS 24.008 V18.4.0 (2023-09)
area updating procedure, the MS shall not include the DRX parameter in the DRX parameter IE in the ROUTING
AREA UPDATE REQUEST message.
If the MS supports eDRX and requests the use of eDRX, the MS shall include the extended DRX parameters IE in the
ROUTING AREA UPDATE REQUEST message.
In A/Gb mode, if the MS supports the restriction on use of enhanced coverage, then the MS shall set the Restriction on
use of enhanced coverage capability bit to "Mobile station supports restriction on use of enhanced coverage" in the MS
network capability IE of the ROUTING AREA UPDATE REQUEST message
If the MS supports dual connectivity of E-UTRA with NR, then the MS shall set the Dual connectivity of E-UTRA with
NR capability bit to "Mobile station supports dual connectivity of E-UTRA with NR" in the MS network capability IE
of the ROUTING AREA UPDATE REQUEST message.
In A/Gb mode, if a UMTS security context is available and if the MS indicates support of integrity protection in the MS
network capability IE included in the ROUTING AREA UPDATE REQUEST message, then the MS shall use the
current GPRS GSM Kint key and the current GPRS GSM integrity algorithm to integrity protect the ROUTING AREA
UPDATE REQUEST message in the LLC layer. If LLC layer has not yet been configured, then the GMM layer in the
MS shall assign the GPRS GSM Kint key, the GPRS GSM Kc128 key, the GPRS GSM integrity algorithm and the GPRS
GSM ciphering algorithm to the LLC layer, and indicates to the LLC layer that it shall start integrity protection. This
shall be done so that the LLC layer can integrity protect, but not cipher, the ROUTING AREA UPDATE REQUEST
message. The MS shall include the CKSN in the CKSN IE in the ROUTING AREA UPDATE REQUEST message. If
the MS has no UMTS security context available, then the MS shall not integrity protect the ROUTING AREA
UPDATE REQUEST message in the LLC layer. The MS shall in this case set the CKSN IE to the value "no key is
available" and send the ROUTING AREA UPDATE REQUEST message unprotected.

If the network receives a ROUTING AREA UPDATE REQUEST message containing the P-TMSI type IE, and the
network does not follow the use of the most significant bit of the <LAC> to distinguish the node type as specified in
3GPP TS 23.003 [10] subclause 2.8.2.2.2, the network shall use the P-TMSI type IE to determine whether the mobile
identity included in the P-TMSI IE, if any, or the mobile identity used by the MS to derive a foreign TLLI (see
subclause 4.7.1.4.1) is a native P-TMSI or a mapped P-TMSI.
The network may initiate GMM common procedures, e.g. the GMM authentication and ciphering procedure.
4.7.5.1.3 Normal and periodic routing area updating procedure accepted by the network
If the routing area updating request has been accepted by the network, a ROUTING AREA UPDATE ACCEPT
message shall be sent to the MS. The network may assign a new P-TMSI and/or a new P-TMSI signature for the MS. If
a new P-TMSI and/or P-TMSI signature have been assigned to the MS, it/they shall be included in the ROUTING
AREA UPDATE ACCEPT message together with the routing area identification.
In a shared network, if the MS is a network sharing supporting MS, the network shall indicate the PLMN identity of the
CN operator that has accepted the routing area updating request in the RAI contained in the ROUTING AREA
UPDATE ACCEPT message; if the MS is a network sharing non-supporting MS, the network shall indicate the PLMN
identity of the common PLMN (see 3GPP TS 23.251 [109]). If the PLMN identity of the common PLMN included in
the RAI does not identify the CN operator that has accepted the routing area updating request, the network may include
the PLMN identity of the CN operator that has accepted the routing area updating request in the ROUTING AREA
UPDATE ACCEPT message.
In a multi-operator core network (MOCN) with common GERAN, the network shall indicate in the RAI the common
PLMN identity (see 3GPP TS 23.251 [109]). If the common PLMN identity included in the RAI does not identify the
CN operator that has accepted the routing area updating request, the network may include the PLMN identity of the CN
operator that has accepted the routing area updating request in the ROUTING AREA UPDATE ACCEPT message.
In A/Gb mode, if the MS indicates support of integrity protection in the MS network capability IE in the ROUTING
AREA UPDATE REQUEST message, and if the network supports integrity protection, then the network shall store all
octets received from the MS in the MS network capability IE and in the MS Radio Access Capability IE, up to the
maximum length defined for the respective information element.
ETSI
Release 18 202 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 1: The network needs to store the MS network capability and MS Radio Access Capability exactly as
received from the MS and network is not allowed to ignore the "higher" octets sent by the MS even if the
network does not support any features indicated in the higher octetst. Otherwise the replay check of the
MS network capability and MS Radio Access Capability will fail in the MS.
protection in the ROUTING AREA UPDATE REQUEST message and the network supports integrity protection, and if
integrity protection of the ROUTING AREA UPDATE REQUEST message is successfully verified in the LLC layer in
the network, then if the network decides to re-authenticate the MS or select a new integrity algorithm or ciphering
algorithm, the network shall initiate an authentication and ciphering procedure.
protection in the ROUTING AREA UPDATE REQUEST message and the network supports integrity protection if
integrity protection of the ROUTING AREA UPDATE REQUEST message is successfully verified in the LLC layer in
the network, the network may decide to continue using the stored GPRS GSM Kint integrity key, GPRS GSM Kc 128
encryption key, GPRS GSM ciphering algorithm and GPRS GSM integrity algorithm in the LLC layer without
initiating an authentication and ciphering procedure. If the MS and network continue to use the same ciphering mode,
ciphering or no ciphering, the ciphering mode is re-established without the need to run an authentication and ciphering
procedure. The network shall replay the MS network capability IE and the MS radio access capability IE received from
the MS in the ROUTING AREA UPDATE REQUEST message, by including the MS network capability IE and the
MS radio access capability IE in the ROUTING AREA UPDATE ACCEPT message to the MS. The GMM layer in the
network shall assign the stored GPRS GSM Kint key, the GPRS GSM Kc128 key, the GPRS GSM integrity algorithm
and the GPRS GSM ciphering algorithm to the LLC layer. The MS shall then indicate to the LLC layer that it shall start
integrity protection and ciphering in the LLC layer before sending the ROUTING AREA UPDATE ACCEPT message
to the MS. If the integrity protection of the ROUTING AREA UPDATE REQUEST message is not successfully
verified in the LLC layer or if the ROUTING AREA UPDATE REQUEST message is received without integrity
protection, then the network shall progress the routing area updating procedure and initiate an authentication and
ciphering procedure to authenticate the MS and activate integrity protection and ciphering in the MS.
protection in the ROUTING AREA UPDATE REQUEST message and the network supports integrity protection, and if
the network is not able to verify the message authentication code in the LLC layer protecting the ROUTING AREA
UPDATE REQUEST message, due to the LLC layer at the network not having been configured yet with the integrity
key and integrity algorithm for this MS, then the network shall progress the ROUTING AREA UPDATE REQUEST
message at GMM layer anyway. If the CKSN included in the ROUTING AREA UPDATE REQUEST message belongs
to an UMTS security context available in the network, then the network may re-establish integrity protection and
ciphering of layer 3 signalling messages in the LLC layer without initiating an authentication and ciphering procedure.
In A/Gb mode, if the MS indicates support of integrity protection of user plane data in the MS network capability IE in
the ROUTING AREA UPDATE REQUEST message, and if the network supports and accepts integrity protection of
user plane data, then the network shall indicate integrity protection of user plane data to the MS in the ROUTING
AREA UPDATE ACCEPT message. The MS shall indicate to the LLC layer to start integrity protection of user plane
data after the reception of the ROUTING AREA UPDATE ACCEPT message, if indicated. The same GPRS GSM Kint
key and the same GPRS GSM integrity algorithm used for integrity protection of layer 3 signalling messages shall be
used for integrity protection of user plane data in the LLC layer. The network shall indicate to the LLC layer to start
integrity protection of user plane data after sending the ROUTING AREA UPDATE ACCEPT message to the MS. If
the network does not indicate to the MS in the ROUTING AREA UPDATE ACCEPT message that it accepts the use of
integrity protection of user plane data, and if the MS does not accept such a network, then the MS shall detach from the
network.
If a new DRX parameter was included in the ROUTING AREA UPDATE REQUEST message, the network shall store
the new DRX parameter and use it for the downlink transfer of signalling and user data.
The network shall include the extended DRX parameters IE in the ROUTING AREA UPDATE ACCEPT message only
if the extended DRX parameters IE was included in the ROUTING AREA UPDATE REQUEST message, and the
network supports and accepts the use of eDRX.
If the MS has indicated in the ROUTING AREA UPDATE REQUEST message that it supports PS inter-RAT handover
from GERAN to UTRAN Iu mode, the network may include in the ROUTING AREA UPDATE ACCEPT message a
request to provide the Inter RAT information container.
If the MS has included the MS network capability IE or the UE network capability IE or both in the ROUTING AREA
UPDATE REQUEST message, the network shall store all octets received from the MS, up to the maximum length
ETSI
Release 18 203 3GPP TS 24.008 V18.4.0 (2023-09)
defined for the respective information element. In case the UE network capability IE indicated new information to the
network, the MS shall set the TIN to "P-TMSI".
NOTE 2: This information is forwarded to the new SGSN during inter-SGSN handover or to the new MME during
intersystem handover to S1 mode.
In A/Gb mode the Cell Notification information element shall be included in the ROUTING AREA UPDATE ACCEPT
message in order to indicate the ability of the network to support the Cell Notification.
The network shall change to state GMM-COMMON-PROCEDURE-INITIATED and shall start the supervision timer
T3350 as described in subclause 4.7.6.
If the LAI or PLMN identity contained in the ROUTING AREA UPDATE ACCEPT message is a member of any of
the "forbidden" lists and the MS is not attached for emergency bearer services, then any such entry shall be deleted.
In Iu mode, the network should prolong the PS signalling connection if the mobile station has indicated a follow-on
request pending in ROUTING AREA UPDATE REQUEST. The network may also prolong the PS signalling
connection without any indication from the mobile terminal (for example, if user plane radio access bearers have been
established for the MS).
If the PDP context status information element is included in ROUTING AREA UPDATE REQUEST message, then the
network shall deactivate all those PDP contexts locally (without peer to peer signalling between the MS and the
network), which are not in SM state PDP-INACTIVE on network side but are indicated by the MS as being in state
PDP-INACTIVE.
If the MBMS context status information element is included in the ROUTING AREA UPDATE REQUEST message,
then the network shall deactivate all those MBMS contexts locally (without peer to peer signalling between the MS and
network) which are not in SM state PDP-INACTIVE on the network side, but are indicated by the MS as being in state
PDP-INACTIVE. If no MBMS context status information element is included, then the network shall deactivate all
MBMS contexts locally which are not in SM state PDP-INACTIVE on the network side.
If a ROUTING AREA UPDATE REQUEST message is received from an MS with a LIPA PDN connection, and if:
- a L-GW Transport Layer Address is provided by the lower layer together with the ROUTING AREA UPDATE
REQUEST message, and the GGSN address associated with the PDP context of the LIPA PDN connection is
different from the provided L-GW Transport Layer Address (see 3GPP TS 25.413 [19c]); or
- no L-GW Transport Layer Address is provided together with the ROUTING AREA UPDATE REQUEST
message by the lower layer,
then the SGSN locally deactivates all PDP contexts associated with the LIPA PDN connection. If the ROUTING AREA
UPDATE REQUEST request message is accepted, the SGSN informs the MS via the PDP context status IE in the
ROUTING AREA UPDATE ACCEPT message that PDP contexts were locally deactivated.
If a ROUTING AREA UPDATE REQUEST message is received from an MS with a SIPTO at the local network PDN
connection, the following different cases can be distinguished:
1) If the PDN connection is a SIPTO at the local network PDN connection with collocated L-GW and if:
- a SIPTO L-GW Transport Layer Address is provided by the lower layer together with the ROUTING AREA
UPDATE REQUEST message, and the GGSN address associated with the PDP context of the SIPTO at the
local network PDN connection is different from the provided SIPTO L-GW Transport Layer Address (see
3GPP TS 25.413 [19c]); or
- no SIPTO L-GW Transport Layer Address is provided together with the ROUTING AREA UPDATE
REQUEST message by the lower layer,
2) If the PDN connection is a SIPTO at the local network PDN connection with stand-alone GW and if:
- a LHN-ID value is provided by the lower layer together with the ROUTING AREA UPDATE REQUEST
message, and the LHN-ID stored in the PDP context of the SIPTO at the local network PDN connection is
different from the provided LHN-ID value (see 3GPP TS 25.413 [19c]); or
- no LHN-ID value is provided together with the ROUTING AREA UPDATE REQUEST message by the
lower layer,
ETSI
Release 18 204 3GPP TS 24.008 V18.4.0 (2023-09)
then the SGSN locally deactivates all PDP contexts associated with the SIPTO at the local network PDN connection. If
the ROUTING AREA UPDATE REQUEST request message is accepted, the SGSN informs the MS via the PDP
context status IE in the ROUTING AREA UPDATE ACCEPT message that PDP contexts were locally deactivated.
For a SIPTO at the local network PDN connection with stand-alone GW, the conditions to deactivate ISR are specified
in 3GPP TS 23.401 [122], subclause 4.3.5.6.
If due to regional subscription restrictions or access restrictions the MS is not allowed to access the routing area, but the
MS has a PDN connection for emergency bearer services established, the network may accept the ROUTING AREA
UPDATE REQUEST message and deactivate all non-emergency PDP contexts by initiating an PDP context
deactivation procedure when the routing area updating procedure is initiated in PMM-CONNECTED mode. When the
routing area updating procedure is initiated in PMM-IDLE mode, the network locally deactivates all non-emergency
PDP contexts and informs the MS via the PDP context status IE in the ROUTING AREA UPDATE ACCEPT message.
The network shall not deactivate the PDP contexts for emergency bearer services. The network shall consider the MS to
be attached for emergency bearer services only.
If the network supports delivery of SMS via GPRS (see 3GPP TS 23.060 [74]) and this delivery is enabled (see
3GPP TS 29.272 [150]), then the network shall include the Additional network feature support IE in the ROUTING
AREA UPDATE ACCEPT message and set the GPRS-SMS indicator.
If the network supports the extended protocol configuration options IE and the MS indicated support of the extended
protocol configuration options IE, then the network shall include the Additional network feature support IE in the
ROUTING AREA UPDATE ACCEPT message and set the ePCO IE indicator to "extended protocol configuration
options IE supported".
The network shall indicate "combined RA/LA updated" or "combined RA/LA updated and ISR activated" in the update
result IE in the ROUTING AREA UPDATE ACCEPT message, if the following conditions apply:
- the update type IE included in the ROUTING AREA UPDATE REQUEST message indicates "periodic
updating" and the MS was previously successfully attached for GPRS and non-GPRS services; and
- location area updating for non-GPRS services as specified in 3GPP TS 29.018 [149] is successful.
The network shall include the T3324 value IE in the ROUTING AREA UPDATE ACCEPT message only if the T3324
value IE was included in the ROUTING AREA UPDATE REQUEST message, and the network supports and accepts
the use of PSM.
If the network supports and accepts the use of PSM, and the MS included the T3312 extended value IE in the
ROUTING AREA UPDATE REQUEST message, then the network shall take into account the T3312 value requested
when providing the Periodic RA update timer IE and the T3312 extended value IE in the ROUTING AREA UPDATE
ACCEPT message.
NOTE 3: Besides the value requested by the MS, the network can take local configuration into account when
selecting a value for T3312 (see 3GPP TS 23.060 [74] subclause 5.3.13.54).
In A/Gb mode, if the MS indicates support for restriction on use of enhanced coverage in the ROUTING AREA
UPDATE REQUEST message, and the network restricts enhanced coverage for the MS, then the network shall set the
RestrictEC bit to "Enhanced coverage restricted" in the Additional network feature support IE of the ROUTING AREA
UPDATE ACCEPT message.
If the network includes the T3324 value IE indicating a value other than deactivated in the ROUTING AREA UPDATE
ACCEPT message, the network shall indicate in the Update result IE in the ROUTING AREA UPDATE ACCEPT
message that ISR is not activated.
Upon receipt of a ROUTING AREA UPDATE ACCEPT message, the MS shall store the received routing area
identification, stops timer T3330, reset the routing area updating attempt counter, reset the service request attempt
counter and set the GPRS update status to GU1 UPDATED. If the message contains a P-TMSI, the MS shall use this P-
TMSI as new temporary identity for GPRS services and shall store the new P-TMSI. If no P-TMSI was included by the
network in the ROUTING AREA UPDATE ACCEPT message, the old P-TMSI shall be kept. Furthermore, the MS
shall store the P-TMSI signature if received in the ROUTING AREA UPDATE ACCEPT message. If no P-TMSI
signature was included in the message, the old P-TMSI signature, if available, shall be deleted.
ETSI
Release 18 205 3GPP TS 24.008 V18.4.0 (2023-09)
Upon receipt of a ROUTING AREA UPDATE ACCEPT message with update result IE indicating "combined RA/LA
updated" or "combined RA/LA updated and ISR activated" during the periodic routing area updating procedure, the MS
shall behave as follows:
- if the ROUTING AREA UPDATE ACCEPT message contains an IMSI, the MS is not allocated any TMSI. The
MS shall delete any old TMSI accordingly;
- if the ROUTING AREA UPDATE ACCEPT message contains a TMSI, the MS shall use this TMSI as new
temporary identity. The MS shall delete its old TMSI and shall store the new TMSI. In this case, a ROUTING
AREA UPDATE COMPLETE message is returned to the network to confirm the received TMSI; or
- if neither a TMSI nor an IMSI has been included by the network in the ROUTING AREA UPDATE ACCEPT
message, the old TMSI, if any is available, shall be kept.
Upon receiving a ROUTING AREA UPDATE COMPLETE message, the SGSN shall stop timer T3350 and change to
state GMM-REGISTERED. The P-TMSI, if sent in the ROUTING AREA UPDATE ACCEPT message, shall be
considered as valid.
NOTE 4: Upon receiving a ROUTING AREA UPDATE COMPLETE message, if a new TMSI is included in the
ROUTING AREA UPDATE ACCEPT message, the SGSN sends a BSSAP+-TMSI-REALLOCATION-
COMPLETE message as specified in 3GPP TS 29.018 [149].
If the PDP context status information element is included in ROUTING AREA UPDATE ACCEPT message, then the
MS shall deactivate all those PDP contexts locally (without peer to peer signalling between the MS and network), which
are not in SM state PDP-INACTIVE in the MS but are indicated by the network as being in state PDP-INACTIVE. If
there is a default PDP context among the PDP contexts to be deactivated, an MS supporting S1 mode shall locally
deactivate all PDP contexts associated to the same PDP address and APN as the default PDP context without peer-to-
peer SM signalling to the network; an MS not supporting S1 mode may apply the same behaviour. If only the PDN
connection for emergency bearer services remains established, the MS shall consider itself attached for emergency
bearer services only.
If the MBMS context status information element is included in the ROUTING AREA UPDATE ACCEPT message,
then the MS shall deactivate all those MBMS contexts locally (without peer to peer signalling between the MS and
network) which are not in SM state PDP-INACTIVE in the MS, but are indicated by the network as being in state PDP-
INACTIVE. If no MBMS context status information element is included, then the MS shall deactivate all those MBMS
contexts locally which are not in SM state PDP-INACTIVE in the MS.
If the ROUTING AREA UPDATE ACCEPT message contains the T3312 extended value IE, then the MS shall use the
T3312 extended value IE as periodic routing area update timer (T3312). If the ROUTING AREA UPDATE ACCEPT
message does not contain the T3312 extended value IE, then the MS shall use value in the Periodic RA update timer IE
as periodic routing area update timer (T3312).
If the MS receives the ROUTING AREA UPDATE ACCEPT message from a PLMN for which a PLMN-specific
attempt counter or PLMN-specific PS-attempt counter is maintained (see subclause 4.1.1.6A), then the MS shall reset
these counters. If the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall
reset this counter.
If the ROUTING AREA UPDATE ACCEPT message contains the T3324 value IE, then the MS shall use the timer
value for T3324 as specified in subclause 4.7.2.8.
If the ROUTING AREA UPDATE ACCEPT message contains the DCN-ID IE, then the MS shall store the included
DCN-ID value together with the PLMN code of the registered PLMN in a DCN-ID list in a non-volatile memory in the
ME as described in 3GPP TS 24.301 [120], annex C.
In a shared network or in a multi-operator core network (MOCN) with common GERAN, if the ROUTING AREA
UPDATE ACCEPT message contains the DCN-ID IE and the PLMN identity of the CN operator IE, the MS shall store
the included DCN-ID value with the PLMN identity indicated in the PLMN identity of the CN operator IE, and the
included DCN-ID value with the PLMN identity indicated in the RAI in a DCN-ID list in a non-volatile memory in the
In A/Gb mode, if the ROUTING AREA UPDATE ACCEPT message contains the Cell Notification information
element, then the MS shall start to use the LLC NULL frame to perform cell updates.
ETSI
Release 18 206 3GPP TS 24.008 V18.4.0 (2023-09)
If the MS has initiated the routing area updating procedure due to manual CSG selection and receives a ROUTING
AREA UPDATE ACCEPT message, and the MS sent the ROUTING AREA UPDATE REQUEST message in a CSG
cell, the MS shall check if the CSG ID and associated PLMN identity of the cell are contained in the Allowed CSG list.
If not, the MS shall add that CSG ID and associated PLMN identity to the Allowed CSG list and the MS may add the
HNB Name (if provided by lower layers) to the Allowed CSG list if the HNB Name is present in neither the Operator
CSG list nor the Allowed CSG list.
The network may also send a list of "equivalent PLMNs" in the ROUTING AREA UPDATE ACCEPT message. Each
entry of the list contains a PLMN code (MCC+MNC). If the routing area updating procedure is initiated during a CS
fallback procedure and the network is configured to support the return to the last registered E-UTRAN PLMN after CS
fallback as specified in 3GPP TS 23.272 [133], and the PLMN identity which is provided as part of the RAI contained
in the ROUTING AREA UPDATE ACCEPT message differs from the last registered E-UTRAN PLMN identity, the
network shall include the last registered E-UTRAN PLMN identity in the list of "equivalent PLMNs" in the ROUTING
AREA UPDATE ACCEPT message.
NOTE 5: The network can determine a routing area updating procedure is initiated during a CS fallback procedure
as specified in 3GPP TS 23.272 [133].
NOTE 6: The last registered E-UTRAN PLMN identity can be derived by the network as specified in
3GPP TS 23.272 [133].
The mobile station shall store the list, as provided by the network, and further handle the list as follows:
- if there is no PDN connection for emergency bearers established, the mobile station shall remove from the list of
"equivalent PLMNs" any PLMN code that is already in the "forbidden PLMN" list. If the mobile station is
operating in MS operation mode C or the mobile station is supporting S1 mode, it shall also remove any PLMN
code that is already in the list of "forbidden PLMNs for GPRS service";
- if the MS is not attached for emergency bearer services and there is a PDN connection for emergency bearer
services established, the MS shall remove from the list of "equivalent PLMNs" any PLMN code present in the
"forbidden PLMN" list when the PDN connection for emergency bearer services is released. If the mobile station
is operating in MS operation mode C or the mobile station is supporting S1 mode, it shall also remove any
PLMN code present in the list of "forbidden PLMNs for GPRS service" when the PDN connection for
emergency bearer services is released; and
- in addition, for all cases the mobile station shall add to the stored list the PLMN code of the registered PLMN
that sent the list.
All PLMNs in the stored list shall be regarded as equivalent to each other for PLMN selection, cell selection/re-
selection and handover. The stored list in the mobile station shall be replaced on each occurrence of the ROUTING
AREA UPDATE ACCEPT message. If no list is contained in the message, then the stored list in the mobile station shall
be deleted. An MS attached for emergency bearer services only shall delete the stored list when the MS enters the state
GMM-DEREGISTERED. The list shall be stored in the mobile station while switched off so that it can be used for
PLMN selection after switch on.
A ROUTING AREA UPDATE COMPLETE message shall be returned to the network if the ROUTING AREA
UPDATE ACCEPT message contained any of:
- a P-TMSI;
- a TMSI;
- receive N-PDU Numbers (see 3GPP TS 44.065 [78] and 3GPP TS 25.322 [19b]); or
- a request for the provision of Inter RAT handover information.
If Receive N-PDU Numbers were included, the Receive N-PDU Numbers values valid in the MS, shall be included in
the ROUTING AREA UPDATE COMPLETE message.
If the network has requested the provision of Inter RAT handover information, the MS shall return a ROUTING AREA
UPDATE COMPLETE message including the Inter RAT handover information IE to the network.
ETSI
Release 18 207 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 7: In Iu mode, after a routing area updating procedure, the mobile station can initiate Service Request
procedure to request the resource reservation for the active PDP contexts if the resources have been
released by the network or send upper layer message (e.g. ACTIVATE PDP CONTEXT REQUEST) to
the network via the existing PS signalling connection.
indicated "follow-on request pending" in ROUTING AREA UPDATE REQUEST message or if user plane radio access
bearers have been established for the MS) the network shall indicate the "follow-on proceed" in the ROUTING AREA
UPDATE ACCEPT message. If the network wishes to release the PS signalling connection, the network shall indicate
"no follow-on proceed" in the ROUTING AREA UPDATE ACCEPT message.
After that in Iu mode, the mobile station shall act according to the follow-on proceed flag included in the Update result
information element in the ROUTING AREA UPDATE ACCEPT message (see subclause 4.7.13).
The network may also send a Local Emergency Numbers List with local emergency numbers in the ROUTING AREA
UPDATE ACCEPT, by including the Emergency Number List IE. The mobile equipment shall store the Local
Emergency Numbers List, as provided by the network. The Local Emergency Numbers List stored in the mobile
equipment shall be replaced on each receipt of the Emergency Number List IE. The received Local Emergency
Numbers List shall be provided to the upper layers.
the cell on which this IE is received. If no list is contained in the ROUTING AREA UPDATE ACCEPT message, then
the stored Local Emergency Numbers List in the mobile equipment shall be kept, except if the mobile equipment has
successfully registered to a PLMN in a country different from that of the PLMN that sent the Local Emergency
Numbers List.
The mobile equipment shall use the stored Local Emergency Numbers List of emergency numbers received from the
emergency number.
In order to indicate to the MS that the GUTI and TAI list assigned to the MS remain registered with the network and are
valid in the MS, the network shall indicate in the Update result IE in the ROUTING AREA UPDATE ACCEPT
message that ISR is activated.
If the MS is attached for emergency bearer services or if the network has deactivated all non-emergency PDP contexts,
the network shall indicate in the update result IE in the ROUTING AREA UPDATE ACCEPT message that ISR is not
activated.
If the ROUTING AREA UPDATE ACCEPT message contains:
i) no indication that ISR is activated, an MS supporting S1 mode shall set the TIN to "P-TMSI" and shall stop the
periodic tracking area update timer T3412 or T3423, if running; or
ii) an indication that ISR is activated, then:
- if the MS is required to perform tracking area updating for IMS voice termination as specified in annex P.5,
the MS shall set the TIN to "P-TMSI" and shall stop the periodic tracking area update timer T3412 or T3423,
if running;
- if the MS had initiated the routing area updating procedure due to a change in DRX parameters, the MS shall
set the TIN to "P-TMSI" and shall stop the periodic tracking area update timer T3412 or T3423 if running;
ETSI
Release 18 208 3GPP TS 24.008 V18.4.0 (2023-09)
- if the MS had initiated the routing area updating procedure due to a change in the UE's usage setting or the
voice domain preference for E-UTRAN, the MS shall set the TIN to "P-TMSI" and shall stop the periodic
tracking area update timer T3412 or T3423, if running; or
- the MS shall regard the available GUTI and TAI list as valid and registered with the network. If the TIN
currently indicates "GUTI" and the periodic tracking area update timer T3412 is running or is deactivated,
the MS shall set the TIN to "RAT-related TMSI". If the TIN currently indicates "GUTI" and the periodic
tracking area update timer T3412 has already expired, the MS shall set the TIN to "P-TMSI".
In A/Gb mode, if a UMTS security context is available, if the MS indicates support of integrity protection in the
ROUTING AREA UPDATE REQUEST message and the network supports integrity protection, then if the MS receives
replayed capability IE’s in ROUTING AREA UPDATE ACCEPT message, then the MS shall check if the replayed MS
network capability IE and the replayed MS Radio Access Capability IE received in the ROUTING AREA UPDATE
ACCEPT message has not been altered compared to the MS network capability IE and the MS Radio Access Capability
IE that the MS sent to the network in ROUTING AREA UPDATE REQUEST message. If the replayed MS network
capability IE and the replayed MS Radio Access Capability IE are not the same, then the MS shall ignore the
ROUTING AREA UPDATE ACCEPT message.
4.7.5.1.4 Normal and periodic routing area updating procedure not accepted by the
network
If the routing area updating cannot be accepted, the network sends a ROUTING AREA UPDATE REJECT message to
the MS. An MS, which receives a ROUTING AREA UPDATE REJECT message with a reject cause other than GMM
cause value #25 or the message is integrity protected, shall stop the timer T3330. If a ROUTING AREA UPDATE
REJECT message containing a reject cause other than GMM cause value #25 is received or the message is integrity
protected, the MS shall stop any ongoing transmission of user data.
If the ROUTING AREA UPDATE REJECT message containing GMM cause value cause #25 was received without
integrity protection, then the MS shall discard the message.
If the routing area update request is rejected due to general NAS level mobility management congestion control, the
network shall set the GMM cause value to #22 "congestion" and assign a back-off timer T3346.
The MS shall then take different actions depending on the received reject cause value:
#3 (Illegal MS);
#6 (Illegal ME);
number. The MS shall consider the SIM/USIM as invalid for GPRS services until switching off or the
SIM/USIM is removed. If the message has been successfully integrity checked by the lower layers and the MS
maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to
MS implementation-specific maximum value. The MS shall delete the list of equivalent PLMNs, and shall enter
the state GMM-DEREGISTERED.NO-IMSI.
If the MS is IMSI attached, the MS shall in addition set the update status to U3 ROAMING NOT ALLOWED,
shall delete any TMSI, LAI and ciphering key sequence number. If the MS is operating in MS operation mode A
and an RR connection exists, the MS shall abort the RR connection, unless an emergency call is ongoing. The
SIM/USIM shall be considered as invalid also for non-GPRS services until switching off or the SIM/USIM is
removed or the timer T3245 expires as described in subclause 4.1.1.6. If the MS maintains a counter for
"SIM/USIM considered invalid for non-GPRS services", then the MS shall set this counter to MS
tracking area update procedure is rejected with the EMM cause with the same value.
NOTE 1: The possibility to configure a MS so that the radio transceiver for a specific radio access technology is not
active, although it is implemented in the MS, is out of scope of the present specification.
ETSI
Release 18 209 3GPP TS 24.008 V18.4.0 (2023-09)
subclause 4.1.3.2.9) and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence
is removed. The MS shall enter the state GMM-DEREGISTERED. If the message has been successfully
integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for
GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.
If the update type is "periodic updating", a GPRS MS operating in MS operation mode A or B in network
operation mode I shall then proceed with the appropriate MM specific procedure.
number. The MS shall delete the list of equivalent PLMNs, and shall enter the GMM state GMM-
tracking area procedure is rejected with the EMM cause with the same value.
#9 (MS identity cannot be derived by the network);
The MS shall set the GPRS update status to GU2 NOT UPDATED (and shall store it according to
subclause 4.1.3.2), enter the state GMM-DEREGISTERED.NORMAL-SERVICE, and shall delete any P-TMSI,
P-TMSI signature, RAI and GPRS ciphering key sequence number.
If the rejected request was not for initiating a PDN connection for emergency bearer services, then
- a GPRS MS operating in MS operation mode A in network operation mode I shall proceed with appropriate
MM specific procedures. Additionally, the MS shall initiate a normal or combined GPRS attach procedure
depending on whether it is in an ongoing circuit-switched transaction. If the MS is in an ongoing circuit-
switched transaction, it shall initiate the appropriate MM specific procedure after the circuit-switched
transaction has been released. The MM sublayer shall act as in network operation mode II as long as the
combined GMM procedures are not successful and no new RA is entered;
- if the update type is "periodic updating", a GPRS MS operating in MS operation mode B in network
operation mode I shall proceed with appropriate MM specific procedures. Additionally, the MS shall initiate
a combined GPRS attach procedure. The MM sublayer shall act as in network operation mode II as long as
the combined GMM procedures are not successful and no new RA is entered;
ETSI
Release 18 210 3GPP TS 24.008 V18.4.0 (2023-09)
- a GPRS MS operating in MS operation mode A or B in network operation mode II which is configured to use
CS fallback and SMS over SGs, or SMS over SGs only, and which did not perform a successful generic
location updating procedure since the last intersystem change from S1 mode to A/Gb or Iu mode shall
proceed with appropriate MM specific procedures. Additionally, a GPRS MS operating in MS operation
mode A or B in network operation mode II shall initiate a GPRS attach procedure; and
- a GPRS MS operating in MS operation mode A or B in network operation mode II which is not configured to
use CS fallback and SMS over SGs, or SMS over SGs only, and a GPRS MS operating in MS operation
mode C may subsequently, automatically initiate the GPRS attach procedure.
# 10 (Implicitly detached);
If the update type is "periodic updating", a GPRS MS operating in MS operation mode B in network operation
mode I, is IMSI detached for both GPRS and CS services in the network.
A GPRS MS operating in MS operation mode A in network operation mode I is detached for GPRS services. If
no RR connection exists then the MS is also IMSI detached for the CS services.
The MS shall enter the state GMM-DEREGISTERED.NORMAL-SERVICE. If the rejected request was not for
initiating a PDN connection for emergency bearer services, then
- a GPRS MS operating in MS operation mode A or B in network operation mode II which is configured to use
CS fallback and SMS over SGs, or SMS over SGs only, and which did not perform a successful generic
location updating procedure since the last intersystem change from S1 mode to A/Gb or Iu mode shall
proceed with appropriate MM specific procedures;
- regardless of the MS operation mode and the network operation mode, the MS shall then perform a new
attach procedure. The MS should also activate PDP context(s) that were originally activated by the MS to
replace any previously MS activated PDP context(s). The MS should also perform the procedures needed in
order to activate any previously active multicast service(s); and
- additionally, a GPRS MS operating in MS operation mode A in network operation mode I which is

configured to use CS fallback and SMS over SGs, or SMS over SGs only, and which is in an ongoing circuit-
switched transaction shall initiate the appropriate MM specific procedure after the circuit-switched
transaction has been released. The MM sublayer shall act as in network operation mode II as long as the
combined GMM procedures are not successful and no new RA is entered.
If S1 mode is supported in the MS, the MS shall handle the EMM state as specified in 3GPP TS 24.301 [120] for
the case when the tracking area update procedure is rejected with the EMM cause with the same value.
NOTE 4: In some cases, user interaction may be required and then the MS cannot activate the PDP and MBMS
context(s) automatically.
the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2),
shall reset the routing area updating attempt counter, shall delete the list of equivalent PLMNs, and enter the
state GMM-DEREGISTERED.
ETSI
Release 18 211 3GPP TS 24.008 V18.4.0 (2023-09)
- If the MS is IMSI attached, the MS shall set the update status to U3 ROAMING NOT ALLOWED and shall
GUTI, last visited registered TAI, TAI list, KSI and tracking area updating attempt counter as specified in
3GPP TS 24.301 [120] for the case when the tracking area update procedure is rejected with the EMM cause
with the same value.
the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to clause 4.1.3.2),
shall reset the routing area updating attempt counter and shall change to state GMM-
clause 4.1.3.2) and shall delete the list of equivalent PLMNs. The MS shall reset the routing area updating
attempt counter, and shall enter the state GMM-REGISTERED.LIMITED-SERVICE.
reset the location update attempt counter. The new MM state is MM IDLE.
ETSI
Release 18 212 3GPP TS 24.008 V18.4.0 (2023-09)
If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status and
tracking area updating attempt counter as specified in 3GPP TS 24.301 [120] for the case when the tracking area
update procedure is rejected with the EMM cause with the same value.
subclause 4.1.3.2), shall reset the routing area updating attempt counter and shall change to state GMM-
DEREGISTERED.
timer T3245 and proceed as described in subclause 4.1.1.6. A GPRS MS operating in MS operation mode C
shall perform a PLMN selection instead of a cell selection. If the message has been successfully integrity
If the update type is "periodic updating" a GPRS MS operating in MS operation mode A or B in network
operation mode I shall then proceed with the appropriate MM specific procedure.
As an implementation option, a GPRS MS operating in operation mode A or B may perform the following
additional action. If no RR connection exists the MS may perform the action immediately. If the MS is operating
in MS operation mode A and an RR connection exists, the MS may only perform the action when the RR
connection is subsequently released:
- The MS may perform a PLMN selection according to 3GPP TS 23.122 [14].
is:
- On the "User Controlled PLMN Selector with Access Technology " or,
- On the "Operator Controlled PLMN Selector with Access Technology " list or,
subclause 4.1.3.2) shall reset the routing area updating attempt counter and shall change to state GMM-
REGISTERED.LIMITED-SERVICE.
ETSI
Release 18 213 3GPP TS 24.008 V18.4.0 (2023-09)
#22 (Congestion);
If the T3346 value IE is present in the ROUTING AREA UPDATE REJECT message and the value indicates
that this timer is neither zero nor deactivated, the MS shall proceed as described below, otherwise it shall be
considered as an abnormal case and the behaviour of the MS for this case is specified in subclause 4.7.5.1.5.
The MS shall abort the routing area updating procedure, reset the routing area updating attempt counter and set
the GPRS update status to GU2 NOT UPDATED. If the rejected request was not for initiating a PDN connection
for emergency bearer services, the MS shall change to state GMM-REGISTERED.ATTEMPTING-TO-
UPDATE.
If the ROUTING AREA UPDATE REJECT message is integrity protected, the MS shall start timer T3346 with
the value provided in the T3346 value IE.
If the ROUTING AREA UPDATE REJECT message is not integrity protected, the MS shall start timer T3346
with a random value from the default range specified in table 11.3a.
The MS stays in the current serving cell and applies the normal cell reselection process. The routing area
updating procedure is started, if still necessary, when timer T3346 expires or is stopped.
A GPRS MS operating in MS operation mode A or B in network operation mode II which is configured to use
CS fallback and SMS over SGs, or SMS over SGs only, and which did not perform a successful generic location
updating procedure since the last intersystem change from S1 mode to A/Gb or Iu mode shall proceed with
appropriate MM specific procedures.
subclause 4.1.3.2) and shall reset the routing area updating attempt counter. The state is changed to GMM-
If the CSG ID and associated PLMN identity of the cell where the MS has sent the ROUTING AREA UPDATE
If the CSG ID and associated PLMN identity of the cell where the MS has sent the ROUTING AREA
UPDATE REQUEST message are contained in the Operator CSG list, the MS shall proceed as specified in
ETSI
Release 18 214 3GPP TS 24.008 V18.4.0 (2023-09)
- The MS shall search for a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].
Other values are considered as abnormal cases. The specification of the MS behaviour in those cases is described in
4.7.5.1.4a Routing area updating procedure for initiating a PDN connection for emergency
bearer services not accepted by the network (UTRAN Iu mode only)
If the routing area updating request for initiating a PDN connection for emergency bearer services cannot be accepted
by the network, the MS shall perform the procedures as described in subclause 4.7.5.1.4. Then if the MS is in the same
selected PLMN where the last routing area updating was attempted, the MS shall:
b) detach locally, if not detached already, attempt GPRS attach for emergency bearer services.
If the routing area updating request for initiating a PDN connection for emergency bearer services fails due to abnormal
case a) in subclause 4.7.5.1.5, the MS shall perform the procedures as described in subclause 4.7.5.1.5 and inform the
upper layers of the failure to access the network.
If the routing area updating request for initiating a PDN connection for emergency bearer services fails due to abnormal
cases b), c) or d) in subclause 4.7.5.1.5, the MS shall perform the procedures as described in subclause 4.7.5.1.5. Then
if the MS is in the same selected PLMN where the last routing area updating was attempted, the MS shall:

If the routing area updating procedure is started in response to a paging request from the network, access class
barring, EAB or ACDC is not applicable.
The routing area updating procedure shall not be started. The MS stays in the current serving cell and applies the
normal cell reselection process. The procedure is started as soon as possible and if still necessary, i.e. when the
barred state is removed or because of a cell change.
If access is barred because of access class control, the upper layers request PS signalling connection, ACDC is
applicable to the request and the MS supports ACDC, then the routing area updating procedure shall be started
according to subclause 4.7.5.1.1.
ETSI
Release 18 215 3GPP TS 24.008 V18.4.0 (2023-09)
If access is barred for a certain ACDC category, and if the upper layers request PS signalling connection for a
higher ACDC category and the MS supports ACDC, then the routing area updating procedure shall be started
according to subclause 4.7.5.1.1.
If an access request for an uncategorized application is barred due to ACDC , and if the upper layers request PS
signalling connection for a certain ACDC category and the MS supports ACDC, then the routing area updating
procedure shall be started according to subclause 4.7.5.1.1.
b) Lower layer failure without "Extended Wait Time" received from lower layers before the ROUTING AREA
UPDATE ACCEPT or ROUTING AREA UPDATE REJECT message is received
The procedure shall be aborted and the MS shall proceed as described below, except in the following
implementation option cases b.1 and b.2.
b.1) Release of PS signalling connection before the completion of the routing area updating procedure
The routing area updating procedure shall be initiated again, if the following conditions apply:
i) The original routing area update procedure was initiated over an existing PS signalling connection; and
ii) The routing area update procedure was not due to timer T3330 expiry; and
the PS signalling connection were (e.g. PS authentication procedure, see subclause 4.7.7) received after the
ROUTING AREA UPDATE REQUEST message was transmitted.
b.2) RR release in Iu mode (i.e. RRC connection release) with, for example, cause "Normal", or "User inactivity"
or "Direct signalling connection re-establishment" (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111])
The routing area updating procedure shall be initiated again, if the following conditions apply:
i) The original routing area update procedure was initiated over an existing RRC connection; and
ii) The routing area update procedure was not due to timer T3330 expiry; and
ROUTING AREA UPDATE REQUEST message was transmitted.
NOTE 1: The RRC connection release cause that triggers the re-initiation of the routing area update procedure is
c) T3330 time-out
The procedure is restarted four times, i.e. on the fifth expiry of timer T3330, the MS shall abort the procedure
and, in Iu mode, release the PS signalling connection (see 3GPP TS 25.331 [23c]). The MS shall proceed as
described below.
d) ROUTING AREA UPDATE REJECT, other causes than those treated in subclause 4.7.5.1.4, and cases of GMM
cause values #22 and #25, if considered as abnormal cases according to subclause 4.7.5.1.4
If the routing area updating request is not for initiating a PDN connection for emergency bearer services, upon
reception of the cause codes # 95, # 96, # 97, # 99 and # 111 the MS should set the routing area updating attempt
counter to 5.
e) If a routing area border is crossed, when the MS is in state GMM-ROUTING-AREA-UPDATE-INITIATED, the

routing area updating procedure shall be aborted and re-initiated immediately. The MS shall set the GPRS update
status to GU2 NOT UPDATED.
f) In A/Gb mode, if a cell change occurs within the same RA, when the MS is in state GMM-ROUTING-AREA-
UPDATE-INITIATED, the cell update procedure is performed, before completion of the routing area updating
procedure.
g) Routing area updating and detach procedure collision
ETSI
Release 18 216 3GPP TS 24.008 V18.4.0 (2023-09)
If the MS receives a DETACH REQUEST message before the routing area updating procedure has been
completed, the routing area updating procedure shall be aborted and the GPRS detach procedure shall be
progressed. If the DETACH REQUEST message contains detach type "re-attach not required" and GMM
cause #2 "IMSI unknown in HLR", the MS will follow the procedure as described below for the detach type
"IMSI detach".
If the MS receives a DETACH REQUEST message before the routing area updating procedure has been
completed, the routing area updating procedure shall be progressed, i.e. the DETACH REQUEST message
shall be ignored.
h) Routing area updating and P-TMSI reallocation procedure collision
If the MS receives a P-TMSI REALLOCATION C0MMAND message before the routing area updating
procedure has been completed, the P-TMSI reallocation procedure shall be aborted and the routing area updating
procedure shall be progressed.
i) "Extended wait time" for PS domain from the lower layers
If the ROUTING AREA UPDATE REQUEST message contained the low priority indicator set to "MS is
configured for NAS signalling low priority", the MS shall start timer T3346 with the "Extended wait time" value
and reset the routing area updating attempt counter.
The MS shall abort the routing area updating procedure, stay in the current serving cell, set the GPRS update
status to GU2 NOT UPDATED, change the state to GMM-REGISTERED.ATTEMPTING-TO-UPDATE and
apply the normal cell reselection process.
If the MS had used eDRX before initiating routing area updating procedure, then the MS shall continue to use
the eDRX with the extended DRX parameters IE received during the last attach or routing area updating
procedure.
The MS shall not start the routing area updating procedure unless:
- the MS is in PMM-CONNECTED mode (Iu mode);
- the MS receives a paging;
- the MS has a PDN connection for emergency bearer services established;
- the MS is establishing a PDN connection for emergency bearer services; or
- the MS has a PDN connection established without the NAS signalling low priority indication or is
establishing a PDN connection without the NAS signalling low priority indication and if the timer T3346 was
started due to rejection of a NAS request message (e.g. ATTACH REQUEST, ROUTING AREA UPDATE
REQUEST or SERVICE REQUEST) which contained the low priority indicator set to "MS is configured for
NAS signalling low priority".
NOTE 2: It is considered an abnormal case if the MS needs to initiate an routing area updating procedure while
timer T3346 is running independent on whether timer T3346 was started due to an abnormal case or a non
successful case.
ETSI
Release 18 217 3GPP TS 24.008 V18.4.0 (2023-09)
If the stored RAI is different to the RAI of the current serving cell or the TIN indicates "GUTI", the MS shall set
the GPRS update status to GU2 NOT UPDATED and change to state GMM-REGISTERED.ATTEMPTING-
TO-UPDATE.
k) Mobile originated detach required
GPRS detach due to removal of the USIM or due to switch off:
If the MS is in the state GMM-ROUTING-AREA-UPDATE-INITIATED, the routing area updating

procedure shall be aborted and the GPRS detach procedure shall be performed (see subclause 4.7.4.1).
GPRS detach not due to removal of the USIM and not due to switch off:
The MS shall initiate the MS initiated detach procedure after successful completion of the routing area
updating procedure.
l) Routing area updating and paging for non-GPRS services procedure collision
If a GPRS MS in MS operation mode B receives a paging for non-GPRS services before the normal or periodic
routing area updating procedure has been completed, the MS shall progress the routing area updating procedure
and respond to the paging for non-GPRS services when it has completed the routing area updating procedure or
aborted the procedure for other reasons.
In cases b, c, d, e, g with detach type "re-attach required" or "re-attach not required" with GMM cause other than #2
"IMSI unknown in HLR", and i, the MS shall stop any ongoing transmission of user data.
In cases b, c, d, i and j the MS shall proceed as follows:
Timer T3330 shall be stopped if still running.
For the cases b, c, d, and i when the "Extended wait time" is ignored, if the routing area updating request is not
for initiating a PDN connection for emergency bearer services, the routing area updating attempt counter shall be
incremented.
If the routing area updating attempt counter is less than 5, and the stored RAI is equal to the RAI of the current
serving cell and the GPRS update status is equal to GU1 UPDATED and the TIN does not indicate "GUTI":
- the MS shall keep the GPRS update status to GU1 UPDATED and changes state to GMM-
REGISTERED.NORMAL-SERVICE. The MS shall start timer T3311.
- If in addition the ROUTING AREA UPDATE REQUEST message indicated "periodic updating", none of
the other reasons for initiating the routing area updating procedure listed in subclause 4.7.5.1 was applicable,
and the ROUTING AREA UPDATE REQUEST message did not include a Requested READY timer value
IE, T3324 value IE, T3312 extended value IE or Extended DRX parameters IE,
- in Iu mode, the timer T3311 may be stopped when the MS enters PMM-CONNECTED mode;
- in A/Gb mode, the timer T3311 may be stopped when the READY timer is started.
- If timer T3311 expires the routing area updating procedure is triggered again.
If the routing area updating attempt counter is less than 5, and the stored RAI is different to the RAI of the
current serving cell or the GPRS update status is different to GU1 UPDATED or the TIN indicates "GUTI":
- for the cases i and j, the routing area updating procedure is started, if still necessary, when timer T3346
expires or is stopped.
- for the cases b, c, d, and i when the "Extended wait time" is ignored, if the routing area updating request is
not for initiating a PDN connection for emergency bearer services, the MS shall start timer T3311, shall set
the GPRS update status to GU2 NOT UPDATED and changes state to GMM-
REGISTERED.ATTEMPTING-TO-UPDATE.
- If S1 mode is supported by the MS, the MS shall in addition handle the EPS update status as specified in
3GPP TS 24.301 [120] for the abnormal case when a normal or periodic tracking area updating procedure
ETSI
Release 18 218 3GPP TS 24.008 V18.4.0 (2023-09)
fails and the tracking area updating attempt counter is less than 5 and the EPS update status is different from
EU1 UPDATED.
- the MS shall start timer T3302, and shall set the GPRS update status to GU2 NOT UPDATED. An MS which
is a GPRS MS in MS operation modes C shall also delete the list of equivalent PLMNs. The MS shall also
enter the state GMM-REGISTERED.ATTEMPTING-TO-UPDATE or optionally the GMM-
REGISTERED.PLMN-SEARCH state (see subclause 4.2.5.1.8) in order to perform a PLMN selection
- If S1 mode is supported by the MS, the MS shall in addition handle the EPS update status as specified in
3GPP TS 24.301 [120] for the abnormal case when a normal or periodic tracking area updating procedure
fails and the tracking area updating attempt counter is equal to 5.
- If the MS does not enter the state GMM-REGISTERED.PLMN-SEARCH, then
- a GPRS MS operating in MS operation mode A in network operation mode I shall proceed with
appropriate MM specific procedures. If the MS operating in MS operation mode A is in an ongoing
circuit-switched transaction, it shall initiate the appropriate MM specific procedure after the circuit-
switched transaction has been released. The MM sublayer of the MS operating in MS operation mode A
shall act as in network operation mode II as long as the combined GMM procedures are not successful
and no new RA is entered;
- if the update type is "periodic updating", a GPRS MS operating in MS operation mode B in network
operation mode I shall proceed with appropriate MM specific procedures. The MM sublayer shall act as
in network operation mode II as long as the combined GMM procedures are not successful and no new
RA is entered; and
- a GPRS MS operating in MS operation mode A or B in network operation mode II which is configured to

use CS fallback and SMS over SGs, or SMS over SGs only, and which did not perform a successful
generic location updating procedure since the last intersystem change from S1 mode to A/Gb or Iu mode
shall proceed with appropriate MM specific procedures.

a) If a lower layer failure occurs before the message ROUTING AREA UPDATE COMPLETE has been received
from the MS and a P-TMSI and/or PTMSI signature has been assigned, the network shall abort the procedure
and shall consider both, the old and new P-TMSI and the corresponding P-TMSI signatures as valid until the old
P-TMSI can be considered as invalid by the network (see subclause 4.7.1.5). During this period the network may
use the identification procedure followed by a P-TMSI reallocation procedure if the old P-TMSI is used by the
MS in a subsequent message.
NOTE 1: Optionally, paging with IMSI may be used if paging with old and new P-TMSI fails. Paging with IMSI
causes the MS to re-attach as described in subclause 4.7.9.1.
b) Protocol error
If the ROUTING AREA UPDATE REQUEST message has been received with a protocol error, the network
shall return a ROUTING AREA UPDATE REJECT message with one of the following reject causes:
ETSI
Release 18 219 3GPP TS 24.008 V18.4.0 (2023-09)
c) T3350 time-out
On the first expiry of the timer, the network shall retransmit the ROUTING AREA UPDATE ACCEPT message
and shall reset and restart timer T3350. The retransmission is performed four times, i.e. on the fifth expiry of
timer T3350, the routing area updating procedure is aborted. Both, the old and the new P-TMSI and the
corresponding P-TMSI signatures shall be considered as valid until the old P-TMSI can be considered as invalid
by the network(see subclause 4.7.1.5). During this period the network acts as described for case a above.
MS Network
ROUTING AREA UPDATE REQUEST

Start T3330
If P-TMSI or
TMSI allocated,
ROUTING AREA UPDATE ACCEPT or Receive N-PDU
Stop T3330
Number needed
Start T3350
If P-TMSI or
TMSI allocated, ROUTING AREA UPDATE COMPLETE
or Receive N-PDU Stop T3350
Number needed
or
ROUTING AREA UPDATE REQUEST

Start T3330
ROUTING AREA UPDATE REJECT

Stop T3330
Figure 4.7.5/1 3GPP TS 24.008: Routing and combined routing area updating procedure
d.1) ROUTING AREA UPDATE REQUEST received after the ROUTING AREA UPDATE ACCEPT message
has been sent and before the ROUTING AREA UPDATE COMPLETE message is received
- If one or more of the information elements in the ROUTING AREA UPDATE REQUEST message differ from
the ones received within the previous ROUTING AREA UPDATE REQUEST message, the previously initiated
routing area updating procedure shall be aborted if the ROUTING AREA UPDATE COMPLETE message has
not been received and the new routing area updating procedure shall be progressed, or
- If the information elements do not differ, then the ROUTING AREA UPDATE ACCEPT message shall be
resent and the timer T3350 shall be restarted if an ROUTING AREA UPDATE COMPLETE message is
expected. In that case, the retransmission counter related to T3350 is not incremented.
d.2) More than one ROUTING AREA UPDATE REQUEST received and no ROUTING AREA UPDATE
ACCEPT or ROUTING AREA UPDATE REJECT message has been sent
- If one or more of the information elements in the ROUTING AREA UPDATE REQUEST message differs from
the ones received within the previous ROUTING AREA UPDATE REQUEST message, the previously initiated
routing area updating procedure shall be aborted and the new routing area updating procedure shall be
progressed;
- If the information elements do not differ, then the network shall continue with the previous routing area updating
procedure and shall not treat any further this ROUTING AREA UPDATE REQUEST message.
e) DETACH REQUEST message received before the ROUTING AREA UPDATE ACCEPT message is sent or
before the ROUTING AREA UPDATE COMPLETE message (in case of P-TMSI and/or TMSI was allocated)
is received.
ETSI
Release 18 220 3GPP TS 24.008 V18.4.0 (2023-09)
The network shall abort the signalling for the routing area updating procedure towards the MS and shall progress
the detach procedure as described in subclause 4.7.4.1.
NOTE 2: Internally in the network, before processing the detach request, the SGSN can perform the necessary
signalling procedures for the routing area updating procedure before progressing the detach procedure.
The network shall proceed with the routing area updating procedure and shall progress the detach procedure
after successful completion of the routing area updating procedure.
f) ROUTING AREA UPDATE REQUEST message with update type IE indicating "periodic updating" is received
by the network, the network does not have the GMM context data related to the subscription, and the network
operates in network operation mode I.
The network may send the ROUTING AREA UPDATE REJECT message with GMM cause value #10
"Implicitly detached".
4.7.5.2 Combined routing area updating procedure
4.7.5.2.0 General
Within a combined routing area updating procedure the messages ROUTING AREA UPDATE ACCEPT and
ROUTING AREA UPDATE COMPLETE carry information for the routing area updating and the location area
updating.
4.7.5.2.1 Combined routing area updating procedure initiation

The combined routing area updating procedure is initiated only by a GPRS MS operating in MS operation modes A or
B, if the MS is in state GMM-REGISTERED and MM-IDLE, and if the network operates in network operation mode I:
- when a GPRS MS that is IMSI attached for GPRS and non-GPRS services detects a change of the routing area in
state GMM-REGISTERED and MM-IDLE, unless the MS is configured for "AttachWithIMSI" as specified in
3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and is entering a routing area in a new PLMN that is neither
the registered PLMN nor in the list of equivalent PLMNs;
- when a GPRS MS that is IMSI attached for GPRS services wants to perform an IMSI attach for non-GPRS
services;
- after termination of a non-GPRS service via non-GPRS channels to update the association if the MS has changed
the RA during that non-GPRS service transaction;
- after termination of a non-GPRS service via non-GPRS channels to update the association if GPRS services were
suspended during the non-GPRS service but no resume is received. See 3GPP TS 23.060 [74] subclause 16.2.1;
- after termination of a non-GPRS service via non-GPRS channels to update the association, if the GPRS MS in
MS operation mode A performed a normal GPRS attach or a normal routing area updating procedure during the
circuit-switched transaction;
- after a CM SERVICE REJECT message with cause value #4 is received by the mobile station (see
subclause 4.5.1.1); in this case the update type IE shall be set to "Combined RA/LA updating with IMSI attach";
- when a GPRS MS needs to update the network with the new MS Radio Access Capability IE;
- when a GPRS MS needs to update the network with a new DRX parameter IE;
- in Iu mode, to re-synchronize the PMM mode of MS and network after RRC connection release with cause
- in Iu mode, to re-synchronize the PMM mode of MS and network after inter-system change not due to PS
handover from PMM-CONNECTED mode in Iu mode to A/Gb mode or S1 mode, if the MS performed an inter -
system change back to Iu mode without sending a ROUTING AREA UPDATE REQUEST message while in
A/Gb mode or a TRACKING AREA UPDATE REQUEST message while in S1 mode;
ETSI
Release 18 221 3GPP TS 24.008 V18.4.0 (2023-09)
- in Iu mode and A/Gb mode, after intersystem change from S1 mode, and the GMM receives an indication of
"RRC connection failure" from lower layers due to lower layer failure while in S1 mode. In this case, if the TIN
indicates "RAT-related TMSI", the MS shall set the TIN to "GUTI" before initiating the routing area updating
procedure;
- in A/Gb mode, after intersystem change from S1 mode if the TIN indicates "RAT-related TMSI", but the MS is
required to perform routing area updating for IMS voice termination as specified in annex P.4;
- when the MS enters GMM-REGISTERED.NORMAL-SERVICE and the TIN indicates "GUTI";
- when the MS supports SRVCC and changes the mobile station classmark 2, mobile station classmark 3 or the
supported codecs;
- when the MS which is configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a
GERAN or UTRAN cell and timer T3423 has expired, or is in the GERAN or UTRAN cell when timer T3423
expires;
- when due to a manual CSG selection the GPRS MS has selected a CSG cell whose CSG identity and associated
PLMN identity are not included in the MS's Allowed CSG list or in the MS's Operator CSG list;
- when the MS changes the MS network capability information;
- when the UE's usage setting or the voice domain preference for E-UTRAN change in the MS;
- when the MS activates mobility management for IMS voice termination as specified in annex P.2 and the TIN
indicates "RAT-related TMSI";
- upon reception of a paging indication using P-TMSI, if the timer T3346 is running and the MS is in state GMM-
REGISTERED.ATTEMPTING-TO-UPDATE and the RAI of the current cell is same as the stored RAI;
- when the MS which is configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a
GERAN or UTRAN cell, after intersystem change from S1 mode to Iu or A/Gb mode not due to CS fallback,
and the location area of the current cell is different from the location area stored in the MS;
- in A/Gb mode, after intersystem change from S1 mode via cell change order procedure not due to CS fallback, if
the TIN indicates "RAT-related TMSI"; in this case the MS shall set the TIN to "GUTI" before initiating the
combined routing area updating procedure;
- in A/Gb mode, after Inter RAT handover from S1 mode or Iu mode;
- when the MS needs to request the use of PSM or needs to stop the use of PSM;
- when the MS needs to request the use of eDRX or needs to stop the use of eDRX;
- when a change in the eDRX usage conditions at the MS requires different extended DRX parameters;
- when a change in the PSM usage conditions at the MS requires a different timer T3312 value or different timer
T3324 value; or
NOTE 1: A change in the PSM or eDRX usage conditions at the MS can include e.g. a change in the MS
configuration, a change in requirements from upper layers or the battery running low at the MS.
- when the Default_DCN_ID value changes, as specified in 3GPP TS 24.368 [135] or in USIM file NASCONFIG as
NOTE 2: The routing area updating procedure is initiated after deleting the DCN-ID list as specified in
3GPP TS 24.301 [120], annex C.
In A/Gb mode, the routing and location area identification are broadcast on the broadcast channel(s). A combined
routing area updating procedure shall abort any ongoing GMM procedure. Aborted GMM procedures shall be repeated
after the combined routing area updating procedure has been successfully performed. The ROUTING AREA UPDATE
REQUEST message shall always be the first message sent from the MS in the new routing area after routing area
change.
ETSI
Release 18 222 3GPP TS 24.008 V18.4.0 (2023-09)
In Iu mode, the routing and location area identification are broadcast on the broadcast channel(s) or sent to the MS via
the PS signalling connection. A combined routing area updating procedure shall abort any ongoing GMM procedure.
Aborted GMM procedures may be repeated after the combined routing area updating procedure has been successfully
performed. The ROUTING AREA UPDATE REQUEST message shall always be the first GMM message sent from the
MS in the new routing area after routing area change.
To initiate a combined routing area updating procedure the MS sends the message ROUTING AREA UPDATE
REQUEST to the network, starts timer T3330 and changes to state GMM-ROUTING-UPDATING-INITIATED and
MM LOCATION UPDATING PENDING. The value of the Update type IE in the message shall indicate "combined
RA/LA updating" unless explicitly specified otherwise. If for the last attempt to update the registration of the location
area a MM specific procedure was performed, the value of the Update type IE in the ROUTING AREA UPDATE
REQUEST message shall indicate "combined RA/LA updating with IMSI attach". Furthermore the MS shall include
the TMSI status IE if no valid TMSI is available. If the MS has stored a valid LAI and the MS supports EMM combined
procedures, the MS shall include it in the Old location area identification IE in the ROUTING AREA UPDATE
REQUEST message. If timer T3302 is currently running, the MS shall stop timer T3302. If timer T3311 is currently
running, the MS shall stop timer T3311.
If the MS has stored a valid TMSI, the MS shall include the TMSI based NRI container IE in the ROUTING AREA
UPDATE REQUEST message.
A GPRS MS in MS operation modes B that is in an ongoing circuit-switched transaction, shall initiate the combined
routing area updating procedure after the circuit-switched transaction has been released, if the MS has changed the RA
during the circuit-switched transaction and if the network operates in network operation mode I.
A GPRS MS in MS operation mode A shall initiate the combined routing area updating procedure with IMSI attach
after the circuit-switched transaction has been released, if a normal GPRS attach or a normal routing area updating
procedure was performed during the circuit-switched transaction and provided that the network operates in network
operation mode I.
A GPRS MS in MS operation mode A shall perform the normal routing area update procedure during an ongoing
circuit-switched transaction.
If the MS initiates the combined routing area updating procedure for GPRS services and "SMS-only service", the MS
shall indicate "SMS only" in the Additional update type IE.
In Iu mode, if the MS wishes to prolong the established PS signalling connection after the normal routing area updating
procedure (for example, the MS has any CM application request pending), it may set a follow-on request pending
indicator on (see subclause 4.7.13).
In Iu mode, when a ROUTING AREA UPDATE REQUEST is received by the SGSN over a new PS signalling
connection while there is an ongoing PS signalling connection (network is already in mode PMM-CONNECTED) for
this MS, the network shall progress the routing area update procedure as normal and release the previous PS signalling
connection when the routing area update procedure has been accepted by the network.
NOTE 3: The re-establishment of the radio bearers of active PDP contexts is done as described in subclause
"Service Request procedure".
If the combined routing area updating procedure is initiated due to the reception of the paging indication while T3346 is
running, the "follow-on request pending" indication shall be set to 1.

The network may initiate GMM common procedures, e.g. the GMM authentication and ciphering procedure.
4.7.5.2.3 Combined routing area updating procedure accepted by the network

Depending on the value of the update result IE received in the ROUTING AREA UPDATE ACCEPT message, two
different cases can be distinguished:
Case 1) The update result IE value indicates "combined RA/LA": Routing and location area updating is
successful;
Case 2) The update result IE value indicates "RA only": Routing area updating is successful, but location area
updating is not successful.
ETSI
Release 18 223 3GPP TS 24.008 V18.4.0 (2023-09)
A ROUTING AREA UPDATE COMPLETE message shall be returned to the network if the ROUTING AREA
UPDATE ACCEPT message containsany of:
- a P-TMSI and/or a TMSI;
- Receive N-PDU Numbers (see 3GPP TS 44.065 [78] and 3GPP TS 25.322 [19b]); or
- a request for the provision of Inter RAT handover information.
If Receive N-PDU Numbers were included, the Receive N-PDU Numbers that are valid in the MS shall be included in
the ROUTING AREA UPDATE COMPLETE message.
If the network has requested the provision of Inter RAT handover information the MS shall return a ROUTING AREA
UPDATE COMPLETE message including the Inter RAT handover information IE, as applicable, to the network.
indicated "follow-on request pending" in ROUTING AREA UPDATE REQUEST message) the network shall indicate
the "follow-on proceed" in the ROUTING AREA UPDATE ACCEPT message. If the network wishes to release the PS
signalling connection, the network shall indicate "no follow-on proceed" in the ROUTING AREA UPDATE ACCEPT
message.
After that in Iu mode, the mobile station shall act according to the follow-on proceed flag included in the Update result
information element in the ROUTING AREA UPDATE ACCEPT message (see subclause 4.7.13).
If the network supports CS Fallback, and the mobile station has indicated support of EMM combined procedures in MS
network capability, the network shall indicate in the Update result IE in the ROUTING AREA UPDATE ACCEPT
message that ISR is not activated.
4.7.5.2.3.1 Combined routing area updating successful
The description for normal routing area update as specified in subclause 4.7.5.1.3 shall be followed. In addition, the
following description for location area updating applies.
The handling at the receipt of the ROUTING AREA UPDATE ACCEPT depends on the value received in the update
result IE as specified below.
The TMSI reallocation may be part of the combined routing area updating procedure. The TMSI allocated is then
included in the ROUTING AREA UPDATE ACCEPT message together with the location area identification (LAI).
The network shall, in this case, change to state GMM-COMMON-PROCEDURE-INITIATED and shall start the timer
T3350 as described in subclause 4.7.6.
The MS, receiving a ROUTING AREA UPDATE ACCEPT message, stores the received location area identification,
stops timer T3330, enters state MM IDLE, reset the location update attempt counter and sets the update status to U1
UPDATED. If the ROUTING AREA UPDATE ACCEPT message contains an IMSI, the mobile station is not allocated
any TMSI, and shall delete any TMSI accordingly. If the ROUTING AREA UPDATE ACCEPT message contains a
TMSI, the MS shall use this TMSI as new temporary identity. The MS shall delete its old TMSI and shall store the new
TMSI. In this case, an ROUTING AREA UPDATE COMPLETE message is returned to the network. If neither a TMSI
nor an IMSI has been included by the network in the ROUTING AREA UPDATE ACCEPT message, the old TMSI, if
any is available, shall be kept.
If the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events (see
subclause 4.1.1.6A), then the MS shall reset this counter.
If the MS is not configured for NAS signalling low priority, and any of the following conditions is fulfilled:
- the MS initiated the combined routing area updating procedure due to a change of the registered location area;
- the value of the Update type IE in the ROUTING AREA UPDATE REQUEST message indicated "combined
RA/LA updating with IMSI attach"; or
- the MS indicated support of EMM combined procedures in the MS network capability;
then the MS may stop timer T3246 if running.
Any timer used for triggering the location updating procedure (e.g. T3211, T3212) shall be stopped if running.
ETSI
Release 18 224 3GPP TS 24.008 V18.4.0 (2023-09)
The network receiving a ROUTING AREA UPDATE COMPLETE message stops timer T3350, changes to GMM-
REGISTERED state
NOTE: Upon receiving a ROUTING AREA UPDATE COMPLETE message, the SGSN sends a BSSAP+-
TMSI-REALLOCATION-COMPLETE message as specified in 3GPP TS 29.018 [149].
4.7.5.2.3.2 Combined routing area updating successful for GPRS services only
Apart from the actions on the routing area updating attempt counter, the description for normal routing area update as
specified in subclause 4.7.5.1.3 shall be followed. In addition, the following description for location area updating
applies.
The SGSN shall use GMM cause #28 "SMS provided via GPRS in this routing area" in the ROUTING AREA
UPDATE ACCEPT message only if the MS requested "SMS-only service" by including the Additional update type IE
in the ROUTING AREA UPDATE REQUEST message. The SGSN may indicate in the Update result IE in the
ROUTING AREA UPDATE ACCEPT message that ISR is activated.
The MS receiving the ROUTING AREA UPDATE ACCEPT message takes one of the following actions depending on
the GMM cause:
#2 (IMSI unknown in HLR);
new MM state is MM IDLE. The SIM/USIM shall be considered as invalid for non-GPRS services until
switching off or the SIM/USIM is removed. If the message has been successfully integrity checked by the
lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services",
#16 (MSC temporarily not reachable); or
#17 (Network failure)
The MS shall stop timer T3330 if still running, and shall enter state MM-IDLE. The routing area updating
attempt counter shall be incremented.
If the routing area updating attempt counter is less than 5, and the stored RAI is equal to the RAI of the current
serving cell and the GMM update status is equal to GU1 UPDATED:
attach" is triggered again.
UPDATE-MM;
specific procedures.
The MM sublayer shall act as in network operation mode II as long as the combined GMM procedures
are not successful and no new RA is entered.
# 22 (Congestion);
The MS shall change to state GMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM, shall stop timer

T3330 if still running, and shall enter state MM-IDLE. The MS shall set the routing area updating attempt
counter to 5 and shall start timer T3302.
# 28 (SMS provided via GPRS in this routing area);
ETSI
Release 18 225 3GPP TS 24.008 V18.4.0 (2023-09)
new MM state is MM IDLE.
Other GMM causevalues and the case that no GMM cause IE was received are considered as abnormal cases. The
combined routing area updating shall be considered as failed for non-GPRS services. The specification of the MS
behaviour in those cases is specified in subclause 4.7.5.2.5.
4.7.5.2.4 Combined routing area updating not accepted by the network

If the combined routing area updating cannot be accepted, the network sends a ROUTING AREA UPDATE REJECT
message to the MS. An MS that receives a ROUTING AREA UPDATE REJECT message containing a reject cause
other than GMM cause value #25 or the message is integrity protected, shall stop the timer T3330, and shall enter the
state MM IDLE. If a ROUTING AREA UPDATE REJECT message containing a reject cause other than GMM cause
value #25 is received or the message is integrity protected, the MS shall stop any ongoing transmission of user data.
If the ROUTING AREA UPDATE REJECT message containing GMM cause value #25 was received without integrity
protection, then the MS shall discard the message.
If the routing area update request is rejected due to general NAS level mobility management congestion control, the
network shall set the GMM cause value to #22 "congestion" and assign a back-off timer T3346.
The MS shall then take different actions depending on the received reject cause:
#3 (Illegal MS);
#6 (Illegal ME), or
#8 (GPRS services and non GPRS services not allowed);
The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED and the update status to U3
ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any P-TMSI, P-
TMSI signature, TMSI, RAI, LAI, ciphering key sequence number and GPRS ciphering key sequence number.
The MS shall consider the SIM/USIM as invalid for GPRS and non GPRS services until switching off or the
SIM/USIM is removed or the timer T3245 expires as described in subclause 4.1.1.6. The MS shall delete the list
of equivalent PLMNs, and shall enter the state GMM-DEREGISTERED.NO-IMSI.
specific maximum value. If the message has been successfully integrity checked by the lower layers and the MS
NOTE 1: Optionally the MS starts the timer T3340 as described in subclause 4.7.1.9 for reject cause #8.
combined tracking area update procedure is rejected with the EMM cause with the same value.
is removed. The MS shall enter the state GMM-DEREGISTERED.
specific maximum value.
ETSI
Release 18 226 3GPP TS 24.008 V18.4.0 (2023-09)
The MS shall set the GPRS update status to GU2 NOT UPDATED (and shall store it according to
P-TMSI signature, RAI and GPRS ciphering key sequence number.
A GPRS MS operating in MS operation mode A or B in network operation mode I which is already IMSI
attached for CS services in the network, is still IMSI attached for CS services in the network.
If the rejected request was not for initiating a PDN connection for emergency bearer services, then
- a GPRS MS operating in MS operation mode A or B shall proceed with appropriate MM specific procedures.
The MM sublayer shall act as in network operation mode II as long as the combined GMM procedures are
not successful and no new RA is entered; and
- the MS may subsequently, automatically initiate the GPRS attach procedure.
A GPRS MS operating in MS operation mode A or B in network operation mode I, is IMSI detached for both
GPRS and CS services in the network.
The MS shall enter the state GMM-DEREGISTERED.NORMAL-SERVICE. If the rejected request was not for
initiating a PDN connection for emergency bearer services, the MS shall then perform a new attach procedure.
The MS should also activate PDP context(s) that were originally activated by the MS to replace any previously
MS activated PDP context(s). The MS should also perform the procedures needed in order to activate any
previously active multicast service(s).
the case when the combined tracking area update procedure is rejected with the EMM cause with the same value.
NOTE 3: In some cases, user interaction may be required and then the MS cannot activate the PDP/MBMS
The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED and the update status to U3
ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and enter the state GMM-
DEREGISTERED. Furthermore, the MS shall delete any P-TMSI, P-TMSI signature, TMSI, RAI, LAI,
ciphering key sequence number GPRS ciphering key sequence number, shall delete the list of equivalent
PLMNs, and shall reset the routing area updating attempt counter and the location update attempt counter.
The MS shall then perform a PLMN selection according to 3GPP TS 23.122 [14].
ETSI
Release 18 227 3GPP TS 24.008 V18.4.0 (2023-09)
3GPP TS 24.301 [120] for the case when the combined tracking area update procedure is rejected with the EMM
cause with the same value.
the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2),
shall reset the routing area updating attempt counter and shall change to state GMM-
The MS shall in addition set the update status to U3 ROAMING NOT ALLOWED, shall delete any TMSI, LAI
and ciphering key sequence number and shall reset the location update attempt counter. The new MM state is
MM IDLE.
The MS shall perform a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].
clause 4.1.3.2), and shall delete the list of equivalent PLMNs. The MS shall reset the routing area updating
attempt counter, and shall enter the state GMM-REGISTERED.LIMITED-SERVICE.
The MS shall in addition set the update status to U3 ROAMING NOT ALLOWED and shall reset the location
update attempt counter. The new MM state is MM IDLE.
The MS shall indicate the Update type IE "combined RA/LA updating with IMSI attach" when performing the
routing area updating procedure following the PLMN selection.
tracking area updating attempt counter as specified in 3GPP TS 24.301 [120] for the case when the combined
subclause 4.1.3.2), shall reset the routing area updating attempt counter and shall change to state GMM-
DEREGISTERED.
ETSI
Release 18 228 3GPP TS 24.008 V18.4.0 (2023-09)
timer T3245 and proceed as described subclause 4.1.1.6. If the message has been successfully integrity checked
by the lower layers and the MS maintains a PLMN-specific PS-attempt counter for that PLMN, then the MS
shall set this counter to the MS implementation-specific maximum value.
As an implementation option, a GPRS MS operating in operation mode A or B may perform a PLMN selection
is:
- On the "User Controlled PLMN Selector with Access Technology " or,
- On the "Operator Controlled PLMN Selector with Access Technology " list or,
clause 4.1.3.2), shall reset the routing area updating attempt counter and shall change to state GMM-
The MS shall in addition set the update status to U3 ROAMING NOT ALLOWED and shall reset the location
update attempt counter. The new MM state is MM IDLE.
The MS shall search for a suitable cell in another location area according to 3GPP TS 43.022 [82] and
3GPP TS 25.304 [98].
The MS shall indicate the Update type IE "combined RA/LA updating with IMSI attach" when performing the
#22 (Congestion);
If the T3346 value IE is present in the ROUTING AREA UPDATE REJECT message and the value indicates
that this timer is neither zero nor deactivated, the MS shall proceed as described below, otherwise it shall be
considered as an abnormal case and the behaviour of the MS for this case is specified in subclause 4.7.5.2.5.
The MS shall abort the routing area updating procedure, reset the routing area updating attempt counter and set
the GPRS update status to GU2 NOT UPDATED. If the rejected request was not for initiating a PDN connection
for emergency bearer services, the MS shall change to state GMM-REGISTERED.ATTEMPTING-TO-
UPDATE.
ETSI
Release 18 229 3GPP TS 24.008 V18.4.0 (2023-09)
If the ROUTING AREA UPDATE REJECT message is integrity protected, the MS shall start timer with the
value provided in the T3346 value IE.
If the ROUTING AREA UPDATE REJECT message is not integrity protected, the ME shall start timer T3346
with a random value from the default range specified in table 11.3a.
The MS stays in the current serving cell and applies the normal cell reselection process. The routing area
updating procedure is started, if still necessary, when timer T3346 expires or is stopped.
#25 (Not authorized for this CSG)
subclause 4.1.3.2) and shall reset the routing area updating attempt counter. The state is changed to GMM-
REQUEST message are contained in the Operator CSG list, the MS shall proceed as specified in
If the MS is IMSI attached, the MS shall set the update status to U3 ROAMING NOT ALLOWED and shall

The MS shall proceed as follows:
1) If the combined routing area update was successful for GPRS services only and the ROUTING AREA UPDATE
ACCEPT message contained a cause value not treated in subclause 4.7.5.2.3.2 or the GMM Cause IE is not
included in the message, the MS shall proceed as follows:
a) The MS shall stop timer T3330 if still running, and shall enter state MM IDLE. The routing area updating
attempt counter shall be incremented;
b) If the routing area updating attempt counter is less than 5, and the stored RAI is equal to the RAI of the
attach" is triggered again; and
ETSI
Release 18 230 3GPP TS 24.008 V18.4.0 (2023-09)
c) If the routing area updating attempt counter is greater than or equal to 5:
UPDATE-MM; and
specific procedures. The MM sublayer shall act as in network operation mode II or as long as the
combined GMM procedures are not successful and no new RA is entered;
2) Combined routing area updating and paging for non-GPRS services procedure collision
If the MS receives a paging for non-GPRS services before the routing area updating procedure has been
completed, the MS shall progress the routing area updating procedure and respond to the paging for non-GPRS
services when the MS has completed the routing area updating procedure or aborted the procedure for other
reasons. The MS shall return to MM state MM IDLE and proceed with the appropriate MM specific procedures
to respond to the paging for non-GPRS services; and
3) otherwise, the abnormal cases specified in subclause 4.7.5.1.5 apply with the following modification.
If the GPRS routing area updating attempt counter is incremented according to subclause 4.7.5.1.5 the next actions
depend on the Location Area Identities (stored on SIM/USIM and the one of the current serving cell) and the value of
the routing area updating attempt counter.
- if the update status is U1 UPDATED, and the stored LAI is equal to the one of the current serving cell and the
routing area updating attempt counter is smaller than 5, then the mobile station shall keep the update status to U1
UPDATED, the new MM state is MM IDLE substate NORMAL SERVICE;
- if the routing area updating attempt counter is smaller than 5 and, additionally, the update status is different from
U1 UPDATED or the stored LAI is different from the one of the current serving cell, the mobile station shall
delete any LAI, TMSI, ciphering key sequence number stored in the SIM/USIM and list of equivalent PLMNs
and set the update status to U2 NOT UPDATED. The MM state remains MM LOCATION UPDATING
PENDING; or
- if the routing area updating attempt counter is greater or equal to 5, the mobile station shall delete any LAI,
TMSI, ciphering key sequence number stored in the SIM/USIM and the list of equivalent PLMNs, and shall set
the update status to U2 NOT UPDATED.
A GPRS MS operating in MS operation mode A shall then proceed with appropriate MM specific procedure; a
GPRS MS operating in MS operation mode B may then proceed with appropriate MM specific procedures.
The MM sublayer shall act as in network operation mode II as long as the combined GMM procedures are not
successful and no new RA is entered. The new MM state is MM IDLE substate ATTEMPTING TO UPDATE or
optionally MM IDLE substate PLMN SEARCH in order to perform a PLMN selection according to
3GPP TS 23.122 [14].

The abnormal cases specified in subclause 4.7.5.1.6 apply.
4.7.6 P-TMSI reallocation procedure
4.7.6.0 General
A temporary mobile station identity for GPRS services, the Packet-TMSI (P-TMSI), is used for identification within the
radio interface signalling procedures. The structure of the P-TMSI is specified in 3GPP TS 23.003 [10]. The P-TMSI
has significance only within a routing area. Outside the routing area the P-TMSI has to be combined with the routing
area identification (RAI) to provide for an unambiguous identity.
The purpose of the P-TMSI reallocation procedure is to provide identity confidentiality, i.e. to protect a user against
being identified and located by an intruder (see 3GPP TS 43.020 [13], 3GPP TS 23.060 [74] and 3GPP TS 33.102 [5a]).
Usually, P-TMSI reallocation is performed at least at each change of a routing area (Such choices are left to the network
operator).
ETSI
Release 18 231 3GPP TS 24.008 V18.4.0 (2023-09)
The reallocation of a P-TMSI is performed by the unique procedure defined in subclause 4.7.6. This procedure can only
be initiated by the network in state GMM-REGISTERED.
P-TMSI can also be implicitly reallocated in the attach or routing area updating procedures (see subclauses 4.7.3.1 and
4.7.5). The implicit reallocation of a P-TMSI is described in the corresponding subclauses.
NOTE: Normally, the P-TMSI reallocation will take place in conjunction with another GMM procedure, e.g. at
routing area updating (see 3GPP TS 29.002 [37]).
4.7.6.1 P-TMSI reallocation initiation by the network

The network shall initiate the P-TMSI reallocation procedure by sending a P-TMSI REALLOCATION COMMAND
message to the MS and shall start the timer T3350.
The P-TMSI REALLOCATION COMMAND message shall contain a new combination of P-TMSI, RAI and
optionally a P-TMSI signature or a DCN-ID or both allocated by the network.
The network may suspend the transmission of user data during the P-TMSI reallocation procedure.
4.7.6.2 P-TMSI reallocation completion by the MS

Upon receipt of the P-TMSI REALLOCATION COMMAND message, the MS shall store the routing area identifier
(RAI) and the P-TMSI. Furthermore, the MS shall send a P-TMSI REALLOCATION COMPLETE message to the
network.
If a P-TMSI signature is present in the P-TMSI REALLOCATION COMMAND message, the MS shall store the new
P-TMSI signature and shall if available delete the old P-TMSI signature. If no P-TMSI signature is present in the P-
TMSI REALLOCATION COMMAND message, the old P-TMSI signature, if available, shall be kept.
If the P-TMSI REALLOCATION COMMAND message contains the DCN-ID IE, then the MS shall store the included
DCN-ID value together with the PLMN code of the registered PLMN in a DCN-ID list in a non-volatile memory in the
4.7.6.3 P-TMSI reallocation completion by the network

Upon receipt of the P-TMSI REALLOCATION COMPLETE message, the network shall stop the timer T3350 and
shall consider both the old and the new P-TMSI and the corresponding P-TMSI signatures as valid until the old P-TMSI
can be considered as invalid by the network (see subclause 4.7.1.5).
In A/Gb mode, the GMM layer shall notify the LLC layer that the P-TMSI has been changed (see
3GPP TS 44.064 [78a]).
4.7.6.3A Abnormal cases in the MS

If different new P-TMSIs are included in subsequent P-TMSI REALLOCATION COMMAND messages due to
an aborted or repeated P-TMSI reallocation procedure, the MS shall behave as described in subclause 4.7.6.2.
Furthermore, the MS shall take action on the P-TMSI as described in subclause 4.7.1.5.

If a lower layer failure is detected before the P-TMSI REALLOCATION COMPLETE message is received, the
network shall consider both the old and the new P-TMSI as occupied until the old P-TMSI can be considered as
invalid (see subclause 4.7.1.5).
During this period the network:
ETSI
Release 18 232 3GPP TS 24.008 V18.4.0 (2023-09)
- may first use the old P-TMSI for paging for an implementation dependent number of paging attempts in the
case of network-originated transactions. Upon response from the MS, the network may re-initiate the P-
TMSI reallocation procedure. If no response is received to the paging attempts, the network may use the new
P-TMSI for paging for an implementation dependent number of paging attempts. Upon response from the
MS, the network shall consider the new P-TMSI as valid and the old P-TMSI as invalid. If no response is
received to the paging attempts, the network may use the IMSI for paging for an implementation dependent
number of paging attempts;
NOTE: Paging with IMSI causes the MS to re-attach as described in subclause 4.7.9.1.
- shall consider the new P-TMSI as valid if it is used by the MS (see subclause 4.7.1.5); or
- may use the identification procedure followed by a new P-TMSI reallocation, if the MS uses the old P-TMSI.
b) Expiry of timer T3350
The P-TMSI reallocation procedure is supervised by the timer T3350 (see example in figure 4.7.6/1). On the first
expiry of timer T3350, the network shall reset and restart timer T3350 and shall retransmit the P-TMSI
REALLOCATION COMMAND message. This retransmission is repeated four times, i.e. on the fifth expiry of
timer T3350, the network shall abort the P-TMSI reallocation procedure and shall follow the rules for case a as
described above.
c) P-TMSI reallocation and GPRS attach procedure collision
If the network receives an ATTACH REQUEST message before the ongoing P-TMSI reallocation procedure has
been completed, the network shall proceed with the GPRS attach procedure after deletion of the GMM context.
d) P-TMSI reallocation and an MS initiated GPRS detach procedure collision
If the network receives a DETACH REQUEST message before the ongoing P-TMSI reallocation procedure has
been completed, the network shall abort the P-TMSI reallocation procedure and shall progress the GPRS detach
procedure.
e) P-TMSI reallocation and a routing area updating procedure collision
If the network receives a ROUTING AREA UPDATE REQUEST message before the ongoing P-TMSI
reallocation procedure has been completed, the network shall abort the P-TMSI reallocation procedure and shall
progress the routing area updating procedure. The network may then perform a new P-TMSI reallocation.
f) P-TMSI reallocation and a service request procedure collision
If the network receives a SERVICE REQUEST message before the ongoing P-TMSI reallocation procedure
procedure has been completed, the network shall progress both procedures.
MS Network
P-TMSI REALLOCATION COMMAND
Start T3350
P-TMSI REALLOCATION COMPLETE
Stop T3350
Figure 4.7.6/1 3GPP TS 24.008: P-TMSI reallocation procedure
4.7.7 Authentication and ciphering procedure
4.7.7a Authentication and ciphering procedure used for UMTS authentication

challenge.
The purpose of the authentication and ciphering procedure is fivefold (see 3GPP TS 33.102 [5a] and
3GPP TS 43.020 [13]):
ETSI
Release 18 233 3GPP TS 24.008 V18.4.0 (2023-09)
- to permit the network to check whether the identity provided by the MS is acceptable or not;
- to provide parameters enabling the MS to calculate a new GPRS UMTS ciphering key and a new GPRS UMTS
integrity key;
- to let the network set the GSM ciphering mode (ciphering /no ciphering) and GSM ciphering algorithm;
- to permit the mobile station to authenticate the network; and
- to let the network set GSM integrity protection and GSM integrity algorithm (for control plane and optionally for
user plane).
In Iu mode, and in the case of a UMTS authentication challenge, the authentication and ciphering procedure can be used
for authentication only.
The cases in which the authentication and ciphering procedure shall be used are defined in 3GPP TS 33.102 [5a],
3GPP TS 43.020 [13] and 3GPP TS 42.009 [5].
The authentication and ciphering procedure is always initiated and controlled by the network. However, in the case of a
UMTS authentication challenge, there is the possibility for the MS to reject the network.
The MS shall support the UMTS authentication challenge, if a USIM is inserted.
The authentication and ciphering procedure can be used for any combination of the following:
- authentication;
- setting of the GSM ciphering mode and the GSM ciphering algorithm; and
- setting of GSM integrity protection and the GSM integrity algorithm (for control plane and optionally for user
plane).
NOTE: Setting of GSM integrity protection and the GSM integrity algorithm in the authentication and ciphering
procedure is only applicable for an MS and a network supporting integrity protection in A/Gb mode.
In A/Gb mode, the network should not send any user data during the authentication and ciphering procedure.
A UMTS security context is established in the MS and the network when a UMTS authentication challenge is
performed in A/Gb mode or in Iu mode. After a successful UMTS authentication, the GPRS UMTS ciphering key, the
GPRS UMTS integrity key, the GPRS GSM ciphering key and the GPRS ciphering key sequence number, are stored
both in the network and the MS. Furthermore, in A/Gb mode both the ME and the network may derive and store a
GPRS GSM Kc128 as part of the UMTS security context as described in the subclause 4.7.7.3a. Furthermore, in A/Gb
mode, if integrity protection is used, both the MS and the network shall derive and store a GPRS GSM Kint as part of
the UMTS security context as described in the subclause 4.7.7.3b.
4.7.7b Authentication and ciphering procedure used for GSM authentication

challenge
The purpose of the authentication and ciphering procedure is threefold (see 3GPP TS 43.020 [13]):
- to permit the network to check whether the identity provided by the MS is acceptable or not;
- to provide parameters enabling the MS to calculate a new GPRS GSM ciphering key; and
- to let the network set the GSM ciphering mode (ciphering/no ciphering) and GSM ciphering algorithm.
The authentication and ciphering procedure can be used for either:
- authentication only;
- setting of the GSM ciphering mode and the GSM ciphering algorithm only; or
- authentication and the setting of the GSM ciphering mode and the GSM ciphering algorithm.
The cases in which the authentication and ciphering procedure shall be used are defined in 3GPP TS 42.009 [5].
ETSI
Release 18 234 3GPP TS 24.008 V18.4.0 (2023-09)
In A/Gb mode, the authentication and ciphering procedure is always initiated and controlled by the network. It shall be
performed in a non ciphered mode because of the following reasons:
- the network cannot decipher a ciphered AUTHENTICATION_AND_CIPHERING RESPONSE from an

unauthorised MS and put it on the prohibited list; and
- to be able to define a specific point in time from which on a new GPRS GSM ciphering key should be used
instead of the old one.
GSM authentication challenge shall be supported by a ME supporting GERAN or UTRAN.
In A/Gb mode, the network should not send any user data during the authentication and ciphering procedure.
A GSM security context is established in the MS and the network when a GSM authentication challenge is performed in
A/Gb mode or in Iu mode. However, in Iu mode the MS shall not accept a GSM authentication challenge, if a USIM is
inserted. After a successful GSM authentication challenge, the GPRS GSM ciphering key and the GPRS ciphering key
sequence number, are stored both in the network and the MS.
4.7.7c Change of the ciphering algorithm at PS Handover

For PS handover to A/Gb mode (see subclause 10.5.1.14 and 3GPP TS 44.060 [76]) the network shall either assign a
GSM ciphering algorithm to be used in the target cell or deactivate ciphering in the target cell. The MS shall start to use
the new GSM ciphering algorithm or deactivate ciphering upon an indication from the lower layers that the PS
handover procedure has been successfully completed (see 3GPP TS 44.060 [76])
After PS handover to Iu mode (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]) the network shall activate
integrity protection and shall either assign a ciphering algorithm to be used in the target cell or deactivate ciphering in
the target cell, using the security mode control procedure (3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
If the GSM ciphering algorithm is changed at PS handover and the routing area updating procedure triggered by the PS
handover procedure is not accepted by the network, the MS shall delete any GPRS ciphering key sequence number and
proceed as specified in subclauses 4.7.5.1.4 and 4.7.5.2.4. If the routing area updating procedure fails, because the radio
resources assigned in the new cell are released before the MS receives a ROUTING AREA UPDATE ACCEPT
message, the MS shall delete any GPRS ciphering key sequence number and proceed as specified in
subclauses 4.7.5.1.5 item b and 4.7.5.2.5, respectively.
4.7.7.1 Authentication and ciphering initiation by the network

The network initiates the authentication and ciphering procedure by transferring an
AUTHENTICATION_AND_CIPHERING REQUEST message across the radio interface and starts timer T3360. The
AUTHENTICATION_AND_CIPHERING REQUEST message shall contain all parameters necessary to calculate the
response parameters when authentication is performed (see 3GPP TS 43.020 [13] and 3GPP TS 33.102 [5a]).
If authentication is requested, then the AUTHENTICATION_AND_CIPHERING REQUEST message shall contain

either:
- In a GSM authentication challenge, the GPRS ciphering key sequence number and the RAND, or
- In a UMTS authentication challenge, the GPRS ciphering key sequence number, the RAND and the AUTN.
In A/Gb mode, if authentication is not requested, then the AUTHENTICATION_AND_CIPHERING REQUEST

message shall not contain neither the GPRS ciphering key sequence number, the RAND nor the AUTN.
In A/Gb mode, if ciphering is requested, in a GSM authentication challenge or in a UMTS authentication challenge,
then the AUTHENTICATION_AND_CIPHERING REQUEST message shall indicate the GPRS GSM ciphering
algorithm.
In A/Gb mode, an MS supporting integrity protection shall ignore a GSM authentication challenge from the network.
In A/Gb mode, in a UMTS authentication challenge, if the MS has indicated support for integrity protection in MS
network capability IE included in the ATTACH REQUEST or ROUTING AREA UPDATE REQUEST message to the
network, then if the network supports integrity protection then the network shall activate integrity protection in the MS
(see subclause 4.7.3.1.3 and subclause 4.7.5.1.3). If the network does not activate integrity protection in the MS, then
the MS shall detach from the network.
ETSI
Release 18 235 3GPP TS 24.008 V18.4.0 (2023-09)
In A/Gb mode, if no UMTS security context is available in the network or if no common UMTS security context is
available in the MS and the network, and if the MS has indicated support for integrity protection in MS network
capability IE to the network, then an authentication and activation of integrity protection and setting of ciphering mode
(enabled or disabled), shall take place in the same authentication and ciphering procedure. The network shall replay the
MS network capability IE and the MS radio access capability IE received from the MS in the latest ATTACH
REQUEST message or the latest ROUTING AREA UPDATE REQUEST message, by including the MS network
capability IE and the MS radio access capability IE in the AUTHENTICATION AND CIPHERING REQUEST
message to the MS. The network shall select one of the GPRS GSM integrity algorithms indicated in the MS network
capability IE received from the MS in the latest ATTACH REQUEST message or ROUTING AREA UPDATE
REQUEST message. The selected GPRS GSM integrity algorithm shall be included in the AUTHENTICATION AND
CIPHERING REQUEST message. The network shall enable or disable ciphering and include the selected GPRS GSM
ciphering algorithm if ciphering is enabled. If ciphering is enabled, then the network shall select one of the GPRS GSM
ciphering algorithm indicated in the MS network capability IE received from the MS in the latest ATTACH REQUEST
message or ROUTING AREA UPDATE REQUEST message.The network shall calculate a message authentication
code for the AUTHENTICATION AND CIPHERING REQUEST message at the GMM layer with the new integrity
key, GPRS GSM Kint key, indicated by the GPRS ciphering key sequence number included in the
AUTHENTICATION AND CIPHERING REQUEST message. The new GPRS GSM Kint shall be calculated from the
new UMTS security context established in the same procedure as described in the subclause 4.7.7.3b. The
AUTHENTICATION AND CIPHERING REQUEST message shall include the calculated message authentication code
for integrity protection.
In A/Gb mode, if an established UMTS security context is available in the network and if the MS has indicated support
for integrity protection in the MS network capability IE, when authentication takes place in the authentication and
ciphering procedure (regardless whether a change of the integrity algorithm, ciphering algorithm or a change of
ciphering mode takes place in the same procedure), then the network shall replay the MS network capability IE and the
MS Radio Access Capability IE received from the MS in the latest ATTACH REQUEST message or the latest
ROUTING AREA UPDATE REQUEST message, by including the MS network capability IE and the MS Radio
Access Capability IE into the AUTHENTICATION AND CIPHERING REQUEST message to the MS. If a change of
the GPRS GSM integrity algorithm takes place in the same procedure, then the network shall select one of the GPRS
GSMintegrity algorithms indicated in the MS network capability IE received from the MS in the latest ATTACH
REQUEST message or ROUTING AREA UPDATE REQUEST message. The selected GPRS GSM integrity algorithm
shall be included into the AUTHENTICATION AND CIPHERING REQUEST message. If the network decides to
change the ciphering mode or the ciphering algorithm or both, then if ciphering is enabled the network shall select one
of the GPRS GSM ciphering algorithms indicated in the MS network capability IE received from the MS in the latest
ATTACH REQUEST message or ROUTING AREA UPDATE REQUEST message. The network shall also include the
ciphering mode or the selected GPRS GSM ciphering algorithm or both, if ciphering is enabled (Ciphering algorithm
IE) in the AUTHENTICATION AND CIPHERING REQUEST message. The network calculates a message
authentication code over the parameters included in the AUTHENTICATION AND CIPHERING REQUEST message
at the GMM layer with the new integrity key GPRS GSM Kint indicated by the GPRS ciphering key sequence number
included by the AUTHENTICATION AND CIPHERING REQUEST message. The new GPRS GSM Kint shall be
calculated from the new UMTS security context established in the same procedure as described in the
subclause 4.7.7.3b. The AUTHENTICATION AND CIPHERING REQUEST message shall include the calculated
message authentication code for integrity protection.
In A/Gb mode, if an established UMTS security context context is available in the network and if the MS has indicated
support for integrity protection in the MS network capability IE to the network, and if integrity protection is in use, then
if only a change of the integrity algorithm or ciphering algorithm or both, or a change of the ciphering mode, is
requested in the authentication and ciphering procedure, then the AUTHENTICATION AND CIPHERING REQUEST
message shall include the new GPRS GSM integrity algorithm or the new setting of the ciphering mode and the new
GPRS GSM ciphering algorithm; that shall be taken into use.
NOTE: The AUTHENTICATION AND CIPHERING REQUEST message is protected by a message

authentication code in the LLC layer when no authentication takes place in the authentication and
ciphering procedure.Therefore, no message authentication code shall be calculated and included by the
GMM layer into this message when only an algorithm change takes place. In addition, there is no need to
replay the MS network capability IE and the MS Radio Access Capability IE in the AUTHENTICATION
AND CIPHERING REQUEST message when no authentication takes place as a valid UMTS security
context is already established between the MS and network.
The network includes the A&C reference number information element in the AUTHENTICATION AND CIPHERING
REQUEST message. Its value is chosen in order to link an AUTHENTICATION AND CIPHERING REQUEST in a
RA with its RESPONSE. The A&C reference number value might be based on the RA Colour Code value.
ETSI
Release 18 236 3GPP TS 24.008 V18.4.0 (2023-09)
Additionally, the network may request the MS to include its IMEISV in the AUTHENTICATION AND CIPHERING
RESPONSE message.
4.7.7.2 Authentication and ciphering response by the MS

In A/Gb mode, an MS shall be ready to respond upon an AUTHENTICATION_AND_CIPHERING REQUEST
message at any time.
In UMTS, an MS shall be ready to respond upon an AUTHENTICATION_AND_CIPHERING REQUEST message at

any time whilst a PS signalling connection exists.
If a SIM is inserted in the MS, the MS shall ignore the Authentication Parameter AUTN IE if included in the
AUTHENTICATION_AND_CIPHERING REQUEST message and perform the GSM authentication challenge. It shall
not perform the authentication of the network described in subclause 4.7.7.5.1.
In a GSM authentication challenge, if the AUTHENTICATION_AND_CIPHERING REQUEST message includes the

authentication parameters RAND and GPRS CKSN, then upon receipt of the message, the MS processes the challenge
information and sends an AUTHENTICATION_AND_CIPHERING RESPONSE message to the network. The value of
the received A&C reference number information element shall be copied into the A&C reference number information
element in the AUTHENTICATION_AND_CIPHERING RESPONSE message. A GSM authentication challenge will
result in the SIM/USIM passing a SRES and a GPRS GSM ciphering key to the ME. The new GPRS GSM ciphering
key calculated from the challenge information shall overwrite the previous one and any previously stored GPRS UMTS
ciphering and GPRS UMTS integrity keys shall be deleted. The calculated GSM ciphering key shall be stored on the
SIM/USIM together with the GPRS ciphering key sequence number before the
AUTHENTICATION_AND_CIPHERING RESPONSE message is transmitted.
In a UMTS authentication challenge, if the AUTHENTICATION_AND_CIPHERING REQUEST message includes the

UMTS authentication parameters GPRS CKSN, RAND and AUTN, then upon receipt of the message, the MS verifies
the AUTN parameter and if this is accepted, the MS processes the challenge information and sends an
AUTHENTICATION_AND_CIPHERING RESPONSE message to the network. The value of the received A&C
reference number information element shall be copied into the A&C reference number information element in the
AUTHENTICATION_AND_CIPHERING RESPONSE message. A UMTS authentication challenge will result in the
USIM passing a RES, a GPRS UMTS ciphering key, a GPRS UMTS integrity key and a GPRS GSM ciphering key to
the ME. The new GPRS UMTS ciphering key, GPRS UMTS integrity key and GPRS GSM ciphering key calculated
from the challenge information shall overwrite the previous ones. The new GPRS UMTS ciphering key, GPRS UMTS
integrity key and GPRS GSM ciphering key shall be stored on the USIM together with the GPRS ciphering key
sequence number before the AUTHENTICATION_AND_CIPHERING RESPONSE message is transmitted.
Furthermore, in A/Gb mode if a GEA ciphering algorithm that requires a 128-bit ciphering key is taken into use, then a
new GPRS GSM Kc128 shall also be calculated as described in the subclause 4.7.7.3a.
In A/Gb mode, in a UMTS authentication challenge, if the MS supports integrity protection, then the MS shall ignore
the GPRS GSM ciphering key received from the USIM and not store the GPRS GSM ciphering key in the ME or on the
USIM.
In addition, in A/Gb mode, in a UMTS authentication challenge, if the MS has indicated support of integrity protection
in the MS network capability IE to the network, and if an authentication takes place in the authentication and ciphering
procedure, then a new GPRS GSM Kint shall also be calculated by the MS from the new UMTS security context
derived from AKA as described in the subclause 4.7.7.3b. The new GPRS GSM Kint shall be used by the MS to check
and verify the message authentication code recived in the AUTHENTICATION AND CIPHERING REQUEST
message as described in Annex H in 3GPP TS 43.020 [13]. If the integrity is successfully verified in the MS, then the
MS shall check if the replayed MS network capability IE and replayed MS Radio Access Capability IE received in the
AUTHENTICATION AND CIPHERING REQUEST message has not been altered compared to the latest MS network
capability IE and the latest MS Radio Access Capability IE that the MS sent to the network. If the replayed MS network
capability IE and the replayed MS Radio Access Capability IE received in the AUTHENTICATION AND
CIPHERING REQUEST message are not the same as the latest MS network capability IE and the MS Radio Access
Capability IE that the MS sent to the network, then the MS shall ignore the authentication and ciphering procedure. The
network may in addition indicate a GPRS GSM integrity algorithm and a new setting of the ciphering mode and GPRS
GSM ciphering algorithm, to be taken into use by the MS. If the integrity of the AUTHENTICATION AND
CIPHERING REQUEST message is not successfully verified in the GMM layer, then the MS shall ignore the
AUTHENTICATION AND CIPHERING REQUEST message.
In A/Gb mode, in a UMTS authentication challenge if the MS has no available UMTS security context and, if the MS
has indicated support for integrity protection in MS network capability IE to the network, then if the network does not
ETSI
Release 18 237 3GPP TS 24.008 V18.4.0 (2023-09)
activate integrity protection by indicating a GPRS GSMintegrity algorithm or does not include a message authentication
code to the MS in AUTHENTICATION AND CIPHERING REQUEST message, then the MS shall ignore the
AUTHENTICATION AND CIPHERING REQUEST message.
In A/Gb mode, in a UMTS authentication challenge, if the MS has indicated support for integrity protection to the
network and if the integrity of the AUTHENTICATION AND CIPHERING REQUEST message is successfully
verified in the MS and the MS decides to reply by sending an AUTHENTICATION AND CIPHERING RESPONSE
message to the network, then the MS shall integrity protect the AUTHENTICATION AND CIPHERING RESPONSE
message by calculating an message authentication code at the GMM layer using the new integrity key GPRS GSM Kint
calculated by the MS from the new UMTS security context derived from AKA as described in the subclause 4.7.7.3b
and as described in Annex H in 3GPP TS 43.020 [13] and include the new message authentication code into the
AUTHENTICATION AND CIPHERING RESPONSE message. When a successful authentication takes place on the
USIM the GMM layer in the MS shall request the LLC layer to reset the IOV_updates counter to the value zero before
sending the AUTHENTICATION AND CIPHERING RESPONSE message to the network.
In Iu mode, an MS not capable of A/Gb mode shall ignore the Ciphering Algorithm IE in the
AUTHENTICATION_AND_CIPHERING REQUEST message. An MS capable of both Iu mode and A/Gb mode shall
store the received value in the Ciphering Algorithm IE in the AUTHENTICATION_AND_CIPHERING REQUEST
message until entering state GMM-DEREGISTERED, in order to use it at an inter system change to A/Gb mode. In
A/Gb mode, an MS supporting integrity protection shall store the received value in the Ciphering Algorithm IE when
entering GMM-DEREGISTERED and at MS power off as described in subclause 4.7.7.3a.
If the AUTHENTICATION_AND_CIPHERING REQUEST message does not include neither the GSM authentication
parameters (RAND and GPRS CKSN) nor the UMTS authentication parameters (RAND, AUTN and GPRS CKSN),
then upon receipt of the message, the MS replies by sending an AUTHENTICATION_AND_CIPHERING RESPONSE
message to the network.
In A/Gb mode, in the case of an established UMTS security context, if the MS has indicated support for integrity
protection to the network, the network may only indicate a GPRS GSM integrity algorithm or a GPRS GSM ciphering
algorithm or a change of ciphering mode setting in the AUTHENTICATION AND CIPHERING REQUEST message
without re-authentication to the MS. The AUTHENTICATION AND CIPHERING REQUEST message shall include
the new GPRS GSM integrity algorithm or the new GPRS GSM ciphering algorithm; or both, that shall be taken into
use. When the MS receives this AUTHENTICATION AND CIPHERING REQUEST message without requiring a new
authentication, then a new GPRS GSM Kint shall be calculated using the GPRS UMTS ciphering key and the GPRS
UMTS integrity key from the already established UMTS security context stored in the ME as described in the
subclause 4.7.7.3b and a new GPRS GSM Kc128 shall be calculated using the GPRS UMTS ciphering key and the GPRS
UMTS integrity key from the already established UMTS security context stored in the ME as described in the
subclause 4.7.7.3a and the MS replies by sending an AUTHENTICATION AND CIPHERING RESPONSE message to
the network.
NOTE: If only a change of GPRS GSM integrity algorithm or GPRS GSM encryption algorithm or a change of
both algorithms is included in the AUTHENTICATION AND CIPHERING RESPONSE message
without authentication, then the MS shall not integrity protect the AUTHENTICATION AND
CIPHERING RESPONSE message at GMM layer. The MS does therefore not calculate and include a
message authentication code into the AUTHENTICATION AND CIPHERING RESPONSE message at
GMM layer. These GMM messages are instead integrity protected at the LLC layer with current UMTS
security context.
In A/Gb mode, the GMM layer shall notify the LLC layer if ciphering shall be used or not and if yes which GSM
ciphering algorithm and GPRS GSM ciphering key that shall be used (see 3GPP TS 44.064 [78a]).
In A/Gb mode, if an established UMTS security context context is available in the network, if the MS has indicated
support of integrity protection to the network, then the GMM layer in the MS shall assign the GPRS GSM integrity
algorithm and the GPRS GSM Kint integrity key to the LLC layer after it has sent off the AUTHENTICATION AND
CIPHERING RESPONSE message to the network (see 3GPP TS 43.020 [13] and 3GPP TS 44.064 [78a]).
A ME supporting UMTS authentication challenge shall support the following procedure:
ETSI
Release 18 238 3GPP TS 24.008 V18.4.0 (2023-09)
In order to avoid a synchronisation failure, when the mobile station receives an AUTHENTICATION AND
CIPHERING REQUEST message, the mobile station shall store the received RAND together with the RES returned
from the USIM in the volatile memory and associate it with the PS domain. When the MS receives a subsequent
AUTHENTICATION AND CIPHERING REQUEST message, if the stored RAND value for the PS domain is equal to
the new received value in the AUTHENTICATION AND CIPHERING REQUEST message, then the mobile station
shall not pass the RAND to the USIM, but shall immediately send the AUTHENTICATION AND CIPHERING
RESPONSE message with the stored RES for the PS domain. If, for the PS domain, there is no valid stored RAND in
the mobile station or the stored RAND is different from the new received value in the AUTHENTICATION AND
CIPHERING REQUEST message, the mobile station shall pass the RAND to the USIM, shall override any previously
stored RAND and RES with the new ones and start, or reset and restart timer T3316.
The RAND and RES values stored in the mobile station shall be deleted and timer T3316, if running, shall be stopped:
- upon receipt of a SECURITY MODE COMMAND (Iu mode only),

SERVICE ACCEPT (Iu mode only),
SERVICE REJECT (Iu mode only),
ROUTING AREA UPDATE_ACCEPT
or AUTHENTICATION AND CIPHERING REJECT message;
- upon expiry of timer T3316;
- if the mobile station enters the GMM states GMM-DEREGISTERED or GMM-NULL; or
- if the mobile station enters PMM-IDLE mode (Iu mode only).
4.7.7.3 Authentication and ciphering completion by the network

Upon receipt of the AUTHENTICATION AND CIPHERING RESPONSE message, the network stops the timer T3360
and checks the validity of the response (see 3GPP TS 43.020 [13] and 3GPP TS 33.102 [5a]). For this, it may use the
A&C reference number information element within the AUTHENTICATION AND CIPHERING RESPONSE message
to determine whether the response is correlating to the last request that was sent.
In A/Gb mode, in a UMTS authentication challenge if the MS has indicated support of integrity protection to the
network and if the AUTHENTICATION AND CIPHERING REQUEST message authentication, then the network shall
check and verify the message authentication code received in the AUTHENTICATION AND CIPHERING
RESPONSE message from the MS by using the new integrity key GPRS GSM Kint derived from the new UMTS
security context as described in subclause 4.7.7.3b and annex H in 3GPP TS 43.020 [13]. When a successful
authentication takes place after a successful verification of the RES and the message authentication code received in the
AUTHENTICATION AND CIPHERING RESPONSE message from the MS, the GMM layer in the network shall
indicate this successful authentication to the LLC layer. If the check and verification of the message authentication code
included in the AUTHENTICATION AND CIPHERING RESPONSE message fails in the network, then the network
shall ignore the GMM message. If the AUTHENTICATION AND CIPHERING RESPONSE message is received in
the network without a message authentication code then the network shall silently discard the GMM message.
In A/Gb mode, in the case of an established GSM security context, the GMM layer shall notify the LLC sublayer if
ciphering shall be used or not. Furthermore, if ciphering shall be used, then the GMM layer shall also notify the LLC
sublayer which GEA algorithm and GPRS GSM ciphering key that shall be used (see 3GPP TS 44.064 [78a]).
In A/Gb mode, in the case of an established UMTS security context, the GMM layer shall notify the LLC sublayer if
ciphering shall be used or not. Furthermore, if ciphering shall be used, then the GMM layer shall also notify the LLC
sublayer which GEA algorithm and which ciphering key (i.e. GPRS GSM ciphering key or GPRS GSM Kc 128) that shall
be used (see 3GPP TS 44.064 [78a]). If the network has selected a GEA ciphering algorithm that requires a 128-bit
ciphering key, then the ME shall derive a GPRS GSM Kc128 as described in the subclause 4.7.7.3a.
In A/Gb mode, if an established UMTS security context context is available in the network, if the MS has indicated
support of integrity protection to the network, the GMM layer in the network shall assign the GPRS GSM integrity
algorithm and the GPRS GSM Kint integrity key to the LLC layer, after it has received the AUTHENTICATION AND
CIPHERING RESPONSE message from the MS (see 3GPP TS 43.020 [13] and 3GPP TS 44.064[78a]).
Upon receipt of the AUTHENTICATION AND CIPHERING FAILURE message, the network stops the timer T3360.
In Synch failure case, the core network may renegotiate with the HLR/AuC and provide the MS with new
authentication parameters.
ETSI
Release 18 239 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.7.3a 128-bit packet-switched GSM ciphering key

The ME and the network may derive and store a 128-bit packet-switched GSM key or GPRS GSM Kc 128 from an
established UMTS security context. If the GPRS GSM Kc128 exits, then it is also part of the UMTS security context.
The ME with a USIM in use shall compute a new GPRS GSM Kc128 using the GPRS UMTS ciphering key and the
GPRS UMTS integrity key from an established UMTS security context as specified in 3GPP TS 33.102 [5a]. The new
GPRS GSM Kc128 shall be stored only in the ME. The ME shall overwrite the existing GPRS GSM Kc128 with the new
GPRS GSM Kc128. The ME shall delete the GPRS GSM Kc128 at switch off, when the USIM is disabled as well as under
the conditions identified in the subclause 4.1.3.2 and 4.7.7.4. The ME with a USIM in use shall apply the GPRS GSM
Kc128 when in A/Gb mode a GEA ciphering algorithm that requires a 128-bit ciphering key is taken into use.
The network shall compute the GPRS GSM Kc128 using the GPRS UMTS integrity key and the GPRS UMTS ciphering
key from an established UMTS security context as specified in 3GPP TS 33.102 [5a] only when in A/Gb mode a GEA
ciphering algorithm that requires a 128-bit ciphering key is to be used.
In A/Gb mode, if the MS supports integrity protection, the information in the Ciphering Algorithm IE together with the
IMSI from the USIM shall be stored in a non-volatile memory in the ME at MS power off. The information stored in
the Ciphering Algorithm IE can only be used if the IMSI from the USIM matches the IMSI stored in the ME non-
volatile memory at MS power on; otherwise the MS shall delete the Ciphering Algorithm IE.
4.7.7.3b 128-bit packet-switched GSM integrity key (in A/Gb mode and only if MS
supports integrity protection)
The ME and the network may derive and store a 128-bit packet-switched GPRS GSM Kint from an established UMTS
security context. If the GPRS GSM Kint exits, then it is also part of the UMTS security context.
The ME with a USIM in use shall compute a new GPRS GSM Kint using the GPRS UMTS ciphering key and the
GPRS UMTS integrity key from an established UMTS security context as specified in 3GPP TS 43.020 [13]. The new
GPRS GSM Kint shall be stored only in the ME. The ME shall overwrite the existing GPRS GSM Kint with the new
GPRS GSM Kint. The ME shall delete the GPRS GSM Kint at MS switch off, when the USIM is disabled as well as
under the conditions identified in the subclause 4.1.3.2 and 4.7.7.4. The ME with a USIM in use shall apply the GPRS
GSM Kint when in A/Gb mode a GIA integrityg algorithm that requires a 128-bit integrity key is taken into use.
The network shall compute the GPRS GSM Kint using the GPRS UMTS integrity key and the GPRS UMTS ciphering
key from an established UMTS security context as specified in 3GPP TS 43.020 [13]only when in A/Gb mode a GIA
integrity algorithm that requires a 128-bit integrity key is to be used.
At MS power off, the information in the Integrity Algorithm IE shall be stored in a non-volatile memory in the ME
together with the IMSI from the USIM. The information stored in the Integrity Algorithm IE can only be used if the
IMSI from the USIM matches the IMSI stored in the ME non-volatile memory at MS power on; otherwise the MS shall
delete the Integrity Algorithm IE.
4.7.7.4 GPRS ciphering key sequence number

The security parameters for authentication and ciphering are tied together in sets.
In a GSM authentication challenge, from a challenge parameter RAND both the authentication response parameter
SRES and the GPRS GSM ciphering key can be computed given the secret key associated to the IMSI.
In a UMTS authentication challenge, from a challenge parameter RAND, the authentication response parameter RES
and the GPRS UMTS ciphering key and the GPRS UMTS integrity key can be computed given the secret key
associated to the IMSI. Furthermore, in the USIM a GPRS GSM ciphering key can be computed from the GPRS UMTS
integrity key and the GPRS UMTS ciphering key by means of an unkeyed conversion function. Furthermore, in A/Gb
mode if a GEA ciphering algorithm that requires a 128-bit ciphering key is taken into use, then a GPRS GSM Kc 128
shall also be calculated as described in the subclause 4.7.7.3a. Furthermore, in A/Gb mode, if the MS and the network
support integrity protection, when a GIA integrity algorithm that requires a 128-bit integrity key is taken into use, then a
GPRS GSM Kint shall also be calculated as described in the subclause 4.7.7.3b.
In order to allow start of ciphering on a logical link without authentication, GPRS ciphering key sequence numbers are
introduced.
ETSI
Release 18 240 3GPP TS 24.008 V18.4.0 (2023-09)
The GPRS ciphering key sequence number is managed by the network such that the AUTHENTICATION
AND CIPHERING REQUEST message contains the GPRS ciphering key sequence number allocated to the GPRS
GSM ciphering key (in case of a GSM authentication challenge) or the GPRS UMTS ciphering key and the GPRS
UMTS integrity key (in case of a UMTS authentication challenge) which may be computed from the RAND parameter
carried in that message.
If an authentication and ciphering procedure has been completed successfully and a GPRS ciphering key sequence
number is stored in the network, the network shall include a different GPRS ciphering key sequence number in the
AUTHENTICATION AND CIPHERING REQUEST message when it intiates a new authentication and ciphering
procedure.
If a GPRS ciphering key sequence number is contained in the first message during a GMM procedure, the network shall
include a different GPRS ciphering key sequence number in the AUTHENTICATION_AND_CIPHERING REQUEST
message when it initiates an authentication and ciphering procedure.
The MS stores the GPRS ciphering key sequence number with the GPRS GSM ciphering key (in case of a GSM
authentication challenge) and the GPRS UMTS ciphering key and the GPRS UMTS integrity key (in case of a UMTS
authentication challenge), and includes the corresponding GPRS ciphering key sequence number in the ROUTING
AREA UPDATE REQUEST, SERVICE REQUEST and ATTACH REQUEST messages.
If the GPRS ciphering key sequence number is deleted, the associated GPRS GSM ciphering key, GPRS UMTS
ciphering key, GPRS UMTS integrity key, GPRS GSM Kc128 and GPRS GSM Kint shall be deleted if any (i.e. the
established GSM security context or the UMTS security context is no longer valid).
In Iu mode, the network may choose to start ciphering and integrity checking with the stored GPRS UMTS ciphering
key and the stored GPRS UMTS integrity key (under the restrictions given in 3GPP TS 42.009 [5] and
3GPP TS 33.102 [5a]) if the stored GPRS ciphering key sequence number and the one given from the MS are equal.
In A/Gb mode, the network may choose to start ciphering with the stored GPRS GSM ciphering key or GPRS GSM
Kc128 (under the restrictions given in 3GPP TS 42.009 [5]) if the stored GPRS ciphering key sequence number and the
one given from the MS are equal and the previously negotiated ciphering algorithm is known and supported in the
network. When ciphering is requested at GPRS attach, the authentication and ciphering procedure shall be performed
since the MS does not store the ciphering algorithm after entering state GMM-DEREGISTERED.
NOTE 1: The decision of starting ciphering with the GPRS GSM ciphering key or the GPRS GSM Kc128 depends
on whether the network indicates in the AUTHENTICATION AND CIPHERING REQUEST message a
GEA ciphering algorithm which requires a 64 or 128-bit ciphering key as specified in
3GPP TS 33.102 [5a].
In A/Gb mode, if MS indicates support of integrity protection in the MS network capability IE to the network, if the ME
has a Integrity Algorithm IE and a Ciphering Algorithm IE stored in the ME non-volatile memory at MS power on, then
the GMM layer shall calculate a GPRS GSM Kint key as described in subclause 4.7.7.3b and a GPRS GSM Kc128 key as
described in subclause 4.7.7.3a and indicate to the LLC layer before sending the ATTACH REQUEST message that
LLC layer shall start integrity protection with the indicated GPRS GSM Kint key and the integrity algorithm (indicated
in the stored Integrity Algorithm IE). The GMM layer shall also assign the GPRS GSM Kc128 key and the ciphering
algorithm (indicated in the stored Ciphering Algorithm IE) to the LLC layer. The network shall start integrity protection
in the LLC layer after reception of the ATTACH REQUEST message with the stored GPRS GSM Kint and the integrity
algorithm identified by the stored GPRS GSMintegrity algorithm used when UE was previously attached if the GPRS
GSMintegrity algorithm is known and supported in the network, and if the stored GPRS ciphering key sequence number
and the one given from the MS are equal.
Upon GPRS attach, if ciphering is to be used, an AUTHENTICATION AND CIPHERING REQUEST message shall
be sent to the MS to start ciphering. In A/Gb mode, upon GPRS attach, if the MS and network supports integrity
protection, then the network may choose to start ciphering with the stored GPRS GSM ciphering key or GPRS GSM
Kc128 (under the restrictions given in 3GPP TS 42.009 [5]) if the stored GPRS ciphering key sequence number and the
one given from the MS in the ATTACH REQUEST message or ROUTING AREA UPDATE REQUEST message are
equal and the previously negotiated ciphering algorithm is known and supported in the network, without initiating a
authentication and ciphering procedure.
If the GPRS ciphering key sequence number stored in the network does not match the GPRS ciphering key sequence
number received from the MS in the ATTACH REQUEST message, then the network should authenticate the MS.
ETSI
Release 18 241 3GPP TS 24.008 V18.4.0 (2023-09)
In A/Gb mode, the MS starts ciphering after sending the AUTHENTICATION AND CIPHERING RESPONSE
message. The network starts ciphering when a valid AUTHENTICATION AND CIPHERING RESPONSE is received
from the MS.
In Iu mode, the MS starts ciphering and integrity checking according to the conditions specified in specification
3GPP TS 25.331 [23c].
In A/Gb mode, as an option, the network may decide to continue ciphering without sending an AUTHENTICATION
AND CIPHERING REQUEST message after receiving a ROUTING AREA UPDATE REQUEST message with a valid
GPRS ciphering key sequence number. Both the MS and the network shall use the latest ciphering parameters. The
network starts ciphering when sending the ciphered ROUTING AREA UPDATE ACCEPT message to the MS. The
MS starts ciphering after receiving a valid ciphered ROUTING AREA UPDATE ACCEPT message from the network.
NOTE 2: In some specifications the term KSI (Key Set Identifier) is used instead of the term GPRS ciphering key
sequence number.
4.7.7.5 Authentication not accepted by the network

If the authentication response (RES or SRES) is not valid, the network response depends upon the type of identity used
by the MS in the first message:
- If the P-TMSI has been used, the network may decide to initiate the identification procedure. If the IMSI given
by the MS differs from the one the network had associated with the P-TMSI, the authentication should be
restarted with the correct parameters. If the IMSI provided by the MS is the expected one (i.e. authentication has
really failed), the network should send an AUTHENTICATION AND CIPHERING REJECT message to the
mobile station.
- If the IMSI has been used, or the network decides not to try the identification procedure, an
AUTHENTICATION AND CIPHERING REJECT message should be transferred to the MS.
Upon receipt of an AUTHENTICATION AND CIPHERING REJECT message,
a) if the message has been successfully integrity checked by the lower layers, the MS shall set the GPRS update
status to GU3 ROAMING NOT ALLOWED and shall delete the P-TMSI, P-TMSI signature, RAI and GPRS
ciphering key sequence number stored. If available, also the TMSI, LAI and ciphering key sequence number
shall be deleted and the update status shall be set to U3 ROAMING NOT ALLOWED. The SIM/USIM shall be
considered as invalid until switching off or the SIM/USIM is removed. If the MS maintains a counter for
specific maximum value. If the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS
services", then the MS shall set this counter to MS implementation-specific maximum value.
If S1 mode is supported by the MS, the MS shall in addition handle the EMM parameters EMM state, EPS
update status, last visited registered TAI, TAI list, GUTI and KSIASME as specified in 3GPP TS 24.301 [120] for
the case when an EPS authentication is not accepted by the network.
b) if the message is received without integrity protection, then the MS shall start timer T3247 with a random value
uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running (see
subclause 4.1.1.6A). Additionally, the MS shall:
- if the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter
has a value less than an MS implementation-specific maximum value, proceed as specified in
subclause 4.1.1.6A, list item 6.a) for the case an ATTACH REJECT or ROUTING AREA UPDATE
REJECT message is received without integrity protection; and
- otherwise proceed as specified under list item a) above for the case that the message has been successfully
checked by the lower layers.
List item b) above is also applicable, if the message is received in A/Gb mode.
If the AUTHENTICATION AND CIPHERING REJECT message is received, the MS shall abort any GMM procedure,
shall stop any of the retransmission timers that are running (e.g. T3310, T3317, T3330, T3321, T3318 or T3320 and
shall enter state GMM-DEREGISTERED.
ETSI
Release 18 242 3GPP TS 24.008 V18.4.0 (2023-09)
In UTRAN Iu mode, depending on local regulations or operator preference for emergency bearer services, if the MS has
a PDN connection for emergency bearer services established or is establishing a PDN connection for emergency bearer
services, the SGSN need not follow the procedures specified for the authentication failure in the present subclause, the
SGSN can continue with the ongoing GMM specific procedure or Session Management procedure. Upon completion of
the GMM procedure or Session management procedure, the SGSN shall deactivate all non-emergency PDP contexts, if
any, by initiating a PDP context deactivation procedure. The network shall consider the MS to be attached for
emergency bearer services only.
4.7.7.5.1 Authentication not accepted by the MS

In a UMTS authentication challenge, the authentication procedure is extended to allow the MS to check the authenticity
of the core network. Thus allowing, for instance, detection of false base station.
Following a UMTS authentication challenge, the MS may reject the core network, on the grounds of an incorrect
AUTN parameter (see 3GPP TS 33.102 [5a]). This parameter contains two possible causes for authentication failure:
a) MAC code failure
If the MS considers the MAC code (supplied by the core network in the AUTN parameter) to be invalid, it shall send a
AUTHENTICATION AND CIPHERING FAILURE message to the network, with the GMM cause 'MAC failure'. The
MS shall then follow the procedure described in subclause 4.7.7.6 (f).
b) SQN failure
If the MS considers the SQN (supplied by the core network in the AUTN parameter) to be out of range, it shall
send a AUTHENTICATION AND CIPHERING FAILURE message to the network, with the GMM cause
'Synch failure' and the re-synchronization token AUTS provided by the USIM (see 3GPP TS 33.102 [5a]).
The MS shall then follow the procedure described in subclause 4.7.7.6 (g).
In Iu mode, an MSwith a USIM inserted shall reject the authentication challenge if no Authentication Parameter AUTN
IE was present in the AUTHENTICATION REQUEST message (i.e. a GSM authentication challenge has been received
when the MS expects a UMTS authentication challenge). In such a case, the MS shall send the AUTHENTICATION
AND CIPHERING FAILURE message to the network, with the GMM cause 'GSM authentication unacceptable’. The
MS shall then follow the procedure described in subclause 4.7.7.6 (f).
If the MS returns an AUTHENTICATION_AND_CIPHERING_FAILURE message to the network, the MS shall

delete any previously stored RAND and RES and shall stop timer T3316, if running.
If the MS has a PDN connection for emergency bearer services established or is establishing such a PDN connection,
additional MS requirements are specified in subclause 4.7.7.6, under "for items f and g".

Upon detection of a lower layer failure before the AUTHENTICATION AND CIPHERING RESPONSE
message is received, the network shall abort the procedure.
The network shall, on the first expiry of the timer T3360, retransmit the AUTHENTICATION AND
CIPHERING REQUEST message and shall reset and start timer T3360. This retransmission is repeated four
times, i.e. on the fifth expiry of timer T3360, the procedure shall be aborted.
c) Collision of an authentication and ciphering procedure with a GPRS attach procedure
If the network receives an ATTACH REQUEST message before the ongoing authentication procedure has been
completed and no GPRS attach procedure is pending on the network (i.e. no ATTACH ACCEPT/REJECT
message has to be sent as an answer to an ATTACH REQUEST message), the network shall abort the
authentication and ciphering procedure and proceed with the new GPRS attach procedure.
ETSI
Release 18 243 3GPP TS 24.008 V18.4.0 (2023-09)
d) Collision of an authentication and ciphering procedure with a GPRS attach procedure when the authentication
and ciphering procedure has been caused by a previous GPRS attach procedure
If the network receives an ATTACH REQUEST message before the ongoing authentication procedure has been
completed and a GPRS attach procedure is pending (i.e. an ATTACH ACCEPT/REJECT message has still to be
sent as an answer to an earlier ATTACH REQUEST message), then:
- If one or more of the information elements in the ATTACH REQUEST message differs from the ones
received within the previous ATTACH REQUEST message, the network shall not treat the authentication
any further and proceed with the GPRS attach procedure; or
- If the information elements do not differ, then the network shall not treat any further this new ATTACH
REQUEST message.
d1)Collision of an authentication and ciphering procedure with a GPRS detach procedure
If the network receives a DETACH REQUEST message before the ongoing authentication and ciphering
procedure has been completed, the network shall abort the authentication and ciphering procedure and shall
progress the GPRS detach procedure.
If the network receives a DETACH REQUEST message before the ongoing authentication and ciphering
procedure has been completed, the network shall complete the authentication and ciphering procedure and
shall respond to the GPRS detach procedure as described in subclause 4.7.4.
e) Collision of an authentication and ciphering procedure with a routing area updating procedure
If the network receives a ROUTING AREA UPDATE REQUEST message before the ongoing authentication
MS Network
AUTHENTICATION AND CIPHERING REQUEST
Start T3360
AUTHENTICATION AND CIPHERING RESPONSE
Stop T3360
AUTHENTICATION AND CIPHERING REJECT
Figure 4.7.7/1 3GPP TS 24.008: Authentication and ciphering procedure
(f) Authentication failure (GMM cause #18 "MAC failure" or #21 "GSM authentication unacceptable")
The MS shall send an AUTHENTICATION AND CIPHERING FAILURE message, with GMM cause 'MAC
failure’ or 'GSM authentication unacceptable’ according to subclause 4.7.7.5.1, to the network and start timer
T3318. Furthermore, the MS shall stop any of the retransmission timers that are running (e.g. T3310, T3321,
T3330 or T3317). Upon the first receipt of an AUTHENTICATION AND CIPHERING FAILURE message
from the MS with GMM cause 'MAC failure’ or 'GSM authentication unacceptable’ the network may initiate the
identification procedure described in subclause 4.7.8. This is to allow the network to obtain the IMSI from the
MS. The network may then check that the P-TMSI originally used in the authentication challenge corresponded
to the correct IMSI. Upon receipt of the IDENTITY REQUEST message from the network, the MS shall send
the IDENTITY RESPONSE message.
NOTE: Upon receipt of an AUTHENTICATION AND CIPHERING FAILURE message from the MS with
reject cause "MAC failure" or "GSM authentication unacceptable", the network may also terminate the
authentication procedure (see subclause 4.7.7.5).
ETSI
Release 18 244 3GPP TS 24.008 V18.4.0 (2023-09)
If the P-TMSI/IMSI mapping in the network was incorrect, the network should respond by sending a new
AUTHENTICATION AND CIPHERING REQUEST message to the MS. Upon receiving the new
AUTHENTICATION AND CIPHERING REQUEST message from the network, the MS shall stop timer
T3318, if running, and then process the challenge information as normal. If the P-TMSI/IMSI mapping in the
network was correct, the network should terminate the authentication and ciphering procedure by sending an
AUTHENTICATION AND CIPHERING REJECT message.
If the network is validated successfully (an AUTHENTICATION AND CIPHERING REQUEST message that
contains a valid SQN and MAC is received), the MS shall send the AUTHENTICATION AND CIPHERING
RESPONSE message to the network and shall start any retransmission timers (e.g. T3310, T3321, T3330 or
T3317), if they were running and stopped when the MS received the first failed AUTHENTICATION AND
CIPHERING REQUEST message.
If the MS receives the second AUTHENTICATION AND CIPHERING REQUEST message while T3318 is
running and
- the MAC value cannot be resolved; or
- the message was received in UMTS and contains a GSM authentication challenge,
the MS shall follow the procedure specified in this subclause (f), starting again from the beginning. If the SQN is
invalid, the MS shall proceed as specified in (g).
It can be assumed that the source of the authentication challenge is not genuine (authentication not accepted by
the MS) if any of the following occurs:
The MS shall stop timer T3318, if the timer is running and the MS detects a lower layer failure, the network
releases the PS signalling connection, the MS performs inter-system change to S1 mode, or the MS initiates a
GPRS suspension procedure (see 3GPP TS 44.018 [84]).
When it has been deemed by the MS that the source of the authentication challenge is not genuine
(authentication not accepted by the MS), the MS shall behave as described in subclause 4.7.7.6.1.
ETSI
Release 18 245 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 4.7.7a/1 3GPP TS 24.008: Authentication failure cause "MAC failure" or "GSM authentication
unacceptable"
(g) Authentication failure (GMM cause #19 "Synch failure"):
The MS shall send an AUTHENTICATION AND CIPHERING FAILURE message, with the GMM cause
"Synch failure", to the network and start the timer T3320. Furthermore, the MS shall stop any of the
retransmission timers that are running (e.g. T3310, T3321, T3330 or T3317). Upon the first receipt of an
AUTHENTICATION AND CIPHERING message from the MS with the GMM cause "synch failure", the
network shall use the returned AUTS parameter from the authentication & ciphering failure parameter IE in the
AUTHENTICATION AND CIPHERING FAILURE message, to re-synchronise. The re-synchronisation
procedure requires the SGSN to delete all unused authentication vectors for that IMSI and obtain new vectors
from the HLR. When re-synchronisation is complete, the network shall initiate the authentication & ciphering
procedure. Upon receipt of the AUTHENTICATION AND CIPHERING REQUEST message, the MS shall stop
timer T3320, if running.
NOTE: Upon receipt of two consecutive AUTHENTICATION AND CIPHERING FAILURE messages from the
MS with reject cause "synch failure", the network may terminate the authentication procedure by sending
an AUTHENTICATION AND CIPHERING REJECT message.
If the network is validated successfully (a new AUTHENTICATION AND CIPHERING REQUEST message is
received which contains a valid SQN and MAC) while T3320 is running, the MS shall send the
AUTHENTICATION AND CIPHERING RESPONSE message to the network and shall start any retransmission
timers (i.e. T3310, T3321, T3330 or T3317), if they were running and stopped when the MS received the first
failed AUTHENTICATION AND CIPHERING REQUEST message.
If the MS receives the second AUTHENTICATION AND CIPHERING REQUEST message while T3320 is
running and
- the MAC value cannot be resolved; or
- the message was received in Iu mode and contains a GSM authentication challenge,
the MS shall proceed as specified in (f). If the SQN is invalid, the MS shall follow the procedure specified in this
subclause (g), starting again from the beginning.
The MS shall deem that the network has failed the authentication check and behave as described in
subclause 4.7.7.6.1, if any of the following occurs:
ETSI
Release 18 246 3GPP TS 24.008 V18.4.0 (2023-09)
The MS shall stop timer T3320, if the timer is running and the MS detects a lower layer failure, the network
releases the PS signalling connection, the MS performs inter-system change to S1 mode, or the MS initiates a
GPRS suspension procedure (see 3GPP TS 44.018 [84]).
When it has been deemed by the MS that the source of the authentication challenge is not genuine
(authentication not accepted by the MS), the MS shall behave as described in subclause 4.7.7.6.1.
MS Network
AUTHENTICATION & CIPHERING REQUEST Start T3360
AUTH & CIPH FAILURE (cause=’Synch failure’) Stop T3360

Start T3320 Perform
AUTHENTICATION & CIPHERING REQUEST Re-synch
Stop T3320 with HLR
AUTHENTICATION & CIPHERING RESPONSE
Figure 4.7.7b/1 3GPP TS 24.008: Authentication failure cause 'Synch failure’
Upon receipt of an AUTHENTICATION AND CIPHERING REJECT message, the UE shall perform the
actions as specified in subclause 4.7.7.5.
For items f and g:
Depending on local requirements or operator preference for emergency bearer services, if the MS has a PDN
connection for emergency bearer services established or is establishing such a PDN connection, the SGSN need
not follow the procedures specified for the authentication failure specified in the present subclause and shall
continue using the current security context, if any. The SGSN shall deactivate all non-emergency PDP contexts,
if any, by initiating a PDP context deactivation procedure. If there is an ongoing session management procedure,
the SGSN shall deactivate all non-emergency PDP contexts upon completion of the session management
procedure. The network shall consider the MS to be attached for emergency bearer services only.
If an MS has a PDN connection for emergency bearer services established or is establishing such a PDN
connection when timer T3318 or T3320 expires, the MS shall not deem that the network has failed the
authentication check and not behave as described in subclause 4.7.7.6.1. Instead the MS shall continue using the
current security context, if any. The MS shall deactivate all non-emergency PDP contexts, if any, by initiating a
PDP context deactivation procedure. If there is an ongoing session management procedure, the MS shall
deactivate all non-emergency PDP contexts upon completion of the session management procedure. The MS
shall start any retransmission timers (e.g. T3310, T3317, T3321 or T3330) if:
- they were running and stopped when the MS received the AUTHENTICATION AND CIPHERING REJECT
message and detected an authentication failure; and
- the procedures associated with these timers have not yet been completed.
The MS shall consider itself to be attached for emergency bearer services only.
4.7.7.6.1 MS behaviour towards a network that has failed the authentication procedure
If the MS deems that the network has failed the authentication check, then it shall request RR or RRC to release the RR
connection and the PS signalling connection, if any, and bar the active cell or cells (see 3GPP TS 25.331 [23c] and
3GPP TS 44.018 [84]). The MS shall start any retransmission timers (i.e. T3310, T3321, T3330 or T3317), if they were
ETSI
Release 18 247 3GPP TS 24.008 V18.4.0 (2023-09)
running and stopped when the MS received the first AUTHENTICATION AND CIPHERING REQUEST message
containing an invalid MAC or invalid SQN, or no AUTN when a UMTS authentication challenge was expected.
4.7.7.7 Use of established security contexts

In A/Gb mode, in the case of an established GSM security context, the GPRS GSM ciphering key shall be taken into
use by the MS before the AUTHENTICATION AND CIPHERING RESPONSE message is transmitted.
In A/Gb mode, in the case of an established UMTS security context, and if the network indicates in the
AUTHENTICATION AND CIPHERING REQUEST message to the MS that a GEA ciphering algorithm that requires
a 64-bit ciphering key shall be taken into use, then the GPRS GSM ciphering key shall be taken into use by the MS
before the AUTHENTICATION AND CIPHERING RESPONSE message is transmitted. The network shall derive a
GPRS GSM ciphering key from the GPRS UMTS ciphering key and the GPRS UMTS integrity key, by using the
conversion function named "c3" defined in 3GPP TS 33.102 [5a].
a 128-bit ciphering key shall be taken into use, then the MS shall take the following actions:
- if authentication is not requested and a GEA ciphering algorithm that requires 64-bit ciphering key is in use, the
MS shall take into use the GPRS GSM Kc128 derived by the ME from the GPRS UMTS ciphering key and GPRS
UMTS integrity key of the established UMTS security context in use (see 3GPP TS 33.102 [5a]) before the
AUTHENTICATION AND CIPHERING RESPONSE message is transmitted;.
- if authentication is not requested and a GEA ciphering algorithm that requires 128-bit ciphering key is in use, the
GPRS GSM Kc128 of the established UMTS security context in use still applies;
otherwise, the MS shall take into use the GPRS GSM Kc128 derived by the ME from the GPRS UMTS ciphering
key and the GPRS UMTS integrity key provided by the USIM during the latest successful authentication
procedure (see subclause 4.7.7.3a) before the AUTHENTICATION AND CIPHERING RESPONSE message is
transmitted.
a 128-bit ciphering key shall be taken into use, then the network shall derive a GPRS GSM Kc 128 (see
In A/Gb mode, if an established UMTS security context context is available in the network, if the MS indicates support
of integrity protection to the network and the network supports integrity protection, if the network indicates in the
AUTHENTICATION AND CIPHERING REQUEST message to the MS that a new GPRS GSM integrity algorithm
shall be taken into use but no authentication is requested, then the GPRS GSM Kint of the established UMTS security
context in use still applies in the MS and network.
AUTHENTICATION AND CIPHERING REQUEST message to the MS that a GIA integrity protection algorithm that
requires a 128-bit integrity key shall be taken into use but no authentication is requested, then the GPRS GSM Kint of
the established UMTS security context in use still applies in the MS.
In A/Gb mode, if during an ongoing, already ciphering protected RR connection, the network initiates a new
Authentication and ciphering procedure, the new GPRS GSM ciphering key or GPRS GSM Kc128 shall be taken into use
by the MS before the AUTHENTICATION AND CIPHERING RESPONSE message is transmitted. In case of inter-
system change to Iu mode after receipt of the AUTHENTICATION AND CIPHERING REQUEST message, the MS
and the network shall take the new keys into use immediately after the inter-system change.
In Iu mode, in the case of an established GSM security context, the ME shall derive a GPRS UMTS ciphering key and a
GPRS UMTS integrity key from the GPRS GSM ciphering key by using the conversion functions named "c4" and "c5"
defined in 3GPP TS 33.102 [5a]. The derived GPRS UMTS ciphering key and GPRS UMTS integrity key shall be
taken into use by the MS when a valid SECURITY MODE COMMAND message indicating PS domain is received
during an RR connection (the definition of a valid SECURITY MODE COMMAND message is given in
3GPP TS 25.331 [23c]). The network shall derive a GPRS UMTS ciphering key and a GPRS UMTS integrity key from
the GPRS GSM ciphering key by using the conversion functions named "c4" and "c5" defined in 3GPP TS 33.102 [5a].
In Iu mode, in the case of an established UMTS security context, the GPRS UMTS ciphering key and the GPRS UMTS
integrity key shall be taken into use by the MS when a valid SECURITY MODE COMMAND message indicating PS
ETSI
Release 18 248 3GPP TS 24.008 V18.4.0 (2023-09)
domain is received during a PS signalling connection (the definition of a valid SECURITY MODE COMMAND
message is given in 3GPP TS 25.331 [23c]).
In Iu mode, if the MS received a valid SECURITY MODE COMMAND message indicating PS domain in Iu mode or a
valid AUTHENTICATION AND CIPHERING REQUEST message in A/Gb mode before the network initiates a new
authentication and ciphering procedure and establishes a new GSM/UMTS security context, the new GPRS UMTS
ciphering key and GPRS UMTS integrity key are taken into use by the MS, when a new valid SECURITY MODE
COMMAND message indicating PS domain is received during the PS signalling connection. In case of inter-system
change to A/Gb mode, the MS and the network shall take the new keys into use immediately after the inter-system
change.
4.7.7.8 Handling of keys at intersystem change from Iu mode to A/Gb mode

At an inter-system change from Iu mode to A/Gb mode, ciphering may be started (see 3GPP TS 44.064 [78a]) without
any new authentication and ciphering procedure. Deduction of the appropriate security key for ciphering in A/Gb mode,
depends on the current GSM/UMTS security context stored in the MS and the network.
The ME shall handle the GPRS GSM ciphering key and a potential GPRS GSM Kc128 according to table 4.7.7.8.1.
In the case of an established GSM security context, before any initial GMM message is sent in the new cell in A/Gb
mode, the GMM layer in the MS shall notify the LLC layer if ciphering shall be used or not. If ciphering shall be used,
then the GPRS GSM ciphering key and the applicable GEA ciphering algorithm according to the stored Ciphering
Algorithm IE in the MS shall also be indicated to the LLC layer (see 3GPP TS 44.064 [78a]).
In the case of an established UMTS security context, before any initial GMM message is sent in the new cell in A/Gb
mode, the GMM layer in the MS shall notify the LLC layer if ciphering shall be used or not. If ciphering shall be used,
then the GPRS GSM ciphering key or GPRS GSM Kc128 and the applicable GEA ciphering algorithm according to the
stored Ciphering Algorithm IE in the MS shall also be indicated to the LLC layer (see 3GPP TS 44.064 [78a]). If the
network has selected a GEA-algorithm that requires a 128-bit ciphering key, then the ME shall apply a GPRS GSM
Kc128 derived from the GPRS UMTS ciphering key and the GPRS UMTS integrity key of the established UTMS
security context as specified in 3GPP TS 33.102 [5a].
Table 4.7.7.8.1/3GPP TS 24.008: Inter-system change from Iu mode to A/Gb mode
Security context established in MS and At inter-system change to A/Gb mode:

network in Iu mode
GSM security context An ME shall apply the GPRS GSM ciphering key that was
received from the GSM security context created in the SIM/USIM
during the latest successful authentication procedure.
UMTS security context If a GEA algorithm is taken into use that requires a 64-bit long
ciphering key, then an ME shall apply the GPRS GSM ciphering
key that was derived by the USIM from the GPRS UMTS
ciphering key and the GPRS UMTS integrity key during the latest
successful authentication procedure.
If a GEA algorithm is taken into use that requires a 128-bit
ciphering key, then an ME shall apply the GPRS GSM Kc128
derived by the ME from the GPRS UMTS ciphering key and the
GPRS UMTS integrity key (see 3GPP TS 33.102 [5a]) provided
by the USIM during the lastest successful authentication
procedure (see subclause 4.7.7.3a).
NOTE: A USIM with UMTS security context, passes the GPRS UMTS ciphering key, the GPRS UMTS integrity
key and the derived GPRS GSM ciphering key to the ME independent on the current radio access being
UTRAN or GERAN.
4.7.7.9 Handling of keys at intersystem change from A/Gb mode to Iu mode

At an inter-system change from A/Gb mode to Iu mode, ciphering and integrity may be started (see
3GPP TS 25.331 [23c]) without any new authentication and ciphering procedure. Deduction of the appropriate security
keys for ciphering and integrity check in Iu mode, depends on the current GSM/UMTS security context stored in the
MS and the network.
ETSI
Release 18 249 3GPP TS 24.008 V18.4.0 (2023-09)
The ME shall handle the GPRS UMTS ciphering key and the GPRS UMTS integrity key according to table 4.7.7.9.1.
Table 4.7.7.9.1/3GPP TS 24.008: Inter-system change from A/Gb mode to Iu mode
Security context established in MS and At inter-system change to Iu mode:

network in A/Gb mode
GSM security context An ME shall derive the GPRS UMTS ciphering key and the
GPRS UMTS integrity key from the GPRS GSM ciphering key
that was provided by the SIM/USIM during the latest successful
authentication procedure. The conversion functions named "c4"
and "c5" in 3GPP TS 33.102 [5a] are used for this purpose.
UMTS security context An ME shall apply the GPRS UMTS ciphering key and the GPRS
UMTS integrity key that were received from the UMTS security
context created in the USIM during the latest successful
authentication procedure.
NOTE: A USIM with UMTS security context, passes the GPRS UMTS ciphering key, the GPRS UMTS integrity
key and the derived GPRS GSM ciphering key to the ME independent on the current radio access being
UTRAN or GERAN.
4.7.7.10 Handling of keys at intersystem change from S1 mode to Iu mode or A/Gb

mode
At an inter-system change from S1 mode to Iu mode, ciphering and integrity may be started (see
3GPP TS 25.331 [23c]) without any new authentication and ciphering procedure. At an inter-system change from
S1 mode to A/Gb mode, ciphering may be started (see 3GPP TS 44.064 [78a]) without any new authentication and
ciphering procedure. Deduction of the appropriate security keys for ciphering and integrity check in Iu mode or for
ciphering in A/Gb mode, depends on the current EPS security context or the UMTS security context for the PS domain
stored in the MS and the network.
The ME shall handle the GPRS UMTS ciphering key, the GPRS UMTS integrity key, the GPRS GSM ciphering key
and a potential GPRS GSM Kc128 according to table 4.7.7.10.1, table 4.7.7.10.2 and table 4.7.7.10.3.
Table 4.7.7.10.1/3GPP TS 24.008: Inter-system change from S1 mode to Iu mode or A/Gb mode in
connected mode.
Security context established in MS and At inter-system change to Iu mode or A/Gb mode in connected
network mode
EPS security context An ME shall derive the UMTS security keys GPRS UMTS
ciphering key (CK') and GPRS UMTS integrity key (IK') from
KASME and the NAS downlink COUNT value as specified in
3GPP TS 33.401 [123]. The ME shall use the derived UMTS
security keys to derive the GPRS GSM ciphering key using the
At inter-system change from S1 mode to Iu mode, the ME shall
apply the new derived GPRS UMTS integrity key and GPRS
UMTS ciphering key.
At inter-system change from S1 mode to A/Gb mode, the ME
shall apply the new derived GPRS GSM ciphering key.
security context for the PS domain, if any, in the USIM. The MS
shall in addition handle the STARTPS value as specified in
3GPP TS 25.331 [23c].
At inter-system change from S1 mode to A/Gb mode, if a GEA
algorithm is taken into use that requires a 64-bit long ciphering
key, then an ME shall apply the derived GPRS GSM ciphering
key.
key, then an ME shall apply the derived GPRS GSM Kc128 that
was derived by the ME from the derived UMTS security keys
(see subclause 4.7.7.3a).
ETSI
Release 18 250 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 1: For the case in table 4.7.7.10.1, because of deriving a new UMTS security context for the PS domain, a
new GPRS GSM ciphering key needs to be derived from the new derived UMTS security keys (i.e. CK'
and IK'). Note that the new GPRS GSM ciphering key is also part of the new UMTS security context for
the PS domain, and therefore any old GPRS GSM ciphering key stored in the USIM and in the ME
belongs to an old UMTS security context for the PS domain and can no longer be taken into use.
Table 4.7.7.10.2/3GPP TS 24.008: Inter-system change from S1 mode to Iu mode or A/Gb mode in idle
mode when the TIN indicates "GUTI".
Security context established in MS and At inter-system change to Iu mode or A/Gb mode in idle mode
network when the TIN indicates "GUTI"
EPS security context An ME shall derive the UMTS security keys GPRS UMTS
ciphering key (CK') and GPRS UMTS integrity key (IK') from
KASME and the NAS uplink COUNT value as specified in
3GPP TS 33.401 [123]. The ME shall use the derived UMTS
security keys to derive the GPRS GSM ciphering key using the
At inter-system change from S1 mode to Iu mode, the ME shall
apply the new derived GPRS UMTS integrity key and GPRS
UMTS ciphering key.
At inter-system change from S1 mode to A/Gb mode, the ME
shall apply the new derived GPRS GSM ciphering key.
security context for the PS domain, if any, in the USIM. The MS
shall in addition handle the STARTPS value as specified in
3GPP TS 25.331 [23c].
key, then an ME shall apply the derived GPRS GSM ciphering
key.
key, then an ME shall apply the derived GPRS GSM Kc128 that
was derived by the ME from the derived UMTS security keys
(see subclause 4.7.7.3a).
NOTE 2: For the case in table 4.7.7.10.2, because of deriving a new UMTS security context for the PS domain, a
new GPRS GSM ciphering key needs to be derived from the new derived UMTS security keys (i.e. CK'
and IK'). The new GPRS GSM ciphering key is also part of the new UMTS security context for the PS
domain, and therefore any old GPRS GSM ciphering key stored in the USIM and in the ME belongs to an
old UMTS security context for the PS domain and can no longer be taken into use.
ETSI
Release 18 251 3GPP TS 24.008 V18.4.0 (2023-09)
Table 4.7.7.10.3/3GPP TS 24.008: Inter-system change from S1 mode to Iu mode or A/Gb mode in idle
mode when the TIN indicates "RAT-related TMSI"
Security context established in MS and At inter-system change to Iu mode or A/Gb mode in idle mode
network when the TIN indicates "RAT-related TMSI"
UMTS security context At inter-system change from S1 mode to Iu mode, the ME shall
apply the GPRS UMTS ciphering key and the GPRS UMTS
integrity key that were received from the UMTS security context
for the PS domain created in the USIM during the latest
successful authentication procedure.
key, then an ME shall apply the GPRS GSM ciphering key that
was received from the GSM security context created in the
SIM/USIM during the latest successful authentication procedure.
key, then an ME shall apply the GPRS GSM Kc128 derived by the
ME from the GPRS UMTS ciphering key and the GPRS UMTS
integrity key (see 3GPP TS 33.102 [5a]) provided by the USIM
during the lastest successful authentication procedure (see
The network shall replace an already established UMTS security context for the PS domain, if any, when a handover
from S1mode to Iu mode or from S1mode to A/Gb mode has been completed successfully.
If the handover from S1mode to Iu mode or S1mode to A/Gb mode has not been completed successfully, the ME and
the network shall delete the new derived UMTS security context for the PS domain. Additionally, the network shall
delete the already established UMTS security context for the PS domain, if the CKSN of the already established UMTS
security context is equal to the CKSN of the new derived security context for the PS domain.
4.7.8 Identification procedure

The identification procedure is used by the network to request an MS to provide specific identification parameters to the
network e.g. International Mobile Subscriber Identity, International Mobile Equipment Identity (see
3GPP TS 23.003 [10]). For the presentation of the IMEI, the requirements of 3GPP TS 42.009 [5] apply.
4.7.8.1 Identification initiation by the network

The network initiates the identification procedure by transferring an IDENTITY REQUEST message to the MS and
starts the timer T3370. The IDENTITY REQUEST message specifies the requested identification parameters in the
identity type information element.
4.7.8.2 Identification response by the MS

An MS shall be ready to respond to an IDENTITY REQUEST message at any time.
Upon receipt of the IDENTITY REQUEST message the MS sends back an IDENTITY RESPONSE message. The
IDENTITY RESPONSE message shall contain the identification parameters as requested by the network.
4.7.8.3 Identification completion by the network

Upon receipt of the IDENTITY RESPONSE the network shall stop timer T3370.
4.7.8.3a Abnormal cases in the MS

(a) Requested identity is not available:
If the MS cannot encode the requested identity in the IDENTITY RESPONSE message, e.g. because no valid
SIM is available, then it shall encode the identity type as "No identity".
ETSI
Release 18 252 3GPP TS 24.008 V18.4.0 (2023-09)

Upon detection of a lower layer failure before the IDENTITY RESPONSE is received, the network shall abort
any ongoing GMM procedure.
The identification procedure is supervised by the network by the timer T3370. The network shall, on the first
expiry of the timer T3370, retransmit the IDENTITY REQUEST message and reset and restart the timer T3370.
This retransmission is repeated four times, i.e. on the fifth expiry of timer T3370, the network shall abort the
identification procedure and any ongoing GMM procedure.
c) Collision of an identification procedure with a GPRS attach procedure
If the network receives an ATTACH REQUEST message before the ongoing identification procedure has been
completed and no GPRS attach procedure is pending on the network (i.e. no ATTACH ACCEPT/REJECT
message has still to be sent as an answer to an ATTACH REQUEST message), the network shall proceed with
the GPRS attach procedure.
d) Collision of an identification procedure with a GPRS attach procedure when the identification procedure has
been caused by a GPRS attach procedure
If the network receives an ATTACH REQUEST message before the ongoing identification procedure has been
completed and a GPRS attach procedure is pending (i.e. an ATTACH ACCEPT/REJECT message has to be sent
as an answer to an earlier ATTACH REQUEST message), then:
- If one or more of the information elements in the ATTACH REQUEST message differs from the ones
received within the previous ATTACH REQUEST message, the network shall proceed with the GPRS attach
procedure; or
- If the information elements do not differ, then the network shall not treat any further this new ATTACH
REQUEST.
d1)Collision of an identification procedure with an MS initiated GPRS detach procedure
If the network receives a DETACH REQUEST message before the ongoing identification procedure has
been completed, the network shall abort the identification procedure and shall progress the GPRS detach
procedure.
If the network receives a DETACH REQUEST message before the ongoing identification procedure has
been completed, the network shall complete the identification procedure and shall respond to the GPRS
detach procedure as described in subclause 4.7.4.
e) Collision of an identification procedure with a routing area updating procedure
If the network receives a ROUTING AREA UPDATE REQUEST message before the ongoing identification
f) Collision of an identification procedure with a service request procedure
If the network receives a SERVICE REQUEST message before the ongoing identification procedure has been
completed, the network shall progress both procedures.
ETSI
Release 18 253 3GPP TS 24.008 V18.4.0 (2023-09)
MS Network
IDENTITY REQUEST
Start T3370
IDENTITY RESPONSE
Stop T3370
Figure 4.7.8/1 3GPP TS 24.008: Identification procedure
4.7.9 Paging procedure
4.7.9.1 Paging for GPRS services

In A/Gb mode, paging is used by the network to identify the cell the MS has currently selected, or to prompt the mobile
to re-attach if necessary as a result of network failure. If the MS is not GPRS attached when it receives a paging for
GPRS services, the MS shall ignore the paging.
In Iu mode, paging is used by the network to request the establishment of PS signalling connection or to prompt the
mobile to re-attach if necessary as a result of network failure. If the MS is not GPRS attached when it receives a paging
for GPRS services, the MS shall ignore the paging.
4.7.9.1.1 Paging for GPRS services using P-TMSI

The network shall initiate the paging procedure for GPRS services using P-TMSI when GMM signalling messages or
user data is pending to be sent to the MS while the mobile reachable timer is running. The network may page only
GPRS MSs which are GMM-REGISTERED and identified by a local P-TMSI.
In Iu mode, for the MS using eDRX, the network initiates the paging procedure when the paging trigger is received
within the paging time window. If the paging trigger is received outside the paging time window, the network initiates
the paging procedure at T time ahead of the beginning of the next paging time window.
NOTE: T time is a short time period based on implementation. The operator can take possible imperfections in
the synchronization between the CN and the MS into account when choosing T time.
In Iu mode, to initiate the procedure the GMM entity in the network requests the lower layer to start paging (see
3GPP TS 25.331 [23c] and 3GPP TS 25.413 [19c]) and shall start the timer:
- T3315 for this paging procedure, if the network accepted to use eDRX for the MS.
- Otherwise T3313 for this paging procedure.
In Iu mode, if the network starts the timer T3315, the network shall set the timer T3315 to a value smaller than the value
of timer T3-RESPONSE (see 3GPP TS 29.274 [16D] for further details on timer T3-RESPONSE).
In Iu mode, the GMM entity in the network may provide the lower layer with a list of CSG IDs, including the CSG IDs
of both the expired and the unexpired subscriptions. If there is a PDN connection for emergency bearer services
established, the GMM entity in the network shall not provide the list of CSG IDs to the lower layer.
Upon reception of a paging indication, the MS shall stop the timer T3346, if running, and:
- initiate a service request procedure to respond to the paging, the MS shall set the service type to "paging
response" in the SERVICE REQUEST message (see 3GPP TS 24.007 [20], 3GPP TS 23.060 [74],
3GPP TS 25.331 [23c] and 3GPP TS 25.413 [19c]); or
- initiate a routing area update procedure as specified in subclauses 4.7.5.1 and 4.7.5.2.1.
If the paging request for GPRS services was received during an ongoing MS initiated GMM specific procedure, then the
MS shall progress the GMM specific procedure, and the network shall proceed with the GMM specific procedure.
In A/Gb mode, to initiate the procedure the GMM entity requests the RR sublayer to start paging (see
3GPP TS 44.018 [84], 3GPP TS 44.060 [76]), and shall start the timer:
ETSI
Release 18 254 3GPP TS 24.008 V18.4.0 (2023-09)
- T3315 for this paging procedure, if the network accepted to use eDRX for the MS.
- Otherwise T3313 for this paging procedure.
In A/Gb mode, if the network starts the timer T3315, the network shall set the timer T3315 to a value smaller than the
value of timer T3-RESPONSE (see 3GPP TS 29.274 [16D] for further details on timer T3-RESPONSE).
In A/Gb mode, upon reception of a paging indication, the MS shall respond to the paging with any LLC frame (see
3GPP TS 44.064 [78a], 3GPP TS 24.007 [20], 3GPP TS 23.060 [74]).
At intersystem change, an MS not having the READY timer running in A/Gb mode or an MS in PMM-IDLE mode in
Iu mode, being paged in a different access network as when it last sent user data or signalling message, uses the
ROUTING AREA UPDATE REQUEST message as paging response, i.e. the routing area updating procedure shall be
performed instead according to the selective routing area updating procedure.
The network shall stop the timer for the paging procedure (i.e. either timer T3313 or timer T3315) when a response is
received from the MS.
Upon expiry ofthe timer T3313, the network may re-initiate paging.
Upon expiry of the timer T3315, the network shall abort the paging procedure and shall proceed as specified in
3GPP TS 23.060 [74].
In Iu mode, when a response is received from the MS, the network shall change from PMM-IDLE mode to PMM-
CONNECTED mode.
In A/Gb mode, when a response different from an LLC NULL frame is received from the MS, the network shall start
the READY timer.
4.7.9.1.2 Paging for GPRS services using IMSI

Paging for GPRS services using IMSI is an abnormal procedure used for error recovery in the network.
The network may initiate paging using IMSI if the P-TMSI is not available due to a network failure.
In Iu mode, to initiate the procedure the GMM entity in the network requests the lower layer to start paging (see
3GPP TS 25.331 [23c] and 3GPP TS 25.413 [19c]).
In A/Gb mode, to initiate the procedure the GMM entity in the network requests the RR sublayer to start paging (see
3GPP TS 44.018 [84], 3GPP TS 44.060 [76]).
Upon reception of a paging indication for GPRS services using IMSI, the MS shall stop the timer T3346, if it is
running, locally deactivate any active PDP context(s), MBMS context(s) and locally detach from GPRS. The local
detach includes deleting any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number stored, setting
the GPRS update status to GU2 NOT UPDATED and changing state to GMM-DEREGISTERED. The MS shall stop all
timers T3396 that are running.
If S1 mode is supported by the MS, the MS shall in addition handle the EMM parameters EMM state, EPS update
status, last visited registered TAI, TAI list, GUTI and KSIASME as specified in 3GPP TS 24.301 [120] for the case when
a paging for EPS services using IMSI is received.
In Iu mode, when an MS receives a paging request for GPRS services using the IMSI from the network before an MS
initiated GMM specific procedure has been completed, then the MS shall abort the GMM specific procedure, and the
MS shall proceed according to the description in this clause.
After performing the local detach, the MS shall then perform a GPRS attach or combined GPRS attach procedure.
After performing the attach, the MS should activate PDP context(s) to replace any previously active PDP context(s).
The MS should also perform the procedures needed in order to activate any previously active multicast service(s).
NOTE 2: The MS does not respond to the paging except with the Attach Request. Hence timers T3313 and T3315
in the network are not used when paging with IMSI.
ETSI
Release 18 255 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 3: Paging without DRX parameters may require a considerable extension of the paging duration.
NOTE 4: Paging without using eDRX parameters may result in the paging with IMSI not to be received by the MS
for which eDRX has been negotiated or may require a considerable extension of the paging duration.
4.7.9.2 Paging for non-GPRS services

The network may initiate the paging procedure for non-GPRS services when the MS is IMSI attached for non-GPRS
services.
In Iu mode, to initiate the procedure the GMM entity requests the lower layer to start paging (see 3GPP TS 25.331 [23c]
and 3GPP TS 25.413 [19c]) for non-GPRS services.
In A/Gb mode, to initiate the procedure the GMM entity requests the RR sublayer to start paging (see
3GPP TS 44.018 [84] and 3GPP TS 44.060 [76] for non-GPRS services).
The MS identity used for paging shall be the allocated TMSI if acknowledged by the MS, otherwise the IMSI.
4.7.10 Receiving a GMM STATUS message by a GMM entity

If the MS receives a GMM STATUS message no state transition and no specific action shall be taken as seen from the
radio interface, i.e. local actions are possible. The actions to be taken on receiving a GMM STATUS message in the
network are an implementation dependent option.
4.7.11 Void
4.7.12 GMM Information procedure

The GMM information message support is optional in the network. The MM information procedure may be invoked by
the network at any time during an established GMM context.
4.7.12.1 GMM information procedure initiation by the network

The GMM information procedure consists only of the GMM INFORMATION message sent from the network to the
mobile station. During an established GMM context, the network may send none, one, or more GMM INFORMATION
messages to the mobile station. If more than one GMM INFORMATION message is sent, the messages need not have
the same content.
4.7.12.2 GMM information procedure in the mobile station

When the mobile station (supporting the GMM information message) receives an GMM INFORMATION message, it
shall accept the message and optionally use the contents to update appropriate information stored within the mobile
station.
If the mobile station does not support the GMM information message the mobile station shall ignore the contents of the
message and return an GMM STATUS message with cause #97.
4.7.13 Service Request procedure (Iu mode only)

The purpose of this procedure is to transfer the PMM mode from PMM-IDLE to PMM-CONNECTED mode, and/or to
assign radio access bearer in case of PDP contexts are activated without radio access bearer assigned. In latter case, the
PMM mode may be PMM-IDLE mode or may alternatively be the PMM-CONNECTED mode if the MS requires radio
access bearer re-establishment. This procedure is used for;
- the initiation of CM layer service (e.g. SM or SMS) procedure from the MS in PMM-IDLE mode,
- the network to transfer down link signalling,
- uplink (in PMM-IDLE or PMM CONNECTED) and downlink (only in PMM-IDLE) user data,
ETSI
Release 18 256 3GPP TS 24.008 V18.4.0 (2023-09)
- counting the number of mobile stations in a cell which are interested in a specific MBMS service.
- requesting the establishment of a point-to-point Radio Bearer for receiving a MBMS service.
For downlink transfer of signalling or user data in PMM-IDLE mode, the trigger is given from the network by the
paging request procedure, which is out of scope of the present document.
For pending downlink user data in PMM-CONNECTED mode, the re-establishment of radio access bearers for all
active PDP contexts is done without paging.
For counting the number of mobile stations in PMM-IDLE mode interested in a specific MBMS service, the trigger is
given from the network by the MBMS notification procedure (see 3GPP TS 25.331 [23c]).
For establishing a point-to-point radio bearer to allow MBMS service, the trigger is given from the RRC determining
this need from the MBMS control parameters broadcasted by the network (see 3GPP TS 25.331 [23c]).
Service type can take either of the following values; "signalling", "data", "paging response", "MBMS multicast service
reception" or "MBMS broadcast service reception". Each of the values shall be selected according to the criteria to
initiate the Service request procedure.
If the MS is triggered to send a Service Request message for both MBMS multicast service and MBMS broadcast
service simultaneously, the MS shall include a Service Type indicating "MBMS multicast service reception".
The criteria to invoke the Service request procedure are when:
a) the MS has any signalling messages except GMM messages (e.g. for SM or SMS) to be sent to the network in
PMM-IDLE mode (i.e., no secure PS signalling connection has been established). In this case, the service type
shall be set to "signalling".
b) the MS, either in PMM-IDLE or PMM-CONNECTED mode, has pending user data to be sent, no radio access
bearer is established for the corresponding PDP context, and timer T3319 (see subclause 4.7.13.3) is not running
or, optionally, if timer T3319 is running and the flag in the Uplink data status IE for this PDP context has not
been set in the last Service Request. The procedure is initiated by an indication from the lower layers (see
3GPP TS 24.007 [20]). In this case, the service type shall be set to "data".
c) the MS receives a paging request using P-TMSI for PS domain from the network in PMM-IDLE mode. In this
case, the service type shall be set to "paging response".
d) the MS is in PMM-IDLE mode or PMM-CONNECTED, receives an MBMS notification for an MBMS

multicast service for which the MS has activated an MBMS context or for an MBMS broadcast service which
has been selected for reception locally by upper layers in the MS, and is prompted by the contents of the
notification to establish a PS signalling connection (see 3GPP TS 25.346 [110]). In this case, the service type
shall be set to "MBMS multicast service reception" or "MBMS broadcast service reception", respectively.
e) the MS in PMM-IDLE mode or PMM-CONNECTED, determines from the broadcast MBMS control parameters
that there is a need to establish a point-to-point Radio Bearer to enable MBMS reception (see
3GPP TS 25.346 [110]). In this case, the service type shall be set to "MBMS multicast service reception" or
"MBMS broadcast service reception", respectively.
If one of the above criteria to invoke the Service request procedure is fulfilled, then the Service request procedure may
only be initiated by the MS when the following conditions are fulfilled:
- its GPRS update status is GU1 UPDATED and the stored RAI is equal to the RAI of the current serving cell; and
- no GMM specific procedure is ongoing (see subclause 4.1.1.1).
If a GMM specific procedure is ongoing at the time a request from CM sublayer, the RRC or the RABM (see
3GPP TS 24.007 [20]) is received and the ATTACH REQUEST or ROUTING AREA UPDATE REQUEST message
has been sent, then, depending on implementation, the MS shall abort the received request or delay it until the GMM
specific procedure is completed. If the ATTACH REQUEST or ROUTING AREA UPDATE REQUEST message has
not been sent, the MS may indicate "follow-on request pending" in the message (i.e. the MS wishes to prolong the
established PS signalling connection after the GMM specific procedure). Then, the MS shall delay the Service request
procedure until the GMM specific procedure is completed.
ETSI
Release 18 257 3GPP TS 24.008 V18.4.0 (2023-09)
If the network indicates "follow-on proceed" in the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT
message and the MS has a service request pending, the MS shall react depending on the service type. If the service type
is:
- "signalling": the MS shall abort the Service request procedure and send the pending signalling messages
immediately;
- "data": the MS shall immediately perform the pending Service request procedure using the current PS signalling
connection;
- "paging response": the MS shall abort the Service request procedure. No further specific action is required from
the MS.
If the network indicates "follow-on proceed" and the MS has no service request pending, then no specific action is
required from the MS. As an implementation option, the MS may start timer T3340 as described in subclause 4.7.1.9 if
no user plane radio access bearers are set up.
If the network indicates "no follow-on proceed" in the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT
message, the MS shall not initiate the pending Service request procedure until the current PS signalling connection is
released.
NOTE: The "follow-on proceed" indication was not defined in earlier versions of the protocol. A network that is
compliant with the earlier versions of the protocol will always encode the respective bit as zero, i.e. as
"follow-on proceed", even if it does not prolong the PS signalling connection.
After completion of a Service request procedure but before re-establishment of radio access bearer, if the PDP and
MBMS context status information elements are included, then the network shall deactivate all those PDP and MBMS
contexts locally (without peer to peer signalling between the MS and the network), which are not in SM state PDP-
INACTIVE on network side but are indicated by the MS as being in state PDP-INACTIVE.
After completion of a Service request procedure, the pending service is resumed and uses then the connection
established by the procedure. If the service type is indicating "data", then the radio access bearers for all activated PDP
contexts are re-established by the network, except for those activated PDP contexts having maximum bit rate value set
to 0 kbit/s for both uplink and downlink and as an option those which have no pending user data. The re-establishment
of radio access bearers for those PDP contexts is specified in subclause 6.1.3.3.
A service request attempt counter is used to limit the number of service request attempts and no response from the
network. The service request attempt counter shall be incremented as specified in subclause 4.7.13.5.
The service request attempt counter shall be reset when:
- an attach or combined attach procedure is successfully completed;
- a normal or periodic routing area updating or a combined routing area updating procedure is successfully
completed;
- a service request procedure is successfully completed ; or
- the UE moves to GMM-DEREGISTERED state.
4.7.13.1 Service Request procedure initiation

The MS initiates the Service request procedure by sending a SERVICE REQUEST message. The timer T3317 shall be
started after the SERVICE REQUEST message has been sent and state GMM-SERVICE-REQUEST-INITIATED is
entered. The message SERVICE REQUEST shall contain the P-TMSI and the Service type shall indicate either "data",
"signalling", "paging response", "MBMS multicast service reception" or "MBMS broadcast service reception". The MS
shall not issue another Service request when the MS is in state GMM-SERVICE-REQUEST-INITIATED
If the PDP context status information element is included in the SERVICE REQUEST message, then the network shall
deactivate all those PDP contexts locally (without peer to peer signalling between the MS and the network) which are
not in SM state PDP-INACTIVE on the network side, but are indicated by the MS as being in state PDP-INACTIVE.
If the MBMS context status information element is included in the SERVICE REQUEST message, then the network
shall deactivate all those MBMS contexts locally (without peer to peer signalling between the MS and network) which
are not in SM state PDP-INACTIVE on the network side, but are indicated by the MS as being in state PDP-
ETSI
Release 18 258 3GPP TS 24.008 V18.4.0 (2023-09)
INACTIVE. If no MBMS context status information element is included, then the network shall deactivate all MBMS
contexts locally which are not in SM state PDP-INACTIVE on the network side.
For a Service Request of type "data", the MS may include the Uplink data status information element in the SERVICE
REQUEST message. The Uplink data status information indicates which preserved PDP contexts have pending uplink
data to be sent. If the Uplink data status information element is included in the SERVICE REQUEST message with
service type "data", the network may use this information to determine which of the RABs for the preserved PDP
contexts to re-establish.
4.7.13.2 GMM common procedure initiation

The network may initiate GMM common procedures, e.g. the GMM identification or the GMM authentication and
ciphering procedure, depending on the received information such as GPRS ciphering key sequence number and P-
TMSI.
4.7.13.3 Service request procedure accepted by the network

If the SERVICE REQUEST message was sent in PMM-IDLE mode, the indication from the lower layers that the
security mode control procedure is completed shall be treated as a successful completion of the procedure. The service
request attempt counter shall be reset, timer T3317 shall be stopped, and the MS enters GMM-REGISTERED state and
PMM-CONNECTED mode.
If the SERVICE REQUEST message was sent in PMM-CONNECTED mode, then the reception of the SERVICE
ACCEPT message shall be treated as a successful completion of the procedure. The timer T3317 shall be stopped and
the MS remains in PMM-CONNECTED mode.
Upon reception of the SERVICE REQUEST message, if the EMM Combined UE Waiting Flag is 'true', the SGSN shall
complete the procedure and perform a detach procedure for non-GPRS services only as described in subclause 4.7.4.2.
If the SERVICE REQUEST message was sent in a CSG cell and the CSG subscription has expired or was removed for
a MS, but the MS has a PDN connection for emergency bearer services established, the network shall accept the
SERVICE REQUEST message and deactivate all non-emergency PDP contexts by initiating PDP context deactivation
procedure. The PDP contexts for emergency services shall not be deactivated.
At successful completion of a service request procedure with Service type "data", the MS shall start timer T3319. The
timer T3319 shall be stopped when the MS returns to PMM-IDLE mode or when the network releases the radio access
bearer of any active PDP context. The MS shall not issue another Service Request with service type "data" while timer
T3319 is running unless the Service request is being generated from a PDP context for which the flag in the Uplink data
status IE has not been set in the last Service Request.
The network may indicate a value for timer T3319 in the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT
messages. The last provided value of T3319 shall be used by the MS. If the information element T3319 value is not
included in the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT messages, the default value shall be
used. If the T3319 value received by the MS contains an indication that the timer is deactivated or the timer value is
zero, then the MS shall use the default value.
If the PDP context status information element is included in the Service Accept, then the MS shall deactivate locally
(without peer to peer signalling between the MS and the network) all that PDP contexts which are not in SM state PDP-
INACTIVE on MS side but are indicated by the Network as being in state PDP-INACTIVE. If there is a default PDP
context among the PDP contexts to be deactivated, an MS supporting S1 mode shall locally deactivate all PDP contexts
associated to the same PDP address and APN as the default PDP context without peer-to-peer SM signalling to the
network; an MS not supporting S1 mode may apply the same behaviour.
If the MBMS context status information element is included in the SERVICE ACCEPT message, then the MS shall
deactivate all those MBMS contexts locally (without peer to peer signalling between the MS and network) which are
not in SM state PDP-INACTIVE in the MS, but are indicated by the network as being in state PDP-INACTIVE. If no
MBMS context status information element is included, then the MS shall deactivate all those MBMS contexts locally
which are not in SM state PDP-INACTIVE in the MS.
If a service request is received from an MS with a LIPA PDN connection, and if:
ETSI
Release 18 259 3GPP TS 24.008 V18.4.0 (2023-09)
- a L-GW Transport Layer Address is provided by the lower layer together with the service request, and the
GGSN address associated with the PDP context of the LIPA PDN connection is different from the provided L-
GW Transport Layer Address (see 3GPP TS 25.413 [19c]); or
- no L-GW Transport Layer Address is provided together with the service request by the lower layer,
then the SGSN explicitly deactivates all PDP contexts associated with the LIPA PDN connection by initiating the PDP
context deactivation procedure (see subclause 6.1.3.4.2).
If a service request is received from an MS with a SIPTO at the local network PDN connection, the following different
cases can be distinguished:
1) if the PDN connection is a SIPTO at the local network PDN connection with collocated L-GW and if:
- a SIPTO L-GW Transport Layer Address is provided by the lower layer together with the service request,
and the GGSN address associated with the PDP context of the SIPTO at the local network PDN connection is
different from the provided SIPTO L-GW Transport Layer Address (see 3GPP TS 25.413 [19c]); or
- no SIPTO L-GW Transport Layer Address is provided together with the service request by the lower layer,
2) if the PDN connection is a SIPTO at the local network PDN connection with stand-alone GW and if:
- a LHN-ID value is provided by the lower layer together with the service request, and the LHN-ID stored in
the PDP context of the SIPTO at the local network PDN connection is different from the provided LHN-ID
value (see 3GPP TS 25.413 [19c]); or
- no LHN-ID value is provided together with the service request by the lower layer,
then the SGSN explicitly deactivates all PDP contexts associated with the SIPTO at the local network PDN connection
by initiating the PDP context deactivation procedure (see subclause 6.1.3.4.2).
4.7.13.4 Service request procedure not accepted by the network

If the Service request cannot be accepted, the network returns a SERVICE REJECT message to the mobile station.
Based on local policies or configurations in the network, if the network determines to change the periodic routing area
update timer (T3312), or if the network determines to change the PSM usage or the value of the timer T3324 in the MS
for which PSM is allowed by the network, the network may return a SERVICE REJECT with the cause #10 "implicitly
detached" to the MS.
If the service request for mobile originated services is rejected due to general NAS level mobility management
congestion control, the network shall set the GMM cause value to #22 "congestion" and assign a back-off timer T3346.
An MS that receives a SERVICE REJECT message containing a reject cause other than GMM cause value #25 or the
message is integrity protected, shall reset the service request attempt counter, shall stop the timer T3317.
If the SERVICE REJECT message containing GMM cause value #25 was received without integrity protection, then
the MS shall discard the message.
The MS shall then take different actions depending on the received reject cause value:
#3 (Illegal MS); or
#6 (Illegal ME);
- The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to
subclause 4.1.3.2), shall delete the list of equivalent PLMNs and enter the state GMM-DEREGISTERED.NO-
IMSI. Furthermore, it shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence
number and shall consider the SIM/USIM as invalid for GPRS services until switching off or the SIM/USIM is
removed. If the message has been successfully integrity checked by the lower layers and the MS maintains a
counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to MS
- A GPRS MS operating in MS operation mode A or B shall in addition set the update status to U3 ROAMING
NOT ALLOWED, shall delete any TMSI, LAI and ciphering key sequence number. If the MS is operating in
ETSI
Release 18 260 3GPP TS 24.008 V18.4.0 (2023-09)
MS operation mode A and an RR connection exists, the MS shall abort the RR connection, unless an emergency
call is ongoing. The SIM/USIM shall be considered as invalid also for non-GPRS services until switching off or
the SIM/USIM is removed or the timer T3245 expires as described in subclause 4.1.1.6. If the message has been
successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered
invalid for non-GPRS services", then the MS shall set this counter to MS implementation-specific maximum
value.
service request procedure is rejected with the EMM cause with the same value.
subclause 4.1.3.2.9) and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence
number. The new GMM state is GMM-DEREGISTERED.NO-IMSI.
ciphering key sequence number. The MS shall delete the list of equivalent PLMNs. If the MS is operating in MS
operation mode A and an RR connection exists, the MS shall abort the RR connection, unless an emergency call
is ongoing. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS services until switching off
or the SIM/USIM is removed. If the message has been successfully integrity checked by the lower layers and the
MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this
counter to MS implementation-specific maximum value. If the message has been successfully integrity checked
by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services",
- The MS shall set the GPRS update status to GU2 NOT UPDATED (and shall store it according to
P-TMSI signature, RAI and GPRS ciphering key sequence number. If the rejected request was not for initiating a
PDN connection for emergency bearer services, the MS may subsequently, automatically initiate the GPRS
attach procedure.
ETSI
Release 18 261 3GPP TS 24.008 V18.4.0 (2023-09)
- A GPRS MS operating in MS operation mode B in network operation mode I is IMSI detached for both GPRS
and CS services.
A GPRS MS operating in MS operation mode A in network operation mode I is detached for GPRS services. If
no RR connection exists then the MS is also IMSI detached for the CS services.
- The MS shall change to state GMM-DEREGISTERED.NORMAL-SERVICE. If the rejected request was not for
initiating a PDN connection for emergency bearer services, the MS shall then perform a new attach procedure.
The MS should also activate PDP context(s) that were originally activated by the MS to replace any previously
MS activated PDP context(s). The MS should also perform the procedures needed in order to activate any
previously active multicast service(s).
the case when the service request procedure is rejected with the EMM cause with the same value.
- The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number, shall set
the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2)
and enter the state GMM-DEREGISTERED. The MS shall delete the list of equivalent PLMNs.
- The MS shall store the PLMN identity in the "forbidden PLMN list" and if the MS is configured to use timer
- If no RR connection exists, the MS shall perform the following additional actions immediately. If the MS is
- A GPRS MS operating in MS operation mode A shall set the update status to U3 ROAMING NOT
ALLOWED and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM
IDLE.
- The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number, shall set
the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2)
and shall change to state GMM-DEREGISTERED.LIMITED-SERVICE.
- The mobile station shall store the LAI in the list of "forbidden location areas for regional provision of service".
ETSI
Release 18 262 3GPP TS 24.008 V18.4.0 (2023-09)
subclause 4.1.3.2) and shall change to state GMM-REGISTERED.LIMITED-SERVICE.
- The MS shall store the LAI in the list of "forbidden location areas for roaming".
If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state and EPS update status
as specified in 3GPP TS 24.301 [120] for the case when the service request procedure is rejected with the EMM
- The MS shall store the LAI in the list of "forbidden location areas for roaming".
- The MS shall search for a suitable cell in another location area or a tracking area according to 3GPP
TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121].
#22 (Congestion);
ETSI
Release 18 263 3GPP TS 24.008 V18.4.0 (2023-09)
If the T3346 value IE is present in the SERVICE REJECT message and the value indicates that this timer is
abnormal case and the behaviour of the MS for this case is specified in subclause 4.7.13.5.
If the rejected request was not for initiating a PDN connection for emergency bearer services, the MS shall abort
the service request procedure and enter state GMM-REGISTERED, and stop timer T3317 if still running.
If the SERVICE REJECT message is integrity protected, the MS shall start timer T3346 with the value provided
If the SERVICE REJECT message is not integrity protected, the MS shall start timer T3346 with a random value
The MS stays in the current serving cell and applies normal cell reselection process. The service request
procedure may be started by CM layer, if it is still necessary, when timer T3346 expires or is stopped.
- Cause #25 is only applicable in UTRAN Iu mode and when received from a CSG cell. Other cases are
subclause 4.7.13.5.
- If the CSG ID and associated PLMN identity of the cell where the MS has sent the SERVICE REQUEST
- If the CSG ID and associated PLMN identity of the cell where the MS has sent the SERVICE REQUEST
message are contained in the Operator CSG list, the MS shall proceed as specified in 3GPP TS 23.122 [14]
subclause 3.1A.
- The MS shall search for a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].
- If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state and EPS update status
# 40 (No PDP context activated)
- The MS shall deactivate locally all active PDP and MBMS contexts and the MS shall enter the state GMM-
REGISTERED.NORMAL-SERVICE. If the rejected request was not for initiating a PDN connection for
emergency bearer services, the MS may also activate PDP context(s) that were originally activated by the MS to
replace any previously MS activated PDP context(s). The MS may also perform the procedures needed in order
to activate any previously active multicast service(s).
subclause 4.7.13.5.
ETSI
Release 18 264 3GPP TS 24.008 V18.4.0 (2023-09)
4.7.13.4a Service request procedure for initiating a PDN connection for emergency
bearer services not accepted by the network (UTRAN Iu mode only)
If the service request for initiating a PDN connection for emergency bearer services cannot be accepted by the network,
the MS shall perform the procedures as described in subclause 4.7.13.4. Then if the MS is in the same selected PLMN
where the last service request was attempted, the MS shall:
If the service request for initiating a PDN connection for emergency bearer services fails due to abnormal case a) in
subclause 4.7.13.5, the MS shall perform the procedures as described in subclause 4.7.13.5 and inform the upper layers
of the failure to access the network.
NOTE 2: This can result in the upper layers establishment of a CS emergency call (if not already attempted in the
CS domain) or other implementation specific mechanisms, e.g. procedures specified in
If the service request for initiating a PDN connection for emergency bearer services fails due to abnormal cases b), c)
or d) in subclause 4.7.13.5, the MS shall perform the procedures as described in subclause 4.7.13.5. Then if the MS is in
the same selected PLMN where the last service request was attempted, the MS shall:
NOTE 3: This can result in the upper layers establishment of a CS emergency call (if not already attempted in the
CS domain) or other implementation specific mechanisms, e.g. procedures specified in
4.7.13.5 Abnormal cases in the MS

If the service request procedure is started in response to a paging request from the network, access class barring,
EAB or ACDC is not applicable.
The service request procedure shall not be started. The MS stays in the current serving cell and applies normal
cell reselection process. The service request procedure may be started by CM layer if it is still necessary, i.e.
when access is granted or because of a cell change.
If access is barred because of access class control, the service request is initiated due to a request from upper
layers for PS signalling connection, ACDC is applicable to the request and the MS supports ACDC, then the
service request procedure shall be started.
If access is barred for a certain ACDC category, and if the service request is initiated due to a request from upper
layers for PS signalling connection for a higher ACDC category and the MS supports ACDC, then the service
request procedure shall be started.
If an access request for an uncategorized application is barred due to ACDC , and if the service request is
initiated due to a request from upper layers for PS signalling connection for a certain ACDC category and the
MS supports ACDC, then the service request procedure shall be started.
b) Lower layer failure without "Extended Wait Time" received from lower layers before the security mode control
procedure is completed, SERVICE ACCEPT or SERVICE REJECT message is received
The procedure shall be aborted except in the following implementation option cases b.1, b.2 and b.3.
ETSI
Release 18 265 3GPP TS 24.008 V18.4.0 (2023-09)
b.1) Release of PS signalling connection in Iu mode (i.e. RRC connection release) before the completion of the
service request procedure
The service request procedure shall be initiated again, if the following conditions apply:
i) The original service request procedure was initiated over an existing PS signalling connection; and
the PS signalling connection were received after the SERVICE REQUEST message was transmitted.
b.2) RR release in Iu mode (i.e. RRC connection release) with cause different than "Directed signalling
connection re-establishment", for example, "Normal", or "User inactivity" (see 3GPP TS 25.331 [23c] and
3GPP TS 44.118 [111])
The service request procedure shall be initiated again, if the following conditions apply:
i) The original service request procedure was initiated over an existing RRC connection and,
the PS signalling connection were received after the SERVICE REQUEST messge was transmitted.
NOTE: The RRC connection release cause different than "Directed signalling connection re-establishment" that
triggers the re-initiation of the service request procedure is implementation specific.
b.3) RR release in Iu mode (i.e. RRC connection release) with cause "Directed signalling connection re-
establishment" (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111])
The routing area updating procedure shall be initiated followed by a rerun of the service request procedure if the
following condition applies:
i) The service request procedure was not due to a rerun of the procedure due to "Directed signalling
connection re-establishment".
c) T3317 expired
The MS shall enter GMM-REGISTERED state.
If the MS is in PMM-IDLE mode then the MS shall increment the service request attempt counter, abort the
procedure and release locally any resources allocated for the service request procedure. If the service request
procedure is initiated to establish a PDN connection for emergency bearer services or the MS has a PDN
connection for emergency bearer services established or the MS is an MS configured to use AC11 – 15 in
selected PLMN, the service request counter shall not be incremented. If the service request attempt counter is
greater than or equal to 5, the MS shall start timer T3325. The MS shall not attempt service request until expiry
of timer T3325 unless:
- the service request is in response to paging from the network;
- the service request is initiated to establish a PDN connection for emergency bearer services;
- the MS has a PDN connection for emergency bearer services established; or
- the MS is registered in a new PLMN.
If the MS is in PMM-CONNECTED mode, then the procedure shall be aborted.
d) SERVICE REJECT received, other causes than those treated in subclause 4.7.13.4, and cases of GMM cause
values #22 and #25, if considered as abnormal cases according to subclause 4.7.13.4
The procedure shall be aborted.
e) Routing area update procedure is triggered
If a cell change into a new routing area occurs and the necessity of routing area update procedure is determined
before the security mode control procedure is completed, a SERVICE ACCEPT or SERVICE REJECT message
has been received, the Service request procedure shall be aborted and the routing area updating procedure is
ETSI
Release 18 266 3GPP TS 24.008 V18.4.0 (2023-09)
started immediately. Follow-on request pending may be indicated in the ROUTING AREA UPDATE
REQUEST for the service, which was the trigger of the aborted Service request procedure, to restart the pending
service itself or the Service request procedure after the completion of the routing area updating procedure. If the
Service type of the aborted SERVICE REQUEST was indicating "data", then the routing area update procedure
may be followed by a re-initiated Service request procedure indicating "data", if it is still necessary. If the
Service type was indicating "MBMS multicast service reception", or "MBMS broadcast service reception" the
Service request procedure shall be aborted.
f) Power off
If the MS is in state GMM-SERVICE-REQUEST-INITIATED at power off, the GPRS detach procedure shall be
performed.
g) Detach procedure collision
If the MS receives a DETACH REQUEST message from the network in state GMM-SERVICE-REQUEST-
INITIATED, the GPRS detach procedure shall be progressed and the Service request procedure shall be
aborted. If the GMM cause IE, in the DETACH REQUEST message, indicated a "re-attach required", the
GPRS attach procedure shall be performed. If the DETACH REQUEST message contains detach type "re-
attach not required" and GMM cause #2 "IMSI unknown in HLR", the MS will follow the procedure as
described below for the detach type "IMSI detach".
If the MS receives a DETACH REQUEST message from the network in state GMM-SERVICE-REQUEST-
INITIATED, the network and the MS shall progress both procedures.
h) "Extended wait time" for PS domain from the lower layers
The MS shall abort the service request procedure, enter state GMM-REGISTERED, and stop timer T3317 if still
running.
If the SERVICE REQUEST message contained the low priority indicator set to "MS is configured for NAS
signalling low priority", the MS shall start timer T3346 with the "Extended wait time" value.
procedure is started, if still necessary, when timer T3346 expires or is stopped.
m) Timer T3346 is running
The MS shall not start the service request procedure unless:
- the MS receives a paging; or
- the MS is an MS configured to use AC11 – 15 in selected PLMN; or
- the MS has a PDN connection for emergency bearer services established; or
- the MS is establishing a PDN connection for emergency bearer services; or
- the MS has a PDN connection established without the NAS signalling low priority indication or is
establishing a PDN connection without the NAS signalling low priority indication, the timer T3302 and the
timer T3311 are not running and the timer T3346 was started due to rejection of a NAS request message (e.g.
ATTACH REQUEST, ROUTING AREA UPDATE REQUEST or SERVICE REQUEST) which contained
the low priority indicator set to "MS is configured for NAS signalling low priority".
procedure is started, if still necessary, when timer T3346 expires or is stopped.
ETSI
Release 18 267 3GPP TS 24.008 V18.4.0 (2023-09)

If a low layer failure occurs before the security mode control procedure is completed, a SERVICE ACCEPT or
SERVICE REJECT message has been sent to the MS, the network enters/stays in PMM-IDLE.
b) Protocol error
If the SERVICE REQUEST message is received with a protocol error, the network shall return a SERVICE
REJECT message with one of the following reject causes:
The network stays in PMM-IDLE mode.
c) More than one SERVICE REQUEST received and the procedure has not been completed (i.e., the security mode
control procedure has not been completed or SERVICE ACCEPT, SERVICE REJECT message has not been
sent)
- If one or more of the information elements in the SERVICE REQUEST message differs from the ones
received within the previous SERVICE REQUEST message, the previously initiated Service request
procedure shall be aborted and the new Service request procedure shall be progressed;
- If the information elements do not differ, then the network shall continue with the previous Service request
procedure and shall not treat any further this SERVICE REQUEST message.
d) ATTACH REQUEST received before the security mode control procedure has been completed or an SERVICE
ACCEPT or an SERVICE REJECT message has been sent
If an ATTACH REQUEST message is received and the security mode control procedure has not been completed
or an SERVICE ACCEPT or an SERVICE REJECT message has not been sent, the network may initiate the
GMM common procedures, e.g. the GMM authentication and ciphering procedure. The network may e.g. after a
succesful GMM authentication and ciphering procedure execution, abort the Service request procedure, the
GMM context, PDP contexts and MBMS contexts, if any, are deleted and the new ATTACH REQUEST is
progressed.
e) ROUTING AREA UPDATE REQUEST message received before the security mode control procedure has been
completed or an SERVICE ACCEPT or an SERVICE REJECT message has been sent
If an ROUTING AREA UPDATE REQUEST message is received and the security mode control procedure has
not been completed or an SERVICE ACCEPT or an SERVICE REJECT message has not been sent, the network
may initiate the GMM common procedures, e.g. the GMM authentication and ciphering procedure. The network
may e.g. after a successful GMM authentication and ciphering procedure execution, abort the Service request
procedure and progress the routing area update procedure.
f) If the Service Type indicates 'data’ and the network fails to re-establish some or all RAB(s) then the SGSN may
determine if PDP Context Modification or PDP Context Deactivation should be initiated.
The appropriate action is an operator choice and depends on the QoS profile of the PDP Context, and the Uplink
data status.
4.7.14 Void
4.7.15 GMM eCall inactivity procedure
ETSI
Release 18 268 3GPP TS 24.008 V18.4.0 (2023-09)
The GMM eCall inactivity procedure is applicable only to an eCall only mobile station (as determined by information
configured in USIM) that is capable of eCall over IMS and attached for GPRS services. The procedure shall be started
when:
- the mobile station is in PMM-IDLE mode (Iu mode) or packet idle mode;
- the mobile station is in MM IDLE state;
- the mobile station is in any GMM-REGISTERED substate except GMM-REGISTERED.NO-CELL-

AVAILABLE or GMM-REGISTERED.PLMN-SEARCH; and
- one of the following conditions applies:
- timer T3242 expires or is found to have already expired and timer T3243 is not running;
- timer T3243 expires or is found to have already expired and timer T3242 is not running; or
- timers T3242 and T3243 expire or have found to have already expired.
The mobile station shall then stop other running timers (e.g. T3311, T3312) and shall:
- if the mobile station is also attached for non-GPRS services and the network operates in network operation mode
I, perform a combined GPRS detach procedure for GPRS and non-GPRS services;
- if the mobile station is also attached for non-GPRS services and the network operates in network operation mode
II, perform a GPRS detach procedure for GPRS services and an IMSI detach procedure; and
- if the mobile station is not attached for non-GPRS services, perform a GPRS detach procedure for GPRS
services.
The mobile station shall then enter MM Idle eCALL INACTIVE state, delete any LAI, TMSI, ciphering key sequence
number stored in the SIM/USIM, delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence
number stored, delete any GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs, KSI and set the update
state to U4 Updating Disabled.
While in eCALL INACTIVE state, the mobile station shall behave as specified in subclause 4.4.7.
5 Elementary procedures for circuit-switched Call

Control
5.1 Overview
5.1.1 General
This subclause describes the call control (CC) protocol, which is one of the protocols of the Connection Management
(CM) sublayer (see 3GPP TS 24.007 [20]).
Every mobile station must support the call control protocol. If a mobile station does not support any bearer capability at
all then it shall respond to a SETUP message with a RELEASE COMPLETE message as specified in subclause 5.2.2.2.
In Iu mode only, integrity protected signalling (see subclause 4.1.1.1.1 of the present document and in general, see
3GPP TS 33.102 [5a]) is mandatory. In Iu mode only, all protocols shall use integrity protected signalling. Integrity
protection of all CC signalling messages is the responsibility of lower layers. It is the network which activates integrity
protection. This is done using the security mode control procedure (3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
In the call control protocol, more than one CC entity are defined. Each CC entity is independent from each other and
shall communicate with the correspondent peer entity using its own MM connection. Different CC entities use different
transaction identifiers.
With a few exceptions the present document describes the call control protocol only with regard to two peer entities.
The call control entities are described as communicating finite state machines which exchange messages across the
ETSI
Release 18 269 3GPP TS 24.008 V18.4.0 (2023-09)
radio interface and communicate internally with other protocol (sub)layers. This description is only normative as far as
the consequential externally observable behaviour is concerned.
Certain sequences of actions of the two peer entities compose "elementary procedures" which are used as a basis for the
description in this subclause. These elementary procedures may be grouped into the following classes:
- call establishment procedures;
- call clearing procedures;
- call information phase procedures;
- miscellaneous procedures.
The terms "mobile originating" or "mobile originated" (MO) are used to describe a call initiated by the mobile station.
The terms "mobile terminating" or "mobile terminated" (MT) are used to describe a call initiated by the network.
Figure 5.1a/3GPP TS 24.008 gives an overview of the main states and transitions on the mobile station side.
The MS side extension figure 5.1a.1/3GPP TS 24.008 shows how for the Network Initiated MO call the MS reaches
state U1.0 from state U0 $(CCBS)$.
Figure 5.1a.2/3GPP TS 24.008 illustrates the additional state transitions possible in the MS due to SRVCC handovers
from PS to CS or 5G-SRVCC handover from NG-RAN to UTRAN.
Figure 5.1a.3/3GPP TS 24.008 illustrates the additional state transitions possible in the MS due to SRVCC handovers
from CS to PS.
Figure 5.1b/3GPP TS 24.008 gives an overview of the main states and transitions on the network side.
The Network side extension figure 5.1b.1/3GPP TS 24.008 shows for Network Initiated MO Calls the Network reaches
state N1.0 from state N0 $(CCBS)$.Figure 5.1b.2/3GPP TS 24.008 illustrates the additional state transitions possible in
the network due to SRVCC handovers from PS to CS or 5G-SRVCC handover from NG-RAN to UTRAN.
Figure 5.1b.3/3GPP TS 24.008 illustrates the additional state transitions possible in the network due to SRVCC
handovers from CS to PS.
ETSI
Release 18 270 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 5.1a/3GPP TS 24.008: Overview call control protocol/MS side
ETSI
Release 18 271 3GPP TS 24.008 V18.4.0 (2023-09)
U0
NULL
MMCC.PROMPT.IND
MNCC.PROMPT.IND
U0.2
PROMPT PRESENT
DR (START_CC)
U0.3
WAIT FOR NW INFO
DI (CC ESTABLISHMENT)
U0.4
CC-EST. PRESENT
DR (CC ESTABLISHMENT CONFIRMED)
U0.5
CC_EST. CONFIRMED
DI (RECALL)
MNCC.RECALL.IND
U0.6
RECALL_PRESENT
MNCC.SETUP.REQ
DR (SETUP)
U1
CALL INITIATED
Figure 5.1a.1/3GPP TS 24.008: Overview call control protocol/MS side, extension
ETSI
Release 18 272 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 5.1a.2/3GPP TS 24.008: Overview call control protocol/MS side, extension for SRVCC from PS
to CS or 5G-SRVCC handover from NG-RAN to UTRAN
Any state U0
except U0 NULL
Figure 5.1a.3/3GPP TS 24.008: Overview call control protocol/MS side, extension for SRVCC from CS
to PS
ETSI
Release 18 273 3GPP TS 24.008 V18.4.0 (2023-09)
ETSI
Release 18 274 3GPP TS 24.008 V18.4.0 (2023-09)
MMCC.EST.IND (SETUP) MNCC. SETUP REQ.

N0
NULL
MNCC.SETUP.IND. M MCC.EST. REQ.

(mobile ID)
N1 MMCC. EST. CNF.

CALL INIT N0.1 MM-CON-
NECTION PENDING
MNCC.REL.CNF.
MNCC. CALL. PROC. REQ MMCC.REL.REQ.
DR (SETUP)
DR (REL COM),
DI (REL COM) MNCC.REL.IND,
MMCC.REL.REQ.
N19 RELEASE N6
REQUEST CALL PRESENT
DR (CALL PROC)
DI (CALL CONF)
DR (REL)
MNCC.DISC.IND MNCC. CALL.
CONF.IND
DR (REL)
DI (REL)
DI (DISC)
N12 DISCON-
N3 MO CALL
MNCC ALERT REQ NECT INDICATION
MNCC. PROCEEDING
PROGRESS.
REQ. MNCC.
SETUP. RSP DI (DISC)
DR (ALERT) DR (DIS C) N9 M T CALL
DR (PROGRESS) DI (ALERT)
DI (CONN)_ CONFIRM ED
STATES N1, 3, 4,
7, 8, 9; 10, 28 MNCC. DISC. REQ.
N4 CALL MNCC.ALERT.IND.
DELIVERED
MNCC. SETUP. RSP MNCC.SETUP.CNF.

DR (CONN)
N7 CALL
DR (CONN) RECEIVED
MNCC. SETUP.
COMPL. IND. DR (CONN ACK) DI (CONN)
N28 CONNECT
DI (CONN ACK) M NCC. SETUP. MNCC.SETUP.CNF
INDICATION N10 N8 CONNECT
COMPL. REQ. REQUEST
NOTE: ACTIVE
DR(MESSAGE) = MM CC_DATA_REQ(MESSAGE)
DI (MESSAGE) = MMCC_DATA_IND (MESSAGE)
Figure 5.1b/3GPP TS 24.008 Overview call control protocol/Network side
ETSI
Release 18 275 3GPP TS 24.008 V18.4.0 (2023-09)
N0
NULL
MNCC.CC_CONN.REQ
MMCC.CC_CONN.REQ
N0.2
CC_CONN_PENDING
MMCC.EST.IND (START CC)

N0.3
NW_ANSWER_PENDING
DR (CC_ESTABLISH)
N0.4
CC-EST.PESENT
DI (CC_EST_CONF)
N0.5
CC_EST. CONFIRMED
DR (RECALL)
N0.6
RECALL_PRESENT
DI (SETUP)
N1
CALL_INITIATED
Figure 5.1b.1/3GPP TS 24.008 Overview call control protocol/Network side, extension
Figure 5.1b.2/3GPP TS 24.008: Overview call control protocol/Network side, extension for SRVCC
from PS to CS or 5G-SRVCC handover from NG-RAN to UTRAN
ETSI
Release 18 276 3GPP TS 24.008 V18.4.0 (2023-09)
Any state N0
except N0 NULL
Figure 5.1b.3/3GPP TS 24.008: Overview call control protocol/Network side, extension for SRVCC
from CS to PS
5.1.2 Call Control States
5.1.2.1 Call states at the mobile station side of the interface

The states which may exist on the mobile station side of the radio interface are defined in this subclause.
NOTE: States U0.1, U0.2, U0.3, U0.4, U0.5, U0.6, U26, and U27 are 3GPP specific. All other states are ITU-T
defined.
5.1.2.1.1 Null (State U0)

No call exists.
5.1.2.1.2 MM Connection pending (U0.1)

This state exists for a mobile originating call, when the mobile station requests the establishment of a MM connection.
5.1.2.1.2a CC prompt present (U0.2) $(CCBS)$

This state exists for a mobile originating call when the network has prompted the mobile station to establish a CC
connection but the mobile station has not yet responded.
NOTE: This state is transient.
5.1.2.1.2b Wait for network information (U0.3) $(CCBS)$

This state exists for a mobile originating call when the mobile station has responded to the prompt from the network to
establish a CC connection and the mobile station is waiting for further information from the network.
5.1.2.1.2c CC-Establishment present (U0.4) $(CCBS)$

This state exists for a mobile originating call when the mobile station has received a CC-establishment request but has
not yet responded.
5.1.2.1.2d CC-Establishment confirmed (U0.5) $(CCBS)$

This state exists for a mobile originating call when the mobile station has sent the acknowledgement that the mobile
station has received all the CC information that is needed.
5.1.2.1.2e Recall present (U0.6) $(CCBS)$

This state exists for a mobile originating call when the mobile station has received a recall request but has not yet
responded.
5.1.2.1.3 Call initiated (U1)

This state exists for a mobile originating call, when the MS requests call establishment from the network.
ETSI
Release 18 277 3GPP TS 24.008 V18.4.0 (2023-09)
5.1.2.1.4 Mobile originating call proceeding (U3)

This state exists for a mobile originating call when the mobile station has received acknowledgement that the network
has received all call information necessary to effect call establishment.
5.1.2.1.5 Call delivered (U4)

This state exists for a mobile originating call, when the calling mobile station has received an indication that remote
user alerting has been initiated.
5.1.2.1.6 Call present (U6)

This state exists for a mobile terminating call when the mobile station has received a call establishment request but has
not yet responded.
5.1.2.1.7 Call received (U7)

This state exists for a mobile terminating call when the mobile station has indicated alerting but has not yet answered.
5.1.2.1.8 Connect Request (U8)

This state exists for a mobile terminating call, when the mobile station has answered the call and is waiting to be
awarded the call.
5.1.2.1.9 Mobile terminating call confirmed (U9)

This state exists for a mobile terminating call when the mobile station has sent acknowledgement that the mobile station
5.1.2.1.10 Active (U10)

This state exists for a mobile terminating call when the MS has answered the call. This state exists for a mobile
originating call when the MS has received an indication that the remote user has answered the call.
5.1.2.1.11 Disconnect request (U11)

This state exists when the mobile station has requested the network to clear the end-to-end connection (if any) and is
waiting for a response.
5.1.2.1.12 Disconnect indication (U12)

This state exists when the mobile station has received an invitation to disconnect because the network has disconnected
the end-to-end connection (if any).
5.1.2.1.13 Release request (U19)

This state exists when the MS has requested the network to release and is waiting for a response.
5.1.2.1.14 Mobile originating modify (U26)

This state exists when the mobile station has sent a request to the network for a new mode but has not yet received an
answer.
5.1.2.1.15 Mobile terminating modify (U27)

This state exists when the mobile station has received a request from the network for a new mode and has not yet sent a
response to this request.
ETSI
Release 18 278 3GPP TS 24.008 V18.4.0 (2023-09)
5.1.2.2 Network call states

NOTE: States N0.1, N0.2, N0.3, N0.4, N0.5, N0.6, N26, N27, N28, N3a, N4,a, N7a, and N9a are 3GPP specific.
All other states are ITU-T defined.
The call states that may exist on the network side of the radio interface are defined in this subclause.
5.1.2.2.1 Null (State N0)

No call exists.
5.1.2.2.2 MM connection pending (N0.1)

This state exists for a mobile terminating call, when the network requests the establishment of a MM connection.
5.1.2.2.2a CC connection pending (N0.2) $(CCBS)$

This state exists for a mobile originating call when the network has requested the mobile station to establish a CC
connection.
5.1.2.2.2b Network answer pending (N0.3) $(CCBS)$

This state exists for a mobile originating call when the mobile station has established a CC connection upon the request
of the network, but the network has not yet informed the mobile station of the reason for the network's action.
5.1.2.2.2c CC-Establishment present (N0.4) $(CCBS)$

This state exists for a mobile originating call when the network has sent a CC establishment request but has not yet
received a satisfactory response.
5.1.2.2.2d CC-Establishment confirmed (N0.5) $(CCBS)$

This state exists for a mobile originating call when the network has received acknowledgement that the mobile station
5.1.2.2.2e Recall present (N0.6) $(CCBS)$

This state exists for a mobile originating call when the network has sent a recall request but has not yet received a
satisfactory response.
5.1.2.2.3 Call initiated (N1)

This state exists for a mobile originating call when the network has received a call establishment request but has not yet
responded.
5.1.2.2.4 Mobile originating call proceeding (N3)

This state exists for a mobile originating call when the network has sent acknowledgement that the network has
received all call information necessary to effect call establishment.
5.1.2.2.5 Call delivered (N4)

This state exists for a mobile originating call when the network has indicated that remote user alerting has been
initiated.
5.1.2.2.6 Call present (N6)

This state exists for a mobile terminating call when the network has sent a call establishment request but has not yet
received a satisfactory response.
ETSI
Release 18 279 3GPP TS 24.008 V18.4.0 (2023-09)
5.1.2.2.7 Call received (N7)

This state exists for a mobile terminating call when the network has received an indication that the mobile station is
alerting but has not yet received an answer.
5.1.2.2.8 Connect request (N8)

This state exists for a mobile terminating call when the network has received an answer but the network has not yet
awarded the call.
5.1.2.2.9 Mobile terminating call confirmed (N9)

This state exists for a mobile terminating call when the network has received acknowledgement that the mobile station
5.1.2.2.10 Active (N10)

This state exists for a mobile terminating call when the network has awarded the call to the called mobile station. This
state exists for a mobile originating call when the network has indicated that the remote user has answered the call.
5.1.2.2.11 Not used
5.1.2.2.12 Disconnect indication (N12)

This state exists when the network has disconnected the end- to-end connection (if any) and has sent an invitation to
disconnect the mobile station to network connection.
5.1.2.2.13 Release request (N19)

This state exists when the network has requested the MS to release and is waiting for a response.
5.1.2.2.14 Mobile originating modify (N26)

This state exists when the network has received a request from the mobile station for a new mode but has not yet sent a
response.
5.1.2.2.15 Mobile terminating modify (N27)

This state exists when the network has sent a request to the mobile station for a new mode but has not yet received an
answer.
5.1.2.2.16 Connect Indication (N28)

This state exists for a mobile originating call when the network has indicated that the remote user has answered the call
and the network is waiting for acknowledgement by the mobile station.
5.2 Call establishment procedures

Establishment of a call is initiated by request of upper layer in either the mobile station or the network; it consists of:
- the establishment of a CC connection between the mobile station and the network;
- the activation of the codec or interworking function.
Whenever it is specified in the present document clause 5 that the mobile station shall attach the user connection, this
means that the mobile station shall activate the codec or interworking function as soon as an appropriate channel is
available. The mobile station shall de-activate the codec or interworking function whenever an appropriate channel is no
longer available. As soon as an appropriate channel is (again) available, the codec or interworking function shall be re-
activated. If a new order to attach the user connection is received, the new order shall supersede the previous one.
ETSI
Release 18 280 3GPP TS 24.008 V18.4.0 (2023-09)
A channel shall be considered as appropriate if it is consistent with the possibly negotiated bearer capability applicable
for the actual phase of the call. The mobile station shall not consider a channel as not appropriate because the type of
the channel (full rate/half rate) is not the preferred one. If:
- the user connection has to be attached but no appropriate channel is available for a contiguous time of 30
seconds; or if
- the codec or interworking function is de-activated for a contiguous time of 30 seconds;
then the mobile station may initiate call clearing.
Upon request of upper layers to establish a call, restricting conditions for the establishment of the call are examined.
These restricting conditions concern the states of parallel CC entities and are defined elsewhere. If these restricting
conditions are fulfilled, the call establishment is rejected. Otherwise a CC entity in state U0, "null", is selected to
establish the call. It initiates the establishment by requesting the MM sublayer to establish an MM connection.
In Iu mode, if the lower layers indicate the release of a radio access bearer, whereas the corresponding call is still active,
the MS shall not automatically initiate the release of that call.
5.2.1 Mobile originating call establishment

The call control entity of the mobile station initiates establishment of a CC connection by requesting the MM sublayer
to establish a mobile originating MM connection and entering the "MM connection pending" state. There are two kinds
of a mobile originating call: basic call and emergency call. The request to establish an MM connection shall contain a
parameter to specify whether the call is a basic or an emergency call. This information may lead to specific qualities of
services to be provided by the MM sublayers. Timer T303 is started when the CM SERVICE REQUEST message is
sent.
For mobile stations supporting eMLPP basic calls may optionally have an associated priority level as defined in
3GPP TS 23.067 [88]. This information may also lead to specified qualities of service to be provided by the MM
sublayers.
While being in the "MM connection pending" state, the call entity of the mobile station may cancel the call prior to
sending the first call control message according to the rules given in subclause 4.5.1.7.
The mobile station supporting multicall that is initiating an emergency call shall release one or more existing call to
ensure the emergency call can be established if the multicall supported information stored in the mobile station
described in subclauses 5.2.1.2 and 5.2.2.1 indicates the network does not support multicall and some ongoing calls
exists.
Having entered the "MM connection pending" state, upon MM connection establishment, the call control entity of the
mobile station sends a setup message to its peer entity. This setup message is:
- a SETUP message, if the call to be established is a basic call, and
- an EMERGENCY SETUP message, if the call to be established is an emergency call.
NOTE 1: The Extended Local Emergency Numbers List (see 3GPP TS 24.301 [120]) does not apply in this
specification.
The mobile station then enters the "call initiated" state. Timer T303 is not stopped.
The setup message shall contain all the information required by the network to process the call. In particular, the:
- SETUP message shall contain the called party address information;
- EMERGENCY SETUP message shall contain the emergency category, if the emergency category is available at
the MS.
If the mobile station supports multicall, it shall include the Stream Identifier (SI) information element. For the first call
i.e. when there are no other ongoing calls the SI value shall be 1.
For speech calls the mobile station shall indicate all codecs that it supports for UTRAN in the Supported Codec List
information element. Codecs for GERAN shall be indicated in the Bearer Capability information element, if this
ETSI
Release 18 281 3GPP TS 24.008 V18.4.0 (2023-09)
information element is included. Additionally, if the mobile station supports codecs for GERAN and UTRAN, it shall
indicate the codecs for GERAN also in the Supported Codec List information element.
If the call is a redial attempt to switch from speech to multimedia or vice-versa, the SETUP message shall include the
Redial information element.
NOTE 2: Redial attempt is defined in 3GPP TR 23.903: "Redial solution for voice-video switching"[115].
If the MS supports the enhanced network-initiated in-call modification procedure as specified in subclause 5.3.4.3, the
MS shall indicate this in the Call Control Capabilities IE in the SETUP message.
If timer T303 elapses in the "MM connection pending" state, the MM connection in progress shall be aborted and the
user shall be informed about the rejection of the call.
5.2.1.1 Call initiation

The "call initiated" state is supervised by timer T303.For normal MO calls, this timer will have already been started
after entering the "MM connection pending" state. For network-initiated MO calls this timer will be started in the recall
present state as defined in subclause 5.2.3.4
When the call control entity of the mobile station is in the "call initiated" state and if it receives:
i) a CALL PROCEEDING message, it shall proceed as described in subclause 5.2.1.3;
ii) an ALERTING message, it shall proceed as described in subclause 5.2.1.5;
iii) a CONNECT message, it shall proceed as described in subclause 5.2.1.6;
iv) a RELEASE COMPLETE message it shall proceed as described in subclause 5.2.1.2.
Abnormal case:
- If timer T303 elapses in the "call initiated" state before any of the CALL PROCEEDING, ALERTING,
CONNECT or RELEASE COMPLETE messages has been received, the clearing procedure described in
subclause 5.4 is performed.
5.2.1.2 Receipt of a setup message

In the "null" or "recall present" states, upon receipt of a setup message (a SETUP message or an EMERGENCY SETUP
message, see subclause 5.2.1.1), the call control entity of the network enters the "call initiated" state. It shall then
analyse the call information contained in the setup message.
In Iu mode, network shall include the SI received in the SETUP message into the RABid and send it back to the mobile
station. For RABid see 3GPP TS 25.413 [19c] and 3GPP TS 44.118 [111]. If the network receives the SETUP message
with no SI, the network shall set the SI value to 1.
i) If, following the receipt of the setup message, the call control entity of the network determines that the call
information received from the mobile station is invalid (e.g. invalid number), then the network shall initiate call
clearing as defined in subclause 5.4 with one of the following cause values:
#1 "unassigned (unallocated) number",
#3 "no route to destination",
# 22 "number changed",
# 28 "invalid number format (incomplete number)".
ii) If, following the receipt of the setup message, the call control entity of the network determines that a requested
service is not authorized or is not available, it shall initiate call clearing in accordance with subclause 5.4.2 with
one of the following cause values:
#8 "operator determined barring",
# 57 "bearer capability not authorized",
ETSI
Release 18 282 3GPP TS 24.008 V18.4.0 (2023-09)
# 58 "bearer capability not presently available",
# 63 "service or option not available, unspecified", or
# 65 "bearer service not implemented".
iii) Otherwise, the call control entity of the network shall either:
- send a CALL PROCEEDING message to its peer entity to indicate that the call is being processed; and enter
the "mobile originating call proceeding" state;
- or: send an ALERTING message to its peer entity to indicate that alerting has been started at the called user
side; and enter the "call received" state;
- or: send a CONNECT message to its peer entity to indicate that the call has been accepted at the called user
side; and enter the "connect request" state.
The call control entity of the network may insert bearer capability information element(s) in the CALL
PROCEEDING message to select options presented by the mobile station in the Bearer Capability information
element(s) of the SETUP message. The bearer capability information element(s) shall contain the same
parameters as received in the SETUP except those presenting a choice. Where choices were offered, appropriate
parameters indicating the results of those choices shall be included.
The CALL_PROCEEDING message shall also contain the priority of the call in the case where the network
supports eMLPP. Mobile stations supporting eMLPP shall indicate this priority level to higher sublayers and
store this information for the duration of the call for further action. Mobile stations not supporting eMLPP shall
ignore this information element if provided in a CALL PROCEEDING message.
NOTE: If the network supports only R98 or older versions of this protocol and the priority is not included in the
CALL PROCEEDING message, this does not imply that the network does not support eMLPP.
- The CALL_PROCEEDING message shall contain the multicall supported information in the network call
control capabilities in the case where the network supports multicall and there are no other ongoing calls to the
MS. Mobile stations supporting multicall shall store this information until the call control state for all calls
returns to null. Mobile stations not supporting multicall shall ignore this information if provided in a CALL
PROCEEDING message. If the multicall supported information is not sent in the CALL_PROCEEDING
message, the mobile station supporting multicall shall regard that the network doesn't support multicall.
The call control entity of the network having entered the "mobile originating call proceeding" state, the network may
initiate the assignment of a traffic channel according to subclause 5.2.1.9 (early assignment).
For speech calls, if the SETUP message or EMERGENCY SETUP message contains a Supported Codec List
information element, the network shall use this list to select the codec for UTRAN. If no Supported Codec List
information element is received, then for UTRAN the network shall select the default UMTS speech codec according to
subclause 5.2.1.11.
Codecs for GERAN shall be selected from the codecs indicated in the Supported Codec List information element or in
the Bearer Capability information element. If neither a Supported Codec List information element nor a Bearer
Capability information element is received, then for GERAN the network shall select GSM full rate speech version 1.
Codec information that does not apply to the currently serving radio access shall be used by the network if an inter-
system change occurs.
ETSI
Release 18 283 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 5.2/3GPP TS 24.008 Mobile originated call initiation and possible subsequent responses.
5.2.1.3 Receipt of a CALL PROCEEDING message

Having entered the "call initiated" state, when the call control entity of the mobile station receives a CALL
PROCEEDING message, it shall stop timer T303; start timer T310 unless
- the CALL PROCEEDING message contains a progress indicator IE specifying progress description #1, #2, or
#64; or
- it has received a PROGRESS message containing a progress indicator IE specifying progress description #1, #2,
or #64 prior to the CALL PROCEEDING message
and enter the "mobile originating call proceeding" state.
Abnormal case:
If timer T310 elapses before any of the ALERTING, CONNECT or DISCONNECT messages has been
received, the mobile station shall perform the clearing procedure described in subclause 5.4.
Figure 5.3/3GPP TS 24.008 Call proceeding sequence at mobile originating call establishment
5.2.1.4 Notification of progressing mobile originated call

In this subclause, the term "interworking" is used only in the meaning of interworking with a network other than PLMN
or ISDN, not as interworking between PLMN and ISDN since this is the normal case. In this sense, PLMN and ISDN
are seen within the same environment, called the PLMN/ISDN environment.
5.2.1.4.1 Notification of interworking in connection with mobile originated call establishment

During call establishment, the call may leave a PLMN/ISDN environment; e.g., because of interworking with another
network, with a non-PLMN/ISDN user, or with non-PLMN/ISDN equipment within the called user's premises; the call
may also return to a PLMN/ISDN environment. When such situations occur, the network may send a progress indicator
information element to the calling mobile station either:
a) in an appropriate call control message, if a state change is required (e.g. ALERTING or CONNECT); or,
b) in the PROGRESS message, if no state change is appropriate.
This progress indicator information element shall contain one of the following progress description values:
ETSI
Release 18 284 3GPP TS 24.008 V18.4.0 (2023-09)
a) #1 "call is not end-to-end PLMN/ISDN; further call progress information may be available in-band".
b) #2 "destination address is non-PLMN/ISDN".
c) #4 "call has returned to PLMN/ISDN.
See also subclauses 5.5.1 and 5.5.6 for further reactions of the mobile station.
5.2.1.4.2 Call progress in the PLMN/ISDN environment

In order to inform the mobile station that the call is progressing in the PLMN/ISDN environment the network may send
a progress indicator information element to the calling mobile station either:
a) in an appropriate call control message, if a state change is required (e.g., ALERTING or CONNECT); or
b) in the PROGRESS message, if no state change is appropriate.
This progress indicator information element shall contain progress description value #32 "Call is end-to-end
ISDN/PLMN". See also subclause 5.5.6 for further reactions of the mobile station.
5.2.1.5 Alerting
Having entered the "mobile originating call proceeding" state, upon receiving an indication that user alerting has been
initiated at the called address, the call control entity of the network shall: send an ALERTING message to its peer entity
at the calling mobile station and enter the "call delivered" state.
When the call control entity of the mobile station in the "call initiated" state or "mobile originating call proceeding"
state receives an ALERTING message then, the call control entity of the mobile station shall stop timer T303 and T310
(if running) and shall enter the "call delivered" state. In this state:
- for speech calls: an alerting indication should be given to the user. If the mobile station has not attached the user
connection then the mobile station shall internally generate an alerting indication. If the mobile station has
attached the user connection then the network is responsible for generating the alerting indication and the mobile
station need not generate one; and
- for multimedia calls: if the mobile station has not attached the user connection then the mobile station may
internally generate an alerting indication. If the mobile station supports multimedia CAT during the alerting
phase of a mobile originated multimedia call establishment, the network may request the mobile station to attach
the user connection and setup a H.324 call and generate multimedia CAT as specified in subclause 5.3.6.4, in
which case the mobile station need not generatean alerting tone.
Abnormal cases:
On the mobile station side, if timer T303 or T310 expires, the call control entity of the mobile station shall
initiate call clearing as described in subclause 5.4.
Figure 5.4/3GPP TS 24.008 Call confirmation at mobile originating call establishment
5.2.1.6 Call connected

Upon receiving an indication that the call has been accepted, the call control entity of the network shall: through
connect the traffic channel (including the connection of an interworking function, if required) and send a CONNECT
message to its peer entity at the calling mobile station; start timer T313 and enter the "connect indication" state.
This message indicates to the call control entity of the calling mobile station that a connection has been established
through the network.
ETSI
Release 18 285 3GPP TS 24.008 V18.4.0 (2023-09)
The call control entity of the mobile station in the "call initiated" state, in the "mobile originating call proceeding" state
or in the "call delivered" state, shall, upon receipt of a CONNECT message:
- attach the user connection;
- return a CONNECT ACKNOWLEDGE message;
- stop any locally generated alerting indication (if applied);
- clear any H.324 call established to receive multimedia CAT during the alerting phase (if applied) , as specified in
subclause 5.3.6.4
- stop timer T303 and T310 (if running);
- enter the "active" state.
Abnormal cases:
On the mobile station side, if timer T303 or T310 expires, the call control entity of the mobile station shall
initiate call clearing as described in subclause 5.4.
NOTE: The mobile station may have applied an additional internal alerting supervision which causes initiation of
call clearing prior to the expiry of T303 or T310.
The call control of the network in the "connect indication" state, shall, upon receipt of a CONNECT ACKNOWLEDGE
message:
- stop timer T313 and enter the "active" state.
Abnormal cases:
On the network side, if timer T313 elapses before a CONNECT ACKNOWLEDGE message has been received,
the network shall perform the clearing procedure as described in subclause 5.4.
Figure 5.5/3GPP TS 24.008 Call acceptance sequence at mobile originating call establishment
5.2.1.7 Call rejection

Upon receiving an indication that the network or the called user is unable to accept the call, the network shall initiate
call clearing at the radio interface to the mobile which originated the call, as described in subclause 5.4 using the cause
provided by the terminating network or the called user.
5.2.1.8 Transit network selection

NOTE: For further study.
5.2.1.9 Traffic channel assignment at mobile originating call establishment

The mobile station supporting multicall includes the Stream Identifier (SI) in the SETUP message. The multicall
supporting network shall interprets the SI value as follows:
a) Mobile station generates a new SI value at the initiation of an originating call, then a new traffic channel shall be
assigned to the mobile originating call.
b) Mobile station indicates an existing SI value, then the indicated traffic channel shall be used for the mobile
originating call.
ETSI
Release 18 286 3GPP TS 24.008 V18.4.0 (2023-09)
Mobile station supporting multicall shall never send an additional SETUP with indication that a new traffic channel is
requested to a network that does not support multicall.
It is a network dependent decision when to initiate the assignment of an appropriate traffic channel during the mobile
originating call establishment phase. Initiation of a suitable RR procedure to assign an appropriate traffic channel does
neither change the state of a call control entity nor affect any call control timer.
NOTE: During certain phases of such an RR procedure, transmission of CC and MM messages may be
suspended, see 3GPP TS 44.018 [84], clause 3 and 3GPP TS 48.008 [85].
The assignment procedure does not affect any call control timer.
5.2.1.10 Call queuing at mobile originating call establishment

If an idle traffic channel is not available at the assignment instant, the network may place the traffic channel request in a
queue. Calls arriving when all positions in the queue are occupied shall be cleared by the network using the cause #34
"no circuit/channel available".
The maximum queuing interval is supervised by the network. The limit is a network dependent choice. In case the
network is not able to allocate a traffic channel within the queuing limit, the network will release the call using cause
#34 "no circuit/channel available".
Optionally, e.g. if eMLPP is used, the network may decide to pre-empt existing calls or to place the traffic channel
request at some preferential position within the queue.
Specific indications provided in the network to the remote user are a network dependent choice.
5.2.1.11 Speech Codec Selection

For speech calls, a mobile station implementing this version of the protocol shall indicate all codecs that it supports for
UTRAN in the Supported Codec List information element. Codecs for GERAN shall be indicated in the Bearer
Capability information element, if this information element is included. Additionally, if the mobile station supports
codecs for GERAN and UTRAN, it shall indicate the codecs for GERAN also in the Supported Codec List information
element.
If the network does not receive a Supported Codec List information element then for speech calls in UTRAN it shall
select the default UMTS speech codec.
For speech calls in GERAN, if the network does not receive a Supported Codec List information element nor a Bearer
Capability information element, the network shall select GSM full rate speech version 1.
The network shall determine the default UMTS speech codec by the following:
i) If no GSM Speech Version codepoints are received in the Supported Codec List IE or in octet 3a etc. of the
Bearer Capabilities IE then a "UMTS only" terminal is assumed and the default UMTS speech codec shall be
UMTS_AMR.
ii) If at least one GSM Speech Version codepoint is received in the Supported Codec List IE or in octet 3a etc. of
the Bearer Capabilities IE then the ME supports GSM and UMTS and the default UMTS speech codec shall be
UMTS_AMR_2.
NOTE 1: In case (ii), if the call is set up in A/Gb or GERAN Iu mode by a R99 ME, call control in the core
network may treat the ME as a "GSM only" ME. The default UMTS speech codec will only become
relevant when an intersystem handover to UTRAN Iu mode is initiated by the radio access network, and
can be determined when this procedure is started.
If the Supported Codec List IE is received, then the network shall use this list to select the codec for Iu mode and
indicate the selected codec to the ME via RANAP and RRC protocol in the NAS Synchronisation Indicator IE. See
3GPP TS 25.413 [19c], 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111].
The NAS Synchronisation Indicator IE shall be coded as the 4 least significant bits of the selected codec type (CoID)
defined in 3GPP TS 26.103 [83], subclause 6.3.
ETSI
Release 18 287 3GPP TS 24.008 V18.4.0 (2023-09)
The network shall determine the preference for the selected codec type; codec type prioritisation is not provided by the
ME.
The ME shall activate the codec type received in the NAS Synchronisation Indicator IE.
If the mobile station does not receive the NAS Synchronisation Indicator IE (RRC protocol)
- during setup of a speech call;
- during inter-system handover of a speech call from A/Gb or GERAN Iu mode to UTRAN Iu mode;
- during an in-call modification from data to speech;
- during a SRVCC handover to UTRAN Iu mode; or
- during a 5G-SRVCC handover from NG-RAN to UTRAN Iu mode,
then it shall select the UMTS_AMR_2 speech codec.
NOTE 2: If the network does not support UMTS_AMR_2, it may activate the UMTS_AMR codec and indicate to
the mobile station that it shall select UMTS_AMR_2. According to 3GPP TS 26.103 [83], subclause 5.4,
no interworking problem will occur in this case.
If the mobile station has selected a speech codec for UTRAN Iu mode, it shall keep this codec until
- a new codec is requested by the network by sending a NAS Synchronisation Indicator IE (RRC protocol);
- a new codec is requested by the network during inter-system handover from UTRAN Iu mode to A/Gb or
GERAN Iu mode; or
- an in-call modification from speech to data is performed.
For adaptive multirate codec types no indication of subsets of modes is supported in this protocol, from the mobile
station or to the mobile station. It is a pre-condition that the support of such codec types by the mobile station implicitly
includes all modes defined for that codec type.
5.2.1.12 Cellular Text telephone Modem (CTM) selection

The mobile station can send a CTM support indication in the Bearer Capability IE in call establishment messages to
inform the network of the use of CTM text in the call.
When the mobile station indicates speech and support of CTM text telephony, the network shall select a speech codec
and additionally CTM text telephony detection/conversion functions as specified in 3GPP TS 23.226 [92] and
3GPP TS 26.226 [93], if such functions are available.
NOTE: If CTM support is indicated by the mobile station, then it supports CTM text telephony together with any
supported speech codec and for any supported radio access.
5.2.2 Mobile terminating call establishment

Before call establishment can be initiated in the mobile station, the MM connection must be established by the network.
5.2.2.1 Call indication

After the arrival of a call from a remote user, the corresponding call control entity in the network shall: initiate the MM
connection establishment according to clause 4 and enter the "MM connection pending" state. The request to establish
the MM connection is passed from the CM sublayer to the MM sublayer. It contains the necessary routing information
derived from the SETUP message.
Upon completion of the MM connection, the call control entity of the network shall: send the SETUP message to its
peer entity at the mobile station, start timer T303 and enter the "call present" state.
The SETUP message shall contain the multicall supported information in the network call control capabilities in the
case where the network supports multicall and there are no other ongoing calls to the MS. Mobile stations supporting
ETSI
Release 18 288 3GPP TS 24.008 V18.4.0 (2023-09)
multicall shall store this information until the call control state for all calls returns to null. Mobile stations not
supporting multicall shall ignore this information if provided in a SETUP message. If the multicall supported
information is not sent in the SETUP message, the mobile station supporting multicall shall regard that the network
does not support multicall.
Upon receipt of a SETUP message, the mobile station shall perform compatibility checking as described in
subclause 5.2.2.2. If the result of the compatibility checking was compatibility, the call control entity of the mobile
station shall enter the "call present" state. An incompatible mobile station shall respond with a RELEASE COMPLETE
message in accordance with subclause 5.2.2.3.4.
If there are no bearer capability IEs in the SETUP message, the network may provide information about the requested
service in the backup bearer capability IE.
If no response to the SETUP message is received by the call control entity of the network before the expiry of timer
T303, the procedures described in subclause 5.2.2.3.3 shall apply.
Figure 5.6/3GPP TS 24.008 Mobile terminating call initiation and possible subsequent responses.
5.2.2.2 Compatibility checking

The mobile station receiving a SETUP message shall perform compatibility checking before responding to that SETUP
message. Annex B defines compatibility checking to be performed by the mobile station upon receiving a SETUP
message. For a backup bearer capability IE received with a SETUP message the mobile station shall not perform
compatibility checking as described in annex B.
5.2.2.3 Call confirmation
5.2.2.3.1 Response to SETUP

Having entered the "call present state" the call control entity of the mobile station shall - with the exception of the cases
described below - acknowledge the SETUP message by a CALL CONFIRMED message, and enter the "mobile
terminating call confirmed" state.
If the mobile station supports multicall, it shall include the Stream Identifier (SI) information element in the CALL
CONFIRMED message.
If the mobile station is located in the network supporting multicall, it shall never include the SI that is in use and
shall include with either of the following two values:
- SI="no bearer";
- SI=new value (not used by any of the existing bearers).
If the mobile station supporting multicall is located in the network not supporting multicall, it shall include the SI with
value 1.
The call control entity of the mobile station may include in the CALL CONFIRMED message to the network one or
two bearer capability information elements to the network, either preselected in the mobile station or corresponding to a
service dependent directory number (see 3GPP TS 29.007 [38]). The mobile station may also use the backup bearer
capability IE, if provided by the network, to deduce the requested service (see 3GPP TS 27.001 [36], subclause 8.3.3.1).
ETSI
Release 18 289 3GPP TS 24.008 V18.4.0 (2023-09)
The mobile station may also include one or two bearer capabilities in the CALL CONFIRMED message to define the
radio channel requirements. In any case the rules specified in subclause 9.3.2.2 shall be followed.
NOTE: The possibility of alternative responses (e.g., in connection with supplementary services) is for further
study.
information element. Codecs for GERAN shall be indicated in the Bearer Capability information element, if this
information element is included. Additionally, if the mobile station supports codecs for GERAN and UTRAN, it shall
indicate the codecs for GERAN also in the Supported Codec List information element.
If the MS supports the enhanced network-initiated in-call modification procedure as specified in subclause 5.3.4.3, the
MS shall indicate this in the Call Control Capabilities IE in the CALL CONFIRMED message.
A busy MS which satisfies the compatibility requirements indicated in the SETUP message shall respond either with a
CALL CONFIRMED message if the call setup is allowed to continue or a RELEASE COMPLETE message if the call
setup is not allowed to continue, both with cause #17 "user busy".
If the mobile user wishes to refuse the call, a RELEASE COMPLETE message shall be sent with the cause #21 "call
rejected".
In the cases where the mobile station responds to a SETUP message with RELEASE COMPLETE message the mobile
station shall release the MM connection and enter the "null" state after sending the RELEASE COMPLETE message.
The network shall process the RELEASE COMPLETE message in accordance with subclause 5.4.
5.2.2.3.2 Receipt of CALL CONFIRMED and ALERTING by the network

The call control entity of the network in the "call present" state, shall, upon receipt of a CALL CONFIRMED message:
stop timer T303, start timer T310 and enter the "mobile terminating call confirmed" state.
In Iu mode, network shall include the SI received in the CALL CONFIRMED message into the RABid and send it back
to the mobile station. For RABid see 3GPP TS 25.413 [19c] and 3GPP TS 44.118 [111]. If the network receives the
CALL CONFIRMED message with no SI, the network shall set the SI value to 1.
For speech calls, if the CALL CONFIRMED message contains a Supported Codec List information element, the
network shall use this list to select the codec for UTRAN. If no Supported Codec List information element is received,
then for UTRAN the network shall select the default UMTS speech codec according to subclause 5.2.1.11.
The call control entity of the mobile station having entered the "mobile terminating call confirmed" state, if the call is
accepted at the called user side, the mobile station proceeds as described in subclause 5.2.2.5. Otherwise, if the signal
information element was present in the SETUP message user alerting is initiated at the mobile station side; if the signal
information element was not present in the SETUP message, user alerting is initiated when an appropriate channel is
available.
Here, initiation of user alerting means:
- the generation of an appropriate tone or indication at the mobile station; and
- sending of an ALERTING message by the call control entity of the MS to its peer entity in the network and
entering the "call received" state.
The call control entity of the network in the "mobile terminated call confirmed" state shall, upon receipt of an
ALERTING message: send a corresponding ALERTING indication to the calling user; stop timer T310; start timer
T301, and enter the "call received" state.
In the "mobile terminating call confirmed" state or the "call received" state, if the user of a mobile station is User
Determined User Busy then a DISCONNECT message shall be sent with cause #17 "user busy". In the "mobile
ETSI
Release 18 290 3GPP TS 24.008 V18.4.0 (2023-09)
terminating call confirmed" state, if the user of a mobile station wishes to reject the call then a DISCONNECT message
shall be sent with cause #21 "call rejected".
5.2.2.3.3 Call failure procedures

In case of abnormal behaviour the following call failure procedures apply:
i. If the network does not receive any response to the SETUP message prior to the expiration of timer T303, then
the network shall: initiate clearing procedures towards the calling user with cause #18 "no user responding"; and
initiate clearing procedures towards the called mobile station in accordance with subclause 5.4.4 using cause
#102 "recovery on timer expiry".
ii. If the network has received a CALL CONFIRMED message, but does not receive an ALERTING, CONNECT
or DISCONNECT message prior to the expiration of timer T310, then the network shall:
- initiate clearing procedures towards the calling user with cause #18 "no user responding"; and
- initiate clearing procedures towards the called MS in accordance with subclause 5.4.4 using cause #102
"recovery on timer expiry".
iii. If the network has received an ALERTING message, but does not receive a CONNECT or DISCONNECT
message prior to the expiry of timer T301 (or a corresponding internal alerting supervision timing function), then
the network shall: initiate clearing procedures towards the calling user with cause #19 "user alerting, no answer";
and initiate clearing procedures towards the called mobile station in accordance with subclause 5.4.4, using
cause #102 "recovery on timer expiry" or using cause #31 "normal, unspecified".
NOTE: The choice between cause #31 and cause #102 may have consequences on indications generated by the
mobile station, see 3GPP TS 22.001 [8a].
5.2.2.3.4 Called mobile station clearing during mobile terminating call establishment
See subclause 5.4.2.
5.2.2.4 Notification of interworking in connection with mobile terminating call

establishment
In this subclause, the term "interworking" is used only in the meaning of interworking with a network other than PLMN
or ISDN, not as interworking between PLMN and ISDN since this is the normal case. In this sense, PLMN and ISDN
are seen within the same environment, called the PLMN/ISDN environment.
During call establishment the call may enter an PLMN/ISDN environment, e.g., because of interworking with another
network, with a non-PLMN/ISDN user, or with non-PLMN/ISDN equipment within the calling or called user's
premises. When this occurs, the network may include a progress indicator information element to be included in the
SETUP message to be sent to the called mobile station specifying progress description value:
a) #1 "call is not end-to-end PLMN/ISDN; further call progress information may be available in-band" or
b) #3 "origination address is non-PLMN/ISDN".
See also subclause 5.5.1 for further reactions of the mobile station.
5.2.2.5 Call accept

In the "mobile terminating call confirmed" state or the "call received" state, the call control entity in the mobile station
indicates acceptance of a mobile terminating call by:
- sending a CONNECT message to its peer entity in the network;
- starting Timer T313; and
- entering the "connect request" state.
ETSI
Release 18 291 3GPP TS 24.008 V18.4.0 (2023-09)
If the call control entity of the mobile station has indicated "No Bearer" as the SI value in the CALL CONFIRMED
message, it shall assign the SI value and include the SI information element in the CONNECT message. Otherwise the
SI information element shall not be included in the CONNECT message.
5.2.2.6 Active indication

In the "mobile terminated call confirmed" state or in the "call received" state, the call control entity of the network shall,
upon receipt of a CONNECT message: through connect the traffic channel (including the connection of an interworking
function, if required), stop timers T310, T303 or T301 (if running); send a CONNECT ACKNOWLEDGE message to
its peer entity at the mobile station of the called user; initiate procedures to send a CONNECT message towards the
calling user and enter the "active" state.
In the "connect request" state, the call control entity of the mobile station shall, upon receipt of a CONNECT
ACKNOWLEDGE message: stop timer T313 and enter the "active" state.
When timer T313 expires prior to the receipt of a CONNECT ACKNOWLEDGE message, the mobile station shall
initiate clearing in accordance with subclause 5.4.3.
Figure 5.7/3GPP TS 24.008 Call acceptance and active indication at mobile terminating call
establishment
5.2.2.7 Traffic channel assignment at mobile terminating call establishment

After receiving the SETUP message, the mobile station supporting multicall may either require a new traffic channel or
reuse an existing traffic channel.
If a mobile station in the network supporting multicall requires a new traffic channel, it shall:
- send a CALL CONFIRMED message including the SI indicating a new value, not used by any of the existing
traffic channels.
If a mobile station in the network supporting multicall does not require a new traffic channel, it shall:
- send a CALL CONFIRMED message including the SI equal to "no bearer".
After the mobile station has send the CALL CONFIRMED with SI="no bearer", the SI value in the CONNECT
message will tell to the network if a user requests a new traffic channel or one of the existing ones will be re-uesd.
If a new traffic channel is requested by the user, the mobile station in the network supporting multicall shall:
- send a CONNECT message containing the SI with a new value, not used by any existing traffic channel.
If the user decides that an existing traffic channel will be reused, the mobile station in the network supporting multicall
shall:
- send a CONNECT message with an SI indicating an existing value used by an existing traffic channel.
It is a network dependent decision when to initiate the assignment of a traffic channel during the mobile terminating call
establishment phase.
Initiation of the assignment phase does not directly change the state of a CC entity nor affect any call control timer, but
may have some secondary effects (see e.g. subclause 5.2.2.3.2).
5.2.2.8 Call queuing at mobile terminating call establishment

The principles described in subclause 5.2.1.10 apply accordingly.
ETSI
Release 18 292 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE: The interworking to the fixed network has to fulfil the network specific requirements.
5.2.2.9 User connection attachment during a mobile terminating call

For speech calls:
The mobile station shall attach the user connection at latest when sending the connect message.
For data calls:
The mobile station shall attach the user connection when receiving the CONNECT ACKNOWLEDGE message
from the network.
5.2.2.10 Speech Codec Selection

5.2.2.11 Cellular Text telephone Modem (CTM) selection

5.2.3 Network initiated MO call $(CCBS)$

The procedures of subclause 5.2.3 are mandatory for mobile stations supporting "Network initiated MO call".
NOTE: The behaviour of a mobile station that does not support "Network initiated MO call" is described in
clause 4.
5.2.3.1 Initiation
Before call establishment can be initiated in the mobile station, the MM connection shall be established by the network.
After the arrival of an appropriate stimulus (for example a Remote User Free Indication), the corresponding call control
entity in the network shall initiate the MM connection establishment according to clause 4, enter the "CC connection
pending" state and start timer T331. The request to establish the MM connection is passed from the CM sublayer to the
MM sublayer. It contains the necessary routing information derived from the received stimulus.
Upon completion of the MM connection, the call control entity of the mobile station shall send a START CC message
to its peer entity in the network. The mobile station shall then enter the "Wait for network information" state and start
timer T332.
If the network receives a START CC message while in the "CC connection pending" state, the network stops T331,
sends the CC-ESTABLISHMENT message, starts timer T333 and enters the "CC-establishment present" state.
The MM connection establishment may be unsuccessful for a variety of reasons, in which case the MM sublayer in the
network will inform the CC entity in the network with an indication of the reason for the failure. The CC entity shall
then stop all running timers, enter the "Null" state and inform all appropriate entities within the network.
If timer T331 expires, the network shall abort the MM connection establishment attempt, stop all running CC timers,
enter the "Null" state and inform all appropriate entities within the network.
5.2.3.2 CC-Establishment present

In the "CC establishment present" state, the mobile station, upon receipt of the CC-ESTABLISHMENT message, shall
stop timer T332.
The CC-ESTABLISHMENT message contains information which the mobile station shall use for the subsequent
SETUP message (if any) related to this CC-ESTABLISHMENT.
The CC-ESTABLISHMENT message shall contain the Setup Container IE.
ETSI
Release 18 293 3GPP TS 24.008 V18.4.0 (2023-09)
If no CC-ESTABLISHMENT message is received by the call control entity of the mobile station before the expiry of
timer T332, then the mobile station shall initiate clearing procedures towards the network using a RELEASE
COMPLETE message with cause #102 "recovery on timer expiry" and proceed in accordance with subclause 5.4.2.
Upon receipt of a CC-ESTABLISHMENT message the mobile station shall perform checks on the Setup Container IE
in order to align the contained information with the mobile's present capabilities and configuration. The "recall
alignment procedure" is defined later on in this subclause.
If the recall alignment procedure has succeeded, the call control entity of the Mobile Station shall:
- form and store the SETUP message for sending later in the "Recall present" state,
- acknowledge the CC-ESTABLISHMENT message with a CC-ESTABLISHMENT CONFIRMED message,
- start timer T335, and
- enter the "CC-establishment confirmed" state.
Exception:
A busy mobile station which has successfully performed the recall alignment procedure shall respond with a CC-
ESTABLISHMENT CONFIRMED message with cause #17 "user busy", and proceed as stated above.
information element of the CC-ESTABLISHMENT CONFIRMED message. Codecs for GERAN shall be indicated in
the Bearer Capability information element. Additionally, if the mobile station supports codecs for GERAN and
UTRAN, it shall indicate the codecs for GERAN also in the Supported Codec List information element.
A mobile station, for which the recall alignment procedure failed, shall respond with a RELEASE COMPLETE
message in accordance with subclause 5.4.2 with the appropriate cause code as indicated in the description of the recall
alignment procedure.
The SETUP message is constructed from the Setup Container IE received in the CC ESTABLISHMENT MESSAGE.
The mobile station shall assume that the Setup Container IE contains an entire SETUP message with the exception of
the Protocol Discriminator, Transaction ID and Message Type elements. The mobile station may assume that the
contents of the Setup Container IE are the same as were sent from the subscriber in a previous SETUP message of the
mobile originating call establishment attempt. The mobile station shall copy the Setup Container to the SETUP message
and not modify the contents except as defined in the recall alignment procedure and as defined in exceptions below. The
mobile station shall not add other Information Elements to the end of the SETUP message.
Exceptions:
Bearer Capability IE(s), HLC IE(s) and LLC IE(s) (including Repeat Indicator(s), if there are 2 bearer
capabilities), and the Supported Codec List IE require handling as described in the recall alignment procedure
below.
If the CC Capabilities in the Setup Container IE is different to that supported by the mobile station, the mobile
station shall modify the CC Capabilities in the SETUP message to indicate the true capabilities of the mobile
station.
Facility IE(s) and SS Version IE(s) require handling as described in the recall alignment procedure.
Stream Identifier IE requires handling as described in the recall alignment procedure.
If no response to the CC-ESTABLISHMENT message is received by the call control entity of the network before the
expiry of timer T333, then the network shall initiate clearing procedures towards the called mobile station using a
RELEASE COMPLETE message with cause #102 "recovery on timer expiry" and inform all appropriate entities within
the network, proceeding in accordance with subclause 5.4.2.
ETSI
Release 18 294 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 5.7a/3GPP TS 24.008 Call initiation and possible subsequent responses.
5.2.3.2.1 Recall Alignment Procedure

The recall alignment procedure consists of three parts:
- basic service group alignment,
- facility alignment, and
- stream identifier alignment.
Basic service group alignment:
The mobile station shall check that the Bearer Capability, HLC and LLC and Repeat Indicator fields, which are
embedded in the Setup Container IE, match a basic service group supported by the mobile station.
If this check fails, then the recall alignment procedure has failed. The mobile station shall use the cause #88
"incompatible destination" afterwards.
Otherwise, the mobile station is allowed to alter the content within the Bearer Capability, HLC and LLC Information
Elements (e.g. the speech codec version(s), the data rate, the radio channel requirement) provided that the basic service
group is not changed. Furthermore, for speech calls the mobile station is allowed to add or remove the Supported Codec
List Information Element, or to alter the contents of this information element dependent on the codecs supported by the
mobile station. The result shall be that the mobile station has derived Bearer Capability, HLC, LLC, and Supported
Codec List Information Elements, which it can use for a later call setup according to its configuration and capabilities.
Facility alignment:
This only applies if the Setup Container contains 1 or more Facility IEs. Each Facility IE within the Setup
Container will be associated with the common SS Version IE, if present. The handling for each Facility IE is
defined below. The mobile station shall align each facility IE contained in the Setup Container. The rules defined
in 3GPP TS 24.010 [21] also apply.
The Facility IE is encoded as 'simple recall alignment', 'advanced recall alignment' or 'recall alignment not essential'
(see 3GPP TS 24.010 [21]). If the encoding indicates, that
- a simple recall alignment is required, the mobile station shall copy the Facility IE and the common SS version IE
from the Setup Container to the SETUP message without modifying the content.
- an advanced recall alignment is required, the mobile station must recognise and support the operation defined in
the facility. If the mobile station does not recognise or support the operation, then the recall alignment procedure
has failed and the mobile station shall use the cause #29 "facility rejected" in the subsequent rejection of the CC
establishment request.
- the recall alignment is not essential, then the facility operation is not an essential part of the SETUP. If the MS
does not recognise the operation then the SS Version IE and Facility IE are discarded, and NOT copied into the
SETUP message.
NOTE: A mobile station may include a Facility IE without an associated SS Version IE. This would indicate that
the SS operation is encoded using Phase 1 protocols.
Further details on Facility handling are given in 3GPP TS 24.010 [21].
ETSI
Release 18 295 3GPP TS 24.008 V18.4.0 (2023-09)
Stream identifier alignment:
The mobile station shall check whether the Stream Identifier field is contained in the Setup Container or not.
If the Stream Identifier is contained in the Setup Container, the mobile station shall behave as one of the following.
- the mobile station re-assign the Stream Identifier value, and modify the Stream Identifier field.
- the mobile station remove the Stream Identifier field.
If the Stream Identifier is not contained in the Setup Container, the mobile station may behave as follows.
- the mobile station assign the Stream Identifier value, and add the Stream Identifier IE to the end of the SETUP
message.
5.2.3.3 CC-Establishment confirmation

The call control entity of the network in the "CC-establishment present" state, shall, upon receipt of a CC-
ESTABLISHMENT CONFIRMED message, stop timer T333 and enter the "CC-establishment confirmed" state.
For speech calls, if the ESTABLISHMENT CONFIRMED message contains a Supported Codec List information
element, the network shall use this list to select the codec for UMTS. If no Supported Codec List information element is
received, then for UMTS the network shall select the default UMTS speech codec according to subclause 5.2.1.11.
In the "CC-establishment confirmed" state, the network sends a RECALL message. This message initiates user alerting
and also shall include the Facility IE (providing additional information to be presented to the user for notification). The
network starts timer T334 and enters the 'recall present' state.
Upon reception of the RECALL message the Mobile station stops T335 and enters the "recall present" state.
Figure 5.7b/3GPP TS 24.008 Recall
5.2.3.4 Recall present

In the "recall present" state, the call control entity in the mobile station waits for acceptance of the Recall by the user.
Once confirmation is received, the mobile station indicates acceptance of a recall by
- sending a SETUP message to its peer entity in the network;
- starting Timer T303; and
- entering the "call initiated" state and proceeding as described in subclause 5.2.1.1.
The MS shall ensure that the contents of the Bearer Capability IE(s) and Supported Codec List IE sent in the SETUP
message are the same as the Bearer Capability IE(s) and Supported Codec List IE in the previous CC-
ESTABLISHMENT CONFIRMED message related to this Network Initiated MO Call.
ETSI
Release 18 296 3GPP TS 24.008 V18.4.0 (2023-09)
In the "recall-present" state, if the user of a mobile station is User Determined User Busy then a RELEASE
COMPLETE message shall be sent with cause #17 "user busy" In the "recall-present" state. If the user of a mobile
station wishes to reject the recall then a RELEASE COMPLETE message shall be sent with cause #21 "call rejected".
In either case, the mobile shall release the connection in accordance with subclause 5.4.2
On receipt of the SETUP message in the "recall present" state, the network shall stop timer T334 and proceed as
specified in subclause 5.2.1.2.
If the call control entity of the network does not receive a SETUP message before the expiry of timer T334, then the
network shall send a RELEASE COMPLETE message to the mobile using cause #102 "recovery on timer expiry",
release the MM connection, enter the "null" state and shall inform all appropriate entities within the network.
Figure 5.7b/3GPP TS 24.008 Recall acceptance or rejection by user
5.2.3.5 Traffic channel assignment during network initiated mobile originating call
establishment
It is a network dependent decision whether or not to initiate the assignment of a traffic channel during the "CC-
establishment confirmed" state.
5.2.4 Call establishment for SRVCC or vSRVCC
5.2.4.1 General
Before call establishment for SRVCC or vSRVCC can be initiated in the mobile station, the MM connection must be
established by the network.
At PS to CS domain change from S1 mode or Iu mode due to SRVCC handover or vSRVCC handover (see
3GPP TS 23.216 [126]), the RR sublayer in the MS indicates to the MM layer if a voice only SRVCC handover or a
voice and video SRVCC handover was completed successfully. At reception of this indication, the MS that supports
SRVCC or vSRVCC shall establish an MM connection as specified in subclause 4.5.1.8 and either proceeds with
subclause 5.2.4.2 if the indication is that voice only SRVCC was completed successfully or proceeds with
subclause 5.2.4.2a if the indication is that voice and video SRVCC was completed successfully.
At 5G-SRVCC handover from NG-RAN to UTRAN (see 3GPP TS 23.216 [126]), the RR sublayer in the MS indicates
to the MM layer if 5G-SRVCC handover from NG-RAN to UTRAN was completed successfully. At reception of this
indication, the MS that supports 5G-SRVCC handover from NG-RAN to UTRAN shall establish an MM connection as
specified in subclause 4.5.1.8 and proceeds with subclause 5.2.4.2 if the indication is that 5G-SRVCC handover from
NG-RAN to UTRAN was completed successfully.
5.2.4.2 Call activation for SRVCC

If the MS
- supports SRVCC and the MS has a voice media stream previously carried over the PS domain that is handed
over to the CS domain via SRVCC;
- supports SRVCC or vSRVCC and the MS has a voice media stream and a video media stream of a single session
previously in S1 mode carried over the PS domain and only the voice media stream is handed over to the CS
domain via SRVCC; or
- supports 5G-SRVCC handover from NG-RAN to UTRAN and the MS has a voice media stream previously in
the N1 mode that is handed over to the CS domain via 5G-SRVCC handover from NG-RAN to UTRAN
ETSI
Release 18 297 3GPP TS 24.008 V18.4.0 (2023-09)
and the session is in the "confirmed" state (defined in IETF RFC 3261 [137]), and the call control entity in "null" state
receives indication "MM connection establishment due to SRVCC handover", the call control entity of the MS shall
enter the "active" state, set the auxiliary state (defined in 3GPP TS 24.083 [27]) to "idle", set the multi party auxiliary
state (defined in 3GPP TS 24.084 [28]) to "idle" and indicate the call establishment to upper layers. The MS and the
network shall locally set the TI value of the call to "000" and the TI flag value as in mobile terminated call. If a single
voice media stream is handed over and:
- if the session is on hold, the setting of the auxiliary state (as defined in 3GPP TS 24.083 [27]) is described in
3GPP TS 24.237 [136]; and
- if the session is a conferencing session, the setting of the multi party auxiliary state (as defined in
3GPP TS 24.084 [28]) is described in 3GPP TS 24.237 [136].
If the MS supports single radio PS to CS access transfer for calls in alerting state as specified in 3GPP TS 24.237 [136]
subclause 12.2.3B, and the MS has a single voice media stream over the PS domain that is handed over to the CS
domain via SRVCC, and the call control entity of the MS in the "null" state receives an indication "MM connection
establishment due to SRVCC handover" then:
- the call control entity shall indicate to the upper layers that call establishment is due to SRVCC handover;
- if the upper layers indicate that the media stream(s) is/are associated with a mobile originated session in the
"early" state (defined in IETF RFC 3261 [137]) according to the conditions specified in 3GPP TS 24.237 [136]
subclause 12.2.3B.3.2, the call control entity of the MS shall enter the "call delivered" state for this transaction.
The MS and the network shall locally set the TI value of the call to "000" and the TI flag value as in mobile
terminated call; and
- if the upper layers indicate that the media stream(s) is/are associated with a mobile terminating session in the
subclause 12.2.3B.3.1, the call control entity of the MS shall enter the "call received" state for this transaction.
terminated call.
If the MS supports single radio PS to CS SRVCC for originating calls in pre-alerting phase as specified in
3GPP TS 24.237 [136] subclause 12.2.3B, and the MS has a single voice media stream over the PS domain that is
handed over to the CS domain via SRVCC, and the call control entity of the MS in the "null" state receives an
indication "MM connection establishment due to SRVCC handover" then:
- the call control entity shall indicate to the upper layers that call establishment is due to SRVCC handover; and
subclause 12.2.3B.3.3, the call control entity of the MS shall enter the "mobile originating call proceeding" state
for this transaction. The MS and the network shall locally set the TI value of the call to "000" and the TI flag
value as in mobile terminated call.
If the MS supports single radio PS to CS SRVCC for terminating calls in pre-alerting phase as specified in
3GPP TS 24.237 [136] subclause 12.2.3B, and the MS has a single voice media stream over the PS domain that is
handed over to the CS domain via SRVCC, and the call control entity of the MS in the "null" state receives an
indication "MM connection establishment due to SRVCC handover" then:
- the call control entity shall indicate to the upper layers that call establishment is due to SRVCC handover; and
- if the upper layers indicate that the media stream(s) is/are associated with a mobile terminated session in the
subclause 12.2.3B.3.2, the call control entity of the MS shall enter the "call present" state for this transaction.
terminated call.
NOTE: As the MS is entering "call present" state, it must send a CALL CONFIRMED message to the network,
even even the call context (including codecs) is already available at the MSC in order to enter "mobile
ETSI
Release 18 298 3GPP TS 24.008 V18.4.0 (2023-09)
If the MS has additional voice media streams carried over the PS domain that are handed over to the CS domain via
SRVCC, the call states for the transactions and the setting of the TI value and TI flag for these additional media streams
are described in 3GPP TS 24.237 [136].
If the MS supports multicall, the MS shall locally set SI value to "1" and the MS shall assume that the network does not
support multicall. The network shall also locally set SI value to "1".
If the MS has a mobile originating session in the "early" state (as defined in IETF RFC 3261 [137]) and is providing an
internally generated alerting indication to the user prior to the SRVCC handover, then after transitioning from the PS
domain, the MS shall continue to provide the internal alerting indication to the user. The alerting indication is stopped
when the user connection is attached.
If the MS has a mobile originated session established upon a request from the upper layers to establish an eCall over
IMS, then after transitioning from the PS domain, the MS shall support inband transfer of the updated MSD according
to 3GPP TS 26.267 [161].
5.2.4.2a Call activation for vSRVCC

If the MS supports vSRVCC, the MS has a voice media stream and a video media stream of a single session previously
in S1 mode carried over the PS domain that are handed over to the CS domain via vSRVCC, the session associated with
these media streams is in the "confirmed" state (defined in IETF RFC 3261 [137]), and the call control entity in "null"
state receives indication "MM connection establishment due to vSRVCC handover", then the call control entity of the
MS shall enter the "active" state, set the auxiliary state (defined in 3GPP TS 24.083 [27]) to "idle", set the multi party
auxiliary state (defined in 3GPP TS 24.084 [28]) to "idle" and indicate the call establishment is due to vSRVCC
handover to the upper layers. The MS and the network shall locally set the TI value of the call to "000" and the TI flag
If the MS supports single radio PS to CS access transfer for calls in alerting state as specified in 3GPP TS 24.237 [136]
subclause 12.2.3B, and the MS has a single voice media stream and a single video media stream carried over the PS
domain that is handed over to the CS domain via vSRVCC, and the call control entity of the MS in the "null" state
receives indication "MM connection establishment due to vSRVCC handover" then:
- the call control entity shall indicate to the upper layers that call establishment is due to vSRVCC handover;
subclause 12.2.3B.3.2, the call control entity of the MS shall enter the "call delivered" state for this transaction.
terminated call; and
- if the upper layers indicate that the media stream(s) is/are associated with a mobile terminating session in the
subclause 12.2.3B.3.1, the call control entity of the MS shall enter the "call received" state for this transaction.
terminated call.
If the MS supports single radio PS to CS SRVCC for originating calls in pre-alerting phase as specified in
3GPP TS 24.237 [136] subclause 12.2.3B, and the MS has a single voice media stream and a single video media stream
carried over the PS domain that is handed over to the CS domain via vSRVCC, and the call control entity of the MS in
the "null" state receives indication "MM connection establishment due to vSRVCC handover" then:
- the call control entity shall indicate to the upper layers that call establishment is due to vSRVCC handover; and
subclause 12.2.3B.3.3, the call control entity of the MS shall enter the "mobile originating call proceeding" state
for this transaction. The MS and the network shall locally set the TI value of the call to "000" and the TI flag
If the MS supports single radio PS to CS SRVCC for terminating calls in pre-alerting phase as specified in
3GPP TS 24.237 [136] subclause 12.2.3B, and the MS has a single voice media stream and a single video media stream
carried over the PS domain that is handed over to the CS domain via vSRVCC, and the call control entity of the MS in
the "null" state receives indication "MM connection establishment due to vSRVCC handover" then:
ETSI
Release 18 299 3GPP TS 24.008 V18.4.0 (2023-09)
- the call control entity shall indicate to the upper layers that call establishment is due to vSRVCC handover; and
subclause 12.2.3B.3.2, the call control entity of the MS shall enter the "call present" state for this transaction.
terminated call.
NOTE: As the MS is entering "call present" state, it must send a CALL CONFIRMED message to the network,
even even the call context (including codecs) is already available at the MSC in order to enter "mobile
If the MS supports multicall, the MS shall locally set SI value to "1" and the MS shall assume that the network does not
support multicall. The network shall also locally set SI value to "1".If the MS has a mobile originating session in the
"early" state (as defined in IETF RFC 3261 [137]) and is providing an internally generated alerting indication to the
user prior to the vSRVCC handover, then after transitioning from the PS domain, the MS shall continue to provide the
internal alerting indication to the user. The alerting indication is stopped when the user connection is attached.
5.2.4.2b Multimedia CAT and vSRVCC handover

If the MS has a mobile originating session in the "early" state (as defined in IETF RFC 3261 [137]) and is receiving
multimedia CAT over the PS domain prior to the vSRVCC handover, then after transitioning from the PS domain, the
MS stops providing the early media to the user and may internally generate an alerting indication. The alerting
indication is stopped when the user connection is attached.
5.2.4.3 Traffic channel assignment and user connection attachment

An appropriate traffic channel for the call is assigned in SRVCC handover, vSRVCC handover or 5G-SRVCC handover
from NG-RAN to UTRAN.
For SRVCC handover or 5G-SRVCC handover from NG-RAN to UTRAN, the mobile station shall attach the user
connection:
- when the call control entity enters the "active" state or the "call received" state;
- when the call control entity enters the "call delivered" state, if prior to SRVCC the MS in the PS domain was
receiving media for the session subjected to SRVCC handover or 5G-SRVCC handover from NG-RAN to
UTRAN; and
- when the call control entity enters the "mobile originating call proceeding" state, if prior to SRVCC the MS in
the PS domain was receiving media for the session subjected to SRVCC handover5G-SRVCC handover from
NG-RAN to UTRAN.
NOTE: The attachment of the user connection prior to entering the "active" state allows the network to provide
in-band tones and announcements to the UE.
For vSRVCC handover, the mobile station shall attach the user connection when the call control entity enters the
"active" state.
For SRVCC or vSRVCC handover to a speech call, the principles of speech codec selection are described in
subclause 5.2.1.11.
For vSRVCC handover to a circuit-switched multimedia call, further requirements are specified in subclause 5.3.6.6.
5.2.4.4 State verification

The network may check the call and auxiliary states of its peer entity as specified in subclause 5.5.3.1 when the PS to
CS access transfer is complete.
ETSI
Release 18 300 3GPP TS 24.008 V18.4.0 (2023-09)
5.3 Signalling procedures during the "active" state

5.3.1 User notification procedure
The mobile terminating user notification procedure allows the network to notify a mobile station of any appropriate
call-related event during the "active" state of a call. The procedure consists in the network sending a NOTIFY message
to the mobile station. No state change occurs at any of the interface sides following the sending or the receipt of this
message (but an appropriate indication may optionally be generated in the mobile station).
The mobile originating notification procedure allows the mobile station to notify the remote user of any appropriate
call-related event during the "active" state of a call by sending a NOTIFY message containing a notification indicator to
the network; upon receipt of this message, the network sends a NOTIFY message containing the same notify indicator
to the other user involved in the call. No state change occurs at any of the interface sides following the sending or the
receipt of this message.
5.3.2 Call rearrangements

Call rearrangements on the radio interface are not supported by explicit messages (e.g. SUSPEND and RESUME
messages as defined in ETSI ETS 300 102-1 [70]). However if a remote non-PLMN user initiates call rearrangements,
the network shall inform the mobile station by means of a NOTIFY message. In a similar way the mobile station can
inform the network about rearrangements by sending a NOTIFY message (e.g. change of user equipment connected to
the mobile station).
5.3.3 Codec Change Procedure

During a speech call in UMTS, if a mobile station supports more than one UMTS codec, the network can change the
UMTS codec via RRC procedures. In order to request the mobile station to change the codec, the network shall send the
new selected codec type in the NAS Synchronisation Indicator IE (RRC protocol), see subclause 5.2.1.11.
5.3.4 Support of Dual Services

The behaviour described in this subclause is used to realize the following required services throughout subclause 5.3.4.
The mobile station is not obliged to support the network originated in-call modification procedure. In that case, the
mobile station shall, when receiving a MODIFY message, treat the message as unknown and react as described in
subclause 8.4. If the mobile station is already prepared to support the procedure in both directions, it shall act as
described in this subclause.
Alternate Speech/Group 3 fax (Teleservice 61 according to 3GPP TS 22.003 [4]).
5.3.4.1 Service Description

This circuit switched service allows the two users on a point-to-point connection to use the connection between them
for different information transfer during the same call, but not at the same time.
If the negotiation during call establishment leads to the recognition of the above mentioned services, the in-call
modification procedure is allowed to be executed within the current call by changing from one call mode to the other.
In some cases the in-call modification procedure makes it necessary to change the channel configuration by allocating a
new channel and in other cases to change channel configuration parameters while keeping the previously allocated
channel. This change is determined by the network, which initiates either the channel assignment procedure, handover
procedure or channel mode modify procedure (see clause 3).
The capability and the initial mode desired must be identified by the mobile station by identifying each mode of
operation with a separate information element during call establishment. Further the type of change between the modes
must be identified by means of the repeat indicator:
mode 1 "alternate" mode 2.
ETSI
Release 18 301 3GPP TS 24.008 V18.4.0 (2023-09)
5.3.4.2 Call establishment

For both mobile originating and mobile terminating calls, the normal call establishment procedures apply.
5.3.4.2.1 Mobile Originating Establishment

The service is requested by the originating mobile station by transferring a SETUP message to the network containing
the BC repeat indicator IE, the bearer capability 1 information element, and the bearer capability 2 information
element. The first mode of operation ("call mode") shall be indicated by the bearer capability 1 information element
and the second call mode by the bearer capability 2 information element.
A low layer compatibility may optionally be specified for each call mode in a low layer compatibility I and low layer
compatibility II information element. In that case:
- the SETUP message shall contain the LLC repeat indicator IE and both low layer compatibility I and low layer
compatibility II information elements. The low layer compatibility I information element then corresponds to the
bearer capability 1 information element and the low layer compatibility II information element to the bearer
capability 2 information element;
- if no low layer compatibility specification applies for one of the two call modes, the corresponding low layer
compatibility IE (low layer compatibility I or low layer compatibility II) shall indicate "not applicable";
- the LLC repeat indicator shall specify the same repeat indication as the BC repeat indicator IE.
Similarly, a high layer compatibility may optionally be specified for each call mode in a high layer compatibility i and
high layer compatibility ii information element. In that case:
- the SETUP message shall contain the HLC repeat indicator IE and both high layer compatibility i and high layer
compatibility ii information elements. The high layer compatibility i information element then corresponds to the
bearer capability 1 information element and the high layer compatibility ii information element to the bearer
capability 2 information element;
- if no high layer compatibility specification applies for one of the two call modes, the corresponding high layer
compatibility IE (high layer compatibility i or high layer compatibility ii) shall indicate "not applicable";
- the HLC repeat indicator shall specify the same repeat indication as the BC repeat indicator IE.
The receiving entity shall ignore whether the LLC repeat indicator IE or HLC repeat indicator are contained in the
message or not; it shall also ignore the repeat indication of an LLC repeat indicator IE or HLC repeat indicator IE. If
the low layer compatibility II IE is not contained in the message and the low layer compatibility I IE is contained in the
message, the receiving entity shall relate it to a call mode indicated in the message that does not specify speech (if any).
If the high layer compatibility ii IE is not contained in the message and the high layer compatibility i IE is contained in
the message, the receiving entity shall relate it to a call mode indicated in the message that does not specify speech (if
any).
The specific part of the network which is sensitive to the call mode shall examine each mode described in the bearer
capabilities included in the SETUP message by performing compatibility checking as defined in Annex B. If as a result
of this compatibility checking the network decides to reject the call, then the network shall initiate call clearing as
specified in subclause 5.4 with the following causes:
a) #57 "bearer capability not authorized";
b) #58 "bearer capability not presently available";
c) #65 "bearer service not implemented";
d) #70 "only restricted digital information bearer capability is available".
5.3.4.2.2 Mobile Terminating Establishment

The service is indicated to the called mobile station by a SETUP message coded in the same manner as in the mobile
originating call establishment. As specified for normal terminating call establishment, the service may be indicated by
the called mobile station in the CALL CONFIRMED message.
ETSI
Release 18 302 3GPP TS 24.008 V18.4.0 (2023-09)
The destination mobile station shall perform the compatibility checking as defined in Annex B for both required modes
if indicated in the SETUP message. If as a result of compatibility checking the mobile station decides to reject the call,
the mobile station shall initiate call clearing according to the procedures of subclause 5.4 with one of the following
causes:
a) #57 "bearer capability not authorized";
b) #58 "bearer capability not presently available";
c) #65 "bearer service not implemented";
d) #88 "incompatible destination".
The mobile station may accept the call if the first mode indicated is free irrespective of whether the other mode is free
or busy.
5.3.4.3 Changing the Call Mode

In order to change the call mode, the following in-call modification procedures shall be used.
Either side of the radio interface may act as the requesting user to invoke the in-call modification.
Upon each successful completion of the in-call modification procedure, the call changes to the next mode negotiated
and agreed during the establishment phase of the call.
The in-call modification procedures are completely symmetrical at the radio interface.
5.3.4.3.1 Initiation of in-call modification

The procedure is initiated by the requesting originating side in the "active" state of the call. It shall send a MODIFY
message including the new mode to be changed to. The requesting originating side shall also start timer T323 and enter
the "mobile originating modify" state (mobile station side) or the "mobile terminating modify" state (network side). The
new mode given in the MODIFY message shall be one of those already negotiated and agreed during the establishment
phase of the call. If the data call direction is different from the direction of the call setup a reverse call setup direction IE
shall be included in the MODIFY message; otherwise this IE shall not be included.
If the in-call modification is originated by the mobile station, the mobile station shall reserve any internal resources
necessary to support the next call mode, stop sending Bm-channel information; and stop interpreting received Bm-
channel information according to the old call mode.
If the in-call modification is originated by the network, the network may reserve any internal resources necessary to
support the next call mode. The network shall stop sending Bm-channel information and stop interpreting received Bm-
channel information according to the old call mode at the latest when it changes the channel configuration.
Upon receipt of the MODIFY message, the destination side shall check to ensure that the requested call mode can still
be supported and if so, it shall initiate the reservation of any resources necessary to support the next call mode; start
T324 (mobile station side only) if the in-call modification procedure is triggered as a result of a service change from
speech to UDI/RDI multimedia modes; and enter the "mobile originating modify" (network side) or "mobile terminating
modify" state (mobile station side).
5.3.4.3.2 Successful completion of in-call modification

If the destination network/mobile station receives a MODIFY message with a new mode which is already the actual one
of the call the network/mobile station shall remain in the "active" state; send a MODIFY COMPLETE message with the
actual mode; and shall not initiate anything else.
If the requested mode is speech and if during call establishment the network received a Supported Codec List IE, the
network shall use this list to select the codec for UTRAN. If no Supported Codec List information element is received,
then for UTRAN the network shall select the default UMTS speech codec according to subclause 5.2.1.11.
ETSI
Release 18 303 3GPP TS 24.008 V18.4.0 (2023-09)
If the Supported Codec List IE is received, then the network shall indicate the codec selected for Iu mode to the mobile
station via RANAP and RRC protocol in the NAS Synchronisation Indicator IE (see subclause 5.2.1.11).
If the in-call modification was originated by the mobile station, the mobile station and the network shall proceed as
follows:
If the requested mode is not the actual one and can be supported by the network it shall change the channel
configuration, if required, and step on to any internal resources necessary to support the next call mode. If the
requested mode is a data or facsimile mode, it shall also perform the appropriate means to take the direction of
the data call into account. After successful change of the channel configuration it shall start sending user
information according to the next call mode and start interpreting received user channel information according to
the next call mode; send a MODIFY COMPLETE message with the new call mode included and enter the
"active" state (network side). If the MODIFY message had contained a reverse call setup direction IE, the same
IE shall be included in the MODIFY COMPLETE message.
Upon receipt of the MODIFY COMPLETE message the mobile station shall: initiate the alternation to those
resources necessary to support the next call mode; stop timer T323; and enter the "active" state (mobile station
side).
If the in-call modification was originated by the network, the mobile station and the network shall proceed as follows:
If the requested mode is not the actual one and can be supported by the mobile station it shall reserve any
internal resources necessary to support the next call mode.
NOTE: For a change from speech to a different call mode, user interaction may be required, before the mobile
decides that the requested mode can be supported.
If the requested mode is a data or facsimile mode, it shall also perform the appropriate means to take the
direction of the data call into account. The mobile station shall send a MODIFY COMPLETE message with the
new call mode included, stop timer T324 and enter the "active" state (mobile station side). If the MODIFY
message had contained a reverse call setup direction IE, the same IE shall be included in the MODIFY
COMPLETE message. If the old call mode is speech, the mobile station shall continue sending Bm-channel
information and interpreting received Bm-channel information for speech until the network modifies its channel
configuration.
After receipt of the MODIFY COMPLETE message the network shall: reserve any internal resources necessary
to support the next call mode, stop sending Bm-channel information, and stop interpreting received Bm-channel
information according to the old call mode, unless these actions were already performed earlier. Furthermore, the
network shall change the channel configuration, if required; after successful change of the channel configuration
initiate the alternation to those resources necessary to support the next call mode; stop timer T323; and enter the
"active" state (network side).
The mobile station shall start sending user information according to the next call mode and start interpreting
received user channel information according to the next call mode as soon as a suitable channel for the new
mode is available.
In both cases:
For an alternate speech/facsimile group 3 service (refer to subclause 5.3.4) the old resources may still be kept
reserved.
The reaction of the originating side if it had included a reverse call setup direction IE in the MODIFY message,
but the destination side did not include the IE in the MODIFY COMPLETE message is implementation
dependent.
5.3.4.3.3 Change of the channel configuration

In case the requested bearer capability cannot be supported by the current channel configuration the network shall
initiate the assignment procedure and change the channel configuration accordingly.
ETSI
Release 18 304 3GPP TS 24.008 V18.4.0 (2023-09)
5.3.4.3.4 Failure of in-call modification
5.3.4.3.4.1 Network rejection of in-call modification
If the network cannot support the change to the requested call mode or if the change of the channel configuration fails
the network shall: release the resources which had been reserved for the alternation: send a MODIFY REJECT message
with the old bearer capability and with cause # 58 "bearer capability not presently available" to the initiating mobile
station; and enter the "active" state. If the change of the channel configuration fails, the network shall return to the
internal resources required for the old call mode.
Upon receipt of the MODIFY REJECT message with the old bearer capability the initiating mobile station shall: stop
timer T323; release any resources which had been reserved for the alternation; resume sending user channel information
according to the present call mode; resume interpreting received user channel information according to the present call
mode; and enter the "active" state.
5.3.4.3.4.2 Mobile station rejection of in-call modification
If the mobile station cannot support the change to the requested call mode, the mobile station shall: stop timer T324;
release any resources which had been reserved for the alternation; send a MODIFY REJECT message with the old
bearer capability and cause # 58 "bearer capability not presently available", and enter the "active" state.
Upon receipt of the MODIFY REJECT message the network shall: stop timer T323, release any resources which had
been reserved for the alternation.
5.3.4.3.4.3 Time-out recovery
Upon expiration of T323 in either the mobile station or the network the procedures for call clearing shall be initiated
(see subclause 5.4) with cause # 102 "recovery on timer expiry".
Upon expiration of T324 the mobile station shall: release any resources which had been reserved for the alternation;
send a MODIFY REJECT message with the old bearer capability and cause #58 "bearer capability not presently
available"; and enter the "active" state.
5.3.4.4 Abnormal procedures

If a MODIFY, MODIFY COMPLETE or MODIFY REJECT message is received in the "disconnect indication",
"disconnect request" (mobile station side only) or "release request" state then the received message shall be discarded
and no action shall be taken.
If a MODIFY COMPLETE message indicating a call mode which does not correspond to the requested one is received
or if a MODIFY REJECT message indicating a call mode which does not correspond to the actual one is received then
the received message shall be discarded and no action shall be taken.
If a MODIFY message indicating a call mode which does not belong to those negotiated and agreed during the
establishment phase of the call, is received, then a MODIFY REJECT message with the actual call mode and with cause
# 57 "bearer capability not authorized" shall be sent back.
Figure 5.10a/3GPP TS 24.008 In-call modification sequence initiated by MS
ETSI
Release 18 305 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 5.10b/3GPP TS 24.008 In-call modification sequence initiated by network
5.3.5 User initiated service level up- and downgrading (A/Gb mode and
GERAN Iu mode only)
The user initiated service level up- and downgrading is applicable for non-transparent multislot data services, only. By
means of this procedure the user can request a change of the "maximum number of traffic channels" and/or "wanted air
interface user rate" parameters, to be assigned by the network.
5.3.5.1 Initiation of service level up- and downgrading

The procedure is initiated by the mobile station in the "active" state of the call. It shall:
- send a MODIFY message including the wanted value of the "maximum number of traffic channels" and/or the
"wanted air interface user rate" parameters;
- not change any of the other, possibly negotiated, parameters of the bearer capability information element;
- start timer T323; and
- enter the "mobile originating modify" state.
Any internal resources necessary to support the next service parameters shall be reserved. If a dual service was
negotiated at call setup, the mobile station shall initiate the service level up- or down-grading only during the data phase
of the dual service.
Upon receipt of the MODIFY message, the network shall check if the indicated maximum number of traffic channels
can be supported and enter the "mobile originating modify" state.
5.3.5.2 Successful completion of service level up- and downgrading

The network may upon reception of the MODIFY message initiate a change of the channel configuration assigned to
the mobile station.
As a response to the MODIFY message the network sends a MODIFY COMPLETE message including the bearer
capability negotiated at call setup and enters the "active" state.
Upon receipt of the MODIFY COMPLETE message the mobile station shall stop timer T323 and enter the "active"
state.
5.3.5.3 Rejection of service level up- and downgrading

If a change of bearer service is requested together with a change of the "maximum number of traffic channels" and/or
the "wanted air interface user rate", or if the current used service is not a data service where up- and downgrading is
applicable, or if the receiver chooses not to grant the request, the network shall:
- send a MODIFY REJECT message with bearer capability negotiated at call setup and with cause #58 "bearer
capability not presently available";
- enter the "active" state.
ETSI
Release 18 306 3GPP TS 24.008 V18.4.0 (2023-09)
Upon receipt of the MODIFY REJECT message with the bearer capability negotiated at call setup, the mobile station
shall: stop timer T323 and enter the "active" state.
5.3.5.4 Time-out recovery

Upon expiration of T323 in the mobile station the procedures for call clearing shall be initiated with cause #102
"recovery on timer expiry".
5.3.6 Support of multimedia calls
5.3.6.1 Service description

The 3GPP circuit-switched multimedia call is based on the 3G-324M (see 3GPP TS 26.111 [80]), which is a 3GPP-
variant of the ITU-T Recommendation H.324 [146]. CS Multimedia telephony is a Bearer Service, which utilizes the
Synchronous Transparent Data service (BS30), see 3GPP TS 22.002 [3].
At the multimedia call setup the required call type, 3G-324M, is indicated, for the network to be able to invoke
appropriate interworking functionality. In the peer end the H.324 information is used to invoke the terminal application.
In addition to H.324 indication the terminal must select Information Transfer Capability (ITC) for the multimedia call.
The 'correct' ITC depends on the peer end and the transporting networks; an all-ISDN call is a UDI/RDI call, and a call,
which involves PSTN, is an analog "3.1 kHz audio" call.
For the case when the setup of a multimedia call is not successful, fallback to speech is specified.
Users may also request a service change between UDI/RDI multimedia and speech modes during a call (see 3GPP TS
23.172 [97]).
5.3.6.2 Call establishment

For both mobile originating and mobile terminating calls, the normal call establishment procedures apply, with the
exceptions specified in the following subclauses.
For further description of the function of MSC/IWF in the following clauses, see 3GPP TS 29.007 [38].
5.3.6.2.1 Mobile originated multimedia call establishment

At call setup the required call type, 3G-324M, is indicated by the originating MS in the SETUP message, with the
bearer capability IE parameter Other Rate Adaption set to "H.223 and H.245".
For analogue multimedia, the support of a fallback to speech is requested by including two bearer capability IEs,
multimedia first and speech as the second BC in the SETUP message. The MS shall indicate fallback to speech by these
two BC IEs and the associated Repeat Indicator set to "support of fallback".
For UDI/RDI multimedia, the support of a fallback and service change is requested by including two bearer capability
IEs, with the first BC as the preferred service in the SETUP message. The MS shall indicate service change and fallback
by these two BC IEs and the associated Repeat Indicator set to "support of service change and fallback".
If the bearer capability IE is received from the MS either in A/Gb or GERAN Iu mode and indicates no A/Gb mode
support for the requested bearer service, the network shall consider it as a request to perform an inter-system handover
to UTRAN Iu mode, as described in 3GPP TS 23.009 [114] subclause 14.2.
The bearer compatibility checking in the network is according to subclause 5.3.4.2.1.
If the MS requested for an analogue multimedia call with fallback to speech, or for a UDI/RDI multimedia call with
fallback and service change, and the network accepts the call, the network has the following options for the inclusion of
bearer capability IEs in the CALL PROCEEDING message:
- if the network accepts the requested analogue multimedia call and supports fallback to speech, both multimedia
and speech bearer capability IEs shall be included;
- if the network accepts the requested UDI/RDI multimedia call and supports fallback and service change, both
multimedia and speech bearer capability IEs shall be included. The order of the bearer capability IEs
ETSI
Release 18 307 3GPP TS 24.008 V18.4.0 (2023-09)
determines the preferred service, and the network may reverse the order of these IEs (see 3GPP TS 23.172 [97],
subclause 4.2.1);
- if the network accepts a multimedia (only) call, a multimedia bearer capability IE shall be included;
- if the network accepts a speech (only) call, a speech bearer capability IE shall be included;
- for a UDI/RDI multimedia call, if the network accepts the requested speech call and supports service change,
both multimedia and speech bearer capability IEs shall be included. The order of the bearer capability IEs
determines the preferred service, and the network may reverse the order of these IEs (see 3GPP TS 23.172 [97],
subclause 4.2.1);
- if the network received a UDI/RDI multimedia bearer capability IE with FNUR equal to 32kbit/s and a speech
bearer capability IE in the SETUP message, the network shall not release the call, but shall reply with one
bearer capability IE only, as specified in 3GPP TS 23.172 [97].
NOTE: Service change and fallback for UDI/RDI multimedia calls is not supported with Fixed Network User
Rate set to 32 kbit/s (see 3GPP TS 23.172 [97]).
If the MS requested for a multimedia call only, and the network accepts the call, the network shall always include a
single multimedia bearer capability IE in the CALL PROCEEDING message.
The originating user shall determine (possibly by pre-configuration of the terminal) whether a digital connection is
required or if the call will be an analog modem call. If the call is expected to be digital the multimedia bearer capability
IE parameter ITC is set to UDI/RDI. In an analog call the multimedia bearer capability IE parameter ITC is set to
"3,1 kHz audio ex PLMN". Additionally required modem type is indicated (Other Modem Type = V.34).
5.3.6.2.1.1 Fallback
If the network, during the setup of an H.324-call, detects that the transit network or the called end does not support an
H.324 call (e.g. because of a failure in the modem handshaking in case of an analogue multimedia call), then the
network initiates the in-call modification procedure (see subclause 5.3.4.3) towards the MS to modify the call mode to
speech, if the MS had included a speech bearer capability IE in the SETUP message.
In case of a UDI/RDI multimedia call with service change and fallback, if the network detects that the called end does
not support speech, then it initiates an in-call modification procedure towards the MS to modify the call mode to
multimedia, if the first bearer capability IE was for a speech call.
5.3.6.2.2 Mobile terminating multimedia call

At call setup the required call type, 3G-324M, is indicated by the network in the SETUP message, with the bearer
capability IE parameter. Other Rate Adaption set to 'H.223 and H.245'. ITC is either '3,1 kHz audio ex PLMN' or
'UDI/RDI'.
For analogue multimedia, if the network supports fallback to speech and the subscriber has subscription to speech, two
bearer capability IEs, multimedia first and speech as the second BC are included in the SETUP message. The network
shall indicate fallback to speech by these two BC IEs and the associated Repeat Indicator set to "support of fallback".
For UDI/RDI multimedia, if the network supports fallback and service change, and the subscriber has subscription to
speech, two bearer capability IEs, with the first BC as the preferred service are included in the SETUP message. The
network shall indicate service change and fallback by these two BC IEs and the associated Repeat Indicator set to
"service change and fallback".
If the bearer capability IE is received from the MS either in A/Gb or GERAN Iu mode and indicates no A/Gb mode
support for the requested bearer service, the network shall consider it as a request to perform an inter-system handover
to UTRAN Iu mode, as described in 3GPP TS 23.009 [114] subclause 14.2.
The bearer capability IE(s) may (in the case of the single numbering scheme) be missing from the SETUP message.
The bearer compatibility checking in the MS is according to subclause 5.3.4.2.2.
The MS shall indicate the supported call type(s) in the CALL CONFIRMED message, which is the acknowledgement
to SETUP. If the network offered an analogue multimedia call with fallback to speech, or a UDI/RDI multimedia call
ETSI
Release 18 308 3GPP TS 24.008 V18.4.0 (2023-09)
with fallback and service change, the MS has the following options for the inclusion of bearer capability IEs in the
CALL CONFIRMED message:
- if the MS/user accepts the offered analogue multimedia call and supports fallback to speech, both multimedia
and speech bearer capability IEs shall be included;
- if the MS/user accepts the offered UDI/RDI multimedia call, and supports fallback and service change, both
multimedia and speech bearer capability IEs shall be included. The order of the BC IEs determines the preferred
service, and the MS/user may reverse the order of these IEs;
- if the MS/user accepts the offered multimedia call, but does not support fallback or service change, only a
multimedia bearer capability IE shall be included;
- if the MS/user wishes a speech (only) call a speech bearer capability IE is included;
- for a UDI/RDI multimedia call, if the MS/user accepts the offered speech call and supports service change, both
speech and multimedia bearer capability IEs shall be included. The order of the BC IEs determines the preferred
service, and the MS/user may reverse the order of these IEs.
If the network offered a multimedia call only, and the MS/user accepts the call, the MS shall always include a single
multimedia bearer capability IE in the CALL CONFIRMED message.
If the SETUP contained no bearer capability IE the network shall perform compatibility checking of the CALL
CONFIRMED message in the same way as the compatibility checking of the SETUP message in the mobile originating
call case, described in subclause 5.3.6.2.1.
5.3.6.2.2.1 Fallback to speech
If modem handshaking fails (in a modem call), the call mode will be modified to speech if a speech bearer capability
IE was included. The modem signalling is inband, so the call must have reached the active state, when these
conclusions about the presence of modems can be done. The call modifications are realized through the in-call
modification procedure, by which the network requests the MS to modify the call mode (see subclause 5.3.4.3).
NOTE: Fallback from digital (UDI) H.324-call to speech after call setup is not a valid case at the terminating
side.
5.3.6.3 In-call modification in the "active" state

The in-call modification procedure as described in subclause 5.3.4.3 shall be used to:
- trigger a service change between speech and UDI/RDI multimedia modes, when service change has been agreed
at call setup;
- trigger a network-initiated service upgrade from speech to UDI/RDI multimedia modes (see
3GPP TS 23.172 [97]). The network shall initiate this procedure only if the mobile station indicated support of
the enhanced network-initiated in-call modification procedure in the Call Control Capabilities IE at call
establishment. In this case, the MODIFY message shall include the Network-initiated Service Upgrade indicator
IE; or
- modify the multimedia bearer capability for an analogue multimedia call (restricted to the network initiated in-
call modification only). In this case, the network shall send a MODIFY message including the new Bearer
Capability to be changed to. The following bearer capability parameters can be modified with the procedure (see
3GPP TS 29.007 [38]):
- Fixed Network User Rate (analogue multimedia calls only).
ETSI
Release 18 309 3GPP TS 24.008 V18.4.0 (2023-09)
5.3.6.3.1 Void
5.3.6.3.2 Void
5.3.6.3.3 Void
5.3.6.3.3.1 Void
5.3.6.3.3.2 Void
5.3.6.4 Multimedia CAT during the alerting phase of a mobile originated call
A mobile station supporting multimedia CAT during the alerting phase of a mobile originated multimedia call
establishment shall indicate support of this capability to the network in the Call Control Capabilities information
element in the SETUP message.
The network may generate a multimedia CAT to such a mobile station before it has reached the "active" state of a call.
To do so, the network shall through connect the traffic channel towards the source of the multimedia CAT and send a
progress indicator IE indicating user attachment with progress description #9 "In-band multimedia CAT available" in
either an ALERTING message or a PROGRESS message that is sent to the mobile station during call establishment.
On reception of an ALERTING or a PROGRESS message the mobile station shall proceed as specified elsewhere in
clause 5; if the progress indicator IE indicated user attachment with progress description #9 "In-band multimedia CAT
available", the mobile station shall:
- attach the user connection for multimedia as soon as an appropriate channel in multimedia mode is available; and
- set up an H.324 call.
It is up to the network to ensure that no undesired end-to-end through connection with the called party takes place
during the establishment of a mobile terminated call.
The mobile station shall not abort the call if an error or H.324 call clearing occurs during the setup or the lifetime of the
H.324 call during the alerting phase; the call control entity of the calling mobile station shall remain in its current state.
Upon reception of a new request from the network to attach the user connection with progress description #9 "In-band
multimedia CAT available", the mobile station shall release any on-going H.324 call, and set up a new H.324 call.
NOTE: The network can request the mobile station to restart a new H.324 call during the alerting phase of the call
e.g. during call forwarding scenarios to transmit to the calling party the multimedia CAT of the
forwarded-to party.
The network may initiate the in-call modification procedure (see subclause 5.3.4.3) towards the MS in the "call
delivered" state to modify the call mode to speech, if service change has been agreed at call setup.
Upon receiving an indication that the call has been accepted, the call control entity of the network shall send a
CONNECT message to its peer entity at the calling mobile station; start timer T313 and enter the "connect indication"
state. This message indicates to the call control entity of the calling mobile station that a connection has been
established through the network.
On reception of a CONNECT message, the mobile station shall proceed as specified elsewhere in clause 5; the mobile
station shall release any on-going H.324 call and set up a new H.324 call towards the called party.
Mobile stations supporting multimedia CAT during the alerting phase of a mobile originated multimedia call
establishment should also support the Media Oriented Negotiation Acceleration procedures specified in ITU-
T Recommendation H.324 Amendment 1 [117] and ITU-T Recommendation H.324 Amendment 2 [118].
5.3.6.5 DTMF transmission during a multimedia call

establishment should support transmission of DTMFs during a H.324 call using the H.245 UserInputIndication message
(see ITU-T H.245 [119]) if it has attached the user connection for multimedia and an appropriate channel is available.
ETSI
Release 18 310 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE: DTMF can be used to convey to the network the end user request to stop or copy an on-going multimedia
CAT.
5.3.6.6 vSRVCC handover to a circuit-switched multimedia call

Upon vSRVCC handover to a traffic channel suitable for a data call, the MS shall use a single bearer capability IE for
multimedia with ITC set to "UDI" and FNUR set to 64 kbit/s for the call.
NOTE: After the MS has attached the user connection (see subclause 5.2.4.3), the MS initially uses predefined
codecs for voice and video as specified in 3GPP TS 26.111 [80]. Additionally, the MS can perform in-
band codec re-negotiation using H.245 signalling according to the procedures defined in
3GPP TS 26.111 [80].
5.4 Call clearing

5.4.1 Terminology
The following terms are used in the present document in the description of clearing procedures:
- A traffic channel (see 3GPP TS 44.003 [16]) is "connected" when the channel is part of a circuit-switched
connection established according to the present document.
- A traffic channel is "disconnected" when the channel is no longer part of a circuit-switched connection, but is not
yet available for use in a new connection.
5.4.2 Exception conditions

Under normal conditions, the call control entity of the mobile station or of the network initiates call clearing by sending
a DISCONNECT message to its peer entity; then both entities follow the procedures defined in subclauses 5.4.3 and
5.4.4 respectively.
As an exception to the above rule, the call control entity of the mobile station or of the network, in response to a SETUP
or START CC or CC-ESTABLISHMENT CC-ESTABLISHMENT CONFIRMED or RECALL message, can reject a
call by stopping all running call control timers, responding with a RELEASE COMPLETE message, releasing the MM
connection, and returning to the "null" state, provided no other response has previously been sent.
As a further exception, the call control entity of the network may initiate call clearing by stopping all running call
control timers, sending a RELEASE message, starting timer T308, and entering the "release request" state.
NOTE: This way to initiate call clearing by sending a RELEASE message should not be used by the network:
- if in-band tones/announcements are provided and the network decides to use the procedure described
in subclause 5.4.4.1.1.1 or 5.4.4.2.1;
- if the network wants to have the opportunity to respond to information sent by the mobile station
during call clearing, e.g. when the network indicates that "CCBS activation is possible".
A call control entity shall accept an incoming RELEASE COMPLETE message used to initiate the call clearing even
though the cause information element is not included.
A control entity shall accept an incoming RELEASE message used to initiate the call clearing even though the cause
information element is not included.
Furthermore, a call control entity shall regard an incoming RELEASE COMPLETE message as consistent with any of
its states; a call control entity shall regard an incoming RELEASE message as consistent with any of its states except
the null state: a call control entity of the mobile station shall regard an incoming DISCONNECT message as consistent
with any of its call control states except the "null" state, the "release request" state, and the "disconnect indication" state;
a call control entity of the network shall regard an incoming DISCONNECT message as consistent with any of its call
control states except the "null" state and the "release request" state.
NOTE: This allows the introduction of shorter call clearing procedures in the future.
ETSI
Release 18 311 3GPP TS 24.008 V18.4.0 (2023-09)
5.4.3 Clearing initiated by the mobile station
5.4.3.1 Initiation of call clearing

Apart from the exceptions identified in subclause 5.4.2, the call control entity of the mobile station shall initiate clearing
by: stopping all running call control timers, sending a DISCONNECT message; starting timer T305; and entering the
"disconnect request" state.
5.4.3.2 Receipt of a DISCONNECT message from the mobile station.

The call control entity in the network in any state except the "null" state and the "release request" state shall, upon
receipt of a DISCONNECT message:
- Stop all running call control timers;
- initiate procedures to clear the network connection and the call to the remote user;
- send a RELEASE message to its peer entity;
- enter the "release request" state.
NOTE: The RELEASE message has only local significance and does not imply an acknowledgement of clearing
from the remote user.
5.4.3.3 Receipt of a RELEASE message from the network

The call control entity of the mobile station in any state except the "null" state and the "release request" state, shall,
upon receipt of a RELEASE message: stop all running call control timers; send a RELEASE COMPLETE message;
release the MM connection; and return to the "null" state.
5.4.3.4 Receipt of a RELEASE COMPLETE message from the mobile station

A call control entity of the network in any call control state shall, upon receipt of a RELEASE COMPLETE message
from its peer entity in the mobile station: stop all running call control timers; release the MM connection; and return to
the "null" state.

The call control entity of the mobile station in the "disconnect request" state, shall upon expiry of timer T305: send a
RELEASE message to the network with the cause number originally contained in the DISCONNECT message and
optionally, a second cause information element with cause #102 "recovery on timer expiry", start timer T308, and enter
the "release request" state.
The call control entity of the network in the "release request" state, shall, at first expiry of timer T308, retransmit the
RELEASE message, start timer T308, and stay in the "release request" state. At second expiry of timer T308, the call
control entity of the network shall: release the MM connection; and return to the "null" state.
5.4.4 Clearing initiated by the network

Apart from the exception conditions identified in subclause 5.4.2, the call control entity of the network shall initiate
clearing by: sending a DISCONNECT message; and entering the "disconnect indication" state. The DISCONNECT
message is a local invitation to clear the call.
NOTE: When the network initiates clearing by sending a RELEASE message, the procedures described in
subclauses 5.4.3., 5.4.3.4 and 5.4.3.5 are followed.
A mobile station that does not support the "Prolonged Clearing Procedure" shall comply with the requirements of
subclause 5.4.4.1 and shall ignore subclause 5.4.4.2. A mobile station that supports the "Prolonged Clearing Procedure"
shall comply with the requirements of subclauses 5.4.4.2 and shall ignore subclause 5.4.4.1.
ETSI
Release 18 312 3GPP TS 24.008 V18.4.0 (2023-09)
5.4.4.1 Clearing initiated by the network: mobile does not support "Prolonged
Clearing Procedure"
Sublause 5.4.4.1 only applies to mobile stations that do not support the "Prolonged Clearing Procedure" option.
5.4.4.1.1 Clearing when tones/announcements provided

When in-band tones/announcements are provided (see subclause 5.5.1), the call control entity of the network may
initiate clearing by sending a DISCONNECT message containing progress indicator #8 "in-band information or
appropriate pattern now available", starting timer T306, and entering the "disconnect indication" state.
5.4.4.1.1.1 Receipt of a DISCONNECT message with progress indicator #8 from the network
The call control entity of the MS in any state except the "null" state, the "disconnect indication" state, and the "release
request" state, shall, upon receipt of a DISCONNECT message with progress indicator #8:
i) if an appropriate speech traffic channel is not connected, continue clearing as defined in subclause 5.4.4.1.2.1
without connecting to the in-band tone/announcement;
ii) if an appropriate speech traffic channel is connected, attach the user connection for speech if it is not yet attached
and enter the "disconnect indication" state. In that state, if upper layers request the clearing of the call, the call
control entity of the MS shall proceed as defined in subclause 5.4.4.1.2.1.
5.4.4.1.1.2 Expiry of timer T306
The call control entity of the network, having entered the "disconnect indication" state after sending a disconnect
message with the progress indicator #8, shall, upon expiry of timer T306, continue clearing by sending a RELEASE
message with the cause number originally contained in the DISCONNECT message; starting timer T308; and entering
the "release request" state.
5.4.4.1.2 Clearing when tones/announcements not provided

When in-band tones and announcements are not provided, the call control entity of the network shall initiate call
clearing by stopping all running call control timers, sending a DISCONNECT message without progress indicator,
starting timer T305 and entering the "disconnect indication" state.
5.4.4.1.2.1 Receipt of a DISCONNECT message without progress indicator or with progress

indicator different from #8 from the network
The call control entity of the mobile station in any state except the "null" state, the "disconnect indication" state, and the
"release request" state, shall, upon the receipt of a DISCONNECT message without progress indicator information
element or with progress indicator different from #8:
- stop all running call control timers;
- send a RELEASE message;
5.4.4.1.2.2 Receipt of a RELEASE message from the mobile station
The call control entity of the network in any state except the "null" state and the "release request" state, shall, upon
receipt of a RELEASE message: stop all running call control timers; send a RELEASE COMPLETE message; release
the MM connection; and return to the "null" state.
ETSI
Release 18 313 3GPP TS 24.008 V18.4.0 (2023-09)
5.4.4.1.2.3 Abnormal cases
The call control entity of the network, having entered the "disconnect indication" state after sending a DISCONNECT
message without progress indicator or with progress indicator different from #8, shall upon expiry of timer T305: send a
RELEASE message to the mobile station with the cause number originally contained in the DISCONNECT message;
start timer T308; and enter the "release request" state. In addition to the original clearing cause, the RELEASE message
may contain a second cause information element with cause #102 "recovery on timer expiry".
5.4.4.1.3 Completion of clearing

A call control entity of the mobile station in any call control state shall, upon receipt of a RELEASE COMPLETE
message from its peer entity in the network: stop all running call control timers; release the MM connection; and return
to the "null" state.
The call control entity of the mobile station in the "release request" state shall at first expiry of timer T308 retransmit
the RELEASE message and restart timer T308. At second expiry of timer T308, the call control entity of the mobile
station shall: release the MM connection; and return to the "null" state.
5.4.4.2 Clearing initiated by the network: mobile supports "Prolonged Clearing

Procedure"
Sublause 5.4.4.2 only applies to mobile stations that support the "Prolonged Clearing Procedure" option.
5.4.4.2.1 Clearing when tones/announcements provided and the network does not indicate
that "CCBS activation is possible"
When in-band tones/announcements are provided (see subclause 5.5.1) and CCBS is not applicable, the call control
entity of the network may initiate clearing by sending a DISCONNECT message containing progress indicator #8 "in-
band information or appropriate pattern now available", either not containing an Allowed Actions IE or containing an
Allowed Actions IE indicating "CCBS activation is not possible", starting timer T306, and entering the "disconnect
indication" state.
5.4.4.2.1.1 Receipt of a DISCONNECT message
The call control entity of the MS in any state except the "null" state, the "disconnect indication" state, and the "release
request" state, shall, upon receipt of a DISCONNECT message with progress indicator #8 and, either not containing an
Allowed Actions IE or containing an Allowed Actions IE indicating "CCBS activation is not possible":
i) if an appropriate speech traffic channel is not connected,
- start timer T308;
- enter the "release request" state; and
- not connect to the in-band tone/announcement.
ii) if an appropriate speech traffic channel is connected, attach the user connection for speech if it is not yet attached
and enter the "disconnect indication" state. In that state, if upper layers request the clearing of the call, the call
control entity of the MS shall:
ETSI
Release 18 314 3GPP TS 24.008 V18.4.0 (2023-09)
The call control entity of the network, having entered the "disconnect indication, shall, upon expiry of timer T306,
continue clearing by sending a RELEASE message with the cause number originally contained in the DISCONNECT
message; starting timer T308; and entering the "release request" state.
5.4.4.2.2 Clearing when the network indicates that "CCBS activation is possible"
When Activation of CCBS is possible, the call control entity of the network may initiate clearing by sending a
DISCONNECT message containing the Allowed Actions IE with an indication that "Activation of CCBS is possible"
and starting T338. Optionally, progress indicator #8 "in-band information or appropriate pattern now available" may
also be contained in the DISCONNECT message (in which case, T338 shall not be greater than T306).
5.4.4.2.2.1 Receipt of a DISCONNECT
Relative to the current state the following procedures apply:
- The call control entity of the MS in the "null" state, the "disconnect indication" state and the "release request"
state, shall, upon receipt of a DISCONNECT message react as described in clause 8.
- The call control entity of the MS in the "disconnect request" state, shall, upon receipt of a DISCONNECT
message:
- The call control entity of the MS in any other states, shall, upon receipt of a DISCONNECT message with an
Allowed Actions IE indicating "Activation of CCBS is possible" pass the "Activation of CCBS is possible"
indication to the upper layer, enter the "disconnect indication" state, stop all running call control timers and await
a response from the upper layers.
If the DISCONNECT message contained the progress indicator #8 "in-band information or appropriate pattern now
available" and an appropriate speech traffic channel is connected, then the MS shall attach the user connection for
speech if it is not yet attached. If the DISCONNECT message did not contain the progress indicator #8 "in-band
information or appropriate pattern now available" any connected speech traffic channel shall be disconnected.
Response from the upper layers:
i) If the upper layers request the clearing of the call, the call control entity of the MS shall:
ii) If the upper layers request that the "CCBS activation is to be attempted" then the MS shall
- send a RELEASE message containing a Facility IE including an
- Invoke=CCBSRequest to the network;
ETSI
Release 18 315 3GPP TS 24.008 V18.4.0 (2023-09)
If an appropriate speech traffic channel is connected, transmission of this RELEASE message shall not cause it
to be disconnected.
The call control entity of the network, having entered the "disconnect indication" state after sending a DISCONNECT
message with an Allowed Actions IE indicating "Activation of CCBS is possible" shall, upon expiry of timer T338,
continue clearing by sending a RELEASE message with the cause number originally contained in the DISCONNECT
message; starting timer T308; and entering the "release request" state.
5.4.4.2.3 Clearing when tones/announcements are not provided and the network does not
indicate that "CCBS activation is possible"
When in-band tones and announcements are not provided, and, the network does not wish to indicate in the Allowed
Actions IE that "CCBS is possible", the call control entity of the network shall initiate call clearing by stopping all
running call control timers, sending a DISCONNECT message without progress indicator, either without the Allowed
Actions IE or with the Allowed Actions IE indicating that "CCBS is not possible", starting timer T305 and entering the
"disconnect indication" state.
5.4.4.2.3.1 Receipt of a DISCONNECT message
The call control entity of the mobile station in any state except the "null" state, the "disconnect indication" state, and the
"release request" state, shall, upon the receipt of a DISCONNECT message either without progress indicator
information element or with progress indicator different from #8, and, either without the Allowed Actions IE or with the
Allowed Actions IE indicating that "CCBS is not possible":
The call control entity of the network, having entered the "disconnect indication", shall upon expiry of timer T305: send
a RELEASE message to the mobile station with the cause number originally contained in the DISCONNECT message;
start timer T308; and enter the "release request" state.
5.4.4.2.4 Receipt of a RELEASE message from the mobile station
5.4.4.2.4.1 Release, CCBS not requested
For a network that does not support the "CCBS activation" option:
The call control entity of the network in any state except the "null" state and the "release request" state, shall,
upon receipt of a RELEASE message: stop all running call control timers; send a RELEASE COMPLETE
message; release the MM connection; and return to the "null" state.
For a network that does support the "CCBS activation" option:
upon receipt of a RELEASE message without a Facility IE including an Invoke=CCBSRequest: stop all running
call control timers; send a RELEASE COMPLETE message; release the MM connection; and return to the "null"
state.
ETSI
Release 18 316 3GPP TS 24.008 V18.4.0 (2023-09)
5.4.4.2.4.2 Release, CCBS Requested
For a network that does not support the "CCBS activation" option:
upon receipt of a RELEASE message: stop all running call control timers; send a RELEASE COMPLETE
message; release the MM connection; and return to the "null" state.
For a network that does support the "CCBS activation" option:
upon receipt of a RELEASE message containing a Facility IE including an Invoke=CCBSRequest: stop all
running call control timers; then attempt to activate the recall; then send a RELEASE COMPLETE message
indicating the success or failure of the recall activation attempt; release the MM connection; and return to the
"null" state.
5.4.4.2.5 Completion of clearing

A call control entity of the mobile station in any call control state shall, upon receipt of a RELEASE COMPLETE
message from its peer entity in the network: stop all running call control timers; release the MM connection; and return
to the "null" state.
The call control entity of the mobile station in the "release request" state shall at first expiry of timer T308 retransmit
the RELEASE message and restart timer T308. At second expiry of timer T308, the call control entity of the mobile
station shall: release the MM connection; and return to the "null" state.
The retransmitted RELEASE message need not contain the Facility IE including an Invoke=CCBSRequest, even if the
original RELEASE message did contain this IE.5.4.5Clear collision
Clear collision occurs when both the mobile station and the network simultaneously transfer DISCONNECT messages
specifying the same call.
The behaviour of the network call control entity receiving a DISCONNECT message whilst in the "disconnect
indication" state is specified in subclause 5.4.3. The behaviour of the MS call control entity receiving a DISCONNECT
message whilst in the "disconnect request" state is defined in subclause 5.4.4.
Clear collision can also occur when both sides simultaneously transfer RELEASE messages related to the same call.
The entity receiving such a RELEASE message whilst within the "release request" state shall: stop timer T308; release
the MM connection; and enter the "null" state (without sending a RELEASE COMPLETE message).
5.4.5 Call clearing for SRVCC from CS to PS

If the MS receives the request from upper layers to release the call locally, the call control entity of the MS shall detach
the user connection, if connected, and enter the NULL state.
5.5 Miscellaneous procedures

5.5.1 In-band tones and announcements
When the network wants to make the mobile station attach the user connection (e.g. in order to provide in-band
tones/announcement) before the mobile station has reached the "active" state of a call, the network may include a
progress indicator IE indicating user attachment in a suitable CC message:
- Either it includes the IE in a SETUP, CALL PROCEEDING, ALERTING, or CONNECT message that is send
during call establishment
- it sends a PROGRESS message containing the IE.
ETSI
Release 18 317 3GPP TS 24.008 V18.4.0 (2023-09)
A progress indicator IE indicates user attachment if it specifies a progress description in the set {1, 2, 3} or in the set
{6, 7, 8, ..., 20}.
On reception of a SETUP, CALL PROCEEDING, ALERTING, CONNECT, or PROGRESS message the mobile
station shall proceed as specified elsewhere in clause 5; if the progress indicator IE indicated user attachment and a
speech mode traffic channel is appropriate for the call the mobile station shall in addition: attach the user connection for
speech as soon as an appropriate channel in speech mode is available. (If a new order to attach the user connection is
received before the attachment has been performed, the new order shall supersede the previous one.)
Under certain conditions the MS will have to attach the user connection before the CONNECT message. It is up to the
network to ensure that no undesired end-to-end through connection takes place during the establishment of a MT call.
NOTE: This allows the use of progress indicator IEs independently from the channel modes appropriate for the
call.
The network may generate multimedia CAT to a mobile station supporting multimedia CAT during the alerting phase
of a mobile originated multimedia call establishment as specified in subclause 5.3.6.4.
5.5.2 Call collisions

Call collisions as such cannot occur at the network. Any simultaneous mobile originating or mobile terminating calls
are dealt with separately assigned and different transaction identifiers.
5.5.3 Status procedures
5.5.3.1 Status enquiry procedure

Whenever a call control entity wishes to check the call state of its peer entity, it may initiate the status enquiry
procedure.
NOTE: This may, in particular, apply to procedural error conditions described in clause 8.
A call control entity initiates the status enquiry procedure by sending the STATUS ENQUIRY message and starting
timer T322. The value of T322 is implementation dependent in the MS and set in the network by the network operator.
While timer T322 is running, the call control entity shall not send further STATUS ENQUIRY messages.
Upon receipt of a STATUS ENQUIRY message, the receiver shall respond with a STATUS message, reporting the
current call state and cause value #30 "response to STATUS ENQUIRY". Receipt of the STATUS ENQUIRY shall not
result in a state change relating to any protocol and connection of the receiver.
If a STATUS message is received that contains cause value #30 "response to status enquiry", timer T322 shall be
stopped and further appropriate actions taken, based on the information in that STATUS message, relative to the current
state of the receiver of the STATUS message. These further "appropriate actions" are implementation dependent.
However, the actions prescribed in subclause 5.5.3.2 shall apply.
If a clearing message is received while timer T322 is running, timer T322 shall be stopped, and call clearing shall
continue.
If timer T322 expires, the STATUS ENQUIRY message may be retransmitted maximally once. If T322 expires after
the STATUS ENQUIRY has been transmitted the maximum number of times, clearing of the call shall be initiated with
cause value #41, "temporary failure", in the first call clearing message.
5.5.3.2 Reception of a STATUS message by a CC entity
5.5.3.2.1 STATUS message with incompatible state

On receipt of a STATUS message reporting an incompatible call control state, the receiving entity shall clear the call by
sending a RELEASE COMPLETE message with cause # 101 "message not compatible with protocol state". The
reported call control state is incompatible if the combination of call control states at the sender and receiver side cannot
occur, do not match or cannot be aligned by actions of the receiver; the exact definition is implementation dependent.
ETSI
Release 18 318 3GPP TS 24.008 V18.4.0 (2023-09)
5.5.3.2.2 STATUS message with compatible state

A STATUS message may be received indicating a compatible call state but containing one of the following causes:
# 95 "semantically incorrect message"; or
# 96 "invalid mandatory information"; or
# 97 "message type non-existent or not implemented"; or
# 98 "message type not compatible with protocol state"; or
# 99 "information element non-existent or not implemented"; or
# 100 "conditional IE error".
This indicates that the transmitter of the STATUS message was unable to accept some information sent by the recipient
of the STATUS message. This allow the recipient to retransmit some or all of the information. Other actions are
possible and are implementation dependent; they may include releasing the call.
In the case the MS receives a STATUS message with the cause #100 due to the presence of a Repeat Indicator with the
value "service change and fallback" in a SETUP message, it may then resend a new SETUP message with a single BC-
IE (no Repeat Indicator is included). The actual behaviour is dependent on the implementation.
In the case the network receives a STATUS message with the cause #100 due to the presence of a Repeat Indicator with
the value "service change and fallback" in a SETUP message, it shall then resend a new SETUP message, with either
the BC-IE of the preferred service or the speech BC-IE (fallback to speech) as the only BC (no Repeat Indicator is
included). The preferred behaviour is decided by configuration.
5.5.4 Call re-establishment, mobile station side

This subclause describes the internal handling in the mobile station as far as call control is concerned.
5.5.4.1 Indication from the mobility management sublayer

When a MM connection is active, an indication may be given by the MM sublayer to the call control entity to announce
that the current MM connection has been interrupted but might be re-established on request of call control.
5.5.4.2 Reaction of call control

Depending whether call re-establishment is allowed or not and on its actual state, call control shall decide to either
request re-establishment or to release the MM connection.
a) Re-establishment not required
If the call is in the call establishment or call clearing phase, i.e. any state other than the "active" state or the
"mobile originating modify" state, call control shall release the MM connection
b) Re-establishment required
If the call is in the "active" state or "mobile originating modify" state, the indication from MM that re-
establishment is possible shall cause call control to request re-establishment from the MM connection,
suspend any further message to be sent and await the completion of the re-establishment procedure.
5.5.4.3 Completion of re-establishment

Call Control is notified when the MM connection is re-established and shall then resume the transmission of possibly
suspended messages and resume user data exchange when an appropriate channel is available.
5.5.4.4 Unsuccessful outcome

If the attempt to re-establish the connection was unsuccessful, the MM connection will be released and a release
indication will be given to call control, see subclause 4.5.1.6.
ETSI
Release 18 319 3GPP TS 24.008 V18.4.0 (2023-09)
5.5.5 Call re-establishment, network side

This subclause describes the handling in the network as far as call control is concerned.
5.5.5.1 State alignment

After a successful call re-establishment it is a network responsibility to identify (e.g. by using the status enquiry
procedure, if needed, and resolve, if possible, any call state or auxiliary state mismatch between the network and the
mobile station.
5.5.6 Progress
At any time during the establishment or release of a call and during an active call the network may send a PROGRESS
message to the mobile station.
On receipt of a PROGRESS message during the establishment or release of a call the mobile station shall stop all call
control timers related to that call.
NOTE: If the PROGRESS has been received before the receipt of a CALL PROCEEDING message, the mobile
station will not start timer T310 on receipt of a CALL PROCEEDING message, see subclause 5.2.1.1.3.
Figure 5.11/3GPP TS 24.008 Progress
5.5.7 DTMF protocol control procedure

Dual Tone Multi Frequency (DTMF) is an inband one out of four plus one out of four signalling system primarily used
from terminal instruments in telecommunication networks. The support of DTMF in the network is described in
3GPP TS 23.014 [12].
The mobile station shall be capable of transmitting DTMF messages as specified in this subclause if and only if the
mobile station has the user connection for speech attached and an appropriate channel is available.
The transaction identifier used by the DTMF messages shall be that of the attached speech call.
NOTE 1: The present document means that DTMF messages can generally be sent in the active state of a call in
speech transmission mode or when a traffic channel is available during setup or release and the progress
indicator IE has been received.
NOTE 2: Since the DTMF protocol messages are sent in a store and forward mode on the signalling channels the
control of the device at the far end may be delayed dependent on the load or quality of the channels.
NOTE 3: The procedures described in this paragraph support DTMF only in the direction mobile station to
network.
establishment should also be capable of transmitting DTMFs during a multimedia call as specified in subclause 5.3.6.5.
5.5.7.1 Start DTMF request by the mobile station

A user may cause a DTMF tone to be generated e.g. by depression of a key in the mobile station. The relevant action is
interpreted by the mobile station as a requirement for a DTMF digit to be sent in a START DTMF message on an
established FACCH. This message contains the value of the digit to be transmitted (0, 1, ..., 9, A, B, C, D, *, #).
Only a single digit will be transferred in each START DTMF message.
On sending a START DTMF message the MS shall start timer T336.
ETSI
Release 18 320 3GPP TS 24.008 V18.4.0 (2023-09)
Where a previous START DTMF message has been sent, another START DTMF message shall only be sent by the MS
following receipt of its STOP DTMF ACKNOWLEDGE message (see subclause 5.5.7.4) or a START DTMF REJECT
message from the network (see subclause 5.5.7.2) or following the expiry of timers T336 and T337.
If timer T336 expires, the MS shall terminate the ongoing DTMF procedure without any retransmissions, and is free to
begin another DTMF procedure (e.g. another START DTMF message).
5.5.7.2 Start DTMF response by the network

Upon receiving the START DTMF message the network shall either:
- convert the received digit into a DTMF tone which is applied toward the remote user, or
- send the DTMF digit as an out-of-band message (see 3GPP TS 23.205 [96])
and return a START DTMF ACKNOWLEDGE message to the mobile station. This acknowledgement may be used in
the mobile station to generate an indication as a feedback for a successful transmission.
If the network cannot accept the START DTMF message a START DTMF REJECT message will be sent to the mobile
station. Upon receipt of a START DTMF ACK message or a START DTMF REJECT message, the MS shall stop timer
T336.
5.5.7.3 Stop DTMF request by the mobile station

When the user indicates that the DTMF sending should cease e.g. by releasing the key the mobile station will send a
STOP DTMF message to the network.
On sending a STOP DTMF message the MS shall start timer T337.
The MS shall only send a STOP DTMF message if a START DTMF ACKNOWLEDGE message has been received
from the network (see subclause 5.5.7.2).
If timer T337 expires, the MS shall terminate the ongoing DTMF procedure without any retransmissions, and is free to
begin another DTMF procedure. (e.g. another START DTMF message).
5.5.7.4 Stop DTMF response by the network

Upon receiving the STOP DTMF message the network shall either:
- stop sending the DTMF tone if applied by the network, or
- initiate a suitable out-of-band message (see 3GPP TS 23.205 [96])
and return a STOP DTMF ACKNOWLEDGE message to the mobile station. Upon receipt of a STOP DTMF
ACKNOWLEDGE message, the MS shall stop timer T337.
5.5.7.5 Sequencing of subsequent start DTMF requests by the mobile station

If the network is generating DTMF tones it shall ensure that the minimum length of tone and the minimum gap between
two subsequent tones (according to ETSI ES 201 235-2 [12a]) is achieved.
NOTE 1: In ETSI ES 201 235-2 [12a] the minimum duration of a DTMF tone is 65ms.
NOTE 2: In ETSI ES 201 235-2 [12a] the minimum gap between DTMF tones is 65ms.
There is no defined maximum length to the tone, which will normally cease when a STOP DTMF message is received
from the MS. However, the operator may choose to put a pre-defined time limit on the duration of tones sent.
The appropriate sequencing of DTMF control messages is shown in figures 5.8 and 5.9.
NOTE 3: The network may implement the time limit option where the DTMF tone duration is controlled by the
network irrespective of the receipt of a STOP DTMF message from the mobile station.
ETSI
Release 18 321 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 5.8/3GPP TS 24.008 Single DTMF transmission
Figure 5.9/3GPP TS 24.008 Multiple DTMF transmission
6 Support for packet services

This chapter contains the description of the procedures for the session management of GPRS point-to-point data
services and MBMS point-to-point and point-to-multipoint data services at the radio interface (Reference point Uu and
Um).
6.1 GPRS Session management

6.1.1 General
The main function of the session management (SM) is to support PDP context handling of the user terminal.
Furthermore, the SM supports the MBMS context handling within the MS and the network, which allows the MS to
receive data from a specific MBMS source.
The SM comprises procedures for
- identified PDP context activation, deactivation and modification; and
- identified MBMS context activation and deactivation.
SM procedures for identified access can only be performed if a GMM context has been established between the MS and
the network. If no GMM context has been established, the MM sublayer has to initiate the establishment of a GMM
context by use of the GMM procedures as described in chapter 4. After GMM context establishment, SM uses services
offered by GMM (see 3GPP TS 24.007 [20]). Ongoing SM procedures are suspended during GMM procedure
execution.
The SM procedures for identified MBMS context activation and deactivation can only be performed, if in addition to
the GMM context the MS has a PDP context activated.
In Iu mode only, integrity protected signalling (see subclause 4.1.1.1.1 of the present document and in general, see
3GPP TS 33.102 [5a]) is mandatory. In Iu mode only, all protocols shall use integrity protected signalling. Integrity
ETSI
Release 18 322 3GPP TS 24.008 V18.4.0 (2023-09)
protection of all SM signalling messages is the responsibility of lower layers. It is the network which activates integrity
protection. This is done using the security mode control procedure (3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).
For the session management protocol, the extended TI mechanism may be used (see 3GPP TS 24.007 [20]).
6.1.2 Session management states

In this subclause, the SM states are described for one SM entity (see 3GPP TS 24.007 [20]). Each SM entity is
associated with one PDP context or MBMS context. Subclause 6.1.2.1 describes the SM states in the MS and
subclause 6.1.2.2 describes the SM states on the network side.
6.1.2.1 Session management states in the MS

In this subclause, the possible states of an SM entity in the mobile station are described. As illustrated in figure
6.1/3GPP TS 24.008 and 6.1a/3GPP TS 24.008 there are seven SM states in the MS.
6.1.2.1.1 PDP-INACTIVE
This state indicates that neither PDP context nor MBMS context exist.
6.1.2.1.2 PDP-ACTIVE-PENDING
This state exists when PDP context activation was requested by the MS.
6.1.2.1.3 PDP-INACTIVE-PENDING
This state exists when deactivation of the PDP contexts was requested by the MS.
6.1.2.1.4 PDP-ACTIVE
This state indicates that the PDP context is active.
6.1.2.1.5 PDP-MODIFY_PENDING
This state exists when modification of the PDP context was requested by the MS.
6.1.2.1.6 MBMS-ACTIVE-PENDING
This state exists when the MS has requested the network to activate an MBMS context.
6.1.2.1.7 MBMS-ACTIVE
This state indicates that the MBMS context is active.
ETSI
Release 18 323 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 6.1/3GPP TS 24.008: Session management states for PDP context handling in the MS
(overview)
It shall be noted, that Figure 6.1/3GPP TS 24.008 applies to both the PDP context activation procedure and the
secondary PDP context activation procedure, though the distinction in messages regarding the activation of PDP
contexts is not shown here for simplicity.
ETSI
Release 18 324 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 6.1a/3GPP TS 24.008: Session management states for MBMS context handling in the MS
(overview)
6.1.2.2 Session management states on the network side

In this subclause, the possible states of an SM entity on the network side are described. As illustrated in figures
6.2/3GPP TS 24.008 and 6.2a/3GPP TS 24.008 there are eight SM states on the network side.
6.1.2.2.1 PDP-INACTIVE
This state indicates that the PDP context or MBMS context is not active.
6.1.2.2.2 PDP-ACTIVE-PENDING
This state exists when the PDP context activation was initiated by the network.
6.1.2.2.3 PDP-INACTIVE-PENDING
This state exists when deactivation of the PDP context was requested by the network.
6.1.2.2.4 PDP-ACTIVE
This state indicates that the PDP context is active.
6.1.2.2.5 PDP-MODIFY-PENDING
This state exists when modification of the PDP context was requested by the network.
ETSI
Release 18 325 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.2.2.6 MBMS-ACTIVE-PENDING
This state exists when the network has initiated MBMS context activation.
6.1.2.2.7 MBMS-INACTIVE-PENDING
This state exists when the network has requested the MS to deactivate an MBMS context.
6.1.2.2.8 MBMS-ACTIVE
This state indicates that the MBMS context is active.
Figure 6.2/3GPP TS 24.008: Session management states for PDP context handling on the network
side (overview)
It shall be noted, that figure 6.2/3GPP TS 24.008 applies to both the PDP context activation procedure and the
secondary PDP context activation procedure, though the distinction in messages regarding the activation of PDP
contexts is not shown here for simplicity.
ETSI
Release 18 326 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 6.2a/3GPP TS 24.008: Session management states for MBMS context handling on the network
side (overview)
6.1.2A PDP address allocation
6.1.2A.1 General
PDP addresses are handled differently for PDN interworking of type PPP and IP (IPv4 or IPv6).
6.1.2A.1.1 Interworking with PDN based on IP

During PDP context activation (see subclause 6.1.3.1), the MS can configure an IPv4 address, or obtain an IPv6
interface identifier to be used during the IETF-based IP address allocation after PDP context establishment.
The MS can obtain an IPv4 address or an IPv6 prefix via an IETF-based IP address allocation mechanism once the PDP
context is established.
The following IETF-based IP address/prefix allocation methods are specified for GPRS (the corresponding procedures
are specified in 3GPP TS 29.061 [130]):
a) /64 IPv6 default prefix allocation via IPv6 stateless address autoconfiguration. Optionally, allocation of
additional IPv6 prefix(es) with length /64 or shorter via stateful DHCPv6 Prefix Delegation (see
IETF RFC 3633 [139]);
b) IPv4 address allocation and IPv4 parameter configuration via DHCPv4;
Upon deactivation of a default PDP context, the MS shall locally release any IPv4 address or IPv6 prefix allocated to
the MS for the corresponding PDN connection.
6.1.2A.1.2 Interworking with PDN based on PPP

During PDP context activation no PDP address is configured. Instead, such information is negotiated and configured
during the NCP phase of PPP.
ETSI
Release 18 327 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.2A.2 IP address allocation via NAS signalling

The MS shall set the PDP type in the PDP address IE in the ACTIVATE PDP CONTEXT REQUEST message when
requesting establishment of a default PDP context; the detailed rules with regards to IP version for MS and network side
are defined in subclause 6.1.3.1.
If the MS wants to use DHCPv4 for IPv4 address assignment, it shall indicate that to the network within the Protocol
Configuration Options IE in the ACTIVATE PDP CONTEXT REQUEST.
If the MS requests allocation of an IPv6 address, the network constructs it of two parts: a /64 IPv6 prefix and an
interface identifier of 64 bits length. The IPv6 prefix part is not used immediately by the MS; however, the network
shall use the same IPv6 prefix in subsequent procedures for IETF-based IP address allocation. The interface identifier is
only used for building a unique link-local IPv6 address.
6.1.3 Session Management procedures
6.1.3.0 General
The MS's maximum number of active PDP contexts in a PLMN is determined by the lowest of the maximum number of
Network Service Access Point Identifiers (NSAPIs) allowed by the protocol (as specified in subclause 10.5.6.2), the
PLMN's maximum number of PDP contexts in Iu or A/Gb mode and the MS's implementation-specific maximum
number of PDP contexts.
NOTE: Subclauses 6.1.3.1.3 and 6.1.3.2.2 specify how the MS determines the PLMN's maximum number of PDP
contexts in Iu or A/Gb mode.
6.1.3.1 PDP context activation

The purpose of this procedure is to establish a PDP context between the MS and the network for a specific QoS on a
specific NSAPI. The PDP context activation may be initiated by the MS or the initiation may be requested by the
network.
An MS attached for emergency bearer services shall only request a PDP context with request type set to "emergency".
If there already is a PDN connection for emergency bearer services established, the MS shall not request an additional
PDN connection for emergency bearer services. The MS shall not request emergency bearer services in A/Gb mode or
in GERAN Iu mode.
If the MS has reached the maximum number of active PDP contexts (see subclause 6.1.3.0) and the upper layers of the
MS request activation of additional PDP context, then the MS shall not send an ACTIVATE PDP CONTEXT
REQUEST message or an ACTIVATE SECONDARY PDP CONTEXT REQUEST message to activate the additional
PDP context. If the additional PDP context is a PDP context with type set to "emergency", then it may skip explicit
deactivation to free PDP context resources and instead re-activate the necessary context(s) relying on network handling
of abnormal cases as specified in subclause 6.1.3.1.5 case c). In either case it is an MS implementation option which
PDP context(s) to re-use for emergency.
Each PDP address may be described by one or more PDP contexts in the MS or the network. The PDP Context
Activation procedure is used to activate the default PDP context for a given PDP address and APN, i.e. a PDN
connection, whereas all additional contexts associated to the same PDP address and APN are activated with the
secondary PDP context activation procedure. An MS supporting S1 mode shall keep the default PDP context activated
during the lifetime of the PDN connection. An MS not supporting S1 mode should apply the same behaviour (see
3GPP TS 23.060 [74]). When more than one PDP context is associated to a PDP address, there shall be a Traffic Flow
Template (TFT), including one or more packet filters, for each or all but one context. The downlink and uplink packet
filters are considered separately. If present, the TFT shall be sent transparently either from the MS via the SGSN to the
GGSN to enable packet classification and policing for downlink data transfer in the GGSN or from the GGSN via the
SGSN to the MS to be used in a network requested secondary PDP context activation procedure (see subclause 6.1.3.2)
and enable packet classification and policing for uplink data transfer in the MS (see 3GPP TS 23.060 [74]).
For the purpose of requesting non-IP connectivity, the MS shall set the PDP type number in the Requested PDP address
information element in the ACTIVATE PDP CONTEXT REQUEST message to "non IP". The MS supporting non-IP
connectivity shall also support the extended protocol configuration options IE.
ETSI
Release 18 328 3GPP TS 24.008 V18.4.0 (2023-09)
For the purpose of requesting IP address allocation the MS shall set the PDP type number in the Requested PDP address
information element in the ACTIVATE PDP CONTEXT REQUEST message based on its IP stack configuration (e.g.
the per APN settings specified in 3GPP TS 23.060 [74]) as follows:
a) An MS, which is IPv6 and IPv4 capable, and
- has not been allocated an IP address for this APN, shall set the PDP type number to "IPv4v6 address";
- has been allocated an IPv4 address for this APN and received the SM cause #52, "single address bearers only
allowed", and is requesting an IPv6 address, shall set the PDP type number to "IPv6 address";
- has been allocated an IPv6 address for this APN and received the SM cause #52, "single address bearers only
allowed", and is requesting an IPv4 address, shall set the PDP type number to "IPv4 address".
b) An MS, which is only IPv4 capable, shall set the PDP type number to "IPv4 address".
c) An MS, which is only IPv6 capable, shall set the PDP type number to "IPv6 address".
d) When the IP version capability of the MS is unknown in the MS (as in the case when the MT and TE are
separated and the capability of the TE is not known in the MT), the MS shall set the PDP type number to
"IPv4v6 address".
On receipt of the ACTIVATE PDP CONTEXT REQUEST message sent by the MS, the network when allocating an IP
address shall take into account the PDP type number, the operator policies of the home and visited network, and the
user's subscription data.
- If the MS requests PDP type IPv4v6, but the network configuration dictates the use of IPv4 addressing only or
IPv6 addressing only for this APN, the network shall override the PDP type requested by the MS to a single
address PDP type (IPv4 or IPv6). In the ACTIVATE PDP CONTEXT ACCEPT message sent to the MS, the
network sets the PDP type number to either "IPv4 address" or "IPv6 address" and the SM cause to #50 "PDP
type IPv4 only allowed", or #51 "PDP type IPv6 only allowed", respectively (see subclause 6.1.3.1.1).
- If the MS requests PDP type IPv4v6, but the operator uses single addressing per PDP context due to
interworking with nodes of earlier releases, the network shall override the PDP type requested by setting the
PDP type in the ACTIVATE PDP CONTEXT ACCEPT message sent to the MS to a single address PDP type. In
the ACTIVATE PDP CONTEXT ACCEPT message sent to the MS, the network sets the PDP type number to
either "IPv4 address" or "IPv6 address" and the SM cause to #52, "single address bearers only allowed" (see
subclause 6.1.3.1.1).
The MS, in a pre release 8 network not supporting IPv4/v6, could encounter other network reactions:
- If the MS requests PDP type IPv4v6, and the PDP type is changed to PDP type IPv4 and no SM cause is
included, the MS should request another PDP context for PDP type IPv6 to the same APN.
NOTE: Some networks can respond with ACTIVATE PDP CONTEXT REJECT with SM cause #28 "unknown
PDP address or PDP type". In that instance, the MS can attempt to establish dual-stack connectivity by
performing two PDP context activation request procedures to activate an IPv4 PDP context and an IPv6
PDP context, both to the same APN.
6.1.3.1.1 Successful PDP context activation initiated by the mobile station

In order to request a PDP context activation, the MS sends an ACTIVATE PDP CONTEXT REQUEST message to the
network, enters the state PDP-ACTIVE-PENDING and starts timer T3380. The message contains the selected NSAPI,
PDP type number and requested QoS. The MS shall ensure that the selected NSAPI is not currently being used by
another Session Management entity in the MS. The MS may indicate the support of Network Requested Bearer Control
procedures, the support of local IP address in TFTs or the 3GPP PS data off UE status in the protocol configuration
options information element. The MS supporting S1 mode shall indicate subscribed, interactive or background traffic
class in the QoS requested. The MS not supporting S1 mode should indicate subscribed, interactive or background
traffic class in the QoS requested. If there is a subscribed QoS profile available for the MS, the network may ignore the
requested QoS and apply the subscribed QoS profile (see 3GPP TS 23.060 [74]).
The MS shall set the request type to "initial request" when the MS is establishing connectivity to an additional PDN for
the first time, i.e. when it is an initial attach to that PDN. The MS shall set the request type to "handover" when the
connectivity to a PDN is established upon handover from a non-3GPP access network and the MS was connected to that
ETSI
Release 18 329 3GPP TS 24.008 V18.4.0 (2023-09)
PDN before the handover to the 3GPP access network. If the MS is establishing connectivity for emergency bearer
services it shall set the request type to "emergency" and not include an APN in the ACTIVATE PDP CONTEXT
REQUEST message.
Upon receipt of the ACTIVATE PDP CONTEXT REQUEST message with request type set to "emergency" the
network shall use the APN or the GGSN/PDN GW configured for emergency bearer services.
Upon receipt of an ACTIVATE PDP CONTEXT REQUEST message with a PDP type number "IPv4v6 address" in the
Requested PDP address information element, the network shall on sending the ACTIVATE PDP CONTEXT ACCEPT
message:
- include the SM cause information element with cause #50 "PDP type IPv4 only allowed", if the requested PDN
connectivity is accepted with the restriction that only PDP type IPv4 is allowed; or
- include the SM cause information element with cause #51 "PDP type IPv6 only allowed", if the requested PDN
connectivity is accepted with the restriction that only PDP type IPv6 is allowed; or
- include the SM cause information element with cause #52 "single address bearers only allowed", if the requested
PDN connectivity is accepted with the restriction that only single IP version bearers are allowed.
If the MS receives the SM cause value #50 "PDP type IPv4 only allowed" or #51 "PDP type IPv6 only allowed" in the
ACTIVATE PDP CONTEXT ACCEPT message, the MS shall not subsequently request another PDP context to get a
PDP Type different from the one allowed by the network, until:
- all PDP contexts to the given APN are deactivated either explicitly between the MS and the network, i.e. PDP
context deactivation procedure, or implicitly (without peer to peer signalling between the MS and the network)
as a result of:
i) PDP context synchronization during routing area updating or service request procedure;
ii) PDP context deactivation initiated by the network,
iii) detach from GPRS services; or;
iv) a service request procedure is rejected with a cause which results in the MS entering state GMM-
DEREGISTERED; or
- the PDP type which is used to access to the APN is changed.
NOTE 1: Request to send another ACTIVATE PDP CONTEXT REQUEST message with a specific PDP type
comes from upper layers.
If the MS receives the SM cause value #52 "single address bearers only allowed" in the ACTIVATE PDP CONTEXT
ACCEPT message, the MS should subsequently request another PDP context for the other PDP type to the same APN
with a single address PDP type (IPv4 or IPv6) other than the one already activated.
NOTE 2: If the MT and TE are separated, the MS might not be able to use SM cause #52 "single address bearers
only allowed" as a trigger for activating a second single-IP-stack PDP context.
Upon receipt of an ACTIVATE PDP CONTEXT REQUEST message, the network selects a radio priority level based
on the QoS negotiated and may reply with an ACTIVATE PDP CONTEXT ACCEPT message.
If the ACTIVATE PDP CONTEXT REQUEST message included a low priority indicator set to "MS is configured for
NAS signalling low priority", the network shall store the NAS signalling low priority indication within the default PDP
context.
If the network receives an ACTIVATE PDP CONTEXT REQUEST message with the same combination of APN and
PDP type as an already existing PDN connection, and multiple PDN connections for a given APN are allowed, the
network may retain the existing PDP contexts and proceed with the requested PDP context activation procedure.
Upon receipt of the message ACTIVATE PDP CONTEXT ACCEPT the MS shall stop timer T3380, shall enter the
state PDP-ACTIVE. If the protocol configuration options information element is present, the network may indicate the
Bearer Control Mode that shall be used, the network support of local IP address in TFTs, or the 3GPP PS data off
support indication. If the protocol configuration options information element is not present or the Selected Bearer
Control Mode parameter is not present in the protocol configuration options information element, the MS shall apply
Bearer Control Mode 'MS only' for all active PDP contexts sharing the same PDP Address and APN. If the 3GPP PS
ETSI
Release 18 330 3GPP TS 24.008 V18.4.0 (2023-09)
data off UE status is "activated", the MS behaves as described in subclause 4.7.1.10. If the offered QoS parameters
received from the network differ from the QoS requested by the MS, the MS shall either accept the negotiated QoS or
initiate the PDP context deactivation procedure. If the Request type information element is not present, the network
shall assume that the request type is "initial request".
NOTE 3: If the MS requested a value for a QoS parameter that is not within the range specified by
3GPP TS 23.107 [81], the network should negotiate the parameter to a value that lies within the specified
range.
If the lower layers provide a L-GW Transport Layer Address value together with the ACTIVATE PDP CONTEXT
REQUEST message and a PDN connection is established as a LIPA PDN connection due to the ACTIVATE PDP
CONTEXT REQUEST message, then the SGSN shall store the L-GW Transport Layer Address value as the GGSN
address in the PDP context of the LIPA PDN connection. If connectivity with the requested APN is accepted and the
network considers this PDN connection a LIPA PDN connection, then subject to operator policy the SGSN shall
include in the ACTIVATE PDP CONTEXT ACCEPT message the Connectivity type IE indicating "the PDN
connection is considered a LIPA PDN connection".
If the lower layers provide a SIPTO L-GW Transport Layer Address value identifying a L-GW together with the
ACTIVATE PDP CONTEXT REQUEST message and a PDN connection is established as a SIPTO at the local
network PDN connection due to the ACTIVATE PDP CONTEXT REQUEST message, then the SGSN shall store the
SIPTO L-GW Transport Layer Address value as the P-GW address in the PDP context of the SIPTO at the local
network PDN connection.
If the lower layers provide a LHN-ID value together with the ACTIVATE PDP CONTEXT REQUEST message and a
PDN connection is established as a SIPTO at the local network PDN connection due to the ACTIVATE PDP
CONTEXT REQUEST message, then the SGSN shall store the LHN-ID value in the PDP context of the SIPTO at the
local network PDN connection.
NOTE 4: The receipt of a LHN-ID value during the establishment of the PDN connection, during routing area
updating procedure or during inter-SGSN handover can be used as an indication by the SGSN that the
SIPTO at the local network PDN connection is established to a stand-alone GW (see
3GPP TS 23.060 [74]).
In A/Gb mode, the MS shall initiate establishment of the logical link for the LLC SAPI indicated by the network with
the offered QoS and selected radio priority level if no logical link has been already established for that SAPI. If the
offered QoS parameters received from the network differ from the QoS requested by the MS, the MS shall either accept
the negotiated QoS or initiate the PDP context deactivation procedure. If the LLC SAPI indicated by the network can
not be supported by the MS, the MS shall initiate the PDP context deactivation procedure.
In Iu mode, both the network and the MS shall store the LLC SAPI and the radio priority in the PDP context. If a Iu
mode to A/Gb mode system change is performed, the new SGSN shall initiate establishment of the logical link using
the negotiated QoS profile, the negotiated LLC SAPI, and selected radio priority level stored in the PDP context as in a
A/Gb mode to A/Gb mode Routing Area Update.
An MS, which is capable of operating in A/Gb mode, shall use a valid LLC SAPI, while an MS which is not capable of
operating in A/Gb mode shall indicate the LLC SAPI value as "LLC SAPI not assigned" in order to avoid unnecessary
value range checking and any other possible confusion in the network. When the MS uses a valid LLC SAPI, the
network shall return a valid LLC SAPI. The network shall return the "LLC SAPI not assigned" value only when the MS
uses the "LLC SAPI not assigned" value.
NOTE 5: The radio priority level and the LLC SAPI parameters, though not used in Iu mode, shall be included in
the messages, in order to support handover between Iu mode and A/Gb mode networks.
If a WLAN offload indication information element is included in the ACTIVATE PDP CONTEXT ACCEPT message,
the MS shall store the WLAN offload acceptability values for this PDN connection and use the UTRAN offload
acceptability value to determine whether this PDN connection is offloadable to WLAN or not.
At inter-system change from Iu mode to A/Gb mode, SM shall locally deactivate the active PDP context(s) if SM does
not have the following parameters:
- LLC SAPI; and
- radio priority.
ETSI
Release 18 331 3GPP TS 24.008 V18.4.0 (2023-09)
Upon receipt of the ACTIVATE PDP CONTEXT ACCEPT message with the Connectivity type IE indicating "the PDN
connection is considered a LIPA PDN connection", the MS provides an indication to the upper layers that the
connectivity is provided by a LIPA PDN connection.
6.1.3.1.2 Successful PDP context activation requested by the network

In order to request a PDP context activation, the network sends a REQUEST PDP CONTEXT ACTIVATION message
to the MS and starts timer T3385. The message contains an offered PDP address. If available, the APN shall be included
in the REQUEST PDP CONTEXT ACTIVATION message.
Upon receipt of a REQUEST PDP CONTEXT ACTIVATION message if an APN is indicated in the message and the
timer T3396 is running for the APN, the MS shall stop the timer T3396, and then either initiate the PDP context
activation procedure as described in the previous subclause or reject the activation request by sending a REQUEST PDP
CONTEXT ACTIVATION REJECT message as described in subclause 6.1.3.1.4. If the REQUEST PDP CONTEXT
ACTIVATION message did not contain an APN, then the MS shall stop the timer T3396 associated with no APN. The
value of the reject cause IE of the REQUEST PDP CONTEXT ACTIVATION REJECT message shall indicate the
reason for rejection, e.g. "insufficient resources to activate another context".
The ACTIVATE PDP CONTEXT REQUEST message sent by the MS in order to initiate the PDP context activation
procedure shall contain the PDP address, PDP Type and APN requested by the network in the REQUEST PDP
CONTEXT ACTIVATION message.
Upon receipt of the ACTIVATE PDP CONTEXT REQUEST message, the network shall stop timer T3385.
The same procedures then apply as described for MS initiated PDP context activation.
6.1.3.1.3 Unsuccessful PDP context activation initiated by the MS
6.1.3.1.3.1 General
Upon receipt of an ACTIVATE PDP CONTEXT REQUEST message the network may reject the MS initiated PDP
context activation by sending an ACTIVATE PDP CONTEXT REJECT message to the MS. The message shall contain
a cause code that typically indicates one of the following causes:
# 8: Operator Determined Barring;
# 26: insufficient resources;
# 27: missing or unknown APN;
# 28: unknown PDP address or PDP type;
# 29: user authentication failed;
# 30: activation rejected by GGSN, Serving GW or PDN GW;
# 31: activation rejected, unspecified;
# 32: service option not supported;
# 33: requested service option not subscribed;
# 34: service option temporarily out of order;
# 35: NSAPI already used. The network shall not send this cause code (see note 1);
# 50: PDP type IPv4 only allowed;
# 51: PDP type IPv6 only allowed;
# 57: PDP type IPv4v6 only allowed;
# 58: PDP type non IP only allowed;
# 65: maximum number of PDP contexts reached;
ETSI
Release 18 332 3GPP TS 24.008 V18.4.0 (2023-09)
# 66: requested APN not supported in current RAT and PLMN combination;
# 95 - 111: protocol errors;
#112: APN restriction value incompatible with active PDP context; or
#113: Multiple accesses to a PDN connection not allowed.
NOTE 1: Pre-R99 network may send this cause code.
The network may include a Back-off timer value IE in the ACTIVATE PDP CONTEXT REJECT message. If the SM
cause value is #26 "insufficient resources" and if the request type in the ACTIVATE PDP CONTEXT REQUEST was
set to "emergency", the network shall not include a Back-off timer value IE.
If the Back-off timer value IE is included and the SM cause value is different from #26 "insufficient resources", #50
"PDP type IPv4 only allowed", #51 "PDP type IPv6 only allowed", #57 "PDP type IPv4v6 only allowed", #58 "PDP
type non IP only allowed" and #65 "maximum number of PDP contexts reached", the network may include the Re-
attempt indicator IE to indicate whether the MS is allowed to attempt a PDN connectivity procedure in the PLMN for
the same APN in S1 mode, and whether another attempt in A/Gb and Iu mode or in S1 mode is allowed in an equivalent
PLMN.
If the SM cause value is #50 "PDP type IPv4 only allowed", #51 "PDP type IPv6 only allowed", #57 "PDP type IPv4v6
only allowed" or #58 "PDP type non IP only allowed", the network may include the Re-attempt indicator IE without
Back-off timer value IE to indicate whether the MS is allowed to attempt a PDP context activation procedure in an
equivalent PLMN for the same APN in A/Gb or Iu mode using the same PDP type.
If the SM cause value is #66 "requested APN not supported in current RAT and PLMN combination", the network may
include the Re-attempt indicator IE without Back-off timer value IE to indicate whether the MS is allowed to attempt a
PDP context activation procedure in an equivalent PLMN for the same APN in A/Gb or Iu mode.
Upon receipt of an ACTIVATE PDP CONTEXT REJECT message, the MS shall stop timer T3380 and enter/remain in
state PDP-INACTIVE.
If the ACTIVATE PDP CONTEXT REQUEST message was sent with request type set to "emergency" and the MS
receives an ACTIVATE PDP CONTEXT REJECT message, then the MS may inform the upper layers of the failure to
establish the emergency bearer.
attempted in the CS domain) or initiating other implementation specific mechanisms, e.g. procedures
specified in 3GPP TS 24.229 [95] can result in the emergency call being attempted to another IP-CAN.
6.1.3.1.3.2 Handling of network rejection due to SM cause #26
If the SM cause value is #26 "insufficient resources" and the Back-off timer value IE is included, the MS shall ignore
the Re-attempt indicator IE provided by the network, if any, and take different actions depending on the timer value
received for timer T3396 in the Back-off timer value IE (if the MS is configured for dual priority, exceptions are
specified in subclause 6.1.3.12; if the MS is an MS configured to use AC11 – 15 in selected PLMN, exceptions are
specified in subclause 6.1.3.11):
i) if the timer value indicates neither zero nor deactivated and an APN was included in the ACTIVATE PDP
CONTEXT REQUEST message, the MS shall stop timer T3396 associated with the corresponding APN, if it is
running. If the timer value indicates neither zero nor deactivated, the request type was different from
"emergency", and no APN was included in the ACTIVATE PDP CONTEXT REQUEST message, the MS shall
stop timer T3396 associated with no APN if it is running. The MS shall then start timer T3396 with the value
provided in the Back-off timer value IE and:
- shall not send another ACTIVATE PDP CONTEXT REQUEST, ACTIVATE SECONDARY PDP
CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message with exception of those identified
in subclause 6.1.3.3, for the same APN that was sent by the MS, until timer T3396 expires or timer T3396 is
stopped; and
- shall not send another ACTIVATE PDP CONTEXT REQUEST message without an APN and with request
type different from "emergency", or another ACTIVATE SECONDARY PDP CONTEXT REQUEST or
MODIFY PDP CONTEXT REQUEST message with exception of those identified in subclause 6.1.3.3, for a
ETSI
Release 18 333 3GPP TS 24.008 V18.4.0 (2023-09)
non-emergency PDN connection established without an APN sent by the MS, if the APN was not included in
the ACTIVATE PDP CONTEXT REQUEST message and the request type was different from "emergency",
until timer T3396 expires or timer T3396 is stopped.
The MS shall not stop timer T3396 upon a PLMN change or inter-system change;
ii) if the timer value indicates that this timer is deactivated, the MS:
- shall not send another ACTIVATE PDP CONTEXT REQUEST, ACTIVATE SECONDARY PDP
CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message with exception of those identified
in subclause 6.1.3.3, for the same APN that was sent by the MS, until the MS is switched off or the
SIM/USIM is removed or the MS receives a REQUEST PDP CONTEXT ACTIVATION, REQUEST
SECONDARY PDP CONTEXT ACTIVATION or MODIFY PDP CONTEXT REQUEST message with the
same APN from the network or a DEACTIVATE PDP CONTEXT REQUEST message including SM cause
#39 "reactivation requested" for a PDP context which was activated by the MS for the same APN from the
network; and
- shall not send another ACTIVATE PDP CONTEXT REQUEST message without an APN and with request
type different from "emergency", or another ACTIVATE SECONDARY PDP CONTEXT REQUEST or
MODIFY PDP CONTEXT REQUEST message with exception of those identified in subclause 6.1.3.3, for a
non-emergency PDN connection established without an APN sent by the MS, if the APN was not included in
the ACTIVATE PDP CONTEXT REQUEST message and the request type was different from "emergency",
until the MS is switched off or the SIM/USIM is removed or the MS receives for a non-emergency PDP
context which was activated by the MS any of the following messages: a REQUEST PDP CONTEXT
ACTIVATION without an APN, a REQUEST SECONDARY PDP CONTEXT ACTIVATION or MODIFY
PDP CONTEXT REQUEST message for a non-emergency PDN connection established without an APN sent
by the MS, or a DEACTIVATE PDP CONTEXT REQUEST message including SM cause #39 "reactivation
requested" for a non-emergency PDN connection which was established without an APN sent by the MS.
The timer T3396 remains deactivated upon a PLMN change or inter-system change; and
iii) if the timer value indicates that this timer is zero, the MS:
- shall stop timer T3396 associated with the corresponding APN, if running, and may send an ACTIVATE
PDP CONTEXT REQUEST, ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP
CONTEXT REQUEST message for the same APN; and
- if the APN was not included in the ACTIVATE PDP CONTEXT REQUEST message and the request type
was different from "emergency", the MS shall stop timer T3396 associated with no APN, if running, and may
send an ACTIVATE PDP CONTEXT REQUEST message without an APN, or another ACTIVATE
SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message for a non-
emergency PDN connection established without an APN sent by the MS.
If the Back-off timer value IE is not included, then the MS may send another ACTIVATE PDP CONTEXT REQUEST,
ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message for the
same APN.
The MS may initiate a PDP context activation procedure for emergency bearer services even if the timer T3396 is
running.
If the MS is switched off when the timer T3396 is running, and if the SIM/USIM in the MS remains the same when the
MS is switched on, the MS shall behave as follows:
- if prior to switch off, timer T3396 was running because an ACTIVATE PDP CONTEXT REQUEST,
ACTIVATE SECONDARY PDP CONTEXT REQUEST, MODIFY PDP CONTEXT REQUEST or
ACTIVATE MBMS CONTEXT REQUEST message containing the low priority indicator set to "MS is
ETSI
Release 18 334 3GPP TS 24.008 V18.4.0 (2023-09)
configured for NAS signalling low priority" was rejected with a timer value for timer T3396, and if timer T3396
is restarted at switch on, then the MS configured for dual priority shall handle session management requests as
indicated in subclause 6.1.3.12.
6.1.3.1.3.3 Handling of network rejection due to SM cause other than SM cause #26
If the SM cause value is different from #26 "insufficient resources", #50 "PDP type IPv4 only allowed", #51 "PDP type
IPv6 only allowed", #57 "PDP type IPv4v6 only allowed", #58 "PDP type non IP only allowed", #65 "maximum
number of PDP contexts reached", and #66 "requested APN not supported in current RAT and PLMN combination",
and the Back-off timer value IE is included, the MS shall take different actions depending on the timer value received in
the Back-off timer value IE (if the MS is an MS configured to use AC11 – 15 in selected PLMN, exceptions are
i) if the timer value indicates neither zero nor deactivated, the MS shall start the back-off timer with the value
provided in the Back-off timer value IE for the PDP context activation procedure and PLMN and APN
combination and:
- shall not send another ACTIVATE PDP CONTEXT REQUEST message in the PLMN for the same APN
that was sent by the MS, until the back-off timer expires, the MS is switched off or the SIM/USIM is
removed; and
- shall not send another ACTIVATE PDP CONTEXT REQUEST message in the PLMN without an APN if
the APN was not included in the ACTIVATE PDP CONTEXT REQUEST message, until the back-off timer
expires, the MS is switched off or the SIM/USIM is removed;
ii) if the timer value indicates that this timer is deactivated, the MS:
- shall not send another ACTIVATE PDP CONTEXT REQUEST message in the PLMN for the same APN
that was sent by the MS, until the MS is switched off or the SIM/USIM is removed; and
- shall not send another ACTIVATE PDP CONTEXT REQUEST message in the PLMN without an APN if
the APN was not included in the ACTIVATE PDP CONTEXT REQUEST message, until the MS is switched
off or the SIM/USIM is removed; and
- may send an ACTIVATE PDP CONTEXT REQUEST message in the PLMN for the same APN; and
- may send an ACTIVATE PDP CONTEXT REQUEST message in the PLMN without an APN if the APN
was not included in the ACTIVATE PDP CONTEXT REQUEST message.
If the Back-off timer value IE is not included, then the MS shall ignore the Re-attempt indicator IE provided by the
network, if any.
i) Additionally, if the SM cause value is #8 "operator determined barring", #27 "missing or unknown APN", #32
"service option not supported", or #33 "requested service option not subscribed", the MS shall proceed as
follows:
- if the MS is registered in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is
present), the MS shall behave as described above in the present subclause, using the configured
SM_RetryWaitTime value as specified in 3GPP TS 24.368 [135] or in USIM file NASCONFIG as specified in
3GPP TS 31.102 [112], if available, as back-off timer value; and
- otherwise, if the MS is not registered in its HPLMN or in a PLMN that is within the EHPLMN list (if the
EHPLMN list is present), or if the SM_RetryWaitTime value is not configured, the MS shall behave as
described above in the present subclause using the default value of 12 minutes for the back-off timer.
ii) For SM cause values different from #8 "operator determined barring", #27 "missing or unknown APN", #32
"service option not supported", or #33 "requested service option not subscribed", the MS behaviour regarding the
start of a back-off timer is unspecified.
The MS shall not stop any back-off timer upon a PLMN change or inter-system change. If the network indicates that a
back-off timer for the PDP context activation procedure and PLMN and APN combination is deactivated, then it
remains deactivated upon a PLMN change or inter-system change.
ETSI
Release 18 335 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 1: This means the back-off timer can still be running or be deactivated for the given SM procedure and
PLMN and APN combination when the MS returns to the PLMN or when it performs inter-system
change back from S1 mode to A/Gb or Iu mode. Thus the MS can still be prevented from sending another
ACTIVATE PDP CONTEXT REQUEST message in the PLMN for the same APN.
If the back-off timer is started upon receipt of an ACTIVATE PDP CONTEXT REJECT message (i.e. the timer value
was provided by the network, a configured value is available or the default value is used as explained above) or the
back-off timer is deactivated, the MS behaves as follows:
i) after a PLMN change the MS may send an ACTIVATE PDP CONTEXT REQUEST message for the same APN
in the new PLMN, if the back-off timer is not running and is not deactivated for the PDP context activation
procedure and the combination of new PLMN and APN;
Furthermore as an implementation option, for the SM cause values #8 "operator determined barring", #27
"missing or unknown APN", #32 "service option not supported" or #33 "requested service option not
subscribed", if the network does not include a Re-attempt indicator IE, the MS may decide not to automatically
send another ACTIVATE PDP CONTEXT REQUEST message for the same APN, if the MS registered to a new
PLMN which is in the list of equivalent PLMNs.
ii) if the network does not include the Re-attempt indicator IE to indicate whether re-attempt in S1 mode is allowed,
or the MS ignores the Re-attempt indicator IE, e.g. because the Back-off timer value IE is not included, then:
present), the MS shall apply the configured SM_RetryAtRATChange value as specified in
3GPP TS 24.368 [135] or in USIM file NASCONFIG as specified in 3GPP TS 31.102 [112], if available, to
determine whether the MS may attempt a PDN connectivity procedure for the same PLMN and APN
combination in S1 mode; and
- if the MS is not registered in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list
is present), or if the NAS configuration MO as specified in 3GPP TS 24.368 [135] is not available and the
value for inter-system change is not configured in the USIM file NASCONFIG, then the MS behaviour regarding
a PDN connectivity procedure for the same PLMN and APN combination in S1 mode is unspecified; and
iii) if the network includes the Re-attempt indicator IE indicating that re-attempt in an equivalent PLMN is not
allowed, then depending on the timer value received in the Back-off timer value IE, for each combination of a
PLMN from the equivalent PLMN list and the APN the MS shall start a back-off timer for the PDP context
activation procedure with the value provided by the network, or deactivate the respective back-off timer as
follows:
- If the Re-attempt indicator IE additionally indicates that re-attempt in S1 mode is allowed, the MS shall start
or deactivate the back-off timer for A/Gb and Iu mode only; and
- otherwise the MS shall start or deactivate the back-off timer for A/Gb, Iu, and S1 mode.
If the back-off timer for a PLMN and APN combination was started or deactivated in S1 mode upon receipt of a PDN
CONNECTIVITY REJECT message (see 3GPP TS 24.301 [120]) and the network indicated that re-attempt in A/Gb or
Iu mode is allowed, then this back-off timer does not prevent the MS from sending an ACTIVATE PDP CONTEXT
REQUEST message in this PLMN for the same APN in A/Gb or Iu mode. If the network indicated that re-attempt in
A/Gb or Iu mode is not allowed, the MS shall not send any ACTIVATE PDP CONTEXT REQUEST message in this
PLMN for the same APN in A/Gb or Iu mode until the back-off timer expires, the MS is switched off or the USIM is
removed.
NOTE 2: The back-off timer is used to describe a logical model of the required MS behaviour. This model does not
imply any specific implementation, e.g. as a timer or timestamp.
NOTE 3: Reference to back-off timer in this section can either refer to use of timer T3396 or to use of a different
packet system specific timer within the MS. Whether the MS uses T3396 as a back-off timer or it uses
different packet system specific timers as back-off timers is left up to MS implementation. This back-off
timer is stopped when the MS is switched off or the SIM/USIM is removed.
The MS may initiate a PDP context activation procedure for emergency bearer services even if the back-off timer is
running.
ETSI
Release 18 336 3GPP TS 24.008 V18.4.0 (2023-09)
If the SM cause value is #50 "PDP type IPv4 only allowed", #51 "PDP type IPv6 only allowed", #57 "PDP type IPv4v6
only allowed" or #58 "PDP type non IP only allowed", the MS shall ignore the Back-off timer value IE provided by the
network, if any. The MS shall not automatically send another ACTIVATE PDP CONTEXT REQUEST message for the
same APN that was sent by the MS using the same PDP type, until any of the following conditions is fulfilled:
- the MS is registered to a new PLMN, and either the network did not include a Re-attempt indicator IE in the
ACTIVATE PDP CONTEXT REJECT message or the Re-attempt indicator IE included in the message
indicated that re-attempt in an equivalent PLMN is allowed;
- the MS is registered to a new PLMN which was not in the list of equivalent PLMNs at the time when the
ACTIVATE PDP CONTEXT REJECT message was received;
- the PDP type which is used to access to the APN is changed;
- the MS is switched off; or
- the SIM/USIM is removed.
For the SM cause values #50 "PDP type IPv4 only allowed", #51 "PDP type IPv6 only allowed", #57 "PDP type IPv4v6
only allowed" and #58 "PDP type non IP only allowed", the MS shall ignore the value of the RATC bit in the Re-
attempt indicator IE provided by the network, if any.
NOTE 4: For the SM cause values #50 "PDP type IPv4 only allowed", #51 "PDP type IPv6 only allowed", #57
"PDP type IPv4v6 only allowed" and #58 "PDP type non IP only allowed", re-attempt in S1 mode for the
same APN (or no APN, if no APN was indicated by the MS) using the same PDP type is not allowed.
Furthermore as an implementation option, for the SM cause values #50 "PDP type IPv4 only allowed", #51 "PDP type
IPv6 only allowed", #57 "PDP type IPv4v6 only allowed" and #58 "PDP type non IP only allowed", if the network does
not include a Re-attempt indicator IE the MS may decide not to automatically send another ACTIVATE PDP
CONTEXT REQUEST message for the same APN that was sent by the MS using the same PDP type, if the MS
registered to a new PLMN which is in the list of equivalent PLMNs.
NOTE 5: Request to send another ACTIVATE PDP CONTEXT REQUEST message with a specific PDP type has
to come from upper layers.
If the SM cause value is #65 "maximum number of PDP contexts reached", the MS shall determine the PLMN's
maximum number of PDP contexts in A/Gb or Iu mode (see subclause 6.1.3.0) as the number of active PDP contexts it
has. The MS shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any.
NOTE 6: In some situations, when attempting to establish multiple PDP contexts, the number of active PDP
contexts that the MS has when SM cause #65 is received is not equal to the maximum number of PDP
contexts reached in the network.
NOTE 7: When the network supports emergency bearer services, it is not expected that SM cause #65 is returned
by the network when the MS requests a PDP context for emergency bearer services.
The PLMN's maximum number of PDP contexts in A/Gb or Iu mode applies to the PLMN in which the SM cause #65
"maximum number of PDP contexts reached" is received. When the MS is switched off or when the USIM is removed,
the MS shall clear all previous determinations representing any PLMN's maximum number of PDP contexts in A/Gb or
Iu mode (see subclause 6.1.3.0). Upon successful registration with a new PLMN, the MS may clear previous
determinations representing any PLMN's maximum number of PDP contexts in A/Gb or Iu mode.
If the SM cause value is #66 "requested APN not supported in current RAT and PLMN combination", the MS shall take
different actions depending on the Back-off timer value IE and the Re-attempt indicator IE optionally included:
i) If the Back-off timer value IE is not included, and either the Re-attempt indicator IE is not included or the Re-
attempt indicator IE is included indicating that re-attempt in an equivalent PLMN is allowed, the MS shall not
send an ACTIVATE PDP CONTEXT REQUEST message for the same APN in the current PLMN in A/Gb or
Iu mode until the MS is switched off or the SIM/USIM is removed;
ii) if the Back-off timer value IE is not included, and the Re-attempt indicator IE is included and indicates that re-
attempt in an equivalent PLMN is not allowed, the MS shall not send an ACTIVATE PDP CONTEXT
REQUEST message for the same APN in any PLMN in the list of equivalent PLMNs in A/Gb or Iu mode until
the MS is switched off or the SIM/USIM is removed; and
ETSI
Release 18 337 3GPP TS 24.008 V18.4.0 (2023-09)
iii) if the Back-off timer value IE is included, the MS shall take different actions depending on the timer value
received in the Back-off timer value IE:
a) if the timer value indicates neither zero nor deactivated, the MS shall start the back-off timer with the value
provided in the Back-off timer value IE for the PLMN and APN combination and shall not send another
ACTIVATE PDP CONTEXT REQUEST for the same APN in the current PLMN in A/Gb or Iu mode until
the back-off timer expires, the MS is switched off or the SIM/USIM is removed;
b) if the timer value indicates that this timer is deactivated, the MS shall not send another ACTIVATE PDP
CONTEXT REQUEST message for the same APN in the current PLMN in A/Gb or Iu mode until the MS is
switched off or the SIM/USIM is removed; and
c) if the timer value indicates that this timer is zero, the MS may send an ACTIVATE PDP CONTEXT
REQUEST message in the PLMN for the same APN.
If the network includes the Re-attempt indicator IE indicating that re-attempt in an equivalent PLMN is not
allowed, then
- for case a) the MS shall additionally start a back-off timer with the value provided in the Back-off timer
value IE for the PDP context activation procedure for each combination of a PLMN from the equivalent
PLMN list and the APN; and
- for case b) the MS shall deactivate the respective back-off timers for the PDP context activation procedure
for each combination of a PLMN from the equivalent PLMN list and the APN.
For the SM cause value #66 "requested APN not supported in current RAT and PLMN combination" the MS shall
ignore the value of the RATC bit in the Re-attempt indicator IE provided by the network, if any.
As an implementation option, for cases i), iii.a) and iii.b), if the Re-attempt indicator IE is not included, the MS may
decide not to automatically send another ACTIVATE PDP CONTEXT REQUEST message for the same APN in a
PLMN which is in the list of equivalent PLMNs.
6.1.3.1.3A Void
6.1.3.1.4 Unsuccessful PDP context activation requested by the network

Upon receipt of the REQUEST PDP CONTEXT ACTIVATION message, the MS may reject the network requested
PDP context activation by sending the REQUEST PDP CONTEXT ACTIVATION REJECT message to the network.
The message contains the same TI as included in the REQUEST PDP CONTEXT ACTIVATION and an additional
cause code that typically indicates one of the following causes:
# 40: feature not supported; or
# 95 - 111: protocol errors.
The network shall stop timer T3385 and enter state PDP-INACTIVE.

a) Expiry of timers
In the mobile station:
On the first expiry of the timer T3380, the MS shall resend the ACTIVATE PDP CONTEXT REQUEST and
shall reset and restart timer T3380. This retransmission is repeated four times, i.e. on the fifth expiry of timer
T3380, the MS shall release all resources possibly allocated for this invocation and shall abort the procedure;
no automatic PDP context activation re-attempt shall be performed; and
ETSI
Release 18 338 3GPP TS 24.008 V18.4.0 (2023-09)
- if the ACTIVATE PDP CONTEXT REQUEST message was sent with request type set to "emergency", then
the MS may inform the upper layers of the failure to establish the emergency bearer.
NOTE: This can result in the upper layers requesting establishment of a CS emergency call (if not already
attempted in the CS domain) or initiating other implementation specific mechanisms, e.g. procedures
specified in 3GPP TS 24.229 [95] can result in the emergency call being attempted to another IP-CAN.
On the network side:
On the first expiry of the timer T3385, the network shall resend the message REQUEST PDP CONTEXT
ACTIVATION and shall reset and restart timer T3385. This retransmission is repeated four times, i.e. on the
fifth expiry of timer T3385, the network shall release possibly allocated resources for this activation and shall
abort the procedure.
b) Collision of MS initiated and network requested PDP context activation
If the MS uses dynamic PDP addressing that turns out to collide with the network requested PDP address, then
there is no detection of collision specified but left for network implementation.
c) MS initiated PDP context activation request for an already activated PDP context (on the network side)
i) If the network receives a ACTIVATE PDP CONTEXT REQUEST message with the same combination
of APN, PDP type and PDP address as an already activated PDP context, the network shall deactivate the
existing PDP context and, if any, all the linked PDP contexts (matching the combination of APN, PDP
type and PDP address), locally without notification to the MS and proceed with the requested PDP
context activation.
ii) Alternatively (different combination of APN, PDP type and PDP address), if the NSAPI matches that of
an already activated PDP context, then the network shall deactivate only the existing PDP context locally
without notification to the MS and proceed with the requested PDP context activation.
It is an implementation option if the parameters used for comparison described in clause i) and ii) are the
parameters provided in the (current and previous) ACTIVATE PDP CONTEXT REQUESTs or the parameters
which are the result of the application of the selection rules defined in 3GPP TS 23.060 [74] Annex A.2.
The parameter provided in the current ACTIVATE PDP CONTEXT REQUEST can not be compared to the
actually used parameters (result of application of selection rules defined in 3GPP TS 23.060 [74] Annex A.2) of
the previously activated PDP contexts.
If the network receives an ACTIVATE PDP CONTEXT REQUEST message with request type "emergency" and
there already is a PDN connection for emergency bearer services existing, the network shall reject the request
with cause code #31 "activation rejected, unspecified".
d) Network initiated PDP context activation request for an already activated PDP context (on the mobile station
side)
If the MS receives a REQUEST PDP CONTEXT ACTIVATION message with the same combination of
APN, PDP type and PDP address as an already activated PDP context, the MS shall deactivate the existing
PDP context and, if any, all the linked PDP contexts (matching the combination of APN, PDP type and PDP
address) locally without notification to the network and proceed with the requested PDP context activation.
e) Additional MS initiated PDP context activation request received from an MS that is attached for emergency
bearer services:
If the MS is attached for emergency bearer services the network shall only accept the PDP context activation
request for emergency services. The network shall reject any other PDP context activation request with cause
code #31 "activation rejected, unspecified".
f) Reception of the ACTIVATE PDP CONTEXT ACCEPT message and Bearer Control Mode violation
If the Selected Bearer Control Mode indicates other value than 'MS only' in the ACTIVATE PDP CONTEXT
ACCEPT message although the protocol configuration options information element was not present or the MS
Support of Network Requested Bearer Control indicator was not present in the protocol configuration options
information element of the corresponding ACTIVATE PDP CONTEXT REQUEST message, the MS shall
ETSI
Release 18 339 3GPP TS 24.008 V18.4.0 (2023-09)
ignore the Selected Bearer Control Mode parameter received from the network and apply Bearer Control Mode
'MS only' for all active PDP contexts sharing the same PDP Address and APN.
Figure 6.3/3GPP TS 24.008: MS initiated PDP context activation procedure
MS Network
REQUEST PDP CONTEXT ACTIVATION

Start T3385
ACTIVATE PDP CONTEXT REQUEST

Start T3380 Stop T3385
ACTIVATE PDP CONTEXT ACCEPT

Stop T3380
or
ACTIVATE PDP CONTEXT REJECT

Stop T3380
or
REQUEST PDP CONTEXT ACTIVATION REJECT

Stop T3385
ECREJECT
Figure 6.4/3GPP TS 24.008: Network initiated PDP context activation procedure
6.1.3.1.6 Handling Activate PDP context request for MS configured for dual priority
If a PDP context exists that was created due to a request including a low priority indicator set to "MS is configured for
NAS signalling low priority" and the upper layers of the MS request to activate a PDP context with the same APN and
the low priority indicator set to "MS is not configured for NAS signalling low priority", when initiating the PDP context
activation procedure, the MS shall:
- send an ACTIVATE PDP CONTEXT REQUEST message with the same combination of APN, PDP type and
PDP address as the existing PDP context to activate a PDP context;
NOTE 1: This option relies on the network handling of abnormal cases as specified in subclause 6.1.3.1.5 case c).
- send an ACTIVATE PDP CONTEXT REQUEST message with the same combination of APN and PDP type as
the existing PDP context but with a different PDP address, or without PDP address, to activate a PDP context; or
- send an ACTIVATE PDP CONTEXT REQUEST message with the same APN after the successful deactivation
of the existing PDP context.
ETSI
Release 18 340 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 2: The above list of options also apply for the case when the existing PDP context was created due to a
request including a low priority indicator set to "MS is not configured for NAS signalling low priority"
and the new request to activate a PDP context with the same APN contains a low priority indicator set to
"MS is configured for NAS signalling low priority".
As an alternative the upper layers of the MS can request to activate a PDP context with a different APN.
6.1.3.2 Secondary PDP Context Activation Procedure

The purpose of this procedure is to establish an additional PDP context between the MS and the network for a specific
Traffic Flow Template (TFT) and QoS profile on a specific NSAPI, when one or more PDP contexts has/have already
been established for the particular PDP address and APN. The MS shall include a request for a TFT comprising at least
one packet filter applicable for the uplink direction. Depending on the selected Bearer Control Mode being 'MS only' or
'MS/NW', the secondary PDP context activation procedure may either be initiated by the MS or by either the MS or the
network, respectively. However, the network and the MS shall not initiate a secondary PDP context activation
procedure for established PDP context of "non IP" PDP type.
The network shall allocate packet filter identifiers and manage packet filter evaluation precedence for the packet filters
added by the network. The MS shall allocate packet filter identifiers and manage packet filter evaluation precedence for
the packet filters added by the MS.
If there is a PDN connection for emergency bearer services established, the MS shall not initiate a secondary PDP
context activation procedure for this connection unless triggered by the network.
NOTE: 3GPP TS 23.060 [74] subclause 9.3 specifies that a packet filter applicable for the downlink direction is
not mandatory in a TFT.
6.1.3.2.1 Successful Secondary PDP Context Activation Procedure Initiated by the MS

In order to request a PDP context activation with the same PDP address and APN as an already active PDP context, the
MS shall send an ACTIVATE SECONDARY PDP CONTEXT REQUEST message to the network, enter the state
PDP-ACTIVE-PENDING and start timer T3380. The message shall contain the selected NSAPI. The MS shall ensure
that the selected NSAPI is not currently being used by another Session Management entity in the MS. The message
shall also include a QoS profile, a requested LLC SAPI and the Linked TI. The QoS profile is the requested QoS. If
present, the TFT shall be sent transparently through the SGSN to the GGSN to enable packet classification and policing
for downlink data transfer. If the selected Bearer Control Mode is 'MS/NW' and a TFT IE is included in the
ACTIVATE SECONDARY PDP CONTEXT REQUEST message, the MS shall set the packet filter direction
parameter of each packet filter in the TFT to a value different from "00". The MS shall allocate packet filter identifiers
for all packet filters included in the TFT.
Upon receipt of an ACTIVATE SECONDARY PDP CONTEXT REQUEST, the network shall validate the message by
verifying the TI given in the Linked TI IE to be any of the active PDP context(s). The same GGSN address shall be
used by the SGSN as for the already established PDP context(s) for that PDP address. The network shall select a radio
priority level based on the QoS negotiated and shall reply with an ACTIVATE SECONDARY PDP CONTEXT
ACCEPT message, if the request can be accepted.
NOTE 1: If the MS requested a value for a QoS parameter that is not within the range specified by 3GPP TS 23.107
[81], the network should negotiate the parameter to a value that lies within the specified range.
Upon receipt of the message ACTIVATE SECONDARY PDP CONTEXT ACCEPT, the MS shall stop timer T3380
and enter the state PDP-ACTIVE. If the offered QoS parameters received from the network differ from the QoS
requested by the MS, the MS shall either accept the negotiated QoS or initiate the PDP context deactivation procedure.
In A/Gb mode the MS shall initiate establishment of the logical link for the LLC SAPI indicated by the network with
the offered QoS and selected radio priority level if no logical link has been already established for that SAPI. If the LLC
SAPI indicated by the network can not be supported by the MS, the MS shall initiate the PDP context deactivation
procedure.
In Iu mode, both SGSN and MS shall store the LLC SAPI and the radio priority in the PDP context. If an Iu mode to
A/Gb mode Routing Area Update is performed, the new SGSN shall initiate establishment of the logical link using the
negotiated LLC SAPI, the negotiated QoS profile and selected radio priority level stored in the PDP context as in an
A/Gb mode to A/Gb mode Routing Area Update.
ETSI
Release 18 341 3GPP TS 24.008 V18.4.0 (2023-09)
An MS, which is capable of operating in A/Gb mode, shall use a valid LLC SAPI, while an MS which is not capable of
operating in A/Gb mode shall indicate the LLC SAPI value as "LLC SAPI not assigned" in order to avoid unnecessary
value range checking and any other possible confusion in the network. When the MS uses a valid LLC SAPI, the
network shall return a valid LLC SAPI. The network shall return the "LLC SAPI not assigned" value only when the MS
uses the "LLC SAPI not assigned" value.
NOTE 2: The radio priority level and the LLC SAPI parameters, though not used in Iu mode, shall be included in
the messages, in order to support handover between Iu mode and A/Gb mode networks.
At inter-system change from Iu mode to A/Gb mode, SM shall locally deactivate the active PDP context(s) if SM does
not have the following parameters:
- LLC SAPI; and
- radio priority.
6.1.3.2.1a Successful Secondary PDP Context Activation Procedure Requested by the

network
In order to request a PDP context activation with the same PDP address and APN as an already active PDP context, the
network shall send a REQUEST SECONDARY PDP CONTEXT ACTIVATION message to the MS and start timer
T3385. The message contains the required QoS, Linked TI, and optionally protocol configuration options and a TFT.
The network shall always include a TFT in the REQUEST SECONDARY PDP CONTEXT ACTIVATION message. If
present, the TFT shall be sent transparently through the SGSN to the MS to enable packet classification and policing for
uplink and downlink data transfer. The network shall allocate packet filter identifiers for all packet filters included in
the TFT.
NOTE: A network implementing an earlier release of this specification can send a REQUEST SECONDARY
PDP CONTEXT ACTIVATION message without any TFT.
Upon receipt of a REQUEST SECONDARY PDP CONTEXT ACTIVATION message, if the MS sent an APN for the
establishment of the PDN connection, the MS shall stop the timer T3396 if it is running for the APN sent by the MS. If
the MS did not send an APN for the establishment of the PDN connection and the request type was different from
"emergency", the MS shall stop the timer T3396 associated with no APN if it is running. If the REQUEST
SECONDARY PDP CONTEXT ACTIVATION message was received for an emergency PDN connection, the UE
shall not stop the timer T3396 associated with no APN if it is running. For any case, the MS shall then either initiate the
secondary PDP context activation procedure as described in the subclause 6.1.3.2.1 or shall reject the activation request
by sending a REQUEST SECONDARY PDP CONTEXT ACTIVATION REJECT message as described in
subclause 6.1.3.2.2a. The value of the reject cause IE of the REQUEST SECONDARY PDP CONTEXT
ACTIVATION REJECT message shall indicate the reason for rejection, e.g. "insufficient resources to activate another
context".
The MS shall maintain the previously negotiated Bearer Control Mode (BCM) for all active PDP contexts sharing the
same PDP Address and APN and ignore any BCM parameter, if included in the REQUEST SECONDARY PDP
CONTEXT ACTIVATION message. If the previously negotiated BCM is 'MS only', the MS should reject the PDP
context activation (see subclause 6.1.3.2.2a).
The ACTIVATE SECONDARY PDP CONTEXT REQUEST message sent by the MS in order to initiate the secondary
PDP context activation procedure shall contain the QoS and Linked TI required in the REQUEST SECONDARY PDP
CONTEXT ACTIVATION message. The MS shall also include a TFT with packet filters as specified in the REQUEST
SECONDARY PDP CONTEXT ACTIVATION message.
Upon receipt of the ACTIVATE SECONDARY PDP CONTEXT REQUEST message, the network shall stop timer
T3385.
The same procedures then apply as described for MS initiated secondary PDP context activation.
ETSI
Release 18 342 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.3.2.2 Unsuccessful Secondary PDP Context Activation Procedure initiated by the MS
6.1.3.2.2.1 General
Upon receipt of an ACTIVATE SECONDARY PDP CONTEXT REQUEST message, the network may reject the MS
initiated PDP context activation by sending an ACTIVATE SECONDARY PDP CONTEXT REJECT message to the
MS. The message shall contain a cause code that typically indicates one of the following:
# 34: service option temporarily out of order;
# 41: semantic error in the TFT operation;
# 42: syntactical error in the TFT operation;
# 43: unknown PDP context;
# 44: semantic errors in packet filter(s);
# 45: syntactical errors in packet filter(s);
# 46: PDP context without TFT already activated;
# 48: request rejected, Bearer Control Mode violation;
# 56: collision with network initiated request;
# 60: bearer handling not supported;
# 65: maximum number of PDP contexts reached; or
The network may include a Back-off timer value IE in the ACTIVATE SECONDARY PDP CONTEXT REJECT
message.
If the Back-off timer value IE is included and the SM cause value is different from #26 "insufficient resources" and #65
"maximum number of PDP contexts reached", the network may include the Re-attempt indicator IE to indicate whether
the MS is allowed to attempt a bearer resource allocation procedure in the PLMN for the same APN in S1 mode, and
whether another attempt in A/Gb and Iu mode or in S1 mode is allowed in an equivalent PLMN.
If the ACTIVATE SECONDARY PDP CONTEXT REQUEST message is related to an already active LIPA PDN
connection or SIPTO at the local network PDN connection, then the network shall reply with an ACTIVATE
SECONDARY PDP CONTEXT REJECT message with cause code #60 "bearer handling not supported".
If a PDP context for the TI given in the Linked TI IE exists, then the TFT in the ACTIVATE SECONDARY PDP
CONTEXT REQUEST message is checked by the network for different types of TFT IE errors as specified in
Upon receipt of an ACTIVATE SECONDARY PDP CONTEXT REJECT message, the MS shall stop timer T3380 and
enter the state PDP-INACTIVE.
ETSI
Release 18 343 3GPP TS 24.008 V18.4.0 (2023-09)
specified in subclause 6.1.3.12; if the MS is an MS configured to use AC11 – 15 in selected PLMN, exceptions are
i) if the timer value indicates neither zero nor deactivated, the MS shall stop timer T3396 associated with the
corresponding APN, if it is running. The MS shall then start timer T3396 with the value provided in the Back-off
timer value IE and not send another ACTIVATE PDP CONTEXT REQUEST, ACTIVATE SECONDARY PDP
CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message with exception of those identified in
subclause 6.1.3.3, for the same APN until timer T3396 expires or timer T3396 is stopped. If the MS did not send
an APN for the establishment of the PDN connection and the request type was different from "emergency", the
MS shall stop timer T3396 associated with no APN, if it is running. The MS shall then start timer T3396 with
the value provided in the Back-off timer value IE and not send another ACTIVATE PDP CONTEXT REQUEST
without an APN and with request type different from "emergency", or another ACTIVATE SECONDARY PDP
subclause 6.1.3.3, for a non-emergency PDN connection established without an APN sent by the MS, until timer
T3396 expires or timer T3396 is stopped. The MS shall not stop timer T3396 upon a PLMN change or inter-
system change;
ii) if the timer value indicates that this timer is deactivated, the MS shall not send another ACTIVATE PDP
CONTEXT REQUEST, ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT
REQUEST message with exception of those identified in subclause 6.1.3.3, for the same APN until the MS is
switched off or the SIM/USIM is removed or the MS receives a REQUEST PDP CONTEXT ACTIVATION,
REQUEST SECONDARY PDP CONTEXT ACTIVATION or MODIFY PDP CONTEXT REQUEST message
for the same APN or a DEACTIVATE PDP CONTEXT REQUEST message including SM cause #39
"reactivation requested" for a PDP context which was activated by the MS for the same APN from the network.
If the MS did not send an APN for the establishment of the PDN connection and the request type was different
from "emergency", the MS shall not send another ACTIVATE PDP CONTEXT REQUEST without an APN and
with request type different from "emergency", or another ACTIVATE SECONDARY PDP CONTEXT
REQUEST or MODIFY PDP CONTEXT REQUEST with exception of those identified in subclause 6.1.3.3, for
a non-emergency PDN connection established without an APN sent by the MS, until the MS is switched off or
the SIM/USIM is removed or the MS receives any of the following messages: a REQUEST PDP CONTEXT
PDP CONTEXT REQUEST message for a non-emergency PDN connection established without an APN sent by
the MS, or a DEACTIVATE PDP CONTEXT REQUEST message including SM cause #39 "reactivation
requested" for a PDP context which was activated by the MS for a non-emergency PDN connection established
without an APN sent by the MS. The timer T3396 remains deactivated upon a PLMN change or inter-system
change; or
- if the MS did not send an APN for the establishment of the PDN connection and the request type was
different from "emergency", the MS shall stop timer T3396 associated with no APN, if running, and may
If the Back-off timer value IE is not included, the MS may send an ACTIVATE PDP CONTEXT REQUEST,
same APN.
MS is switched on, the MS behaves as follows:
ETSI
Release 18 344 3GPP TS 24.008 V18.4.0 (2023-09)
If the SM cause value is different from #26 "insufficient resources" and #65 "maximum number of PDP contexts
reached", and the Back-off timer value IE is included, the MS takes different actions depending on the timer value
received in the Back-off timer value IE (if the MS is an MS configured to use AC11 – 15 in selected PLMN, exceptions
are specified in subclause 6.1.3.13):
provided in the Back-off timer value IE for the secondary PDP context activation procedure and PLMN and
APN combination and not send another ACTIVATE SECONDARY PDP CONTEXT REQUEST message in the
PLMN for the same APN until the back-off timer expires, the MS is switched off or the SIM/USIM is removed;
ii) if the timer value indicates that this timer is deactivated, the MS shall not send another ACTIVATE
SECONDARY PDP CONTEXT REQUEST message in the PLMN for the same APN until the MS is switched
off or the SIM/USIM is removed; and
iii) if the timer value indicates that this timer is zero, the MS may send an ACTIVATE SECONDARY PDP
CONTEXT REQUEST message in the PLMN for the same APN.
network, if any.
i) Additionally, if the SM cause value is #32 "service option not supported", or #33 "requested service option not
subscribed", the MS shall proceed as follows:
ii) For SM cause values different from #32 "service option not supported", or #33 "requested service option not
subscribed", the MS behaviour regarding the start of a back-off timer is unspecified.
back-off timer for the secondary PDP context activation procedure and PLMN and APN combination is deactivated,
then it remains deactivated upon a PLMN change or inter-system change.
ACTIVATE SECONDARY PDP CONTEXT REQUEST message in the PLMN for the same APN.
If the back-off timer is started upon receipt of an ACTIVATE SECONDARY PDP CONTEXT REJECT message (i.e.
the timer value was provided by the network, a configured value is available or the default value is used as explained
above) or the back-off timer is deactivated, the MS behaves as follows:
i) after a PLMN change the MS may send an ACTIVATE SECONDARY PDP CONTEXT REQUEST message
for the same APN in the new PLMN, if the back-off timer is not running and is not deactivated for the secondary
PDP context activation procedure and the combination of new PLMN and APN;
Furthermore as an implementation option, for the SM cause values #32 "service option not supported" or #33
"requested service option not subscribed", if the network does not include a Re-attempt indicator IE, the MS may
ETSI
Release 18 345 3GPP TS 24.008 V18.4.0 (2023-09)
decide not to automatically send another ACTIVATE SECONDARY PDP CONTEXT REQUEST message for
the same APN, if the MS registered to a new PLMN which is in the list of equivalent PLMNs.
determine whether the MS may attempt a bearer resource allocation procedure for the same PLMN and APN
combination in S1 mode; and
a bearer resource allocation procedure for the same PLMN and APN combination in S1 mode is unspecified;
and
PLMN from the equivalent PLMN list and the APN the MS shall start a back-off timer for the secondary PDP
context activation procedure with the value provided by the network, or deactivate the respective back-off timer
as follows:
If the back-off timer for a PLMN and APN combination was started or deactivated in S1 mode upon receipt of a
BEARER RESOURCE ALLOCATION REJECT message (see 3GPP TS 24.301 [120]) and the network indicated that
re-attempt in A/Gb or Iu mode is allowed, then this back-off timer does not prevent the MS from sending an
ACTIVATE SECONDARY PDP CONTEXT REQUEST message in this PLMN for the same APN in A/Gb or Iu
mode. If the network indicated that re-attempt in A/Gb or Iu mode is not allowed, the MS shall not send any
ACTIVATE SECONDARY PDP CONTEXT REQUEST message in this PLMN for the same APN in A/Gb or Iu
mode, until the timer expires, the MS is switched off or the USIM is removed.
If the SM cause value is #65 "maximum number of PDP contexts reached", the MS shall determine the PLMN's
maximum number of PDP contexts in A/Gb or Iu mode (see subclause 6.1.3.0) as the number of active PDP contexts it
has. The MS shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any.
NOTE 4: In some situations, when attempting to establish multiple PDP contexts, the number of active PDP
contexts that the MS has when cause #65 is received is not equal to the maximum number of PDP
contexts reached in the network.
The PLMN's maximum number of PDP context in A/Gb or Iu mode applies to the PLMN in which the SM cause #65
"maximum number of PDP contexts reached" is received. When the MS is switched off or when the USIM is removed,
the MS shall clear all previous determinations representing any PLMN's maximum number of PDP contexts in A/Gb or
Iu mode (see subclause 6.1.3.0). Upon successful registration with a new PLMN, the MS may clear previous
determinations representing any PLMN's maximum number of PDP contexts in A/Gb or Iu mode.
ETSI
Release 18 346 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.3.2.2a Unsuccessful secondary PDP context activation requested by the network

Upon receipt of the REQUEST SECONDARY PDP CONTEXT ACTIVATION message, the MS may reject the
network requested secondary PDP context activation by sending the REQUEST SECONDARY PDP CONTEXT
ACTIVATION REJECT message to the network. The message contains the same TI as included in the REQUEST
SECONDARY PDP CONTEXT ACTIVATION and an additional cause code that typically indicates one of the
following causes:
# 40: feature not supported;
# 43: unknown PDP context;
# 46: PDP context without TFT already activated;
# 48: request rejected, Bearer Control Mode violation; or
The MS should reply with the REQUEST SECONDARY PDP CONTEXT ACTIVATION REJECT message with
cause #48 "request rejected, Bearer Control Mode violation" if the previously negotiated Bearer Control Mode is 'MS-
only'.
If a PDP context for the TI given in the Linked TI IE exists, then the TFT in the REQUEST SECONDARY PDP
CONTEXT ACTIVATION message is checked by the MS for different types of TFT IE errors as specified in
Upon receipt of a REQUEST SECONDARY PDP CONTEXT ACTIVATION REJECT message, the network shall
stop timer T3385 and enter state PDP-INACTIVE.

a) Expiry of timers
On the first expiry of the timer T3380, the MS shall resend the ACTIVATE SECONDARY PDP
CONTEXT REQUEST and shall reset and restart timer T3380. This retransmission is repeated four
times, i.e. on the fifth expiry of timer T3380, the MS shall release all resources possibly allocated for this
invocation and shall abort the procedure; no automatic PDP context activation re-attempt shall be
performed.
On the first expiry of the timer T3385, the network shall resend the message REQUEST SECONDARY
PDP CONTEXT ACTIVATION and shall reset and restart timer T3385. This retransmission is repeated
four times, i.e. on the fifth expiry of timer T3385, the network shall release possibly allocated resources
for this activation and shall abort the procedure.
b) MS initiated secondary PDP context activation procedure for an already activated PDP context (On the network
side)
ETSI
Release 18 347 3GPP TS 24.008 V18.4.0 (2023-09)
If the NSAPI matches that of an already activated PDP context, the network shall deactivate the existing PDP
context locally without notification to the MS and proceed with the requested PDP context activation. The case
of a TI match is described in subclause 8.3.2.
c) no PDP context with linked TI activated (on the network side)
The network shall then check whether there is an activated PDP context for the TI given in the Linked TI IE
in the ACTIVATE SECONDARY PDP CONTEXT REQUEST message. If there is no active PDP context
for the specified TI, the network shall reply with an ACTIVATE SECONDARY PDP CONTEXT REJECT
message, cause code indicating "unknown PDP context".
d) no PDP context with Linked TI activated (on the mobile station side)
The MS shall check whether there is an activated PDP context for the TI given in the Linked TI IE in the
REQUEST SECONDARY PDP CONTEXT ACTIVATION message. If there is no active PDP context for
the specified TI, the MS shall reply with a REQUEST SECONDARY PDP CONTEXT ACTIVATION
REJECT message, cause code indicating "unknown PDP context".
e) MS initiated secondary PDP context activation procedure for a PDN connection established for emergency
bearer services (on the network side)
If the MS initiated secondary PDP context activation procedure is for a PDN connection established for
emergency bearer services the network shall reply with an ACTIVATE SECONDARY PDP CONTEXT
REJECT message, cause code indicating "activation rejected, unspecified".
f) no TFT IE is received in the REQUEST SECONDARY PDP CONTEXT ACTIVATION message (on the
mobile station side)
The MS shall either:
A) reply with a REQUEST SECONDARY PDP CONTEXT ACTIVATION REJECT message, cause code
indicating "semantic error in the TFT operation"; or
B) optionally, to support networks compliant with earlier versions of the protocol, accept the network
requested secondary PDP context activation and proceed as specified in subclause 6.1.3.2.1a. If another
PDP context with the same PDP address and APN without a TFT exists, the MS shall deactivate this old
PDP context without a TFT by explicit peer-to-peer signalling between the MS and the network.
If during a previous inter-system change from S1 mode to A/Gb or Iu mode the default PDP context linked to
the new PDP context was mapped from an EPS bearer context, the MS shall follow option A.
NOTE 1: A network implementing this version of the protocol will always include a request for a TFT when
requesting the activation of a non-default PDP context.
If a PDP context for the TI given in the Linked TI IE exists, then the TFT in the ACTIVATE SECONDARY PDP
CONTEXT REQUEST or the REQUEST SECONDARY PDP CONTEXT ACTIVATION message is checked for
different types of TFT IE errors as follows:
a) Semantic errors in TFT operations:
1) When the TFT operation is an operation other than "Create a new TFT".
The network shall reject the activation request with cause "semantic error in the TFT operation".
The MS shall reject the activation request with cause "semantic error in the TFT operation".
b) Syntactical errors in TFT operations:
1) When the TFT operation is "Create a new TFT" and the packet filter list in the TFT IE is empty.
2) Void.
3) When there are other types of syntactical errors in the coding of the TFT IE, such as a mismatch
between the number of packet filters subfield, and the number of packet filters in the packet filter list.
The network shall reject the activation request with cause "syntactical error in the TFT operation".
ETSI
Release 18 348 3GPP TS 24.008 V18.4.0 (2023-09)
The MS shall reject the activation request with cause "syntactical error in the TFT operation".
c) Semantic errors in packet filters:
1) When a packet filter consists of conflicting packet filter components which would render the packet
filter ineffective, i.e. no IP packet will ever fit this packet filter. How the network determines a
semantic error in a packet filter is outside the scope of the present document.
2) When the resulting TFT does not contain any packet filter applicable for the uplink direction.
NOTE 2: When BCM='MS only', the MS is allowed to include a TFT with packet filters without any explicit
direction information, i.e. with value "00", and such packet filters are applicable for both uplink and
downlink directions.
The network shall reject the activation request with cause "semantic errors in packet filter(s)".
The MS shall reject the activation request with cause "semantic errors in packet filter(s)".
d) Syntactical errors in packet filters:
1) When the TFT operation is "Create a new TFT" and two or more packet filters in the resultant TFT
would have identical packet filter identifiers.
2) When the TFT operation is "Create a new TFT" and two or more packet filters in all TFTs associated
with this PDP address and APN would have identical packet filter precedence values.
3) When there are other types of syntactical errors in the coding of packet filters, such as the use of a
reserved value for a packet filter component identifier.
In case 2) the network shall not diagnose an error, further process the new activation request and, if it was
processed successfully, delete the old packet filters which have identical filter precedence values.
Furthermore, by means of explicit peer-to-peer signalling between the MS and the network, the network shall
deactivate the PDP context(s) for which it has deleted the packet filters.
In cases 1) and 3) the network shall reject the activation request with cause "syntactical errors in packet
filter(s)".
In case 2) the MS shall not diagnose an error, further process the new activation request and, if it was
processed successfully, delete the old packet filters which have identical filter precedence values.
Furthermore, by means of explicit peer-to-peer signalling between the network and the MS, the MS shall
deactivate the PDP context(s) for which it has deleted the packet filters.
In cases 1) and 3) the MS shall reject the activation request with cause "syntactical errors in packet filter(s)".
Otherwise, the network shall accept the activation request by replying to the MS with an ACTIVATE SECONDARY
PDP CONTEXT ACCEPT message. In case of network requested secondary PDP context activation procedure the MS
shall accept the activation request by replying to the network with an ACTIVATE SECONDARY PDP CONTEXT
REQUEST message.
MS Network
ACTIVATE SECONDARY PDP CONTEXT REQUEST
Start T3380
Stop T3380 ACTIVATE SECONDARY PDP CONTEXT ACCEPT
or
ACTIVATE SECONDARY PDP CONTEXT REJECT

Stop T3380
Figure 6.5/3GPP TS 24.008: MS initiated secondary PDP context activation procedure
ETSI
Release 18 349 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 6.5a/3GPP TS 24.008: Network requested secondary PDP context activation procedure
6.1.3.3 PDP context modification procedure

The PDP context modification procedure is invoked by the network or by the MS, in order to:
- inform about the change of the 3GPP PS data off UE status for a PDN connection;
- change the QoS negotiated;
- change the Radio priority level; or
- change the TFT,
negotiated during the PDP context activation procedure, the secondary PDP context activation procedure or at
previously performed PDP context modification procedures. Depending on the selected Bearer Control Mode being 'MS
only' or 'MS/NW', the MS or the network respectively may also create and delete a TFT of an active default PDP
context. The PDP context modification procedure can be initiated by the network or the MS at any time when a PDP
context is active. The network and the MS shall manage packet filter identifiers for the packet filters each modifies or
deletes. The network and the MS shall manage packet filter evaluation precedence for the packet filters each modifies.If
the MS changes a TFT, which is not assigned to a default PDP context, the MS shall ensure that at least one packet filter
applicable for the uplink direction remains among the packet filters created by the MS in that TFT, or no own packet
filters . If the network changes a TFT, which is not ass igned to a default PDP context, the network shall ensure that at
least one packet filter applicable for the uplink direction remains among the TFT packet filters created by the network in
that TFT, or no own packet filters. The MS supporting S1 mode shall not modify the QoS of the first PDP context that
was established within the PDN connection. The MS not supporting S1 mode should not modify the QoS of the first
PDP context that was established within the PDN connection (see 3GPP TS 23.060 [74]).
To indicate a change of 3GPP PS data off UE status for a PDN connection, the MS shall include the protocol
configuration options IE in the MODIFY PDP CONTEXT REQUEST message and set the 3GPP PS data off UE status
only if the network included the 3GPP PS data off support indication for the PDN connection established by the PDP
context activation procedure. The MS behaves as described in subclause 4.7.1.10.
ETSI
Release 18 350 3GPP TS 24.008 V18.4.0 (2023-09)
When the PDP context modification procedure is used to indicate a change of 3GPP PS data off UE status for a PDN
connection (see subclause 4.7.1.10), the UE shall initiate the PDP context modification procedure even if the timer
T3396 or the back-off timer is running or is deactivated.
The PDP context modification procedure may also be invoked by the MS, in order to upgrade the maximum bit rate and
to trigger the re-establishment of the radio access bearer for an activated PDP context which is preserved in the MS with
maximum bit rate values of 0kbit/s for both uplink and downlink (see 3GPP TS 23.060 [74]).
NOTE 1: As described in 3GPP TS 23.060 [74], the MS only preserves PDP contexts with a TFT including packet
filter(s) set by the MS.
If
- the PDP Context Modification request is accepted by the network but the radio access bearer is not established;
or
- the PDP Context Modification request is rejected with cause "insufficient resources" (see subclause 6.1.3.3.3),
then the MS is not required to start a new PDP Context Modification procedure or to start a Service Request procedure
in order to trigger the re-establishment of the radio access bearer.
If there is a PDN connection for emergency bearer services established, the MS shall not request a modification of
bearer resources for this PDN connection.
The network requested PDP context modification procedure may also be used to update the PDP address when external
PDP address allocation is performed, in which case the MS receives the PDP address in the MODIFY PDP CONTEXT
REQUEST (Network to MS direction) message.
NOTE 2: The procedure may be initiated by the network due to an inter-SGSN Routing Area Updating when a PDP
context is active.
The network requested PDP context modification procedure may also be used to update the WLAN offload indication,
in which case the MS receives the updated WLAN offload indication in the MODIFY PDP CONTEXT REQUEST
(Network to MS direction) message.
6.1.3.3.1 Network initiated PDP Context Modification

In order to initiate the procedure, the network sends the MODIFY PDP CONTEXT REQUEST message to the MS and
starts timer T3386. The message shall contain the new QoS and the radio priority level and LLC SAPI that shall be used
by the MS in A/Gb mode at the lower layers for the transmission of data related to the PDP context. The MODIFY PDP
CONTEXT REQUEST message may also contain packet filters in the TFT information element. If the selected Bearer
Control Mode is 'MS/NW' and the TFT information element is included in the MODIFY PDP CONTEXT REQUEST
message, the network shall include packet filter(s), or if no packet filters are proposed to be either added, replaced or
deleted, it shall set TFT operation code to "No TFT operation" and include packet filter identifier(s) in the Packet filter
identifier parameter in the parameters list to indicate which packet filter(s) in the TFT is associated with the QoS
change. If the TFT information element is included in the MODIFY PDP CONTEXT REQUEST message and packet
filter(s) is proposed to be added, the network shall allocate packet filter identifier(s) for all packet filters to be added to
the TFT. The network shall allocate packet filter identifier value s which are currently not allocated to any existing
packet filter of the same TFT.
The network informs the MS about the Bearer Control Mode to be applied for all active PDP contexts sharing the same
PDP Address and APN by including the selected Bearer Control Mode parameter in the protocol configuration options
information element. This information is either explicitly given in the MODIFY PDP CONTEXT REQUEST message
or implicitly given by not being present. The MS shall act according to the presence of the protocol configuration
options information element and the value of the selected Bearer Control Mode parameter in the MODIFY PDP
CONTEXT REQUEST message:
- if the protocol configuration options information element is not present, the MS shall apply Bearer Control Mode
'MS only' for all active PDP contexts sharing the same PDP Address and APN.
- if the selected Bearer Control Mode parameter is not present in the protocol configuration options information
element, the MS shall apply Bearer Control Mode 'MS only' for all active PDP contexts sharing the same PDP
Address and APN.
ETSI
Release 18 351 3GPP TS 24.008 V18.4.0 (2023-09)
- if the selected Bearer Control Mode parameter is present in the protocol configuration options information
element, the MS shall apply Bearer Control Mode according to the value of this parameter for all active PDP
contexts sharing the same PDP Address and APN.
If a WLAN offload indication information element is included in the MODIFY PDP CONTEXT REQUEST message,
the MS shall replace stored WLAN offload acceptability values for this PDN connection with the newly received
offload indications and use the UTRAN offload acceptability value to determine whether this PDN connection is
offloadable to WLAN or not.
Upon receipt of the MODIFY PDP CONTEXT REQUEST message, if the MS sent an APN for the establishment of the
PDN connection, the MS shall stop the timer T3396 if it is running for the APN sent by the MS.If the MS did not send
an APN for the establishment of the PDN connection and the request type was different from "emergency", the MS
shall stop the timer T3396 associated with no APN if it is running. If the MODIFY PDP CONTEXT REQUEST
message was received for an emergency PDN connection, the MS shall not stop the timer T3396 associated with no
APN if it is running. For any case, the MS shall then reply with the MODIFY PDP CONTEXT ACCEPT message, if
the MS accepts the new QoS and the indicated LLC SAPI.
The network shall upon receipt of the MODIFY PDP CONTEXT ACCEPT message stop timer T3386.
In A/Gb mode, the network shall establish, reconfigure or continue using the logical link with the new QoS for the LLC
SAPI indicated in the MODIFY PDP CONTEXT REQUEST message.
In Iu mode, if the Radio Access Bearer supporting the PDP context is active, then the network shall reconfigure and
continue using the Radio Access Bearer with the new QoS indicated in the MODIFY PDP CONTEXT REQUEST
message; if the PDP context is preserved, then the network may re-establish a Radio Access Bearer with the new QoS
indicated in the MODIFY PDP CONTEXT REQUEST message.
6.1.3.3.2 MS initiated PDP Context Modification accepted by the network

In order to initiate the procedure, the MS sends the MODIFY PDP CONTEXT REQUEST message to the network,
enters the state PDP-MODIFY-PENDING and starts timer T3381. The message may contain the requested new QoS
and/or the TFT and the requested LLC SAPI (used in A/Gb mode). If the selected Bearer Control Mode is 'MS/NW' and
the MS wants to modify the QoS, it shall include a TFT with packet filter(s), or if no packet filters are proposed to be
either added, replaced or deleted, it shall set TFT operation code to "No TFT operation" and include packet filter
identifier(s) in the Packet filter identifier parameter in the parameters list to indicate which packet filter(s) in the TFT is
associated with the QoS change. If the TFT information element is included in the MODIFY PDP CONTEXT
REQUEST message and packet filters are proposed to be added, the MS shall allocate packet filter identifier(s) for all
packet filters to be added to the TFT. The MS shall allocate packet filter identifier value s which are currently not
allocated to any existing packet filter of the TFT. If a PDP context is associated with a TFT containing packet filters
established by both the MS and the network, the only parameters in the QoS profile of that PDP context the MS is
allowed to modify are the bitrate parameters.
Upon receipt of the MODIFY PDP CONTEXT REQUEST message, the network may reply with the MODIFY PDP
CONTEXT ACCEPT message in order to accept the context modification. The reply message may contain the
negotiated QoS and the radio priority level based on the new QoS profile and the negotiated LLC SAPI that shall be
used in A/Gb mode by the logical link.
Upon receipt of the MODIFY PDP CONTEXT ACCEPT message, the MS shall stop the timer T3381. If the offered
QoS parameters received from the network differs from the QoS requested by the MS, the MS shall either accept the
negotiated QoS or initiate the PDP context deactivation procedure.
If a modification of QoS is requested by the MS, which the network can not accept, being unable to provide the
requested QoS, it should maintain the QoS negotiated as previously negotiated or propose a new QoS. That means that
the network should not reject the MS initiated PDP context modification request due to the unavailability of the QoS. If
the MS requested a value for a QoS parameter that is not within the range specified by 3GPP TS 23.107[81], the
network should negotiate the parameter to a value that lies within the specified range.
ETSI
Release 18 352 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.3.3.3 MS initiated PDP Context Modification not accepted by the network
6.1.3.3.3.1 General
Upon receipt of a MODIFY PDP CONTEXT REQUEST message, the network may reject the MS initiated PDP
context modification request by sending a MODIFY PDP CONTEXT REJECT message to the MS. The message shall
contain a cause code that typically indicates one of the following:
# 32: Service option not supported;
# 37: QoS not accepted;
# 48: request rejected, Bearer Control Mode violation;
# 60: bearer handling not supported; or
If upon the reception of a MODIFY PDP CONTEXT REQUEST message the network fails to re-establish the radio
access bearer for a PDP context whose maximum bit rate in uplink and downlink is set to 0kbit/s, the network shall
reply with a MODIFY PDP CONTEXT REJECT message with cause #26 "insufficient resources".
If a TFT modification was requested and the requested TFT is not available, then the MODIFY PDP CONTEXT
REJECT message shall be sent.
The network shall reply with a MODIFY PDP CONTEXT REJECT message with cause #48 "request rejected, Bearer
Control Mode violation", if
- the selected Bearer Control Mode is 'MS/NW' and the MS requests to create a TFT for a PDP context that was
established without TFT;
- the selected Bearer Control Mode is 'MS/NW' and the MS requests to upgrade the QoS of a PDP context without
downlink packet filters, unless uplink packet filters already exist for the PDP context and the MS requests with
the same MODIFY PDP CONTEXT REQUEST message to create downlink packet filters ;
- the selected Bearer Control Mode is 'MS/NW' and the MS requests to modify the QoS, but does not include a
TFT with at least apacket filter identifiers to indicate which packet filters in the TFT that is associated with the
QoS change; or
- the selected Bearer Control Mode is 'MS/NW' and the MS requests to modify the QoS for a PDP context
associated with a TFT containing packet filters established by both the MS and the network and the MS tries to
modify other parameters than the bitrate parameters in the QoS profile of that PDP context.
If a TFT modification was requested and the MS requests to modify or delete packet filters which were added by the
network, then the MODIFY PDP CONTEXT REJECT message shall be sent.
If the MS has requested to modify the QoS of a default PDP context, the network shall reply with a MODIFY PDP
CONTEXT REJECT message with cause code "QoS not accepted".
If the MS has requested to modify the PDP context of a LIPA PDN connection or SIPTO at the local network PDN
connection, then the network shall reply with a MODIFY PDP CONTEXT REJECT message with cause code "bearer
handling not supported".
ETSI
Release 18 353 3GPP TS 24.008 V18.4.0 (2023-09)
The TFT in the request message is checked by the network for different types of TFT IE errors as specified in
The network may include a Back-off timer value IE in the MODIFY PDP CONTEXT REJECT message.
The network shall not include the SM cause value #26 "insufficient resources" in the MODIFY PDP CONTEXT
REJECT message due to APN based congestion control being active.
If the Back-off timer value IE is included and the SM cause value is not #26 "insufficient resources", the network may
include the Re-attempt indicator IE to indicate whether the MS is allowed to attempt a bearer resource modification
procedure in the PLMN for the same APN in S1 mode, and whether another attempt in A/Gb and Iu mode or in S1
mode is allowed in an equivalent PLMN.
Upon receipt of a MODIFY PDP CONTEXT REJECT message, the MS shall stop timer T3381 and enter the state
PDP-ACTIVE.
If the SM cause value is #26 and the Back-off timer value IE is included, the MS shall ignore the Re-attempt indicator
IE provided by the network, if any, and take different actions depending on the timer value received for timer T3396 in
the Back-off timer value IE (if the MS is configured for dual priority, exceptions are specified in subclause 6.1.3.12; if
the MS is an MS configured to use AC11 – 15 in selected PLMN, exceptions are specified in subclause 6.1.3.11):
timer value IE and not send another ACTIVATE PDP CONTEXT REQUEST, ACTIVATE SECONDARY PDP
subclause 6.1.3.3, for the same APN until timer T3396 expires or timer T3396 is stopped. If the MS did not send
an APN for the establishment of the PDN connection and the request type was different from "emergency", the
MS shall stop timer T3396 associated with no APN, if it is running. The MS shall then start timer T3396 with
the value provided in the Back-off timer value IE and not send another ACTIVATE PDP CONTEXT REQUEST
without an APN and with request type different from "emergency", or another ACTIVATE SECONDARY PDP
subclause 6.1.3.3, for a non-emergency PDN connection established without an APN sent by the MS, until timer
T3396 expires or timer T3396 is stopped. The MS shall not stop timer T3396 upon a PLMN change or inter-
system change;
CONTEXT REQUEST, ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT
REQUEST message with exception of those identified in subclause 6.1.3.3, for the same APN until the MS is
switched off or the SIM/USIM is removed or the MS receives REQUEST PDP CONTEXT ACTIVATION,
REQUEST SECONDARY PDP CONTEXT ACTIVATION or MODIFY PDP CONTEXT REQUEST message
for the same APN or a DEACTIVATE PDP CONTEXT REQUEST message including SM cause #39
"reactivation requested" for a PDP context which was activated by the MS for the same APN from the network.
If the MS did not send an APN for the establishment of the PDN connection and the request type was different
from "emergency", the MS shall not send another ACTIVATE PDP CONTEXT REQUEST without an APN and
REQUEST or MODIFY PDP CONTEXT REQUEST with exception of those identified in subclause 6.1.3.3, for
a non-emergency PDN connection established without APN sent by the MS, until the MS is switched off or the
SIM/USIM is removed or the MS receives any of the following messages: a REQUEST PDP CONTEXT
PDP CONTEXT REQUEST message for a non-emergency PDN connection established without an APN sent by
the MS, or a DEACTIVATE PDP CONTEXT REQUEST message including SM cause #39 "reactivation
requested" for a PDP context which was activated by the MS for a non-emergency PDN connection established
without an APN sent by the MS. The timer T3396 remains deactivated upon a PLMN change or inter-system
change; or
ETSI
Release 18 354 3GPP TS 24.008 V18.4.0 (2023-09)
If the Back-off timer value IE is not included, the MS may send an ACTIVATE PDP CONTEXT REQUEST,
same APN.
MS is switched on, the MS behaves as follows:
If the SM cause value is not #26 "insufficient resources" and the Back-off timer value IE is included, the MS takes
different actions depending on the timer value received in the Back-off timer value IE (if the MS is an MS configured to
use AC11 – 15 in selected PLMN, exceptions are specified in subclause 6.1.3.13):
provided in the Back-off timer value IE for the PDP context modification procedure and PLMN and APN
combination and not send another MODIFY PDP CONTEXT REQUEST message with exception of those
identified in subclause 6.1.3.3, in the PLMN for the same APN until the back-off timer expires, the MS is
switched off or the SIM/USIM is removed;
ii) if the timer value indicates that this timer is deactivated, the MS shall not send another MODIFY PDP
CONTEXT REQUEST message with exception of those identified in subclause 6.1.3.3, in the PLMN for the
same APN until the MS is switched off or the SIM/USIM is removed; or
iii) if the timer value indicates that this timer is zero, the MS may send an MODIFY PDP CONTEXT REQUEST
message in the PLMN for the same APN.
network, if any.
i) Additionally, if the SM cause value is #32 "service option not supported", or #33 "requested service option not
subscribed", the MS shall proceed as follows:
described above in the present subclause, using the default value of 12 minutes for the back-off timer.
ii) For SM cause values different from #32 "service option not supported", or #33 "requested service option not
subscribed", the MS behaviour regarding the start of a back-off timer is unspecified.
ETSI
Release 18 355 3GPP TS 24.008 V18.4.0 (2023-09)
back-off timer for the PDP context modification procedure and PLMN and APN combination is deactivated, then it
MODIFY PDP CONTEXT REQUEST message with exception of those identified in subclause 6.1.3.3, in
the PLMN for the same APN.
If the back-off timer is started upon receipt of a MODIFY PDP CONTEXT REQUEST message (i.e. the timer value
was provided by the network, a configured value is available or the default value is used as explained above) or the
back-off timer is deactivated, the MS behaves as follows:
i) after a PLMN change the MS may send a MODIFY PDP CONTEXT REQUEST message for the same APN in
the new PLMN, if the back-off timer is not running and is not deactivated for the PDP context modification
procedure and the combination of new PLMN and APN;
Furthermore as an implementation option, for the SM cause values #32 "service option not supported" or #33
"requested service option not subscribed", if the network does not include a Re-attempt indicator IE, the MS may
decide not to automatically send another MODIFY PDP CONTEXT REQUEST message for the same APN, if
the MS registered to a new PLMN which is in the list of equivalent PLMNs.
determine whether the MS may attempt a bearer resource modification procedure for the same PLMN and
APN combination in S1 mode; and
a bearer resource modification procedure for the same PLMN and APN combination in S1 mode is
unspecified; and
PLMN from the equivalent PLMN list and the APN the MS shall start a back-off timer for the PDP context
modification procedure with the value provided by the network, or deactivate the respective back-off timer as
follows:
If the back-off timer for a PLMN and APN combination was started or deactivated in S1 mode upon receipt of a
BEARER RESOURCE MODIFICATION REJECT message (see 3GPP TS 24.301 [120]) and the network indicated
that re-attempt in A/Gb or Iu mode is allowed, then this back-off timer does not prevent the MS from sending a
MODIFY PDP CONTEXT REQUEST message in this PLMN for the same APN in A/Gb or Iu mode. If the network
indicated that re-attempt in A/Gb or Iu mode is not allowed, the MS shall not send any MODIFY PDP CONTEXT
REQUEST message in this PLMN for the same APN in A/Gb or Iu mode until the timer expires, the MS is switched off
or the USIM is removed.
ETSI
Release 18 356 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.3.3.3a Network initiated PDP Context Modification not accepted by the MS

Upon receipt of a MODIFY PDP CONTEXT REQUEST message, if the MS does not accept the new QoS due to
resource reasons or the indicated LLC SAPI, the MS shall initiate the PDP context deactivation procedure for the PDP
context - the reject cause IE value of the DEACTIVATE PDP CONTEXT REQUEST message shall indicate "QoS not
accepted".
The MS may reject the network initiated PDP context modification request by sending a MODIFY PDP CONTEXT
REJECT message to the network. The message shall contain a cause code that typically indicates one of the following:
# 48: request rejected, Bearer Control Mode violation; or
The MS shall reply with a MODIFY PDP CONTEXT REJECT message with cause "request rejected, Bearer Control
Mode violation", if the selected Bearer Control Mode is 'MS only' and the network requests to modify or delete a TFT
If a TFT modification was requested and the network requests to modify or delete packet filters which were added by
the MS, then the MODIFY PDP CONTEXT REJECT message shall be sent.
The TFT in the request message is checked by the MS for different types of TFT IE errors as specified in
Upon receipt of a MODIFY PDP CONTEXT REJECT message, the network shall stop timer T3386 and enter the state
PDP-ACTIVE.

a) Expiry of timers
On the first expiry of timer T3386, the network shall resend the MODIFY PDP CONTEXT REQUEST
message reset and restart timer T3386. This retransmission is repeated four times, i.e. on the fifth expiry of
timer T3386, the network may continue to use the previously negotiated QoS and TFT, or it may initiate the
PDP context deactivation procedure.
In the MS:
On the first expiry of timer T3381, the MS shall resend the MODIFY PDP CONTEXT REQUEST message
reset and restart timer T3381. This retransmission is repeated four times, i.e. on the fifth expiry of timer
T3381, the MS may continue to use the previously negotiated QoS and TFT, or it may initiate the PDP
context deactivation procedure.
b) Collision of MS and Network initiated PDP Context Modification Procedures
A collision of a MS and network initiated PDP context modification procedures is identified by the MS if a
MODIFY PDP CONTEXT REQUEST message is received from the network after the MS has sent a MODIFY
PDP CONTEXT REQUEST message itself, and both messages contain the same TI and the MS has not yet
received a MODIFY PDP CONTEXT ACCEPT message from the network.
A collision is detected by the network in case a MODIFY PDP CONTEXT REQUEST message is received from
the MS with the same TI as the MODIFY PDP CONTEXT REQUEST message sent to the MS.
In the case of such a collision, the network initiated PDP context modification shall take precedence over the MS
initiated PDP context modification. The MS shall terminate internally the MS initiated PDP context modification
procedure, enter the state PDP-Active and proceed with the network initiated PDP context modification
ETSI
Release 18 357 3GPP TS 24.008 V18.4.0 (2023-09)
procedure by sending a MODIFY PDP CONTEXT ACCEPT message. The network shall ignore the MODIFY
PDP CONTEXT REQUEST message received in the state PDP-MODIFY-PENDING. The network shall
proceed with the network initiated PDP context modification procedure as if no MODIFY PDP CONTEXT
REQUEST message was received from the MS.
c) Collision of MS initiated PDP Context Modification Procedures and Network initiated Deactivate PDP Context
Request Procedures
A collision of a MS initiated PDP context modification procedures and a network initiated PDP context
deactivation procedures is identified by the MS if a DEACTIVATE PDP CONTEXT REQUEST message is
received from the network after the MS has sent a MODIFY PDP CONTEXT REQUEST message, and the MS
has not yet received a MODIFY PDP CONTEXT ACCEPT message from the network.
In the case of such a collision, the network initiated PDP context deactivation shall take precedence over the MS
initiated PDP context modification. The MS shall terminate internally the MS initiated PDP context modification
procedure, and proceed with the network initiated PDP context deactivation procedure by sending a
DEACTIVATE PDP CONTEXT ACCEPT, enter the state PDP-INACTIVE. The network shall ignore the
MODIFY PDP CONTEXT REQUEST message received in the state PDP-INACTIVE-PENDING. The network
shall proceed with the network initiated PDP context deactivation procedure as if no MODIFY PDP CONTEXT
REQUEST message was received from the MS.
d) MS initiated PDP context modification procedure for a PDN connection established for emergency bearer
services.
The network shall reply with a MODIFY PDP CONTEXT REJECT message with a cause code indicating
"activation rejected by GGSN, Serving GW or PDN GW".
The TFT in the MODIFY PDP CONTEXT REQUEST message is checked for different types of TFT IE errors as
follows:
a) Semantic errors in TFT operations:
1) When the TFT operation is "Create a new TFT" and there is already an existing TFT for the PDP context.
2) When the TFT operation is an operation other than "Create a new TFT" and there is no TFT for the PDP
context.
3) When the TFT operation is "Delete existing TFT" and the TFT includes packet filters created by the receiver
of the request.
4) When the TFT operation is "Delete existing TFT" and there is already another PDP context with the same
PDP address and APN without a TFT.
5) When the TFT operation is "Delete existing TFT" and the PDP context is not the default PDP context.
6) When the TFT operation is "Delete packet filters from existing TFT" or "Replace packet filters in existing
TFT" and at least one of the packet filters to be deleted or replaced was created by the receiver of the request.
7) When the TFT operation is "Delete packet filters from existing TFT" and this operation would render the
TFT empty.
In the above cases the network shall perform the following actions:
In case 1) the network shall further process the new activation request and, if it was processed successfully,
delete the old TFT.
In case 2) the network shall:
- further process the new request and, if no error according to list items b), c), and d) was detected, consider
the TFT as successfully deleted, if the TFT operation is "Delete existing TFT" or "Delete packet filters from
existing TFT"; and
- process the new request as an activation request, if the TFT operation is "Add packet filters in existing TFT"
or "Replace packet filters in existing TFT".
In case 3) the network shall reject the modification request with cause "semantic error in the TFT operation".
ETSI
Release 18 358 3GPP TS 24.008 V18.4.0 (2023-09)
In case 4) the network shall either:
- reject the modification request with cause "semantic error in the TFT operation"; or
- optionally, if the BCM is "MS only" and the packet filters in the TFT do not have any explicit direction
information, i.e. the packet filter direction parameter is set to "00", process the new deletion request and, after
successful deletion of the TFT, deactivate the old PDP context with the same PDP address and APN without
a TFT by explicit peer-to-peer signalling between the MS and the network.
- In case 5) the network shall either:
- reject the modification request with cause "semantic error in the TFT operation"; or
- optionally, if the BCM is "MS only" and the packet filters in the TFT do not have any explicit direction
information, i.e. the packet filter direction parameter is set to "00", process the new deletion request.
In case 6) the network shall reject the modification request with cause "semantic error in the TFT operation".
In case 7) the network shall:
i) if the PDP context is the default PDP context, further process the new request and, if no error according to
list items b), c), and d) was detected, delete the existing TFT. After successful deletion of the TFT, if there
was already another PDP context with the same PDP address and APN without a TFT, the network shall
deactivate this old PDP context without a TFT by explicit peer-to-peer signalling between the MS and the
network; and
ii) if the PDP context is not the default PDP context, further process the new request and, if no error according
to list items b), c), and d) was detected, delete the existing TFT. After successful deletion of the TFT, the
network shall deactivate the modified PDP context by explicit peer-to-peer signalling between the MS and
the network. The network need not respond with a Modify PDP Context Accept message.
In the above cases the MS shall perform the following actions:
In case 1) the MS shall further process the new activation request and, if it was processed successfully, delete the
old TFT.
In case 2) the MS shall:
- further process the new request and, if no error according to list items b), c), and d) was detected, consider
the TFT as successfully deleted, if the TFT operation is "Delete existing TFT" or "Delete packet filters from
existing TFT"; and
- process the new request as an activation request, if the TFT operation is "Add packet filters in existing TFT"
or "Replace packet filters in existing TFT".
In case 3) the MS shall reject the modification request with cause "semantic error in the TFT operation".
In case 4) the MS shall either:
A) reject the modification request with cause "semantic error in the TFT operation"; or
B) optionally, to support networks compliant with earlier versions of the protocol, process the new deletion
request and, after successful deletion of the TFT, deactivate the old PDP context with the same PDP address
and APN without a TFT by explicit peer-to-peer signalling between the MS and the network.
NOTE 1: This case is not expected to occur for a network implementing this version of the protocol, because at
least one of the two PDP contexts without TFT will be a non-default PDP context. But for Bearer Control
Mode 'MS/NW' such a network does not support an initial configuration where the old PDP context
without TFT is a non-default PDP context, and the network will not attempt to delete the TFT of a non-
default PDP context.
If during a previous inter-system change from S1 mode to A/Gb or Iu mode the default PDP context linked to the
PDP context to be modified was mapped from an EPS bearer context, the MS shall follow option A.
In case 5) the MS shall either:
ETSI
Release 18 359 3GPP TS 24.008 V18.4.0 (2023-09)
A) reject the modification request with cause "semantic error in the TFT operation"; or
B) optionally, to support networks compliant with earlier versions of the protocol, process the new deletion
request.
NOTE 2: A network implementing this version of the protocol will not attempt to delete the TFT of a non-default
PDP context.
If during a previous inter-system change from S1 mode to A/Gb or Iu mode the default PDP context linked to the
PDP context to be modified was mapped from an EPS bearer context, the MS shall follow option A.
In case 6) the MS shall reject the modification request with cause "semantic error in the TFT operation".
In case 7) the MS shall:
i) if the PDP context is the default PDP context, further process the new request and, if no error according to
list items b), c), and d) was detected, delete the existing TFT. After successful deletion of the TFT, if there
was already another PDP context with the same PDP address and APN without a TFT, the MS shall
deactivate this old PDP context without a TFT by explicit peer-to-peer signalling between the MS and the
network; and
ii) if the PDP context is not the default PDP context, either
- further process the new request and, if no error according to list items b), c), and d) was detected, delete
the existing TFT. After successful deletion of the TFT, the MS shall deactivate the modified PDP context
by explicit peer-to-peer signalling between the MS and the network. The MS need not send a Modify
PDP Context Accept message; or
- reject the modification request with cause "semantic error in the TFT operation".
b) Syntactical errors in TFT operations:
1) When the TFT operation is an operation other than "Delete existing TFT" or "No TFT operation" and the
packet filter list in the TFT IE is empty.
2) When the TFT operation is "Delete existing TFT" or "No TFT operation" with a non-empty packet filter list
in the TFT IE.
3) When the TFT operation is "Replace packet filters in existing TFT" and the packet filter to be replaced does
not exist in the original TFT.
4) When the TFT operation is "Delete packet filters from existing TFT" and the packet filter to be deleted does
not exist in the original TFT.
5) Void.
6) When there are other types of syntactical errors in the coding of the TFT IE, such as a mismatch between the
number of packet filters subfield, and the number of packet filters in the packet filter list.
7) When the TFT operation is "No TFT operation" with an empty parameters list.
In case 3) the network shall not diagnose an error, further process the replace request and, if no error according
to list items c) and d) was detected, include the packet filters received to the existing TFT.
In case 4) the network shall not diagnose an error, further process the deletion request and, if no error according
to list items c) and d) was detected, consider the respective packet filter as successfully deleted.
Otherwise the network shall reject the modification request with cause "syntactical error in the TFT operation".
In case 3) the MS shall not diagnose an error, further process the replace request and, if no error according to list
items c) and d) was detected, include the packet filters received to the existing TFT.
In case 4) the MS shall not diagnose an error, further process the deletion request and, if no error according to
list items c) and d) was detected, consider the respective packet filter as successfully deleted.
Otherwise the MS shall reject the modification request with cause "syntactical error in the TFT operation".
ETSI
Release 18 360 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 2a: An implementation that strictly follows packet filter list as defined in subclause 10.5.6.12 might not
detect case 2).
c) Semantic errors in packet filters:
1) When a packet filter consists of conflicting packet filter components which would render the packet filter
ineffective, i.e. no IP packet will ever fit this packet filter. How the receiver determines a semantic error in a
packet filter is outside the scope of the present document.
2) When the resulting TFT, which is not assigned to the default PDP context, does not contain any packet filter
applicable for the uplink direction.
NOTE 3: When BCM is 'MS only', the MS is allowed to include a TFT with packet filters without any explicit
direction information, i.e. with value "00", and such packet filters are applicable for both uplink and
downlink directions.
The network shall reject the modification request with cause "semantic errors in packet filter(s)".
The MS shall reject the modification request with cause "semantic errors in packet filter(s)".
d) Syntactical errors in packet filters:
1) When the TFT operation is "Create a new TFT" or "Add packet filters to existing TFT" and two or more
packet filters in the resultant TFT would have identical packet filter identifiers.
2) When the TFT operation is "Create a new TFT" or "Add packet filters to existing TFT" or "Replace packet
filters in existing TFT" and two or more packet filters in all TFTs associated with this PDP address and APN
would have identical packet filter precedence values.
3) When there are other types of syntactical errors in the coding of packet filters, such as the use of a reserved
value for a packet filter component identifier.
In case 1), if two or more packet filters with identical packet filter identifiers are contained in the new request,
the network shall reject the modification request with cause "syntactical errors in packet filter(s)". Otherwise, the
network shall not diagnose an error, further process the new request and, if it was processed successfully, delete
the old packet filters which have the identical packet filter identifiers.
In case 2) the network shall not diagnose an error, further process the new request and, if it was processed
successfully, delete the old packet filters which have identical filter precedence values. Furthermore, by means
of explicit peer-to-peer signalling between the MS and the network, the network shall deactivate the PDP
context(s) for which it has deleted the packet filters.
Otherwise the network shall reject the modification request with cause "syntactical errors in packet filter(s)".
In case 1), if two or more packet filters with identical packet filter identifiers are contained in the new request,
the MS shall reject the modification request with cause "syntactical errors in packet filter(s)". Otherwise, the MS
shall not diagnose an error, further process the new request and, if it was processed successfully, delete the old
packet filters which have the identical packet filter identifiers.
In case 2) the MS shall not diagnose an error, further process the new request and, if it was processed
successfully, delete the old packet filters which have identical filter precedence values. Furthermore, the MS
shall deactivate the PDP context(s) for which it has deleted the packet filters by means of explicit peer-to-peer
signalling between the MS and the network,.
Otherwise, the MS shall reject the modification request with cause "syntactical errors in packet filter(s)".
ETSI
Release 18 361 3GPP TS 24.008 V18.4.0 (2023-09)
MS Network
MODIFY PDP CONTEXT REQUEST
Start T3386
MODIFY PDP CONTEXT ACCEPT

Stop T3386
Figure 6.6/3GPP TS 24.008: Network initiated PDP context modification procedure
Figure 6.7/3GPP TS 24.008: MS initiated PDP context modification procedure
6.1.3.4 PDP context deactivation procedure

The purpose of this procedure is to deactivate an existing PDP context between the MS and the network. The PDP
context deactivation may be initiated by the MS or by the network. The tear down indicator information element may
be included in the DEACTIVATE PDP CONTEXT REQUEST message in order to indicate whether only the PDP
context associated with this specific TI or all active PDP contexts sharing the same PDP address and APN as the PDP
context associated with this specific TI shall be deactivated. If the tear down is requested, all other active PDP contexts
sharing the same PDP address and APN as the PDP context associated with this specific TI shall be deactivated locally
without peer-to-peer signalling. In this case, the network should not include WLAN offload indication in the
DEACTIVATE PDP CONTEXT REQUEST message, and if the UE receives the WLAN offload indication, the UE
shall ignore the indication. If the tear down indicator information element is not included in the DEACTIVATE PDP
CONTEXT REQUEST message, only the PDP context associated with this specific TI shall be deactivated. For an
exception when the PDP context is a default PDP context and there are other active PDP contexts sharing the same PDP
address and APN, see subclause 6.1.3.4.3.
An MS supporting S1 mode shall always include the tear down indicator when deactivating the default PDP context. An
MS not supporting S1 mode should apply the same behavior (see 3GPP TS 23.060 [74]).
Local deactivation of a NBIFOM multi-access PDN connection can be triggered by an NBIFOM procedure
(see 3GPP TS 24.161 [158]). If such a trigger is received then the associated PDP contexts mentioned in this
specification shall be deactivated locally without peer-to-peer signalling.
After successful PDP context deactivation, the associated NSAPI and TI values are released and can be reassigned to
another PDP context.
If one or more MBMS contexts are linked to a PDP context that has been deactivated, the MS shall deactivate all those
MBMS contexts locally (without peer to peer signalling between the MS and the network).
The MS is allowed to initiate the PDP context deactivation procedure even if the timer T3396 is running.
6.1.3.4.1 PDP context deactivation initiated by the MS

In order to deactivate a PDP context, the MS sends a DEACTIVATE PDP CONTEXT REQUEST message to the
network, enters the state PDP-INACTIVE-PENDING and starts timer T3390. The message contains the transaction
ETSI
Release 18 362 3GPP TS 24.008 V18.4.0 (2023-09)
identifier (TI) in use for the PDP context to be deactivated and a cause code that typically indicates one of the following
causes:
# 25: LLC or SNDCP failure (A/Gb mode only);
# 36: regular deactivation; or
# 37: QoS not accepted.
The network shall reply with the DEACTIVATE PDP CONTEXT ACCEPT message. Upon receipt of the
DEACTIVATE PDP CONTEXT ACCEPT message, the MS shall stop timer T3390.
In A/Gb mode, both the MS and the network shall initiate local release of the logical link if it is not used by another
PDP context.
In Iu mode, the network shall initiate the release of Radio Access Bearer associated with this PDP context.
If the selected Bearer Control Mode is 'MS/NW' the MS should not deactivate a PDP context, if it is the only PDP
context without TFT within a group of active PDP contexts sharing the same PDP address and APN.
NOTE 1: A configuration with more than one PDP context without TFT within a group of active PDP contexts
sharing the same PDP address and APN can occur during a network initiated PDP context modification
due to asynchronous TFT states in the MS and in the network (see e.g. subclause 6.1.3.3.4 bullet a.3 in
the description of the TFT checks).
NOTE 2: If the MS deactivates the last remaining PDP context without TFT within a group of active PDP contexts
sharing the same PDP address and APN, a network implementing this version of the protocol will
deactivate all other active PDP contexts sharing the same PDP address and APN by explicit peer-to-peer
signalling; a network compliant with earlier versions of the protocol can initiate the re-establishment of
this PDP context using the network requested secondary PDP context activation procedure.
6.1.3.4.2 PDP context deactivation initiated by the network

In order to deactivate a PDP context, the network sends a DEACTIVATE PDP CONTEXT REQUEST message to the
MS and starts timer T3395. The message contains the transaction identifier in use for the PDP context to be deactivated
and a cause code that typically indicates one of the following causes:
# 25: LLC or SNDCP failure (A/Gb mode only);
# 36: regular deactivation;
# 38: network failure;
# 39: reactivation requested.
#112: APN restriction value incompatible with active PDP context; or
#113: Multiple accesses to a PDN connection not allowed.
The MS shall, upon receipt of this message, reply with a DEACTIVATE PDP CONTEXT ACCEPT message. Upon
receipt of the DEACTIVATE PDP CONTEXT ACCEPT message, the network shall stop the timer T3395.
If the DEACTIVATE PDP CONTEXT REQUEST message includes the cause #39 "reactivation requested", the PDP
context was activated by the MS, and the MS sent an APN for the establishment of the PDN connection, the MS shall
stop timer T3396 if it is running for the APN sent by the MS. The MS should then re-activate the PDP context. If the
MS did not send an APN for the establishment of the PDN connection and the request type was different from
"emergency", the MS shall stop the timer T3396 associated with no APN if it is running, and should re-activate the PDP
context without including an APN. Additionally, the MS should re-activate the PDP contexts that were originally
ETSI
Release 18 363 3GPP TS 24.008 V18.4.0 (2023-09)
activated by the MS and released by the network as a result of this PDP context deactivation procedure. If the
DEACTIVATE PDP CONTEXT REQUEST message was received for an emergency PDN connection, the MS shall
not stop the timer T3396 associated with no APN if it is running. The MS should then re-initiate the PDP context
activation procedure for the emergency PDN connection.
NOTE: User interaction is necessary in some cases when the MS cannot re-activate the PDP context(s)
automatically.
If a detach is requested by the HLR for an MS that has PDP contexts for emergency services, the SGSN shall send a
DEACTIVATE PDP CONTEXT REQUEST message to the MS for all the PDP contexts that are not PDP contexts for
emergency services.
If the network operates in network operation mode I, ISR is activated and the MS has indicated support of EMM
combined procedures in MS network capability, when the SGSN receives the request from the Serving GW for
deactivating the last remaining PDP context, then the SGSN shall perform a detach procedure for non-GPRS services
only as described in subclause 4.7.4.2.
In A/Gb mode, both the MS and the network shall initiate local release of the logical link if it is not used by another
PDP context.
In Iu mode, the network shall initiate the release of Radio Access Bearer associated with this PDP context.
If the SM cause value is #26 "insufficient resources", the network may include a value for timer T3396 in the
DEACTIVATE PDP CONTEXT REQUEST message.
If the SM cause value is #26 "insufficient resources" and T3396 value IE is included:
- the MS shall take different actions depending on the timer value received for timer T3396 (if the MS is
configured for dual priority, exceptions are specified in subclause 6.1.3.12; if the MS is an MS configured to use
AC11 – 15 in selected PLMN, exceptions are specified in subclause 6.1.3.11):
i) if the timer value indicates neither zero nor deactivated, the MS shall stop the timer T3396 associated with
the corresponding APN, if it is running. The MS shall start timer T3396 with received value and not send
another ACTIVATE PDP CONTEXT REQUEST, ACTIVATE SECONDARY PDP CONTEXT REQUEST
or MODIFY PDP CONTEXT REQUEST message with exception of those identified in subclause 6.1.3.3,
for the same APN until timer T3396 expires or the timer T3396 is stopped. If the MS did not send an APN
for the establishment of the PDN connection and the request type was different from "emergency", the MS
shall stop timer T3396 associated with no APN, if it is running. The MS shall then start timer T3396 with the
value provided in the Back-off timer value IE and not send another ACTIVATE PDP CONTEXT REQUEST
without an APN and with request type different from "emergency", or another ACTIVATE SECONDARY
PDP CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message with exception of those
identified in subclause 6.1.3.3, for a non-emergency PDN connection established without an APN sent by the
MS, until timer T3396 expires or timer T3396 is stopped. The MS shall not stop timer T3396 upon a PLMN
change or inter-system change;
CONTEXT REQUEST, ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP
CONTEXT REQUEST message with exception of those identified in subclause 6.1.3.3, for the same APN
until the MS is switched off or the SIM/USIM is removed or the MS receives a REQUEST PDP CONTEXT
ACTIVATION, REQUEST SECONDARY PDP CONTEXT ACTIVATION or MODIFY PDP CONTEXT
REQUEST message with exception of those identified in subclause 6.1.3.3, for the same APN from the
network or a DEACTIVATE PDP CONTEXT REQUEST message including SM cause #39 "reactivation
requested" for a PDP context which was activated by the MS for the same APN from the network. If the MS
did not send an APN for the establishment of the PDN connection and the request type was different from
"emergency", the MS shall not send another ACTIVATE PDP CONTEXT REQUEST without an APN and
REQUEST or MODIFY PDP CONTEXT REQUEST with exception of those identified in subclause 6.1.3.3,
for a non-emergency PDN connection established without an APN sent by the MS, until the MS is switched
off or the SIM/USIM is removed or the MS receives any of the following messages: a REQUEST PDP
CONTEXT ACTIVATION without an APN, a REQUEST SECONDARY PDP CONTEXT ACTIVATION
or MODIFY PDP CONTEXT REQUEST message for a non-emergency PDN connection established without
an APN sent by the MS, or a DEACTIVATE PDP CONTEXT REQUEST message including SM cause #39
"reactivation requested" for a PDP context which was activated by the MS for a non-emergency PDN
ETSI
Release 18 364 3GPP TS 24.008 V18.4.0 (2023-09)
connection established without APN sent by the MS. The timer T3396 remains deactivated upon a PLMN
change or inter-system change; and
- shall stop timer T3396 associated with the corresponding APN, if running, and may send another
ACTIVATE PDP CONTEXT REQUEST, ACTIVATE SECONDARY PDP CONTEXT REQUEST or
MODIFY PDP CONTEXT REQUEST message for the same APN; and
SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message for a
non-emergency PDN connection established without an APN sent by the MS.
- If the timer T3396 is running when the MS enters state GMM-DEREGISTERED, the MS remains switched on,
and the SIM/USIM in the MS remains the same, then timer T3396 is kept running until it expires or it is stopped.
- if the MS is switched off when the timer T3396 is running, the MS shall behave as follows when the MS is
switched on and the SIM/USIM in the MS remains the same:
- let t1 be the time remaining for T3396 timeout at switch off and let t be the time elapsed between switch off
and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or
less than t, then the timer need not be restarted. If the MS is not capable of determining t, then the MS shall
restart the timer with the value t1; and
ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message
containing the low priority indicator set to "MS is configured for NAS signalling low priority" was rejected
with timer T3396, and if timer T3396 is restarted at switch on, then the MS configured for dual priority shall
handle session management requests as indicated in subclause 6.1.3.12.
If the T3396 value IE is not included, the MS shall proceed with deactivation procedure and then send DEACTIVATE
PDP CONTEXT ACCEPT message.

a) Expiry of timers
On the first expiry of timer T3390, the MS shall resent the message DEACTIVATE PDP CONTEXT
REQUEST and shall reset and restart the timer T3390. This retransmission is repeated four times, i.e. on the
fifth expiry of timer T3390, the MS shall release all resources allocated and shall erase the PDP context
related data.
On the first expiry of timer T3395, the network shall resent the message DEACTIVATE PDP CONTEXT
REQUEST and shall reset and restart timer T3395. This retransmission is repeated four times, i.e. on the fifth
expiry of timer T3395, the network shall erase the PDP context related data for that MS.
b) Collision of MS and network initiated PDP context deactivation requests
If the MS and the network initiated PDP context deactivation requests collide, the MS and the network shall each
reply with the messages DEACTIVATE PDP CONTEXT ACCEPT and shall stop timer T3390 and T3395,
respectively.
c) Network initiated PDP context deactivation request without tear down indicator information element for a
default PDP context
If an MS supporting S1 mode receives a DEACTIVATE PDP CONTEXT REQUEST message without tear
down indicator information element, and the PDP context associated with the specific TI is a default PDP
ETSI
Release 18 365 3GPP TS 24.008 V18.4.0 (2023-09)
context, the MS shall deactivate the default PDP context as specified in subclause 6.1.3.4.2. Additionally the
MS shall deactivate all other active PDP contexts sharing the same PDP address and APN as the default PDP
context locally without peer-to-peer signalling.
An MS not supporting S1 mode may apply the same behaviour.
MS Network
DEACTIVATE PDP CONTEXT REQUEST

Start T3390
DEACTIVATE PDP CONTEXT ACCEPT

Stop T3390
Figure 6.8/3GPP TS 24.008: MS initiated PDP context deactivation procedure
MS Network

Start T3395

Stop T3395
Figure 6.9/3GPP TS 24.008: Network initiated PDP context deactivation procedure
6.1.3.4a Void
6.1.3.5 Void
6.1.3.5a Notification procedure
6.1.3.5a.1 General
The network can use the notification procedure to inform the MS about events which are relevant for the upper layer
which is using a PDP context or has requested a session management procedure.
If the MS has indicated that it supports the notification procedure, the network may initiate the procedure at any time
while a PDP context is activated or another session management procedure is ongoing.
6.1.3.5a.2 Notification procedure initiation by the network

The network initiates the notification procedure by sending a NOTIFICATION message to the MS (see example in
figure 6.9a/3GPP TS 24.008).
ETSI
Release 18 366 3GPP TS 24.008 V18.4.0 (2023-09)
MS Network
NOTIFICATION
Figure 6.9a/3GPP TS 24.008: Notification procedure
6.1.3.5a.3 Notification procedure in the MS

When the MS receives a NOTIFICATION message, the SM protocol entity in the MS shall provide the notification
indicator to the upper layer.
The notification indicator can have the following value:
#1: SRVCC handover cancelled, IMS session re-establishment required.
6.1.3.6 Receiving a SM STATUS message by a SM entity

If the SM entity of the MS receives an SM STATUS message the MS shall take different actions depending on the
received SM cause value:
#81 Invalid transaction identifier value
The MS shall abort any ongoing SM procedure related to the received transaction identifier value, stop any
related timer, and deactivate the corresponding PDP or MBMS context locally (without peer to peer signalling
between the MS and the network).
If one or more MBMS contexts are linked to a PDP context that has been deactivated, the MS shall deactivate all
those MBMS Contexts locally (without peer to peer signalling between the MS and the network).
#97 Message type non-existent or not implemented
The MS shall abort any ongoing SM procedure related to the received transaction identifier value and stop any
related timer.
If the SM entity of the MS receives a SM STATUS message with any other SM cause value no state transition and no
specific action shall be taken as seen from the radio interface, i.e. local actions are possible.
If the SM entity of the network receives an SM STATUS message the network shall take different actions depending on
the received SM cause value:
#81 Invalid transaction identifier value
The network shall abort any ongoing SM procedure related to the received transaction identifier value, stop any
related timer, and deactivate the corresponding PDP or MBMS context locally (without peer to peer signalling
between the MS and the network).
ETSI
Release 18 367 3GPP TS 24.008 V18.4.0 (2023-09)
If one or more MBMS contexts are linked to a PDP context that has been deactivated, the MS shall deactivate all
those MBMS Contexts locally (without peer to peer signalling between the MS and the network).
#97 Message type non-existent or not implemented
The network shall abort any ongoing SM procedure related to the received transaction identifier value and stop
any related timer.
The actions to be taken in the network on receiving a SM STATUS message with any other SM cause value are an
implementation dependent option.
6.1.3.7 Protocol configuration options

The MS and the GGSN may communicate parameters by means of the protocol configuration options information
element or extended protocol configuration options information element when activating, modifying or deactivating a
PDP context. Such parameters can e.g. be used to convey information from external protocols between the MS and the
GGSN. An overview of how the protocol configuration options information element is used is specified in 3GPP TS
27.060 [36a].
The protocol configuration options information element and the extended protocol configuration options information
element is transparent to the SGSN.
NOTE 1: The MS and the network negotiate support of the extended protocol configuration options IE end-to-end
for each PDN connection, as the information element can only be used if it is supported also by the
GGSN/PDN GW.
If supported by the network and the MS end-to-end for a PDN connection, protocol configuration options shall be
exchanged via the extended protocol configuration options IE. Otherwise the protocol configuration options IE is used.
For the MS, the extended protocol configuration options is supported by the network and the MS end-to-end for a PDN
connection if the network has indicated support of the extended protocol configuration options IE in the last ATTACH
ACCEPT or ROUTING AREA UPDATING ACCEPT message, and
- the PDP Type requested for the default PDP context is non-IP; or
- the network has included the extended protocol configuration options IE in at least one session management
message received by the MS for this PDN connection.
For the SGSN, the extended protocol configuration options is supported by the network and the MS end-to-end for a
PDN connection if the MS has indicated support of the extended protocol configuration options IE in the last ATTACH
REQUEST or ROUTING AREA UPDATING REQUEST message, and
- the PDP Type requested for the default PDP context is non-IP; or
- the SGSN has received the extended protocol configuration options IE in at least one message sent by the GGSN
or PDN GW towards the MS for this PDN connection (for details see 3GPP TS 29.274 [16D]).
NOTE 2: For the GGSN or PDN GW, the extended protocol configuration options is supported by the network and
the MS end-to-end for a PDN connection if:
- the GGSN initiates a network requested PDP context activation with offered PDP Type non-IP; or
- the last support indication received from the SGSN or S-GW indicates that extended protocol
configuration options is supported for this PDN connection (for details see 3GPP TS 29.274 [16D]).
6.1.3.8 MBMS context activation

The purpose of this procedure is to establish an MBMS context in the MS and in the network for a specific IP Multicast
Address using a specific NSAPI for MBMS user plane transmission. The MS shall only initiate the MBMS context
activation when requested by the network. However, the trigger for the activation request by the network is initiated by
the MS at the application layer (see 3GPP TS 23.246 [106]).
ETSI
Release 18 368 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.3.8.1 Successful MBMS context activation

In order to request an MBMS context activation, the network sends a REQUEST MBMS CONTEXT ACTIVATION
message to the MS, enters the state MBMS-ACTIVE-PENDING and starts timer T3385. The message shall contain the
IP multicast address, the APN and the Linked NSAPI.
Upon receipt of a REQUEST MBMS CONTEXT ACTIVATION message, the MS shall validate the message by
verifying the NSAPI given in the Linked NSAPI IE to be one of the active PDP context(s), stop the timer T3396 if it is
running for the APN indicated in the message and send an ACTIVATE MBMS CONTEXT REQUEST, enter state
MBMS-ACTIVE-PENDING and start timer T3380. The message shall contain an IP multicast address and an APN,
which shall be the same as the IP multicast address and the APN requested by the network in the REQUEST MBMS
CONTEXT ACTIVATION message. Furthermore, the MS shall include the Supported MBMS bearer capabilities, i.e.
the maximum downlink bit rate the MS can handle.
Upon receipt of the ACTIVATE MBMS CONTEXT REQUEST message, the network shall stop timer T3385. If the
network accepts the request, it shall reply with an ACTIVATE MBMS CONTEXT ACCEPT message.
Upon receipt of the message ACTIVATE MBMS CONTEXT ACCEPT the MS shall stop timer T3380 and shall enter
the state MBMS-ACTIVE.
6.1.3.8.2 Unsuccessful MBMS context activation requested by the MS
6.1.3.8.2.1 General
Upon receipt of an ACTIVATE MBMS CONTEXT REQUEST message the network may reject the MS initiated
MBMS context activation by sending an ACTIVATE MBMS CONTEXT REJECT message to the MS. The sender of
the message shall include the same TI as included in the ACTIVATE MBMS CONTEX REQUEST and an additional
cause code that typically indicates one of the following causes:
# 24: MBMS bearer capabilities insufficient for the service;
# 27: missing or unknown APN;
# 29: user authentication failed;
# 34: service option temporarily out of order; or
# 95 - # 111: protocol errors.
The network may include a Back-off timer value IE in the ACTIVATE MBMS CONTEXT REJECT message.
If the Back-off timer value IE is included and the SM cause value is different from #26 "insufficient resources", the
network may include the Re-attempt indicator IE to indicate whether the MS is allowed to attempt an MBMS context
activation procedure in an equivalent PLMN.
Upon receipt of an ACTIVATE MBMS CONTEXT REJECT message, the MS shall stop timer T3380 and enter/remain
in state PDP-INACTIVE.
ETSI
Release 18 369 3GPP TS 24.008 V18.4.0 (2023-09)
timer value IE and shall not send another ACTIVATE MBMS CONTEXT REQUEST message for the same
APN that was sent by the MS until timer T3396 expires or timer T3396 is stopped. The MS shall not stop timer
T3396 upon a PLMN change or inter-system change;
ii) if the timer value indicates that this timer is deactivated, the MS shall not send another ACTIVATE MBMS
CONTEXT REQUEST message for the same APN that was sent by the MS, until the MS is switched off or the
SIM/USIM is removed or the MS receives REQUEST MBMS CONTEXT ACTIVATION message for the same
APN from the network. The timer T3396 remains deactivated upon a PLMN change or inter-system change; and
iii) if the timer value indicates that this timer is zero, the MS may send another ACTIVATE MBMS CONTEXT
REQUEST message for the same APN.
If the Back-off timer value IE is not included, then the MS may send another ACTIVATE MBMS CONTEXT
REQUEST message for the same APN.
If the MS is switched off when the timer T3396 is running, the MS shall behave as follows when the MS is switched on
and the SIM/USIM in the MS remains the same:
configured for NAS signalling low priority" was rejected with timer T3396, and if timer T3396 is restarted at
switch on, then the MS configured for dual priority shall handle session management requests as indicated in
subclause 6.1.3.12.
If the SM cause value is different from #26 "insufficient resources", and the Back-off timer value IE is included, the MS
shall take different actions depending on the timer value received in the Back-off timer value IE:
provided in the Back-off timer value IE for the MBMS context activation procedure and PLMN and APN
combination. The MS shall not send another ACTIVATE MBMS CONTEXT REQUEST message in the PLMN
for the same APN that was sent by the MS until the back-off timer expires, the MS is switched off or the
SIM/USIM is removed;
ii) if the timer value indicates that this timer is deactivated, the MS shall not send another ACTIVATE MBMS
CONTEXT REQUEST message in the PLMN for the same APN that was sent by the MS until the MS is
switched off or the SIM/USIM is removed; and
iii) if the timer value indicates that this timer is zero, the MS may send an ACTIVATE MBMS CONTEXT
REQUEST message in the PLMN for the same APN.
network, if any.
i) Additionally, if the SM cause value is #8 "operator determined barring", #27 "missing or unknown APN", #32
"service option not supported", or #33 "requested service option not subscribed", the MS shall proceed as
follows:
ETSI
Release 18 370 3GPP TS 24.008 V18.4.0 (2023-09)
ii) For SM cause values different from #8 "operator determined barring", #27 "missing or unknown APN", #32
"service option not supported", or #33 "requested service option not subscribed", the MS behaviour regarding the
start of a back-off timer is unspecified.
back-off timer for the MBMS context activation procedure and PLMN and APN combination is deactivated, then it
ACTIVATE MBMS CONTEXT REQUEST message in the PLMN for the same APN.
If the back-off timer is started upon receipt of an ACTIVATE MBMS CONTEXT REJECT message (i.e. the timer
value was provided by the network, a configured value is available or the default value is used as explained above) or
the back-off timer is deactivated, the MS behaves as follows:
i) after a PLMN change the MS may send an ACTIVATE MBMS CONTEXT REQUEST message for the same
APN in the new PLMN, if the back-off timer is not running and is not deactivated for the MBMS context
activation procedure and the combination of new PLMN and APN;
Furthermore as an implementation option, for the SM cause values #8 "operator determined barring", #27
"missing or unknown APN", #32 "service option not supported" or #33 "requested service option not
subscribed", if the network does not include a Re-attempt indicator IE, the MS may decide not to automatically
send another ACTIVATE MBMS CONTEXT REQUEST message for the same APN, if the MS registered to a
new PLMN which is in the list of equivalent PLMNs.
ii) if the network includes the Re-attempt indicator IE, the MS shall ignore any indication provided in the IE
regarding whether re-attempt in S1 mode is allowed. If the Re-attempt indicator IE indicates that re-attempt in an
equivalent PLMN is not allowed, then depending on the timer value received in the Back-off timer value IE, for
each combination of a PLMN from the equivalent PLMN list and the APN the MS shall start a back-off timer for
the MBMS context activation procedure with the value provided by the network, or deactivate the respective
back-off timer.
6.1.3.8.3 Unsuccessful MBMS context activation requested by the network

Upon receipt of the REQUEST MBMS CONTEXT ACTIVATION message, the MS may reject the network requested
MBMS context activation by sending the REQUEST MBMS CONTEXT ACTIVATION REJECT message to the
network. The sender of the message shall include the same TI as included in the REQUEST MBMS CONTEXT
ACTIVATION and an additional cause code that typically indicates one of the following causes:
# 40: feature not supported; or
# 95 - # 111: protocol errors.
The network shall stop timer T3385 and enter in state PDP-INACTIVE.
ETSI
Release 18 371 3GPP TS 24.008 V18.4.0 (2023-09)

a) Expiry of timers in the mobile station: On the first expiry of the timer T3380, the MS shall resend the
ACTIVATE MBMS CONTEXT REQUEST and shall reset and restart timer T3380. This retransmission is
repeated four times, i.e. on the fifth expiry of timer T3380, the MS shall release all resources possibly allocated
for this invocation and shall abort the procedure; no automatic MBMS context activation re-attempt shall be
performed.
b) Expiry of timers on the network side: On the first expiry of the timer T3385, the network shall resend the
message REQUEST MBMS CONTEXT ACTIVATION and shall reset and restart timer T3385. This
retransmission is repeated four times, i.e. on the fifth expiry of timer T3385, the network shall release possibly
allocated resources for this activation and shall abort the procedure.
c) MBMS context activation request for an already activated MBMS context (on the mobile station side): If the MS
receives a REQUEST MBMS CONTEXT ACTIVATION message with the same combination of APN and IP
multicast address (i.e. PDP type and PDP address) as an already activated MBMS context, the MS shall
deactivate the existing MBMS context locally without notification to the network and proceed with the requested
MBMS context activation.
d) MBMS context activation request for an already activated MBMS context (on the network side): If the network
receives an ACTIVATE MBMS CONTEXT REQUEST message with the same combination of APN and IP
multicast address (i.e. PDP type and PDP address) as an already activated MBMS context, the network shall
deactivate the existing MBMS context locally without notification to the MS and proceed with the requested
MBMS context activation.
Figure 6.10/3GPP TS 24.008: MBMS context activation procedure
6.1.3.9 MBMS context deactivation

The purpose of this procedure is to deactivate an existing MBMS context in the MS and the network. The MS shall only
initiate the MBMS context deactivation when requested by the network, however the trigger for the deactivation request
by the network may be initiated by the MS at application layer or by the network, see 3GPP TS 23.246 [106].
After a successful MBMS context deactivation, the associated MBMS NSAPI and TI values shall be released in both
the MS and the network and can be reassigned to another MBMS context.
The MBMS context deactivation procedure makes use of the messaging and signalling of the PDP context deactivation
procedure as described in the subclauses 6.1.3.9.1 and 6.1.3.9.2.
ETSI
Release 18 372 3GPP TS 24.008 V18.4.0 (2023-09)
6.1.3.9.1 MBMS context deactivation initiated by the network

In order to request an MBMS context deactivation, the network sends a DEACTIVATE PDP CONTEXT REQUEST
message to the MS, enters the state MBMS-INACTIVE-PENDING and starts timer T3395. The message contains the
transaction identifier (TI) in use for the MBMS context to be deactivated and a cause code that typically indicates one
of the following causes:
# 36: regular deactivation;
# 38: network failure;
# 47: multicast group membership time-out.
The MS shall reply with a DEACTIVATE PDP CONTEXT ACCEPT message and enter the state PDP-INACTIVE.
Upon receipt of the DEACTIVATE PDP CONTEXT ACCEPT message, the network shall stop the timer T3395 and
enter the state PDP-INACTIVE.

a) Expiry of timers:
On the first expiry of the timer T3395, the network shall resend the message DEACTIVATE PDP
CONTEXT REQUEST and shall reset and restart the timer T3395. This retransmission is repeated, i.e. on the
fifth expiry of the timer T3395, the network shall erase the MBMS context related data for that MS.
MS Network

Start T3395

Stop T3395
Figure 6.11/3GPP TS 24.008: MBMS context deactivation procedure
6.1.3.10 MBMS protocol configuration options

The MS and the GGSN may communicate parameters related to the MBMS bearer by means of the MBMS protocol
configuration options information element when activating or deactivating an MBMS context. For example, such
parameters can be used to convey information between the MS and the GGSN.
The MBMS protocol configuration options information element is transparent to the SGSN.
6.1.3.11 Handling of APN based congestion control

The network may detect and start performing the APN based congestion control when one or more APN congestion
criteria as specified in 3GPP TS 23.060 [74] are met. The network may store an APN congestion back-off time on a per
MS and congested APN basis. If the MS does not provide an APN for the PDP context activation, then the SGSN uses
the APN which is used in GGSN/PDN GW selection procedure as congested APN. When APN based congestion
control is active, the network may reject session management requests except the modify PDP context requests from
UEs or deactivate existing PDP contexts with SM cause value #26 "insufficient resources".
In the MS, session management timers T3396 for APN based congestion control are started and stopped on a per APN
basis. The APN associated with T3396 is the APN sent by the MS when the PDN connection is established. If no APN
is included in the ACTIVATE PDP CONTEXT REQUEST message, then T3396 is associated with no APN. For this
purpose the MS shall memorize the APN provided to the network during the PDP context activation. The timer T3396
ETSI
Release 18 373 3GPP TS 24.008 V18.4.0 (2023-09)
associated with no APN will never be started due to any SM procedure related to an emergency PDN connection. If the
timer T3396 associated with no APN is running, it does not affect the ability of the MS to request an emergency PDN
connection.
If timer T3396 is running or is deactivated, and the MS is an MS configured to use AC11 – 15 in selected PLMN, then
the MS is allowed to initiate any session management procedure for the respective APN.
6.1.3.11A Handling of group specific session management congestion control

The network may detect and start performing the group specific session management congestion control when one or
more group congestion criteria as specified in 3GPP TS 23.060 [74] are met. When group specific session management
congestion control is active, the mechanism for APN based congestion control as specified in subclause 6.1.3.11 shall
be followed.
6.1.3.12 Handling session management request for MS configured for dual priority
If timer T3396 is running for a specific APN due to one of the following reasons:
- an ACTIVATE PDP CONTEXT REQUEST, ACTIVATE SECONDARY PDP CONTEXT REQUEST,

MODIFY PDP CONTEXT REQUEST or ACTIVATE MBMS CONTEXT REQUEST message containing the
low priority indicator set to "MS is configured for NAS signalling low priority" was rejected with a timer value
for timer T3396 and SM cause value #26 "insufficient resources";
- a DEACTIVATE PDP CONTEXT REQUEST message was received with a timer value for timer T3396 and
SM cause value #26 "insufficient resources" for a PDP context established with the low priority indicator set to
"MS is configured for NAS signalling low priority", or
- because the MS received a DEACTIVATE PDP CONTEXT REQUEST message containing a timer value for
timer T3396 and SM cause value #26 "insufficient resources" for a PDP context established with the low priority
indicator set to "MS is configured for NAS signalling low priority";
upon request of the upper layers the MS can:
- send an ACTIVATE PDP CONTEXT REQUEST or ACTIVATE MBMS CONTEXT REQUEST message to
the same APN, with low priority indicator set to "MS is not configured for NAS signalling low priority"; or,
- send an ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST
message, with low priority indicator set to "MS is not configured for NAS signalling low priority", for an active
PDP context established with low priority indicator set to "MS is not configured for NAS signalling low priority"
exists.
If timer T3396 is running, because any of the following messages containing the low priority indicator set to "MS is
configured for NAS signalling low priority" was rejected with a timer value for timer T3396 and SM cause value #26
"insufficient resources":
- an ACTIVATE PDP CONTEXT REQUEST without an APN and with request type different from "emergency";
or
- an ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST message
for a non-emergency PDN connection established without APN sent by the MS,
or because the MS received a DEACTIVATE PDP CONTEXT REQUEST message containing a timer value for timer
T3396 and SM cause value #26 "insufficient resources" for a non-emergency PDN connection established without an
APN and established with the low priority indicator set to "MS is configured for NAS signalling low priority", then
upon request of the upper layers the MS can:
- send an ACTIVATE PDP CONTEXT REQUEST message without an APN and with low priority indicator set to
"MS is not configured for NAS signalling low priority" for establishment an non-emergency PDN connection; or
- send an ACTIVATE SECONDARY PDP CONTEXT REQUEST or MODIFY PDP CONTEXT REQUEST
message, with low priority indicator set to "MS is not configured for NAS signalling low priority", for an active
non-emergency PDP context established without an APN and with low priority indicator set to "MS is not
configured for NAS signalling low priority".
ETSI
Release 18 374 3GPP TS 24.008 V18.4.0 (2023-09)
For requests with low priority indicator set to "MS is configured for NAS signalling low priority", the MS shall follow
the procedures specified in subclause 6.1.3.1.3.
6.1.3.13 Handling of network rejection not due to APN based congestion control
The network may include a back-off timer value in a session management reject message to regulate the time interval at
which the MS may retry the same procedure. For SM cause values other than #26 "insufficient resources", the network
may also include the re-attempt indicator to indicate whether the MS is allowed to re-attempt the corresponding EPS
session management procedure for the same APN in S1 mode after inter-system change.
NOTE 1: If the network includes this back-off timer value, then the MS is blocked from sending another SM
request for the same procedure for the same PLMN and APN combination for the specified duration.
Therefore, the operator needs to exercise caution in determining the use of this timer value.
NOTE 2: If the re-attempt indicator is not provided by the network, an MS registered in its HPLMN or in an
EHPLMN (if the EHPLMN list is present) can use the configured SM_RetryAtRATChange value
specified in the NAS configuration MO or in the USIM NASCONFIG file to derive the re-attempt indicator
as specified in subclauses 6.1.3.1.3.3, 6.1.3.2.2.3, and 6.1.3.3.3.3.
If re-attempt in S1 mode is allowed, the MS shall consider the back-off timer to be applicable only to the GPRS session
management in A/Gb and Iu mode for the rejected session management procedure and the given PLMN and APN
combination. If re-attempt in S1 mode is not allowed, the MS shall consider the back-off timer to be applicable to both
NAS protocols, i.e. applicable to the GPRS session management in A/Gb and Iu mode for the rejected session
management procedure and to the EPS session management in S1 mode for the corresponding EPS session management
procedure and the given PLMN and APN combination.
The APN of the PLMN and APN combination associated with the back-off timer is the APN sent by the MS when the
PDN connection is established. If no APN is included in the ACTIVATE PDP CONTEXT REQUEST message, then
the back-off timer is associated with the combination of the PLMN and no APN. For this purpose the MS shall
memorize the APN provided to the network during the PDP context activation. The back-off timer associated with the
combination of a PLMN with no APN will never be started due to any SM procedure related to an emergency PDN
connection. If the back-off timer associated with the combination of a PLMN with no APN is running, it does not affect
the ability of the MS to request an emergency PDN connection.
The network may additionally indicate in the re-attempt indicator that a command to back-off is applicable not only for
the PLMN in which the MS received the session management reject message, but for each PLMN included in the
equivalent PLMN list at the time when the session management reject message was received.
If the back-off timer is running or is deactivated for a given PLMN and APN combination, and the MS is an MS
configured to use AC11 – 15 in selected PLMN, then the MS is allowed to initiate any GPRS session management
procedure for this PLMN and APN combination.
6.1.3.14 Handling of WLAN offload control

In networks that support offloading of traffic to WLAN, as specified in 3GPP TS 25.331 [23c], a permission to offload
is determined for the MS and the PDP context in accordance with 3GPP TS 23.060 [74] subclause 5.3.21.
6.2 void
6.3 Coordination between SM and GMM for supporting ISR

The MS with its TIN set as "RAT-related TMSI" for which ISR is activated shall change its TIN to "P-TMSI" to locally
deactivate ISR and stop the periodic tracking area update timer T3412 or T3423, if running:
- upon modification of any PDP context which was activated before the ISR is activated in the MS;
- upon deactivation of the last remaining PDP context in the MS;
- at the time when the MS performs intersystem change from A/Gb mode to S1 mode or from Iu mode to S1 mode
if any PDP context activated after the ISR was activated in the MS exists, and the MS is in EMM-IDLE mode on
completion of intersystem change; or
ETSI
Release 18 375 3GPP TS 24.008 V18.4.0 (2023-09)
- upon deactivation of last non-emergency PDP context in the MS, if the MS has only a PDN connection for
emergency bearer services remaining.
ISR remains activated on the network side in the above cases.
6.4 MSISDN notification procedure

The MSISDN notification procedure allows the MS to query the network for its MSISDN for the purpose of user
information. In order to request the MSISDN, the MS shall encode the protocol configuration options information
element (subclause 10.5.6.3) in the MS to network direction to indicate MSISDN query. The network shall then provide
the MSISDN, if available, in the protocol configuration options information element in the network to MS direction.
Querying the network and handling of the provided MSISDN by the MS is implementation dependent, in a similar way
to the USSD notification or application mode defined in 3GPP TS 23.090 [132].
NOTE: The MS might store the provided MSISDN in the corresponding USIM file (see 3GPP TS 31.102 [112]
subclause 4.2.26) and such an MS could check this USIM file to determine whether to query the network.
The network shall provide only one MSISDN. As a result, a provided MSISDN shall supercede any MSISDN that was
previously provided in the protocol configuration options information element. The MSISDN provided is for user
information only, and the MS shall not use the MSISDN in any NAS signalling procedure. If the MSISDN is stored in
the ME, the ME shall retain the MSISDN at power off. The MSISDN stored in the ME, if any, can only be used if the
IMSI from the USIM matches the IMSI stored in non-volatile memory, else the MS shall delete the MSISDN.
7 Examples of structured procedures

See 3GPP TS 23.108 [9a].
8 Handling of unknown, unforeseen, and erroneous

protocol data
8.1 General
The procedures specified in 3GPP TS 24.008 and call-related supplementary service handling in 3GPP TS 24.010 [21]
apply to those messages which pass the checks described in this subclause.
This subclause also specifies procedures for the handling of unknown, unforeseen, and erroneous protocol data by the
receiving entity. These procedures are called "error handling procedures", but in addition to providing recovery
mechanisms for error situations they define a compatibility mechanism for future extensions of the protocols.
Error handling concerning the value part of the Facility IE and of the SS Version Indicator IE are not in the scope of the
present document. It is defined in 3GPP TS 24.010 [21] and the 3GPP TS 24.08x series.
Sub subclauses 8.1 to 8.8 shall be applied in order of precedence.
Most error handling procedures are mandatory for the mobile station.
Detailed error handling procedures in the network are implementation dependent and may vary from PLMN to PLMN.
However, when extensions of this protocol are developed, networks will be assumed to have the error handling that is
indicated in this subclause as mandatory ("shall") and that is indicated as strongly recommended ("should").
Subclauses 8.2, 8.3, 8.4, 8.5 and 8.7.2 do not apply to the error handling in the network applied to the receipt of initial
layer 3 message: If the network diagnoses an error described in one of these subclauses in the initial layer 3 message
received from the mobile station, it shall either:
- try to recognize the classmark and then take further implementation dependent actions; or
- release the RR-connection.
ETSI
Release 18 376 3GPP TS 24.008 V18.4.0 (2023-09)
Also, the error handling of the network is only considered as mandatory or strongly recommended when certain
thresholds for errors are not reached during a dedicated connection.
For definition of semantical and syntactical errors see 3GPP TS 24.007 [20], subclause 11.4.2.
8.2 Message too short

When a message is received that is too short to contain a complete message type information element, that message
shall be ignored, cf. 3GPP TS 24.007 [20].
8.3 Unknown or unforeseen transaction identifier

8.3.1 Call Control
The mobile station and the network shall ignore a Call Control message received with TI EXT bit = 0. Otherwise, if the
TI EXT bit =1 or no extension is used, the behaviour described below shall be followed.
The mobile station and network shall reject a SETUP, EMERGENCY SETUP or START CC message received with
octet 1 part of the TI value coded as "111" by sending RELEASE COMPLETE with cause #81 "Invalid transaction
identifier value" The TI value in RELEASE COMPLETE shall be the complete TI value including the extension octet
from the message that caused the rejection.
Any message other than SETUP, EMERGENCY SETUP or START CC received with octet 1 part of the TI value
coded as "111" shall be ignored.
For a call control message received with octet 1 part of the TI value not coded as "111", the following procedures shall
apply:
a) For a network that does not support the "Network initiated MO call" option and for all mobile stations:
Whenever any call control message except EMERGENCY SETUP, SETUP or RELEASE COMPLETE is
received specifying a transaction identifier which is not recognized as relating to an active call or to a call in
progress, the receiving entity shall send a RELEASE COMPLETE message with cause #81 "invalid transaction
identifier value" using the received transaction identifier value and remain in the Null state.
For a network that does support the "Network initiated MO call" option $(CCBS)$:
Whenever any call control message except EMERGENCY SETUP, SETUP, START CC or RELEASE
COMPLETE is received specifying a transaction identifier which is not recognized as relating to an active call or
to a call in progress, the receiving entity shall send a RELEASE COMPLETE message with cause #81 "invalid
transaction identifier value" using the received transaction identifier value and remain in the Null state.
b) When a RELEASE COMPLETE message is received specifying a transaction identifier which is not recognized
as relating to an active call or to a call in progress, the MM connection associated with that transaction identifier
shall be released.
c) For a network that does not support the "Network initiated MO call" option and for all mobile stations:
When an EMERGENCY SETUP or, a SETUP message is received specifying a transaction identifier which is
not recognized as relating to an active call or to a call in progress, and with a transaction identifier flag
incorrectly set to "1", this message shall be ignored.
When an EMERGENCY SETUP, a START CC or, a SETUP message is received specifying a transaction
identifier which is not recognised as relating to an active call or to a call in progress, and with a transaction
identifier flag incorrectly set to "1", this message shall be ignored.
d) When a SETUP message is received by the mobile station specifying a transaction identifier which is recognized
as relating to an active call or to a call in progress, this SETUP message shall be ignored.
e) For a network that does not support the "Network initiated MO call" option:
ETSI
Release 18 377 3GPP TS 24.008 V18.4.0 (2023-09)
When an EMERGENCY SETUP message or a SETUP message is received by the network specifying a
transaction identifier which is recognized as relating to an active call or to a call in progress, this message need
not be treated and the network may perform other actions.
When an EMERGENCY SETUP message or a START CC message is received by the network specifying a
transaction identifier which is recognised as relating to an active call or to a call in progress, this message need
not be treated and the network may perform other actions.
The same applies to a SETUP message unless the transaction has been established by a START_CC message
and the network is in the "recall present" state (N0.6).
8.3.2 Session Management

The mobile station and network shall ignore a session management message with TI EXT bit = 0. Otherwise, the
following procedures shall apply:
a) Whenever any session management message except ACTIVATE PDP CONTEXT REQUEST, ACTIVATE
SECONDARY PDP CONTEXT REQUEST, or SM-STATUS is received by the network specifying a
transaction identifier which is not recognized as relating to an active PDP context or MBMS context,or to a PDP
context or MBMS context that is in the process of activation or deactivation, the network shall send a SM-
STATUS message with cause #81 "invalid transaction identifier value" using the received transaction identifier
value including the extension octet and remain in the PDP-INACTIVE state.
b) Whenever any session management message except REQUEST PDP CONTEXT ACTIVATION, REQUEST
SECONDARY PDP CONTEXT ACTIVATION, REQUEST MBMS CONTEXT ACTIVATION, or SM-
STATUS is received by the MS specifying a transaction identifier which is not recognized as relating to an
active context or to a context that is in the process of activation or deactivation, the MS shall send a SM-
STATUS message with cause #81 "invalid transaction identifier value" using the received transaction identifier
value including the extension octet and remain in the PDP-INACTIVE state.
c) When a REQUEST PDP CONTEXT ACTIVATION message, REQUEST SECONDARY PDP CONTEXT
ACTIVATION message or REQUEST MBMS CONTEXT ACTIVATION message is received by the MS with
a transaction identifier flag set to "1", this message shall be ignored.
d) When an ACTIVATE PDP CONTEXT REQUEST message is received by the network specifying a transaction
identifier which is not recognized as relating to a PDP context that is in the process of activation, and with a
transaction identifier flag set to "1", this message shall be ignored.
e) Whenever an ACTIVATE PDP CONTEXT REQUEST or ACTIVATE SECONDARY PDP CONTEXT

REQUEST message is received by the network specifying a transaction identifier relating to a PDP context or
MBMS context not in state PDP-INACTIVE, the network shall deactivate the old PDP context or MBMS
context relating to the received transaction identifier without notifying the MS. Furthermore, the network shall
continue with the activation procedure of a new PDP context as indicated in the received message. Whenever an
ACTIVATE MBMS CONTEXT REQUEST message is received by the network specifying a transaction
identifier relating to an MBMS context not in state PDP-INACTIVE, the network shall deactivate the old
MBMS context relating to the received transaction identifier without notifying the MS. Furthermore, the network
shall continue with the activation procedure of a new MBMS context as indicated in the received message.
f) Whenever a REQUEST PDP CONTEXT ACTIVATION message or REQUEST SECONDARY PDP

CONTEXT ACTIVATION message is received by the MS specifying a transaction identifier relating to a PDP
context or MBMS context not in state PDP-INACTIVE, the MS shall locally deactivate the old PDP context or
MBMS context relating to the received transaction identifier. Furthermore, the MS shall continue with the
activation procedure of a new PDP context as indicated in the received message.
Whenever a REQUEST MBMS CONTEXT ACTIVATION message is received by the MS specifying a

transaction identifier relating to a PDP context or MBMS context not in state PDP-INACTIVE, the MS shall
locally deactivate the old PDP context or MBMS context relating to the received transaction identifier.
Furthermore, the MS shall continue with the activation procedure of a new MBMS context as indicated in the
received message.
ETSI
Release 18 378 3GPP TS 24.008 V18.4.0 (2023-09)
g) When an ACTIVATE SECONDARY PDP CONTEXT REQUEST message is received by the network
specifying a transaction identifier which is not recognized as relating to a PDP context that is in the process of
activation and with a transaction identifier flag set to "1", this message shall be ignored.
8.4 Unknown or unforeseen message type

If a mobile station receives an RR, MM or CC message with message type not defined for the PD or not implemented
by the receiver in unacknowledged mode, it shall ignore the message.
If a mobile station receives an RR, MM or CC message with message type not defined for the PD or not implemented
by the receiver in acknowledged mode, it shall return a status message (STATUS, MM STATUS depending on the
protocol discriminator) with cause # 97 "message type non-existent or not implemented".
If a mobile station receives a GMM message or SM message with message type not defined for the PD or not
implemented by the receiver, it shall return a status message (GMM STATUS or SM STATUS depending on the
protocol discriminator) with cause # 97 "message type non-existent or not implemented".
If the network receives an MM message with message type not defined for the PD or not implemented by the receiver in
a protocol state where reception of an unsolicited message with the given PD from the mobile station is not foreseen in
the protocol, the network actions are implementation dependent. Otherwise, if the network receives a message with
message type not defined for the PD or not implemented by the receiver, it shall ignore the message except that it
should return a status message (STATUS, MM STATUS, GMM STATUS or SM STATUS depending on the protocol
discriminator) with cause #97 "message type non-existent or not implemented".
NOTE: A message type not defined for the PD in the given direction is regarded by the receiver as a message
type not defined for the PD, see 3GPP TS 24.007 [20].
If the mobile station receives a message not compatible with the protocol state, the mobile station shall ignore the
message except for the fact that, if an RR connection exists, it returns a status message (STATUS, MM STATUS
depending on the protocol discriminator) with cause #98 "Message type not compatible with protocol state". When the
message was a GMM message the GMM-STATUS message with cause #98 "Message type not compatible with
protocol state" shall be returned. When the message was a SM message the SM-STATUS message with cause #98
"Message type not compatible with protocol state" shall be returned.
If the network receives a message not compatible with the protocol state, the network actions are implementation
dependent.
NOTE: The use by GMM and SM of unacknowledged LLC may lead to messages "not compatible with the
protocol state".
8.5 Non-semantical mandatory information element errors

When on receipt of a message,
- an "imperative message part" error; or
- a "missing mandatory IE" error;
is diagnosed or when a message containing:
- a syntactically incorrect mandatory IE; or
- an IE unknown in the message, but encoded as "comprehension required" (see 3GPP TS 24.007 [20]); or
- an out of sequence IE encoded as "comprehension required" (see 3GPP TS 24.007 [20]) is received,
the mobile station shall proceed as follows:
If the message is not one of the messages listed in subclauses 8.5.1, 8.5.2, 8.5.3, 8.5.4 and 8.5.5 a), b) , f) or h),
the mobile station shall ignore the message except for the fact that, if an RR connection exists, it shall return a
status message (STATUS, MM STATUS depending on the protocol discriminator) with cause # 96 "Invalid
mandatory information". If the message was a GMM message the GMM-STATUS message with cause #96 "
ETSI
Release 18 379 3GPP TS 24.008 V18.4.0 (2023-09)
Invalid mandatory information" shall be returned. If the message was an SM message the SM-STATUS message
with cause # 96 "invalid mandatory information" shall be returned.
- the network shall proceed as follows:
When the message is not one of the messages listed in subclause 8.5.3 b), c), d) or e) and 8.5.5 a), c), d), e) or
g), the network shall either:
- try to treat the message (the exact further actions are implementation dependent), or
- ignore the message except that it should return a status message (STATUS, or MM STATUS (depending
on the protocol discriminator), GMM STATUS, or SM STATUS) with cause # 96 "Invalid mandatory
information".
8.5.1 Radio resource management

See 3GPP TS 44.018 [84].
8.5.2 Mobility management

No exceptional cases are described for mobility management messages.
8.5.3 Call control

a) If the message is a SETUP message, a RELEASE COMPLETE message with cause # 96 "invalid mandatory
information" shall be returned.
b) If the message is a DISCONNECT message, a RELEASE message shall be returned with cause value # 96
"invalid mandatory information" and subclause 5.4. "call clearing" applies as normal.
c) If the message is a RELEASE message, a RELEASE COMPLETE message shall be returned with cause value #
96 "invalid mandatory information".
d) If the message is a RELEASE COMPLETE message, it shall be treated as a normal RELEASE COMPLETE
message.
e) If the message is a HOLD REJECT or RETRIEVE REJECT message, it shall be treated as a normal HOLD
REJECT or RETRIEVE REJECT message.
f) If the message is a STATUS message and received by the network, a RELEASE COMPLETE message may be
returned with cause value # 96 "invalid mandatory information".
8.5.4 GMM mobility management

No exceptional cases are described for mobility management messages.
8.5.5 Session management

a) If the message is a DEACTIVATE PDP CONTEXT REQUEST, a DEACTIVATE PDP CONTEXT ACCEPT
message shall be returned. All resources allocated for that context shall be released.
b) If the message is a REQUEST PDP CONTEXT ACTIVATION, a REQUEST PDP CONTEXT ACTIVATION
REJECT message with cause # 96 "Invalid mandatory information" shall be returned.
c) If the message is an ACTIVATE PDP CONTEXT REQUEST, an ACTIVATE PDP CONTEXT REJECT
message with cause # 96 "Invalid mandatory information" shall be returned.
d) If the message is an ACTIVATE SECONDARY PDP CONTEXT REQUEST, an ACTIVATE SECONDARY

PDP CONTEXT REJECT message with cause # 96 "Invalid mandatory information" shall be returned.
e) If the message is a MODIFY PDP CONTEXT REQUEST, a MODIFY PDP CONTEXT REJECT message with
cause # 96 "Invalid mandatory information" shall be returned.
ETSI
Release 18 380 3GPP TS 24.008 V18.4.0 (2023-09)
f) If the message is a REQUEST MBMS CONTEXT ACTIVATION, a REQUEST MBMS CONTEXT

ACTIVATION REJECT message with cause # 96 "Invalid mandatory information" shall be returned.
g) If the message is an ACTIVATE MBMS CONTEXT REQUEST, an ACTIVATE MBMS CONTEXT REJECT
message with cause # 96 "Invalid mandatory information" shall be returned.
h) If the message is a REQUEST SECONDARY PDP CONTEXT ACTIVATION, a REQUEST SECONDARY

PDP CONTEXT ACTIVATION REJECT message with cause # 96 "Invalid mandatory information" shall be
returned.
8.6 Unknown and unforeseen IEs in the non-imperative

message part
8.6.1 IEIs unknown in the message
The MS shall ignore all IEs unknown in a message which are not encoded as "comprehension required" (see
3GPP TS 24.007 [20]).
The network shall take the same approach.
8.6.2 Out of sequence IEs

The MS shall ignore all out of sequence IEs in a message which are not encoded as "comprehension required" (see
3GPP TS 24.007 [20]).
The network should take the same approach.
8.6.3 Repeated IEs

If an information element with format T, TV, or TLV is repeated in a message in which repetition of the information
element is not specified in clause 9 of the present document, only the contents of the information element appearing
first shall be handled and all subsequent repetitions of the information element shall be ignored. When repetition of
information elements is specified, only the contents of specified repeated information elements shall be handled. If the
limit on repetition of information elements is exceeded, the contents of information elements appearing first up to the
limit of repetitions shall be handled and all subsequent repetitions of the information element shall be ignored.
The network should follow the same procedures.
8.7 Non-imperative message part errors

This category includes:
- syntactically incorrect optional IEs;
- conditional IE errors.
8.7.1 Syntactically incorrect optional IEs

The MS shall treat all optional IEs that are syntactically incorrect in a message as not present in the message.
The network shall take the same approach.
8.7.2 Conditional IE errors

When the MS upon receipt of an RR, MM or CC message diagnoses a "missing conditional IE" error or an "unexpected
conditional IE" error or when it receives an RR, MM or CC message containing at least one syntactically incorrect
conditional IE, it shall ignore the message except for the fact that, if an RR connection exists, it shall return a status
message (STATUS, or MM STATUS depending on the PD) with cause value # 100 "conditional IE error".
ETSI
Release 18 381 3GPP TS 24.008 V18.4.0 (2023-09)
When the MS upon receipt of a GMM or SM message diagnoses a "missing conditional IE" error or an "unexpected
conditional IE" error or when it receives a GMM or SM message containing at least one syntactically incorrect
conditional IE, it shall ignore the message and it shall return a status message (GMM STATUS or SM STATUS
depending on the PD) with cause value # 100 "conditional IE error".
When the network receives a message and diagnose a "missing conditional IE" error or an "unexpected conditional IE"
error or when it receives a message containing at least one syntactically incorrect conditional IE, the network shall
either
- try to treat the message (the exact further actions are implementation dependent), or
- ignore the message except that it should return a status message (STATUS, MM STATUS, GMM STATUS or
SM STATUS depending on the protocol discriminator) with cause # 100 "conditional IE error".
8.8 Messages with semantically incorrect contents

When a message with semantically incorrect contents is received, the foreseen reactions of the procedural part of 3GPP
TS 24.008 (i.e. of clauses 3, 4, 5, 6) are performed. If however no such reactions are specified, the MS shall ignore the
message except for the fact that, if an RR connection exists, it returns a status message (STATUS, or MM STATUS
depending on the PD) with cause value # 95 "semantically incorrect message". If the message was a GMM message the
GMM-STATUS message with cause #95 "semantically incorrect message" shall be returned. If the message was an SM
message the SM-STATUS message with cause # 95 "semantically incorrect message" shall be returned.
The network should follow the same procedure except that a status message is not normally transmitted.
Semantic checking of the Facility information element value part (defined in 3GPP TS 24.080 [24]) is the subject of the
technical specifications 3GPP TS 24.010 [21] and the 3GPP TS 24.08x series.
9 Message functional definitions and contents

This clause defines the structure of the messages of those layer 3 protocols defined in 3GPP TS 24.008. These are
standard L3 messages as defined in 3GPP TS 24.007 [20].
Each definition given in the present clause includes:
a) a brief description of the message direction and use, including whether the message has:
1. Local significance, i.e. relevant only on the originating or terminating access;
2. Access significance, i.e. relevant in the originating and terminating access, but not in the network;
3. Dual significance, i.e. relevant in either the originating or terminating access and in the network; or
4. Global significance, i.e. relevant in the originating and terminating access and in the network.
b) a table listing the information elements known in the message and their order of their appearance in the message.
In messages for circuit-switched call control also a shift information element shall be considered as known even
if not included in the table. All information elements that may be repeated are explicitly indicated. (V and LV
formatted IEs, which compose the imperative part of the message, occur before T, TV, and TLV formatted IEs
which compose the non-imperative part of the message, cf. 3GPP TS 24.007 [20].) In a (maximal) sequence of
consecutive information elements with half octet length, the first information element with half octet length
occupies bits 1 to 4 of octet N, the second bits 5 to 8 of octet N, the third bits 1 to 4 of octet N+1 etc. Such a
sequence always has an even number of elements.
For each information element the table indicates:
1. the information element identifier, in hexadecimal notation, if the IE has format T, TV, or TLV. Usually,
there is a default IEI for an information element type; default IEIs of different IE types of the same protocol
are different. If the IEI has half octet length, it is specified by a notation representing the IEI as a
hexadecimal digit followed by a "-" (example: B-).
ETSI
Release 18 382 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 1: The same IEI may be used for different information element types in different messages of the same
protocol.
NOTE 2: In the CC protocol the IEI of the locking shift and non-locking shift information elements is the same in
all messages and is not used for any other information elements.
2. the name of the information element (which may give an idea of the semantics of the element). The name of
the information element (usually written in italics) followed by "IE" or "information element" is used in
3GPP TS 24.008 as reference to the information element within a message.
3. the name of the type of the information element (which indicates the coding of the value part of the IE), and
generally, the referenced subclause of clause 10 of 3GPP TS 24.008 describing the value part of the
information element.
4. the presence requirement indication (M, C, or O) for the IE as defined in 3GPP TS 24.007 [20].
5. The format of the information element (T, V, TV, LV, TLV) as defined in 3GPP TS 24.007 [20].
6. The length of the information element (or permissible range of lengths), in octets, in the message, where "?"
means that the maximum length of the IE is only constrained by link layer protocol, and in the case of the
Facility IE by possible further conditions specified in 3GPP TS 24.010 [21]. This indication is non-
normative.
c.) subclauses specifying, where appropriate, conditions for IEs with presence requirement C or O in the relevant
message which together with other conditions specified in 3GPP TS 24.008 define when the information
elements shall be included or not, what non-presence of such IEs means, and - for IEs with presence requirement
C - the static conditions for presence and/or non-presence of the IEs (see 3GPP TS 24.007 [20]).
9.1 Messages for Radio Resources management

See 3GPP TS 44.018 [84].
9.2 Messages for mobility management

Table 9.2.1/3GPP TS 24.008 summarizes the messages for mobility management.
ETSI
Release 18 383 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.2.1/3GPP TS 24.008: Messages for mobility management
Registration messages: Reference

IMSI DETACH INDICATION 9.2.12
LOCATION UPDATING ACCEPT 9.2.13
LOCATION UPDATING REJECT 9.2.14
LOCATION UPDATING REQUEST 9.2.15
Security messages: Reference
AUTHENTICATION REJECT 9.2.1
AUTHENTICATION REQUEST 9.2.2
AUTHENTICATION RESPONSE 9.2.3
AUTHENTICATION FAILURE 9.2.3a
IDENTITY REQUEST 9.2.10
IDENTITY RESPONSE 9.2.11
TMSI REALLOCATION COMMAND 9.2.17
TMSI REALLOCATION COMPLETE 9.2.18
Connection management messages: Reference
CM SERVICE ACCEPT 9.2.5
CM SERVICE PROMPT 9.2.5a
CM SERVICE REJECT 9.2.6
CM SERVICE ABORT 9.2.7
CM SERVICE REQUEST 9.2.9
CM RE-ESTABLISHMENT REQUEST 9.2.4
ABORT 9.2.8
Miscellaneous message: Reference
MM INFORMATION 9.2.15a
MM STATUS 9.2.16
MM NULL 9.2.19
9.2.1 Authentication reject

This message is sent by the network to the mobile station to indicate that authentication has failed (and that the
receiving mobile station shall abort all activities). See table 9.2.2/3GPP TS 24.008.
Message type: AUTHENTICATION REJECT
Significance: dual
Direction: network to mobile station
Table 9.2.2/3GPP TS 24.008: AUTHENTICATION REJECT message content
IEI Information element Type/Reference Presence Format Length

Mobility management Protocol discriminator M V 1/2
protocol discriminator 10.2
Skip Indicator Skip Indicator M V 1/2
10.3.1
Authentication Reject Message type M V 1
message type 10.4
ETSI
Release 18 384 3GPP TS 24.008 V18.4.0 (2023-09)
9.2.2 Authentication request

This message is sent by the network to the mobile station to initiate authentication of the mobile station identity. See
table 9.2.3/3GPP TS 24.008.
Message type: AUTHENTICATION REQUEST
Significance: dual
Table 9.2.3/3GPP TS 24.008: AUTHENTICATION REQUEST message content

10.3.1
Authentication Request Message type M V 1
message type 10.4
Ciphering key sequence Ciphering key sequence M V 1/2
number number
10.5.1.2
Spare half octet Spare half octet M V 1/2
10.5.1.8
Authentication Auth. parameter RAND M V 16
parameter RAND (UMTS 10.5.3.1
challenge or GSM challenge)
20 Authentication Auth. parameter AUTN O TLV 18
Parameter AUTN 10.5.3.1.1
9.2.2.1 Authentication Parameter AUTN

This IE shall be present if and only if the authentication challenge is a UMTS authentication challenge.The presence or
absence of this IE defines- in the case of its absence- a GSM authentication challenge or- in the case of its presence- a
UMTS authentication challenge.
The MS shall ignore the IE if a SIM is inserted in the MS.
In UMTS, the MS shall reject the AUTHENTICATION REQUEST message as specified in subclause 4.3.2.5.1 if this
IE is not present and a USIM is inserted in the MS.
9.2.3 Authentication response

This message is sent by the mobile station to the network to deliver a calculated response to the network. See
table 9.2.4/3GPP TS 24.008.
Message type: AUTHENTICATION RESPONSE
Significance: dual
Direction: mobile station to network
ETSI
Release 18 385 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.2.4/3GPP TS 24.008: AUTHENTICATION RESPONSE message content

10.3.1
Authentication Response Message type M V 1
message type 10.4
Authentication Response Auth. Response parameter M V 4
parameter 10.5.3.2
21 Authentication Response Auth. Response parameter O TLV 3-14
Parameter (extension) 10.5.3.2.1
9.2.3.1 Authentication Response Parameter

This IE contains the SRES, if it was a GSM authentication challenge, or the RES (all or just the 4 most significant
octets of) if it was a UMTS authentication challenge (see also subclause 9.2.3.2).
9.2.3.2 Authentication Response Parameter (extension)

This IE shall be included if and only if the authentication challenge was a UMTS authentication challenge and the RES
parameter is greater than 4 octets in length. It shall contain the least significant remaining bits of the RES (the four most
significant octets shall be sent in the Authentication Response Parameter IE (see subclause 9.2.3.1))
This IE shall not be included if a SIM is inserted in the MS.
9.2.3a Authentication Failure

This message is sent by the mobile station to the network to indicate that authentication of the network has failed. See
table 9.2.4a/3GPP TS 24.008.
Message type: AUTHENTICATION FAILURE
Significance: dual
Table 9.2.4a/3GPP TS 24.008: AUTHENTICATION FAILURE message content

Protocol discriminator 10.2
10.3.1
Authentication Failure Message type M V 1
Message type 10.4
Reject Cause Reject Cause M V 1
10.5.3.6
22 Authentication Failure parameter Authentication Failure parameter O TLV 16
10.5.3.2.2
9.2.3a.1 Authentication Failure parameter

This IE shall be sent if and only if the reject cause was "Synch failure". It shall include the response to the
authentication challenge from the USIM, which is made up of the AUTS parameter (see 3GPP TS 33.102 [5a]).
ETSI
Release 18 386 3GPP TS 24.008 V18.4.0 (2023-09)
9.2.4 CM Re-establishment request

This message is sent by the mobile station to the network to request re-establishment of a connection if the previous one
has failed. See table 9.2.5/3GPP TS 24.008.
Message type: CM RE-ESTABLISHMENT REQUEST
Significance: dual
Table 9.2.5/3GPP TS 24.008: CM RE-ESTABLISHMENT REQUEST message content

Mobility management Protocol discriminator M V ½
Skip Indicator Skip Indicator M V ½
10.3.1
CM Re-Establishment Message type M V 1
Request message type 10.4
Ciphering key sequence Ciphering key sequence M V ½
number number
10.5.1.2
Spare half octet Spare half octet M V ½
10.5.1.8
Mobile station Mobile station M LV 4
classmark classmark 2
10.5.1.6
Mobile identity Mobile identity M LV 2-9
10.5.1.4
13 Location area Location area C TV 6
identification identification
10.5.1.3
D- Device properties Device properties O TV 1
10.5.7.8
NOTE: In A/Gb mode, the maximum number of octets that can be transferred is 20.
9.2.4.1 Location area identification

The location area identification information element shall appear when a TMSI is used as mobile identity, to render that
mobile identity non-ambiguous. This is the LAI stored in the SIM/USIM.
9.2.4.2 Mobile Station Classmark

This IE shall include for multiband mobile station the Classmark 2 corresponding to the frequency band in use.
9.2.4.3 Device properties

This IE shall be included if the MS is configured for NAS signalling low priority.
9.2.5 CM service accept

This message is sent by the network to the mobile station to indicate that the requested service has been accepted. See
table 9.2.6/3GPP TS 24.008.
ETSI
Release 18 387 3GPP TS 24.008 V18.4.0 (2023-09)
Message type: CM SERVICE ACCEPT
Significance: dual
Table 9.2.6/3GPP TS 24.008: CM SERVICE ACCEPT message content

10.3.1
CM Service Accept Message type M V 1
message type 10.4
9.2.5a CM service prompt $(CCBS)$

A mobile station that does not support the "Network initiated MO call" option shall treat this message as a message with
message type not defined for the PD.
This message is sent by the network to the mobile station to request the mobile to establish a service for the specified
CM protocol using the specified SAPI, e.g. circuit switched connection establishment on SAPI 0, supplementary
services activation on SAPI 0, or short message transfer on SAPI 3. See Table 9.2.7/3GPP TS 24.008.
Message type: CM SERVICE PROMPT
Significance: dual
Table 9.2.7/3GPP TS 24.008: CM SERVICE PROMPT message content

10.3.1
CM Service Prompt Message type M V 1
message type 10.4
PD and SAPI of CM PD and SAPI M V 1
10.5.1.10a
9.2.6 CM service reject

This message is sent by the network to the mobile station to indicate that the requested service cannot be provided. See
table 9.2.8/3GPP TS 24.008.
Message type: CM SERVICE REJECT
Significance: dual
ETSI
Release 18 388 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.2.8/3GPP TS 24.008: CM SERVICE REJECT message content

10.3.1
CM Service Reject Message type M V 1
message type 10.4
Reject cause Reject cause M V 1
10.5.3.6
36 T3246 value MM timer O TLV 3
10.5.3.16
9.2.6.1 T3246 value

This IE may be included when the CS domain NAS level mobility management congestion control is active.
9.2.7 CM service abort

This message is sent by the mobile station to the network to request the abortion of the first MM connection
establishment in progress and the release of the RR connection. See table 9.2.9/3GPP TS 24.008.
Message type: CM SERVICE ABORT
Significance: dual
Table 9.2.9/3GPP TS 24.008: CM SERVICE ABORT message content

10.3.1
CM Service Abort Message type M V 1
message type 10.4
9.2.8 Abort
This message is sent by the network to the mobile station to initiate the abortion of all MM connections and to indicate
the reason for the abortion. See table 9.2.10/3GPP TS 24.008.
Message type: ABORT
Significance: dual
Table 9.2.10/3GPP TS 24.008: ABORT message content

10.3.1
Abort Message type M V 1
message type 10.4
10.5.3.6
ETSI
Release 18 389 3GPP TS 24.008 V18.4.0 (2023-09)
9.2.9 CM service request

This message is sent by the mobile station to the network to request a service for the connection management sublayer
entities, e.g. circuit switched connection establishment, supplementary services activation, short message transfer,
location services. See table 9.2.11/3GPP TS 24.008.
Message type: CM SERVICE REQUEST
Significance: dual
Table 9.2.11/3GPP TS 24.008: CM SERVICE REQUEST message content

10.3.1
CM Service Request Message type M V 1
message type 10.4
CM service type CM service type M V ½
10.5.3.3
Ciphering key sequence Ciphering key sequence M V ½
number number
10.5.1.2
Mobile station Mobile station M LV 4
10.5.1.6
10.5.1.4
8- Priority Priority Level O TV 1
10.5.1.11
C- Additional update parameters Additional update parameters O TV 1
10.5.3.14
10.5.7.8

9.2.9.2 Priority
May be included by mobile station supporting eMLPP to indicate the priority requested.
This information element is only meaningful when the CM service type is:
Mobile originating call establishment;
Emergency call establishment;
Voice group call establishment;
Voice broadcast call establishment.
9.2.9.3 Additional update parameters

The MS shall include this IE during CS fallback for a mobile originating call or if the MS is requested by the upper
layers to set up a mobile originating "DRVCC call" (see subclause 4.5.1.1).
ETSI
Release 18 390 3GPP TS 24.008 V18.4.0 (2023-09)

9.2.10 Identity request

This message is sent by the network to the mobile station to request a mobile station to submit the specified identity to
the network. See table 9.2.12/3GPP TS 24.008.
Message type: IDENTITY REQUEST
Significance: dual
Table 9.2.12/3GPP TS 24.008: IDENTITY REQUEST message content

10.3.1
Identity Request Message type M V 1
message type 10.4
Identity type Identity type M V 1/2
10.5.3.4
10.5.1.8
9.2.11 Identity response

This message is sent by the mobile station to the network in response to an IDENTITY REQUEST message providing
the requested identity. See table 9.2.13/3GPP TS 24.008.
Message type: IDENTITY RESPONSE
Significance: dual
Table 9.2.13/3GPP TS 24.008: IDENTITY RESPONSE message content

10.3.1
Identity Response Message type M V 1
message type 10.4
10.5.1.4
E- P-TMSI type P-TMSI type O TV 1
10.5.5.29
1B Routing area identification Routing area identification 2 O TLV 8
10.5.5.15a
19 P-TMSI signature P-TMSI signature 2 O TLV 5
10.5.5.8a
ETSI
Release 18 391 3GPP TS 24.008 V18.4.0 (2023-09)
9.2.12 IMSI detach indication

This message is sent by the mobile station to the network to set a deactivation indication in the network. See
table 9.2.14/3GPP TS 24.008.
Message type: IMSI DETACH INDICATION
Significance: dual
Table 9.2.14/3GPP TS 24.008: IMSI DETACH INDICATION message content

10.3.1
IMSI Detach Indication Message type M V 1
message type 10.4
Mobile station Mobile station M V 1
10.5.1.5
10.5.1.4

9.2.13 Location updating accept

This message is sent by the network to the mobile station to indicate that updating or IMSI attach in the network has
been completed. See table 9.2.15/3GPP TS 24.008.
Message type: LOCATION UPDATING ACCEPT
Significance: dual
ETSI
Release 18 392 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.2.15/3GPP TS 24.008: LOCATION UPDATING ACCEPT message content

10.3.1
Location Updating Message type M V 1
Accept message type 10.4
Location area Location area M V 5
10.5.1.3
17 Mobile identity Mobile identity O TLV 3-10
10.5.1.4
A1 Follow on proceed Follow on proceed O T 1
10.5.3.7
A2 CTS permission CTS permission O T 1
10.5.3.10
4A Equivalent PLMNs PLMN list O TLV 5-47
10.5.1.13
34 Emergency Number List Emergency Number List O TLV 5-50
10.5.3.13
35 Per MS T3212 GPRS Timer 3 O TLV 3
10.5.7.4a
D- Non-3GPP NW provided policies Non-3GPP NW provided policies O TV 1
10.5.5.37
9.2.13.1 Follow on proceed

The follow on proceed information element appears if the network wishes to indicate that the mobile station may
attempt an MM connection establishment using the same RR connection.
9.2.13.2 CTS permission

The CTS permission information element appears if the network wishes to allow the mobile station to use GSM-
Cordless Telephony System in the Location Area.
9.2.13.3 Equivalent PLMNs

The Equivalent PLMNs information element is included if the network wants to inform the mobile station of equivalent
PLMNs.
9.2.13.4 Emergency Number List

This IE may be sent by the network. If this IE is sent, the contents of this IE indicates a list of emergency numbers valid
within the same country as the PLMN from which this IE is received.
9.2.13.5 Per MS T3212

This IE may be sent by the network to provide the MS with a periodic LAU timer that may be different to the broadcast
value, e.g. to lengthen the timer.
9.2.13.6 Non-3GPP NW provided policies

This IE is included if the network needs to indicate whether emergency numbers provided via non-3GPP access can be
used to initiate MS detected emergency calls (see 3GPP TS 24.302 [156]). If this IE is not included then the MS shall
interpret this as a receipt of an information element with all bits of the value part coded as zero.
ETSI
Release 18 393 3GPP TS 24.008 V18.4.0 (2023-09)
9.2.14 Location updating reject

This message is sent by the network to the mobile station to indicate that updating or IMSI attach has failed. See
table 9.2.16/3GPP TS 24.008.
Message type: LOCATION UPDATING REJECT
Significance: dual
Table 9.2.16/3GPP TS 24.008: LOCATION UPDATING REJECT message content

10.3.1
Reject message type 10.4
10.5.3.6
36 T3246 value MM timer O TLV 3
10.5.3.16
9.2.14.1 T3246 value

This IE may be included when the CS domain NAS level mobility management congestion control is active.
9.2.15 Location updating request

This message is sent by the mobile station to the network either to request update of its location file (normal updating or
periodic updating) or to request IMSI attach. See table 9.2.17/3GPP TS 24.008.
Message type: LOCATION UPDATING REQUEST
Significance: dual
ETSI
Release 18 394 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.2.17/3GPP TS 24.008: LOCATION UPDATING REQUEST message content

10.3.1
Request message type 10.4
Location updating type Location updating type M V 1/2
10.5.3.5
Ciphering key sequence Ciphering key sequence M V 1/2
number number
10.5.1.2
10.5.1.3
Mobile station Mobile station M V 1
10.5.1.5
10.5.1.4
33 Mobile station Mobile station O TLV 5
classmark for UMTS classmark 2
10.5.1.6
C- Additional update parameters Additional update parameters O TV 1
10.5.3.14
10.5.7.8
E- MS network feature support MS network feature support O TV 1
10.5.1.15
NOTE: In A/Gb mode, the maximum number of octets that can be transferred is 20.
9.2.15.1 Location area identification

The location area identification stored in the SIM/USIM is used.

This IE shall include for multiband MS the Classmark 1 corresponding to the frequency band in use.
9.2.15.3 Mobile Station Classmark for Iu mode

This IE shall be included when the mobile station is in Iu mode network. The IE shall not be included when the mobile
station is in A/Gb mode network.

The MS shall include this IE if, during CS fallback for a CS call, or upon request from the upper layers to set up a
mobile originating "DRVCC call", the MS determines that it has to perform location updating when it enters a GERAN
or UTRAN cell (see subclauses 4.5.1.1 and 4.5.1.3.4).

9.2.15.6 MS network feature support

This IE shall be included if the MS supports extended periodic timer T3212 and the Additional update parameters IE is
not included.
ETSI
Release 18 395 3GPP TS 24.008 V18.4.0 (2023-09)
9.2.15a MM information
This message is sent by the network to the mobile station to provide the mobile station with subscriber specific
information. See table 9.2.18/3GPP TS 24.008.
Message type: MM INFORMATION
Significance: dual
Table 9.2.18/3GPP TS 24.008 MM INFORMATION message content

10.3.1
MM Information Message type M V 1
message type 10.4
43 Full name for network Network Name O TLV 3-?
10.5.3.5a
45 Short name for network Network Name O TLV 3-?
10.5.3.5a
46 Local time zone Time Zone O TV 2
10.5.3.8
47 Universal time and local time Time Zone and Time O TV 8
zone
10.5.3.9
48 LSA Identity LSA Identifier O TLV 2-5
10.5.3.11
49 Network Daylight Saving Time Daylight Saving Time O TLV 3
10.5.3.12
9.2.15a.1 Full name for network

This IE may be sent by the network. If this IE is sent, the contents of this IE indicate the "full length name of the
network" that the network wishes the mobile station to associate with the MCC and MNC contained in the Location
Area Identification of the cell to which the mobile station sent its Channel Request message.
9.2.15a.2 Short name for network

This IE may be sent by the network. If this IE is sent, the contents of this IE indicate the "abbreviated name of the
network" that the network wishes the mobile station to associate with the MCC and MNC contained in the Location
Area Identification of the cell to which the mobile station sent its Channel Request message.
9.2.15a.3 Local time zone

This IE may be sent by the network. The mobile station should assume that this time zone applies to the Location Area
of the cell to which the Channel Request message was sent.
If the local time zone has been adjusted for Daylight Saving Time, the network shall indicate this by including the IE
Network Daylight Saving Time.
9.2.15a.4 Universal time and local time zone

This IE may be sent by the network. The mobile station should assume that this time zone applies to the Location Area
of the cell to which the Channel Request message was sent. The mobile station shall not assume that the time
information is accurate.
ETSI
Release 18 396 3GPP TS 24.008 V18.4.0 (2023-09)
9.2.15a.5 LSA Identity

This IE may be sent by the network. The contents of this IE indicate the LSA identity of the serving cell.
9.2.15a.6 Network Daylight Saving Time

This IE may be sent by the network. If this IE is sent, the contents of this IE indicates the value that has been used to
adjust the local time zone.
9.2.16 MM Status
This message is sent by the mobile station or the network at any time to report certain error conditions listed in clause 8.
See table 9.2.19/3GPP TS 24.008.
Message type: MM STATUS
Significance: local
Direction: both
Table 9.2.19/3GPP TS 24.008: MM STATUS message content

10.3.1
MM Status message Message type M V 1
type 10.4
10.5.3.6
9.2.17 TMSI reallocation command

This message is sent by the network to the mobile station to reallocate or delete a TMSI. See table 9.2.20/3GPP TS
24.008.
Message type: TMSI REALLOCATION COMMAND
Significance: dual
Table 9.2.20/3GPP TS 24.008: TMSI REALLOCATION COMMAND message content

10.3.1
TMSI Reallocation Message type M V 1
Command message type 10.4
10.5.1.3
10.5.1.4
ETSI
Release 18 397 3GPP TS 24.008 V18.4.0 (2023-09)
9.2.18 TMSI reallocation complete

This message is sent by the mobile station to the network to indicate that reallocation or deletion of a TMSI has taken
place. See table 9.2.21/3GPP TS 24.008.
Message type: TMSI REALLOCATION COMPLETE
Significance: dual
Table 9.2.21/3GPP TS 24.008: TMSI REALLOCATION COMPLETE message content

10.3.1
TMSI Reallocation Message type M V 1
Complete message type 10.4
9.2.19 MM Null
This message is sent in mobile to network direction.
This message is not used on the radio interface. When received by the network it shall be ignored.
The introduction of this message solves interworking issues.
Message type: MM NULL
Table 9.2.22/3GPP TS 24.008 MM NULL message content

10.3.1
MM Null message Message type M V 1
type 10.4
ETSI
Release 18 398 3GPP TS 24.008 V18.4.0 (2023-09)
9.3 Messages for circuit-switched call control

Table 9.54/3GPP TS 24.008 summarizes the messages for circuit-switched call control.
Table 9.54/3GPP TS 24.008: Messages for circuit-mode connections call control.
Call establishment messages: Reference

ALERTING 9.3.1
CALL CONFIRMED (NOTE) 9.3.2
CALL PROCEEDING 9.3.3
CONNECT 9.3.5
CONNECT ACKNOWLEDGE 9.3.6
EMERGENCY SETUP (NOTE) 9.3.8
PROGRESS 9.3.17
CC-ESTABLISHMENT 9.3.17a
CC-ESTABLISHMENT CONFIRMED 9.3.17b
START CC 9.3.23a
SETUP 9.3.23
Call information phase messages: Reference
MODIFY (NOTE) 9.3.13
MODIFY COMPLETE (NOTE) 9.3.14
MODIFY REJECT (NOTE) 9.3.15
USER INFORMATION 9.3.31
Call clearing messages: Reference
DISCONNECT 9.3.7
RELEASE 9.3.18
RELEASE COMPLETE 9.3.19
Messages for supplementary service control Reference
FACILITY 9.3.9
HOLD (NOTE) 9.3.10
HOLD ACKNOWLEDGE (NOTE) 9.3.11
HOLD REJECT (NOTE) 9.3.12
RETRIEVE (NOTE) 9.3.20
RETRIEVE ACKNOWLEDGE (NOTE) 9.3.21
RETRIEVE REJECT (NOTE) 9.3.22
Miscellaneous messages Reference
CONGESTION CONTROL 9.3.4
NOTIFY 9.3.16
START DTMF (NOTE) 9.3.24
START DTMF ACKNOWLEDGE (NOTE) 9.3.25
START DTMF REJECT (NOTE) 9.3.26
STATUS 9.3.27
STATUS ENQUIRY 9.3.28
STOP DTMF (NOTE) 9.3.29
STOP DTMF ACKNOWLEDGE (NOTE) 9.3.30
NOTE: Not supported by Blue Book ITU-T Recommendation Q.931 [53].
9.3.1 Alerting
9.3.1.1 Alerting (network to mobile station direction)

This message is sent by the network to the calling mobile station to indicate that the called user alerting has been
initiated.
See table 9.55/3GPP TS 24.008.
Message type: ALERTING
Significance: global
ETSI
Release 18 399 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.55/3GPP TS 24.008: ALERTING message content (network to mobile station direction)

Call control Protocol discriminator M V 1/2
Transaction identifier Transaction identifier M V 1/2
10.3.2
Alerting Message type M V 1
message type 10.4
1C Facility Facility O TLV 2-?
10.5.4.15
1E Progress indicator Progress indicator O TLV 4
10.5.4.21
7E User-user User-user O TLV 3-131
10.5.4.25
9.3.1.1.1 Facility
This information element may be used for functional operation of supplementary services.
9.3.1.1.2 Progress indicator

This information element may be included by the network:
- in order to pass information about the call in progress, e.g., in the event of interworking;
- to make the mobile station attach the user connection for speech; and/or
- to make a mobile station supporting multimedia CAT during the alerting phase of a mobile originated
multimedia call establishment attach the user connection and setup an H.324 call.
9.3.1.1.3 User-user
This information element may be included by the network if the called remote user included a user-user information
element in the ALERTING message.
9.3.1.2 Alerting (mobile station to network direction)

This message is sent by the called mobile station to the network, to indicate that the called user alerting has been
initiated.
See table 9.55a/3GPP TS 24.008.
Message type: ALERTING
ETSI
Release 18 400 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.55a/3GPP TS 24.008: ALERTING message content (mobile station to network direction)

10.3.2
Alerting Message type M V 1
message type 10.4
10.5.4.15
10.5.4.25
7F SS version SS version indicator O TLV 2-3
10.5.4.24
9.3.1.2.1 Facility
9.3.1.2.2 User-user
This information element may be included when the called mobile station wants to return information to the calling
remote user.
9.3.1.2.3 SS version
This information element shall not be included if the facility information element is not present in this message.
This information element shall be included or excluded as defined in 3GPP TS 24.010 [21]. This information element
should not be transmitted unless explicitly required by 3GPP TS 24.010 [21].
9.3.2 Call confirmed

This message is sent by the called mobile station to confirm an incoming call request.
Message type: CALL CONFIRMED
Significance: local
ETSI
Release 18 401 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.56/3GPP TS 24.008: CALL CONFIRMED message content

10.3.2
Call confirmed Message type M V 1
message type 10.4
D- Repeat Indicator Repeat Indicator C TV 1
10.5.4.22
04 Bearer capability 1 Bearer capability O TLV 3-16
10.5.4.5
10.5.4.5
08 Cause Cause O TLV 4-32
10.5.4.11
15 CC Capabilities Call Control Capabilities O TLV 4
10.5.4.5a
2D Stream Identifier Stream Identifier O TLV 3
10.5.4.28
40 Supported Codecs Supported Codec List O TLV 5-n
10.5.4.32
9.3.2.1 Repeat indicator

The repeat indicator information element shall be included if bearer capability 1 information element and bearer
capability 2 IE are both included in the message.
9.3.2.2 Bearer capability 1 and bearer capability 2

The bearer capability 1 information element shall be included if and only if at least one of the following six cases
holds:
- the mobile station wishes another bearer capability than that given by the bearer capability 1 information
element of the incoming SETUP message;
- the bearer capability 1 information element is missing or not fully specified in the SETUP message;
- the bearer capability 1 information element received in the SETUP message is accepted and the "radio channel
requirement" of the mobile station is other than "full rate support only mobile station";
- the bearer capability 1 information element received in the SETUP message indicates speech and is accepted
and the mobile station supports CTM text telephony;
- the bearer capability 1 information element received in the SETUP message indicates speech and is accepted
and the mobile station supports other codecs for GERAN than GSM speech version 1;
- the bearer capability 1 information element received in the SETUP message included the "fixed network user
rate" parameter.
When the bearer capability 1 information element is followed by the bearer capability 2 IE in the SETUP, the above
rules apply to both bearer capability 1 IE and bearer capability 2 IE. Except those cases identified in 3GPP TS
27.001 [36], if either bearer capability needs to be included, both shall be included.
Furthermore, both bearer capability information elements may be present if the mobile station wishes to reverse the
order of occurrence of the bearer capability information elements (which is referred to in the repeat indicator
information element, see subclause 10.5.4.22) in cases identified in 3GPP TS 27.001 [36].
If the mobile station wishes to indicate capability for an alternative call mode, which can be entered during the call
through in-call modification, this is indicated by adding a bearer capability information element (bearer capability 2
information element, see subclause 5.3.6).
ETSI
Release 18 402 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.2.3 Cause
This information element is included if the mobile station is compatible but the user is busy.
9.3.2.4 CC Capabilities
This information element may be included by the mobile station to indicate its call control capabilities.
9.3.2.5 Stream Identifier

This information element shall be included by the mobile station supporting multicall.
9.3.2.6 Supported Codecs

This information element shall be included for speech calls, if the mobile station supports UMTS radio access.
9.3.3 Call proceeding

This message is sent by the network to the calling mobile station to indicate that the requested call establishment
information has been received, and no more call establishment information will be accepted.
Message type: CALL PROCEEDING
Significance: local
Table 9.57/3GPP TS 24.008: CALL PROCEEDING message content

10.3.2
Call proceeding Message type M V 1
message type 10.4
10.5.4.22
10.5.4.5
10.5.4.5
10.5.4.15
10.5.4.21
8- Priority granted Priority Level O TV 1
10.5.1.11
2F Network Call Control Network Call Control cap. O TLV 3
Capabilities 10.5.4.29

This information element is included if and only if bearer capability 1 IE and bearer capability 2 IE are both contained
in the message.
ETSI
Release 18 403 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.3.2 Bearer capability 1 and bearer capability 2

The bearer capability 1 information element shall be included if the network has to specify at least one of the
negotiable parameters described in 3GPP TS 27.001 [36], or if the bearer capability 1 information element received in
the SETUP message included the "fixed network user rate" parameter.
When the bearer capability 1 information element is followed by the bearer capability 2 IE in the SETUP, the above
rule applies to both bearer capability 1 IE and bearer capability 2 IE. Except those cases identified in
3GPP TS 27.001 [36], if either bearer capability needs to be included, both shall be included.
9.3.3.3 Facility
9.3.3.4 Progress Indicator

This information element may be included:
- in order to pass information about the call in progress e.g. in the event of interworking; and/or
- to make the MS attach the user connection for speech.
9.3.3.5 Priority granted

The priority field is provided by the network in the case that eMLPP is supported.
9.3.3.6 Network Call Control Capabilities

This information shall be included by the network to indicate its call control capabilities if the network supports
multicall.and there are no other ongoing calls to the MS.
9.3.4 Congestion control

This message is sent by the network to indicate the establishment or termination of flow control on the transmission of
USER INFORMATION messages.
Message type: CONGESTION CONTROL
Significance: local (note)
Table 9.58/3GPP TS 24.008: CONGESTION CONTROL message content

10.3.2
Congestion control Message type M V 1
message type 10.4
Congestion level Congestion level M V 1/2
10.5.4.12
10.5.1.8
10.5.4.11
NOTE: This message has local significance, but may carry information of global significance.
ETSI
Release 18 404 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.4.1 Cause
This information element is included if the user to user information has been discarded as a result of the congestion
situation.
9.3.5 Connect
9.3.5.1 Connect (network to mobile station direction)

This message is sent by the network to the calling mobile station to indicate call acceptance by the called user.
Message type: CONNECT
Table 9.59/3GPP TS 24.008: CONNECT message content(network to mobile station direction)

10.3.2
Connect Message type M V 1
message type 10.4
10.5.4.15
10.5.4.21
4C Connected number Connected number O TLV 3-14
10.5.4.13
4D Connected subaddress Connected subaddress O TLV 2-23
10.5.4.14
10.5.4.25
9.3.5.1.1 Facility

- in order to pass information about the call in progress e.g. in the event of interworking; and/or
9.3.5.1.3 User-user
This information element may be included by the network if the remote user awarded the call included a user- user
information element in the CONNECT message.
9.3.5.2 Connect (mobile station to network direction)

This message is sent by the called mobile station to the network to indicate call acceptance by the called user.
ETSI
Release 18 405 3GPP TS 24.008 V18.4.0 (2023-09)
Message type: CONNECT
Table 9.59a/3GPP TS 24.008: CONNECT message content (mobile station to network direction)

10.3.2
Connect Message type M V 1
message type 10.4
10.5.4.15
4D Connected subaddress Connected subaddress O TLV 2-23
10.5.4.14
10.5.4.25
10.5.4.24
10.5.4.28
9.3.5.2.1 Facility
9.3.5.2.2 User-user
This information element is included when the answering mobile station wants to return user information to the calling
remote user.
9.3.5.2.4 Stream Identifier

This information element shall be included by a mobile station that supports multicall when a mobile station has
indicated "No Bearer" as the SI value in the CALL CONFIRMED message.
9.3.6 Connect acknowledge

This message is sent by the network to the called mobile station to indicate that the mobile station has been awarded the
call. It shall also be sent by the calling mobile station to the network to acknowledge the offered connection.
Message type: CONNECT ACKNOWLEDGE
Significance: local
Direction: both
ETSI
Release 18 406 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.60/3GPP TS 24.008: CONNECT ACKNOWLEDGE message content

10.3.2
Connect acknowledge Message type M V 1
message type 10.4
9.3.7 Disconnect
9.3.7.1 Disconnect (network to mobile station direction)

This message is sent by the network to indicate that the end-to-end connection is cleared.
Message type: DISCONNECT
Table 9.61/3GPP TS 24.008: DISCONNECT message content (network to mobile station direction)

10.3.2
Disconnect Message type M V 1
message type 10.4
Cause Cause M LV 3-31
10.5.4.11
10.5.4.15
10.5.4.21
10.5.4.25
7B Allowed actions $(CCBS)$ Allowed actions O TLV 3
10.5.4.27
9.3.7.1.1 Facility
This information element may be used for functional operation of supplementary services, such as the user-user service.

This information element is included by the network to make the MS attach the user connection for speech and react in
a specific way during call clearing (see subclause 5.4.4).
9.3.7.1.3 User-user
This information element may be included by the network when the remote user initiates call clearing and included a
user-user information element in the DISCONNECT message.
9.3.7.1.4 Allowed actions $(CCBS)$

This information element may be included by the network to inform the MS about further possible reactions.
ETSI
Release 18 407 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.7.2 Disconnect (mobile station to network direction)

This message is sent by the mobile station to request the network to clear an end-to-end connection.
Message type: DISCONNECT
Table 9.61a/3GPP TS 24.008: DISCONNECT message content (mobile station to network direction)

10.3.2
Disconnect Message type M V 1
message type 10.4
10.5.4.11
10.5.4.15
10.5.4.25
10.5.4.24
9.3.7.2.1 Facility
This information element may be used for functional operation of supplementary services, such as the user-user service.
9.3.7.2.2 User-user
This information element is included when the mobile station initiates call clearing and wants to pass user information
to the remote user at call clearing time.
9.3.8 Emergency setup

This message is sent from the mobile station to initiate emergency call establishment.
Message type: EMERGENCY SETUP
ETSI
Release 18 408 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.62/3GPP TS 24.008: EMERGENCY SETUP message content

10.3.2
Emergency setup Message type M V 1
message type 10.4
04 Bearer capability Bearer capability O TLV 3-11
10.5.4.5
10.5.4.28
10.5.4.32
2E Emergency category Service category O TLV 3
10.5.4.33
9.3.8.1 Bearer capability

If the element is not included, the network shall by default assume speech and select the speech codec according to
subclauses 5.2.1.2 and 5.2.1.11. If this information element is included, it shall indicate speech, the appropriate speech
version(s) and have the appropriate value of radio channel requirement field.
This information element shall be included by an ME supporting CTM text telephony or supporting at least one speech
version for GERAN other than GSM FR speech version 1.


This information element shall be included if the mobile station supports UMTS radio access.
9.3.8.4 Emergency category

This information element shall be included if the emergency category is available from the SIM/USIM or the mobile
station.
If this information element is included, it shall indicate the selected emergency call category.
If the element is not included, the network shall by default assume a non-specific emergency call.
9.3.9 Facility
9.3.9.1 Facility (network to mobile station direction)

This message is sent by the network to the mobile station to request or acknowledge a supplementary service. The
supplementary service to be invoked and its associated parameters are specified in the facility information element.
ETSI
Release 18 409 3GPP TS 24.008 V18.4.0 (2023-09)
Message type: FACILITY
Significance: local (NOTE 1)
Table 9.62a/3GPP TS 24.008: FACILITY message content (network to mobile station direction)

10.3.2
Facility Message type M V 1
message type 10.4
Facility (note 2) Facility M LV 1-?
10.5.4.15
NOTE 1: This message has local significance; however, it may carry information of global significance.
NOTE 2: The facility information element has no upper length limit except that given by the maximum number of
octets in a L3 message, see 3GPP TS 44.006 [19].
9.3.9.2 Facility (mobile station to network direction)

This message is sent by the mobile station to the network to request or acknowledge a supplementary service. The
supplementary service to be invoked and its associated parameters are specified in the facility information element.
See table 9.62b/3GPP TS 24.008.
Message type: FACILITY
Significance: local (note 1)
Table 9.62b/3GPP TS 24.008: FACILITY message content (mobile station to network direction)

10.3.2
Facility Message type M V 1
message type 10.4
Facility (note 2) Facility M LV 1-?
10.5.4.15
10.5.4.24
NOTE 1: This message has local significance; however, it may carry information of global significance.
NOTE 2: The facility information element has no upper length limit except that given by the maximum number of
octets in a L3 message, see 3GPP TS 44.006 [19].
ETSI
Release 18 410 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.10 Hold
This message is sent by the mobile user to request the hold function for an existing call.
See table 9.62c/3GPP TS 24.008 for the content of the HOLD message.
For the use of this message, see 3GPP TS 24.010 [21].
Message type: HOLD
Significance: local
Table 9.62c/3GPP TS 24.008: HOLD message content

10.3.2
Hold Message type M V 1
message type 10.4
9.3.11 Hold Acknowledge

This message is sent by the network to indicate that the hold function has been successfully performed.
See table 9.62d/3GPP TS 24.008 for the content of the HOLD ACKNOWLEDGE message.
Message type: HOLD ACKNOWLEDGE
Significance: local
Table 9.62d/3GPP TS 24.008: HOLD ACKNOWLEDGE message content

10.3.2
Hold Acknowledge Message type M V 1
message type 10.4
9.3.12 Hold Reject

This message is sent by the network to indicate the denial of a request to hold a call.
See table 9.62e/3GPP TS 24.008 for the content of the HOLD REJECT message.
Message type: HOLD REJECT
Significance: local
ETSI
Release 18 411 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.62e/3GPP TS 24.008: HOLD REJECT message content

10.3.2
Hold Reject Message type M V 1
message type 10.4
Cause 10.5.4.11 M LV 3-31
9.3.13 Modify
This message is sent by the mobile station to the network or by the network to the mobile station to request a change in
bearer capability for a call.
Message type: MODIFY
Direction: both
Table 9.63/3GPP TS 24.008: MODIFY message content

10.3.2
Modify Message type M V 1
message type 10.4
Bearer capability Bearer capability M LV 2-15
10.5.4.5
7C Low layer comp. Low layer comp. O TLV 2-18
10.5.4.18
7D High layer comp. High layer comp. O TLV 2-5
10.5.4.16
A3 Reverse call setup Reverse call setup O T 1
direction direction
10.5.4.22a
A4 Network-initiated Service Network-initiated Service O T 1
Upgrade indicator Upgrade indicator
10.5.4.3x
9.3.13.1 Low layer compatibility

This information element shall be included if it was included in the initial SETUP message.
9.3.13.2 High layer compatibility

9.3.13.3 Reverse call setup direction

This information element is included or omitted in the mobile to network direction according to the rules defined in
ETSI
Release 18 412 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.13.4 Void
9.3.13.5 Network-initiated Service Upgrade indicator

This information element shall be included only if the MODIFY message was sent by the network to switch from
speech to UDI/RDI multimedia due to a network-initiated service upgrade.
9.3.14 Modify complete

This message is sent by the mobile station to the network or by the network to the mobile station to indicate completion
of a request to change bearer capability for a call.
Message type: MODIFY COMPLETE
Direction: both
Table 9.64/3GPP TS 24.008: MODIFY COMPLETE message content

10.3.2
Modify complete Message type M V 1
message type 10.4
10.5.4.5
10.5.4.18
10.5.4.16
A3 Reverse call setup Reverse call setup O T 1
direction direction
10.5.4.22a


9.3.14.3 Reverse call setup direction

This information element is included or omitted according to the rules defined in subclause 5.3.4.3.2.
9.3.15 Modify reject

This message is sent by the mobile station to the network or by the network to the mobile station to indicate failure of a
request to change the bearer capability for a call.
Message type: MODIFY REJECT
ETSI
Release 18 413 3GPP TS 24.008 V18.4.0 (2023-09)
Direction: both
Table 9.65/3GPP TS 24.008: MODIFY REJECT message content

10.3.2
Modify reject Message type M V 1
message type 10.4
10.5.4.5
10.5.4.11
10.5.4.18
10.5.4.16


9.3.16 Notify
This message is sent either from the mobile station or from the network to indicate information pertaining to a call, such
as user suspended.
Message type: NOTIFY
Significance: access
Direction: both
Table 9.66/3GPP TS 24.008: NOTIFY message content

10.3.2
Notify Message type M V 1
message type 10.4
Notification indicator Notification indicator M V 1
10.5.4.20
9.3.17 Progress
This message is sent from the network to the mobile station to indicate the progress of a call in the event of
interworking or in connection with the provision of in-band information/patterns.
ETSI
Release 18 414 3GPP TS 24.008 V18.4.0 (2023-09)
Message type: PROGRESS
Table 9.67/3GPP TS 24.008: PROGRESS message content

10.3.2
Progress Message type M V 1
message type 10.4
Progress indicator Progress indicator M LV 3
10.5.4.21
10.5.4.25
9.3.17.1 User-user
This information element is included when the PROGRESS message is sent by the network when the call has been
cleared by the remote user before it reached the active state to indicate that the remote user wants to pass user
information at call clearing time.
9.3.17.2 Progress indicator

- in order to pass information about the call in progress, e.g., in the event of interworking;
- to make the mobile station attach the user connection for speech; and/or
- to make a mobile station supporting multimedia CAT during the alerting phase of a mobile originated
multimedia call establishment attach the user connection and setup an H.324 call.
9.3.17a CC-Establishment $(CCBS)$

This message is sent from the network to the mobile station to provide information on the call that the mobile station
should attempt to establish.
See Table 9.67a/3GPP TS 24.008.
Message type: CC-ESTABLISHMENT
Significance: local
ETSI
Release 18 415 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.67a/3GPP TS 24.008: CC-Establishment message content

10.3.2
CC-Establishment Message type M V 1
message type 10.4
Setup container Container M LV 3-n
10.5.4.22b
9.3.17a.1 Void
9.3.17a.2 Setup container

This information element contains the contents of a SETUP message (Mobile Station to Network).
9.3.17b CC-Establishment confirmed $(CCBS)$

A Network that does not support the "Network initiated MO call" option shall treat this message as a message with
This message is sent by the mobile station to the network to indicate the requested channel characteristics for the call
which may be initiated by the mobile station.
See Table 9.67b/3GPP TS 24.008.
Message type: CC-ESTABLISHMENT CONFIRMED
Significance: local
Table 9.67b/3GPP TS 24.008: CC-ESTABLISHMENT CONFIRMED message content

10.3.2
CC-Establishment
confirmed Message type M V 1
message type 10.4
10.5.4.22
04 Bearer capability 1 Bearer capability M TLV 3-16
10.5.4.5
10.5.4.5
10.5.4.11
10.5.4.32
9.3.17b.1 Repeat indicator

The repeat indicator information element shall be included if bearer capability 1 information element and bearer
capability 2 IE are both included in the message.
ETSI
Release 18 416 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.17b.2 Bearer capability 1 and bearer capability 2

If, in any subsequent SETUP message to be sent on this transaction the bearer capability 1 information element is to be
followed by the bearer capability 2 IE, then the bearer capability 2 IE shall be included in this message.
9.3.17b.3 Cause
This information element is included if the mobile station is compatible but the user is busy.
9.3.17b.4 Supported Codecs

9.3.18 Release
9.3.18.1 Release (network to mobile station direction)

This message is sent, from the network to the mobile station to indicate that the network intends to release the
transaction identifier, and that the receiving equipment shall release the transaction identifier after sending RELEASE
COMPLETE.
Message type: RELEASE
Table 9.68/3GPP TS 24.008: RELEASE message content (network to mobile station direction)

10.3.2
Release Message type M V 1
message type 10.4
10.5.4.11
08 Second cause Cause O TLV 4-32
10.5.4.11
10.5.4.15
10.5.4.25
NOTE: This message has local significance; however, it may carry information of global significance when used
as the first call clearing message.
9.3.18.1.1 Cause
This information element shall be included if this message is used to initiate call clearing.
9.3.18.1.2 Second cause

This information element may be included under the conditions described in subclause 5.4.4.1.2.3 "Abnormal cases"
(Clearing initiated by the network).
9.3.18.1.3 Facility
This information element may be included for functional operation of supplementary services.
ETSI
Release 18 417 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.18.1.4 User-user
This information element may be included in the network to mobile station direction, when the RELEASE message is
used to initiate call clearing, in order to transport user-user information from the remote user.
9.3.18.2 Release (mobile station to network direction)

This message is sent from the mobile station to the network to indicate that the mobile station intends to release the
transaction identifier, and that the receiving equipment shall release the transaction identifier after sending RELEASE
COMPLETE.
Message type: RELEASE
Direction: mobile station to network direction
Table 9.68a/3GPP TS 24.008: RELEASE message content (mobile station to network direction)

10.3.2
Release Message type M V 1
message type 10.4
10.5.4.11
08 Second cause Cause O TLV 4-32
10.5.4.11
10.5.4.15
10.5.4.25
10.5.4.24
9.3.18.2.1 Cause
This information element shall be included if this message is used to initiate call clearing.
9.3.18.2.2 Second cause

This information element may be included under the conditions described in subclause 5.4.3.5 "Abnormal cases"
(Clearing initiated by the mobile station).
9.3.18.2.3 Facility
This information element is included when the RELEASE message is used to initiate call clearing and the mobile
station wants to pass user information to the remote user at call clearing time.
ETSI
Release 18 418 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.18a Recall $(CCBS)$

This message is sent from the network to the mobile station to initiate the sending of the SETUP message. In addition it
provides information for user notification.
Message type: RECALL
Significance: local
Table 9.68b/3GPP TS 24.008: Recall message content

10.3.2
Recall Message type M V 1
message type 10.4
Recall Type Recall Type M V 1
10.5.4.21a
Facility Facility M LV 2-n
10.5.4.15
9.3.18a.1 Recall Type

The purpose of the recall type information element is to describe the reason for the recall.
9.3.18a.2 Facility
The information element shall be included for functional operation of supplementary services.
9.3.19 Release complete
9.3.19.1 Release complete (network to mobile station direction)

This message is sent from the network to the mobile station to indicate that the network has released the transaction
identifier and that the mobile station shall release the transaction identifier.
Message type: RELEASE COMPLETE
Direction: network to mobile station direction
ETSI
Release 18 419 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.69/3GPP TS 24.008: RELEASE COMPLETE message content (network to mobile station
direction)

10.3.2
Release complete Message type M V 1
message type 10.4
10.5.4.11
10.5.4.15
10.5.4.25
9.3.19.1.1 Cause
This information element shall be included if the message is used to initiate call clearing.
9.3.19.1.2 Facility
This information element is included in the network to mobile station direction, when the RELEASE COMPLETE
message is used to initiate call clearing, in order to transport user-user information from the remote user.
9.3.19.2 Release complete (mobile station to network direction)

This message is sent from the mobile station to the network to indicate that the mobile station has released the
transaction identifier and that the network shall release the transaction identifier.
Message type: RELEASE COMPLETE
Direction: mobile station to network direction
ETSI
Release 18 420 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.69a/3GPP TS 24.008: RELEASE COMPLETE message content (mobile station to network
direction)

10.3.2
Release complete Message type M V 1
message type 10.4
10.5.4.11
10.5.4.15
10.5.4.25
10.5.4.24
9.3.19.2.1 Cause
This information element shall be included if the message is used to initiate call clearing.
9.3.19.2.2 Facility
This information element is included in the mobile station to network direction when the RELEASE COMPLETE
message is used to initiate call clearing and the mobile station wants to pass user information to the remote user at call
clearing time.
9.3.19.2.4 SS version.
9.3.20 Retrieve
This message is sent by the mobile user to request the retrieval of a held call.
See table 9.69b/3GPP TS 24.008 for the content of the RETRIEVE message.
ETSI
Release 18 421 3GPP TS 24.008 V18.4.0 (2023-09)
Message type: RETRIEVE
Significance: local
Table 9.69b/3GPP TS 24.008: RETRIEVE message content

10.3.2
Retrieve Message type M V 1
message type 10.4
9.3.21 Retrieve Acknowledge

This message is sent by the network to indicate that the retrieve function has been successfully performed.
See table 9.69c/3GPP TS 24.008 for the content of the RETRIEVE ACKNOWLEDGE message.
Message type: RETRIEVE ACKNOWLEDGE
Significance: local
Table 9.69c/3GPP TS 24.008: RETRIEVE ACKNOWLEDGE message content

10.3.2
Retrieve Acknowledge Message type M V 1
message type 10.4
9.3.22 Retrieve Reject

This message is sent by the network to indicate the inability to perform the requested retrieve function.
See table 9.69d/3GPP TS 24.008 for the content of the RETRIEVE REJECT message.
Message type: RETRIEVE REJECT
Significance: local
ETSI
Release 18 422 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.69d/3GPP TS 24.008: RETRIEVE REJECT message content

10.3.2
Retrieve Reject Message type M V 1
Message type 10.4
Cause 10.5.4.11 M LV 3-31
9.3.23 Setup
9.3.23.1 Setup (mobile terminated call establishment)

This message is sent by the network to the mobile station to initiate a mobile terminated call establishment.
Message type: SETUP
ETSI
Release 18 423 3GPP TS 24.008 V18.4.0 (2023-09)
ETSI
Release 18 424 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.70/3GPP TS 24.008: SETUP message content (network to mobile station direction)

10.3.2
Setup Message type M V 1
Message type 10.4
D- BC repeat indicator Repeat indicator C TV 1
10.5.4.22
10.5.4.5
10.5.4.5
10.5.4.15
10.5.4.21
34 Signal Signal O TV 2
10.5.4.23
5C Calling party BCD Calling party BCD num. O TLV 3-14
Number 10.5.4.9
5D Calling party sub- Calling party subaddr. O TLV 2-23
Address 10.5.4.10
5E Called party BCD Called party BCD num. O TLV 3-19
Number 10.5.4.7
6D Called party sub- Called party subaddr. O TLV 2-23
Address 10.5.4.8
74 Redirecting party BCD number Redirecting party BCD num. O TLV 3-19
10.5.4.21b
75 Redirecting party sub-address Redirecting party subaddress. O TLV 2-23
10.5.4.21c
D- LLC repeat indicator Repeat indicator O TV 1
10.5.4.22
7C Low layer Low layer comp. O TLV 2-18
Compatibility I 10.5.4.18
7C Low layer Low layer comp. C TLV 2-18
Compatibility II 10.5.4.18
D- HLC repeat indicator Repeat indicator O TV 1
10.5.4.22
7D High layer High layer comp. O TLV 2-5
Compatibility i 10.5.4.16
7D High layer High layer comp. C TLV 2-5
Compatibility ii 10.5.4.16
10.5.4.25
8- Priority Priority Level O TV 1
10.5.1.11
19 Alert Alerting Pattern O TLV 3
10.5.4.26
2F Network Call Control Network Call Control cap. O TLV 3
Capabilities 10.5.4.29
3A Cause of No CLI Cause of No CLI O TLV 3
10.5.4.30
41 Backup bearer capability Backup bearer capability O TLV 3-15
10.5.4.4a
ETSI
Release 18 425 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.23.1.1 BC repeat indicator

The BC repeat indicator information element is included if and only if bearer capability 1 information element and
bearer capability 2 IE are both present in the message.
9.3.23.1.2 Bearer capability 1 and bearer capability 2

The bearer capability 1 information element may be omitted in the case where the mobile subscriber is allocated only
one directory number for all services (ref.: 3GPP TS 29.007 [38]). The bearer capability 2 IE is missing at least if the
bearer capability 1 IE is missing.
If the MSC wishes to indicate capability for an altenative call mode, which can be entered through fallback, this is
indicated by adding a bearer capability information element (bearer capability) 2 element (see subclause 5.3.6).
9.3.23.1.3 Facility

This information element is included by the network
- in order to pass information about the call in progress e.g. in the event of interworking and/or
9.3.23.1.4a Called party BCD number

For all bands except for PCS1900, the maximum length of this IE sent by the network shall be 13 octets
9.3.23.1.5 Called party subaddress

Included in the Network-to-mobile station direction if the calling user includes a called party subaddress information
element in the SETUP message.
9.3.23.1.6 LLC repeat indicator

The LLC repeat indicator information element is included if and only if both following conditions hold:
- The BC repeat indicator IE is contained in the message.
- The low layer compatibility I IE is contained in the message.
If included, the LLC repeat indicator shall specify the same repeat indication as the BC repeat indicator IE.
9.3.23.1.7 Low layer compatibility I

Included in the network-to-mobile station direction if the calling user specified a low layer compatibility.
9.3.23.1.8 Low layer compatibility II

Included if and only if the LLC repeat indicator information element is contained in the message.
9.3.23.1.9 HLC repeat indicator

The HLC repeat indicator information element is included if and only both following conditions hold:
- The high layer compatibility i IE is contained in the message.
If included, the HLC repeat indicator shall specify the same repeat indication as the BC repeat indicator IE.
ETSI
Release 18 426 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.23.1.10 High layer compatibility i

Included in the network-to-mobile station direction if the calling user specified a high layer compatibility.
9.3.23.1.11 High layer compatibility ii

Included if and only if the HLC repeat indicator information element is contained in the message.
9.3.23.1.12 User-user
May be included in the network to called mobile station direction when the calling remote user included a user-user
information element in the SETUP message.
9.3.23.1.13 Redirecting party BCD number

May be included in the network to called mobile station direction when the call has been redirected.
9.3.23.1.14 Redirecting party subaddress

May be included in the network to called mobile station direction when the calling remote user included a called party
subaddress in the SETUP message and the call has been redirected
9.3.23.1.15 Priority
May be included by the network to indicate the priority of the incoming call if eMLPP is used.
9.3.23.1.16 Alert $(Network Indication of Alerting in the MS)$

May be included by the network to give some indication about alerting (category or level). If supported in the MS, this
optional indication is to be used by the MS as specified in 3GPP TS 22.101 [8].
9.3.23.1.17 Network Call Control Capabilities

This information shall be included by the network to indicate its call control capabilities if the network supports
multicall.and there are no other ongoing calls to the MS.
9.3.23.1.18 Cause of No CLI

This IE may be included by the network as defined by 3GPP TS 24.081 [25].
When both Calling Party BCD number IE and Cause of No CLI IE are included in SETUP message then the Cause of
No CLI IE provides additional information on why the number digits are not present.
9.3.23.1.19 Backup bearer capability

The backup bearer capability IE may be included by the network only if there are no bearer capability IEs contained in
the message.
NOTE: The MSC may use the backup bearer capability IE if it is not able to provide a complete bearer
capability IE.
9.3.23.2 Setup (mobile originating call establishment)

This message is sent from the mobile station to the network to initiate a mobile originating call establishment.
Message type: SETUP
ETSI
Release 18 427 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.70a/3GPP TS 24.008: SETUP message content (mobile station to network direction)

10.3.2
Setup Message type M V 1
message type 10.4
D- BC repeat indicator Repeat indicator C TV 1
10.5.4.22
04 Bearer capability 1 Bearer capability M TLV 3-16
10.5.4.5
10.5.4.5
1C Facility(simple recall alignment) Facility O TLV 2-
10.5.4.15
5D Calling party sub- Calling party subaddr. O TLV 2-23
address 10.5.4.10
5E Called party BCD Called party BCD num. M TLV 3-43
number 10.5.4.7
6D Called party sub- Called party subaddr. O TLV 2-23
address 10.5.4.8
D- LLC repeat indicator Repeat indicator O TV 1
10.5.4.22
compatibility I 10.5.4.18
compatibility II 10.5.4.18
D- HLC repeat indicator Repeat indicator O TV 1
10.5.4.22
compatibility i 10.5.4.16
compatibility ii 10.5.4.16
10.5.4.25
10.5.4.24
A1 CLIR suppression CLIR suppression C T 1
10.5.4.11a
A2 CLIR invocation CLIR invocation C T 1
10.5.4.11b
15 CC capabilities Call Control Capabilities O TLV 4
10.5.4.5a
1D Facility $(CCBS)$ Facility O TLV 2-?
(advanced recall alignment) 10.5.4.15
1B Facility (recall alignment Facility O TLV 2-?
Not essential) $(CCBS)$ 10.5.4.15
10.5.4.28
10.5.4.32
A3 Redial Redial O T 1
10.5.4.34
9.3.23.2.1 BC repeat indicator

The BC repeat indicator information element is included if and only if bearer capability 1 IE and bearer capability 2 IE
are both present in the message.
ETSI
Release 18 428 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.23.2.2 Facility
The information element may be included for functional operation of supplementary services.
Three different codings of this IE exist, for further details see 3GPP TS 24.010 [21].
9.3.23.2.3 LLC repeat indicator

The LLC repeat indicator information element is included if and only if both following conditions hold:
- The low layer compatibility I IE is contained in the message.
If included, the LLC repeat indicator shall specify the same repeat indication as the BC repeat indicator IE.
9.3.23.2.4 Low layer compatibility I

The information element is included in the MS-to-network direction when the calling MS wants to pass low layer
compatibility information to the called user.
9.3.23.2.5 Low layer compatibility II

Included if and only if the LLC repeat indicator information element is contained in the message.
9.3.23.2.6 HLC repeat indicator

The HLC repeat indicator information element is included if and only if both following conditions hold:
- The high layer compatibility i IE is contained in the message.
If included, the HLC repeat indicator shall specify the same repeat indication as the BC repeat indicator IE.
9.3.23.2.7 High layer compatibility i

The information element is included when the calling MS wants to pass high layer compatibility information to the
called user.
9.3.23.2.8 High layer compatibility ii

Included if and only if the HLC repeat indicator information element is contained in the message.
The information element is included in the calling mobile station to network direction when the calling mobile station
wants to pass user information to the called remote user.
9.3.23.2.11 CLIR suppression

The information element may be included by the MS (see 3GPP TS 24.081 [25]). If this information element is included
the CLIR invocation IE shall not be included.
ETSI
Release 18 429 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.23.2.12 CLIR invocation

The information element may be included by the MS (see 3GPP TS 24.081 [25]). If this information element is included
the CLIR suppression IE shall not be included.
9.3.23.2.13 CC Capabilities
This information element may be included by the mobile station to indicate its call control capabilities.
9.3.23.2.14 Stream Identifier

9.3.23.2.15 Bearer capability 1 and bearer capability 2

If the mobile station wishes to indicate capability for an altenative call mode, which can be entered throughfallback, this
is indicated by adding a bearer capability information element (bearer capability) 2 element (see subclause 5.3.6).
9.3.23.2.16 Supported Codecs

9.3.23.2.17 Redial
This information element shall be included if the mobile station is attempting to set up a call to switch from speech to
multimedia or vice-versa.
9.3.23a Start CC $(CCBS)$

A Network that does not support the "Network initiated MO call" option shall treat this message as a message with
This message is sent by the mobile station to the network to open a Call Control transaction which the network has
requested the mobile station to open.
Message type: START CC
Significance: local
Table 9.70b/3GPP TS 24.008: START CC message content

10.3.2
Start CC Message type M V 1
message type 10.4
15 CC Capabilities Call Control Capabilities O TLV 4
10.5.4.5a
9.3.23a.1 CC Capabilities
This information element may be included by the mobile station to indicate its call control capabilities
ETSI
Release 18 430 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.24 Start DTMF

This message is sent by the mobile station to the network and contains the digit the network should reconvert back into
a DTMF tone which is then applied towards the remote user.
Message type: START DTMF
Significance: local
Table 9.71/3GPP TS 24.008: START DTMF message content

10.3.2
Start DTMF Message type M V 1
message type 10.4
2C Keypad facility Keypad facility M TV 2
10.5.4.17
9.3.25 Start DTMF Acknowledge

This message is sent by the network to the mobile station to indicate the successful initiation of the action requested by
the START DTMF message (conversion of the digit contained in this message into a DTMF tone).
Message type: START DTMF ACKNOWLEDGE
Significance: local
Table 9.72/3GPP TS 24.008: START DTMF ACKNOWLEDGE message content

10.3.2
Start DTMF acknowledge Message type M V 1
message type 10.4
2C Keypad facility Keypad facility M TV 2
10.5.4.17
9.3.25.1 Keypad facility

This information element contains the digit corresponding to the DTMF tone that the network applies towards the
remote user.
9.3.26 Start DTMF reject

This message is sent by the network to the mobile station, if the network can not accept the START DTMF message.
Message type: START DTMF REJECT
ETSI
Release 18 431 3GPP TS 24.008 V18.4.0 (2023-09)
Significance: local
Table 9.73/3GPP TS 24.008: START DTMF REJECT message content

10.3.2
Start DTMF reject Message type M V 1
message type 10.4
10.5.4.11
9.3.27 Status
This message is sent by the mobile station or the network at any time during a call to report certain error conditions
listed in clause 8. It shall also be sent in response to a STATUS ENQUIRY message.
Message type: STATUS
Significance: local
Direction: both
Table 9.74/3GPP TS 24.008: STATUS message content

10.3.2
Status Message type M V 1
message type 10.4
10.5.4.11
Call state Call state M V 1
10.5.4.6
24 Auxiliary states Auxiliary states O TLV 3
10.5.4.4
9.3.27.1 Auxiliary states

The information element is included if and only if the call state is "active" or "mobile originating modify" and any
auxiliary state is different from "idle". For the definition of the auxiliary states see 3GPP TS 24.083 [27] and 3GPP TS
24.084 [28]
9.3.28 Status enquiry

This message is sent by the mobile station or the network at any time to solicit a STATUS message from the peer layer
3 entity. Sending of STATUS message in response to a STATUS ENQUIRY message is mandatory.
Message type: STATUS ENQUIRY
Significance: local
ETSI
Release 18 432 3GPP TS 24.008 V18.4.0 (2023-09)
Direction: both
Table 9.75/3GPP TS 24.008: STATUS ENQUIRY message content

10.3.2
Status enquiry Message type M V 1
message type 10.4
9.3.29 Stop DTMF

This message is sent by a mobile station to the network and is used to stop the DTMF tone sent towards the remote user.
Message type: STOP DTMF
Significance: local
Table 9.76/3GPP TS 24.008: STOP DTMF message content

10.3.2
Stop DTMF Message type M V 1
message type 10.4
9.3.30 Stop DTMF acknowledge

This message is sent by the network to the mobile station to indicate that the sending of the DTMF tone has been
stopped.
Message type: STOP DTMF ACKNOWLEDGE
Significance: local
Table 9.77/3GPP TS 24.008: STOP DTMF ACKNOWLEDGE message content

10.3.2
Stop DTMF acknowledge Message type M V 1
message type 10.4
ETSI
Release 18 433 3GPP TS 24.008 V18.4.0 (2023-09)
9.3.31 User information

This message is sent by the mobile station to the network to transfer information to the remote user. This message is
also sent by the network to the mobile station to deliver information transferred from the remote user. This message is
used if the user-to-user transfer is part of an allowed information transfer as defined in 3GPP TS 24.010 [21].
Message type: USER INFORMATION
Significance: access
Direction: both
Table 9.78/3GPP TS 24.008: USER INFORMATION message content

10.3.2
User Information Message type M V 1
message type 10.4
User-user User-user M LV 2-130
10.5.4.25
A0 More data More data O T 1
10.5.4.19
9.3.31.1 User-user
Some networks may only support a maximum length of 35 octets. Procedures for interworking are not currently defined
and are for further study.
R98 and earlier versions of this protocol specified a minimum length of 3 octets for this information element (not
counting the IEI). To avoid interworking problems with mobile stations supporting only R98 or earlier versions of the
protocol, the network shall deliver the User information message to these mobile stations only if the length of the User-
user IE is greater or equal to 3 octets (not counting the IEI).
9.3.31.2 More data

The information element is included by the sending user to indicate that another USER INFORMATION message
pertaining to the same message block will follow.
9.4 GPRS Mobility Management Messages

9.4.1 Attach request
This message is sent by the MS to the network in order to perform a GPRS or combined GPRS attach. See
table 9.4.1/3GPP TS 24.008.
Message type: ATTACH REQUEST
Significance: dual
Direction: MS to network
ETSI
Release 18 434 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.1/3GPP TS 24.008: ATTACH REQUEST message content
IEI Information Element Type/Reference Presence Format Length

Protocol discriminator Protocol discriminator M V 1/2
10.2
Skip indicator Skip indicator M V ½
10.3.1
Attach request message identity Message type M V 1
10.4
MS network capability MS network capability M LV 3-9
10.5.5.12
Attach type Attach type M V ½
10.5.5.2
GPRS ciphering key sequence Ciphering key sequence number M V ½
number 10.5.1.2
DRX parameter DRX parameter M V 2
10.5.5.6
10.5.1.4
Old routing area identification Routing area identification M V 6
10.5.5.15
MS Radio Access capability MS Radio Access capability M LV 6 - 51
10.5.5.12a
19 Old P-TMSI signature P-TMSI signature O TV 4
10.5.5.8
17 Requested READY timer GPRS Timer O TV 2
value 10.5.7.3
9- TMSI status TMSI status O TV 1
10.5.5.4
33 PS LCS Capability PS LCS Capability O TLV 3-4
10.5.5.22
11 Mobile station classmark 2 Mobile station classmark 2 O TLV 5
10.5.1.6
20 Mobile station classmark 3 Mobile station classmark 3 O TLV 2 - 34
10.5.1.7
10.5.4.32
58 UE network capability UE network capability O TLV 4 - 15
10.5.5.26
1A Additional mobile identity Mobile identity O TLV 7
10.5.1.4
1B Additional old routing area Routing area identification 2 O TLV 8
identification 10.5.5.15a
5D Voice domain preference and Voice domain preference and UE's O TLV 3
UE's usage setting usage setting
10.5.5.28
10.5.7.8
10.5.5.29
C- MS network feature support MS network feature support O TV 1
10.5.1.15
14 Old location area identification Location Area Identification 2 O TLV 7
10.5.5.30
F- Additional update type Additional update type O TV 1
10.5.5.0
10 TMSI based NRI container Network resource identifier container O TLV 4
10.5.5.31
6A T3324 value GPRS Timer 2 O TLV 3
10.5.7.4
39 T3312 extended value GPRS Timer 3 O TLV 3
10.5.7.4a
6E Extended DRX parameters Extended DRX parameters O TLV 3
10.5.5.32
ETSI
Release 18 435 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.1.1 Old P-TMSI signature

The MS shall include this IE, if the MS holds a valid P-TMSI, P-TMSI signature and RAI, or if the TIN indicates
"GUTI" and the MS holds a valid GUTI, or if the TIN is deleted and the MS holds a valid GUTI, but no valid P-TMSI
and RAI. If the MS is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or
3GPP TS 31.102 [112] and is attaching in a new PLMN which is neither the registered PLMN nor in the list of
equivalent PLMNs, the MS shall not include this IE.
9.4.1.2 Requested READY timer value

This IE may be included if the MS wants to indicate a preferred value for the READY timer.
9.4.1.3 TMSI status

This IE shall be included if the MS performs a combined GPRS attach and no valid TMSI is available.
9.4.1.4 PS LCS Capability

This IE shall be included if the MS supports at least one positioning method for the provision of location services (LCS)
via the PS domain in Gb-mode.
9.4.1.5 UE network capability

An MS supporting S1 mode shall include this IE to indicate its capabilities to the network.
9.4.1.6 Mobile station classmark 2

This IE shall be included if the MS supports SRVCC to GERAN or UTRAN.

This IE shall be included if the MS supports SRVCC to GERAN.

This IE shall be included if the MS supports SRVCC to GERAN or UTRAN to indicate its supported speech codecs for
CS speech calls.
9.4.1.9 Additional mobile identity

The MS shall include this IE, if the TIN indicates "GUTI" and the MS holds a valid GUTI, P-TMSI and RAI. If the MS
is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and is attaching in
a new PLMN which is neither the registered PLMN nor in the list of equivalent PLMNs, the MS shall not include this
IE.
9.4.1.10 Additional old routing area identification

The MS shall include this IE, if the TIN indicates "GUTI" and the MS holds a valid GUTI, P-TMSI and RAI.
9.4.1.11 Voice domain preference and UE's usage setting

This IE shall be included if:
- the MS supports CS fallback and SMS over SGs, or the MS is configured to support IMS voice, or both; and
- the MS supports WB-S1 mode.
ETSI
Release 18 436 3GPP TS 24.008 V18.4.0 (2023-09)

9.4.1.13 P-TMSI type

The MS shall include this IE if the type of identity in the Mobile identity IE is set to "TMSI/P-TMSI/M-TMSI".

This IE shall be included if the MS supports extended periodic timer T3312.
9.4.1.15 Old location area identification

The MS shall include this IE during a combined attach procedure, if the MS holds a valid LAI and the MS supports
EMM combined procedures.
9.4.1.16 Additional update type

The MS shall include this IE if the MS initiates a combined GPRS attach procedure for GPRS services and "SMS-only
service".
9.4.1.17 TMSI based NRI container

The MS shall include this IE during a combined attach procedure if it has a valid TMSI.
9.4.1.18 T3324 value

The MS may include this IE to request the use of PSM.
9.4.1.19 T3312 extended value

The MS may include this IE to request a particular T3312 value if the T3324 value IE is included.
9.4.1.20 Extended DRX parameters

The MS may include this IE to request the use of eDRX.
9.4.2 Attach accept

This message is sent by the network to the MS to indicate that the corresponding attach request has been accepted. See
table 9.4.2/3GPP TS 24.008.
Message type: ATTACH ACCEPT
Significance: dual
Direction: network to MS
ETSI
Release 18 437 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.2/3GPP TS 24.008: ATTACH ACCEPT message content
ETSI
Release 18 438 3GPP TS 24.008 V18.4.0 (2023-09)

10.2
Skip indicator Skip indicator M V 1/2
10.3.1
Attach accept message identity Message type M V 1
10.4
Attach result Attach result M V 1/2
10.5.5.1
Force to standby Force to standby M V 1/2
10.5.5.7
Periodic RA update timer GPRS Timer M V 1
10.5.7.3
Radio priority for SMS Radio priority M V 1/2
10.5.7.2
Radio priority for TOM8 Radio priority 2 M V 1/2
10.5.7.5
Routing area identification Routing area identification M V 6
10.5.5.15
19 P-TMSI signature P-TMSI signature O TV 4
10.5.5.8
17 Negotiated READY timer GPRS Timer O TV 2
value 10.5.7.3
18 Allocated P-TMSI Mobile identity O TLV 7
10.5.1.4
23 MS identity Mobile identity O TLV 7-10
10.5.1.4
25 GMM cause GMM cause O TV 2
10.5.5.14
10.5.7.4
8C Cell Notification Cell Notification O T 1
10.5.5.21
4A Equivalent PLMNs PLMN List O TLV 5-47
10.5.1.13
B- Network feature support Network feature support O TV 1
10.5.5.23
10.5.3.13
A- Requested MS Information Requested MS Information O TV 1
10.5.5.25
37 T3319 value GPRS Timer 2 O TLV 3
10.5.7.4
10.5.7.4
10.5.7.4a
66 Additional network feature support Additional network feature support O TLV 3
10.5.5.23A
10.5.7.4
10.5.5.32
C- User Plane integrity indicator User Plane integrity indicator O TV 1
10.5.5.34
31 Replayed MS network capability MS network capability O TLV 4-10
10.5.5.12
33 Replayed MS Radio Access MS Radio Access capability O TLV 6 - 51
capability 10.5.5.12a
65 DCN-ID DCN-ID O TLV 4
10.5.5.35
63 PLMN identity of the CN operator PLMN identity of the CN operator O TLV 5
10.5.5.36
10.5.5.37
ETSI
Release 18 439 3GPP TS 24.008 V18.4.0 (2023-09)

This IE may be included to assign an identity to the MS's GMM context.
9.4.2.2 Negotiated READY timer value

This IE may be included to indicate a value for the READY timer.
9.4.2.3 Allocated P-TMSI

This IE may be included to assign a P-TMSI to an MS in case of a GPRS or combined GPRS attach.
9.4.2.4 MS identity
This IE may be included to assign or unassign a TMSI to an MS in case of a combined GPRS attach.
9.4.2.5 GMM cause

This IE shall be included when IMSI attach for non-GPRS services was not successful during a combined GPRS attach
procedure.
9.4.2.6 T3302 value

This IE may be included to indicate a value for the T3302 timer.
9.4.2.7 Cell Notification (A/Gb mode only)

In A/Gb mode, this IE shall be included by the SGSN in order to indicate the ability to support the Cell Notification.

PLMNs.
9.4.2.9 Network feature support

This IE may be included to inform the MS of the support of certain features. If this IE is not included then the
respective features are not supported.

within the same country as the PLMN from which this IE is received.
9.4.2.11 Requested MS Information

This IE may be sent by the network to request the MS to provide feature-related information.
9.4.2.12 T3319 value

This IE may be included to indicate a value for timer T3319.
9.4.2.13 T3323 value

The network may include this IE to indicate a value for timer T3323.
ETSI
Release 18 440 3GPP TS 24.008 V18.4.0 (2023-09)
If the IE is not included, the MS shall use the default value.

The network may include this IE to provide the MS with a longer periodic routing area update timer.
9.4.2.15 Additional network feature support

The network may include this IE to inform the MS of the support of certain features. If this IE is not included then the
MS shall interpret this as a receipt of an information element with all bits of the value part coded as zero.
9.4.2.16 T3324 value

The network shall include the T3324 value IE if:
- the MS included the T3324 value IE in the ATTACH REQUEST message; and
- the network supports PSM and accepts the use of PSM.

The network shall include the Extended DRX parameters IE if:
- the MS included the Extended DRX parameters IE in the ATTACH REQUEST message; and
- the network supports eDRX and accepts the use of eDRX.
9.4.2.18 User Plane integrity indicator

The network shall include the User Plane integrity indicator IE if the MS shall enable integrity protection of user plane
data in LLC layer.
9.4.2.19 Replayed MS network capability

The network may include this IE if integrity protection and replay protection of GMM messages is to be used.
9.4.2.20 Replayed MS radio access capability

9.4.2.21 DCN-ID
This IE is included in the message when the network wishes to provide a DCN-ID to the MS.
9.4.2.22 PLMN identity of the CN operator

This IE is included in the message when the common PLMN identity included in the RAI does not identify the CN
operator that has accepted the GPRS attach request in a shared network or in a multi-operator core network (MOCN)
with common GERAN.

used to initiate MS detected emergency calls (see 3GPP TS 24.302 [156]). If this IE is not included then the MS shall
9.4.3 Attach complete

This message is sent by the MS to the network if at least one of the following conditions is fulfilled:
ETSI
Release 18 441 3GPP TS 24.008 V18.4.0 (2023-09)
- a P-TMSI and/or a TMSI was included within the attach accept message; or
- the network has requested the MS to provide feature-related information.
Message type: ATTACH COMPLETE
Significance: dual
Table 9.4.3/3GPP TS 24.008: ATTACH COMPLETE message content

10.2
10.3.1
Attach complete message identity Message type M V 1
10.4
27 Inter RAT handover information Inter RAT information container O TLV 3-250
10.5.5.24
2B E-UTRAN inter RAT handover E-UTRAN inter RAT information O TLV 3-257
information container 10.5.5.27
9.4.3.1 Inter RAT handover information

This IE shall be included if the network has requested this information in the attach accept message.
9.4.3.2 E-UTRAN inter RAT handover information

This IE shall be included if the network has requested this information in the attach accept message.
9.4.4 Attach reject

This message is sent by the network to the MS to indicate that the corresponding attach request has been rejected. See
table 9.4.4/3GPP TS 24.008.
Message type: ATTACH REJECT
Significance: dual
Table 9.4.4/3GPP TS 24.008: ATTACH REJECT message content

10.2
10.3.1
Attach reject message identity Message type M V 1
10.4
GMM cause GMM cause M V 1
10.5.5.14
10.5.7.4
3A T3346 value GPRS timer 2 O TLV 3
10.5.7.4
ETSI
Release 18 442 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.4.1 T3302 value

In Iu mode, if the MS is not attaching for emergency services, the network shall not include this IE if this message is to
be sent non-integrity protected. If the MS is attaching for emergency bearer services, the network may include this IE if
this message is to be sent non-integrity protected.
In Iu mode, if the MS is not attaching for emergency services, the MS shall ignore the contents of this IE if this message
is received without integrity protection. If the MS is attaching for emergency bearer services, the MS shall use the
received contents of this IE if this message is received without integrity protection.
If this IE is not included or if in Iu mode the message is not integrity protected, the MS shall use the default value.
9.4.4.2 T3346 value

This IE may be included when the NAS level mobility management congestion control is active.
9.4.5 Detach request
9.4.5.1 Detach request (mobile terminated detach)

This message is sent by the network to request the release of a GMM context. See table 9.4.5.1/3GPP TS 24.008.
Message type: DETACH REQUEST
Significance: dual
Table 9.4.5.1/3GPP TS 24.008:DETACH REQUEST message content

10.2
10.3.1
Detach request message identity Message type M V 1
10.4
Detach type Detach type M V 1/2
10.5.5.5
10.5.5.7
10.5.5.14
9.4.5.1.1 GMM cause

This IE shall be included in case the detach reason has to be indicated to the MS, e.g. due to a failed IMEI check.
9.4.5.2 Detach request (mobile originating detach)

This message is sent by the MS to request the release of a GMM context. See table 9.4.5.2/3GPP TS 24.008.
Message type: DETACH REQUEST
Significance: dual
ETSI
Release 18 443 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.5.2/3GPP TS 24.008:DETACH REQUEST message content

10.2
10.3.1
Detach request message identity Message type M V 1
10.4
Detach type Detach type M V 1/2
10.5.5.5
10.5.1.8
18 P-TMSI Mobile identity O TLV 7
10.5.1.4
19 P-TMSI signature P-TMSI signature 2 O TLV 5
10.5.5.8a
9.4.5.2.1 P-TMSI
This IE shall be included by the MS, if the P-TMSI is available.
9.4.5.2.2 P-TMSI signature

This IE shall be included if the MS has a valid P-TMSI signature.
9.4.6 Detach accept
9.4.6.1 Detach accept (mobile terminated detach)

This message is sent by the MS to indicate that the detach procedure has been completed. See table 9.4.6.1/3GPP TS
24.008.
Message type: DETACH ACCEPT
Significance: dual
Table 9.4.6.1/3GPP TS 24.008:DETACH ACCEPT message content

10.2
10.3.1
Detach accept message identity Message type M V 1
10.4
9.4.6.2 Detach accept (mobile originating detach)

This message is sent by the network to indicate that the detach procedure has been completed. See table 9.4.6.2/3GPP
TS 24.008.
Message type: DETACH ACCEPT
Significance: dual
ETSI
Release 18 444 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.6.2/3GPP TS 24.008:DETACH ACCEPT message content

10.2
10.3.1
Detach accept message identity Message type M V 1
10.4
10.5.5.7
10.5.1.8
9.4.7 P-TMSI reallocation command

This message is sent by the network to the MS to reallocate a P-TMSI and optionally assign a DCN-ID. See
table 9.4.7/3GPP TS 24.008.
Message type: P-TMSI REALLOCATION COMMAND
Significance: dual
Table 9.4.7/3GPP TS 24.008: P-TMSI REALLOCATION COMMAND message content

10.2
10.3.1
P-TMSI reallocation command Message type M V 1
message identity 10.4
Allocated P-TMSI Mobile identity M LV 6
10.5.1.4
10.5.5.15
10.5.5.7
10.5.1.8
10.5.5.8
10.5.5.35

9.4.7.2 DCN-ID
This IE may be included to assign a new DCN-ID to the MS.
9.4.8 P-TMSI reallocation complete

This message is sent by the MS to the network to indicate that reallocation of a P-TMSI has taken place. See
table 9.4.8/3GPP TS 24.008.
Message type: P-TMSI REALLOCATION COMPLETE
ETSI
Release 18 445 3GPP TS 24.008 V18.4.0 (2023-09)
Significance: dual
Table 9.4.8/3GPP TS 24.008: P-TMSI REALLOCATION COMPLETE message content

10.2
10.3.1
P-TMSI reallocation complete Message type M V 1
9.4.9 Authentication and ciphering request

This message is sent by the network to the MS to initiate authentication of the MS identity. Additionally, the ciphering
mode is set, indicating whether ciphering will be performed or not. See table 9.4.9/3GPP TS 24.008.
Message type: AUTHENTICATION AND CIPHERING REQUEST
Significance: dual
Table 9.4.9/TS 24.008: AUTHENTICATION AND CIPHERING REQUEST message content

10.2
10.3.1
Authentication and ciphering Message type M V 1
request message identity 10.4
Ciphering algorithm Ciphering algorithm M V 1/2
10.5.5.3
IMEISV request IMEISV request M V 1/2
10.5.5.10
10.5.5.7
A&C reference number A&C reference number M V 1/2
10.5.5.19
21 Authentication parameter RAND Authentication parameter RAND O TV 17
10.5.3.1
8- GPRS ciphering key sequence Ciphering key sequence number C TV 1
number 10.5.1.2
28 Authentication parameter Authentication parameter AUTN O TLV 18
AUTN 10.5.3.1.1
10.5.5.12
9- Integrity algorithm Integrity algorithm O TV 1
10.5.5.3a
43 Message authentication code Message authentication code O TLV 6
10.5.5.33
capability 10.5.5.12a
9.4.9.1 Authentication Parameter RAND

This IE shall only be included if authentication shall be performed.
ETSI
Release 18 446 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.9.2 GPRS ciphering key sequence number

This IE is included if and only if the Authentication parameter RAND is contained in the message.
9.4.9.3 Authentication Parameter AUTN

This IE shall be present if and only if the authentication challenge is a UMTS authentication challenge.The presence or
absence of this IE defines- in the case of its absence- a GSM authentication challenge or- in the case of its presence- a
UMTS authentication challenge.
The MS shall ignore the IE if a SIM is inserted in the MS.
In UMTS, the MS shall reject the AUTHENTICATION & CIPHERING REQUEST message as specified in
subclause 4.7.7.5.1 if this IE is not present and a USIM is inserted in the MS.

This IE is included if integrity protection and replay protection of GMM messages is to be used.
9.4.9.5 Integrity algorithm

9.4.9.6 Message authentication code

This IE is included if integrity protection of AUTHENTICATION AND CIPHERING REQUEST message and
AUTHENTICATION AND CIPHERING RESPONSEmessages is to be used.
9.4.9.7 Replayed MS Radio Access Capability

9.4.10 Authentication and ciphering response

This message is sent by the MS to the network in response to an Authentication and ciphering request message. See
table 9.4.10/3GPP TS 24.008.
Message type: AUTHENTICATION AND CIPHERING RESPONSE
Significance: dual
ETSI
Release 18 447 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.10/3GPP TS 24.008: AUTHENTICATION AND CIPHERING RESPONSE message content

10.2
10.3.1
Authentication and ciphering GPRS message type M V 1
response message identity 10.4
A&C reference number A&C reference number M V 1/2
10.5.5.19
10.5.1.8
22 Authentication parameter Authentication Response parameter O TV 5
Response 10.5.3.2
23 IMEISV Mobile identity O TLV 11
10.5.1.4
29 Authentication Response Authentication Response parameter O TLV 3-14
parameter (extension) 10.5.3.2.1
43 Message authentication code Message authentication code O TLV 6
10.5.5.33
9.4.10.1 Authentication Response Parameter

This IE is included if authentication was requested within the corresponding authentication and ciphering request
message. This IE contains the SRES, if the authentication challenge was for GSM or the RES (all or just the 4 most
significant octets of) if it is a UMTS authentication challenge (see also subclause 9.4.10.2)
9.4.10.2 IMEISV
This IE is included if requested within the corresponding authentication and ciphering request message.
9.4.10.3 Authentication Response Parameter (extension)

This IE shall be included if and only if the authentication challenge was a UMTS authentication challenge and the RES
parameter is greater than 4 octets in length. It shall contain the least significant remaining bits of the RES (the four most
significant octets shall be sent in the Authentication Response Parameter IE (see subclause 9.2.3.1))
This IE shall not be included if a SIM is inserted in the MS.

9.4.10a Authentication and Ciphering Failure

This message is sent by the mobile station to the network to indicate that authentication of the network has failed. See
table 9.4.10a/3GPP TS 24.008.
Message type: AUTHENTICATION AND CIPHERING FAILURE
Significance: dual
ETSI
Release 18 448 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.10a/3GPP TS 24.008: AUTHENTICATION AND CIPHERING FAILURE message content

10.3.1
Authentication and Ciphering Message type M V 1
Failure
Message type 10.4
GMM Cause GMM Cause M V 1
10.5.5.14
30 Authentication Failure parameter Authentication Failure parameter O TLV 16
10.5.3.2.2
9.4.10a.1 Authentication Failure parameter

This IE shall be sent if and only if the GMM cause was "Synch failure". It shall include the response to the
authentication challenge from the USIM, which is made up of the AUTS parameter (see 3GPP TS 33.102 [5a]).
9.4.11 Authentication and ciphering reject

This message is sent by the network to the MS to indicate that authentication has failed (and that the receiving MS shall
abort all activities). See table 9.4.11/3GPP TS 24.008.
Message type: AUTHENTICATION AND CIPHERING REJECT
Significance: dual
Table 9.4.11/3GPP TS 24.008: AUTHENTICATION AND CIPHERING REJECT message content

10.2
10.3.1
Authentication and ciphering Message type M V 1
reject message identity 10.4
9.4.12 Identity request

This message is sent by the network to the MS to request submission of the MS identity according to the specified
identity type. See table 9.4.12/3GPP TS 24.008.
Message type: IDENTITY REQUEST
Significance: dual
ETSI
Release 18 449 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.12/3GPP TS 24.008: IDENTITY REQUEST message content

10.2
10.3.1
Identity request message identity Message type M V 1
10.4
Identity type Identity type 2 M V 1/2
10.5.5.9
10.5.5.7
9.4.13 Identity response

This message is sent by the MS to the network in response to an identity request message providing the requested
identity. See table 9.4.13/3GPP TS 24.008.
Message type: IDENTITY RESPONSE
Significance: dual
Table 9.4.13/3GPP TS 24.008: IDENTITY RESPONSE message content

10.2
10.3.1
Identity response message Message type M V 1
identity 10.4
Mobile identity Mobile identity M LV 4 - 10
10.5.1.4
9.4.14 Routing area update request

This message is sent by the MS to the network either to request an update of its location file or to request an IMSI
attach for non-GPRS services. See table 9.4.14/3GPP TS 24.008.
Message type: ROUTING AREA UPDATE REQUEST
Significance: dual
ETSI
Release 18 450 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.14/3GPP TS 24.008: ROUTING AREA UPDATE REQUEST message content
ETSI
Release 18 451 3GPP TS 24.008 V18.4.0 (2023-09)

10.2
10.3.1
Routing area update request Message type M V 1
Update type Update type M V 1/2
10.5.5.18
GPRS ciphering key sequence Ciphering key sequence number M V 1/2
number 10.5.1.2
Old routing area identification Routing area identification M V 6
10.5.5.15
MS Radio Access capability MS Radio Access capability M LV 6 - 51
10.5.5.12a
19 Old P-TMSI signature P-TMSI signature O TV 4
10.5.5.8
17 Requested READY timer value GPRS Timer O TV 2
10.5.7.3
27 DRX parameter DRX parameter O TV 3
10.5.5.6
9- TMSI status TMSI status O TV 1
10.5.5.4
18 P-TMSI Mobile identity O TLV 7
10.5.1.4
31 MS network capability MS network capability O TLV 4 - 10
10.5.5.12
32 PDP context status PDP context status O TLV 4
10.5.7.1
33 PS LCS Capability PS LCS Capability O TLV 3-4
10.5.5.22
35 MBMS context status MBMS context status O TLV 2 - 18
10.5.7.6
58 UE network capability UE network capability O TLV 4 - 15
10.5.5.26
1A Additional mobile identity Mobile identity O TLV 7
10.5.1.4
1B Additional old routing area Routing area identification 2 O TLV 8
identification 10.5.5.15a
11 Mobile station classmark 2 Mobile station classmark 2 O TLV 5
10.5.1.6
20 Mobile station classmark 3 Mobile station classmark 3 O TLV 2 - 34
10.5.1.7
10.5.4.32
5D Voice domain preference and Voice domain preference and UE's O TLV 3
UE's usage setting usage setting
10.5.5.28
10.5.5.29
10.5.7.8
C- MS network feature support MS network feature support O TV 1
10.5.1.15
14 Old location area identification Location Area Identification 2 O TLV 7
10.5.5.30
F- Additional update type Additional update type O TV 1
10.5.5.0
10 TMSI based NRI container Network resource identifier container O TLV 4
10.5.5.31
10.5.7.4
10.5.7.4a
ETSI
Release 18 452 3GPP TS 24.008 V18.4.0 (2023-09)

10.5.5.32
9.4.14.1 Old P-TMSI signature

The MS shall include this IE, if the MS received the IE from the network in an ATTACH ACCEPT or ROUTING
AREA UPDATE ACCEPT message, or if the TIN indicates "GUTI" and the MS holds a valid GUTI.
9.4.14.2 Requested READY timer value

This IE may be included if the MS wants to indicate a preferred value for the READY timer.
9.4.14.3 DRX parameter

This IE shall be included if the MS changes the access network from GSM to UMTS, or the MS wants to indicate new
DRX parameters to the network.
9.4.14.4 TMSI status

This IE shall be included if the MS performs a combined routing area update and no valid TMSI is available.
9.4.14.5 P-TMSI (Iu mode only)

This IE shall be included by the MS.
9.4.14.6 MS network capability

This IE shall be included by the MS to indicate its capabilities to the network.
9.4.14.7 PDP context status


This IE shall be included if the MS supports at least one positioning method for the provision of location services (LCS)
via the PS domain in Gb-mode.
9.4.14.9 MBMS context status

This IE shall be included by the MS, if it has MBMS contexts with an SM state different from PDP-INACTIVE.
9.4.14.10 Additional mobile identity

This IE shall be included by the MS, if the TIN indicates "GUTI" and the MS holds a valid GUTI and P-TMSI and RAI.
9.4.14.11 Additional old routing area identification

This IE shall be included by the MS, if the TIN indicates "GUTI" and the MS holds a valid GUTI and P-TMSI and RAI.

An MS supporting S1 mode shall include this IE, unless the update type indicates "periodic update".

This IE shall be included if the MS supports SRVCC to GERAN or UTRAN.
ETSI
Release 18 453 3GPP TS 24.008 V18.4.0 (2023-09)

This IE shall be included if the MS supports SRVCC to GERAN.

This IE shall be included if the MS supports SRVCC to GERAN or UTRAN to indicate its supported speech codecs for
CS speech calls.

This IE shall be included if and only if:
- the MS supports CS fallback and SMS over SGs, or the MS is configured to support IMS voice, or both, and
- the MS supports WB-S1 mode.

The MS shall include this IE.


This IE shall be included if the MS supports extended periodic timer T3312.
9.4.14.20 Old location area identification

The MS shall include this IE during a combined routing area updating procedure, if the MS holds a valid LAI and the
MS supports EMM combined procedures.

The MS shall include this IE if the MS initiates a combined routing area updating procedure for GPRS services and
"SMS-only service".
9.4.14.22 TMSI based NRI container

The MS shall include this IE if it has a valid TMSI.
9.4.14.23 T3324 value

The MS may include this IE to request the use of PSM.

The MS may include this IE to request a particular T3312 value if T3324 value IE is included.

The MS may include this IE to request the use of eDRX.
ETSI
Release 18 454 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.15 Routing area update accept

This message is sent by the network to the MS to provide the MS with GPRS mobility management related data in
response to a routing area update request message. See table 9.4.15/3GPP TS 24.008.
Message type: ROUTING AREA UPDATE ACCEPT
Significance: dual
ETSI
Release 18 455 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.15/3GPP TS 24.008: ROUTING AREA UPDATE ACCEPT message content
ETSI
Release 18 456 3GPP TS 24.008 V18.4.0 (2023-09)

10.2
10.3.1
Routing area update accept Message type M V 1
10.5.5.7
Update result Update result M V 1/2
10.5.5.17
Periodic RA update timer GPRS Timer M V 1
10.5.7.3
10.5.5.15
10.5.5.8
18 Allocated P-TMSI Mobile identity O TLV 7
10.5.1.4
23 MS identity Mobile identity O TLV 7-10
10.5.1.4
26 List of Receive N-PDU Numbers Receive N-PDU Number list O TLV 4 - 19
10.5.5.11
17 Negotiated READY timer value GPRS Timer O TV 2
10.5.7.3
10.5.5.14
10.5.7.4
8C Cell Notification Cell Notification O T 1
10.5.5.21
4A Equivalent PLMNs PLMN List O TLV 5-47
10.5.1.13
10.5.7.1
B- Network feature support Network feature support O TV 1
10.5.5.23
10.5.3.13
10.5.7.6
A- Requested MS Information Requested MS Information O TV 1
10.5.5.25
10.5.7.4
10.5.7.4
39 T3312 extended value GPRS timer 3 O TLV 3
10.5.7.4a
66 Additional network feature support Additional network feature support O TLV 3
10.5.5.23A
6A T3324 value GPRS Timer2 O TLV 3
10.5.7.4
10.5.5.32
C- User Plane integrity indicator User Plane integrity indicator O TV 1
10.5.5.34
10.5.5.12
Capability 10.5.5.12a
10.5.5.35
63 PLMN identity of the CN operator PLMN identity of the CN operator O TLV 5
10.5.5.36
ETSI
Release 18 457 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.5.37

9.4.15.2 Allocated P-TMSI

This IE may be included to assign a P-TMSI to an MS in case of a GPRS or combined routing area updating procedure.
9.4.15.3 MS identity
This IE may be included to assign or unassign a TMSI to a MS in case of a combined routing area updating procedure.
9.4.15.4 List of Receive N-PDU Numbers

This IE shall be included in case of an inter SGSN routing area updating from A/Gb mode to A/Gb mode, or inter
SGSN routing area updating from Iu mode to A/Gb mode, or intra SGSN routing area updating from Iu mode to A/Gb
mode, if there are PDP contexts that have been activated in LLC acknowledged transfer mode.
9.4.15.5 Negotiated READY timer value

This IE may be included to indicate a value for the READY timer.
9.4.15.6 GMM cause

This IE shall be included if the combined GPRS routing area updating procedure was successful for GPRS services
only.
9.4.15.7 T3302 value

In Iu mode, if the MS is not attached for emergency bearer services, the network shall not include this IE if this message
is to be sent non-integrity protected. If the MS is attached for emergency bearer services, the network may include this
IE if this message is to be sent non-integrity protected.
In Iu mode, if this message is received without integrity protection the MS not attached for emergency bearer services
shall ignore the contents of this IE and use the default value. If the MS is attached for emergency bearer services, the
MS shall use the received contents of this IE if this message is received without integrity protection.
If this IE is not included in the message in A/Gb mode or if in Iu mode this IE is not included in an integrity protected
message, the MS shall use the default value.
9.4.15.8 Cell Notification (A/Gb mode only)

In A/Gb mode, this IE shall be included if by the SGSN in order to indicate the ability to support the Cell Notification.

PLMNs.

This IE shall be included by the NW.
ETSI
Release 18 458 3GPP TS 24.008 V18.4.0 (2023-09)

This IE may be included to inform the MS of the support of certain features. If this IE is not included then the
respective features are not supported.

within the same MCC as in the cell on which this IE is received.

This IE shall be included by the network, if it has MBMS contexts for the MS with an SM state different from PDP-
INACTIVE.
9.4.15.14 Requested MS Information

This IE may be sent by the network to request the MS to provide feature-related information.
9.4.15.15 T3319 value

This IE may be included to indicate a value for timer T3319.
9.4.15.16 T3323 value

The network may include this IE to indicate a value for timer T3323.
If the IE is not included, the MS shall use the default value.

The network may include this IE to provide the MS with a longer periodic routing area update timer.
9.4.15.18 Additional network feature support

The network may include this IE to inform the MS of the support of certain features. If this IE is not included then the
MS shall interpret this as a receipt of an information element with all bits of the value part coded as zero.
9.4.15.19 T3324 value

The network shall include the T3324 value IE if:
- the MS included the T3324 value IE in the ROUTING AREA UPDATE REQUEST message; and
- the network supports PSM and accepts the use of PSM.

The network shall include the Extended DRX parameters IE if:
- the MS included the Extended DRX parameters IE in the ROUTING AREA UPDATE REQUEST message; and
- the network supports eDRX and accepts the use of eDRX.

The network shall include the User Plane integrity indicator IE if the MS shall enable integrity protection of user plane
data in LLC layer.
ETSI
Release 18 459 3GPP TS 24.008 V18.4.0 (2023-09)

9.4.15.23 Replayed MS Radio Access Capability

9.4.15.24 DCN-ID
This IE is included in the message when the network wishes to provide a DCN-ID to the MS.

This IE is included in the message when the common PLMN identity included in the RAI does not identify the CN
operator that has accepted the routing area update request in a shared network or in a multi-operator core network
(MOCN) with common GERAN.

used to initiate UE detected emergency calls (see 3GPP TS 24.302 [156]). If this IE is not included then the UE shall
9.4.16 Routing area update complete

This message shall be sent by the MS to the network in response to a routing area update accept message if at least one
of the following conditions is fulfilled:
- a P-TMSI and/or a TMSI has been assigned;
- there are established LLC connections; or
- the network has requested the MS to provide feature-related information.
Message type: ROUTING AREA UPDATE COMPLETE
Significance: dual
Table 9.4.16/3GPP TS 24.008: ROUTING AREA UPDATE COMPLETE message content

10.2
10.3.1
Routing area update complete Message type M V 1
26 List of Receive N-PDU Numbers Receive N-PDU Number list O TLV 4 – 19
10.5.5.11
27 Inter RAT handover information Inter RAT information container O TLV 3-250
10.5.5.24
2B E-UTRAN inter RAT handover E-UTRAN inter RAT information O TLV 3-257
information container 10.5.5.27
ETSI
Release 18 460 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.16.1 List of Receive N-PDU Numbers

This IE shall be included if the routing area update accept message contained this IE.
9.4.16.2 Inter RAT handover information

This IE shall be included if the network has requested this information in the routing area update accept message.
9.4.16.3 E-UTRAN inter RAT handover information

This IE shall be included if the network has requested this information in the routing area update accept message.
9.4.17 Routing area update reject

This message is sent by the network to the MS in order to reject the routing area update procedure. See
table 9.4.17/3GPP TS 24.008.
Message type: ROUTING AREA UPDATE REJECT
Significance: dual
Table 9.4.17/3GPP TS 24.008: ROUTING AREA UPDATE REJECT message content

10.2
10.3.1
Routing area update reject Message type M V 1
10.5.5.14
10.5.5.7
10.5.1.8
10.5.7.4
10.5.7.4
9.4.17.1 T3302 value

In Iu mode, if the MS is not attached for emergency bearer services, the network shall not include this IE if this message
is to be sent non-integrity protected. If the MS is attached for emergency bearer services, the network may include this
IE if this message is to be sent non-integrity protected.
In Iu mode, the MS not attached for emergency bearer services shall ignore the contents of this IE if this message is
received without integrity protection. If the MS is attached for emergency bearer services, the MS shall use the received
contents of this IE if this message is received without integrity protection.
If this IE is not included or if in Iu mode the message is not integrity protected, the MS shall use the default value.
9.4.17.2 T3346 value

This IE may be included when the general NAS level mobility management congestion control is active.
ETSI
Release 18 461 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.18 GMM Status

This message is sent by the MS or by the network at any time to report certain error conditions listed in clause 8. See
table 9.4.18/3GPP TS 24.008.
Message type: GMM STATUS
Significance: local
Direction: both
Table 9.4.18/3GPP TS 24.008: GMM STATUS message content

10.2
10.3.1
GMM Status message identity Message type M V 1
10.4
10.5.5.14
9.4.19 GMM Information

This message is sent by the network at any time to sent certain information to the MS.
Message type: GMM INFORMATION
Significance: local
Table 9.4.19/3GPP TS 24.008: GMM INFORMATION message content

10.2
10.3.1
GMM Information message Message type M V 1
identity 10.4
43 Full name for network Network name O TLV 3-?
10.5.3.5a
45 Short name for network Network name O TLV 3-?
10.5.3.5a
46 Local time zone Time zone O TV 2
10.5.3.8
47 Universal time and local time zone Time zone and time O TV 8
10.5.3.9
48 LSA Identity LSA Identifier O TLV 2-5
10.5.3.11
49 Network Daylight Saving Time Daylight Saving Time O TLV 3
10.5.3.12
9.4.19.1 Full name for network

This IE may be sent by the network. If this IE is sent, the contents of this IE indicate the "full length name of the
network" that the network wishes the mobile station to associate with the MCC and MNC contained in the routing area
identification of the current cell.
ETSI
Release 18 462 3GPP TS 24.008 V18.4.0 (2023-09)
9.4.19.2 Short name for network

This IE may be sent by the network. If this IE is sent, the contents of this IE indicate the "abbreviated name of the
network" that the network wishes the mobile station to associate with the MCC and MNC contained in the routing area
identification of the cell the MS is currently in.
9.4.19.3 Local time zone

This IE may be sent by the network. The mobile station should assume that this time zone applies to the routing area of
the cell the MS is currently in.
9.4.19.4 Universal time and local time zone

This IE may be sent by the network. The mobile station should assume that this time zone applies to the routing area the
MS is currently in. The mobile station shall not assume that the time information is accurate.
9.4.19.5 LSA Identity

This IE may be sent by the network. The contents of this IE indicate the LSA identity of the serving cell.
9.4.19.6 Network Daylight Saving Time

This IE may be sent by the network. If this IE is sent, the contents of this IE indicates the value that has been used to
adjust the local time zone.
9.4.20 Service Request (Iu mode only)

This message is sent by the MS to transfer to establish logical association between the MS and the network. See
table 9.4.20/3GPP TS 24.008.
Message type: Service Request
Significance: dual
ETSI
Release 18 463 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.20/3GPP TS 24.008: Contents of Service Request message content

10.2
10.3.1
Service Request message identity Message type M V 1
10.4
Ciphering key sequence number Ciphering key sequence number M V 1/2
10.5.1.2
Service type Service type M V 1/2
10.5.5.20
P-TMSI Mobile station identity M LV 6
10.5.1.4
10.5.7.1
10.5.7.6
36 Uplink data status Uplink data status O TLV 4
10.5.7.7
10.5.7.8


This IE shall be included by the MS, if it has MBMS contexts with an SM state different from PDP-INACTIVE.
9.4.20.3 Uplink data status

This IE may be included by the MS when the Service Type is set to "data".

9.4.21 Service Accept (Iu mode only)

This message is sent by the network in response to a Service Request message. See table 9.4.21/3GPP TS 24.008.
Message type: Service Accept
Significance: dual
ETSI
Release 18 464 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.4.21/3GPP TS 24.008: Contents of Service Accept message content

10.2
10.3.1
Service Accept message identity Message type M V 1
10.4
10.5.7.1
10.5.7.6

This IE shall be included by the NW.

This IE shall be included by the network, if it has MBMS contexts for the MS with an SM state different from PDP-
INACTIVE.
9.4.22 Service Reject (Iu mode only)

This message is sent by the network to the MS in order to reject the Service request procedure. See table 9.4.22/3GPP
TS 24.008.
Message type: Service Reject
Significance: dual
Table 9.4.22/3GPP TS 24.008: Contents of Service Reject message content

10.2
10.3.1
Service Reject message identity Message type M V 1
10.4
10.5.5.14
10.5.7.4
9.4.22.1 T3346 value

This IE may be included when the general NAS level mobility management congestion control is active.
9.5 GPRS Session Management Messages

9.5.1 Activate PDP context request
This message is sent by the MS to the network to request activation of a PDP context.
ETSI
Release 18 465 3GPP TS 24.008 V18.4.0 (2023-09)
Message type: ACTIVATE PDP CONTEXT REQUEST
Table 9.5.1/3GPP TS 24.008: ACTIVATE PDP CONTEXT REQUEST message content

10.2
Transaction identifier Transaction identifier M V 1/2– 3/2
10.3.2
Activate PDP context request Message type M V 1
Requested NSAPI Network service access point M V 1
identifier 10.5.6.2
Requested LLC SAPI LLC service access point identifier M V 1
10.5.6.9
Requested QoS Quality of service M LV 13-21
10.5.6.5
Requested PDP address Packet data protocol address M LV 3 - 23
10.5.6.4
28 Access point name Access point name O TLV 3 - 102
10.5.6.1
27 Protocol configuration options Protocol configuration options O TLV 3 - 253
10.5.6.3
A- Request type Request type O TV 1
10.5.6.17
C- Device properties Device properties O TV 1
10.5.7.8
33 NBIFOM container NBIFOM container O TLV 3 – 257
10.5.6.21
7B Extended protocol configuration Extended protocol configuration O TLV-E 4 - 65538
options options
10.5.6.3a
5C Extended QoS Extended quality of service O TLV 12
10.5.6.5B
9.5.1.1 Access point name

This IE is included in the message when the MS selects a specific external network to be connected to.

This IE is included in the message when the MS wishes to transmit (protocol) data (e.g. configuration parameters, error
codes or messages/events) to the network and the extended protocol configuration options IE is not supported by the
MS or the network or both end-to-end for the PDN connection (see subclause 6.1.3.7).
This IE shall be included if the MS supports Network Requested Bearer Control procedures or Local IP address in TFTs
and the PDP Type requested is different from non-IP.
9.5.1.3 Request type

This IE is included in the message to indicate whether the PDP context request is for a handover from a non-3GPP
access network or to activate a PDP context for emergency bearer services.

ETSI
Release 18 466 3GPP TS 24.008 V18.4.0 (2023-09)
9.5.1.5 NBIFOM container

This information element is used to transfer information associated with network-based IP flow mobility, see
3GPP TS 24.161 [158].
9.5.1.6 Extended protocol configuration options

codes or messages/events) to the network and the extended protocol configuration options IE is supported by the
network and the MS end-to-end for the PDN connection (see subclause 6.1.3.7).
9.5.1.7 Extended QoS

This IE is included in the message when the MS wishes to transmit the maximum and guaranteed bit rate values to the
network and at least one of the values to be transmitted exceeds the maximum bit rate value as specified in the quality
of service information element in subclause 10.5.6.5.
9.5.2 Activate PDP context accept

This message is sent by the network to the MS to acknowledge activation of a PDP context.
Message type: ACTIVATE PDP CONTEXT ACCEPT
ETSI
Release 18 467 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.5.2/3GPP TS 24.008: ACTIVATE PDP CONTEXT ACCEPT message content

10.2
10.3.2
Activate PDP context accept Message type M V 1
Negotiated LLC SAPI LLC service access point identifier M V 1
10.5.6.9
Negotiated QoS Quality of service M LV 13-21
10.5.6.5
Radio priority Radio priority M V 1/2
10.5.7.2
10.5.1.8
2B PDP address Packet data protocol address O TLV 4-24
10.5.6.4
27 Protocol configuration options Protocol configuration options O TLV 3-253
10.5.6.3
34 Packet Flow Identifier Packet Flow Identifier O TLV 3
10.5.6.11
39 SM cause SM cause 2 O TLV 3
10.5.6.6a
B- Connectivity type Connectivity type O TV 1
10.5.6.19
C- WLAN offload indication WLAN offload acceptability O TV 1
10.5.6.20
10.5.6.21
options options
10.5.6.3a
10.5.6.5B
9.5.2.1 PDP address

This IE shall be included by the network if the MS has requested the activation of a PDP context with the PDP type
IPv4 or IPv6 or IPv4v6 and dynamic addressing.

This IE is included in the message when the network wishes to transmit (protocol) data (e.g. configuration parameters,
error codes or messages/events) to the MS and the extended protocol configuration options IE is not supported by the
This IE is also included to indicate the selected Bearer Control Mode to be applied as well as the network support for
Local IP address in TFTs for all active PDP contexts sharing the same PDP Address and APN, if the PDN type is
different from Non-IP, and the extended protocol configuration options IE is not supported by the MS or the network or
both end-to-end for the PDN connection (see subclause 6.1.3.7).
9.5.2.3 Packet Flow Identifier

This IE may be included if the network wants to indicate the Packet Flow Identifier associated to the PDP context. The
network shall not include this IE if the MS has not indicated PFC procedure support in PFC feature mode field of MS
Network Capability IE.
If the MS has not indicated PFC procedure support, then it shall ignore this IE, if received.
ETSI
Release 18 468 3GPP TS 24.008 V18.4.0 (2023-09)
9.5.2.4 SM cause
This IE shall be included if the network accepts the requested PDN connectivity with restrictions.
9.5.2.5 Connectivity type

The network shall include the connectivity type IE if:
- the network is configured to indicate when a PDN connection is a LIPA PDN connection; and
- the present PDN connection is a LIPA PDN connection.
9.5.2.6 WLAN offload indication

This IE shall be included in the message when the network wishes to indicate if the UE is allowed to offload the traffic
of the associated PDN connection to WLAN(s), as specified in subclause 10.5.6.20.

3GPP TS 24.161 [158].

error codes or messages/events) to the MS and the extended protocol configuration options IE is supported by both the
MS and the network end-to-end for the PDN connection (see subclause 6.1.3.7).
This IE is also included to indicate the selected Bearer Control Mode to be applied as well as the network support for
Local IP address in TFTs for all active PDP contexts sharing the same PDP Address and APN, if the PDN type is
different from Non-IP, and the extended protocol configuration options IE is supported by both the MS and the network
end-to-end for the PDN connection (see subclause 6.1.3.7).

This IE is included in the message when the network wishes to transmit the maximum and guaranteed bit rate values to
the MS and at least one of the values to be transmitted exceeds the maximum bit rate value as specified in the quality of
service information element in subclause 10.5.6.5.
9.5.3 Activate PDP context reject

This message is sent by the network to the MS to reject activation of a PDP context.
Message type: ACTIVATE PDP CONTEXT REJECT
ETSI
Release 18 469 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.5.3/3GPP TS 24.008: ACTIVATE PDP CONTEXT REJECT message content

10.2
10.3.2
Activate PDP context reject Message type M V 1
SM cause SM Cause M V 1
10.5.6.6
27 Protocol configuration options Protocol configuration options O TLV 3 - 253
10.5.6.3
37 Back-off timer value GPRS timer 3 O TLV 3
10.5.7.4a
6B Re-attempt indicator Re-attempt indicator O TLV 3
10.5.6.5A
10.5.6.21
options options
10.5.6.3a

9.5.3.2 Back-off timer value

The network may include this IE if the SM cause is not #50 "PDP type IPv4 only allowed", #51 "PDP type IPv6 only
allowed", #57 "PDP type IPv4v6 only allowed", #58 "PDP type non IP only allowed", nor #65 "maximum number of
PDP contexts reached", to request a minimum time interval before procedure retry is allowed.
9.5.3.3 Re-attempt indicator

The network may include this IE only if the SM cause value is #50 "PDP type IPv4 only allowed", #51 "PDP type IPv6
only allowed", #57 "PDP type IPv4v6 only allowed", #58 "PDP type non IP only allowed", or #66 "requested APN not
supported in current RAT and PLMN combination", or if the network includes the Back-off timer value IE and the SM
cause value is not #26 "insufficient resources".

3GPP TS 24.161 [158].

9.5.4 Activate Secondary PDP Context Request

This message is sent by the MS to the network to request activation of an additional PDP context associated with the
same PDP address and APN as an already active PDP context. See Table 9.5.4/3GPP TS 24.008.
Message type: ACTIVATE SECONDARY PDP CONTEXT REQUEST
ETSI
Release 18 470 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.5.4/3GPP TS 24.008: ACTIVATE SECONDARY PDP CONTEXT REQUEST message content

Protocol discriminator Protocol discriminator M V ½
10.2
Transaction identifier Transaction identifier M V ½– 3/2
10.3.2
Activate secondary PDP context Message type M V 1
request message identity 10.4
Requested NSAPI Network service access point M V 1
identifier
10.5.6.2
10.5.6.9
Requested QoS Quality of service M LV 13-21
10.5.6.5
Linked TI Linked TI M LV 2-3
10.5.6.7
36 TFT Traffic Flow Template O TLV 3-257
10.5.6.12
10.5.6.3
10.5.7.8
10.5.6.21
7B Extended protocol configuration Extended protocol configuration O TLV-E 4-
options options 65538
10.5.6.3a
10.5.6.5B
9.5.4.1 TFT
This IE shall be included if a linked PDP context without TFT has already been activated.



3GPP TS 24.161 [158].

codes or messages/events) to the network and the extended protocol configuration options IE is supported by both the
ETSI
Release 18 471 3GPP TS 24.008 V18.4.0 (2023-09)

9.5.5 Activate Secondary PDP Context Accept

This message is sent by the network to the MS to acknowledge activation of an additional PDP context associated with
the same PDP address and APN as an already active PDP context. See Table 9.5.5/3GPP TS 24.008.
Message type: ACTIVATE SECONDARY PDP CONTEXT ACCEPT
Table 9.5.5/3GPP TS 24.008: ACTIVATE SECONDARY PDP CONTEXT ACCEPT message content

10.2
10.3.2
accept message identity 10.4
10.5.6.9
Negotiated QoS Quality of service M LV 13-21
10.5.6.5
10.5.7.2
10.5.1.8
10.5.6.11
10.5.6.3
10.5.6.20
10.5.6.21
7B Extended protocol configuration Extended protocol configuration O TLV-E 4-
options options 65538
10.5.6.3a
10.5.6.5B

If the MS has not indicated PFC procedure support, then it shall ignore this IE, if received.

ETSI
Release 18 472 3GPP TS 24.008 V18.4.0 (2023-09)


3GPP TS 24.161 [158].


9.5.6 Activate Secondary PDP Context Reject

This message is sent by the network to the MS to reject activation of an additional PDP context associated with the
same PDP address and APN as an already active PDP context. See Table 9.5.6/3GPP TS 24.008.
Message type: ACTIVATE SECONDARY PDP CONTEXT REJECT
Table 9.5.6/3GPP TS 24.008: ACTIVATE SECONDARY PDP CONTEXT REJECT message content

10.2
10.3.2
reject message identity 10.4
10.5.6.6
27 Protocol configuration options Protocol configuration options O TLV 3 – 253
10.5.6.3
10.5.7.4a
10.5.6.5A
10.5.6.21
options options
10.5.6.3a

ETSI
Release 18 473 3GPP TS 24.008 V18.4.0 (2023-09)

The network may include this IE if the SM cause is not #65 "maximum number of PDP contexts reached", to request a
minimum time interval before procedure retry is allowed.

The network may include this IE only if it includes the Back-off timer value IE and the SM cause value is not #26
"insufficient resources".

3GPP TS 24.161 [158].

9.5.7 Request PDP context activation

This message is sent by the network to the MS to initiate activation of a PDP context.
Message type: REQUEST PDP CONTEXT ACTIVATION
Table 9.5.7/3GPP TS 24.008: REQUEST PDP CONTEXT ACTIVATION message content

10.2
10.3.2
Request PDP context activation Message type M V 1
Offered PDP address Packet data protocol address M LV 3 - 23
10.5.6.4
28 Access point name Access point name O TLV 3 – 102
10.5.6.1
10.5.6.3
10.5.6.21
options options
10.5.6.3a

ETSI
Release 18 474 3GPP TS 24.008 V18.4.0 (2023-09)

3GPP TS 24.161 [158].

9.5.8 Request PDP context activation reject

This message is sent by the MS to the network to reject initiation of a PDP context activation.
Message type: REQUEST PDP CONTEXT ACTIVATION REJECT
Table 9.5.8/3GPP TS 24.008: REQUEST PDP CONTEXT ACTIVATION REJECT message content

10.2
10.3.2
Request PDP context act. reject Message type M V 1
SM cause SM cause M V 1
10.5.6.6
10.5.6.3
10.5.6.21
options options
10.5.6.3a


3GPP TS 24.161 [158].

ETSI
Release 18 475 3GPP TS 24.008 V18.4.0 (2023-09)
9.5.9 Modify PDP context request (Network to MS direction)

This message is sent by the network to the MS to request modification of an active PDP context. See table 9.5.9/3GPP
TS 24.008.
Message type: MODIFY PDP CONTEXT REQUEST (NETWORK TO MS DIRECTION)
Table 9.5.9/3GPP TS 24.008: MODIFY PDP CONTEXT REQUEST (Network to MS direction) message
content

10.2
10.3.2
Modify PDP context request Message type M V 1
10.5.7.2
10.5.1.8
10.5.6.9
New QoS Quality of service M LV 13-21
10.5.6.5
2B PDP address Packet data protocol address O TLV 4-24
10.5.6.4
10.5.6.11
10.5.6.3
36 TFT Traffic Flow Template O TLV 3 - 257
10.5.6.12
10.5.6.20
10.5.6.21
options options
10.5.6.3a
10.5.6.5B
9.5.9.1 PDP address

If the MS requested external PDP address allocation at PDP context activation via an APN and this was confirmed by
the network in the ACTIVATE PDP CONTEXT ACCEPT message, then the network shall include the PDP address IE
in the MODIFY PDP CONTEXT REQUEST message once the address has been actually allocated, in order to update
the PDP context in the MS.

If this IE is not included, the MS shall keep the old Packet Flow Identifier value. If the MS has not indicated PFC
procedure support, then it shall ignore this IE, if received.
ETSI
Release 18 476 3GPP TS 24.008 V18.4.0 (2023-09)

error codes or messages/events) to the MS and the extended protocol configuration options IE is not supported by both
the MS and the network end-to-end for the PDN connection (see subclause 6.1.3.7). This IE is also included to indicate
the selected Bearer Control Mode to be applied when the extended protocol configuration options IE is not supported by
the MS or the network or both end-to-end for the PDN connection (see subclause 6.1.3.7).
9.5.9.4 TFT
This IE is included in the message to provide the MS with uplink and downlink packet filters when the protocol
configuration options information element indicates the selected Bearer Control Mode 'MS/NW'.


3GPP TS 24.161 [158].

MS and the network end-to-end for the PDN connection (see subclause 6.1.3.7). This IE is also included to indicate the
selected Bearer Control Mode to be applied when the extended protocol configuration options IE is supported by both
the MS and the network end-to-end for the PDN connection (see subclause 6.1.3.7).

9.5.10 Modify PDP context request (MS to network direction)

This message is sent by the MS to the network to request modification of an active PDP context. See table 9.5.10/3GPP
TS 24.008.
Message type: MODIFY PDP CONTEXT REQUEST (MS TO NETWORK DIRECTION)
ETSI
Release 18 477 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.5.10/3GPP TS 24.008: MODIFY PDP CONTEXT REQUEST (MS to network direction) message
content

10.2
10.3.2
Modify PDP context request Message type M V 1
32 Requested LLC SAPI LLC service access point identifier O TV 2
10.5.6.9
30 Requested new QoS Quality of service O TLV 14-22
10.5.6.5
31 New TFT Traffic Flow Template O TLV 3-257
10.5.6.12
10.5.6.3
10.5.7.8
10.5.6.21
options options
10.5.6.3a
10.5.6.5B
9.5.10.1 Requested LLC SAPI

This IE may be included in the message to request a new LLC SAPI if a new QoS is requested.
9.5.10.2 Requested new QoS

This IE may be included in the message to request a modification of the QoS.
9.5.10.3 New TFT

This IE may be included in the message to request a new TFT or modification of an existing TFT or transfer extra
parameters to the network (e.g. the Authorization Token; see 3GPP TS 24.229 [95]).



3GPP TS 24.161 [158].
ETSI
Release 18 478 3GPP TS 24.008 V18.4.0 (2023-09)


9.5.11 Modify PDP context accept (MS to network direction)

This message is sent by the MS to the network to acknowledge the modification of an active PDP context. See
table 9.5.11/3GPP TS 24.008.
Message type: MODIFY PDP CONTEXT ACCEPT (MS TO NETWORK DIRECTION)
Table 9.5.11/3GPP TS 24.008: MODIFY PDP CONTEXT ACCEPT (MS TO NETWORK DIRECTION)
message content

10.2
10.3.2
Modify PDP context accept Message type M V 1
10.5.6.3
10.5.6.21
options options
10.5.6.3a


3GPP TS 24.161 [158].

ETSI
Release 18 479 3GPP TS 24.008 V18.4.0 (2023-09)
9.5.12 Modify PDP context accept (Network to MS direction)

This message is sent by the network to the MS to acknowledge the modification of an active PDP context. See
table 9.5.12/3GPP TS 24.008.
Message type: MODIFY PDP CONTEXT ACCEPT (NETWORK TO MS DIRECTION)
Direction: Network to MS
Table 9.5.12/3GPP TS 24.008: MODIFY PDP CONTEXT ACCEPT (NETWORK to MS direction) message
content

Protocol discriminator Protocol discriminator M V ½
10.2
Transaction identifier Transaction identifier M V ½– 3/2
10.3.2
Modify PDP context accept Message type M V 1
30 Negotiated QoS Quality of service O TLV 14-22
10.5.6.5
32 Negotiated LLC SAPI LLC service access point identifier O TV 2
10.5.6.9
8 New radio priority Radio priority O TV 1
10.5.7.2
10.5.6.11
10.5.6.3
10.5.6.20
10.5.6.21
options options
10.5.6.3a
10.5.6.5B
9.5.12.1 Negotiated QoS

This IE is included in the message if the network assigns a new QoS.
9.5.12.2 Negotiated LLC SAPI

This IE is included in the message if the network assigns a new LLC SAPI.
9.5.12.3 New radio priority

This IE is included in the message only if the network modifies the radio priority.

If this IE is not included, the MS shall keep the old Packet Flow Identifier value.If the MS has not indicated PFC
procedure support, then it shall ignore this IE, if received.
ETSI
Release 18 480 3GPP TS 24.008 V18.4.0 (2023-09)



3GPP TS 24.161 [158].


9.5.13 Modify PDP Context Reject

This message is sent by the network or the MS to reject a modification of an active PDP context. See Table
9.5.13/3GPP TS 24.008.
Message type: MODIFY PDP CONTEXT REJECT
Direction: both
Table 9.5.13/3GPP TS 24.008: MODIFY PDP CONTEXT REJECT message content

10.2
10.3.2
Modify PDP Context Reject Message type M V 1
10.4
10.5.6.6
10.5.6.3
10.5.7.4a
10.5.6.5A
10.5.6.21
options options
10.5.6.3a
ETSI
Release 18 481 3GPP TS 24.008 V18.4.0 (2023-09)


The network may include this IE to request a minimum time interval before procedure retry is allowed.

The network may include this IE only if it includes the Back-off timer value IE and the SM cause value is not #26
"insufficient resources".

3GPP TS 24.161 [158].

9.5.14 Deactivate PDP context request

This message is sent to request deactivation of an active PDP context or an active MBMS context. See
table 9.5.14/3GPP TS 24.008.
Message type: DEACTIVATE PDP CONTEXT REQUEST
Direction: both
Table 9.5.14/3GPP TS 24.008: DEACTIVATE PDP CONTEXT REQUEST message content

10.2
10.3.2
Deactivate PDP context request Message type M V 1
10.5.6.6
9- Tear down indicator Tear down indicator O TV 1
10.5.6.10
10.5.6.3
35 MBMS protocol configuration MBMS protocol configuration options O TLV 3 – 253
options 10.5.6.15
37 T3396 value GPRS timer 3 O TLV 3
10.5.7.4a
10.5.6.20
options options
10.5.6.3a
ETSI
Release 18 482 3GPP TS 24.008 V18.4.0 (2023-09)
9.5.14.1 Tear down indicator

This IE is included in the message in order to indicate whether only the PDP context associated with this specific TI or
all active PDP contexts sharing the same PDP address and APN as the PDP context associated with this specific TI shall
be deactivated.
If this IE is received for an MBMS context, it shall be ignored by the receiver.

This IE is included in the message when the MS or the network wishes to transmit (protocol) data (e.g. configuration
parameters, error codes or messages/events) to the peer entity and the extended protocol configuration options IE is not
supported by the MS or the network or both end-to-end for the PDN connection (see subclause 6.1.3.7).

This IE is included in the message when the MS or the network wishes to transmit MBMS bearer related (protocol) data
(e.g. configuration parameters, error codes or messages/events) to the peer entity for an MBMS context.
If the IE is received for a PDP context, it shall be ignored by the receiver.
9.5.14.4 T3396 value

The network may include this IE if the ESM cause is #26 "insufficient resources".

of the associated PDN connection to WLAN(s), as specified in subclause 10.5.6.20. If the SGSN wishes to deactivate
all PDP contexts of a PDN connection, SGSN shall not include this IE.
9.5.14.6 Void

parameters, error codes or messages/events) to the peer entity and the extended protocol configuration options IE is
9.5.15 Deactivate PDP context accept

This message is sent to acknowledge deactivation of the PDP context requested in the corresponding Deactivate PDP
context request message. See table 9.5.15/3GPP TS 24.008.
Message type: DEACTIVATE PDP CONTEXT ACCEPT
Direction: both
ETSI
Release 18 483 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.5.15/3GPP TS 24.008: DEACTIVATE PDP CONTEXT ACCEPT message content

10.2
10.3.2
Deactivate PDP context accept Message type M V 1
10.5.6.3
options 10.5.6.15
options options
10.5.6.3a

parameters, error codes or messages/events) to the peer entity and the extended protocol configuration options IE is not

This IE is included in the message when the MS or the network wishes to transmit MBMS bearer related (protocol) data
(e.g. configuration parameters, error codes or messages/events) to the peer entity for an MBMS context.
If the IE is received for a PDP context, it shall be ignored by the receiver.
9.5.15.3 Void

parameters, error codes or messages/events) to the peer entity and the extended protocol configuration options IE is
supported by both the MS and the network end-to-end for the PDN connection (see subclause 6.1.3.7).
9.5.15a Request Secondary PDP Context Activation

This message is sent by the network to the MS to request activation of a secondary PDP context.
See table 9.5.15a/3GPP TS 24.008.
Message type: REQUEST SECONDARY PDP CONTEXT ACTIVATION
ETSI
Release 18 484 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.5.15a/3GPP TS 24.008: REQUEST SECONDARY PDP CONTEXT ACTIVATION message

content

10.2
10.3.2
Request secondary PDP context Message type M V 1
activation message identity 10.4
Required QoS Quality of service M LV 13-21
10.5.6.5
Linked TI Linked TI M LV 2-3
10.5.6.7
36 TFT Traffic Flow Template O TLV 3-257
10.5.6.12
10.5.6.3
10.5.6.20
10.5.6.21
options options
10.5.6.3a
10.5.6.5B
9.5.15a.1 TFT
The network shall include this IE. This IE provides the MS with uplink and downlink packet filters.
9.5.15a.2 Protocol configuration options

error codes or messages/events) to the MS end-to-end for the PDN connection (see subclause 6.1.3.7).
9.5.15a.3 WLAN offload indication

9.5.15a.4 NBIFOM container

3GPP TS 24.161 [158].
9.5.15a.5 Extended protocol configuration options

9.5.15a.6 Extended QoS

ETSI
Release 18 485 3GPP TS 24.008 V18.4.0 (2023-09)
9.5.15b Request Secondary PDP Context Activation Reject

This message is sent by the MS to the network to reject the request of a secondary PDP context activation.
See table 9.5.15b/3GPP TS 24.008.
Message type: REQUEST SECONDARY PDP CONTEXT ACTIVATION REJECT
Table 9.5.15b/3GPP TS 24.008: REQUEST SECONDARY PDP CONTEXT ACTIVATION REJECT

message content

10.2
10.3.2
Request secondary PDP context Message type M V 1
activation reject message identity 10.4
10.5.6.6
10.5.6.3
10.5.6.21
options options
10.5.6.3a
9.5.15b.1 Protocol configuration options

codes or messages/events) to the network end-to-end for the PDN connection (see subclause 6.1.3.7).
9.5.15b.2 NBIFOM container

3GPP TS 24.161 [158].
9.5.15b.3 Extended protocol configuration options

9.5.16 Void
9.5.16a Notification
This message is sent by the network to inform the MS about events which are relevant for the upper layer using the PDP
context or having requested a session management procedure. See table 9.5.16a/3GPP TS 24.008.
Message type: NOTIFICATION
Significance: local
ETSI
Release 18 486 3GPP TS 24.008 V18.4.0 (2023-09)
Table 9.5.16a/3GPP TS 24.008: NOTIFICATION message content

10.2
10.3.2
Notification message identity Message type M V 1
10.4
Notification indicator Notification indicator M LV 2
10.5.6.18
9.5.17 Void
9.5.18 Void
9.5.19 Void
9.5.20 Void
9.5.21 SM Status
This message is sent by the network or the MS to pass information on the status of the indicated context and report
certain error conditions (eg. as listed in clause 8). See table 9.5.21/3GPP TS 24.008.
Message type: SM Status
Significance: local
Direction: both
Table 9.5.21/3GPP TS 24.008: SM STATUS message content

10.2
10.3.2
SM Status message identity Message type M V 1
10.4
SM Cause SM Cause M V 1
10.5.6.6
9.5.22 Activate MBMS Context Request

This message is sent by the MS to the network as an explicit response to a Request MBMS Context Activation message
Message type: ACTIVATE MBMS CONTEXT REQUEST
ETSI
Release 18 487 3GPP TS 24.008 V18.4.0 (2023-09)
TABLE 9.5.22 : ACTIVATE MBMS CONTEXT REQUEST message content
IEI Information Element Type/ Presence Format Length

10.2
10.3.2
Activate MBMS context request Message type M V 1
Requested MBMS NSAPI Enhanced Network service access M V 1
point identifier 10.5.6.16
10.5.6.9
Supported MBMS bearer MBMS bearer capabilities M LV 2–3
capabilities 10.5.6.14
Requested multicast address Packet data protocol address M LV 3 - 23
10.5.6.4
Access point name Access point name M LV 2 – 101
10.5.6.1
35 MBMS protocol configuration MBMS protocol configuration options O TLV 3 - 253
options 10.5.6.15
10.5.7.8
NOTE: The MBMS NSAPI will be used in Iu mode when the network chooses a point-to-point MBMS bearer for
the transfer of MBMS data in the user plane.

This IE is included in the message when the MS wishes to transmit MBMS bearer related (protocol) data (e.g.
configuration parameters, error codes or messages/events) to the peer entity for an MBMS context.

9.5.23 Activate MBMS Context Accept

This message is sent by the network to the MS to acknowledge activation of an MBMS context.
Message type: ACTIVATE MBMS CONTEXT ACCEPT
TABLE 9.5.23 : ACTIVATE MBMS CONTEXT ACCEPT message content

10.2
10.3.2
Activate MBMS context accept Message type M V 1
Temporary Mobile Group Identity Temporary Mobile Group Identity M LV 4-7
10.5.6.13
10.5.6.9
options 10.5.6.15
ETSI
Release 18 488 3GPP TS 24.008 V18.4.0 (2023-09)

This IE is included in the message when the network wishes to transmit MBMS bearer related (protocol) data (e.g.
9.5.24 Activate MBMS Context Reject

This message is sent by the network to the MS to reject activation of a MBMS context.
Message type: ACTIVATE MBMS CONTEXT REJECT
TABLE 9.5.24 : ACTIVATE MBMS CONTEXT REJECT message content

10.2
10.3.2
Activate MBMS context reject Message type M V 1
10.5.6.6
options 10.5.6.15
10.5.7.4a
10.5.6.5A


The network may include this IE to request a minimum time interval before procedure retry is allowed.

The network may include this IE only if the network includes the Back-off timer value IE and the SM cause value is not
#26 "insufficient resources".
9.5.25 Request MBMS Context Activation

This message is sent by the network to the MS to initiate activation of an MBMS context.
Message type: REQUEST MBMS CONTEXT ACTIVATION
ETSI
Release 18 489 3GPP TS 24.008 V18.4.0 (2023-09)
TABLE 9.5.25 : REQUEST MBMS CONTEXT ACTIVATION message content

10.2
10.3.2
Request MBMS context activation Message type M V 1
Linked NSAPI Network service access point M V 1
identifier 10.5.6.2
Offered Multicast address Packet data protocol address M LV 3 - 23
10.5.6.4
Access point name Access point name M LV 2 – 101
10.5.6.1
options 10.5.6.15
9.5.25.1 Linked NSAPI

This IE is included in the message to allow the MS to associate the MBMS context with the PDP context over which the
IGMP/MLD join message was sent.

9.5.26 Request MBMS Context Activation Reject

This message is sent by the MS to the network to reject initiation of an MBMS context activation.
Message type: REQUEST MBMS CONTEXT ACTIVATION REJECT
TABLE 9.5.26 : REQUEST MBMS CONTEXT ACTIVATION REJECT message content

10.2
10.3.2
Request MBMS context act. reject Message type M V 1
10.5.6.6
options 10.5.6.15

This IE is included in the message when the MS wishes to transmit MBMS bearer related (protocol) data (e.g.
ETSI
Release 18 490 3GPP TS 24.008 V18.4.0 (2023-09)
10 General message format and information elements

coding
The figures and text in this clause describe the Information Elements contents.
10.1 Overview
Within the Layer 3 protocols defined in 3GPP TS 24.008, every message is a standard L3 message as defined in 3GPP
TS 24.007 [20]. This means that the message consists of the following parts:
a) protocol discriminator;
b) transaction identifier;
c) message type;
d) other information elements, as required.
This organization is illustrated in the example shown in figure 10.1/3GPP TS 24.008.
Figure 10.1/3GPP TS 24.008 General message organization example
Unless specified otherwise in the message descriptions of clause 9, a particular information element shall not be present
more than once in a given message.
The term "default" implies that the value defined shall be used in the absence of any assignment, or that this value
allows negotiation of alternative values in between the two peer entities.
When a field extends over more than one octet, the order of bit values progressively decreases as the octet number
increases. The least significant bit of the field is represented by the lowest numbered bit of the highest numbered octet
of the field.
10.2 Protocol Discriminator

The Protocol Discriminator (PD) and its use are defined in 3GPP TS 24.007 [20].
10.3 Skip indicator and transaction identifier

10.3.1 Skip indicator
Bits 5 to 8 of the first octet of every Mobility Management message and GPRS MobilityManagement message contains
the skip indicator.
With the exception of the following cases for a shared GERAN network in A/Gb mode,
- when the MS is sending a LOCATION UPDATING REQUEST, CM SERVICE REQUEST, IMSI DETACH
INDICATION or CM RE-ESTABLISHMENT REQUEST message; or
ETSI
Release 18 491 3GPP TS 24.008 V18.4.0 (2023-09)
- when the network is receiving a LOCATION UPDATING REQUEST, PAGING RESPONSE, CM SERVICE
REQUEST, IMSI DETACH INDICATION or CM RE-ESTABLISHMENT REQUEST message,
the skip indicator field shall be handled as follows:
a) A message received with skip indicator different from 0000 shall be ignored. A message received with skip
indicator encoded as 0000 shall not be considered an error that causes the message to be ignored.
b) A protocol entity sending a Mobility Management message or a GPRS Mobility Management message shall
encode the skip indicator as 0000.
In a shared GERAN network in A/Gb mode:
a) When the MS is sending a LOCATION UPDATING REQUEST, CM SERVICE REQUEST, IMSI DETACH
INDICATION or CM RE-ESTABLISHMENT REQUEST message,
- if the MS is a GERAN network sharing supporting MS, the MS shall encode the skip indicator IE to indicate
the chosen PLMN identity from the PLMN identities in the broadcast system information (see
3GPP TS 44.018 [84]) according to table 10.3.1;
- otherwise, the MS shall encode the skip indicator as 0000.
b) When the network is receiving a LOCATION UPDATING REQUEST, PAGING RESPONSE, CM SERVICE
REQUEST, IMSI DETACH INDICATION or CM RE-ESTABLISHMENT REQUEST message,
- if the skip indicator is encoded as 0000, the message shall not be considered an error that causes the message
to be ignored;
- if the skip indicator is different from 0000, the message shall not be considered an error and shall be
processed by the receiving MM entity. The MS shall be considered as GERAN network sharing supporting
MS.
NOTE: The skip indicator handling of PAGING RESPONSE message on the MS and the BSS is specified in
3GPP TS 44.018 [84].
8 7 6 5 4 3 2 1
Skip indicator - - - - octet 1
Figure 10.3.1: Skip indicator
Table 10.3.1/3GPP TS 24.008: Skip indicator
Bits
8 7 6 5
0 0 0 0 Skip Indicator without indication of selected PLMN
0 0 0 1 PLMN identity of the Common PLMN in the broadcast system information
0 0 1 0 PLMN identity of the first Additional PLMN in the broadcast system information
0 0 1 1 PLMN identity of the second Additional PLMN in the broadcast system information
0 1 0 0 PLMN identity of the third Additional PLMN in the broadcast sytem information
0 1 0 1 PLMN identity of the fourth Additional PLMN in the broadcast system information
0 1 1 0 Reserved
0 1 1 1 Reserved
All other values shall be interpreted as "Skip Indicator without indication of selected PLMN".
Value 0000 indicates no indication of selected PLMN from the MS, which happens in UTRAN, or non-
shared GERAN or Multi-Operator Core Network (MOCN) with common GERAN configurations or in a
shared GERAN if the MS does not support GERAN network sharing.
ETSI
Release 18 492 3GPP TS 24.008 V18.4.0 (2023-09)
10.3.2 Transaction identifier

Bits 5 to 8 of the first octet of every message belonging to the protocols "Call Control; call related SS messages" and
"Session Management"contain the transaction identifier (TI). The transaction identifier and its use are defined in 3GPP
TS 24.007 [20].
For the session management protocol, the extended TI mechanism may be used (see 3GPP TS 24.007 [20]).
For the call control protocol, the extended TI mechanism shall be supported for the purpose of protocol error handling
as specified in subclause 8.3.1
10.4 Message Type

The message type IE and its use are defined in 3GPP TS 24.007 [20]. Tables 10.3/3GPP TS 24.008,
10.4/3GPP TS 24.008, and 10.4a/3GPP TS 24.008 define the value part of the message type IE used in the Mobility
Management protocol, the Call Control protocol, and Session management protocol.
Table 10.2/3GPP TS 24.008: Message types for Mobility Management
8 7 6 5 4 3 2 1
x x 0 0 - - - - Registration messages:
0 0 0 1 - IMSI DETACH INDICATION
0 0 1 0 - LOCATION UPDATING ACCEPT
0 1 0 0 - LOCATION UPDATING REJECT
1 0 0 0 - LOCATION UPDATING REQUEST
x x 0 1 - - - - Security messages:
0 0 0 1 - AUTHENTICATION REJECT
0 0 1 0 - AUTHENTICATION REQUEST
0 1 0 0 - AUTHENTICATION RESPONSE
1 1 0 0 - AUTHENTICATION FAILURE…………..
1 0 0 0 - IDENTITY REQUEST
1 0 0 1 - IDENTITY RESPONSE
1 0 1 0 - TMSI REALLOCATION COMMAND
1 0 1 1 - TMSI REALLOCATION COMPLETE
x x 1 0 - - - - Connection management messages:

0 0 0 1 - CM SERVICE ACCEPT
0 0 1 0 - CM SERVICE REJECT
0 0 1 1 - CM SERVICE ABORT
0 1 0 0 - CM SERVICE REQUEST
0 1 0 1 - CM SERVICE PROMPT
0 1 1 0 - Reserved (see NOTE)
1 0 0 0 - CM RE-ESTABLISHMENT REQUEST
1 0 0 1 - ABORT
x x 1 1 - - - - Miscellaneous messages:
0 0 0 0 - MM NULL
0 0 0 1 - MM STATUS
0 0 1 0 - MM INFORMATION
NOTE: This value was allocated but never used in earlier phases of the protocol.
When the radio connection started with a core network node of earlier than R99, bit 8 shall be set to 0 and bit 7 is
reserved for the send sequence number in messages sent from the mobile station. In messages sent from the network,
bits 7 and 8 are coded with a "0". See 3GPP TS 24.007 [20].
When the radio connection started with a core network node of R'99 or later, bits 7 and 8 are reserved for the send
sequence number in messages sent from the mobile station. In messages sent from the network, bits 7 and 8 are coded
with a "0". See 3GPP TS 24.007 [20].
ETSI
Release 18 493 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.3/3GPP TS 24.008: Message types for Call Control and call related SS messages
8 7 6 5 4 3 2 1
x x 0 0 0 0 0 0 escape to nationally specific
message types; see 1) below
x x 0 0 - - - - Call establishment messages:

0 0 0 1 - ALERTING
1 0 0 0 - CALL CONFIRMED
0 0 1 0 - CALL PROCEEDING
0 1 1 1 - CONNECT
1 1 1 1 - CONNECT ACKNOWLEDGE
1 1 1 0 - EMERGENCY SETUP
0 0 1 1 - PROGRESS
0 1 0 0 - CC-ESTABLISHMENT
0 1 1 0 - CC-ESTABLISHMENT CONFIRMED
1 0 1 1 - RECALL
1 0 0 1 - START CC
0 1 0 1 - SETUP
x x 0 1 - - - - Call information phase messages:

0 1 1 1 - MODIFY
1 1 1 1 - MODIFY COMPLETE
0 0 1 1 - MODIFY REJECT
0 0 0 0 - USER INFORMATION
1 0 0 0 - HOLD
1 0 0 1 - HOLD ACKNOWLEDGE
1 0 1 0 - HOLD REJECT
1 1 0 0 - RETRIEVE
1 1 0 1 - RETRIEVE ACKNOWLEDGE
1 1 1 0 - RETRIEVE REJECT
x x 1 0 - - - - Call clearing messages:

0 1 0 1 - DISCONNECT
1 1 0 1 - RELEASE
1 0 1 0 - RELEASE COMPLETE
x x 1 1 - - - - Miscellaneous messages:
1 0 0 1 - CONGESTION CONTROL
1 1 1 0 - NOTIFY
1 1 0 1 - STATUS
0 1 0 0 - STATUS ENQUIRY
0 1 0 1 - START DTMF
0 0 0 1 - STOP DTMF
0 0 1 0 - STOP DTMF ACKNOWLEDGE
0 1 1 0 - START DTMF ACKNOWLEDGE
0 1 1 1 - START DTMF REJECT
1 0 1 0 - FACILITY
1): When used, the message type is defined in the following octet(s), according to the national specification.
When the radio connection started with a core network node of earlier than R99, bit 8 shall be set to 0 and bit 7 is
reserved for the send sequence number in messages sent from the mobile station. In messages sent from the network,
bits 7 and 8 are coded with a "0". See 3GPP TS 24.007 [20].
When the radio connection started with a core network node of R'99 or later, bits 7 and 8 are reserved for the send
sequence number in messages sent from the mobile station. In messages sent from the network, bits 7 and 8 are coded
with a "0". See 3GPP TS 24.007 [20].
ETSI
Release 18 494 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.4/3GPP TS 24.008: Message types for GPRS mobility management
Bits
8 7 6 5 4 3 2 1
0 0 - - - - - - Mobility management messages
0 0 0 0 0 0 0 1 Attach request
0 0 0 0 0 0 1 0 Attach accept
0 0 0 0 0 0 1 1 Attach complete
0 0 0 0 0 1 0 0 Attach reject
0 0 0 0 0 1 0 1 Detach request
0 0 0 0 0 1 1 0 Detach accept
0 0 0 0 1 0 0 0 Routing area update request

0 0 0 0 1 0 0 1 Routing area update accept
0 0 0 0 1 0 1 0 Routing area update complete
0 0 0 0 1 0 1 1 Routing area update reject
0 0 0 0 1 1 0 0 Service Request
0 0 0 0 1 1 0 1 Service Accept
0 0 0 0 1 1 1 0 Service Reject
0 0 0 1 0 0 0 0 P-TMSI reallocation command

0 0 0 1 0 0 0 1 P-TMSI reallocation complete
0 0 0 1 0 0 1 0 Authentication and ciphering req
0 0 0 1 0 0 1 1 Authentication and ciphering resp
0 0 0 1 0 1 0 0 Authentication and ciphering rej
0 0 0 1 1 1 0 0 Authentication and ciphering failure
0 0 0 1 0 1 0 1 Identity request
0 0 0 1 0 1 1 0 Identity response
0 0 1 0 0 0 0 0 GMM status
0 0 1 0 0 0 0 1 GMM information
ETSI
Release 18 495 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.4a/3GPP TS 24.008: Message types for GPRS session management
Bits
8 7 6 5 4 3 2 1
0 1 - - - - - - Session management messages
0 1 0 0 0 0 0 1 Activate PDP context request

0 1 0 0 0 0 1 0 Activate PDP context accept
0 1 0 0 0 0 1 1 Activate PDP context reject
0 1 0 0 0 1 0 0 Request PDP context activation

0 1 0 0 0 1 0 1 Request PDP context activation rej.
0 1 0 0 0 1 1 0 Deactivate PDP context request
0 1 0 0 0 1 1 1 Deactivate PDP context accept
0 1 0 0 1 0 0 0 Modify PDP context request(Network to MS direction)
0 1 0 0 1 0 0 1 Modify PDP context accept (MS to network direction)
0 1 0 0 1 0 1 0 Modify PDP context request(MS to network direction)
0 1 0 0 1 0 1 1 Modify PDP context accept (Network to MS direction)
0 1 0 0 1 1 0 0 Modify PDP context reject
0 1 0 0 1 1 0 1 Activate secondary PDP context request

0 1 0 0 1 1 1 0 Activate secondary PDP context accept
0 1 0 0 1 1 1 1 Activate secondary PDP context reject
0 1 0 1 0 0 0 0 Reserved: was allocated in earlier phases of the protocol

0 1 0 1 0 1 0 1 SM Status
0 1 0 1 0 1 1 0 Activate MBMS Context Request

0 1 0 1 0 1 1 1 Activate MBMS Context Accept
0 1 0 1 1 0 0 0 Activate MBMS Context Reject
0 1 0 1 1 0 0 1 Request MBMS Context Activation
0 1 0 1 1 0 1 0 Request MBMS Context Activation Reject
0 1 0 1 1 0 1 1 Request Secondary PDP Context Activation

0 1 0 1 1 1 0 0 Request Secondary PDP Context Activation Reject
0 1 0 1 1 1 0 1 Notification
10.5 Other information elements

The different formats (V, LV, T, TV, TLV) and the five categories of information elements (type 1, 2, 3, 4, and 6) are
defined in 3GPP TS 24.007 [20].
The first octet of an information element in the non-imperative part contains the IEI of the information element. If this
octet does not correspond to an IEI known in the message, the receiver shall determine whether this IE is of type 1 or 2
(i.e. it is an information element of one octet length), an IE of type 4 (i.e. that the next octet is the length indicator
indicating the length of the remaining of the information element) or an IE of type 6 (i.e. that the next 2 octets are the
length indicator indicating the length of the remaining of the information element (see 3GPP TS 24.007 [20]).
This allows the receiver to jump over unknown information elements and to analyse any following information
elements.
The information elements which are common for at least two of the three protocols Radio Resources management,
Mobility Management and Call Control, are listed in subclause 10.5.1.
The information elements for the protocols Mobility Management and Call Control are listed in subclauses 10.5.3 and
10.5.4 respectively. Default information element identifiers are listed in annex K.
ETSI
Release 18 496 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE: Different information elements may have the same default information element identifier if they belong to
different protocols.
The descriptions of the information element types in subclauses 10.5.1, 10.5.3, and 10.5.4 are organized in alphabetical
order of the IE types. Each IE type is described in one subclause.
The subclause may have an introduction:
- possibly explaining the purpose of the IE;
- possibly describing whether the IE belongs to type 1, 2, 3, 4 or 5;
- possibly indicating the length that the information element has if it is either type 5 or if it is used in format TV
(type 1 and 3) or TLV (type 4).
A figure of the subclause defines the structure of the IE indicating:
- possibly the position and length of the IEI. (However it depends on the message in which the IE occurs whether
the IE contains an IEI.);
- the fields the IE value part is composed of;
- possibly the position and length of the length indicator. (However it depends on the IE type whether the IE
contains a length indicator or not.);
- possibly octet numbers of the octets that compose the IE (see clause a) below).
Finally, the subclause contains tables defining the structure and value range of the fields that compose the IE value part.
The order of appearance for information elements in a message is defined in clause 9.
The order of the information elements within the imperative part of messages has been chosen so that information
elements with 1/2 octet of content (type 1) go together in succession. The first type 1 information element occupies bits
1 to 4 of octet N, the second bits 5 to 8 of octet N, the third bits 1 to 4 of octet N + 1 etc. If the number of type 1
information elements is odd then bits 5 to 8 of the last octet occupied by these information elements contains a spare
half octet IE in format V.
Where the description of information elements in the present document contains bits defined to be "spare bits", these
bits shall set to the indicated value (0 or 1) by the sending side, and their value shall be ignored by the receiving side.
With few exceptions, spare bits are indicated as being set to "0" in 3GPP TS 24.008.
10.5.1 Common information elements.
10.5.1.1 Cell identity

The purpose of the Cell Identity information element is to identify a cell within a location area.
The Cell Identity information element is coded as shown in figure 10.5.1/3GPP TS 24.008 and table 10.5.1/3GPP TS
24.008.
The Cell Identity is a type 3 information element with 3 octets length.
8 7 6 5 4 3 2 1
Cell Identity IEI octet 1
CI value octet 2
CI value (continued) octet 3
Figure 10.5.1/3GPP TS 24.008 Cell Identity information element
ETSI
Release 18 497 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.1/3GPP TS 24.008: Cell Identity information element
CI value, Cell identity value (octet 2 and 3)
In the CI value field bit 8 of octet 2 is the most significant bit and bit 1 of octet 3 the
least significant bit.
The coding of the cell identity is the responsibility of each administration. Coding
using full hexadecimal representation may be used.
The cell identity consists of 2 octets.
10.5.1.2 Ciphering Key Sequence Number

In a GSM authentication challenge, the purpose of the Ciphering Key Sequence Number information element is to make
it possible for the network to identify the ciphering key Kc which is stored in the mobile station without invoking the
authentication procedure.
The ciphering key sequence number is allocated by the network and sent with the AUTHENTICATION REQUEST or
AUTHENTICATION AND CIPHERING REQUEST message to the mobile station where it is stored together with the
calculated keys, e.g. Kc, CK, IK, Kc128, Kint.
The Ciphering Key Sequence Number information element is coded as shown in figure 10.5.2/3GPP TS 24.008 and
table 10.5.2/3GPP TS 24.008.
In a UMTS authentication challenge, the purpose of the Ciphering Key Sequence Number information element is to
make it possible for the network to identify the ciphering key CK and integrity key IK which are stored in the MS
without invoking the authentication procedure. CK and IK form a Key Set Identifier (KSI) (see 3GPP TS 33.102 [5a])
which is encoded the same as the CKSN and is therefore included in the CKSN field.
The ciphering key sequence number is a type 1 information element.
8 7 6 5 4 3 2 1
Ciphering Key key sequence octet 1
Sequence Number 0
IEI spare
Figure 10.5.2/3GPP TS 24.008 Ciphering Key Sequence Number information element
Table 10.5.2/3GPP TS 24.008: Ciphering Key Sequence Number information element
Key sequence (octet 1)
Bits
3 2 1
0 0 0
through Possible values for the ciphering key
1 1 0 sequence number
1 1 1 No key is available (MS to network);

Reserved (network to MS)
10.5.1.3 Location Area Identification

The purpose of the Location Area Identification information element is to provide an unambiguous identification of
location areas within the area covered by the 3GPP system.
The Location Area Identification information element is coded as shown in figure 10.5.3/3GPP TS 24.008 and
table 10.5.3/3GPP TS 24.008.
ETSI
Release 18 498 3GPP TS 24.008 V18.4.0 (2023-09)
The Location Area Identification is a type 3 information element with 6 octets length.
8 7 6 5 4 3 2 1
Location Area Identification IEI octet 1
MCC digit 2 MCC digit 1 octet 2
MNC digit 3 MCC digit 3 octet 3
MNC digit 2 MNC digit 1 octet 4
LAC octet 5
LAC (continued) octet 6
Figure 10.5.3/3GPP TS 24.008 Location Area Identification information element
ETSI
Release 18 499 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.3/3GPP TS 24.008: Location Area Identification information element
MCC, Mobile country code (octet 2 and 3)

The MCC field is coded as in ITU-T Rec. E212, Annex A.
If the LAI is deleted the MCC and MNC shall take the value from the deleted LAI.
In abnormal cases, the MCC stored in the mobile station can contain elements not
in the set {0, 1 ... 9}. In such cases the mobile station should transmit the stored
values using full hexadecimal encoding. When receiving such an MCC, the network
shall treat the LAI as deleted.
MNC, Mobile network code (octet 3 bits 5 to 8, octet 4)

The coding of this field is the responsibility of each administration but BCD coding
shall be used. The MNC shall consist of 2 or 3 digits. For PCS 1900 for NA, Federal
regulation mandates that a 3-digit MNC shall be used. However a network operator
may decide to use only two digits in the MNC in the LAI over the radio interface. In
this case, bits 5 to 8 of octet 3 shall be coded as "1111". Mobile equipment shall
accept LAI coded in such a way.
NOTE 1: In earlier versions of this protocol, the possibility to use a one digit MNC
in LAI was provided on the radio interface. However as this was not used
this possibility has been deleted.
NOTE 2: In earlier versions of this protocol, bits 5 to 8 of octet 3 were coded as

"1111". Mobile equipment compliant with these earlier versions of the
protocol may be unable to understand the 3-digit MNC format of the LAI,
and therefore unable to register on a network broadcasting the LAI in this
format.
In abnormal cases, the MNC stored in the mobile station can have:
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ... 9, F} hex.
In such cases the mobile station shall transmit the stored values using full
hexadecimal encoding. When receiving such an MNC, the network shall treat the
LAI as deleted.
The same handling shall apply for the network, if a 3-digit MNC is sent by the
mobile station to a network using only a 2-digit MNC.
LAC, Location area code (octet 5 and 6)

In the LAC field bit 8 of octet 5 is the most significant bit and bit 1 of octet 6 the
The coding of the location area code is the responsibility of each administration
except that two values are used to mark the LAC, and hence the LAI, as deleted.
Coding using full hexadecimal representation may be used. The location area code
consists of 2 octets.
If a LAI has to be deleted then all bits of the location area code shall be set to one
with the exception of the least significant bit which shall be set to zero. If a
SIM/USIM is inserted in a Mobile Equipment with the location area code containing
all zeros, then the Mobile Equipment shall recognise this LAC as part of a deleted
LAI
10.5.1.4 Mobile Identity

The purpose of the Mobile Identity information element is to provide either the international mobile subscriber identity,
IMSI, the temporary mobile subscriber identity, TMSI/P-TMSI/M-TMSI, the international mobile equipment identity,
IMEI, the international mobile equipment identity together with the software version number, IMEISV, or the
temporary mobile group identity (TMGI), associated with the optional MBMS Session Identity.
The IMSI shall not exceed 15 digits, the TMSI/P-TMSI/M-TMSI is 4 octets long, and the IMEI is composed of 15
digits, the IMEISV is 16 digits (see 3GPP TS 23.003 [10]). The TMGI is at maximum 6 octets long and is defined in
subclause 10.5.6.13. The MBMS Session Identity, if included, is 1 octet long (see 3GPP TS 48.018 [86]).
ETSI
Release 18 500 3GPP TS 24.008 V18.4.0 (2023-09)
For packet paging the network shall select the mobile identity type with the following priority:
1- P-TMSI: The P-TMSI shall be used if it is available.
2- IMSI: The IMSI shall be used in cases where no P-TMSI is available.
For MBMS (pre-)notification (see 3GPP TS 44.018 [84] and 3GPP TS 44.060 [76]) the network shall select the mobile
identity type "TMGI and optional MBMS Session Identity".
NOTE 1: The type of identity "TMGI and optional MBMS Session Identity" is only used by the MBMS
(pre-)notification procedure in of A/Gb mode.
For all other transactions with the following exceptions:
- emergency call establishment, emergency call re-establishment, mobile terminated call establishment, the
identification procedure, the GMM identification procedure, the GMM authentication, GPRS attach, routing area
updating, and ciphering procedure and the ciphering mode setting procedure; and
- location updating when the MS is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or
3GPP TS 31.102 [112] and the selected PLMN is neither the registered PLMN nor in the list of equivalent
PLMNs;
the mobile station and the network shall select the mobile identity type with the following priority:
1- TMSI: The TMSI shall be used if it is available.
2- IMSI: The IMSI shall be used in cases where no TMSI is available.
For mobile terminated call establishment the mobile station shall select the same mobile identity type as received from
the network in the PAGING REQUEST message. In case of enhanced DTM CS establishment (see 3GPP TS 44.018
[84]) the mobile station shall select the mobile identity type with the following priority in the PAGING RESPONSE
message:
1- TMSI: The TMSI shall be used if it is available.
2- IMSI: The IMSI shall be used in cases where no TMSI is available.
For the PAGING RESPONSE message sent as a response to a paging for CS fallback, the MS shall:
- select the TMSI as mobile identity type if the network has, in E-UTRAN,
- paged the MS for CS fallback using the S-TMSI; or
- indicated TMSI in the CS SERVICE NOTIFICATION message (see 3GPP TS 24.301 [120]);
- select the IMSI as mobile identity type if the network has, in E-UTRAN,
- paged the MS for CS fallback using the IMSI; or
- indicated IMSI in the CS SERVICE NOTIFICATION message (see 3GPP TS 24.301 [120]).
For emergency call establishment and re-establishment the mobile station shall select the mobile identity type with the
following priority:
1- TMSI: The TMSI shall be used if it is available and if the location update status is UPDATED, and the stored
LAI is equal to the one received on the BCCH from the current serving cell.
2- IMSI: The IMSI shall be used in cases where no TMSI is available or TMSI is available but either the update
status is different from UPDATED, or the stored LAI is different from the one received on the BCCH from
the current serving cell.
3- IMEI: The IMEI shall be used in cases where no SIM/USIM is available or the SIM/USIM is considered as
not valid by the mobile station or no IMSI or TMSI is available.
In the identification procedure and in the GMM identification procedure the mobile station shall select the mobile
identity type which was requested by the network, if available. If the requested identity is not available, then the mobile
station shall indicate the identity type "No Identity".
ETSI
Release 18 501 3GPP TS 24.008 V18.4.0 (2023-09)
In the ciphering mode setting procedure and in the GMM authentication and ciphering procedure the mobile shall select
the IMEISV.
The Mobile Identity information element is coded as shown in figure 10.5.4/3GPP TS 24.008 and table 10.5.4/3GPP TS
24.008.
The Mobile Identity is a type 4 information element with a minimum length of 3 octet and 11 octets length maximal.
Further restriction on the length may be applied, e.g. number plans.
8 7 6 5 4 3 2 1
Mobile Identity IEI octet 1
Length of mobile identity contents octet 2

odd/
Identity digit 1 even Type of identity octet 3
indic
Identity digit p+1 Identity digit p octet 4*
Figure 10.5.4/3GPP TS 24.008 Mobile Identity information element
8 7 6 5 4 3 2 1
Mobile Identity IEI octet 1
Length of Mobile Identity contents octet 2
0 0 MBMS MCC/ odd/
Sess MNC even Type of identity octet 3
spare Id indic indic indic
octet 4
MBMS Service ID octet 5
octet 6
MCC digit 2 MCC digit 1 octet 6a*
MNC digit 3 MCC digit 3 octet 6b*
MNC digit 2 MNC digit 1 octet 6c*
MBMS Session Identity octet 7*
Figure 10.5.4a/3GPP TS 24.008: Mobile Identity information element for type of identity "TMGI and
optional MBMS Session Identity"
ETSI
Release 18 502 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.4/3GPP TS 24.008: Mobile Identity information element
ETSI
Release 18 503 3GPP TS 24.008 V18.4.0 (2023-09)
Type of identity (octet 3)

Bits
3 2 1
0 0 1 IMSI
0 1 0 IMEI
0 1 1 IMEISV
1 0 0 TMSI/P-TMSI/M-TMSI
1 0 1 TMGI and optional MBMS Session Identity
0 0 0 No Identity (note 1)
All other values are reserved.
Odd/even indication (octet 3)

Bit
4
0 even number of identity digits and also when the TMSI/P-TMSI or TMGI
and optional MBMS Session Identity is used
1 odd number of identity digits
Identity digits (octet 3 etc)
For the IMSI, IMEI and IMEISV this field is coded using BCD coding. If the number
of identity digits is even then bits 5 to 8 of the last octet shall be filled with an end
mark coded as "1111".
For Type of identity "No Identity", the Identity digit bits shall be encoded with all 0s
and the Length of mobile identity contents parameter shall be set to one of the
following values:
- "1" if the identification procedure is used (see subclause 9.2.11);
- "3" if the GMM identification procedure is used (see subclause 9.4.13)
- "3" if the EMM identification procedure is used (see 3GPP TS 24.301 [120])
If the mobile identity is the TMSI/P-TMSI/M-TMSI then bits 5 to 8 of octet 3 are

coded as "1111" and bit 8 of octet4 is the most significant bit and bit 1 of the last
octet the least significant bit. The coding of the TMSI/P-TMSI is left open for each
administration.
For type of identity "TMGI and optional MBMS Session Identity" the coding of octet
3 etc is as follows:
MCC/MNC indication (octet 3)

Bit
5
0 MCC/MNC is not present
1 MCC/MNC is present
MBMS Session Identity indication (octet 3)

Bit
6
0 MBMS Session Identity is not present
1 MBMS Session Identity is present
MBMS Service ID (octet 4, 5 and 6)
The contents of the MBMS Service ID field are coded as octets 3 to 5 of the
Temporary Mobile Group Identity IE in Figure 10.5.154/3GPP TS 24.008.
Therefore, bit 8 of octet 4 is the most significant bit and bit 1 of octet 6 the least
significant bit. The coding of the MBMS Service ID is the responsibility of each
administration. Coding using full hexadecimal representation may be used. The
MBMS Service ID consists of 3 octets.
MCC, Mobile country code (octet 6a, octet 6b bits 1 to 4)
The MCC field is coded as in ITU-T Rec. E.212 [46], Annex A.
ETSI
Release 18 504 3GPP TS 24.008 V18.4.0 (2023-09)
MNC, Mobile network code (octet 6b bits 5 to 8, octet 6c)
shall be used. The MNC shall consist of 2 or 3 digits. If a network operator decides
to use only two digits in the MNC, bits 5 to 8 of octet 6b shall be coded as "1111".
The MCC and MNC digits are coded as octets 6 to 8 of the Temporary Mobile
Group Identity IE in Figure 10.5.154/3GPP TS 24.008.
MBMS Session Identity (octet 7)
The MBMS Session Identity field is encoded as the value part of the MBMS
Session Identity IE as specified in 3GPP TS 48.018 [86].
NOTE 1: This can be used in the case when a fill paging message without any
valid identity has to be sent on the paging subchannel and when the
requested identity is not available at the mobile station during the identity
request procedure.
10.5.1.5 Mobile Station Classmark 1

The purpose of the Mobile Station Classmark 1 information element is to provide the network with information
concerning aspects of high priority of the mobile station equipment. This affects the manner in which the network
handles the operation of the mobile station. The Mobile Station Classmark information indicates general mobile station
characteristics and it shall therefore, except for fields explicitly indicated, be independent of the frequency band of the
channel it is sent on.
The Mobile Station Classmark 1 information element is coded as shown in figure 10.5.5/3GPP TS 24.008 and
table 10.5.5/3GPP TS 24.008.
The Mobile Station Classmark 1 is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
Mobile Station Classmark 1 IEI octet 1
0 Revision ES A5/1 RF power
spare level IND capability octet 2
Figure 10.5.5/3GPP TS 24.008 Mobile Station Classmark 1 information element
ETSI
Release 18 505 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.5/3GPP TS 24.008: Mobile Station Classmark 1 information element
ETSI
Release 18 506 3GPP TS 24.008 V18.4.0 (2023-09)
Revision level (octet 2)

Bits
7 6
0 0 Reserved for GSM phase 1
0 1 Used by GSM phase 2 mobile stations
1 0 Used by mobile stations supporting R99 or later versions of the protocol
1 1 Reserved for future use. If the network receives a revision level specified as
'reserved for future use', then it shall use the highest revision level supported
by the network.
ES IND (octet 2, bit 5) "Controlled Early Classmark Sending" option implementation

An MS not supporting A/Gb mode shall set this bit to '0’.
An MS supporting A/Gb mode shall indicate the associated capability (see table):
0 "Controlled Early Classmark Sending" option is not implemented in the MS

1 "Controlled Early Classmark Sending" option is implemented in the MS
NOTE 1: The value of the ES IND gives the implementation in the MS. It's value is not
dependent on the broadcast SI 3 Rest Octet <Early Classmark Sending
Control> value.
A5/1 algorithm supported (octet 2, bit4) (Note 2)

0 encryption algorithm A5/1 available

1 encryption algorithm A5/1 not available
RF power capability (octet 2)

When GSM 450, GSM 480, GSM 710, GSM 750, T-GSM 810, GSM 850, GSM 900 P, E
[or R] band is used (for exceptions see 3GPP TS 44.018 [84]), the MS shall indicate the
RF power capability of the band used (see table):
When UMTS is used, a single band GSM 450, GSM 480, GSM 710, GSM 750, T-GSM
810, GSM 850, GSM 900 P, E [or R] MS shall indicate the RF power capability
corresponding to the (GSM) band it supports (see table). In this case information on
which single band is supported is found in classmark 3.
Bits
3 2 1
0 0 0 class 1
0 0 1 class 2
0 1 0 class 3
0 1 1 class 4
1 0 0 class 5
When the GSM 1800 or GSM 1900 band is used (for exceptions see 3GPP TS 44.018
[84], sub-clause 3.4.18), the MS shall indicate the RF power capability of the band used
(see table):
When UMTS is used, a single band GSM 1800 or GSM 1900 MS shall indicate the RF
power capability corresponding to the (GSM) band it supports (see table). In this case,
information on which single band is supported is found in classmark 3.
Bits
3 2 1
0 0 0 class 1
0 0 1 class 2
0 1 0 class 3
When UMTS is used, an MS not supporting any GSM band or a multiband GSM MS
shall code this field as follows (see table):
Bits
3 2 1
1 1 1 RF power capability is irrelevant in this information element.
ETSI
Release 18 507 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 2: The requirements for the support of the A5 algorithms in the MS are specified
in 3GPP TS 43.020 [13].

concerning aspects of both high and low priority of the mobile station equipment. This affects the manner in which the
network handles the operation of the mobile station. The Mobile Station Classmark information indicates general
mobile station characteristics and it shall therefore, except for fields explicitly indicated, be independent of the
frequency band of the channel it is sent on.
The Mobile Station Classmark 2 information element is coded as shown in figure 10.5.6/3GPP TS 24.008,
table 10.5.6a/3GPP TS 24.008 and table 10.5.6b/3GPP TS 24.008.
The Mobile Station Classmark 2 is a type 4 information element with 5 octets length.
8 7 6 5 4 3 2 1
Mobile station classmark 2 IEI octet 1
Length of mobile station classmark 2 contents octet 2

0 Revision ES A5/1 RF power
spare level IND capability octet 3
0 PS SS Screen. SM ca VBS VGCS FC
spare capa. Indicator pabi. octet 4
CM3 0 LCSVA UCS2 SoLSA CMSP A5/3 A5/2
spare CAP octet 5
NOTE 1: Owing to backward compatibility problems, bit 8 of octet 4 should not be used unless it is also checked
that the bits 8, 7 and 6 of octet 3 are not "0 0 0".
Figure 10.5.6/3GPP TS 24.008 Mobile Station Classmark 2 information element
Table 10.5.6a/3GPP TS 24.008: Mobile Station Classmark 2 information element
Revision level (octet 3)

Bits
7 6
0 0 Reserved for GSM phase 1
0 1 Used by GSM phase 2 mobile stations
1 0 Used by mobile stations supporting R99 or later versions of the protocol
1 1 Reserved for future use. If the network receives a revision level specified as 'reserved
for future use', then it shall use the highest revision level supported by the network.
ES IND (octet 3, bit 5) "Controlled Early Classmark Sending" option implementation

AN MS not supporting A/Gb mode shall set this bit to '0’.
0 "Controlled Early Classmark Sending" option is not implemented in the MS

1 "Controlled Early Classmark Sending" option is implemented in the MS
NOTE 1: The value of the ES IND gives the implementation in the MS. It's value is not
dependent on the broadcast SI 3 Rest Octet <Early Classmark Sending Control> value
ETSI
Release 18 508 3GPP TS 24.008 V18.4.0 (2023-09)
A5/1 algorithm supported (octet 3, bit 4) (Note 4)

An MS supporting A/Gb mode shall indicate the associated capability (see table)

RF Power Capability (Octet 3)

When T-GSM 380, T-GSM 410, GSM 450, GSM 480, GSM 710, GSM 750, T-GSM 810, GSM
850, GSM 900 P, E [or R] band is used (for exceptions see 3GPP TS 44.018 [84]), the MS shall
indicate the RF power capability of the band used (see table).
When UMTS or E-UTRAN is used, a single band T-GSM 380, T-GSM 410, GSM 450, GSM 480,
GSM 710, GSM 750, T-GSM 810, GSM 850, GSM 900 P, E [or R] MS shall indicate the RF power
capability corresponding to the (GSM) band it supports (see table). In this case, information on
which single band is supported is found in classmark 3.
Bits
3 2 1
0 0 0 class 1
0 0 1 class 2
0 1 0 class 3
0 1 1 class 4
1 0 0 class 5
When the GSM 1800 or GSM 1900 band is used (for exceptions see 3GPP TS 44.018 [84]) The
MS shall indicate the RF power capability of the band used (see table).
When UMTS or E-UTRAN is used, a single band GSM 1800 or GSM 1900 MS shall indicate the
RF power capability corresponding to the (GSM) band it supports (see table). In this case,
information on which single band is supported is found in classmark 3
Bits
3 2 1
0 0 0 class 1
0 0 1 class 2
0 1 0 class 3
When UMTS or E-UTRAN is used, an MS not supporting any GSM band or a multiband GSM MS
shall code this field as follows (see table):
Bits
3 2 1
1 1 1 RF Power capability is irrelevant in this information element
PS capability (pseudo-synchronization capability) (octet 4)

Bit 7
0 PS capability not present
1 PS capability present
SS Screening Indicator (octet 4)

Bits
6 5
0 0 defined in 3GPP TS 24.080 [24]
ETSI
Release 18 509 3GPP TS 24.008 V18.4.0 (2023-09)

SM capability (MT SMS pt to pt capability) (octet 4)
Bit 4
0 Mobile station does not support mobile terminated point to point SMS
1 Mobile station supports mobile terminated point to point SMS
VBS notification reception (octet 4)

Bit 3
0 no VBS capability or no notifications wanted
1 VBS capability and notifications wanted
VGCS notification reception (octet 4)

Bit 2
0 no VGCS capability or no notifications wanted
1 VGCS capability and notifications wanted
FC Frequency Capability (octet 4)

When the T-GSM 400, GSM 400, or GSM 700, or T-GSM 810, or GSM 850, or GSM 1800, or
GSM 1900 band or UMTS or E-UTRAN is used (for exceptions see 3GPP TS 44.018 [84]), for
definitions of frequency band see 3GPP TS 45.005 [33]), this bit shall be sent with the value '0’.
NOTE 2: This bit conveys no information about support or non support of the E-GSM or R-GSM
bands when T-GSM 400, GSM 400, GSM 700, T-GSM 810, GSM 850, GSM 1800, GSM 1900
band or UMTS or E-UTRAN is used.
When a GSM 900 band is used (for exceptions see 3GPP TS 44.018 [84]):
Bit 1
0 The MS does not support the E-GSM or R-GSM band (For definition of frequency
bands see 3GPP TS 45.005 [33])
1 The MS does support the E-GSM or R-GSM (For definition of frequency bands see
3GPP TS 45.005 [33])
NOTE 3: For mobile station supporting the R-GSM band further information can be found in MS
Classmark 3.
CM3 (octet 5, bit 8)
0 The MS does not support any options that are indicated in CM3
1 The MS supports options that are indicated in classmark 3 IE
LCS VA capability (LCS value added location request notification capability) (octet 5,bit 6)
This information field indicates the support of the LCS value added location request notification
via CS domain as defined in 3GPP TS 23.271 [105].
0 location request notification via CS domain not supported
1 location request notification via CS domain supported
UCS2 treatment (octet 5, bit 5)
This information field indicates the likely treatment by the mobile station of UCS2 encoded
character strings. For backward compatibility reasons, if this field is not included, the value 0 shall
be assumed by the receiver.
0 the ME has a preference for the default alphabet (defined in 3GPP TS 23.038 [8b])
over UCS2.
1 the ME has no preference between the use of the default alphabet and the use of
UCS2.
ETSI
Release 18 510 3GPP TS 24.008 V18.4.0 (2023-09)
SoLSA (octet 5, bit 4)

0 The ME does not support SoLSA.
1 The ME supports SoLSA.
CMSP: CM Service Prompt (octet 5, bit 3) $(CCBS)$
0 "Network initiated MO CM connection request" not supported.

1 "Network initiated MO CM connection request" supported for at least one CM protocol.


The MS shall set this bit to '0’.
The network shall accept any received value.
1 Not used. This value was allocated in earlier versions of the protocol.
NOTE 4: The requirements for the support of the A5 algorithms in the MS are specified in
3GPP TS 43.020 [13].
NOTE 2: Additional mobile station capability information might be obtained by invoking the classmark
interrogation procedure when GSM is used.

concerning aspects of the mobile station. The contents might affect the manner in which the network handles the
operation of the mobile station. The Mobile Station Classmark information indicates general mobile station
characteristics and it shall therefore, except for fields explicitly indicated, be independent of the frequency band of the
channel it is sent on.
The Mobile Station Classmark 3 is a type 4 information element with a maximum of 34 octets length.
The value part of a Mobile Station Classmark 3 information element is coded as shown in figure 10.5.1.7/3GPP TS
24.008 and table 10.5.1.7/3GPP TS 24.008.
NOTE: The 34 octet limit is so that the CLASSMARK CHANGE message will fit in up to two layer 2 frames.
SEMANTIC RULE: a multiband mobile station shall provide information about all frequency bands it can support. A
single band mobile station shall not indicate the band it supports in the Multiband Supported, GSM 400 Bands
Supported, GSM 710 Associated Radio Capability, GSM 750 Associated Radio Capability, T-GSM 810 Associated
Radio Capability, GSM 850 Associated Radio Capability or GSM 1900 Associated Radio Capability fields in the
Mobile Station Classmark 3. Due to shared radio frequency channel numbers between GSM 1800 and GSM 1900, the
mobile should indicate support for either GSM 1800 band OR GSM 1900 band.
SEMANTIC RULE: a mobile station shall include the MS Measurement Capability field if the Multi Slot Class field
contains a value of 19 or greater (see 3GPP TS 45.002 [32]).
Typically, the number of spare bits at the end is the minimum to reach an octet boundary. The receiver may add any
number of bits set to "0" at the end of the received string if needed for correct decoding.
ETSI
Release 18 511 3GPP TS 24.008 V18.4.0 (2023-09)
ETSI
Release 18 512 3GPP TS 24.008 V18.4.0 (2023-09)
<Classmark 3 Value part> ::=

< spare bit >
{ < Multiband supported : { 000 } >
< A5 bits >
| < Multiband supported : { 101 | 110 } >
< A5 bits >
< Associated Radio Capability 2 : bit(4) >
< Associated Radio Capability 1 : bit(4) >
| < Multiband supported : { 001 | 010 | 100 } >
< A5 bits >
< spare bit >(4)
< Associated Radio Capability 1 : bit(4) > }
{ 0 | 1 < R Support > }
{ 0 | 1 < HSCSD Multi Slot Capability > }
< UCS2 treatment: bit >
< Extended Measurement Capability : bit >
{ 0 | 1 < MS measurement capability > }
{ 0 | 1 < MS Positioning Method Capability > }
{ 0 | 1 < ECSD Multi Slot Capability > }
{ 0 | 1 < 8-PSK Struct > }
{ 0 | 1 < GSM 400 Bands Supported : { 01 | 10 | 11 } >
< GSM 400 Associated Radio Capability: bit(4) > }
{ 0 | 1 <GSM 850 Associated Radio Capability : bit(4) > }

{ 0 | 1 <GSM 1900 Associated Radio Capability : bit(4) > }
< UMTS FDD Radio Access Technology Capability : bit >
< UMTS 3.84 Mcps TDD Radio Access Technology Capability : bit >
< CDMA 2000 Radio Access Technology Capability : bit >
{ 0 | 1 < DTM GPRS Multi Slot Class : bit(2) >

< Single Slot DTM : bit >
{0 | 1< DTM EGPRS Multi Slot Class : bit(2) > } }
{ 0 | 1 < Single Band Support > } -- Release 4 starts here.
{ 0 | 1 <GSM 750 Associated Radio Capability : bit(4)>}
< UMTS 1.28 Mcps TDD Radio Access Technology Capability : bit >
< GERAN Feature Package 1 : bit >
{ 0 | 1 < Extended DTM GPRS Multi Slot Class : bit(2) >

< Extended DTM EGPRS Multi Slot Class : bit(2) > }
{ 0 | 1 < High Multislot Capability : bit(2) > } --Release 5 starts here.
0 -- The value '1' was allocated in an earlier version of the protocol and shall not be used.
< GMSK Multislot Power Profile : bit (2) >

< 8-PSK Multislot Power Profile : bit (2) >
{ 0 | 1 < T-GSM 400 Bands Supported : { 01 | 10 | 11 } > -- Release 6 starts here.

< T-GSM 400 Associated Radio Capability: bit(4) > }
< Downlink Advanced Receiver Performance : bit (2)>
< DTM Enhancements Capability : bit >
{ 0 | 1 < DTM GPRS High Multi Slot Class : bit(3) >

< Offset required : bit>
{ 0 | 1 < DTM EGPRS High Multi Slot Class : bit(3) > } }
< Repeated ACCH Capability : bit >
{ 0 | 1 <GSM 710 Associated Radio Capability : bit(4)>} -- Release 7 starts here.

{ 0 | 1 <T-GSM 810 Associated Radio Capability : bit(4)>}
< Ciphering Mode Setting Capability : bit >
ETSI
Release 18 513 3GPP TS 24.008 V18.4.0 (2023-09)
< Additional Positioning Capabilities : bit >
< E-UTRA FDD support : bit > -- Release 8 starts here

< E-UTRA TDD support : bit >
< E-UTRA Measurement and Reporting support : bit >
< Priority-based reselection support : bit >
< UTRA CSG Cells Reporting : bit > -- Release 9 starts here
< VAMOS Level : bit(2) >
< TIGHTER Capability : bit(2) > -- Release 10 starts here

< Selective Ciphering of Downlink SACCH : bit >
< CS to PS SRVCC from GERAN to UTRA : bit(2) > -- Release 11 starts here
< CS to PS SRVCC from GERAN to E-UTRA : bit(2)>
< GERAN Network Sharing support : bit >

< E-UTRA Wideband RSRQ measurements support : bit >
< ER Band Support : bit > -- Release 12 starts here

< UTRA Multiple Frequency Band Indicators support : bit >
< E-UTRA Multiple Frequency Band Indicators support: bit >
< Extended TSC Set Capability support: bit >
< Extended EARFCN value range : bit > -- Late addition of a release 11 feature
< spare bits > ;
< A5 bits > ::=

< A5/7 : bit > < A5/6 : bit > < A5/5 : bit > < A5/4 : bit > ;
<R Support>::=
< R-GSM band Associated Radio Capability : bit(3) > ;
< HSCSD Multi Slot Capability > ::=

< HSCSD Multi Slot Class : bit(5) > ;
< MS Measurement capability > ::=

< SMS_VALUE : bit (4) >
< SM_VALUE : bit (4) > ;
< MS Positioning Method Capability > ::=

< MS Positioning Method : bit(5) > ;
< ECSD Multi Slot Capability > ::=

< ECSD Multi Slot Class : bit(5) > ;
< 8-PSK Struct> : :=

< Modulation Capability : bit >
{ 0 | 1 < 8-PSK RF Power Capability 1: bit(2) > }
{ 0 | 1 < 8-PSK RF Power Capability 2: bit(2) > }
< Single Band Support > ::=

< GSM Band : bit (4) > ;
Figure 10.5.1.7/3GPP TS 24.008 Mobile Station Classmark 3 information element
ETSI
Release 18 514 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.1.7/3GPP TS 24.008: Mobile Station Classmark 3 information element
Multiband Supported (3 bit field)
Band 1 supported
Bit 1
0 P-GSM not supported
1 P-GSM supported
Band 2 supported
Bit 2
0 E-GSM or R-GSM not supported
1 E-GSM or R-GSM supported
Band 3 supported
Bit 3
0 GSM 1800 not supported
1 GSM 1800 supported
The indication of support of P-GSM band or E-GSM or R-GSM band is mutually exclusive.
When the 'Band 2 supported' bit indicates support of E-GSM or R-GSM, the presence of the <R Support> field,
see below, indicates if the E-GSM or R-GSM band is supported.
In this version of the protocol, the sender indicates in this field either none, one or two of these 3 bands
supported.
For single band mobile station or a mobile station supporting none of the GSM 900 bands(P-GSM, E-GSM and
R-GSM) and GSM 1800 bands, all bits are set to 0.
A5/4
0 Encryption algorithm A5/4 not available
1 Encryption algorithm A5/4 available
A5/5
A5/6
A5/7
Associated Radio capability 1 and 2 (4 bit fields)
If either of P-GSM or E-GSM or R-GSM is supported, the radio capability 1 field indicates the radio capability for
P-GSM, E-GSM or R-GSM, and the radio capability 2 field indicates the radio capability for GSM 1800 if
supported, and is spare otherwise.
If none of P-GSM or E-GSM or R-GSM are supported, the radio capability 1 field indicates the radio capability
for GSM 1800, and the radio capability 2 field is spare.
The radio capability contains the binary coding of the power class associated with the band indicated in
multiband support bits (see 3GPP TS 45.005 [33]).
(continued...)
ETSI
Release 18 515 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.1.7/3GPP TS 24.008 (continued): Mobile Station Classmark 3 information element
R-GSM band Associated Radio Capability (3 bit field)
In case where the R-GSM band is supported the R-GSM band associated radio capability field contains the
binary coding of the power class associated (see 3GPP TS 45.005 [33]) (regardless of the number of GSM
bands supported). A mobile station supporting the R-GSM band shall also when appropriate, (see 10.5.1.6)
indicate its support in the 'FC' bit in the Mobile Station Classmark 2 information element.
NOTE: The coding of the power class for P-GSM, E-GSM, R-GSM and GSM 1800 in radio capability 1 and/or 2
is different to that used in the Mobile Station Classmark 1 and Mobile Station Classmark 2 information elements.
HSCSD Multi Slot Class (5 bit field)
In case the MS supports the use of multiple timeslots for HSCSD then the HSCSD Multi Slot Class field is coded
as the binary representation of the multislot class defined in 3GPP TS 45.002 [32].
UCS2 treatment (1 bit field)
This information field indicates the likely treatment by the mobile station of UCS2 encoded character strings. If
not included, the value 0 shall be assumed by the receiver.
0 the ME has a preference for the default alphabet (defined in 3GPP TS 23.038 [8b]) over UCS2.
1 the ME has no preference between the use of the default alphabet and the use of UCS2.
Extended Measurement Capability (1 bit field)
This bit indicates whether the mobile station supports 'Extended Measurements' or not
0 the MS does not support Extended Measurements
1 the MS supports Extended Measurements
SMS_VALUE (Switch-Measure-Switch) (4 bit field)

The SMS field indicates the time needed for the mobile station to switch from one radio channel to another,
perform a neighbour cell power measurement, and the switch from that radio channel to another radio channel.
Bits
4321
0000 1/4 timeslot (~144 microseconds)
...
SM_VALUE (Switch-Measure) (4 bit field)

The SM field indicates the time needed for the mobile station to switch from one radio channel to another and
perform a neighbour cell power measurement.
Bits
4321
...
MS Positioning Method (5 bit field)

This field indicates the Positioning Method(s) supported by the mobile station for the provision of location
services (LCS) via the CS domain in A-mode.
MS assisted E-OTD
Bit 5
0 MS assisted E-OTD not supported
1 MS assisted E-OTD supported
ETSI
Release 18 516 3GPP TS 24.008 V18.4.0 (2023-09)
MS based E-OTD
Bit 4
0 MS based E-OTD not supported
1 MS based E-OTD supported
MS assisted GPS
Bit 3
0 MS assisted GPS not supported
1 MS assisted GPS supported
MS based GPS
Bit 2
0 MS based GPS not supported
1 MS based GPS supported
MS Conventional GPS
Bit 1
0 conventional GPS not supported
1 conventional GPS supported
ECSD Multi Slot class (5 bit field)
An MS that supports ECSD shall include this field to indicate its ECSD capability. Whether the MS is capable of
8-PSK modulation in uplink is indicated by the value of the Modulation Capability field in the 8-PSK struct. The
ECSD Multi Slot Class field is coded as the binary representation of the multislot class defined in 3GPP TS
45.002 [32].
8-PSK struct
The MS shall include the 8-PSK struct if it supports ECSD or DTM EGPRS or both.
Modulation Capability
The Modulation Capability field indicates the modulation scheme the MS supports in addition to GMSK.
0 8-PSK supported for downlink reception only
1 8-PSK supported for uplink transmission and downlink reception
8-PSK RF Power Capability 1 (2 bit field)

If 8-PSK modulation is supported for both uplink and downlink, the 8-PSK RF Power Capability 1 field indicates
the radio capability for 8-PSK modulation in GSM 400, GSM 700, GSM 850 or GSM 900.
8-PSK RF Power Capability 2 (2 bit field)

If 8-PSK modulation is supported for both uplink and downlink, the 8-PSK RF Power Capability 2 field indicates
the radio capability for 8-PSK modulation in GSM 1800 or GSM 1900 if supported, and is not included
otherwise.
The respective 8-PSK RF Power Capability 1 and 8-PSK RF Power Capability 2 fields contain the following
coding of the 8-PSK modulation power class (see 3GPP TS 45.005 [33]):
Bits 2 1
00 Reserved
01 Power class E1
10 Power class E2
11 Power class E3
ETSI
Release 18 517 3GPP TS 24.008 V18.4.0 (2023-09)
GSM 400 Bands Supported (2 bit field)

See the semantic rule for the sending of this field.
Bits
21
01 GSM 480 supported, GSM 450 not supported
10 GSM 450 supported, GSM 480 not supported
11 GSM 450 supported, GSM 480 supported
GSM 400 Associated Radio Capability (4 bit field)

If either GSM 450 or GSM 480 or both is supported, the GSM 400 Associated Radio Capability field indicates
the radio capability for GSM 450 and/or GSM 480.
The radio capability contains the binary coding of the power class associated with the band indicated in GSM
400 Bands Supported bits (see 3GPP TS 45.005 [33]).
NOTE: The coding of the power class for GSM 450 and GSM 480 in GSM 400 Associated Radio Capability is
different to that used in the Mobile Station Classmark 1 and Mobile Station Classmark 2 information elements.

This field indicates whether GSM 850 band is supported and its associated radio capability.
The radio capability contains the binary coding of the power class associated with the GSM 850 band (see
3GPP TS 45.005 [33]).
Note: the coding of the power class for GSM 850 in GSM 850 Associated Radio Capability is different to that
used in the Mobile Station Classmark 1 and Mobile Station Classmark 2 information elements.

3GPP TS 45.005 [33]).
Note: the coding of the power class for GSM 1900 in GSM 1900 Associated Radio Capability is different to that
ETSI
Release 18 518 3GPP TS 24.008 V18.4.0 (2023-09)
ETSI
Release 18 519 3GPP TS 24.008 V18.4.0 (2023-09)
UMTS FDD Radio Access Technology Capability (1 bit field)

0 UMTS FDD not supported
1 UMTS FDD supported
UMTS 3.84 Mcps TDD Radio Access Technology Capability (1 bit field)
0 UMTS 3.84 Mcps TDD not supported
1 UMTS 3.84 Mcps TDD supported
CDMA 2000 Radio Access Technology Capability (1 bit field)

0 CDMA2000 not supported
1 CDMA2000 supported
DTM GPRS Multi Slot Class (2 bit field)

This field indicates the DTM GPRS multislot capabilities of the MS. It is coded as follows:
Bit
21
00 Unused. If received, the network shall interpret this as '01’
01 Multislot class 5 supported
If a multislot class type 1 MS indicates the support of a DTM GPRS multislot class for which three uplink
timeslots can be assigned, the mobile station shall support Extended Dynamic Allocation.
This field shall contain one of the following values if the DTM GPRS High Multi Slot Class field is present:
- Multislot class 9 if DTM GPRS High Multi Slot Class is set to indicate Class 31/36 or Class 41;
- Multislot class 11 if DTM GPRS High Multi Slot Class is set to indicate Classes 32/37, 33/38 or Classes
42, 43, 44.
The same multislot capability is applicable also for EGPRS2 if supported.
Single Slot DTM (1 bit field)

This field indicates whether the MS supports single slot DTM operation (see 3GPP TS 43.055 [87]). It is coded
as follows:
0 Single Slot DTM not supported

1 Single Slot DTM supported
An MS indicating support for Extended DTM GPRS multislot class or Extended DTM EGPRS multislot class
shall set this bit to '1’. The network may ignore the bit in this case.
DTM EGPRS Multi Slot Class (2 bit field)

This field indicates the DTM EGPRS multislot capabilities of the MS. Whether the MS is capable of 8-PSK
modulation in uplink is indicated by the value of the Modulation Capability field in the 8-PSK struct. This field
shall be included only if the mobile station supports EGPRS DTM. This field is coded as the DTM GPRS Multi
Slot Class field.
If a multislot class type 1 MS indicates the support of a DTM EGPRS multislot class for which three uplink
timeslots can be assigned, the mobile station shall support Extended Dynamic Allocation.
This field shall contain one of the following values if the DTM EGPRS High Multi Slot Class field is present:
- Multislot class 9 if DTM EGPRS High Multi Slot Class is set to indicate Class 31/36 or Class 41;
- Multislot class 11 if DTM EGPRS High Multi Slot Class is set to indicate Classes 32/37, 33/38 or Classes
42, 43, 44.
Single Band Support

This field shall be sent if the mobile station supports UMTS and one and only one GSM band with the exception
of R-GSM; this field shall not be sent otherwise
GSM Band (4 bit field)

Bits
4321
0000 E-GSM is supported
0001 P-GSM is supported
0010 GSM 1800 is supported
ETSI
Release 18 520 3GPP TS 24.008 V18.4.0 (2023-09)

1001 T-GSM 810 is supported
All other values are reserved for future use.
NOTE: When this field is received, the associated RF power capability is found in Classmark 1 or 2.

3GPP TS 45.005 [33]).
NOTE: The coding of the power class for GSM 750 in GSM 750 Associated Radio Capability is different to that
GERAN Feature Package 1 (1 bit field)

This field indicates whether the MS supports the GERAN Feature Package 1 (see 3GPP TS 44.060 [76]). It is
coded as follows:
0 GERAN feature package 1 not supported.

1 GERAN feature package 1 supported.
Extended DTM GPRS Multi Slot Class (2 bit field)

This field indicates the extended DTM GPRS multislot capabilities of the MS and shall be interpreted in
conjunction with the DTM GPRS Multi Slot Class field. It is coded as follows, where 'DGMSC’ denotes the DTM
GPRS Multi Slot Class field:
DGMSC Bit 2 1 Bit 2 1
00 00 Unused. If received, it shall be interpreted as '01 00’
01 00 Multislot class 5 supported
11 01 Unused. If received, it shall be interpreted as ’11 00’
The presence of this field indicates that the MS supports combined fullrate and halfrate GPRS channels in the
downlink.When this field is not present, the MS supports the multislot class indicated by the DTM GPRS Multi
Slot Class field.
If this field is included, it shall contain one of the following values if the DTM GPRS High Multi Slot Class field is
present:
- Multislot class 10 if DTM GPRS High Multi Slot Class is set to indicate Class 31/36 or Class 41;
- Multislot class 11 if DTM GPRS High Multi Slot Class is set to indicate Classes 32/37, 33/38 or Classes
42, 43, 44.
Extended DTM EGPRS Multi Slot Class (2 bit field)

This field is not considered when the DTM EGPRS Multi Slot Class field is not included. This field indicates the
extended DTM EGPRS multislot capabilities of the MS and shall be interpreted in conjunction with the DTM
ETSI
Release 18 521 3GPP TS 24.008 V18.4.0 (2023-09)
EGPRS Multi Slot Class field. This field is coded as the Extended DTM GPRS Multi Slot Class field. The
presence of this field indicates that the MS supports combined fullrate and halfrate GPRS channels in the
downlink. When this field is not present, the MS supports the multislot class indicated by the DTM EGPRS Multi
Slot Class field.
If this field is included, it shall contain one of the following values if the DTM EGPRS High Multi Slot Class field
is present:
- Multislot class 10 if DTM EGPRS High Multi Slot Class is set to indicate Class 31/36 or Class 41;
- Multislot class 11 if DTM EGPRS High Multi Slot Class is set to indicate Classes 32/37, 33/38 or Classes
42, 43, 44.
High Multislot Capability (2 bit field)

This field indicates the support of multislot classes 30 to 45, see 3GPP TS 45.002 [32].
The High Multislot Capability is individually combined with each multislot class field sent by the MS (the possible
multislot class fields are: GPRS multislot class, EGPRS multislot class) to extend the related multislot class with
the rule described in the MS Radio Access Capability IE. The same capability is applicable also to EGPRS2 if
supported.

This field indicates the MS support of the GERAN Feature Package 2. The GERAN Feature Package 2 includes
Enhanced Power Control (EPC) (see 3GPP TS 45.008 [34]).

GMSK Multislot Power Profile (2 bit field)

This field indicates the GMSK multislot power capability parameter GMSK_MULTISLOT_POWER_PROFILE as
described in 3GPP TS 45.005 [33].
Bits
21
00 GMSK_MULTISLOT_POWER_PROFILE 0
8-PSK Multislot Power Profile (2 bit field)

This field indicates the 8-PSK multislot power capability parameter 8-PSK_MULTISLOT_POWER_PROFILE as
described in 3GPP TS 45.005 [33]. If the MS does not support 8-PSK in the uplink, then it shall set this field to '0
0’.
Bits
21
00 8-PSK_MULTISLOT_POWER_PROFILE 0
T-GSM 400 Bands Supported (2 bit field)

Bits
21
01 T-GSM 380 supported, T-GSM 410 not supported
10 T-GSM 410 supported, T-GSM 380 not supported
11 T-GSM 410 supported, T-GSM 380 supported
T-GSM 400 Associated Radio Capability (4 bit field)

If either T-GSM 410 or T-GSM 380 or both is supported, the T-GSM 400 Associated Radio Capability field
indicates the radio capability for T-GSM 410 and/or T-GSM 380.
The radio capability contains the binary coding of the power class associated with the band indicated in T-GSM
400 Bands Supported bits (see 3GPP TS 45.005 [33]).
NOTE: The coding of the power class for T-GSM 410 and T-GSM 380 in T-GSM 400 Associated Radio
Capability is different to that used in the Mobile Station Classmark 1 and Mobile Station Classmark 2 information
elements.
ETSI
Release 18 522 3GPP TS 24.008 V18.4.0 (2023-09)
Downlink Advanced Receiver Performance (2 bit field)

This field indicates Downlink Advanced Receiver Performance capabilities of the MS (see 3GPP TS 45.005
[33]).
Bits
21
00 Downlink Advanced Receiver Performance not supported
01 Downlink Advanced Receiver Performance – phase I supported
10 Downlink Advanced Receiver Performance – phase II supported
The value '11’ shall not be used by the MS.

If the value '11’ is received by the network, it shall be interpreted as '10’.
DTM Enhancements Capability (1 bit field)

This field indicates whether the mobile station supports enhanced DTM CS establishment and enhanced DTM
CS release or not. It is coded as follows:
0 The mobile station does not support enhanced DTM CS establishment and enhanced DTM CS release
procedures.
1 The mobile station supports enhanced DTM CS establishment and enhanced DTM CS release
procedures.
DTM GPRS High Multi Slot Class (3 bit field)

Bit
321
000 Unused. If received, the network shall interpret this as '0 0 1’
001 Multislot class 31 or 36 supported
The presence of this field indicates that the MS supports the DTM extension to high multislot classes. When this
field is not present, the MS supports the DTM multislot class indicated by the DTM GPRS Multi Slot Class field.
The values '0 0 1', '0 1 0' and '0 1 1' shall be interpreted as indicating DTM GPRS multislot class 36, 37 or 38
respectively if the Offset required field indicates that the offset t0 is required; in all other cases those codepoints
shall be interpreted as indicating DTM GPRS multislot class 31, 32 or 33 respectively.
Offset required (1 bit field)

This field indicates whether the GPRS multislot class of the mobile station is such that the Timing Advance
offset t0 is required (see 3GPP TS 45.002 [32]). It is coded as follows:
0 The mobile station does not require the offset

1 The mobile station requires the offset
DTM EGPRS High Multi Slot Class (3 bit field)

This field indicates the DTM EGPRS multislot capabilities of the MS. This field may be included only if the
mobile station supports EGPRS DTM. This field is coded as the DTM GPRS High Multi Slot Class field. When
this field is not present, the MS supports the DTM multislot class indicated by the DTM EGPRS Multi Slot Class
field.
The values '0 0 1', '0 1 0' and '0 1 1' shall be interpreted as indicating DTM EGPRS multislot class 36, 37 or 38
respectively if the Offset required field indicates that the Timing Advance offset t0 is required; in all other cases
those codepoints shall be interpreted as indicating DTM EGPRS multislot class 31, 32 or 33 respectively.
The same multislot capability is applicable also for EGPRS2 if supported
Repeated ACCH Capability (1 bit field)

This field indicates whether the MS supports Repeated SACCH and Repeated Downlink FACCH (see
3GPP TS 44.006 [19]). It is coded as follows:
0 The mobile station does not support Repeated SACCH

1 The mobile station supports Repeated SACCH and Repeated Downlink FACCH
ETSI
Release 18 523 3GPP TS 24.008 V18.4.0 (2023-09)
An MS that only supports Repeated Downlink FACCH shall set this bit field to '0’.

3GPP TS 45.005 [33]).
NOTE: The coding of the power class for GSM 710 in GSM 710 Associated Radio Capability is different to that
T-GSM 810 Associated Radio Capability (4 bit field)

This field indicates whether T- GSM 810 band is supported and its associated radio capability.
The radio capability contains the binary coding of the power class associated with the T-GSM 810 band (see
3GPP TS 45.005 [33]).
NOTE: The coding of the power class for T-GSM 810 in T-GSM 810 Associated Radio Capability is different to
that used in the Mobile Station Classmark 1 and Mobile Station Classmark 2 information elements.
Ciphering Mode Setting Capability (1 bit field)

This field indicates whether the MS supports the Ciphering Mode Setting IE in the
DTM ASSIGNMENT COMMAND message (see 3GPP TS 44.018 [84]). It is coded as follows:
0 The mobile station does not support the Ciphering Mode Setting IE in the
DTM ASSIGNMENT COMMAND message
1 The mobile station supports the Ciphering Mode Setting IE in the DTM ASSIGNMENT COMMAND
message
Additional Positioning Capabilities (1 bit field)

This field indicates whether the mobile station supports additional positioning capabilities which can be retrieved
using RRLP. It is coded as follows:
0 The mobile station does not support additional positioning capabilities which can be retrieved using
RRLP
1 The mobile station supports additional positioning capabilities which can be retrieved using RRLP.
E-UTRA FDD support (1 bit field)

Bit
0 E-UTRA FDD not supported
1 E-UTRA FDD supported
E-UTRA TDD support (1 bit field)

Bit
0 E-UTRA TDD not supported
1 E-UTRA TDD supported
E-UTRA Measurement and Reporting support (1 bit field)

This field indicates whether the mobile station supports E-UTRAN neighbouring cell measurements and
measurement reporting in dedicated mode and, if the mobile station is DTM capable, also in dual transfer mode.
If both "E-UTRA FDD support" and "E-UTRA TDD support" bits are set to '0', this field shall be set to '0'. If one
of or both "E-UTRA FDD support"and "E-UTRA TDD support" bits are set to '1', this field may be set to '0' or
'1'. It is coded as follows:
Bit
0 E-UTRAN Neighbour Cell measurements and measurement reporting while having an RR connection
not supported
1 E-UTRAN Neighbour Cell measurements and measurement reporting while having an RR connection
supported
Priority-based reselection support (1 bit field)

This field indicates whether the mobile station supports priority-based cell reselection. It is coded as follows:
Bit
0 Priority-based cell reselection not supported
1 Priority-based cell reselection supported
ETSI
Release 18 524 3GPP TS 24.008 V18.4.0 (2023-09)
UTRA CSG Cells Reporting (1 bit field)

This field indicates whether the mobile station supports reporting of measurements and routing parameters (see
3GPP TS 44.018 [84]) for UTRAN CSG cells in dedicated mode and, if the mobile station is DTM capable, also
in dual transfer mode. This capability shall apply to each UTRA radio access mode supported by the mobile. It is
coded as follows:
Bit
0 Reporting of UTRAN CSG cells not supported
1 Reporting of UTRAN CSG cells supported
VAMOS Level (2 bit field)

This field indicates the VAMOS support of the MS and the VAMOS level supported. It is coded as follows:
Bits
21
00 VAMOS not supported
01 VAMOS I supported
10 VAMOS II supported
11 VAMOS III supported.
TIGHTER Capability (2 bit field)

This field indicates Tightened Link Level Performance support in the MS (see 3GPP TS 45.005 [33]). The
tightened performance applies to the traffic channels and signalling channels specified in 3GPP TS 45.005 [33].
The field is coded as follows:
Bits
21
00 TIGHTER not supported
01 TIGHTER supported for speech and signalling channels only
10 TIGHTER supported for speech and signalling channels and for GPRS and EGPRS, but not for EGPRS2
11 TIGHTER supported for speech and signalling channels and for GPRS, EGPRS and EGPRS2
Selective Ciphering of Downlink SACCH (1 bit field)

This field indicates whether the mobile station supports Selective Ciphering of Downlink SACCH (see
Bit
0 Selective Ciphering of Downlink SACCH not supported
1 Selective Ciphering of Downlink SACCH supported
CS to PS SRVCC from GERAN to UTRA (2 bit field)

This field indicates whether the mobile station supports CS to PS SRVCC to UTRAN. If" UMTS FDD Radio
Access Technology Capability" and" UMTS 1.28 Mcps TDD Radio Access Technology Capability" bitsare
set to '0’ this field shall be set to '00’. If one or both bits are set to '1’ this field may be set to '01’ or '10’ or '11’. It
is coded as follows:
Bits
21
00 CS to PS SRVCC from GERAN to U MTS FDD and 1.28 Mcps TDD not supported
01 CS to PS SRVCC from GERAN to UMTS FDD supported
10 CS to PS SRVCC from GERAN to UMTS 1.28 Mcps TDD supported
11 CS to PS SRVCC from GERAN to UMTS FDD and 1.28 Mcps TDD supported
CS to PS SRVCC from GERAN to E-UTRA (2 bit field)

This field indicates whether the mobile station supports CS to PS SRVCC to E-UTRAN. If both "E-UTRA FDD
support" and "E-UTRA TDD support" bits are set to '0', this field shall be set to '00'. If one or both "E-UTRA
FDD support" and "E-UTRA TDD support" bits are set to '1', this field may be set to '01' or '10' or '11’. A mobile
station not compliant to the UE E-UTRA capability requirements as defined in 3GPP TS 36.306 [153] shall set
this field to '00'. It is coded as follows:
Bits
21
00 CS to PS SRVCC from GERAN to E-UTRA FDD and TDD not supported
01 CS to PS SRVCC from GERAN to E-UTRA FDD supported
10 CS to PS SRVCC from GERAN to E-UTRA TDD supported
11 CS to PS SRVCC from GERAN to E-UTRA FDD and TDD supported
ETSI
Release 18 525 3GPP TS 24.008 V18.4.0 (2023-09)
GERAN Network Sharing support (1 bit field)

This field indicates whether the mobile station supports GERAN network sharing. A mobile station supporting
GERAN network sharing shall also support the extended EARFCN value range in GERAN and indicate this in
the respective bit. The field is coded as follows:
Bit
0 GERAN network sharing not supported
1 GERAN network sharing supported
E-UTRA Wideband RSRQ measurements support (1 bit field)

This field indicates whether the mobile station supports E-UTRA wideband RSRQ measurements (see
Bit
0 E-UTRA wideband RSRQ measurements not supported
1 E-UTRA wideband RSRQ measurements supported
ER Band Support (1 bit field)

This field indicates whether the mobile station supports ER-GSM band (see 3GPP TS 45.005 [33]). It is coded
as follows:
Bit
0 ER-GSM not supported
1 ER-GSM supported
NOTE: When ER-GSM is supported, the associated RF power capability is found in Mobile Station Classmark 1,
Mobile Station Classmark 2 and/or Mobile Station Classmark 3. The ER-GSM band associated radio capability
is the same as for the R-GSM band (see R-GSM band Associated Radio Capability).
UTRA Multiple Frequency Band Indicators support (1 bit field)

This field indicates whether the mobile station supports multiple radio frequency bands in UTRAN (see 3GPP
TS 25.331 [23c]) and whether it understands signalling of overlapping UTRA frequency bands (see 3GPP TS
44.018 [84]). It is coded as follows:
Bit
0 Multiple Frequency Band Indicators in UTRAN not supported
1 Multiple Frequency Band Indicators in UTRAN supported
E-UTRA Multiple Frequency Band Indicators support (1 bit field)

This field indicates whether the mobile station supports multiple radio frequency bands in E-UTRAN (see 3GPP
TS 36.331 [129]) and whether it understands signalling of overlapping E-UTRA frequency bands (see 3GPP TS
44.018 [84]). It is coded as follows:
Bit
0 Multiple Frequency Band Indicators in E-UTRAN not supported
1 Multiple Frequency Band Indicators in E-UTRAN supported
Extended TSC Set Capability support (1 bit field)

This field indicates whether the mobile station supports the extended TSC sets when operating in the PS or CS
domain (see 3GPP TS 45.002 [32]). It is coded as follows:
Bit
0 Extended TSC sets not supported
1 Extended TSC sets supported
Extended EARFCN value range (1 bit field)

This field indicates whether the mobile station supports the extended EARFCN value range in GERAN (see
Bit
0 Extended EARFCN value range not supported
1 Extended EARFCN value range supported
ETSI
Release 18 526 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.1.8 Spare Half Octet

This element is used in the description of messages in clause 9 when an odd number of half octet type 1 information
elements are used. This element is filled with spare bits set to zero and is placed in bits 5 to 8 of the octet unless
otherwise specified.
10.5.1.9 Descriptive group or broadcast call reference

The purpose of the Descriptive Group or Broadcast Call Reference is to provide information describing a voice group
or broadcast call. The IE of the Descriptive Group or Broadcast Call Reference is composed of the group or broadcast
call reference together with a service flag, an acknowledgement flag, the call priority and the group cipher key number.
The Descriptive Group or Broadcast Call Reference information element is coded as shown in figure 10.5.8/3GPP TS
24.008 and Table10.5.8/3GPP TS 24.008
The Descriptive Group or Broadcast Call Reference is a type 3 information element with 6 octets length.
8 7 6 5 4 3 2 1
Group or broadcast call reference IEI octet 1
Binary coding of the group or broadcast call reference octet 2
octet 3
octet 4
SF AF call priority octet 5

Spare
Ciphering information 0 0 0 0 octet 6
Figure 10.5.8/3GPP TS 24.008 Descriptive Group or Broadcast Call Reference
ETSI
Release 18 527 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.8/3GPP TS 24.008 Descriptive Group or Broadcast Call Reference
Binary code of the group or broadcast call reference

The length of the binary code has 27 bits which is encoded in the octet 2, 3, 4 and
Bits 8,7,6 (octet 5).
The highest bit of the BC is the bit 8 in the octet 2 and the lowest bit is allocated in
the bit 6 in the octet 5. (see also 3GPP TS 23.003 [10])
SF Service flag (octet 5)
Bit
5
0 VBS (broadcast call reference)
1 VGCS (group call reference)
AF Acknowledgement flag (octet 5), network to MS direction:

Bit
4
0 acknowledgement is not required
1 acknowledgement is required
Call priority (octet 5)

Bit
3 2 1
0 0 0 no priority applied
0 0 1 call priority level 4
1 1 0 call priority level B
1 1 1 call priority level A
Ciphering information (octet 6)

Bit
8 7 6 5
0 0 0 0 no ciphering
0 0 0 1 ciphering with cipher key number 1
1 0 1 0 ciphering with cipher key number A
1 0 1 1 ciphering with cipher key number B
1 1 0 0 ciphering with cipher key number C
1 1 0 1 ciphering with cipher key number D
1 1 1 0 ciphering with cipher key number E
1 1 1 1 ciphering with cipher key number F
AF Acknowledgement flag (octet 5), MS to network direction:

Bit 4 is spare and shall be set to "0".

Bits 1 to 3 are spare and shall be set to "0".
Ciphering information (octet 6)

10.5.1.10 Group Cipher Key Number

The purpose of the Group Cipher Key Number is to provide information on the group cipher key to be used for
ciphering and deciphering by the mobile station.
ETSI
Release 18 528 3GPP TS 24.008 V18.4.0 (2023-09)
The Group Cipher Key Number information element is coded as shown in figure 10.5.9/3GPP TS 24.008 and
Table10.5.9/3GPP TS 24.008
The Group Cipher Key Number is a type 1 information element with 1 octet length.
8 7 6 5 4 3 2 1
Group cipher key number
IEI Group cipher key number
Figure 10.5.9/3GPP TS 24.008 Group Cipher Key Number
Table 10.5.9/3GPP TS 24.008 Group Cipher Key Number
Group cipher key number

Bit
4 3 2 1
0 0 0 0 spare
0 0 0 1 cipher key number 1
1 0 1 0 cipher key number A
1 0 1 1 cipher key number B
1 1 0 0 cipher key number C
1 1 0 1 cipher key number D
1 1 1 0 cipher key number E
1 1 1 1 cipher key number F
10.5.1.10a PD and SAPI $(CCBS)$

The purpose of the PD and SAPI information element is to provide information concerning Protocol Discriminators and
Service Access Point Identifiers.
The PD and SAPI information element is coded as shown in figure 10.5.10/3GPP TS 24.008 and table 10.5.10/3GPP
TS 24.008.
The PD and SAPI is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
PD and SAPI IEI octet 1
0 0 SAPI PD
spare spare octet 2
Figure10.5.10/3GPP TS 24.008
PD and SAPI information element
ETSI
Release 18 529 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.1.10/3GPP TS 24.008: PD and SAPI information element
SAPI: Service Access Point Identifier (octet 2)
Bits
6 5
0 0 SAPI 0
0 1 reserved
1 0 reserved
1 1 SAPI 3
PD: Protocol Discriminator (octet 2)

bits 4-1
Encoded as specified in subclause 11.2.1 of 3GPP TS 24.007 [20].
10.5.1.11 Priority Level

The purpose of the Priority Level is to provide information defining the priority level requested or applied. The Priority
Level IE may be included in CM_SERVICE_REQUEST, CALL_PROCEEDING and SETUP messages.
The Priority Level information element is coded as shown in figure 10.5.11/3GPP TS 24.008 and table 10.5.11/3GPP
TS 24.008.
The Priority Level is a type 1 information element with 1 octet length.
8 7 6 5 4 3 2 1
Priority Level 0 call priority
IEI spare octet 1
Figure 10.5.11/3GPP TS 24.008 Priority Level
Table 10.5.11/3GPP TS 24.008 Priority Level

Bit
3 2 1
0 0 0 no priority applied
1 1 0 call priority level B
1 1 1 call priority level A
10.5.1.12 Core Network System Information (Iu mode only)

The purpose of the Core Network System Information is to provide the MS with actual parameter settings of system
information parameters controlling MM and GMM functionality. The Core Network system information is included in
specific information elements within some RRC messages sent to MS, see 3GPP TS 25.331 [23c].
NOTE: These IEs do not have an IEI or a length indicator, because these IEs are never present in any layer 3
messages, Hence these IEs do not conform to the general IE rules defined in 3GPP TS 24.007 [20].
ETSI
Release 18 530 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.1.12.1 CN Common GSM-MAP NAS system information

The purpose of the CN Common GSM-MAP NAS system information element is to provide the MS with actual
parameter settings of parameters relevant for both MM and GMM functionality. The coding of the information element
identifier and length information is defined in the 3GPP TS 25.331 [23c]. Only the coding of the content is in the scope
of the present document.
The content of the CN common GSM-MAP NAS system information element is coded as shown in
figure 10.5.1.12.1/3GPP TS 24.008 and table 10.5.1.12.1/3GPP TS 24.008.
The length of this element content is two octets. The MS shall ignore any additional octets received.
8 7 6 5 4 3 2 1
LAC octet 1
octet 2
Figure 10.5.1.12.1/3GPP TS 24.008 Common system information element
Table 10.5.1.12.1/3GPP TS 24.008: Common system information element
LAC, Location Area Code (2 octet field)

This field is the binary representation of the Location Area Code, see 3GPP TS 23.003 [10]. The LAC field
consists of 16 bits. Bit 8 in octet 1 is the most significant bit and bit 1 in octet 2 is the least significant bit.
10.5.1.12.2 CS domain specific system information

The purpose of the CN domain specific GSM-MAP NAS system information element, when used for the CS domain, is
to provide the MS with actual parameter settings of parameters relevant only for MM functionality. The coding of the
information element identifier and length information is defined in the 3GPP TS 25.331 [23c]. Only the coding of the
content is in the scope of the present document.
For CS domain, the content of the CN domain specific GSM-MAP NAS system information element is coded as shown
in figure 10.5.1.12.2/3GPP TS 24.008 and table 10.5.1.12.2/3GPP TS 24.008. The length of this element content is two
octets. The MS shall ignore any additional octets received.
8 7 6 5 4 3 2 1
T3212 octet 1
Spare ATT octet 2
Figure 10.5.1.12.2/3GPP TS 24.008 CS domain specific system information element
Table 10.5.1.12.2/3GPP TS 24.008: CS domain specific system information element
T3212 timeout value (1 octet field)

The T3212 timeout field is coded as the binary representation of the timeout value for periodic updating in
decihours. Bit 8 in octet 1 is the most significant bit and bit 1 in octet 1 is the least significant bit.
Range: 1 to 255
The value 0 is used for infinite timeout value i.e. periodic updating shall not be used
ATT, Attach-detach allowed (1 bit field):

Bit 1
0 MSs shall not apply IMSI attach and detach procedure.
1 MSs shall apply IMSI attach and detach procedure
The bits 2 – 8 of octet 2 are spare and shall be coded all zeros.
ETSI
Release 18 531 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.1.12.3 PS domain specific system information

The purpose of the CN domain specific GSM-MAP NAS system information element, when used for the PS domain, is to
provide the MS with actual parameter settings of parameters relevant only for GMM functionality. The coding of the
information element identifier and length information is defined in the 3GPP TS 25.331 [23c]. Only the coding of the
content is in the scope of the present document.
For PS domain, the content of the CN domain specific GSM-MAP NAS system information element is coded as shown in
figure 10.5.1.12.3/3GPP TS 24.008 and table 10.5.1.12.3/3GPP TS 24.008. The length of this element content is two
octets. The MS shall ignore any additional octets received.
8 7 6 5 4 3 2 1
RAC octet 1
Spare NMO I NMO octet 2
Figure 10.5.1.12.3/3GPP TS 24.008 PS domain specific system information element
Table 10.5.1.12.3/3GPP TS 24.008: PS domain specific system information element
RAC, Routing Area Code (8 bit field)

This field is the binary representation of the Routing Area Code, see 3GPP TS 23.003 [10]. Bit 8 in octet 1
is the most significant bit and bit 1 in octet 1 is the least significant bit.
NMO, Network Mode of Operation (1 bit field)

This field is the binary representation of the Network Mode of Operation, see 3GPP TS 23.060 [74]
Bit 1
0 Network Mode of Operation I
1 Network Mode of Operation II
NMO I, Network Mode of Operation I (1 bit field)

This field is the binary representation of whether the Network Mode of Operation I is applicable for the MS
configured for NMO_I_Behaviour, see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]
Bit 2
0 Network Mode of Operation indicated in Bit 1 (NMO, Network Mode of Operation) is used for MS
configured for NMO_I_Behaviour
1 Network Mode of Operation I is used for MS configured for NMO_I_Behaviour
The bits 3 – 8 of octet 2 are spare and shall be coded all zeros.
10.5.1.13 PLMN list

The purpose of the PLMN List information element is to provide a list of PLMN codes to the mobile station.
The PLMN List information element is coded as shown in figure 10.5.13/3GPP TS 24.008 and table 10.5.13/3GPP TS
24.008.
The PLMN List is a type 4 information element with a minimum length of 5 octets and a maximum length of 47 octets.
ETSI
Release 18 532 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
PLMN List IEI octet 1
Length of PLMN List contents octet 2
MCC digit 2, PLMN 1 MCC digit 1, PLMN 1 octet 3
MNC digit 3, PLMN 1 MCC digit 3, PLMN 1 octet 4
MNC digit 2, PLMN 1 MNC digit 1, PLMN 1 octet 5
MCC digit 2, PLMN 15 MCC digit 1, PLMN 15 octet 45
MNC digit 3, PLMN 15 MCC digit 3, PLMN 15 octet 46
MNC digit 2, PLMN 15 MNC digit 1, PLMN 15 octet 47
Figure 10.5.13/3GPP TS 24.008 PLMN List information element
Table 10.5.13/3GPP TS 24.008: PLMN List information element
MCC, Mobile country code (octet 3, octet 4 bits 1 to 4)

MNC, Mobile network code (octet 5, octet 4 bits 5 to 8).

may decide to use only two digits in the MNC over the radio interface. In this case,
bits 5 to 8 of octet 4 shall be coded as "1111". Mobile equipment shall accept MNC
coded in such a way.
10.5.1.14 NAS container for PS HO

The purpose of the NAS container for PS HO information element is to indicate the NAS specific information for the PS
handover to A/Gb mode. The NAS container for PS HO information element is included in the PS HO command
message, see 3GPP TS 44.060 [76]. The coding of the information element identifier and length information is defined
in 3GPP TS 44.060 [76].
The content of the NAS container for PS HO information element is coded as shown in figure 10.5.1.14/3GPP TS
24.008 and table 10.5.1.14/3GPP TS 24.008. The length of this information element is 5 octets. The MS shall ignore
any additional octets received.
8 7 6 5 4 3 2 1
0 0 0 old 0 Type of ciphering octet 1
spare spare spare XID spare algorithm
IOV-UI value (High-order octet) octet 2
IOV-UI value (continued) octet 3
IOV-UI value (continued) octet 4
IOV-UI value (Low-order octet) octet 5
ETSI
Release 18 533 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 10.5.1.14/3GPP TS 24.008 NAS container for PS HO information element
Table 10.5.1.14/3GPP TS 24.008: NAS container for PS HO information element
Type of ciphering algorithm (octet 1, bits 1 to 3)

Bits
3 2 1
0 0 0 ciphering not used
0 0 1 GPRS Encryption Algorithm GEA/1
Bit 4 of octet 1 is spare and shall be coded as zero.
old XID (octet 1, bit 5):

With this bit the network indicates, which LLC layer parameters and layer-3 parameters the MS shall use in
the target cell after it has performed the Reset of LLC and SNDCP.
Bit 5
0 The MS shall perform a Reset of LLC and SNDCP without old XID indicator as specified in
3GPP TS 44.064 [78a] and 3GPP TS 44.065 [78].
1 The MS shall perform a Reset of LLC and SNDCP with old XID indicator as specified in
3GPP TS 44.064 [78a] and 3GPP TS 44.065 [78].
The bits 6 – 8 of octet 1 are spare and shall be coded all zeroes.
IOV-UI value (octet 2 to 5)

The IOV-UI value consists of 32 bits, the format is defined in 3GPP TS 44.064 [78a].

The purpose of the MS network feature support information element is to indicate support of mobility management
parameters during the tracking area updating, location updating, routing area updating, IMSI attach, GPRS attach, and
EPS attach procedures.
The MS network feature support information element is coded as shown in figure 10.5.1.15/3GPP TS 24.008 and
table 10.5.1.15/3GPP TS 24.008.
The MS network feature support information element is a type 1 information element.
8 7 6 5 4 3 2 1
MS network feature support 0 0 0 extend octet 1
IEI Spare Spare Spare ed
periodi
c
timers
Figure 10.5.1.15/3GPP TS 24.008: MS network feature support information element
ETSI
Release 18 534 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.1.15/3GPP TS 24.008: MS network feature support information element
Extended periodic timers (octet 1)
Bit
1
0 MS does not support the extended periodic timer in this domain
1 MS supports the extended periodic timer in this domain
The relevant extended periodic timer is T3212 for MM messages, T3312 for GMM
messages, and T3412 for EMM messages.
Bits 4, 3 and 2 of octet 1 are spare and shall be coded as zero.
10.5.2 Radio Resource management information elements.

See 3GPP TS 44.018 [84].
10.5.3 Mobility management information elements.
10.5.3.1 Authentication parameter RAND

The purpose of the Authentication Parameter RAND information element is to provide the mobile station with a non-
predictable number to be used to calculate the authentication response signature SRES and the ciphering key Kc (for a
GSM authentication challenge), or the response RES and both the ciphering key CK and integrity key IK (for a UMTS
authentication challenge).
The Authentication Parameter RAND information element is coded as shown in figure 10.5.75/3GPP TS 24.008 and
table 10.5.89/3GPP TS 24.008.
The Authentication Parameter RAND is a type 3 information element with 17 octets length.
8 7 6 5 4 3 2 1
Authentication parameter RAND IEI octet 1
RAND value octet 2
octet 17
Figure 10.5.75/3GPP TS 24.008 Authentication Parameter RAND information element
Table 10.5.89/3GPP TS 24.008: Authentication Parameter RAND information element
RAND value (octet 2, 3,... and 17)

The RAND value consists of 128 bits. Bit 8 of octet 2 is the most significant bit while bit 1 of octet
17 is the least significant bit.
10.5.3.1.1 Authentication Parameter AUTN (UMTS and EPS authentication challenge)

The purpose of the Authentication Parameter AUTN information element is to provide the MS with a means of
authenticating the network.
The Authentication Parameter AUTN information element is coded as shown in figure 10.5.75.1/3GPP TS 24.008 and
table 10.5.89.1/3GPP TS 24.008.
The Authentication Parameter AUTN is a type 4 information element with a length of 18 octets.
ETSI
Release 18 535 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Authentication Parameter AUTN IEI octet 1
Length of AUTN contents octet 2
octet 3
AUTN
octet 18
Figure 10.5.75.1/3GPP TS 24.008 Authentication Parameter AUTN information element (UMTS and
EPS authentication challenge)
Table 10.5.89.1/3GPP TS 24.008 Authentication Parameter AUTN information element (UMTS and EPS
authentication challenge)
AUTN value (octets 3 to 18)

The AUTN consists of (SQN xor AK)||AMF||MAC
=48+16+64 bits
(see 3GPP TS 33.102 [5a])
Bit 8 of octet 9 is the "separation bit" of the AMF field (see 3GPP TS 33.401 [123]).
10.5.3.2 Authentication Response parameter

The purpose of the authentication response parameter information element is to provide the network with the
authentication response calculated in the SIM/USIM.
The Authentication Parameter SRES information element is coded as shown in figure 10.5.76/3GPP TS 24.008 and
tables 10.5.90 a & b /3GPP TS 24.008.
The Authentication Response Parameter is a type 3 information element with 5 octets length. In a GSM authentication
challenge, the response calculated in the SIM/USIM (SRES) is 4 bytes in length, and is placed in the Authentication
Response Parameter information element.
In a UMTS authentication challenge, the response calculated in the USIM (RES) may be up to 16 octets in length. The 4
most significant octets shall be included in the Authentication Response Parameter information element. The remaining
part of the RES shall be included in the Authentication Response Parameter (extension) IE (see subclause 10.5.3.2.1)
8 7 6 5 4 3 2 1
Authentication Response parameter IEI octet 1
SRES value or most significant octet 2

4 octets of RES
:
:
octet 5
Figure 10.5.76/3GPP TS 24.008 Authentication Response Parameter information element
Table 10.5.90a/3GPP TS 24.008: Authentication Response Parameter information element

(SRES) (GSM authentication challenge only)
SRES value (octet 2, 3, 4 and 5)

The SRES value consists of 32 bits. Bit 8 of octet 2 is the most significant bit while bit 1 of octet 5
is the least significant bit.
ETSI
Release 18 536 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.90b/3GPP TS 24.008: Authentication Response Parameter information element (RES)

(UMTS authentication challenge only)
RES value (octet 2, 3, 4 and 5)

This contains the most significant 4 octets of RES
If RES>4 octets, the remaining octets of RES shall appear in the Authentication Response
Parameter (extension) IE (see subclause 10.5.3.2.1)
10.5.3.2.1 Authentication Response Parameter (extension) (UMTS authentication challenge

only)
This IE is included if the authentication response parameter RES is longer than 4 octets (UMTS only) and therefore
does not fit in the Authentication Response Parameter field (see 10.5.3.2).
The Authentication Response parameter (extension) IE is coded as shown in figure 10.5.76.1/3GPP TS 24.008 and table
10.5.90.1/3GPP TS 24.008.
The Authentication Response parameter (extension) IE is a type 4 information element with a minimum length of 3
octets and a maximum length of 14 octets.
8 7 6 5 4 3 2 1
Authentication Response (extension) IEI octet 1
Length of Authentication Response contents octet 2
RES (all but 4 most significant octets) octet 3
:
:
octet 14
Figure 10.5.76.1/3GPP TS 24.008 Authentication Response Parameter (extension) information

element (UMTS authentication challenge only)
Table 10.5.90.1/3GPP TS 24.008: Authentication Response Parameter (extension) information element

(RES)
RES (extension) value (octet 3 to 14)
This contains all but the 4 most significant octets of RES
10.5.3.2.2 Authentication Failure parameter (UMTS and EPS authentication challenge)

The purpose of the Authentication Failure parameter information element is to provide the network with the necessary
information to begin a re-authentication procedure (see 3GPP TS 33.102 [5a]) in the case of a 'Synch failure', following
a UMTS or EPS authentication challenge.
The Authentication Failure parameter IE is coded as shown in figure 10.5.76.2/3GPP TS 24.008 and table
10.5.90.2/3GPP TS 24.008.
The Authentication Failure parameter IE is a type 4 information element with a length of 16 octets.
ETSI
Release 18 537 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Authentication Failure parameter IEI octet 1
Length ofAuthentication Failure parameter contents octet 2
Authentication Failure parameter octet 3
:
:
octet 16
Figure 10.5.76.2/3GPP TS 24.008 Authentication Failure parameter information element (UMTS and
EPS authentication challenge)
Table 10.5.90.2/3GPP TS 24.008: Authentication Failure parameter information element
Authentication Failure parameter value (octet 3 to 16)
This contains AUTS (see 3GPP TS 33.102 [5a])
10.5.3.3 CM service type

The purpose of the CM Service Type information element is to specify which service is requested from the network.
The CM Service Type information element is coded as shown in figure 10.5.77/3GPP TS 24.008 and
table 10.5.91/3GPP TS 24.008.
The CM Service Type is a type 1 information element.
8 7 6 5 4 3 2 1
CM service type IEI service type octet 1
Figure 10.5.77/3GPP TS 24.008 CM Service Type information element
Table 10.5.91/3GPP TS 24.008: CM Service Type information element
Service type (octet 1)

Bits
4 3 2 1
0 0 0 1 Mobile originating call establishment or packet mode connection
establishment
0 0 1 0 Emergency call establishment
0 1 0 0 Short message service
1 0 0 0 Supplementary service activation
1 0 0 1 Voice group call establishment
1 0 1 0 Voice broadcast call establishment
1 0 1 1 Location Services (NOTE)

NOTE: this service type shall only be used by a type A LMU if the MM
connection was requested for the transmission of LCS signalling
messages specified in 3GPP TS 44.071 [23a].
10.5.3.4 Identity type

The purpose of the Identity Type information element is to specify which identity is requested.
The Identity Type information element is coded as shown in figure 10.5.78/3GPP TS 24.008 and table 10.5.92/3GPP TS
24.008.
ETSI
Release 18 538 3GPP TS 24.008 V18.4.0 (2023-09)
The Identity Type is a type 1 information element.
8 7 6 5 4 3 2 1
Identity type IEI 0 type of identity octet 1
spare
Figure 10.5.78/3GPP TS 24.008 Identity Type information element
Table 10.5.92/3GPP TS 24.008: Identity Type information element

Bits
3 2 1
0 0 1 IMSI
0 1 0 IMEI
0 1 1 IMEISV
1 0 0 TMSI
1 0 1 P-TMSI, RAI, P-TMSI signature
10.5.3.5 Location updating type

The purpose of the Location Updating Type information element is to indicate whether a normal updating, a periodic
updating or an IMSI attach is wanted. It may also indicate that a follow-on request has been received from the mobile
station CM layer.
The Location Updating Type information element is coded as shown in figure 10.5.79/3GPP TS 24.008 and
table 10.5.93/3GPP TS 24.008.
The Location Updating Type is a type 1 information element.
8 7 6 5 4 3 2 1
Location updating FOR 0 LUT octet 1
type IEI spare
Figure 10.5.79/3GPP TS 24.008 Location Updating Type information element
Table 10.5.93/3GPP TS 24.008: Location Updating Type information element
LUT (octet 1)
Bits
2 1
0 0 Normal location updating
0 1 Periodic updating
1 0 IMSI attach
1 1 Reserved
FOR (octet 1)
The Follow-On Request bit (FOR) is coded as follows:
Bits
4
0 No follow-on request pending
1 Follow-on request pending
10.5.3.5a Network Name

The purpose of this information element is to pass a text string to the mobile station.
ETSI
Release 18 539 3GPP TS 24.008 V18.4.0 (2023-09)
The Network Name information element is coded as shown in figure 10.5.80/3GPP TS 24.008 and table 10.5.94/3GPP
TS 24.008.
If the coding scheme UCS2 is used and Chinese-Japanese-Korean-Vietnamese (CJKV) ideographs as defined in
ISO/IEC 10646 [72] are received in the text string, the MS shall use the MCC of the PLMN from which it received the
network name information element to determine the language for those CJKV ideographs as specified in
table 10.5.93a/3GPP TS 24.008:
Table 10.5.93a/3GPP TS 24.008: MCC to CJKV ideograph language mapping table
MCC(s) Country/Region Language

(C, J, K, or V)
460, 461 Mainland China Chinese-G
466 Taiwan Chinese-T
454 HongKong Chinese-T
455 Macao Chinese-T
440, 441 Japan J (Kanji)
450, 467 Korea K (Hanja)
452 Vietnam V (Chunom)
NOTE: This is due to CJKV ideograph language ambiguity in UCS2, in the sense that the same hexadecimal code
can be mapped to different character displays dependent on the used language. The coding of CJKV
ideographs itself does not allow to discriminate the CJKV ideograph language.
The Network Name is a type 4 information element with a minimum length of 3 octets. No upper length limit is
specified except for that given by the maximum number of octets in a L3 message (see 3GPP TS 44.006 [19]).
8 7 6 5 4 3 2 1
Network Name IEI octet 1
Length of Network Name contents octet 2

ext coding scheme Add Number of spare
1 CI bits in last octet octet 3
octet 4
Text String
octet n
Figure 10.5.80/3GPP TS 24.008 Network Name information element
ETSI
Release 18 540 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.94/3GPP TS 24.008 Network Name information element
Number of spare bits in last octet (octet 3, bits 1 to 3)
2 1
0 0 1 bit 8 is spare and set to "0" in octet n
0 1 0 bits 7 and 8 are spare and set to "0" in octet n
0 1 1 bits 6 to 8(inclusive) are spare and set to "0" in octet n
0 0 0 this field carries no information about the number of spare bits in octet n
Add CI (octet 3, bit 4)
0 The MS should not add the letters for the Country's Initials to the text string
1 The MS should add the letters for the Country's Initials and a separator
(e.g. a space) to the text string
Coding Scheme (octet 3, bits 5-7)
0 0 0 Cell Broadcast data coding scheme, GSM default alphabet, language unspecified, defined in 3GPP TS
23.038 [8b]
0 0 1 UCS2 (16 bit) [72]
0 1 0
to reserved
1 1 1
If Coding Scheme = "000" and the <CR> as specified in 3GPP TS 23.038 [8b] is intended to be added to the octet
boundary by the network, the Number of spare bits in last octet is set to "111".
If Coding Scheme is not equal to "000", all values of number of spare bits in last octet received by the mobile station
shall be interpreted as "this field carries no information about the number of spare bits in octet n".
Text String (octet 4 to octet n, inclusive)

Encoded according to the Coding Scheme defined by octet 3, bits 5-7
10.5.3.6 Reject cause

The purpose of the Reject Cause information element is to indicate the reason why a request from the mobile station is
rejected by the network.
The Reject Cause information element is coded as shown in figure 10.5.81/3GPP TS 24.008 and
table 10.5.95/3GPP TS 24.008.
The Reject Cause is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
Reject cause IEI octet 1
reject cause value octet 2
Figure 10.5.81/3GPP TS 24.008 Reject Cause information element
ETSI
Release 18 541 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.95/3GPP TS 24.008: Reject Cause information element
Reject cause value (octet 2)

Bits
8 7 6 5 4 3 2 1
0 0 0 0 0 0 1 0 IMSI unknown in HLR
0 0 0 0 0 0 1 1 Illegal MS
0 0 0 0 0 1 0 0 IMSI unknown in VLR
0 0 0 0 0 1 0 1 IMEI not accepted
0 0 0 0 0 1 1 0 Illegal ME
0 0 0 0 1 0 1 1 PLMN not allowed
0 0 0 0 1 1 0 0 Location Area not allowed
0 0 0 0 1 1 0 1 Roaming not allowed in this location area
0 0 0 0 1 1 1 1 No Suitable Cells In Location Area
0 0 0 1 0 0 0 1 Network failure
0 0 0 1 0 1 0 0 MAC failure
0 0 0 1 0 1 0 1 Synch failure
0 0 0 1 0 1 1 0 Congestion
0 0 0 1 0 1 1 1 GSM authentication unacceptable
0 0 0 1 1 0 0 1 Not authorized for this CSG
0 0 1 0 0 0 0 0 Service option not supported
0 0 1 0 0 0 0 1 Requested service option not subscribed
0 0 1 0 0 0 1 0 Service option temporarily out of order
0 0 1 0 0 1 1 0 Call cannot be identified
0 0 1 1 0 0 0 0 }
to } retry upon entry into a new cell
0 0 1 1 1 1 1 1 }
0 1 0 1 1 1 1 1 Semantically incorrect message
0 1 1 0 0 0 0 0 Invalid mandatory information
0 1 1 0 0 0 0 1 Message type non-existent or not implemented
0 1 1 0 0 0 1 0 Message type not compatible with the protocol state
0 1 1 0 0 0 1 1 Information element non-existent or not implemented
0 1 1 0 0 1 0 0 Conditional IE error
0 1 1 0 0 1 0 1 Message not compatible with the protocol state
0 1 1 0 1 1 1 1 Protocol error, unspecified
Any other value received by the mobile station shall be treated as 0010 0010,
'Service option temporarily out of order'. Any other value received by the network
shall be treated as 0110 1111, 'Protocol error, unspecified'.
NOTE: The listed reject cause values are defined in Annex G.
10.5.3.7 Follow-on Proceed

The purpose of the Follow-on Proceed information element is to indicate that an MM connection may be established on
an existing RR connection.
The Follow-on Proceed information element is coded as shown in figure 10.5.82/3GPP TS 24.008.
The Follow-on Proceed is a type 2 information element.
8 7 6 5 4 3 2 1
Follow-on Proceed IEI octet 1
Figure 10.5.82/3GPP TS 24.008 Follow-on Proceed information element
10.5.3.8 Time Zone

The purpose of this information element is to encode the offset between universal time and local timein steps of 15
minutes.
ETSI
Release 18 542 3GPP TS 24.008 V18.4.0 (2023-09)
The Time Zone information element is coded as shown in figure 10.5.83/3GPP TS 24.008 and
table 10.5.96/3GPP TS 24.008.
The Time Zone is a type 3 information element with a length of 2 octets.
8 7 6 5 4 3 2 1
Time Zone IEI octet 1
Time Zone
octet 2
Figure 10.5.83/3GPP TS 24.008 Time Zone information element
Table 10.5.96/3GPP TS 24.008 Time Zone information element
Time Zone (octet 2, bits 1-8)

This field uses the same format as the Timezone field used in the TP-Service-Centre-Time-Stamp,
which is defined in 3GPP TS 23.040 [90], and its value shall be set as defined in 3GPP TS 22.042
[89]
10.5.3.9 Time Zone and Time

The purpose of the timezone part of this information element is to encode the offset between universal time and local
time in steps of 15 minutes.
The purpose of the time part of this information element is to encode the universal time at which this information
element may have been sent by the network.
The Time Zone and Time information element is coded as shown in figure 10.5.84/3GPP TS 24.008 and
table 10.5.97/3GPP TS 24.008.
The Time Zone and Time is a type 3 information element with a length of 8 octets.
8 7 6 5 4 3 2 1
Time Zone and Time IEI octet 1
Year
octet 2
Month
octet 3
Day
octet 4
Hour
octet 5
Minute
octet 6
Second
octet 7
Time zone
octet 8
Figure 10.5.84/3GPP TS 24.008 Time Zone and Time information element
ETSI
Release 18 543 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.97/3GPP TS 24.008 Timezone and Time information element
Year (octet 2, bits 1-8)
This field uses the same format as the Year field used in the TP-Service-Centre-Time-Stamp, which is defined in
3GPP TS 23.040 [90], and its value shall be set as defined in 3GPP TS 22.042 [89]
Month (octet 3, bits 1-8)

This field uses the same format as the Month field used in the TP-Service-Centre-Time-Stamp, which is defined in
3GPP TS 23.040 [90], and its value shall be set as defined in 3GPP TS 22.042 [89].
Day (octet 4, bits 1-8)
This field uses the same format as the Day field used in the TP-Service-Centre-Time-Stamp, which is defined in 3GPP
TS 23.040 [90], and its value shall be set as defined in 3GPP TS 22.042 [89].
Hour (octet 5, bits 1-8)

This field uses the same format as the Hour field used in the TP-Service-Centre-Time-Stamp, which is defined in
Minute (octet 6, bits 1-8)

This field uses the same format as the Minute field used in the TP-Service-Centre-Time-Stamp, which is defined in
Second (octet 7, bits 1-8)

This field uses the same format as the Second field used in the TP-Service-Centre-Time-Stamp, which is defined in
Time Zone (octet 8, bits 1-8)

This field uses the same format as the Time Zone field used in the TP-Service-Centre-Time-Stamp, which is defined in
NOTE: Due to ambiguities in earlier versions of the protocol specifications, some mobile stations may interpret
the received NITZ time as local time. This may result in incorrect time settings in the mobile.
10.5.3.10 CTS permission

The purpose of the CTS permission information element is to indicate that the mobile station is allowed to use GSM-
Cordless Telephony System in the Location Area. The CTS permission information element is coded as shown in
figure 10.5.84a/3GPP TS 24.008.
The CTS permission is a type 2 information element.
8 7 6 5 4 3 2 1
CTS Permission IEI octet 1
Figure 10.5.84a/3GPP TS 24.008 CTS permission information element
ETSI
Release 18 544 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.3.11 LSA Identifier

This element uniquely identifies a LSA.
The LSA Identifier information element is coded as shown in figure 10.68c/3GPP TS 24.008.
The LSA Identifier is a type 4 information element with a length of 2 or 5 octets.
8 7 6 5 4 3 2 1
LSA Identifier IEI octet 1
Length of LSA Identifier contents
octet 2
LSA ID
octet 3
LSA ID cont.
octet 4
LSA ID cont.
octet 5
Figure 10.68c/3GPP TS 24.008 LSA Identifier information element
If the Length = 0, then no LSA ID is included. This is used to indicate that the MS has moved to an area where there is
no LSA available for that MS.
Octets 3-5 are coded as specified in 3GPP TS 23.003 [10], 'Identification of Localised Service Area'. Bit 8 of octet 3 is
the most significant bit.
10.5.3.12 Daylight Saving Time

The purpose of this information element is to encode the Daylight Saving Time in steps of 1 hour.
The Daylight Saving Time information element is coded as shown in figure 10.5.84b/3GPP TS 24.008 and
table 10.5.97a/3GPP TS 24.008.
The Daylight Saving Time is a type 4 information element with a length of 3 octets.
8 7 6 5 4 3 2 1
Daylight Saving Time IEI octet 1
Length of Daylight Saving Time contents octet 2

spare value
0 0 0 0 0 0 octet 3
Figure 10.5.84b/3GPP TS 24.008 Daylight Saving Time information element
Table 10.5.97a/3GPP TS 24.008: Daylight Saving Time information element
Daylight Saving Time value (octet 3)

Bits
2 1
0 0 No adjustment for Daylight Saving Time
0 1 +1 hour adjustment for Daylight Saving Time
1 0 +2 hours adjustment for Daylight Saving Time
1 1 Reserved
ETSI
Release 18 545 3GPP TS 24.008 V18.4.0 (2023-09)

The purpose of this information element is to encode emergency number(s) for use within the country where the IE is
received.
The Emergency Number List information element is coded as shown in figure 10.5.84c/3GPP TS 24.008.
The Emergency Number List IE is a type 4 information element with a minimum length of 5 octets and a maximum
length of 50 octets.
8 7 6 5 4 3 2 1
Emergency Number List IEI octet 1
Length of Emergency Number List IE contents octet 2
Length of 1st Emergency Number information (Note 1) octet 3
Spare Emergency Service Category Value octet 4
0 0 0
Number digit 2 Number digit 1 octet 5
(Note 2)
Number digit 4 Number digit 3 octet 6*
: : :
(Note 3) octet j-1*
Length of 2nd Emergency Number information (Note 1) octet j*

Spare Emergency Service Category Value octet j+1*
0 0 0
Number digit 2 Number digit 1 octet j+2*
(Note 2)
Number digit 4 Number digit 3 octet j+3*
: : :
(Note 3) : octet j+k*
. .
. .
. .
Length of xth Emergency Number information (Note 1) octet n*
Spare Emergency Service Category Value octet n+1*
0 0 0
Number digit 2 Number digit 1 octet n+2*
(Note 2)
Number digit 4 Number digit 3 octet n+3*
: : :
(Note 3) : octet n+m*
NOTE 1: The length contains the number of octets used to encode the Emergency Service Category Value and the
Number digits.
NOTE 2: The number digit(s) in octet 5 precedes the digit(s) in octet 6 etc. The number digit, which would be
entered first, is located in octet 5, bits 1 to 4. The contents of the number digits are coded as shown in
table 10.5.118/3GPP TS 24.008.
NOTE 3: If the emergeny number contains an odd number of digits, bits 5 to 8 of the last octet of the respective
emergency number shall be filled with an end mark coded as "1111".
Figure 10.5.84c/3GPP TS 24.008 Emergency Number List information element
ETSI
Release 18 546 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.97aa/3GPP TS 24.008: Emergency Number List information element
Emergency Service Category Value (octet 4, j+1, n+1, etc.; bit 1 to 5)
Bits 1 to 5 are coded as bits 1 to 5 of octet 3 of the Service Category information

element as specified in subclause 10.5.4.33.

The purpose of the Additional update parameters information element is to provide additional information during the
location updating procedure and during MM connection establishment.
The Additional update parameters information element is coded as shown in figure 10.5.84d/3GPP TS 24.008 and
table 10.5.97b/3GPP TS 24.008.
The Additional update parameters information element is a type 1 information element.
8 7 6 5 4 3 2 1
Additional update parameters 0 DR- CSMO CSMT octet 1
IEI Spare VCC
Figure 10.5.84d/3GPP TS 24.008: Additional update parameters information element
Table 10.5.97b/3GPP TS 24.008: Additional update parameters information element
Additional update parameters value (octet 1, bit 1 to 4)
CSMT (1 bit field)
Bit
1
0 No additional information.
1 CS fallback mobile terminating call
CSMO (1 bit field)
Bit
2
1 CS fallback mobile originating call
DRVCC call (1 bit field)
Bit
3
1 DRVCC call
10.5.3.15 Void
10.5.3.16 MM Timer
The purpose of the MM timer information element is to specify MM specific timer values, e.g. for the timer T3246.
The MM timer is a type 4 information element with 3 octets length.
ETSI
Release 18 547 3GPP TS 24.008 V18.4.0 (2023-09)
The MM timer information element is coded as shown in figure 10.5.3.16-1/3GPP TS 24.008 and table 10.5.3.16-
1/3GPP TS 24.008.
8 7 6 5 4 3 2 1
MM Timer IEI octet 1
Length of MM Timer contents octet 2
MM Timer value octet 3
Figure 10.5.3.16-1/3GPP TS 24.008: MM Timer information element
Table 10.5.3.16-1/3GPP TS 24.008: MM Timer information element
Timer value (octet 3)
Bits 5 to 1 represent the binary coded timer value.
Bits 6 to 8 defines the timer value unit for the MM timer as follows:
Bits
876
0 0 0 value is incremented in multiples of 2 seconds
0 0 1 value is incremented in multiples of 1 minute
0 1 0 value is incremented in multiples of decihours
1 1 1 value indicates that the timer is deactivated.
Other values shall be interpreted as multiples of 1 minute in this version of the

protocol.
The value indicated is contructed by multiplying the value in bits 5 to 1 with the timer
value unit in bits 8 to 6, unless the timer value unit indicates the timer being
deactivated.
10.5.4 Call control information elements
10.5.4.1 Extensions of codesets

There is a certain number of possible information element identifier values using the formatting rules described in
subclause 10.5: 128 from the type 3 & 4 information element format and at least 8 from the type 1 & 2 information
element format.
One value in the type 1 format is specified for shift operations described below. One other value in both the type 3 & 4
and type 1 format is reserved. This leaves 133 information element identifier values available for assignment.
It is possible to expand this structure to eight codesets of 133 information element identifier values each. One common
value in the type 1 format is employed in each codeset to facilitate shifting from one codeset to another. The contents of
this shift information element identifies the codeset to be used for the next information element or elements. The
codeset in use at any given time is referred to as the "active codeset". By convention, codeset 0 is the initially active
codeset.
Two codeset shifting procedures are supported: locking shift and non-locking shift.
Codeset 5 is reserved for information elements reserved for national use.
Codeset 6 is reserved for information elements specific to the local network (either public or private).
Codeset 7 is reserved for user-specific information elements.
The coding rules specified in subclause 10.5 shall apply for information elements belonging to any active codeset.
ETSI
Release 18 548 3GPP TS 24.008 V18.4.0 (2023-09)
The mobile station and the network shall not apply the "comprehension required" scheme (see 3GPP TS 24.007 [20]) to
information elements belonging to codesets different from codeset 0.
IEIs with bits 5, 6, 7 and 8 all set to zero should not be allocated for new optional information elements in codesets
different from codeset 0, because there are legacy mobile stations that apply the "comprehension required" scheme also
to these information elements, e.g. if such a mobile station receives a SETUP message containing an unknown
information element from codeset 5 with an IEI with bits 5, 6, 7 and 8 all set to zero, then the mobile station will release
the call.
Transitions from one active codeset to another (i.e. by means of the locking shift procedure) may only be made to a
codeset with a higher numerical value than the codeset being left.
An information element belonging to codeset 5, 6 or 7 may appear together with information elements belonging to
codeset 0, by using the non-locking shift procedure (see subclause 10.5.4.3).
A user or network equipment shall have the capability to recognize a shift information element and to determine the
length of the following information element, although the equipment need not be able to interpret and act on the content
of the information element. This enables the equipment to determine the start of the subsequent information element.
10.5.4.2 Locking shift procedure

The locking shift procedure employs an information element to indicate the new active codeset. The specified codeset
remains active until another locking shift information element is encountered which specifies the use of another codeset.
For example, codeset 0 is active at the start of message content analysis. If a locking shift to codeset 5 is encountered,
the next information elements will be interpreted according to the information element identifiers assigned in codeset 5,
until another shift information element is encountered. This procedure is used only to shift to a higher order codeset
than the one being left.
The locking shift is valid only within that message which contains the locking shift information element. At the start of
every message content analysis, the active codeset is codeset 0.
The locking shift information element uses the type 1 information element format and coding shown in
figure 10.5.85/3GPP TS 24.008 and table 10.5.98/3GPP TS 24.008.
8 7 6 5 4 3 2 1
1 0 0 1 0 New codeset octet 1
(Shift identifier) identification
"0" in this position indicates locking shift
Figure 10.5.85/3GPP TS 24.008 Locking shift element
Table 10.5.98/3GPP TS 24.008: Locking shift element
Codeset identification (octet 1):

Bits
3 2 1
0 0 0 not applicable
0 0 1 }
to } reserved
1 0 0 }
1 0 1 codeset 5: information elements for national use
1 1 0 codeset 6: information elements specific to the local network
(either public or private)
1 1 1 codeset 7: user-specific information elements
10.5.4.3 Non-locking shift procedure

The non-locking shift procedure provides a temporary shift to the specified lower or higher codeset. The non-locking
shift procedure uses a type 1 information element to indicate the codeset to be used to interpret the next information
ETSI
Release 18 549 3GPP TS 24.008 V18.4.0 (2023-09)
element. After the interpretation of the next information element, the active codeset is again used for interpreting any
following information elements. For example, codeset 0 is active at the beginning of message content analysis. If a non-
locking shift to codeset 6 is encountered, only the next information element is interpreted according to the information
element identifiers assigned in codeset 6. After this information element is interpreted, codeset 0 will again be used to
interpret the following information elements. A non-locking shift information element indicating the current codeset
shall not be regarded as an error.
A locking shift information element shall not follow directly a non-locking shift information element. If this
combination is received, it shall be interpreted as though a locking shift information element had been received.
The non-locking shift information element uses the type 1 information format and coding shown in figure 10.5.86/3GPP
TS 24.008 and table 10.5.99/3GPP TS 24.008.
8 7 6 5 4 3 2 1
1 0 0 1 1 Temporary codeset octet 1
(Shift identifier) identification
"1" in this position indicates non-locking shift
Figure 10.5.86/3GPP TS 24.008 Non-locking shift element
Table 10.5.99/3GPP TS 24.008: Non-locking shift element
Codeset identification (octet 1):

Bits
3 2 1
0 0 0 codeset 0 (initially active):
3GPP TS 24.008 information elements
0 0 1 }
to } reserved
1 0 0 }
1 0 1 codeset 5: information elements for national use
1 1 0 codeset 6: information elements specific to the local network
(either public or private)
1 1 1 codeset 7: user-specific information elements
10.5.4.4 Auxiliary states

The purpose of the auxiliary states information element is to describe the current status of the auxiliary states of a call in
the call control states "active" and "mobile originating modify" (see 3GPP TS 24.083 [27] and 3GPP TS 24.084 [28]).
The auxiliary states information element is coded as shown in figure 10.5.87/3GPP TS 24.008, table 10.5.100/3GPP TS
24.008 and table 10.5.101/3GPP TS 24.008.
The auxiliary states is a type 4 information element with 3 octets length.
8 7 6 5 4 3 2 1
Auxiliary states IEI octet 1
Length of auxiliary states contents octet 2

1 0 0 0 hold aux. MPTY aux.
ext spare state state octet 3
Figure 10.5.87/3GPP TS 24.008 Auxiliary states information element
ETSI
Release 18 550 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.100/3GPP TS 24.008: Auxiliary states information element
Hold auxiliary state (octet 3)
Bits
4 3
0 0 idle Note 1
0 1 hold request Note 1
1 0 call held Note 1
1 1 retrieve request Note 1
Note 1: These states are defined in 3GPP TS 24.083 [27].
Table 10.5.101/3GPP TS 24.008: Auxiliary states information element
Multi party auxiliary state (octet 3)

Bits
2 1
0 0 idle Note 2
0 1 MPTY request Note 2
1 0 call in MPTY Note 2
1 1 split request Note 2
Note 2: These states are defined in 3GPP TS 24.084 [28].
10.5.4.4a Backup bearer capability

The purpose of the backup bearer capability IE is to indicate a requested service to a MS in case a complete description
of the bearer service by a bearer capability IE is not available. The backup bearer capability information element is not
subject to compatibility checking as described in annex B.
The backup bearer capability IE is coded as shown in figure 10.5.87a/3GPP TS 24.008 and
tables 10.5.101a/3GPP TS 24.008 to 10.5.101m/3GPP TS 24.008.
The backup bearer capability is a type 4 information element with a minimum length of 3 octets and a maximum length
of 15 octets.
ETSI
Release 18 551 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Backup bearer capability IEI octet 1
Length of the backup bearer capability contents octet 2

1 radio co- trans information
ext channel ding fer transfer octet 3
requirement std mode capability
1 comp dupl. confi NIRR esta-
ext -ress. Structure mode gur. bli. octet 4*
0/1 0 0 rate signalling
ext access id. adaption access protocol octet 5*
1 Other rate 0 0 0
ext Other IT adaption Spare octet 5a*
C
0/1 0 1 User information sync/
ext layer 1 id. layer 1 protocol async octet 6*
0/1 numb. nego- numb.
ext stop tia- data user rate octet 6a*
bits tion bits
0/1 intermed. NIC NIC
ext rate on TX on RX Parity octet 6b*
0/1 connection
ext element modem type octet 6c*
0/1 Other
ext modem type Fixed network user rate octet 6d*
0/1 Acceptable Maximum number of
ext channel traffic channels octet 6e*
codings
0/1 UIMI Wanted air interface
ext user rate octet 6f*
1 Acceptable 0 0
ext channel codings Asymmetry
Extended Indication Spare octet 6g*
1 1 0 User information
ext layer 2 id. layer 2 protocol octet 7*
Figure 10.5.87a/3GPP TS 24.008 Backup bearer capability information element
ETSI
Release 18 552 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE: The coding of the octets of the backup bearer capability IE is not conforming to the coding of the bearer
capability IE in ITU-T Recommendation Q.931 [53].
Table 10.5.101a/3GPP TS 24.008: Backup bearer capability information element
Radio channel requirement (octet 3)

In A/Gb mode and GERAN Iu mode, i.e. not applicable for UTRAN Iu mode data services.
Bits 6 and 7 are spare bits. The sending side (i.e. the network) shall set bit 7 to value 0 and bit 6 to
value 1.
Coding standard (octet 3)

Bit
5
0 GSM standardized coding as described below
1 reserved
Transfer mode (octet 3)

Bit
4
0 circuit mode
1 packet mode
Information transfer capability (octet 3)

Bits
321
0 0 0 speech
0 0 1 unrestricted digital information
0 1 0 3.1 kHz audio, ex PLMN
0 1 1 facsimile group 3
1 0 1 Other ITC (See Octet 5a)
1 1 1 reserved, to be used in the network.
The meaning is: alternate speech/facsimile group 3 - starting with speech.
All other values are reserved
ETSI
Release 18 553 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.101b/3GPP TS 24.008: Backup bearer capability information element
Compression (octet 4)
Structure (octet 4)
Bits
65
00 service data unit integrity
11 unstructured
Duplex mode (octet 4)

Bit
4
0 half duplex
1 full duplex
Configuration (octet 4)
Bit
3
0 point-to-point
NIRR (octet 4)
(Negotiation of Intermediate Rate Requested)
In A/Gb mode and GERAN Iu mode, i.e. not applicable for UTRAN Iu modedata services.
Establishment (octet 4)
Bit
1
0 demand
Table 10.5.101c/3GPP TS 24.008: Backup bearer capability information element
Access identity (octet 5)

Bits
76
00 octet identifier
Rate adaption (octet 5)

Bits
54
00 no rate adaption
01 rate adaptation according to ITU-T Rec. V.110 [60] and ITU-T Rec. X.30 [65]
10 flag stuffing according to ITU-T Rec. X.31 [66]
11 Other rate adaption (see octet 5a)
Signalling access protocol (octet 5)
Bits
321
0 0 1 according to ITU-T Rec. Q.920 [49] and ITU-T Rec. Q.930 [50]
ETSI
Release 18 554 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.101d/3GPP TS 24.008: Backup bearer capability information element
Other ITC (octet 5a)

If the value "Other ITC" is not signalled in the field "ITC" then the contents of this field shall be
ignored.
Bit
76
00 restricted digital information
Other rate adaption (octet 5a)

If the value " Other rate adaption" is not signalled in the field "Rate adaption" then the contents of
this field shall be ignored.
In UTRAN Iu mode, PIAFS (see 3GPP TS 27.001 [36]) shall be considered. In A/Gb mode and
GERAN Iu mode, the call shall be rejected if PIAFS is requested.
Bit
54
00 according to ITU-T Rec. V.120 [61]
01 according to ITU-T Rec. H.223 [146] and ITU-T Rec. H.245 [119]
10 PIAFS
Table 10.5.101e/3GPP TS 24.008: Backup bearer capability information element
Layer 1 identity (octet 6)

Bits
76
01 octet identifier
User information layer 1 protocol (octet 6)

Bits
5432
0000 default layer 1 protocol
All other values reserved.
Synchronous/asynchronous (octet 6)
Bit
1
0 synchronous
1 asynchronous
ETSI
Release 18 555 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.101f/3GPP TS 24.008: Backup bearer capability information element
Number of Stop Bits (octet 6a)

Bit
7
0 1 bit (This value is also used in the case of synchronous mode)
1 2 bits
Negotiation (octet 6a)

Bit
6
0 in-band negotiation not possible
NOTE: See ITU-T Rec. V.110 [60] and ITU-T Rec. X.30 [65]
Number of data bits excluding parity bit if present (octet 6a)

Bit
5
0 7 bits
1 8 bits (this value is also used in the case of bit oriented protocols)
User rate (octet 6a)

In A/Gb mode and GERAN Iu mode only.
Bits
4321
0000 User rate unknown
0001 0.3 kbit/s (according to ITU-T Rec. X.1 [142] and ITU-T Rec. V.110 [60])
0110 12.0 kbit/s transparent (non compliance with ITU-T Rec. X.1 [142] and
ITU-T Rec. V.110 [60])
0111 reserved: was allocated in earlier phases of the protocol.
For facsimile group 3 calls the user rate indicates the first and maximum speed the mobile station
is using.
ETSI
Release 18 556 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.101g/3GPP TS 24.008: Backup bearer capability information element
Octet 6b for rate adaptation Intermediate rate (octet 6b) according to ITU-T Rec. V.110 [60] and
ITU-T Rec. X.30 [65]
If the value "User rate unknown" is signalled in the field "User rate" then the contents of this field
shall be ignored.
Bits
76
00 reserved
01 reserved
10 8 kbit/s
11 16 kbit/s
Network independent clock (NIC) on transmission (Tx) (octet 6b) (See ITU-T Rec. V.110 [60] and
ITU-T Rec. X.30 [65]).
Bit
5
0 does not require to send data with network independent clock
1 requires to send data with network independent clock
Network independent clock (NIC) on reception (Rx) (octet 6b) (See ITU-T Rec. V.110 [60] and
ITU-T Rec. X.30 [65])
Bit
4
0 cannot accept data with network independent clock (i.e. sender does not support this
optional procedure)
1 can accept data with network independent clock (i.e. sender does support this optional
procedure)
Parity information (octet 6b)

Bits
321
0 0 0 odd
0 1 0 even
0 1 1 none
1 0 0 forced to 0
1 0 1 forced to 1
ETSI
Release 18 557 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.101h/3GPP TS 24.008: Backup bearer capability information element
Connection element (octet 6c)

Bit
76
00 transparent
01 non transparent (RLP)
10 both, transparent preferred
11 both, non transparent preferred
The network should use the 4 values depending on its capabilities to support the different modes.
Modem type (octet 6c)
Bits
54321
0 0 0 0 0 none
0 0 0 0 1 according to ITU-T Rec. V.21 [54] (note 1)
0 0 0 1 1 according to ITU-T Rec. V.22 bis [56] (note 1)
0 0 1 0 0 reserved: was allocated in earlier phases of the protocol
0 0 1 0 1 according to ITU-T Rec. V.26 ter [58] (note 1)
0 0 1 1 0 according to ITU-T Rec. V.32 [59]
0 0 1 1 1 modem for undefined interface
0 1 0 0 0 autobauding type 1

Note 1: In A/Gb mode and GERAN Iu mode only.
Table 10.5.101i/3GPP TS 24.008: Backup bearer capability information element
Other modem type (octet 6d)

Bits
76
0 0 no other modem type specified in this field
Fixed network user rate (octet 6d)

Bit
54321
0 0 0 0 0 Fixed network user rate not applicable/No meaning is associated
with this value.
0 0 0 0 1 9.6 kbit/s (according to ITU-T Rec. X.1 [142] and ITU-T Rec. V.110 [60])
0 0 0 1 0 14.4 kbit/s (according to ITU-T Rec. X.1 [142] and V.110 [60])
0 0 1 1 0 48.0 kbit/s (according to ITU-T Rec. X.1 [142] and V.110 [60] (synch) (note 1))
0 0 1 1 1 56.0 kbit/s (according to ITU-T Rec. X.1 [142] and V.110 [60] (synch) /bit transparent)
0 1 0 0 0 64.0 kbit/s bit transparent
0 1 0 0 1 33.6 kbit/s bit transparent (note 2)
0 1 0 1 0 32.0 kbit/s (according to ITU-T Rec. I.460 [79])
0 1 0 1 1 31.2 kbit/s (according to ITU-T Rec. V.34 [148] (note 2))
The value "0 1 0 1 1" shall be used only by the network to inform the MS about FNUR modification
due to negotiation between the modems in a 3.1 kHz multimedia call.

Note 2: In UTRAN Iu mode only
ETSI
Release 18 558 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.101j/3GPP TS 24.008: Backup bearer capability information element
Acceptable channel codings (octet 6e):

Maximum number of traffic channels (octet 6e):

Table 10.5.101k/3GPP TS 24.008: Backup bearer capability information element
UIMI, User initiated modification indication (octet 6f),
765
000 User initiated modification not allowed/applicable
001 User initiated modification up to 1 TCH/F allowed/may be requested
All other values shall be interpreted as "User initiated modification up to 4 TCH/F may be requested".
User initiated modification indication is not applicable for transparent connection.
Wanted air interface user rate (octet 6f):

Table 10.5.101l/3GPP TS 24.008: Backup bearer capability information element

Bits
76
10 octet identifier
Bits
54321
0 1 0 0 0 according to ISO/IEC 6429 [42], codeset 0 (DC1/DC3)
0 1 0 0 1 reserved: was allocated but never used in earlier phases of the protocol
0 1 0 1 0 videotex profile 1
0 1 1 0 0 COPnoFlCt (Character oriented Protocol with no Flow Control
mechanism)
ETSI
Release 18 559 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.101m/3GPP TS 24.008: Backup bearer capability information element
Acceptable Channel Codings extended (octet 6g):
Bits 2 and 1 are spare.
10.5.4.4a.1 Static conditions for the backup bearer capability IE contents

If the information transfer capability field (octet 3) indicates "speech", octets 4, 5, 5a, 5b, 6, 6a, 6b, 6c, 6d, 6e, 6f, 6g
and 7 shall not be included.
If the information transfer capability field (octet 3) indicates a value different from "speech", octets 4 and 5shall be
included, octets 6, 6a, 6b, 6c, 6d, 6e, 6f and 6g are optional. In case octet 6 is included, octets 6a, 6b, and 6c shall also
be included. In case octet 6d is included, octets 6e, 6f and 6g may be included. If the information transfer capability
field (octet 3) indicates "facsimile group 3" and octet 6c is included, the modem type field (octet 6c) shall indicate
"none".
If the information transfer capability field (octet 3) indicates "other ITC" or the rate adaption field (octet 5) indicates
"other rate adaption", octet 5a shall be included.
The modem type field (octet 6c) shall not indicate "autobauding type 1" unless the connection element field (octet 6c)
indicates "non transparent".
10.5.4.5 Bearer capability

The purpose of the bearer capability information element is to describe a bearer service. The use of the bearer capability
information element in relation to compatibility checking is described in annex B.
The bearer capability information element is coded as shown in figure 10.5.88/3GPP TS 24.008 and
tables 10.5.102/3GPP TS 24.008 to 10.5.115/3GPP TS 24.008.
The bearer capability is a type 4 information element with a minimum length of 3 octets and a maximum length of
16 octets.
ETSI
Release 18 560 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Bearer capability IEI octet 1
Length of the bearer capability contents octet 2

0/1 radio co- trans information
ext channel ding fer transfer octet 3
requirement std mode capability
0/1 0 0
ext co- CTM speech version octet 3a *
ding spare indication
0/1 0 0 0
ext co- spare spare Speech version octet 3b etc*
ding Indication
1 comp dupl. confi NIRR esta-
ext -ress. structure mode gur. bli. octet 4*
0/1 0 0 rate signalling
ext access id. adaption access protocol octet 5*
0/1 Other rate 0 0 0
ext Other ITC adaption Spare octet 5a*
1 Hdr/ Multi Mode LLI Assig Inb. 0
ext noHdr frame nor/e neg Spare octet 5b*
0/1 0 1 User information sync/
ext layer 1 id. layer 1 protocol async octet 6*
0/1 numb. nego- numb.
ext stop tia- data user rate octet 6a*
bits tion bits
0/1 intermed. NIC NIC
ext rate on TX on RX Parity octet 6b*
0/1 connection
ext element modem type octet 6c*
0/1 Other
ext modem type Fixed network user rate octet 6d*
0/1 Acceptable Maximum number of
ext channel traffic channels octet 6e*
codings
0/1 UIMI Wanted air interface
ext user rate octet 6f*
1 Acceptable 0 0
ext channel codings Asymmetry
extended Indication Spare octet 6g*
1 1 0 User information
ext layer 2 id. layer 2 protocol octet 7*
Figure 10.5.88/3GPP TS 24.008 Bearer capability information element
NOTE 1: The coding of the octets of the bearer capability information element is not conforming to
ITU Recommendation Q.931 [53].
An MS shall encode the Bearer Capability infomation element according to A/Gb mode call control requirements also if
it is requesting for a service in Iu mode, with the following exceptions:
1. A mobile station not supporting A/Gb mode and GERAN Iu mode for the requested bearer service shall set the
following parameters to the value "0":
- Maximum number of traffic channels (octet 6e, bits 1-3)
- Acceptable Channel coding(s) (octet 6e, bits 4, 5 and 7)
2. Furthermore, a mobile station not supporting A/Gb mode and GERAN Iu mode for the requested bearer service
shall also set the following parameters to the value "0", if the respective octets have to be included in the bearer
capability information element according to subclause 10.5.4.5.1 and 3GPP TS 27.001 [36]:
- UIMI, User initiated modification indication (octet 6f, bits 5-7)
- Acceptable Channel Codings extended (octet 6g, bits 5-7)
ETSI
Release 18 561 3GPP TS 24.008 V18.4.0 (2023-09)
For UTRAN Iu mode the following parameters are irrelevant for specifying the radio access bearer, because multiple
traffic channels (multislot) are not deployed, see 3GPP TS 23.034 [104]. However, the parameters if received, shall be
stored in the MSC, and used for handover to A/Gb or GERAN Iu mode:
- Acceptable Channel coding(s) (octet 6e, bits 4, 5 and 7)
- UIMI, User initiated modification indication (octet 6f, bits 5-7)
- Acceptable Channel Codings extended (octet 6g, bits 5-7)
NOTE 2: The following parameters are relevant in UTRAN Iu mode for non transparent data calls for deciding
which RLP version to negotiate in order to avoid renegotiation of RLP version in case of inter-system
handover from UTRAN Iu mode to A/Gb or GERAN Iu mode, see 3GPP TS 24.022 [141]:
- Wanted air interface user rate (octet 6f, bits 1- 4)
- UIMI, User initiated modification indication (octet 6f, bits 5-7).
Table 10.5.102/3GPP TS 24.008: Bearer capability information element
Radio channel requirement (octet 3), network to MS direction

Bits 6 and 7 are spare bits. The sending side (i.e. the network) shall set bit 7 to value 0 and bit 6 to
value 1.
Radio channel requirement (octet 3) MS to network direction
When information transfer capability (octet 3) indicates other values than speech:
Bits
76
00 reserved
01 full rate support only MS
10 dual rate support MS/half rate preferred
11 dual rate support MS/full rate preferred
When information transfer capability (octet 3) indicates the value speech and no speech version
indication is present in octet 3a etc.:
Bits
76
00 reserved
01 full rate support only MS/fullrate speech version 1 supported
1 0 dual rate support MS/half rate speech version 1 preferred, full rate speech version 1 also
supported
1 1 dual rate support MS/full rate speech version 1 preferred, half rate speech version 1 also
supported
When information transfer capability (octet 3) indicates the value speech and speech version
indication(s) is(are) present in octet 3a etc.:
Bits
76
00 reserved
01 the mobile station supports at least full rate speech version 1 but does not support half rate
speech version 1. The complete voice codec preference is specified in octet(s) 3a etc.
10 The mobile station supports at least full rate speech version 1 and half rate speech version
1. The mobile station has a greater preference for half rate speech version 1 than for full
rate speech version 1. The complete voice codec preference is specified in octet(s) 3a etc.
11 The mobile station supports at least full rate speech version 1 and half rate speech version
1. The mobile station has a greater preference for full rate speech version 1 than for half
rate speech version 1. The complete voice codec preference is specified in octet(s) 3a etc.
(continued...)
ETSI
Release 18 562 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.102/3GPP TS 24.008: Bearer capability information element (continued)

Bit
5
0 GSM standardized coding as described below
1 reserved
Transfer mode (octet 3)

Bit
4
0 circuit mode
1 packet mode
Information transfer capability (octet 3)

Bits
321
0 0 0 speech
0 0 1 unrestricted digital information
0 1 0 3.1 kHz audio, ex PLMN
0 1 1 facsimile group 3
1 0 1 Other ITC (See Octet 5a)
1 1 1 reserved, to be used in the network.
The meaning is: alternate speech/facsimile group 3 - starting with speech.
ETSI
Release 18 563 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.103/3GPP TS 24.008 Bearer capability information element
Octet(s) 3a etc. MS to network direction

Octet(s) 3a etc., bits 1 to 4 shall only be used to convey speech coding information belonging to a
A/Gb mode or GERAN Iu mode. When included for a UTRAN Iu mode call establishment they
shall be used for handover to A/Gb mode or GERAN Iu mode.
A mobile station supporting CTM text telephony, but not supporting A/Gb mode or GERAN Iu
mode shall encode octet 3a, bits 1 to 4 as "no speech version supported for GERAN".
Coding
Bit
7
0 octet used for extension of information transfer capability
1 octet used for other extension of octet 3
When information transfer capability (octet 3) indicates speech and coding (bit 7 in octet 3a etc.) is
coded as 0, bits 1 through 6 are coded:
CTM text telephony indication (octet 3a)

Bit
6
0 CTM text telephony is not supported
1 CTM text telephony is supported
Bit 6 in octet(s) 3b etc. is spare.
Bit 5 in octet(s) 3a etc. is spare.
Speech version indication (octet(s) 3a etc.)

Bits
4321
0000 GSM full rate speech version 1 (note 2)
0001 GSM half rate speech version 1 (note 2)
1111 no speech version supported for GERAN (note 1)
All other values have the meaning "speech version tbd" and shall be ignored
when received.
NOTE 1: This value shall only be used by an MS supporting CTM text telephony, but not
supporting A/Gb or GERAN Iu mode.
NOTE 2: As defined in 3GPP TS 26.103 [83] and 3GPP TS 48.008 [85].
If octet 3 is extended with speech version indication(s) (octets 3a etc.), all speech versions
supported shall be indicated and be included in order of preference (the first octet (3a) has the
highest preference and so on).
If information transfer capability (octet 3) indicates speech and coding (bit 7 in octet 3a etc.) is
coded as 1, or the information transfer capability does not indicate speech, then the extension
octet shall be ignored.
Octet(s) 3a etc. network to MS direction
The octet(s) 3a etc. shall be ignored by the MS.
ETSI
Release 18 564 3GPP TS 24.008 V18.4.0 (2023-09)
Compression (octet 4), network to MS direction:

Bit
7
0 data compression not possible
1 data compression possible
Compression (octet 4), MS to network direction:

Bit
7
0 data compression not allowed
1 data compression allowed
Structure (octet 4)
Bits
65
0 0 service data unit integrity
1 1 unstructured
Duplex mode (octet 4)

Bit
4
0 half duplex
1 full duplex
Configuration (octet 4)
Bit
3
0 point-to-point
NIRR (octet 4)
(Negotiation of Intermediate Rate Requested)
Bit
2
0 No meaning is associated with this value.
1 Data up to and including 4.8 kb/s, full rate, non-transparent, 6 kb/s radio interface rate is
requested.
Establishment (octet 4)
Bit
1
0 demand
ETSI
Release 18 565 3GPP TS 24.008 V18.4.0 (2023-09)
Access identity (octet 5)

Bits
76
0 0 octet identifier
Rate adaption (octet 5)

Bits
54
0 0 no rate adaption
0 1 rate adaptation according to ITU-T Rec. V.110 [66] and ITU-T Rec. X.30 [65]
1 0 flag stuffing according to ITU-T Rec. X.31 [66]
1 1 Other rate adaption (see octet 5a)
Signalling access protocol (octet 5)
Bits
321
001 according to ITU-T Rec. Q.920 [49] and ITU-T Rec. Q.930 [50]
010 reserved: was allocated in earlier phases of the protocol
Other ITC (octet 5a)

If the value "Other ITC" is not signalled in the field "ITC" then the contents of this field shall be
ignored.
Bit
76
0 0 restricted digital information
Other rate adaption (octet 5a)

If the value " Other rate adaption" is not signalled in the field "Rate adaption" then the contents of
this field shall be ignored.
In UTRAN Iu mode, PIAFS (see 3GPP TS 27.001 [36]) shall be considered. In A/Gb mode and
GERAN Iu mode, the call shall be rejected if PIAFS is requested.
Bit
54
01 according to ITU-T Rec. H.223 [146] and ITU-T Rec. H.245 [119]
10 PIAFS
ETSI
Release 18 566 3GPP TS 24.008 V18.4.0 (2023-09)
Rate adaption header/no header (octet 5b)
Bit
7
0 Rate adaption header not included
1 Rate adaption header included
Multiple frame establishment support in data link (octet 5b)
Bit
6
0 Multiple frame establishment not supported, only UI frames allowed
1 Multiple frame establishment supported
Mode of operation (octet 5b)
Bit
5
0 Bit transparent mode of operation
1 Protocol sensitive mode of operation
Logical link identifier negotiation (octet 5b)
Bit
4
0 Default, LLI=256 only
1 Full protocol negotiation, (note: A connection over which protocol negotiation will
be executed is indicated in bit 2 of octet 5b)
Assignor/Assignee (octet 5b)
Bit
3
0 Message originator is "default assignee"
1 Message originator is "assignor only"
In band/Out of band negotiation (octet 5b)
Bit
2
0 Negotiation is done in-band using logical link zero
1 Negotiation is done with USER INFORMATION messages on a temporary
signalling connection
Bit 1 is spare and set to the value "0"
ETSI
Release 18 567 3GPP TS 24.008 V18.4.0 (2023-09)

Bits
76

Bits
5432
0 0 0 0 default layer 1 protocol
All other values reserved.
Synchronous/asynchronous (octet 6)
Bit
1
0 synchronous
1 asynchronous
Number of Stop Bits (octet 6a)

Bit
7
0 1 bit (This value is also used in the case of synchronous mode)
1 2 bits
Negotiation (octet 6a)

Bit
6
0 in-band negotiation not possible
NOTE: See ITU-T Rec. V.110 [60] and ITU-T Rec. X.30 [65]
Number of data bits excluding parity bit if present (octet 6a)

Bit
5
0 7 bits
1 8 bits (this value is also used in the case of bit oriented protocols)
User rate (octet 6a)

Bits
4321
0001 0.3 kbit/s according to ITU-T Rec. X.1 [142] and ITU-T Rec. V.110 [60]
0110 12.0 kbit/s transparent (non compliance with ITU-T Rec. X.1 [142] and ITU-
T Rec. V.110 [60])
0111 reserved: was allocated in earlier phases of the protocol.
For facsimile group 3 calls the user rate indicates the first and maximum speed the mobile station
is using.
ETSI
Release 18 568 3GPP TS 24.008 V18.4.0 (2023-09)
Octet 6b for V.110/X.30 rate adaptation Intermediate rate (octet 6b)

Bits
76
0 0 reserved
0 1 reserved
1 0 8 kbit/s
1 1 16 kbit/s
Network independent clock (NIC) on transmission (Tx) (octet 6b) (See ITU-T Rec. V.110 [60] and
ITU-T Rec. X.30 [65])
Bit
5
0 does not require to send data with network independent clock
1 requires to send data with network independent clock
Network independent clock (NIC) on reception (Rx) (octet 6b) (See ITU-T Rec. V.110 [60] and
ITU-T Rec. X.30 [65])
Bit
4
0 cannot accept data with network independent clock (i.e. sender does not support this
optional procedure)
1 can accept data with network independent clock (i.e. sender does support this optional
procedure)
Parity information (octet 6b)

Bits
321
0 0 0 odd
0 1 0 even
0 1 1 none
1 0 0 forced to 0
1 0 1 forced to 1
ETSI
Release 18 569 3GPP TS 24.008 V18.4.0 (2023-09)
Connection element (octet 6c)

Bit
76
0 0 transparent
0 1 non transparent (RLP)
1 0 both, transparent preferred
1 1 both, non transparent preferred
The requesting end (e.g. the one sending the SETUP message) should use the 4 values
depending on its capabilities to support the different modes. The answering party shall only use
the codings 00 or 01, based on its own capabilities and the proposed choice if any. If both MS and
network support both transparent and non transparent, priority should be given to the MS
preference.
Modem type (octet 6c)

Bits
54321
0 0 0 0 0 none
0 0 0 1 1 according to ITU-T Rec. V.22 bis [56] (note 1)
0 0 1 0 1 according to ITU-T Rec.V.26 ter [58] (note 1)
0 0 1 1 0 according to ITU-T Rec. V.32 [59]
0 0 1 1 1 modem for undefined interface
0 1 0 0 0 autobauding type 1

ETSI
Release 18 570 3GPP TS 24.008 V18.4.0 (2023-09)
Other modem type (octet 6d)

Bits
76
0 0 no other modem type specified in this field
10 V.34
Fixed network user rate (octet 6d)

Bit
54321
0 0 0 0 0 Fixed network user rate not applicable/No meaning is associated
with this value.
0 0 1 1 0 48.0 kbit/s (according to ITU-T Rec. X.1 [142] and ITU-T Rec. V.110 [60]) (synch)
(note 1)
0 0 1 1 1 56.0 kbit/s (according to ITU-T Rec. X.1 [142] and ITU-T Rec. V.110 [60]) (synch) /bit
transparent)
0 1 0 0 0 64.0 kbit/s bit transparent
0 1 0 0 1 33.6 kbit/s bit transparent (note 2)
0 1 0 1 0 32.0 kbit/s Recommendation I.460 [79]
0 1 0 1 1 31.2 kbit/s Recommendation V.34 [148] (note 2)
The value "0 1 0 1 1" shall be used only by the network to inform the MS about FNUR modification
due to negotiation between the modems in a 3.1 kHz multimedia call.

Note 2: In UTRAN Iu mode only
ETSI
Release 18 571 3GPP TS 24.008 V18.4.0 (2023-09)
Acceptable channel codings (octet 6e), mobile station to network direction:
Bit
7
0 TCH/F14.4 not acceptable
1 TCH/F14.4 acceptable
Bit
6
0 Spare
Bit
5
Bit
4
Acceptable channel codings (octet 6e), network to MS direction:

Maximum number of traffic channels (octet 6e), MS to network direction:
Bits
321
000 1 TCH
001 2 TCH
010 3 TCH
011 4 TCH
100 5 TCH
101 6 TCH
110 7 TCH
111 8 TCH
Maximum number of traffic channels (octet 6e), network to MS direction:

ETSI
Release 18 572 3GPP TS 24.008 V18.4.0 (2023-09)
UIMI, User initiated modification indication (octet 6f),
765
000 User initiated modification not allowed/required/applicable
All other values shall be interpreted as "User initiated modification up to 4 TCH/F may be requested".
User initiated modification indication is not applicable for transparent connection.
Wanted air interface user rate (octet 6f), MS to network direction:

Bits
4321
0 0 0 0 Air interface user rate not applicable/No meaning associated with this value
0001 9.6 kbit/s
0010 14.4 kbit/s
0011 19.2 kbit/s
0101 28.8 kbit/s
0 1 1 0 38.4 kbit/s
0111 43.2 kbit/s
1000 57.6 kbit/s
1001 interpreted by the network as 38.4 kbit/s in this version of the protocol
Wanted air interface user rate (octet 6f), network to MS direction:


Bits
76
Bits
54321
0 1 0 0 0 according to ISO/IEC 6429 [42], codeset 0 (DC1/DC3)
0 1 0 0 1 reserved: was allocated but never used in earlier phases of the protocol
0 1 0 1 0 videotex profile 1
0 1 1 0 0 COPnoFlCt (Character oriented Protocol with no Flow Control
mechanism)
ETSI
Release 18 573 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.115a/3GPP TS 24.008: Bearer capability information element
Acceptable Channel Codings extended (octet 6g) mobile station to network direction:
Bit
7
Bit
6
Bit
5
Channel Coding Asymmetry Indication
Bits
43
00 Channel coding symmetry preferred
10 Downlink biased channel coding asymmetry is preferred
01 Uplink biased channel coding asymmetry is preferred
11 Unused, if received it shall be interpreted as "Channel coding symmetry preferred"
EDGE Channel Codings (octet 6g), network to MS direction:
Bits 2 and 1 are spare.
10.5.4.5.1 Static conditions for the bearer capability IE contents

If the information transfer capability field (octet 3) indicates "speech", octets 4, 5, 5a, 5b, 6, 6a, 6b, 6c, 6d, 6e, 6f, 6g
and 7 shall not be included.
If the information transfer capability field (octet 3) indicates "speech", octet 3a etc. shall be included only if the mobile
station supports CTM text telephony or if it supports at least one speech version for GERAN other than:
- GSM full rate speech version 1; or
- GSM half rate speech version 1.
If the information transfer capability field (octet 3) indicates a value different from "speech", octets 4, 5, 6, 6a, 6b, and
6c shall be included, octets 6d, 6e, 6f and 6g are optional. In the network to MS direction in case octet 6d is included,
octets 6e, 6f and 6g may be included. In the MS to network direction in case octet 6d is included octet 6e shall also be
included and 6f and 6g may be included.
If the information transfer capability field (octet 3) indicates "facsimile group 3", the modem type field (octet 6c) shall
indicate "none".
If the information transfer capability field (octet 3) indicates "other ITC" or the rate adaption field (octet 5) indicates
"other rate adaption", octet 5a shall be included.
If the rate adaption field (octet 5) indicates "other rate adaption" and the other rate adaption field (octet 5a) indicates
"V.120", octet 5b shall be included.
The modem type field (octet 6c) shall not indicate "autobauding type 1" unless the connection element field (octet 6c)
indicates "non transparent".
ETSI
Release 18 574 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.4.5a Call Control Capabilities

The purpose of the Call Control Capabilities information element is to identify the call control capabilities of the mobile
station.
The Call Control Capabilities information element is coded as shown in figure 10.5.89/3GPP TS 24.008 and
table 10.5.116/3GPP TS 24.008.
The Call Control Capabilities is a type 4 information element with a length of 4 octets.
8 7 6 5 4 3 2 1
Call Control Capabilities IEI octet 1
Length of Call Control Capabilities contents octet 2
Maximum number of supported MCAT ENICM PCP DTMF octet3
bearers
0 0 0 0 Maximum number of
spare speech bearers octet 4
Figure 10.5.89/3GPP TS 24.008 Call Control Capabilities information element
Table 10.5.116/3GPP TS 24.008: Call Control Capabilities
DTMF (octet 3, bit 1)

0 This value is reserved for earlier versions of the protocol.
1 This value indicates that the mobile station supports DTMF as specified
in subclause 5.5.7 of the present document.
PCP (octet 3, bit 2)

0 This value indicates that the mobile station does not support the
Prolonged Clearing Procedure
1 This value indicates that the mobile station supports the Prolonged
Clearing Procedure.
ENICM (octet 3, bit 3)

0 This value indicates that the mobile station does not support the
Enhanced Network-initiated In-Call Modification procedure.
1 This value indicates that the mobile station supports the Enhanced
Network-initiated In-Call Modification procedure as specified in
subclause 5.3.4.3 of the present document.
MCAT (octet 3, bit 4)

0 This value indicates that the mobile station does not support Multimedia
CAT.
1 This value indicates that the mobile station supports Multimedia CAT
during the alerting phase of a mobile originated multimedia call
establishment as specified in subclause 5.3.6.4 of the present document.
Maximum number of supported bearers (octet 3, bit 5 to bit 8)

0 0 0 0 1 bearer supported
All values are interpreted as the binary representation of the number of bearers
supported.
Bit 5 of octet 3 is the least significant bit and bit 8 of octet 3 is the most significant bit.
Maximum number of speech bearers (octet 4, bit 1 to bit 4)
All values are interpreted as the binary representation of the number of bearers
supported.
Note: In this version of the protocol, the MS should not indicate more than one
speech bearer.
ETSI
Release 18 575 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.4.6 Call state

The purpose of the call state information element is to describe the current status of a call, (see subclause 5.1).
The call state information element is coded as shown in figure 10.5.90/3GPP TS 24.008 and
table 10.5.117/3GPP TS 24.008.
The call state is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
call state IEI octet 1
coding
standard call state value (coded in binary) octet 2
Figure 10.5.90/3GPP TS 24.008 Call state information element
ETSI
Release 18 576 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.117/3GPP TS 24.008: Call state information element

Bits
8 7
0 0 standardized coding as described in ITU-T Rec. Q.931
0 1 reserved for other international standards
1 0 national standard
1 1 standard defined for the GSM PLMNS as described below
Coding standards other than "1 1 - Standard defined for the GSM PLMNS" shall not be
used if the call state can be represented with the GSM standardized coding.
The mobile station or network need not support any other coding standard than
"1 1 - Standard defined for the GSM PLMNS".
If a call state IE indicating a coding standard not supported by the receiver is received,
call state "active" shall be assumed.
Call state value (octet 2)

Bits
6 5 4 3 2 1
0 0 0 0 0 0 UO - null NO - null
0 0 0 0 1 0 U0.1- MM connection pending N0.1- MM connection pending
1 0 0 0 1 0 U0.2- CC prompt present N0.2- CC connection pending
1 0 0 0 1 1 U0.3- Wait for network N0.3- Network answer pending
information
1 0 0 1 0 0 U0.4- CC-Establishment N0.4- CC-Establishment
present present
1 0 0 1 0 1 U0.5- CC-Establishment N0.5- CC-Establishment
confirmed confirmed
1 0 0 1 1 0 U0.6- Recall present N0.6- Recall present
0 0 0 0 0 1 U1 - call initiated N1 - call initiated
0 0 0 0 1 1 U3 - mobile originating call N3 - mobile originating call
proceeding proceeding
0 0 0 1 0 0 U4 - call delivered N4 - call delivered
0 0 0 1 1 0 U6 - call present N6 - call present
0 0 0 1 1 1 U7 - call received N7 - call received
0 0 1 0 0 0 U8 - connect request N8 - connect request
0 0 1 0 0 1 U9 - mobile terminating call N9 - mobile terminating call
confirmed confirmed
0 0 1 0 1 0 U10- active N10- active
0 0 1 0 1 1 U11- disconnect request
0 0 1 1 0 0 U12- disconnect indication N12-disconnect indication
0 1 0 0 1 1 U19- release request N19- release request
0 1 1 0 1 0 U26- mobile originating modify N26- mobile originating modify
0 1 1 0 1 1 U27- mobile terminating modify N27- mobile terminating modify
0 1 1 1 0 0 N28- connect indication
10.5.4.7 Called party BCD number

The purpose of the called party BCD number information element is to identify the called party.
The called party BCD number information element is coded as shown in figure 10.5.91/3GPP TS 24.008 and
table 10.5.118/3GPP TS 24.008.
The called party BCD number is a type 4 information element with a minimum length of 3 octets and a maximum
length of 43 octets. For PCS 1900 the maximum length is 19 octets.
ETSI
Release 18 577 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Called party BCD number IEI octet 1
Length of called party BCD number contents octet 2

1 type of Numbering plan
ext number identification octet 3

:
2) :
Figure 10.5.91/3GPP TS 24.008 Called party BCD number information element
NOTE 1: The number digit(s) in octet 4 precedes the digit(s) in octet 5 etc. The number digit which would be
entered first is located in octet 4, bits 1 to 4.
NOTE 2: If the called party BCD number contains an odd number of digits, bits 5 to 8 of the last octet shall be
filled with an end mark coded as "1111".
Since the information element must contain the complete called party BCD number there is no need for an additional
complete indication.
Table 10.5.118/3GPP TS 24.008: Called party BCD number
Type of number (octet 3) (Note 1)
Bits
7 6 5
0 0 0 unknown (Note 2)
0 0 1 international number (Note 3, Note 5)
0 1 0 national number (Note 3)
0 1 1 network specific number (Note 4)
1 0 0 dedicated access, short code
1 0 1 reserved
1 1 0 reserved
1 1 1 reserved for extension
NOTE 1: For the definition of "number" see ITU-T Recommendation I.330 [48] and 3GPP TS 23.003 [10].
NOTE 2: The type of number "unknown" is used when the user or the network has no knowledge of the type of
number, e.g. international number, national number, etc. In this case the number digits field is organized
according to the network dialling plan, e.g. prefix or escape digits might be present.
NOTE 3: Prefix or escape digits shall not be included.
NOTE 4: The type of number "network specific number" is used to indicate administration/service number specific
to the serving network, e.g. used to access an operator.
NOTE 5: The international format shall be accepted by the MSC when the call is destined to a destination in the
same country as the MSC.
ETSI
Release 18 578 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.118/3GPP TS 24.008: Called party BCD number (continued)
Numbering plan identification (octet 3)
Number plan (applies for type of number = 000, 001, 010 and 100)
Bits
4 3 2 1
0 0 0 0 unknown
0 0 0 1 ISDN/telephony numbering plan (ITU-T Rec. E.164 [45] / ITU-
T Rec. E.163 [44])
0 0 1 1 data numbering plan (ITU-T Rec. X.121 [69])
0 1 0 0 telex numbering plan (ITU-T Rec. F.69 [47])
1 0 0 0 national numbering plan
1 0 0 1 private numbering plan
1 0 1 1 reserved for CTS (see 3GPP TS 44.056 [91])
1 1 1 1 reserved for extension
- When an MS is the recipient of number information from the network, any incompatibility between the number
digits and the number plan identification shall be ignored and a STATUS message shall not be sent to the
network.
- In the case of numbering plan "unknown", the number digits field is organized according to the network dialling
plan; e.g. prefix or escape digits might be present.
Table 10.5.118/3GPP TS 24.008: Called party BCD number (continued)
Number digits (octets 4, etc.)

Bits Number digit value
4 3 2 1 or
8 7 6 5
0 0 0 0 0
0 0 0 1 1
0 0 1 0 2
0 0 1 1 3
0 1 0 0 4
0 1 0 1 5
0 1 1 0 6
0 1 1 1 7
1 0 0 0 8
1 0 0 1 9
1 0 1 0 *
1 0 1 1 #
1 1 0 0 a
1 1 0 1 b
1 1 1 0 c
1 1 1 1 used as an endmark in the case of an odd number of
number digits
10.5.4.8 Called party subaddress

The purpose of the Called party subaddress is to identify the subaddress of the called party of a call. For the definition
of a subaddress see ITU-T Rec. I.330 [48].
The Called party subaddress information element is coded as shown in figure 10.5.92/3GPP TS 24.008 and
Table 10.5.119/3GPP TS 24.008.
The called party subaddress is a type 4 information element with a minimum length of 2 octets and a maximum length
of 23 octets.
ETSI
Release 18 579 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Called party Subaddress IEI octet 1
Length of called party subaddress contents octet 2

1 type of odd/ev 0 0 0
ext subaddress Indica spare octet 3*
Subaddress information octet 4*

:
: etc.
Figure 10.5.92/3GPP TS 24.008 Called party subaddress
Table 10.5.119/3GPP TS 24.008: Called party subaddress
Type of subaddress (octet 3)
Bits
7 6 5
0 0 0 NSAP (see ITU-T Rec. X.213 [144]/ISO 8348 AD2)
0 1 0 User specified
Odd/even indicator (octet 3)

Bit
4
0 even number of address signals
1 odd number of address signals
NOTE 1: The odd/even indicator is used when the type of subaddress is "user
specified" and the coding is BCD.
Subaddress information (octet 4, etc...)

The NSAP X.213/ISO8348AD2 address shall be formatted as specified by octet 4
which contains the Authority and Format Identifier (AFI). The encoding is made
according to the "preferred binary encoding" as defined in X.213 [144]/ISO8348AD2.
For the definition of this type of subaddress, see ITU-T Rec. I.334 [145].
A coding example is given in ANNEX A.
For User-specific subaddress, this field is encoded according to the user specification,
subject to a maximum length of 20 octets.
NOTE 2: It is recommended that users apply NSAP subaddress type since this
subaddress type allows the use of decimal, binary and IA5 characters in a
standardised manner.
10.5.4.9 Calling party BCD number

The purpose of the calling party BCD number information element is to identify the origin of a call.
The calling party BCD number information element is coded as shown in figure 10.5.93/3GPP TS 24.008 and
table 10.5.120/3GPP TS 24.008.
The calling party BCD number is a type 4 information element. In the network to mobile station direction it has a
minimum length of 3 octets and a maximum length of 14 octets. (This information element is not used in the mobile
station to network direction.).
ETSI
Release 18 580 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Calling party BCD number IEI octet 1
Length of calling party BCD number contents octet 2

0/1 type of Numbering plan
ext number identification octet 3
1 presentat. 0 0 0 screening
ext indicator spare indicator octet 3a*

:
:
Figure 10.5.93/3GPP TS 24.008 Calling party BCD number information element
The contents of octets 3, 4, etc. are coded as shown in table 10.5.118. The coding of octet 3a is defined in table 10.5.120
below.
If the calling party BCD number contains an odd number of digits, bits 5 to 8 of the last octet shall be filled with an end
mark coded as "1111".
Table 10.5.120/3GPP TS 24.008: Calling party BCD number
Presentation indicator (octet 3a)

Bits
7 6
0 0 Presentation allowed
0 1 Presentation restricted
1 0 Number not available due to interworking
1 1 Reserved
If octet 3a is omitted the value "00 - Presentation allowed" is assumed.
Screening indicator (octet 3a)
Bits
2 1
0 0 User-provided, not screened
0 1 User-provided, verified and passed
1 0 User-provided, verified and failed
1 1 Network provided
If octet 3a is omitted the value "0 0 - User provided, not screened" is assumed.
10.5.4.10 Calling party subaddress

The purpose of the Calling party subaddress is to identify a subaddress associated with the origin of a call. For the
definition of a subaddress see ITU-T Rec. I.330 [48].
The Calling party subaddress information element is coded as shown in figure 10.5.94/3GPP TS 24.008 and
table 10.5.121/3GPP TS 24.008.
The calling party subaddress is a type 4 information element with a minimum length of 2 octets and a maximum length
of 23 octets.
ETSI
Release 18 581 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Calling party Subaddress IEI octet 1
Length of calling party subaddress contents octet 2

ext subaddress Indica octet 3*

:
: etc.
Figure 10.5.94/3GPP TS 24.008 Calling party subaddress
Table 10.5.121/3GPP TS 24.008: Calling party subaddress
Type of subaddress (octet 3)
Bits
7 6 5
0 0 0 NSAP (see ITU-T Rec. X.213 [144]/ISO 8348 AD2)
0 1 0 User specified
Odd/even indicator (octet 3)

Bit
4
0 even number of address signals
1 odd number of address signals
The odd/even indicator is used when the type of subaddress is "user specified" and the
coding is BCD
Subaddress information (octet 4, etc...)

The NSAP X.213/ISO8348AD2 address shall be formatted as specified by octet 4
which contains the Authority and Format Identifier (AFI). The encoding is made
according to the "preferred binary encoding" as defined in ITU-T Rec.
X.213 [144]/ISO8348AD2. For the definition of this type of this type of subaddress, see
ITU-T Rec. I.334 [145].
A coding example is given in annex A.
For User-specific subaddress, this field is encoded according to the user specification,
subject to a maximum length of 20 octets.
NOTE: It is recommended that users apply NSAP subad dress type since this
subaddress type allows the use of decimal, binary and IA5 characters in a
standardised manner.
10.5.4.11 Cause
The purpose of the cause information element is to describe the reason for generating certain messages, to provide
diagnostic information in the event of procedural errors and to indicate the location of the cause originator.
The cause information element is coded as shown in figure 10.5.95/3GPP TS 24.008 and tables 10.5.122 and
10.5.123/3GPP TS 24.008.
The cause is a type 4 information element with a minimum length of 4 octets and a maximum length of 32 octets.
The cause information element may be repeated in a message.
ETSI
Release 18 582 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Cause IEI octet 1
Length of cause contents octet 2

0/1 coding 0
ext standard spare location octet 3
1
ext recommendation octet 3a*
1
ext cause value octet 4
diagnostic(s) if any octet 5*
octet N*
Figure 10.5.95/3GPP TS 24.008 Cause information element
If the default value applies for the recommendation field, octet 3a shall be omitted.
Table 10.5.122/3GPP TS 24.008: Cause information element

Bits
7 6
0 0 Coding as specified in ITU-T Rec. Q.931
0 1 Reserved for other international standards
1 0 National standard
1 1 Standard defined for the GSM PLMNs as described below and in table
10.5.123/3GPP TS 24.008
used if the cause can be represented with the GSM standardized coding.
The mobile station or network need not support any other coding standard than "1 1 -
Standard defined for the GSM PLMNS".
If a cause IE indicating a coding standard not supported by the receiver is received,
cause "interworking, unspecified" shall be assumed.
Location (octet 3)
Bits
4 3 2 1
0 0 0 0 user
0 0 0 1 private network serving the local user
0 0 1 0 public network serving the local user
0 0 1 1 transit network
0 1 0 0 public network serving the remote user
0 1 0 1 private network serving the remote user
0 1 1 1 international network
1 0 1 0 network beyond interworking point
Recommendation (octet 3a)

Octet 3a shall not be included if the coding standard is coded as "1 1 - Standard
defined for GSM PLMNS".
If the coding standard is different from "1 1 - Standard defined for GSM PLMNS", the
coding of octet 3a, if included, and octets 4 to N is according to that coding standard.
ETSI
Release 18 583 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.122/3GPP TS 24.008: Cause information element (continued)
Cause value (octet 4)
The cause value is divided in two fields: a class (bits 5 through 7) and a value within
the class (bits 1 through 4).
The class indicates the general nature of the event.
Class (000): normal event

Class (001): normal event
Class (010): resource unavailable
Class (011): service or option not available
Class (100): service or option not implemented
Class (101): invalid message (e.g. parameter out of range)
Class (110): protocol error (e.g. unknown message)
Class (111): interworking
The cause values are listed in Table 10.5.123/3GPP TS 24.008 below and defined in
Annex H.
Diagnostic(s) (octet 5)
Diagnostic information is not available for every cause, see Table 10.5.123/3GPP TS
24.008 below.
When available, the diagnostic(s) is coded in the same way as the corresponding
information element in clause 10.
The inclusion of diagnostic(s) is optional.
ETSI
Release 18 584 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.123/3GPP TS 24.008: Cause information element values
Cause value Cause Cause Diag- Remarks

Class Value num. nostic
7 6 5 4 3 2 1
0 0 0 0 0 0 1 1. Unassigned (unallocated) number Note 9

0 0 0 0 0 1 1 3. No route to destination Note 9
0 0 0 0 1 1 0 6. Channel unacceptable -
0 0 0 1 0 0 0 8. Operator determined barring -
0 0 0 1 1 0 1 13. Call completed elsewhere -
0 0 1 0 0 0 0 16. Normal call clearing Note 9
0 0 1 0 0 0 1 17. User busy Note 1
0 0 1 0 0 1 0 18. No user responding -
0 0 1 0 0 1 1 19. User alerting, no answer -
0 0 1 0 1 0 1 21. Call rejected Note 9 - user supplied
diagnostic (note 4)
0 0 1 0 1 1 0 22. Number changed New destination(note 5)
0 0 1 1 0 0 0 24. Call rejected due to feature at the -
destination
0 0 1 1 0 0 1 25. Pre-emption
0 0 1 1 0 1 0 26. Non selected user clearing -
0 0 1 1 0 1 1 27. Destination out of order -
0 0 1 1 1 0 0 28. Invalid number format (incomplete -
number)
0 0 1 1 1 0 1 29. Facility rejected Note 1
0 0 1 1 1 1 0 30. Response to STATUS ENQUIRY -
0 0 1 1 1 1 1 31. Normal, unspecified -
0 1 0 0 0 1 0 34. No circuit/channel available Note 1
0 1 0 0 1 1 0 38. Network out of order -
0 1 0 1 0 0 1 41. Temporary failure -
0 1 0 1 0 1 0 42. Switching equipment congestion -
0 1 0 1 0 1 1 43. Access information discarded Discarded information
element identifiers
(note 6)
0 1 0 1 1 0 0 44. requested circuit/channel not available -
0 1 0 1 1 1 1 47. Resources unavailable, unspecified -
0 1 1 0 0 0 1 49. Quality of service unavailable Note 9
0 1 1 0 0 1 0 50. Requested facility not subscribed Note 1
0 1 1 0 1 1 1 55. Incoming calls barred within the CUG Note 1
0 1 1 1 0 0 1 57. Bearer capability not authorized Note 3
0 1 1 1 0 1 0 58. Bearer capability not presently available Note 3
0 1 1 1 1 1 1 63. Service or option not available, -
unspecified
1 0 0 0 0 0 1 65. Bearer service not implemented Note 3
(continued)
ETSI
Release 18 585 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.123/3GPP TS 24.008 (concluded): Cause information element values
Cause value Cause Cause Diag- Remarks

Class Value num. nostic
7 6 5 4 3 2 1
1 0 0 0 1 0 0 68. ACM equal to or greater than ACMmax

1 0 0 0 1 0 1 69. Requested facility not implemented Note 1
1 0 0 0 1 1 0 70. Only restricted digital information bearer
capability is available
1 0 0 1 1 1 1 79. Service or option not implemented, -
unspecified
1 0 1 0 0 0 1 81. Invalid transaction identifier value -
1 0 1 0 1 1 1 87. User not member of CUG Note 1
1 0 1 1 0 0 0 88. Incompatible destination Incompatible parameter
(Note 2)
1 0 1 1 0 1 1 91. Invalid transit network selection -
1 0 1 1 1 1 1 95. Semantically incorrect message -
1 1 0 0 0 0 0 96. Invalid mandatory information Information element
identifier(s)
1 1 0 0 0 0 1 97. Message type non-existent or not Message type
implemented
1 1 0 0 0 1 0 98. Message type not compatible with Message type
protocol state
1 1 0 0 0 1 1 99. Information element non-existent or not Information element
implemented identifier(s) (notes 6,7)
1 1 0 0 1 0 0 100. Conditional IE error Information element
identifier(s) (note 6)
1 1 0 0 1 0 1 101. Message not compatible with protocol Message type
state
1 1 0 0 1 1 0 102. Recovery on timer expiry Timer number (note 8)
1 1 0 1 1 1 1 111. Protocol error, unspecified -
1 1 1 1 1 1 1 127. Interworking, unspecified -
All other values in the range 0 to 31 shall be treated as cause 31.
NOTE 1: Diagnostics for supplementary services are handled as follows:
octet 5, bit 8:
This is an extension bit as defined in the preliminary part of subclause 10.5. In this version of this
protocol, this bit shall be set to 1. If it is set to zero, the contents of the following octets shall be ignored.
octet 5, bit 7-1:
0000001 - Outgoing calls barred within CUG
0000010 - No CUG selected
0000011 - Unknown CUG index
0000100 - CUG index incompatible with requested basic service
0000101 - CUG call failure, unspecified
0000110 - CLIR not subscribed
ETSI
Release 18 586 3GPP TS 24.008 V18.4.0 (2023-09)
0000111 - CCBS possible
0001000 - CCBS not possible
All other values shall be ignored.
NOTE 2: The incompatible parameter is composed of the incompatible information element identifier.
NOTE 3: The format of the diagnostic field for cause numbers 57, 58 and 65 is as shown in figure 10.5.88/3GPP
TS 24.008 and tables 10.5.102/3GPP TS 24.008 to 10.5.115/3GPP TS 24.008.
NOTE 4: The user supplied diagnostics field is encoded according to the user specification, subject to the
maximum length of the cause information element. The coding of user supplied diagnostics should be
made in such a way that it does not conflict with the coding described in note 9 below.
NOTE 5: The new destination is formatted as the called party BCD number information element, including
information element identifier.
NOTE 6: Locking and non-locking shift procedures described in subclause 10.5.4.2 and clause 3 are applied. In
principle, information element identifiers are ordered in the same order as the information elements in the
received message.
NOTE 7: When only the locking shift information element is included and no information element identifier
follows, it means that the codeset in the locking shift itself is not implemented.
NOTE 8: The timer number is coded in IA5 characters, e.g., T308 is coded as "3" "0" "8". The following coding is
used in each octet:
bit 8: spare "0"
bits 7-1: IA5 character
Octet 5 carries "3", octet 5a carries "0", etc.
NOTE 9: The following coding is used for octet 5:
bit 8 :1
bits 7-3: 00000
bits 2-1: condition as follows:
00 - unknown
01 - permanent
10 - transient
10.5.4.11a CLIR suppression

The CLIR suppression information element may be sent by the mobile station to the network in the SETUP message.
The use is defined in 3GPP TS 24.081 [25].
The CLIR suppression information element is coded as shown in figure 10.5.96/3GPP TS 24.008.
The CLIR suppression is a type 2 information element.
8 7 6 5 4 3 2 1
CLIR suppression IEI octet 1
Figure 10.5.96/3GPP TS 24.008 CLIR suppression information element
ETSI
Release 18 587 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.4.11b CLIR invocation

The CLIR invocation information element may be sent by the mobile station to the network in the SETUP message. The
use is defined in 3GPP TS 24.081 [25].
The CLIR invocation information element is coded as shown in figure 10.5.97/3GPP TS 24.008.
The CLIR invocation is a type 2 information element.
8 7 6 5 4 3 2 1
CLIR invocation IEI octet 1
Figure 10.5.97/3GPP TS 24.008 CLIR invocation information element
10.5.4.12 Congestion level

The purpose of the congestion level information element is to describe the congestion status of the call.
The congestion level information element is coded as shown in figure 10.5.98/3GPP TS 24.008 and
table 10.5.124/3GPP TS 24.008.
The congestion level is a type 1 information element.
8 7 6 5 4 3 2 1
Congestion level Congestion level octet 1
IEI
Figure 10.5.98/3GPP TS 24.008 Congestion level information element
Table 10.5.124/3GPP TS 24.008: Congestion level information element
Congestion level (octet 1)

Bits
4 3 2 1
0 0 0 0 receiver ready
1 1 1 1 receiver not ready
10.5.4.13 Connected number

The purpose of the connected number information element is to identify the connected party of a call.
The connected number information element is coded as shown in figure 10.5.99/3GPP TS 24.008.
The connected number is a type 4 information element with a minimum length of 3 octets and a maximum length of 14
octets.
ETSI
Release 18 588 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Connected number IEI octet 1
Length of connected number contents octet 2
0/1 Type of number Number plan octet 3
ext identification note 1)
1 Presentation 0 0 0 Screening octet 3a*
ext indicator Spare indicator note 1)
note 1)
note 1)
note 2) :
:
Figure 10.5.99/3GPP TS 24.008
NOTE 1: The contents of octets 3,4,5, etc. ... are coded as shown in table 10.5.118/3GPP TS 24.008. The coding of
octet 3a is defined in table 10.5.120/3GPP TS 24.008.
NOTE 2: If the connected number contains an odd number of digits, bits 5 to 8 of the last octet shall be filled with
the end mark coded as "1111".
10.5.4.14 Connected subaddress

The purpose of the connected subaddress information element is to identify a subaddress associated with the connected
party of a call.
The connected subaddress information element is coded as shown in figure 10.5.100/3GPP TS 24.008.
The connected subaddress is a type 4 information element with a minimum length of 2 octets and a maximum length of
23 octets.
8 7 6 5 4 3 2 1
Connected subaddress IEI octet 1
Length of connected subaddress contents octet 2
Type of odd/even 0 0 0 octet 3*
subaddress indicator Spare
:
: etc.
Figure 10.5.100/3GPP TS 24.008
The coding for Type of subaddress, odd/even indicator, and subaddress information is in table 10.5.119/3GPP TS
24.008.
10.5.4.15 Facility
The purpose of the facility information element is to transport supplementary service related information. Within the
scope of 3GPP TS 24.008 the content of the Facility information field is an array of octets. The usage of this
transportation mechanism is defined in 3GPP TS 24.080 [24].
The facility information element is coded as shown in figure 10.5.101/3GPP TS 24.008.
The facility is a type 4 information element with a minimum length of 2 octets. No upper length limit is specified except
for that given by the maximum number of octets in a L3 message (see 3GPP TS 44.006 [19]).
ETSI
Release 18 589 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Facility IEI octet 1
Length of facility contents octet 2
Facility information (see 3GPP TS 24.080 [24]) octet 3-?*
Figure 10.5.101/3GPP TS 24.008

The purpose of the high layer compatibility information element is to provide a means which should be used by the
remote user for compatibility checking. See annex B.
The high layer compatibility information element is coded as shown in figure 10.5.102/3GPP TS 24.008 and
table 10.5.125/3GPP TS 24.008.
The high layer compatibility is a type 4 information element with a minimum length of 2 octets and a maximum length
of 5 octets.
NOTE: The high layer compatibility information element is transported transparently by a PLMN between a call
originating entity (e.g. a calling user) and the addressed entity (e.g. a remote user or a high layer function
network node addressed by the call originating entity). However, if explicitly requested by the user (at
subscription time), a network which provides some capabilities to realize teleservices may interpret this
information to provide a particular service.
8 7 6 5 4 3 2 1
High layer compatibility IEI octet 1
Length of high layer compatibility contents octet 2

1 coding presentat.
ext standard interpretation method of octet 3*
protocol
profile
0/1 octet 4*
ext High layer characteristics identification
1 Extended high layer characteristics octet 4a*
ext identification (note)
Figure 10.5.102/3GPP TS 24.008 High layer compatibility information element
If the value part of the IE is empty, the IE indicates "not applicable".
NOTE: Octet 4a may be present e.g. when octet 4 indicates Maintenance or Management, or audio visual.
Table 10.5.125/3GPP TS 24.008: High layer compatibility information element

see ITU Recommendation Q.931.
Interpretation (octet 3)
Presentation method of protocol profile (octet 3)

High layer characteristics identification (octet 4)

Extended high layer characteristics identification (octet 4a)
ETSI
Release 18 590 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.4.16.1 Static conditions for the high layer compatibility IE contents

Either the value part of the IE is empty, or it contains at least octet 3 and 4.
10.5.4.17 Keypad facility

The purpose of the keypad facility information element is to convey IA5 characters, e.g. entered by means of a terminal
keypad (see note).
The keypad facility information element is coded as shown in figure 10.5.103/3GPP TS 24.008.
The keypad facility is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
Keypad facility IEI octet 1
Spare
0 Keypad information (IA5 character) octet 2
Figure 10.5.103/3GPP TS 24.008 Keypad facility information element
NOTE: In the 3GPP system this information element is only used to transfer one DTMF digit (0, 1, ... , 9, A, B,
C, D, *, #) as one IA5 character.

The purpose of the low layer compatibility information element is to provide a means which should be used for
compatibility checking by an addressed entity (e.g., a remote user or an interworking unit or a high layer function
network node addressed by the calling user). The low layer compatibility information element is transferred
transparently by a PLMN between the call originating entity (e.g. the calling user) and the addressed entity.
Except for the information element identifier, the low layer compatibility information element is coded as in ITU
recommendation Q.931.
For backward compatibility reasons coding of the modem type field according to ETS 300 102-1 (12-90) shall also be
supported.
The low layer compatibility is a type 4 information element with a minimum length of 2 octets and a maximum length
of 18 octets.
8 7 6 5 4 3 2 1
Low layer compatibility IEI octet 1
Length of the low layer compatibility contents octet 2
octet 3*
The following octets are coded
as described in :
ITU Recommendation Q.931 :
(Coding of the modem type according to both Q.931 and :
ETS 300 102-1 (12-90) shall be accepted)
Figure 10.5.104/3GPP TS 24.008 Low layer compatibility information element
If the value part of the IE is empty, the IE indicates "not applicable".
10.5.4.19 More data

The more data information element is sent by the mobile station to the network or to the network to the mobile station
in a USER INFORMATION message. The presence of the more data information element indicates to the destination
ETSI
Release 18 591 3GPP TS 24.008 V18.4.0 (2023-09)
remote user/mobile station that another USER INFORMATION message will follow containing information belonging
to the same block.
The use of the more data information element is not supervised by the network.
The more data information element is coded as shown in figure 10.5.105/3GPP TS 24.008.
The more data is a type 2 information element.
8 7 6 5 4 3 2 1
More data IEI octet 1
Figure 10.5.105/3GPP TS 24.008 More data information element
10.5.4.20 Notification indicator

The purpose of the notification indicator information element is to indicate information pertaining to a call.
The notification indicator element is coded as shown in figure 10.5.106/3GPP TS 24.008 and table 10.5.126/ 3GPP TS
24.008.
The notification indicator is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
Notification indicator IEI octet 1
1 octet 2
ext Notification description
Figure 10.5.106/3GPP TS 24.008 Notification indicator information element
Table 10.5.126/3GPP TS 24.008: Notification indicator information element
Notification description (octet 2)

Bits
7 6 5 4 3 2 1
0 0 0 0 0 0 0 User suspended
0 0 0 0 0 0 1 User resumed
0 0 0 0 0 1 0 Bearer change
10.5.4.21 Progress indicator

The purpose of the progress indicator information element is to describe an event which has occurred during the life of
a call.
The progress indicator information element is coded as shown in figure 10.5.107/3GPP TS 24.008 and
table 10.5.127/3GPP TS 24.008.
The progress indicator is a type 4 information element with a length of 4 octets.
ETSI
Release 18 592 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Progress indicator IEI octet 1
Length of progress indicator contents octet 2

1 coding 0
ext standard spare location octet 3
1 octet 4
ext progress description
Figure 10.5.107/3GPP TS 24.008 Progress indicator information element
Table 10.5.127/3GPP TS 24.008: Progress indicator information element

Bits
7 6
0 0 Standardized coding, as described in ITU-T Rec. Q.931
0 1 Reserved for other international standards
1 0 National standard
1 1 Standard defined for the GSMßPLMNS as described below
used if the progress description can be represented with the GSMßstandardized
coding.
The mobile station or network need not support any other coding standard than "1 1 -
Standard defined for the GSM PLMNS".
If a progress indicator IE indicating a coding standard not supported by the receiver is
received, progress description "Unspecific" shall be assumed.
Location (octet 3)
Bits
4 3 2 1
0 0 0 0 User
0 0 0 1 Private network serving the local user
0 0 1 0 Public network serving the local user
0 1 0 0 Public network serving the remote user
0 1 0 1 Private network serving the remote user
1 0 1 0 Network beyond interworking point
Note: Depending on the location of the users, the local public network and remote
public network may be the same network.
Progress description (octet 4)

Bits
7 6 5 4 3 2 1 No.
0 0 0 0 0 0 1 1. Call is not end-to-end PLMN/ISDN, further call
progress information may be available in-band
0 0 0 0 0 1 0 2. Destination address in non-PLMN/ISDN
0 0 0 0 0 1 1 3. Origination address in non-PLMN/ISDN
0 0 0 0 1 0 0 4. Call has returned to the PLMN/ISDN
0 0 0 1 0 0 0 8. In-band information or appropriate pattern now
available
0 0 0 1 0 0 1 9. In-band multimedia CAT available
0 1 0 0 0 0 0 32. Call is end-to-end PLMN/ISDN
1 0 0 0 0 0 0 64. Queueing
All other values Unspecific
10.5.4.21a Recall type $(CCBS)$

The purpose of the recall type information element is to describe the reason for the recall.
ETSI
Release 18 593 3GPP TS 24.008 V18.4.0 (2023-09)
The recall type information element is coded as shown in Figure 10.5.108/3GPP TS 24.008 and Table 10.5.128/3GPP
TS 24.008.
The recall type is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
recall type IEI octet 1
spare recall type
0 0 0 0 0 octet 2
Figure 10.5.108/3GPP TS 24.008 Recall type information element
Table 10.5.128/3GPP TS 24.008: Recall type information element
recall type (octet 2, bits 1 to 4)

Bits
3 2 1
0 0 0 - CCBS
0 0 1 }
to } - shall be treated as CCBS (intended for other similar types of Recall)
1 1 0 }
1 1 1 - reserved
10.5.4.21b Redirecting party BCD number

The purpose of the redirecting party BCD number information element is to identify the redirecting party.
The redirecting party BCD number information element is coded as shown in figure 10.5.108a/3GPP TS 24.008.
The redirecting party BCD number is a type 4 information element. In the network to mobile station direction it has a
minimum length of 3 octets and a maximum length of 19 octets.
8 7 6 5 4 3 2 1
Redirecting party BCD number IEI octet 1
Length of redirecting party BCD number contents octet 2

0/1 type of Numbering plan octet 3
ext number identification (note 1)
1 presentat. 0 0 0 Screening octet 3a*
ext indicator spare indicator (note 1)
octet 4*
Number digit 2 Number digit 1 (note 1)
octet 5*
Number digit 4 Number digit 3 (note 1)
:
Note 2) :
Figure 10.5.108a/3GPP TS 24.008

Redirecting party BCD number information element
NOTE 1: The contents of octets 3, 4, etc. are coded as shown in table 10.5.118/3GPP TS 24.008. The coding of
octet 3a is defined in table 10.5.120/3GPP TS 24.008.
NOTE 2: If the redirecting party BCD number contains an odd number of digits, bits 5 to 8 of the last octet shall be
filled with an end mark coded as "1111".
ETSI
Release 18 594 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.4.21c Redirecting party subaddress

The purpose of the Redirecting party subaddress is to identify a subaddress associated with the redirecting party. For the
definition of a subaddress see Rec. ITU-T I.330.
The Redirecting party subaddress information element is coded as shown in figure 10.5.108b/3GPP TS 24.008 and
table 10.5.121/3GPP TS 24.008.
The Redirecting party subaddress is a type 4 information element with a minimum length of 2 octets and a maximum
8 7 6 5 4 3 2 1
Redirecting party Subaddress IEI octet 1
Length of redirecting party subaddress contents octet 2

ext subaddress Indica octet 3*

:
:
etc.
Figure 10.5.108b/3GPP TS 24.008

Redirecting party subaddress information element

The purpose of the repeat indicator information element is to indicate how the associated repeated information elements
shall be interpreted, when included in a message. The repeat indicator information element is included immediately
before the first occurrence of the associated information element which will be repeated in a message. "Mode 1" refers
to the first occurrence of that information element, "mode 2" refers to the second occurrence of that information element
in the same message.
The repeat indicator information element is coded as shown in figure 10.5.109/3GPP TS 24.008 and
table 10.5.129/3GPP TS 24.008.
The repeat indicator is a type 1 information element.
8 7 6 5 4 3 2 1
repeat indicator repeat indication octet 1
IEI
Figure 10.5.109/3GPP TS 24.008 Repeat indicator information element
Table 10.5.129/3GPP TS 24.008: Repeat indicator information element
Repeat indication (octet 1)

Bits
4 3 2 1
0 0 0 1 Circular for successive selection
"mode 1 alternate mode 2"
0 0 1 0 Support of fallback – mode 1 preferred, mode 2 selected if setup of
mode 1 fails
0 0 1 1 reserved: was allocated in earlier phases of the protocol
0 1 0 0 Service change and fallback – mode 1 alternate mode 2, mode 1
preferred
ETSI
Release 18 595 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.4.22a Reverse call setup direction

This information element may be included in a MODIFY and MODIFY COMPLETE message to indicate that the
direction of the data call to which the MODIFY message relates is opposite to the call setup direction.
The reverse call setup direction information element is coded as shown in figure 10.5.110/3GPP TS 24.008.
The reverse call setup direction is a type 2 information element
8 7 6 5 4 3 2 1
reverse call setup direction IEI octet 1
Figure 10.5.110/3GPP TS 24.008 Reverse call setup direction information element
10.5.4.22b SETUP Container $(CCBS)$

This information element contains the contents of a SETUP message (Mobile Station to Network). This means that the
Call Control protocol discriminator IE, the Transaction Identifier IE and the Setup message type IE are not included.
The SETUP Container information element is coded as shown in figure 10.5.111/3GPP TS 24.008.
The SETUP Container is a type 4 information. No upper length limit is specified except for that given by the maximum
number of octets in a L3 message (see 3GPP TS 44.006 [19]).
8 7 6 5 4 3 2 1
SETUP Container IEI octet 1
Length of SETUP container contents octet 2
SETUP message octet 3-n
Figure 10.5.111/3GPP TS 24.008 Octet j (j = 3, 4 ... n) is the unchanged octet j of the SETUP message.
10.5.4.23 Signal
The purpose of the signal information element is to allow the network to convey information to a user regarding tones
and alerting signals (see subclauses 5.2.2.3.2 and 7.3.3.).
The signal information element is coded as shown in figure 10.5.112/3GPP TS 24.008 and
table 10.5.130/3GPP TS 24.008.
The signal is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
Signal IEI octet 1
Signal value octet 2
Figure 10.5.112/3GPP TS 24.008 Signal information element
ETSI
Release 18 596 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.130/3GPP TS 24.008: Signal information element
Signal value (octet 2)

Bits
8 7 6 5 4 3 2 1
0 0 0 0 0 0 0 0 dial tone on
0 0 0 0 0 0 0 1 ring back tone on
0 0 0 0 0 0 1 0 intercept tone on
0 0 0 0 0 0 1 1 network congestion tone on
0 0 0 0 0 1 0 0 busy tone on
0 0 0 0 0 1 0 1 confirm tone on
0 0 0 0 0 1 1 0 answer tone on
0 0 0 0 0 1 1 1 call waiting tone on
0 0 0 0 1 0 0 0 off-hook warning tone on
0 0 1 1 1 1 1 1 tones off
0 1 0 0 1 1 1 1 alerting off
10.5.4.24 SS Version Indicator

The purpose of the SS version indicator information element is to aid the decoding of the Facility information element
as described in 3GPP TS 24.010 [21]. Within the scope of 3GPP TS 24.008 the contents of the SS Version information
field is an array of one or more octets. The usage of the SS version information field is defined in 3GPP TS 24.080 [24].
The SS version indicator information element is coded as shown in figure 10.5.113/3GPP TS 24.008.
The SS version indicator is a type 4 information element with a minimum length of 2 octets. No upper length limit is
specified except for that given by the maximum number of octets in a L3 message (see 3GPP TS 44.006 [19]).
8 7 6 5 4 3 2 1
SS version indicator IEI octet 1
Length of SS version indicator contents octet 2
SS version information (see 3GPP TS 24.080 [24]) octet 3*
: *
: *
Figure 10.5.113/3GPP TS 24.008
NOTE: Usually, this information element has only one octet of content.
10.5.4.25 User-user
The purpose of the user-user information element is to convey information between the mobile station and the remote
ISDN user.
The user-user information element is coded as shown in figure 10.5.114/3GPP TS 24.008 and table 10.5.131/
3GPP TS 24.008. There are no restrictions on the content of the user-user information field.
The user-user is a type 4 information element with a minimum length of 3 octets and a maximum length of either 35 or
131 octets. In the SETUP message the user-user information element has a maximum size of 35 octets in a
GSM PLMN. In the USER INFORMATION, ALERTING, CONNECT, DISCONNECT, PROGRESS, RELEASE and
RELEASE COMPLETE messages the user-user information element has a maximum size of 131 octets in a
GSM PLMN.
In other networks than GSM PLMNs the maximum size of the user-user information element is 35 or 131 octets in the
messages mentioned above. The evolution to a single maximum value is the long term objective; the exact maximum
value is the subject of further study.
NOTE: The user-user information element is transported transparently through a GSM PLMN.
ETSI
Release 18 597 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
User-user IEI octet 1
Length of user-user contents octet 2

User-user protocol discriminator octet 3
User-user information octet 4*
octet N*
Figure 10.5.114/3GPP TS 24.008 User-user information element
Table 10.5.131/3GPP TS 24.008: User-user information element
User-user protocol discriminator (octet 3)

Bits
8 7 6 5 4 3 2 1
0 0 0 0 0 0 0 0 User specific protocol (Note 1)
0 0 0 0 0 0 0 1 OSI high layer protocols
0 0 0 0 0 0 1 0 X.244 (Note 2)
0 0 0 0 0 0 1 1 Reserved for system management convergence
function
0 0 0 0 0 1 0 0 IA5 characters (Note 3)
0 0 0 0 0 1 1 1 rate adaption according to ITU-T Rec. V.120 [61]
0 0 0 0 1 0 0 0 user-network call control messages according to
ITU-T Rec. Q.931 [53]
0 0 0 1 0 0 0 0 Reserved for other network layer or

through layer 3 protocols
0 0 1 1 1 1 1 1
0 1 0 0 0 0 0 0
through National use
0 1 0 0 1 1 1 0
0 1 0 0 1 1 1 1 3GPP capability exchange protocol (NOTE 4)
0 1 0 1 0 0 0 0 Reserved for other network

through layer or layer 3 protocols
1 1 1 1 1 1 1 0
NOTE 1: The user information is structured according to user needs.

NOTE 2: The user information is structured according to ITU-T Rec. X.244 which
specifies the structure of ITU-T Rec. X.25 [143] call user data.
NOTE 3: The user information consists of IA5 characters.
NOTE 4: When the user-user protocol discriminator is set to "3GPP capability
exchange protocol", the user-user information is coded according to
3GPP TS 24.279 [116].
10.5.4.26 Alerting Pattern $(NIA)$

The purpose of the Alerting Pattern information element is to allow the network to convey information related to the
alert to be used by the MS (see 3GPP TS 22.101 [8]).
The Alerting Pattern information element is coded as shown in figure 10.5.115/3GPP TS 24.008 and
table 10.5.132/3GPP TS 24.008.
The Alerting Pattern IE is a type 4 information element with 3 octet length.
ETSI
Release 18 598 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Alerting Pattern IEI octet 1
length of alerting pattern content octet 2
0 0 0 0 Alerting Pattern
spare value octet 3
Figure 10.5.115/3GPP TS 24.008 Alerting Pattern information element
Table 10.5.132/3GPP TS 24.008: Alerting Pattern information element
Alerting Pattern value (octet 3)

Bits
4 3 2 1
0 0 0 0 alerting pattern 1
all other values are reserved
Alerting pattern 1, 2 and 3 indicate alerting levels 0, 1 and 2.
Alerting pattern 5 to 9 indicate alerting categories 1 to 5
10.5.4.27 Allowed actions $(CCBS)$

The purpose of the Allowed actions information element is to provide the mobile station with information about further
allowed procedures.
The Allowed actions information element is coded as shown in figure 10.5.116/3GPP TS 24.008 and
table 10.5.133/3GPP TS 24.008.
The Allowed actions is a type 4 information element with 3 octets length.
8 7 6 5 4 3 2 1
Allowed Actions IEI octet 1
Length of allowed actions contents octet 2

CCBS 0 0 0 0 0 0 0
act. spare octet 3
Figure 10.5.116/3GPP TS 24.008 Allowed actions information element
Table 10.5.133/3GPP TS 24.008: Allowed actions information element
CCBS activation (octet 3)
Bits
8
0 Activation of CCBS not possible
1 Activation of CCBS possible
ETSI
Release 18 599 3GPP TS 24.008 V18.4.0 (2023-09)

The purpose of the stream identifier (SI) information element is to associate a particular call with a Radio Access Bearer
(RAB), and to identify whether a new traffic channel shall be assigned within the interface controlled by these
signalling procedures. The SI value indicated in the CC protocol shall be sent in the RAB setup message. And mobile
station is informed the relationship between the call and the RAB.
The Stream identifier information element is coded as shown in figure 10.5.117/3GPP TS 24.008 and
table 10.5.134/3GPP TS 24.008.
The Stream Identifier is a type 4 information element with 3 octets length.
8 7 6 5 4 3 2 1
Stream Identifier IEI octet 1
Length of Stream Identifier contents octet 2
Stream Identifier Value octet 3
Figure 10.5.117/3GPP TS 24.008: Stream Identifier information element
Table 10.5.134/3GPP TS 24.008: Stream Identifier information element
Stream Identifier value(octet 3)
Bit
8 7 6 5 4 3 2 1
0 0 0 0 0 0 0 0 No bearer
0 0 0 0 0 0 0 1 1
:
:
1 1 1 1 1 1 1 1 255
10.5.4.29 Network Call Control Capabilities

The purpose of the Network Call Control Capabilities information element is to identify the call control capabilities of
the network. The contents might affect the manner in which the mobile station handles the call.
The Network Call Control Capabilities information element is coded as shown in figure 10.5.118/3GPP TS 24.008 and
table 10.5.135/3GPP TS 24.008.
The Network Call Control Capabilities is a type 4 information element with a length of 3 octets.
8 7 6 5 4 3 2 1
Network Call Control Capabilities IEI octet 1
Length of NW Call Control Cap. contents octet 2

0 0 0 0 0 0 0
spare MCS octet 3
Figure 10.5.118/3GPP TS 24.008 Network Call Control Capabilities information element
Table 10.5.135/3GPP TS 24.008: Network Call Control Capabilities
MCS (octet 3, bit 1)

0 This value indicates that the network does not support the multicall.
1 This value indicates that the network supports the multicall.
ETSI
Release 18 600 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.4.30 Cause of No CLI

Cause of No CLI information element provides the mobile station the detailed reason why Calling party BCD number is
not notified (see 3GPP TS 24.081 [25]).
The Cause of No CLI information element is coded as shown in figure 10.5.118a/3GPP TS 24.008 and
table 10.5.135a/3GPP TS 24.008.
The Cause of No CLI is a type 4 information element with the length of 3 octets.
8 7 6 5 4 3 2 1
Cause of No CLI IEI octet 1
Length of Cause of No CLI contents octet 2
Cause of No CLI octet 3
Figure 10.5.118a/3GPP TS 24.008 Cause of No CLI information element
Table 10.5.135a/3GPP TS 24.008: Cause of No CLI information element
Cause of No CLI (octet 3)

Bits
8 7 6 5 4 3 2 1
0 0 0 0 0 0 0 0 Unavailable
0 0 0 0 0 0 0 1 Reject by user
0 0 0 0 0 0 1 0 Interaction with other service
0 0 0 0 0 0 1 1 Coin line/payphone
Other values shall be interpreted as "Unavailable".
10.5.4.31 Void
10.5.4.32 Supported codec list

The purpose of the Supported Codec List information element is to provide the network with information about the
speech codecs supported by the mobile.
The Supported Codec List information element is coded as shown in figure 10.5.118c/3GPP TS 24.008.
The Supported Codec List information element is a type 4 information element with a minimum length of 5 octets and a
maximum length of m+3 octets.
Speech codec information belonging to GERAN and UTRAN shall be conveyed by this information element.
ETSI
Release 18 601 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Supported Codec List IEI octet 1
Length Of Supported Codec list octet 2
System Identification 1 (SysID 1) octet 3
Length Of Bitmap for SysID 1 octet 4
Codec Bitmap for SysID 1, bits 1 to 8 octet 5

Codec Bitmap for SysID 1, bits 9 to 16 octet 6
System Identification 2 (SysID 2) octet j
Length Of Bitmap for (SysID 2) octet j+1
Codec Bitmap for (SysID 2), bits 1 to 8 octet j+2

Codec Bitmap for (SysID 2), bits 9 to 16 octet j+3
System Identification x (SysID x) octet m
Length Of Bitmap for (SysID x) octet m+1
Codec Bitmap for (SysID x), bits 1 to 8 octet m+2

Codec Bitmap for (SysID x), bits 9 to 16 octet m+3
Figure 10.5.118c/3GPP TS 24.008 Supported codec list information element
Table 10.5.4.135c/3GPP TS 24.008: Supported Codec List information element
Octet 3, (j), m etc

SysID indicates the radio access technology for which the subsequent Codec
Bitmap indicates the supported codec types.
Coding of this Octet is defined in 3GPP TS 26.103 [83].
Octet 4, (j+1), m+1 etc

Length Of Codec Bitmap for SysID indicates the number of octets included in the
list for the given SysID.
Octets (5 & 6), (j+2 & j+3), (m+2 & m+3) etc
The coding of the Codec Bitmap is defined in 3GPP TS 26.103 [83].
NOTE: If the Codec Bitmap for a SysID is 1 octet, it is an indication that all codecs
of the 2nd octet are not supported. If the Codec Bitmap for a SysID is more than 2
octets, the network shall ignore the additional octet(s) of the bitmap and process
the rest of the information element.
10.5.4.33 Service category

The purpose of the Service category information element is to provide the network with information about services
invoked by the user equipment.
The Service category information element is coded as shown in figure 10.5.118d/3GPP TS 24.008 and
table 10.5.135d/3GPP TS 24.008
The Service category is a type 4 information element with a minimum length of 3 octets.
8 7 6 5 4 3 2 1
Service Category IEI octet 1
Length of Service Category octet 2
0 Emergency Service Category Value octet 3
spare
ETSI
Release 18 602 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 10.5.118d/3GPP TS 24.008 Service Category information element
Table 10.5.135d/3GPP TS 24.008: Service Category information element
Emergency Service Category Value (octet 3)

The meaning of the Emergency Category Value is derived from the following settings (see 3GPP TS 22.101 [8] clause
10):
Bit 1 Police
Bit 2 Ambulance
Bit 3 Fire Brigade
Bit 4 Marine Guard
Bit 5 Mountain Rescue
Bit 6 manually initiated eCall
Bit 7 automatically initiated eCall
Bit 8 is spare and set to "0"
A mobile station not initiating an eCall shall set bit 6 and bit 7 to "0" and may set one or more of bit 1, bit 2, bit 3, bit 4 or
bit 5 to "1". If more than one of these bits is set to "1", routing to a combined emergency centre (e.g. ambulance and fire
brigade in Japan) is required.
A mobile station initiating an eCall shall set either bit 6 or bit 7 to "1" and shall set all other bits to "0". A MSC supporting
eCall shall use the information indicated in bit 6 and bit 7 to route the manually or automatically initiated eCall to an
operator defined emergency call centre.
If the MSC can not match the received service category to any of the emergency centres, or if no bit is set to "1", the
MSC shall route the emergency call to an operator defined default emergency centre.
10.5.4.34 Redial
The purpose of the Redial information element is to indicate to the network that a call is the result of a redial attempt to
switch from speech to multimedia or vice-versa.
The Redial information element is coded as shown in figure 10.5.118e/3GPP TS 24.008
The Redial is a type 2 information element with a length of 1 octet.
8 7 6 5 4 3 2 1
Redial IEI octet 1
Figure 10.5.118e/3GPP TS 24.008 Redial information element
10.5.4.35 Network-initiated Service Upgrade indicator

The purpose of the Network-initiated Service Upgrade indicator information element is to indicate to the mobile station
that the in-call modification procedure is due to a network-initiated upgrade from speech to UDI/RDI multimedia (see
3GPP TS 23.172 [97]).
The Network- initiated Service Upgrade indicator information element is coded as shown in figure 10.5.118f/3GPP TS
24.008.
The Network-initiated Service Upgrade indicator is a type 2 information element with a length of 1 octet.
ETSI
Release 18 603 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Network-initiated Service Upgrade indicator IEI octet 1
Figure 10.5.118f/3GPP TS 24.008 Network-initiated Service Upgrade indicator information element
10.5.5 GPRS mobility management information elements

See subclause 9.9.3.0B in 3GPP TS 24.301 [120].
10.5.5.1 Attach result

The purpose of the attach result information element is to specify the result of a GPRS attach procedure.
The attach result is a type 1 information element.
The attach result information element is coded as shown in figure 10.5.117a/3GPP TS 24.008 and
table 10.5.134a/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Attach result FOP Result of octet 1
IEI attach
Figure 10.5.117a/3GPP TS 24.008: Attach result information element
Table 10.5.134a/3GPP TS 24.008: Attach result information element
Result of attach (octet 1)

Bits
3 2 1
0 0 1 GPRS only attached
0 1 1 Combined GPRS/IMSI attached
Follow-on proceed (octet 1)

Bit
4
0 Follow-on proceed
1 No follow-on proceed
Follow-on proceed is applicable only in Iu mode. This indication shall be ignored if

received in A/Gb mode.
10.5.5.2 Attach type

The purpose of the attach type information element is to indicate the type of the requested attach, i.e. whether the MS
wants to perform a GPRS or combined GPRS attach.
The attach type is a type 1 information element.
The attach type information element is coded as shown in figure 10.5.117b/3GPP TS 24.008 and table 10.5.135b/3GPP
TS 24.008.
ETSI
Release 18 604 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Attach type FOR Type of attach octet 1
IEI
Figure 10.5.117b/3GPP TS 24.008: Attach type information element
Table 10.5.135b/3GPP TS 24.008: Attach type information element
Type of attach (octet 1, bit 1 to 3)

Bits
3 2 1
0 0 1 GPRS attach
0 1 0 Not used. This value was allocated in earlier versions of the protocol
(Note1)
0 1 1 Combined GPRS/IMSI attach
1 0 0 Emergency attach
All other values are interpreted as GPRS attach in this version of the protocol.
Follow-on request (octet 1, bit 4)

Bits
4
Follow-on request pending is applicable only in Iu mode.
NOTE 1: The code point "010" if received by the network, it shall be interpreted as
"Combined GPRS/IMSI attach".
10.5.5.3 Ciphering algorithm

The purpose of the ciphering algorithm information element is to specify which ciphering algorithm shall be used.
The ciphering algorithm is a type 1 information element.
The ciphering algorithm information element is coded as shown in figure 10.5.119/3GPP TS 24.008 and
table 10.5.136/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Ciphering algorithm 0 Type of octet 1
IEI spare algorithm
Figure 10.5.119/3GPP TS 24.008: Ciphering algorithm information element
Table 10.5.136/3GPP TS 24.008: Ciphering algorithm information element
Type of ciphering algorithm (octet 1)

Bits
3 2 1
0 0 0 ciphering not used
ETSI
Release 18 605 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.5.3a Integrity algorithm

The purpose of the integrity algorithm information element is to specify which integrity algorithm shall be used.
The integrity algorithm is a type 1 information element.
The integrity algorithm information element is coded as shown in figure 10.5.5.3a-1/3GPP TS 24.008 and
table 10.5.5.3a-1/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Integrity algorithm 0 Type of octet 1
IEI spare algorithm
Figure 10.5.5.3a-1/3GPP TS 24.008: Integrity algorithm information element
Table 10.5.5.3a-1/3GPP TS 24.008: Integrity algorithm information element
Type of integrity algorithm (octet 1)

Bits
3 2 1
0 0 0 GPRS Integrity Algorithm GIA/4
10.5.5.4 TMSI status

The purpose of the TMSI status information element is to indicate whether a valid TMSI is available in the MS or not.
The TMSI status is a type 1 information element.
The TMSI status information element is coded as shown in figure 10.5.120/3GPP TS 24.008 and
table 10.5.137/3GPP TS 24.008.
8 7 6 5 4 3 2 1
TMSI status 0 0 0 TMSI octet 1
IEI spare flag
Figure 10.5.120/3GPP TS 24.008: TMSI status information element
Table 10.5.137/3GPP TS 24.008: TMSI status information element
TMSI flag (octet 1)

Bit
1
0 no valid TMSI available
1 valid TMSI available
10.5.5.5 Detach type

The purpose of the detach type information element is to indicate which type of detach is requested by the MS. In the
network to MS direction the detach type information element is used to indicate the reason why a detach request is sent.
The detach type is a type 1 information element.
ETSI
Release 18 606 3GPP TS 24.008 V18.4.0 (2023-09)
The detach type information element is coded as shown in figure 10.5.121/3GPP TS 24.008 and
table 10.5.138/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Detach type Power Type of detach octet 1
IEI off
Figure 10.5.121/3GPP TS 24.008: Detach type information element
Table 10.5.138/3GPP TS 24.008: Detach type information element
Type of detach (octet 1)
In the MS to network direction:

Bits
3 2 1
0 0 1 GPRS detach
0 1 0 IMSI detach
0 1 1 Combined GPRS/IMSI detach
All other values are interpreted as Combined GPRS/IMSI detach by this version of the
protocol.
In the network to MS direction:

Bits
3 2 1
0 0 1 re-attach required
0 1 0 re-attach not required
0 1 1 IMSI detach (after VLR failure)
All other values are interpreted as re-attach not required by this version of the protocol.
Power off (octet 1)
In the MS to network direction:

Bit
4
0 normal detach
1 power switched off
In the network to MS direction the Power off bit shall be spare and set to zero.
10.5.5.6 DRX parameter

The purpose of the DRX parameter information element is to indicate whether the MS uses DRX mode or not.
The DRX parameter is a type 3 information element with a length of 3 octets.
The value part of a DRX parameter information element is coded as shown in table 10.5.139/3GPP TS 24.008.
8 7 6 5 4 3 2 1
DRX parameter IEI octet 1
SPLIT PG CYCLE CODE octet 2
CN Specific DRX cycle length SPLIT non-DRX
coefficient on timer octet 3
and CCCH
DRX value for S1 mode
Figure 10.5.122/3GPP TS 24.008: DRX parameter information element
ETSI
Release 18 607 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.139/3GPP TS 24.008: DRX parameter information element
SPLIT PG CYCLE CODE, octet 2

The octet contains the binary coded value of the SPLIT PG CYCLE CODE. The SPLIT
PG CYCLE value is derived from the SPLIT PG CYCLE CODE as follows:
0 704 (equivalent to no DRX)

1 to 64 1 to 64, respectively
65 71
66 72
67 74
68 75
69 77
70 79
71 80
72 83
73 86
74 88
75 90
76 92
77 96
78 101
79 103
80 107
81 112
82 116
83 118
84 128
85 141
86 144
87 150
88 160
89 171
90 176
91 192
92 214
93 224
94 235
95 256
96 288
97 320
98 352
All other values are reserved and shall be interpreted as 1 by this version of the
protocol.
SPLIT on CCCH, octet 3 (bit 4)
0 Split pg cycle on CCCH is not supported by the mobile station

1 Split pg cycle on CCCH is supported by the mobile station
non-DRX timer, octet 3

bit
3 2 1
0 0 0 no non-DRX mode after transfer state
0 0 1 max. 1 sec non-DRX mode after transfer state
ETSI
Release 18 608 3GPP TS 24.008 V18.4.0 (2023-09)
CN Specific DRX cycle length coefficient and DRX value for S1 mode, octet 3
This field represents two separate values. For Iu mode, it represents the 'CN domain
specific DRX cycle length' as defined in 3GPP TS 25.331 [23c]. For S1 mode, it
represents the DRX cycle parameter 'T' as defined in 3GPP TS 36.304 [121].
bit
8 7 6 5 Iu and S1 mode specific
0 0 0 0 For Iu mode, CN Specific DRX cycle length coefficient not specified by
the MS, ie. the system information value 'CN domain specific DRX cycle
length' is used . For S1 mode, DRX value not specified by the MS.
0 1 1 0 CN Specific DRX cycle length coefficient 6 and T = 32
All other values shall be interpreted as "CN Specific DRX cycle length coefficient not
specified by the MS " and "DRX value not specified by the MS" by this version of the
protocol.
NOTE: For Iu mode and S1 mode, this field (octet 3 bits 8 to 5) is used, but was
spare in earlier versions of this protocol.
10.5.5.7 Force to standby

The purpose of the force to standby information element is to force the MS to stop the READY timer in order to prevent
the MS to perform cell updates.
In Iu mode, the network shall always indicate force to standby not indicated in the force to standby information
element.
The force to standby is a type 1 information element.
The force to standby information element is coded as shown in figure 10.5.123/3GPP TS 24.008 and
table 10.5.140/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Force to standby 0 Force to octet 1
IEI spare standby value
Figure 10.5.123/3GPP TS 24.008: Force to standby information element
Table 10.5.140/3GPP TS 24.008: Force to standby information element
Force to standby value (octet 1)
Bits
3 2 1
0 0 0 Force to standby not indicated
0 0 1 Force to standby indicated
All other values are interpreted as

force to standby not indicated by this version of the protocol.

The purpose of the P-TMSI signature information element is to identify a GMM context of an MS.
The P-TMSI signature is a type 3 information element with 4 octets length.
ETSI
Release 18 609 3GPP TS 24.008 V18.4.0 (2023-09)
The P-TMSI signature information element is coded as shown in figure 10.5.124/3GPP TS 24.008 and
table 10.5.141/3GPP TS 24.008.
8 7 6 5 4 3 2 1
P-TMSI signature IEI octet 1
octet 2
P-TMSI signature value
octet 4
Figure 10.5.124/3GPP TS 24.008: P-TMSI signature information element
Table 10.5.141/3GPP TS 24.008: P-TMSI signature information element
P-TMSI signature value

Octets 2, 3 and 4 contain the binary representation of the P-TMSI signature.
10.5.5.8a P-TMSI signature 2

The purpose of the P-TMSI signature 2 information element is to identify a GMM context of an MS.
The P-TMSI signature 2 is a type 4 information element with 5 octets length.
The P-TMSI signature 2 information element is coded as shown in figure 10.5.124a/3GPP TS 24.008 and
table 10.5.141a/3GPP TS 24.008.
8 7 6 5 4 3 2 1
P-TMSI signature 2 IEI octet 1
Length of P-TMSI signature 2 contents octet 2
octet 3
P-TMSI signature 2 value
octet 5
Figure 10.5.124a/3GPP TS 24.008: P-TMSI signature 2 information element
Table 10.5.141a/3GPP TS 24.008: P-TMSI signature 2 information element
P-TMSI signature 2 value is coded as octets 2 to 4 of the P-TMSI signature IE.
10.5.5.9 Identity type 2

The purpose of the identity type 2 information element is to specify which identity is requested.
The identity type 2 is a type 1 information element.
The identity type 2 information element is coded as shown in figure 10.5.125/3GPP TS 24.008 and table 10.5.142/3GPP
TS 24.008.
8 7 6 5 4 3 2 1
Identity type 2 0 Type of octet 1
IEI spare identity
ETSI
Release 18 610 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 10.5.125/3GPP TS 24.008: Identity type 2 information element
Table 10.5.142/3GPP TS 24.008: Identity type 2 information element

Bits
3 2 1
0 0 1 IMSI
0 1 0 IMEI
0 1 1 IMEISV
1 0 0 TMSI
All other values are interpreted as IMSI by this version of the protocol.
10.5.5.10 IMEISV request

The purpose of the IMEISV request information element is to indicate that the IMEISV shall be included by the MS in
the authentication and ciphering response message.
The IMEISV request is a type 1 information element.
The IMEISV request information element is coded as shown in figure 10.5.126/3GPP TS 24.008 and
table 10.5.143/3GPP TS 24.008.
8 7 6 5 4 3 2 1
IMEISV request 0 IMEISV request octet 1
IEI spare value
Figure 10.5.126/3GPP TS 24.008: IMEISV request information element
Table 10.5.143/3GPP TS 24.008: IMEISV request information element
IMEISV request value (octet 1)

Bits
3 2 1
0 0 0 IMEISV not requested
0 0 1 IMEISV requested
All other values are interpreted as IMEISV not requested by this version of the protocol.
10.5.5.11 Receive N-PDU Numbers list

The purpose of the Receive N-PDU Numbers list information element is to specify the current SNDCP Receive N-PDU
Number values.
The Receive N-PDU Number list is a type 4 information element with a length of 4 to 19 octets.
The value part of a Receive N-PDU Number list information element is coded as shown in figure 10.5.127/3GPP TS
24.008 and table 10.5.144/3GPP TS 24.008.
ETSI
Release 18 611 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Receive N-PDU Number list IEI octet 1
Length of Receive N-PDU Number list contents
octet 3
Receive N-PDU Number-list octet 4
octet n*
Figure 10.5.127/3GPP TS 24.008: Receive N-PDU Number list information element
Table 10.5.144/3GPP TS 24.008: Receive N-PDU Number list information element
Receive N-PDU Number -list value ::=
{
< Receive N-PDU Number -list >
< Padding bits>
};
< Receive N-PDU Number-list > ::= < sapi : bit-string(4) > < Receive N-PDU
Number-value : bit-string(8) > { < Receive N-PDU Number-list> | < null > } ;
< nsapi > ::=

{ 0101 }; |-- NSAPI 5
{ 0110 }; | -- NSAPI 6
{ 0111 }; | -- NSAPI 7
{ 1000 }; | -- NSAPI 8
{ 1001 }; | -- NSAPI 9
{ 1010 }; | -- NSAPI 10
{ 1011 }; | -- NSAPI 11
{ 1100 }; | -- NSAPI 12
{ 1101 }; | -- NSAPI 13
{ 1110 }; | -- NSAPI 14
{ 1111 }; -- NSAPI 15
< Receive N-PDU Number-value > ::= { 0 | 1} (8) ;

-- Contains the binary coded representation of the receive N-PDU Number value.
-- The first bit in transmission order is the most significant bit.
<Padding bits> ::= null | 0000;
10.5.5.12 MS network capability

The purpose of the MS network capability information element is to provide the network with information concerning
aspects of the mobile station related to GPRS. The contents might affect the manner in which the network handles the
operation of the mobile station. The MS network capability information indicates general mobile station characteristics
and it shall therefore, except for fields explicitly indicated, be independent of the frequency band of the channel it is
sent on.
The MS network capability is a type 4 information element with a maximum of 10 octets length.
The value part of a MS network capabilityinformation element is coded as shown in figure 10.5.128/3GPP TS 24.008
and table 10.5.145/3GPP TS 24.008.
NOTE: The requirements for the support of the GEA algorithms in the MS are specified in 3GPP TS 43.020 [13].
ETSI
Release 18 612 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
MS network capability IEI octet 1
Length of MS network capability contents octet 2
MS network capability value octet 3-10
Figure 10.5.128/3GPP TS 24.008 MS network capability information element
ETSI
Release 18 613 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.145/3GPP TS 24.008 MS network capability information element
ETSI
Release 18 614 3GPP TS 24.008 V18.4.0 (2023-09)
<MS network capability value part> ::=
<GEA1 bits>
<SM capabilities via dedicated channels: bit>
<SM capabilities via GPRS channels: bit>
<UCS2 support: bit>
<SS Screening Indicator: bit string(2)>
<SoLSA Capability : bit>
<Revision level indicator: bit>
<PFC feature mode: bit>
<Extended GEA bits>
<LCS VA capability: bit>
<PS inter-RAT HO from GERAN to UTRAN Iu mode capability: bit>
<PS inter-RAT HO from GERAN to E-UTRAN S1 mode capability: bit>
<EMM Combined procedures Capability: bit>
<ISR support: bit>
<SRVCC to GERAN/UTRAN capability: bit>
<EPC capability: bit>
<NF capability: bit>

<GERAN network sharing capability: bit>
<User plane integrity protection support: bit>
<GIA/4: bit>
<GIA/5: bit>
<GIA/6: bit>
<GIA/7: bit>
<ePCO IE indicator: bit>
<Restriction on use of enhanced coverage capability: bit>
<Dual connectivity of E-UTRA with NR capability: bit>
<Spare bits>;
<GEA1 bits> ::= < GEA/1 :bit>;
<Extended GEA bits> ::= <GEA/2:bit><GEA/3:bit>< GEA/4:bit >< GEA/5:bit >< GEA/6:bit ><GEA/7:bit>;
<Spare bits> ::= null | {<spare bit> < Spare bits >};
SS Screening Indicator

SM capabilities via dedicated channels

0 Mobile station does not support mobile terminated point to point SMS via CS domain
1 Mobile station supports mobile terminated point to point SMS via CS domain
SM capabilities via GPRS channels

0 Mobile station does not support mobile terminated point to point SMS via PS domain
1 Mobile station supports mobile terminated point to point SMS via PS domain
UCS2 support
This information field indicates the likely treatment by the mobile station of UCS2 encoded character strings.
0 the ME has a preference for the default alphabet (defined in 3GPP TS 23.038 [8b])
over UCS2.
1 the ME has no preference between the use of the default alphabet and the
use of UCS2.
GPRS Encryption Algorithm GEA/1 (NOTE)

The MS shall set this bit to '0'.
The network shall accept any received value in order to support MSs that are compliant to earlier versions of this
ETSI
Release 18 615 3GPP TS 24.008 V18.4.0 (2023-09)
specification.
0 encryption algorithm GEA/1not available
SoLSA Capability
0 The ME does not support SoLSA.
1 The ME supports SoLSA.
Revision level indicator

0 used by a mobile station not supporting R99 or later versions of the protocol
1 used by a mobile station supporting R99 or later versions of the protocol
PFC feature mode

0 Mobile station does not support BSS packet flow procedures
1 Mobile station does support BSS packet flow procedures
GEA/2 (NOTE)
0 encryption algorithm GEA/2 not available
1 encryption algorithm GEA/2 available
GEA/3 (NOTE)
GEA/4 (NOTE)
GEA/5 (NOTE)
GEA/6 (NOTE)
GEA/7 (NOTE)
LCS VA capability (LCS value added location request notification capability)

This information field indicates the support of the LCS value added location request notification via PS domain as
defined in 3GPP TS 23.271 [105].
0 location request notification via PS domain not supported
1 location request notification via PS domain supported
PS inter-RAT HO from GERAN to UTRAN Iu mode capability

This information field indicates the support of the PS inter-RAT HO from GERAN to UTRAN Iu mode.
0 PS inter-RAT HO from GERAN to UTRAN Iu mode not supported
1 PS inter-RAT HO from GERAN to UTRAN Iu mode supported
PS inter-RAT HO from GERAN to E-UTRAN S1 mode capability

This information field indicates the support of the PS inter-RAT HO from GERAN to E-UTRAN S1 mode. A mobile
station not compliant to the UE E-UTRA capability requirements as defined in 3GPP TS 36.306 [153] shall set this field
to '0'.
0 PS inter-RAT HO from GERAN to E-UTRAN S1 mode not supported
1 PS inter-RAT HO from GERAN to E-UTRAN S1 mode supported
EMM Combined procedures capability

This information field indicates the support of EMM combined procedures. The MS shall not change this information
field from the one that was included in the GMM or EMM ATTACH REQUEST message.
0 Mobile station does not support EMM combined procedures
1 Mobile station supports EMM combined procedures
ETSI
Release 18 616 3GPP TS 24.008 V18.4.0 (2023-09)
ISR support
0 The mobile station does not support ISR.
1 The mobile station supports ISR.
SRVCC to GERAN/UTRAN capability

0 SRVCC from UTRAN HSPA or E-UTRAN to GERAN/UTRAN not supported
1 SRVCC from UTRAN HSPA or E-UTRAN to GERAN/UTRAN supported
EPC capability
This information field indicates if the MS supports access to the EPC via access networks other than GERAN or
UTRAN.The network can use this information to decide whether to select a PDN Gateway or a GGSN. The MS shall set
the indication to "0" if a SIM is inserted in the MS.
0 EPC not supported
1 EPC supported
NF capability
This information field indicates if the MS supports the notification procedure.
0 Mobile station does not support the notification procedure.
1 Mobile station supports the notification procedure.
GERAN network sharing capability

This information field indicates if the MS supports GERAN network sharing.
0 Mobile station does not support GERAN network sharing.
1 Mobile station supports GERAN network sharing.
User plane integrity protection support

0 The mobile station does not support user plane integrity protection.
1 The mobile station supports user plane integrity protection.
GIA/4 (NOTE)
0 integrity algorithm GIA/4 not available
1 integrity algorithm GIA/4 available
GIA/5 (NOTE)
GIA/6 (NOTE)
GIA/7 (NOTE)
ePCO IE indicator
0 used by a mobile station not supporting extended protocol configuration options IE
1 used by a mobile station supporting extended protocol configuration options IE
Restriction on use of enhanced coverage capability

This information field indicates if the MS supports restriction on use of enhanced coverage
0 Mobile station does not support restriction on use of enhanced coverage
1 Mobile station supports restriction on use of enhanced coverage
Dual connectivity of E-UTRA with NR capability

This information field indicates if the MS supports dual connectivity of E-UTRA with NR
0 Mobile station does not support dual connectivity of E-UTRA with NR
1 Mobile station supports dual connectivity of E-UTRA with NR
NOTE: The requirements for the support of the GEA and the GIA algorithms in the MS are specified in
3GPP TS 43.020 [13].
ETSI
Release 18 617 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.5.12a MS Radio Access capability

The purpose of the MS Radio Access capability information element is to provide the radio part of the network with
information concerning radio aspects of the mobile station. The contents might affect the manner in which the network
handles the operation of the mobile station.
The MS Radio Access capability is a type 4 information element, with a maximum length of 52 octets.
The MS Radio Access capability information element is coded as shown in figure 10.5.128a/3GPP TS 24.008 and table
10.5.146/3GPP TS 24.008.
For the indication of the radio access capabilities the following conditions shall apply:
- Among the three Access Type Technologies GSM 900-P, GSM 900-E and GSM 900-R only one shall be
present.
- Due to shared radio frequency channel numbers between GSM 1800 and GSM 1900, the mobile station should
provide the relevant radio access capability for either GSM 1800 band OR GSM 1900 band, not both.
- The MS shall indicate its supported Access Technology Types during a single MM procedure.
- If the alternative coding by using the Additional access technologies struct is chosen by the mobile station, the
mobile station shall indicate its radio access capability for the serving BCCH frequency band in the first included
Access capabilities struct, if this information element is not sent in response to an Access Technologies Request
from the network or if none of the requested Access Technology Types is supported by the MS. Otherwise, the
mobile station shall include the radio access capabilities for the frequency bands it supports in the order of
priority requested by the network (see 3GPP TS 44.060 [76]).
- The first Access Technology Type shall not be set to "1111".
For error handling the following shall apply:
 If a received Access Technology Type is unknown to the receiver, it shall ignore all the corresponding fields.
 If within a known Access Technology Type a receiver recognizes an unknown field it shall ignore it.
 For more details about error handling of MS radio access capability see 3GPP TS 48.018 [86].
NOTE: The requirements for the support of the A5 algorithms in the MS are specified in 3GPP TS 43.020 [13].
8 7 6 5 4 3 2 1
MS Radio Access Capability IEI octet 1
Length of MS Radio Access Capability contents octet 2
MS RA capability value part octet 3-52
Figure 10.5.128a/3GPP TS 24.008 MS Radio Access Capability information element
ETSI
Release 18 618 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.146/3GPP TS 24.008: MS Radio Access Capability Information Element
< MS RA capability value part > ::=

< MS RA capability value part struct >
<spare bits>**; -- may be used for future enhancements
<MS RA capability value part struct >::= --recursive structure allows any number of Access technologies
{ { < Access Technology Type: bit (4) > exclude 1111
< Access capabilities : <Access capabilities struct> > }
| { < Access Technology Type: bit (4) == 1111 > -- structure adding Access technologies with same
capabilities
< Length : bit (7) > -- length in bits of list of Additional access technologies and spare bits
< bit (val (Length))
&{
{ 1 < Additional access technologies: < Additional access technologies struct > > } ** 0
<spare bits>**
}>
}
}
{ 0 | 1 <MS RA capability value part struct> } ;
< Additional access technologies struct > ::=

< Access Technology Type : bit (4) >
< GMSK Power Class : bit (3) >
< 8PSK Power Class : bit (2) > ;
< Access capabilities struct > ::=

< Length : bit (7) > -- length in bits of Content and spare bits
< bit (val (Length))
&{
<Access capabilities : <Content>>
<spare bits>**
} > ; -- expands to the indicated length
< Content > ::=

< RF Power Capability : bit (3) >
{ 0 | 1 <A5 bits : <A5 bits> > } -- zero means that the same values apply for parameters as in the immediately
preceding Access capabilities field within this IE
< ES IND : bit >
< PS : bit >
< VGCS : bit >
< VBS : bit >
{ 0 | 1 < Multislot capability : Multislot capability struct > } -- zero means that the same values for multislot
parameters as given in an earlier Access capabilities field within this IE apply also here
-- Additions in release 99
{ 0 | 1 < 8PSK Power Capability : bit(2) >}
< COMPACT Interference Measurement Capability : bit >
< Revision Level Indicator : bit >
< UMTS FDD Radio Access Technology Capability : bit > -- 3G RAT
< UMTS 3.84 Mcps TDD Radio Access Technology Capability : bit > -- 3G RAT
< CDMA 2000 Radio Access Technology Capability : bit > -- 3G RAT
< UMTS 1.28 Mcps TDD Radio Access Technology Capability: bit > -- 3G RAT
{ 0 | 1 < Extended DTM GPRS Multi Slot Class : bit(2) >
< Extended DTM EGPRS Multi Slot Class : bit(2) > }
< Modulation based multislot class support : bit >
{ 0 | 1 < High Multislot Capability : bit(2) > }
ETSI
Release 18 619 3GPP TS 24.008 V18.4.0 (2023-09)
< GMSK Multislot Power Profile : bit (2) >
< 8-PSK Multislot Power Profile : bit (2) >
< Multiple TBF Capability : bit >
< Downlink Advanced Receiver Performance : bit(2) >
< Extended RLC/MAC Control Message Segmentation Capability : bit >
< DTM Enhancements Capability : bit >
{ 0 | 1 < DTM GPRS High Multi Slot Class : bit(3) >
{ 0 | 1 < DTM EGPRS High Multi Slot Class : bit(3) > } }
< PS Handover Capability : bit >
< DTM Handover Capability : bit >
{ 0 | 1 < Multislot Capability Reduction for Downlink Dual Carrier: bit (3) >
< Downlink Dual Carrier for DTM Capability : bit> }
< Flexible Timeslot Assignment : bit >
< GAN PS Handover Capability : bit >
< RLC Non-persistent Mode : bit >
< Reduced Latency Capability : bit >
< Uplink EGPRS2 : bit(2) >
< Downlink EGPRS2 : bit(2) >
< E-UTRA FDD support : bit >
< E-UTRA TDD support : bit >
< GERAN to E-UTRA support in GERAN packet transfer mode: bit(2) >
< Priority-based reselection support : bit >
< Enhanced Flexible Timeslot Assignment : Enhanced Flexible Timeslot Assignment struct>
< Indication of Upper Layer PDU Start Capability for RLC UM : bit >
< EMST Capability : bit >
< MTTI Capability : bit >
< UTRA CSG Cells Reporting : bit >
< E-UTRA CSG Cells Reporting : bit >
< DTR Capability : bit >
< EMSR Capability : bit >
< Fast Downlink Frequency Switching Capability : bit >
< TIGHTER Capability : bit(2) >
< FANR Capability : bit >
< IPA Capability : bit>
< GERAN Network Sharing support : bit>
< E-UTRA Wideband RSRQ measurements support : bit>
< UTRA Multiple Frequency Band Indicators support : bit >
< E-UTRA Multiple Frequency Band Indicators support : bit >
{0 -- DLMC not supported
| 1 < DLMC Capability : DLMC Capability struct > }
< Extended TSC Set Capability support : bit >
-- Late addition of a release 11 feature
< Extended EARFCN value range: bit>
< (EC-)PCH monitoring support: bit(2)>
{0 -- Default requirement as specified in TS 45.010 applies
| 1 < MS Sync Accuracy: bit (4) > }
< EC uplink coverage enhancement support : bit (1)>
< MTA Access Security support: bit(1) >
< EC paging indication channel monitoring support: bit(1) >;
-- error: struct too short, assume features do not exist
ETSI
Release 18 620 3GPP TS 24.008 V18.4.0 (2023-09)
-- error: struct too long, ignore data and jump to next Access technology
ETSI
Release 18 621 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.146/3GPP TS 24.008 (continued): MS Radio Access Capability IE
ETSI
Release 18 622 3GPP TS 24.008 V18.4.0 (2023-09)
< Multislot capability struct > ::=

{ 0 | 1 < HSCSD multislot class : bit (5) > }
{ 0 | 1 < GPRS multislot class : bit (5) > < GPRS Extended Dynamic Allocation Capability : bit > }
{ 0 | 1 < SMS_VALUE : bit (4) > < SM_VALUE : bit (4) > }
{ 0 | 1 < ECSD multislot class : bit (5) > }
{ 0 | 1 < EGPRS multislot class : bit (5) > < EGPRS Extended Dynamic Allocation Capability : bit > }
{ 0 | 1 < DTM GPRS Multi Slot Class: bit(2)>
<Single Slot DTM : bit>
{0 | 1 <DTM EGPRS Multi Slot Class : bit(2)> } } ;
-- error: struct too short, assume features do not exist
<A5 bits> ::= < A5/1 : bit> <A5/2 : bit> <A5/3 : bit> <A5/4 : bit> <A5/5 : bit> <A5/6 : bit> <A5/7 : bit>; -- bits for circuit
mode ciphering algorithms. These fields are not used by the network and may be excluded by the MS.
< Enhanced Flexible Timeslot Assignment struct > ::=

{ 0 | 1 < Alternative EFTA Multislot Class : bit(4) >
< EFTA Multislot Capability Reduction for Downlink Dual Carrier: bit (3) > };
< DLMC Capability struct > ::=

{ 0 | 1 < DLMC - Non-contiguous intra-band reception : bit(2) >
< DLMC - Inter-band reception : bit(1) > }
< DLMC - Maximum Bandwidth : bit(2) >
< DLMC - Maximum Number of Downlink Timeslots : bit(6) >
< DLMC - Maximum Number of Downlink Carriers : bit(3) > ;
Access Technology Type

This field indicates the access technology type to be associated with the following access capabilities.
Bits
4321
0 0 0 0 GSM P
0 0 0 1 GSM E --note that GSM E covers GSM P
0 0 1 0 GSM R --note that GSM R covers GSM E and GSM P
0 0 1 1 GSM 1800
0 1 0 0 GSM 1900
0 1 0 1 GSM 450
0 1 1 0 GSM 480
0 1 1 1 GSM 850
1 0 0 0 GSM 750
1 0 0 1 GSM T 380
1 0 1 0 GSM T 410
1 0 1 1 -- This value was allocated in an earlier version of the protocol and shall not be used.
1 1 0 0 GSM 710
1 1 0 1 GSM T 810
1 1 1 1 Indicates the presence of a list of Additional access technologies
All other values are treated as unknown by the receiver.
A MS which does not support any GSM access technology type shall set this field to '0000'.
RF Power Capability, GMSK Power Class (3 bit field)

This field contains the binary coding of the power class used for GMSK associated with the indicated Access
Technology Type (see 3GPP TS 45.005 [33]).
A MS which does not support any GSM access technology type shall set this field to '000'.
8PSK Power Capability (2 bit field)

If 8-PSK modulation is supported for uplink, this field indicates the radio capability for 8-PSK modulation. The
following coding is used (see 3GPP TS 45.005 [33]):
Bits 2 1
00 Reserved
01 Power class E1
10 Power class E2
11 Power class E3
The presence of this field also indicates 8PSK modulation capability in the uplink.
8PSK Power Class (2 bit field)
ETSI
Release 18 623 3GPP TS 24.008 V18.4.0 (2023-09)
This field indicates the radio capability for 8-PSK modulation. The following coding is used (see 3GPP TS 45.005
[33]):
Bits 2 1
00 8PSK modulation not supported for uplink
01 Power class E1
10 Power class E2
11 Power class E3
Additional access technologies struct

This structure contains the GMSK Power Class and 8PSK Power Class for an additional Access Technology. All
other capabilities for this indicated Access Technology are the same as the capabilities indicated by the preceding
Access capabilities struct.
A5/1
A5/2
The MS shall set this bit to '0’.
The network shall accept any received value.
A5/3
A5/4
A5/5
A5/6
A5/7
ES IND – (Controlled early Classmark Sending)

0 "controlled early Classmark Sending" option is not implemented
1 "controlled early Classmark Sending" option is implemented
ETSI
Release 18 624 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.146/3GPP TS 24.008 (concluded): MS Radio Access Capability IE
ETSI
Release 18 625 3GPP TS 24.008 V18.4.0 (2023-09)
PS – (Pseudo Synchronisation)
0 PS capability not present
1 PS capability present
VGCS – (Voice Group Call Service)

0 no VGCS capability or no notifications wanted
1 VGCS capability and notifications wanted.
VBS – (Voice Broadcast Service)

0 no VBS capability or no notifications wanted
1 VBS capability and notifications wanted
HSCSD Multi Slot Class

The Multi Slot Class field is coded as the binary representation of the multislot class defined in 3GPP TS 45.002 [32].
This field is not used by the network and may be excluded by the MS.
Range 1 to 18, all other values are reserved.
GPRS Multi Slot Class
The GPRS Multi Slot Class field is coded as the binary representation of the multislot class defined in 3GPP TS
45.002 [32].
ECSD Multi Slot Class
The presence of this field indicates ECSD capability. Whether the MS is capable of 8-PSK modulation in uplink is
indicated by the presence of 8-PSK Power Capability field. The Multi Slot Class field is coded as the binary
representation of the multislot class defined in 3GPP TS 45.002 [32]. This field is not used by the network and may
be excluded by the MS.
Range 1 to 18, all other values are reserved.
EGPRS Multi Slot Class
The presence of this field indicates EGPRS capability. Whether the MS is capable of 8-PSK modulation in uplink is
indicated by the presence of 8-PSK Power Capability field. The EGPRS Multi Slot Class field is coded as the binary
representation of the multislot class defined in 3GPP TS 45.002 [32].

The same multislot capability is applicable also for Downlink Multi Carrier configuration if supported.
The same multislot capability is applicable also for EC-GSM-IoT if supported, see 3GPP TS 43.064 [159].
GPRS Extended Dynamic Allocation Capability

0 Extended Dynamic Allocation Capability for GPRS is not implemented
1 Extended Dynamic Allocation Capability for GPRS is implemented
If a multislot class type 1 MS indicates in the GPRS Multi Slot Class field the support of a multislot class for which
three or more uplink timeslots can be assigned, Extended Dynamic Allocation for GPRS shall be implemented in the
mobile station.
EGPRS Extended Dynamic Allocation Capability

0 Extended Dynamic Allocation Capability for EGPRS and EGPRS2 (if supported) is not implemented
1 Extended Dynamic Allocation Capability for EGPRS and EGPRS2 (if supported) is implemented
If a multislot class type 1 MS indicates in the EGPRS Multi Slot Class field the support of a multislot class for which
three or more uplink timeslots can be assigned, Extended Dynamic Allocation for EGPRS and EGPRS2 (if
supported) shall be implemented in the mobile station.
SMS_VALUE (Switch-Measure-Switch) (4 bit field)

The SMS field indicates the time needed for the mobile station to switch from one radio channel to another, perform a
neighbor cell power measurement, and the switch from that radio channel to another radio channel. This field is not
used by the network and may be excluded by the MS.
Bits
4321
...
(SM_VALUE) Switch-Measure (4 bit field)

The SM field indicates the time needed for the mobile station to switch from one radio channel to another and
perform a neighbour cell power measurement. This field is not used by the network and may be excluded by the MS.
Bits
4321
ETSI
Release 18 626 3GPP TS 24.008 V18.4.0 (2023-09)

...
ETSI
Release 18 627 3GPP TS 24.008 V18.4.0 (2023-09)
ETSI
Release 18 628 3GPP TS 24.008 V18.4.0 (2023-09)
DTM GPRS Multi Slot Class (2 bit field)

Bits
21
00 Unused. If received, the network shall interpret this as '01’
This field shall contain one of the following values if the DTM GPRS High Multi Slot Class field is present:
Multislot class 9 if DTM GPRS High Multi Slot Class is set to indicate Class 31/36 or Class 41;
Multislot class 11 if DTM GPRS High Multi Slot Class is set to indicate Classes 32/37, 33/38 or Classes 42, 43, 44.
Single Slot DTM (1 bit field)

This field indicates whether the MS supports single slot DTM operation (see 3GPP TS 43.055 [87]).
Bit
0 Single Slot DTM not supported
1 Single Slot DTM supported
An MS indicating support for Extended DTM GPRS multislot class or Extended DTM EGPRS multislot class shall
set this bit to '1’. The network may ignore the bit in this case.
DTM EGPRS Multi Slot Class (2 bit field)

This field indicates the DTM EGPRS multislot capabilities of the MS. This field shall be included only if the mobile
station supports EGPRS DTM. This field is coded as the DTM GPRS multislot Class field.
This field shall contain one of the following values if the DTM EGPRS High Multi Slot Class field is present:
Multislot class 9 if DTM EGPRS High Multi Slot Class is set to indicate Class 31/36 or Class 41;
Multislot class 11 if DTM EGPRS High Multi Slot Class is set to indicate Classes 32/37, 33/38 or Classes 42, 43,
44.
COMPACT Interference Measurement Capability (1 bit field)

0 COMPACT Interference Measurement Capability is not implemented
1 COMPACT Interference Measurement Capability is implemented
Revision Level Indicator (1 bit field)

Bit
0 The ME is Release ’98 or older
1 The ME is Release ’99 onwards
UMTS FDD Radio Access Technology Capability (1 bit field)

Bit
0 UMTS FDD not supported
1 UMTS FDD supported
Bit
CDMA 2000 Radio Access Technology Capability (1 bit field)

Bit
0 CDMA 2000 not supported
1 CDMA 2000 supported
Bit

The support of interworking towards E-UTRA is indicated separately in the "GERAN to E-UTRA support in
GERAN packet transfer mode" field. This field indicates whether the MS supports the GERAN Feature Package 1
(see 3GPP TS 44.060 [76]). It is coded as follows:
ETSI
Release 18 629 3GPP TS 24.008 V18.4.0 (2023-09)

Extended DTM GPRS Multi Slot Class (2 bit field)

This field indicates the extended DTM GPRS capabilities of the MS and shall be interpreted in conjunction with the
DTM GPRS Multi Slot Class field. It is coded as follows, where 'DGMSC’ denotes the DTM GPRS multislot class
field:
DGMSC Bit 2 1 Bit 2 1
The presence of this field indicates that the MS supports combined fullrate and halfrate GPRS channels in the
downlink. When this field is not present, the MS supports the multislot class indicated by the DTM GPRS Multi Slot
Class field.
If this field is included, it shall contain one of the following values if the DTM GPRS High Multi Slot Class field is
present:
Multislot class 10 if DTM GPRS High Multi Slot Class is set to indicate Class 31/36 or Class 41;
Multislot class 11 if DTM GPRS High Multi Slot Class is set to indicate Classes 32/37, 33/38 or Classes 42, 43, 44.
Extended DTM EGPRS Multislot Class (2 bit field)

This field is not considered when the DTM EGPRS Multislot Class field is not included. This field indicates the
extended DTM EGPRS multislot capabilities of the MS and shall be interpreted in conjunction with the DTM EGPRS
Multislot Class field. This field is coded as the Extended DTM GPRS Multislot Class field. The presence of this field
indicates that the MS supports combined fullrate and halfrate GPRS channels in the downlink. When this field is not
present, the MS supports the multislot class indicated by the DTM EGPRS Multi Slot Class field.
If this field is included, it shall contain one of the following values if the DTM EGPRS High Multi Slot Class field is
present:
Multislot class 10 if DTM EGPRS High Multi Slot Class is set to indicate Class 31/36 or Class 41;
Multislot class 11 if DTM EGPRS High Multi Slot Class is set to indicate Classes 32/37, 33/38 or Classes 42, 43,
44.
Modulation based multislot class support (1 bit field)

Bit
0 "Modulation based multislot class" not supported
1 "Modulation based multislot class" supported
High Multislot Capability (2 bit field)

The High Multislot Capability is individually combined with each multislot class field sent by the MS (the possible
multislot class fields are: GPRS multislot class, EGPRS multislot class) to extend the related multislot class to
multislot classes 30 to 45, see 3GPP TS 45.002 [32]. The same capability is applicable also to EGPRS2 if
supported. The same capability is applicable also to Downlink Multi Carrier configuration if supported.
For each multislot class, the following mapping is done:
Bits
21 coded multislot class field actual multislot class
00 8 30
00 10, 23, 28, 29 39
00 11, 20, 25 32
00 12, 21, 22, 26, 27 33
00 Any other Multislot Class field value
ETSI
Release 18 630 3GPP TS 24.008 V18.4.0 (2023-09)
01 8 35
01 10, 19, 24 36
01 11, 23, 28, 29 45
01 12, 21, 22, 26, 27 38
10 8 40
10 10, 19, 24 41
10 11, 20, 25 42
10 12, 23, 28, 29 44
11 12, 21, 22, 26, 27 43
11 11, 20, 25 37
11 10, 19, 24 31
11 9, 23, 28, 29 34
GMSK Multislot Power Profile (2 bit field)

For detailed definitions, see the Mobile Station Classmark 3 information element.
8-PSK Multislot Power Profile (2 bit field)

For detailed definitions, see the Mobile Station Classmark 3 information element.
Multiple TBF Capability (1 bit field)

Bit
0 Multiple TBF procedures in A/Gb mode not supported
1 Multiple TBF procedures in A/Gb mode supported
Downlink Advanced Receiver Performance (2 bit field)

This field indicates Downlink Advanced Receiver Performance capabilities of the MS (see 3GPP TS 45.005 [33]).
Bits
21
00 Downlink Advanced Receiver Performance not supported
01 Downlink Advanced Receiver Performance – phase I supported
10 Downlink Advanced Receiver Performance – phase II supported
The value '11’ shall not be used by the MS.

If the value '11’ is received by the network, it shall be interpreted as '10’ .
Extended RLC/MAC Control Message Segmentation capability (1 bit field)

Bit
0 Extended RLC/MAC control message segmentation not supported
1 Extended RLC/MAC control message segmentation supported
DTM Enhancements Capability (1 bit field)

This field indicates whether the mobile station supports enhanced DTM CS establishment and enhanced DTM CS
release or not. It is coded as follows:
Bit
0 The mobile station does not support enhanced DTM CS establishment and enhanced DTM CS release
procedures.
1 The mobile station supports enhanced DTM CS establishment and enhanced DTM CS release procedures.
DTM GPRS High Multi Slot Class (3 bit field)

Bit
321
000 Unused. If received, the network shall interpret this as '0 0 1’
The presence of this field indicates that the MS supports the DTM extension to high multislot classes. When this
field is not present, the MS supports the DTM multislot class indicated by the DTM GPRS Multi Slot Class field.
ETSI
Release 18 631 3GPP TS 24.008 V18.4.0 (2023-09)
The values '0 0 1', '0 1 0' and '0 1 1' shall be interpreted as indicating DTM GPRS multislot class 36, 37 or 38
respectively in case the MS indicates support for one of the GPRS multislot classes 35 to 39; in all other cases
those codepoints shall be interpreted as indicating DTM GPRS multislot class 31, 32 or 33 respectively.
This field shall be ignored if the High Multislot Capability field is not present.
DTM EGPRS High Multi Slot Class (3 bit field)

This field indicates the DTM EGPRS multislot capabilities of the MS. This field may be included only if the mobile
station supports EGPRS DTM. This field is coded as the DTM GPRS High Multi Slot Class field. When this field is
not present, the MS supports the DTM multislot class indicated by the DTM EGPRS Multi Slot Class field.
The values '0 0 1', '0 1 0' and '0 1 1' shall be interpreted as indicating DTM EGPRS multislot class 36, 37 or 38
respectively in case the MS indicates support for one of the EGPRS multislot classes 35 to 39; in all other cases
those codepoints shall be interpreted as indicating DTM EGPRS multislot class 31, 32 or 33 respectively.
This field shall be ignored if the High Multislot Capability field is not present.
PS Handover Capability (1 bit field)

This field indicates whether the mobile station supports PS Handover. The PS Handover Capability applies to all
RATs and modes indicated as supported in this information element, except for E-UTRA, where the support is
indicated separately in the "GERAN to E-UTRA support in GERAN packet transfer mode" field.
Bit
0 The mobile station does not support PS Handover.
1 The mobile station supports PS Handover
DTM Handover Capability (1 bit field)

This field indicates whether the mobile station supports DTM Handover. The DTM Handover Capability applies to all
RATs and modes indicated as supported in this information element. It is coded as follows:
Bit
0 The mobile station does not support DTM Handover.
1 The mobile station supports DTM Handover
Multislot Capability Reduction for Downlink Dual Carrier (3 bit field)

This field indicates the receive multislot capability reduction of a dual carrier capable mobile station applicable to
EGPRS and EGPRS2 support when EFTA is not used (see 3GPP TS 45.002 [32]). This reduction applies to the
maximum number of downlink timeslots for dual carrier operation derived from the (DTM) EGPRS (high) multislot
class. The field is coded as follows:
Bit
321
000 No reduction
001 The MS supports 1 timeslot fewer than the maximum number of receive timeslots
010 The MS supports 2 timeslots fewer than the maximum number of receive timeslots
111 Reserved for future use
The presence of this field also indicates that the mobile station supports dual carrier in the downlink for EGPRS.
Downlink Dual Carrier for DTM Capability (1 bit field)

This field indicates whether the mobile station supports DTM during downlink dual carrier operation.
Bit
0 The mobile station does not support DTM during downlink dual carrier operation
1 The mobile station supports DTM during downlink dual carrier operation
If the mobile station supports DTM during downlink dual carrier operation as indicated by this field, the Multislot
Capability Reduction for Downlink Dual Carrier field provided in the MS Radio Access Capability IE is applicable to
EGPRS DTM support as well.
Flexible Timeslot Assignment (1 bit field)

This field indicates whether the mobile station supports Flexible Timeslot Assignment (see 3GPP TS 45.002 [32]).
ETSI
Release 18 632 3GPP TS 24.008 V18.4.0 (2023-09)
0 The mobile station does not support Flexible Timeslot Assignment

1 The mobile station supports Flexible Timeslot Assignment
GAN PS Handover Capability (1 bit field)

This field indicates whether or not the mobile station supports PS Handover from GERAN/UTRAN cell to a GAN
cell. The field is coded as follows:
Bit
0 The mobile station does not support PS Handover from GERAN/UTRAN cell to a GAN cell
1 The mobile station supports PS Handover from GERAN/UTRAN cell to a GAN cell
RLC Non-persistent Mode Capability (1 bit field)

This field indicates whether the mobile station supports RLC Non-persistent Mode (see 3GPP TS 44.060 [76]).
0 The mobile station does not support RLC Non-persistent Mode

1 The mobile station supports RLC Non-persistent Mode
Reduced Latency Capability (1 bit field)

This field indicates whether the mobile station supports Reduced TTI configurations and Fast Ack/Nack Reporting
(see 3GPP TS 44.060 [76]) in packet transfer mode for both EGPRS and, if supported, EGPRS2.
0 The mobile station does not support Reduced TTI configurations and Fast Ack/Nack Reporting
1 The mobile station supports Reduced TTI configurations and Fast Ack/Nack Reporting
A mobile station whose multislot class does not allow the support of Reduced TTI configurations in packet transfer
mode due to a limited number of uplink or downlink timeslots (see 3GPP TS 45.002 [32]) shall set the Reduced
Latency Capability field to '0'.
Uplink EGPRS2 (2 bit field)

This field indicates whether the mobile station supports EGPRS2-A or EGPRS2-A and EGPRS2-B in the uplink.
Bit
21
00 The mobile station does not support either EGPRS2-A or EGPRS2-B in the uplink
01 The mobile station supports EGPRS2-A in the uplink
10 The mobile station supports both EGPRS2-A and EGPRS2-B in the uplink
1 1 This value is not used in this release/version of the specifications. If received it shall be interpreted
as '10’
Downlink EGPRS2 (2 bit field)

This field indicates whether the mobile station supports EGPRS2-A or EGPRS2-A and EGPRS2-B in the downlink.
Bit
21
00 The mobile station does not support either EGPRS2-A or EGPRS2-B in the downlink
01 The mobile station supports EGPRS2-A in the downlink
10 The mobile station supports both EGPRS2-A and EGPRS2-B in the downlink
1 1 This value is not used in this release/version of the specifications. If received it shall be interpreted
as '10’
E-UTRA FDD support (1 bit field)

Bit
0 E-UTRA FDD not supported
1 E-UTRA FDD supported
E-UTRA TDD support (1 bit field)

Bit
0 E-UTRA TDD not supported
1 E-UTRA TDD supported
GERAN to E-UTRA support in GERAN packet transfer mode (2 bit field)

This field indicates the capabilities supported by the mobile station in packet transfer mode for GERAN to E-UTRA
interworking. If both "E-UTRA FDD support" and "E-UTRA TDD support" bits are set to '0', the bit field shall be set
to '0 0'. If one or both of "E-UTRA FDD support" and "E-UTRA TDD support" bits are set to '1', the bit field may be
any of the listed values. The bit field is coded as follows:
Bit
21
00 None
01 E-UTRAN Neighbour Cell measurements and MS autonomous cell reselection to E-UTRAN supported
ETSI
Release 18 633 3GPP TS 24.008 V18.4.0 (2023-09)
10 CCN towards E-UTRAN, E-UTRAN Neighbour Cell measurement reporting and Network controlled cell
reselection to E-UTRAN supported in addition to capabilities indicated by '01'
11 PS Handover to E-UTRAN supported in addition to capabilities indicated by '01' and '10'
Priority-based reselection support (1 bit field)

This field indicates whether the mobile station supports priority-based cell reselection.
0 Priority-based cell reselection not supported

1 Priority-based cell reselection supported
Alternative EFTA multislot class (4 bit field)

The presence of the Alternative EFTA multislot class field indicates that the mobile station supports Enhanced
Flexible Timeslot Assignment, EFTA, (see 3GPP TS 45.002 [32]). This field shall be ignored if the High Multislot
Capability field is not present. The Alternative EFTA multislot class field is used together with the (DTM) EGPRS
(high) multislot class to determine the mobile stations capabilities when using Enhanced Flexible Timeslot
Assignment, EFTA, and is coded as follows:
Bit
4321
0000 No Alternative EFTA multislot class is indicated. Use (DTM) EGPRS (high) multislot class only.
0001 Alternative EFTA multislot class 1
0100
to
1111 Unused. If received, these values shall be interpreted as ’0000’
EFTA Multislot Capability Reduction for Downlink Dual Carrier (3 bit field)
This field indicates the receive multislot capability reduction of a dual carrier capable mobile station applicable to
EGPRS and EGPRS2 support when Enhanced Flexible Timeslot Assignment is used (see 3GPP TS 45.002 [32]).
This reduction applies to the maximum number of downlink timeslots for dual carrier operation derived from the
Alternative EFTA Multislot Class field. The coding of this field is the same as the coding of the Multislot Capability
Reduction for Downlink Dual Carrier field.
This field shall be ignored if a mobile station does not support Downlink Dual Carrier.
Indication of Upper Layer PDU Start Capability for RLC UM (1 bit field)
This field indicates whether the mobile station supports "Indication of Upper Layer PDU Start for RLC UM" (see
3GPP TS 44.060 [76]) for RLC unacknowledged mode of operation. The field is coded as follows:
0 The mobile station does not support "Indication of Upper Layer PDU Start for RLC UM"
1 The mobile station supports "Indication of Upper Layer PDU Start for RLC UM"
EMST Capability (1 bit field)

This field indicates whether the mobile station supports Enhanced Multiplexing for Single TBF (EMST) (see
3GPP TS 44.060 [76]).
0 The mobile station does not support EMST

1 The mobile station supports EMST
MTTI Capability (1 bit field)

This field indicates whether the mobile station supports multiple TTI (MTTI) configurations (see
3GPP TS 44.060 [76])
Bit
0 MTTI configurations not supported
1 MTTI configurations supported
UTRA CSG Cells Reporting (1 bit field)

3GPP TS 44.060 [76]) for UTRAN CSG cells in packet transfer mode. This capability shall apply to each UTRA
radio access mode supported by the mobile.
Bit
0 Reporting of UTRAN CSG cells in packet transfer mode not supported
1 Reporting of UTRAN CSG cells in packet transfer mode supported
E-UTRA CSG Cells Reporting (1 bit field)

3GPP TS 44.060 [76]) for E-UTRAN CSG cells in packet transfer mode. This capability shall apply to each E-UTRA
ETSI
Release 18 634 3GPP TS 24.008 V18.4.0 (2023-09)
radio access mode supported by the mobile.

Bit
0 Reporting of E-UTRAN CSG cells in packet transfer mode not supported
1 Reporting of E-UTRAN CSG cells in packet transfer mode supported
DTR Capability (1 bit field)

This field indicates whether the mobile station supports Dynamic Timeslot Reduction (DTR), see
3GPP TS 44.060 [76].
0 The mobile station does not support DTR

1 The mobile station supports DTR
EMSR Capability (1 bit field)

This field indicates whether the mobile station supports Enhanced Multiplexing for Single RLC Entity (EMSR), see
3GPP TS 44.060 [76].
0 The mobile station does not support EMSR

1 The mobile station supports EMSR
Fast Downlink Frequency Switching Capability (1 bit field)

This field indicates whether the mobile station supports fast downlink frequency switching between two consecutive
TDMA frames (see 3GPP TS 45.002 [32]).
0 Fast downlink frequency switching not supported

1 Fast downlink frequency switching supported
TIGHTER Capability (2 bit field)

This field indicates Tightened Link Level Performance support in the MS (see 3GPP TS 45.005 [33]). The tightened
performance applies to the traffic channels and signalling channels specified in 3GPP TS 45.005 [33].
Bits
21
00 TIGHTER not supported
01 TIGHTER supported for speech and signalling channels only
10 TIGHTER supported for speech and signalling channels and for GPRS and EGPRS, but not for EGPRS2
11 TIGHTER supported for speech and signalling channels and for GPRS, EGPRS and EGPRS2
FANR Capability (1 bit field)

This field indicates whether the mobile station supports Fast Ack/Nack Reporting (see 3GPP TS 44.060 [76]) in
packet transfer mode for EGPRS and, if supported, EGPRS2. If the mobile station indicates support for Reduced
TTI configurations and Fast Ack/Nack Reporting using the Reduced Latency Capability Indicator then the network
shall ignore FANR Capability information.
0 The mobile station does not support Fast Ack/Nack Reporting

1 The mobile station supports Fast Ack/Nack Reporting
IPA Capability (1 bit field)

This field indicates whether the mobile station supports Immediate Packet Assignment (IPA), see 3GPP TS 44.018
[84].
Bit
0 The mobile station does not support IPA
1 The mobile station supports IPA
GERAN Network Sharing support (1 bit field)

This field indicates whether the mobile station supports GERAN network sharing. A mobile station supporting
GERAN network sharing shall also support the extended EARFCN value range in GERAN and indicate this in the
respective bit.
Bit
0 The mobile station does not support GERAN network sharing
1 The mobile station supports GERAN network sharing
E-UTRA Wideband RSRQ measurements support (1 bit field)

This field indicates whether the mobile station supports E-UTRA wideband RSRQ measurements (see
3GPP TS 45.008 [151]).
Bit
0 The mobile station does not support E-UTRA wideband RSRQ measurements
ETSI
Release 18 635 3GPP TS 24.008 V18.4.0 (2023-09)
1 The mobile station supports E-UTRA wideband RSRQ measurements
UTRA Multiple Frequency Band Indicators support (1 bit field)

This field indicates whether the mobile station supports multiple radio frequency bands in UTRAN (see 3GPP TS
25.331 [23c]) and whether it understands signalling of overlapping UTRA frequency bands (see 3GPP TS
44.060 [76]).
Bit
0 The mobile station does not support Multiple Frequency Band Indicators in UTRAN
1 The mobile station supports Multiple Frequency Band Indicators in UTRAN
E-UTRA Multiple Frequency Band Indicators support (1 bit field)

This field indicates whether the mobile station supports multiple radio frequency bands in E-UTRAN (see 3GPP TS
36.331 [129]) and whether it understands signalling of overlapping E-UTRA frequency bands (see 3GPP TS
44.060 [76]).
Bit
0 The mobile station does not support Multiple Frequency Band Indicators in E-UTRAN
1 The mobile station supports Multiple Frequency Band Indicators in E-UTRAN
DLMC - Non-contiguous intra-band reception (2 bit field)

This field indicates the intra-band non-contiguous reception mode (see 3GPP TS 45.005 [33]) supported by the
mobile station in Downlink Multicarrier configurations. The absence of this field indicates that a mobile station does
not support intra-band non-contiguous reception.
Bit
21
00 Not supported
01 Supported in band E-GSM or GSM850
10 Supported in band DCS1800 or PCS1900
11 Supported in band E-GSM, or GSM850, or DCS1800 or PCS1900
DLMC - Inter-band reception (1 bit field)

This field indicates the inter-band reception mode (see 3GPP TS 45.005 [33]) supported by the mobile station in
Downlink Multicarrier configuration. The absence of this field indicates that a mobile station does not support inter-
band reception.
Bit
0 Not supported
1 Supported in band combination (E-GSM, DCS1800), or band combination (GSM850, PCS1900).
DLMC - Maximum Bandwidth (2 bit field)

This field indicates the maximum bandwidth supported by a mobile station.
Bit
21
00 Bandwidth = 5 MHz
DLMC - Maximum Number of Downlink Timeslots (6 bit field)

This field indicates the maximum number of downlink timeslots supported by a mobile station in Downlink Multi
Carrier configuration.
Bit
654321
0 0 0 0 0 06 TS supported
…
…
111101 128 TS supported
1 1 1 1 1 0reserved
1 1 1 1 1 1reserved
ETSI
Release 18 636 3GPP TS 24.008 V18.4.0 (2023-09)
DLMC - Maximum Number of Downlink Carriers (3 bit field)

This field indicates the maximum number of downlink carriers supported by a mobile station in Downlink Multi
Carrier configuration.
Bit
321
000 2 carriers supported
Extended TSC Set Capability support (1 bit field)

This field indicates whether the mobile station supports the extended TSC sets when operating in the PS or CS
domain (see 3GPP TS 45.002 [32]).
Bit
0 The mobile station does not support Extended TSC sets
1 The mobile station supports Extended TSC sets
Extended EARFCN value range (1 bit field)

This field indicates whether the mobile station supports the extended EARFCN value range in GERAN (see
3GPP TS 44.060 [76]).
Bit
0 The mobile station does not support extended EARFCN value range
1 The mobile station supports extended EARFCN value range
(EC-)PCH monitoring support (2 bit field)

This field indicates if the mobile station is capable of monitoring the PCH channel, the EC-PCH channel or both for
paging based reachability.
Bit
21
0 0 PCH supported
0 1 EC-PCH supported
1 0 PCH and EC-PCH supported
1 1 reserved
EC-PCH support also indicates EC-GSM-IoT capability, see 3GPP TS 43.064 [159].
MS Sync Accuracy (4 bit field)

This field indicates the guaranteed synchronization accuracy (i.e the assessment of the BTS timing) achievable by
the MS when synchronizing to the downlink during the MTA and procedure and is coded as the MS Sync Accuracy
field in 3GPP TS 49.031 [165].
EC uplink coverage enhancement support (1 bit field)

This field indicates if the mobile station supports uplink coverage class CC5.
Bit
0 The mobile station does not support uplink coverage class CC5
1 The mobile station supports uplink coverage class CC5
MTA Access Security support (1 bit field)

This field indicates if the mobile station supports MTA Access Security comprising the support of the MTA Access
Security and BSS Duplication Detection methods.
Bit
0 The mobile station does not support MTA Access Security
1 The mobile station supports MTA Access Security
EC paging indication channel monitoring support (1 bit field)

This field indicates if the mobile station supports monitoring of the EC paging indication channel, see
3GPP TS 43.064 [159].
ETSI
Release 18 637 3GPP TS 24.008 V18.4.0 (2023-09)
Bit
0 The mobile station does not support monitoring of the EC paging indication channel
1 The mobile station supports monitoring of the EC paging indication channel
10.5.5.13 Spare
This is intentionally left spare.
10.5.5.14 GMM cause

The purpose of the GMM cause information element is to indicate the reason why a GMM request from the mobile
station is rejected by the network.
The GMM cause information element is coded as shown in figure 10.5.129/3GPP TS 24.008 and table 10.5.147/3GPP
TS 24.008.
The GMM cause is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
GMM cause IEI octet 1
Cause value octet 2
Figure 10.5.129/3GPP TS 24.008: GMM cause information element
ETSI
Release 18 638 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.147/3GPP TS 24.008: GMM cause information element

Bits
8 7 6 5 4 3 2 1
0 0 0 0 0 0 1 0 IMSI unknown in HLR
0 0 0 0 0 0 1 1 Illegal MS
0 0 0 0 0 1 0 1 IMEI not accepted
0 0 0 0 0 1 1 0 Illegal ME
0 0 0 0 0 1 1 1 GPRS services not allowed
0 0 0 0 1 0 0 0 GPRS services and non-GPRS services not
allowed
0 0 0 0 1 0 0 1 MS identity cannot be derived by the network
0 0 0 0 1 0 1 0 Implicitly detached
0 0 0 0 1 0 1 1 PLMN not allowed
0 0 0 0 1 1 0 0 Location Area not allowed
0 0 0 0 1 1 0 1 Roaming not allowed in this location area
0 0 0 0 1 1 1 0 GPRS services not allowed in this PLMN
0 0 0 0 1 1 1 1 No Suitable Cells In Location Area
0 0 0 1 0 0 0 0 MSC temporarily not reachable
0 0 0 1 0 0 0 1 Network failure
0 0 0 1 0 1 0 0 MAC failure
0 0 0 1 0 1 0 1 Synch failure
0 0 0 1 0 1 1 0 Congestion
0 0 0 1 0 1 1 1 GSM authentication unacceptable
0 0 0 1 1 0 0 1 Not authorized for this CSG
0 0 0 1 1 1 0 0 SMS provided via GPRS in this routing area
0 0 1 0 1 0 0 0 No PDP context activated
0 0 1 1 0 0 0 0 }
to } retry upon entry into a new cell
0 0 1 1 1 1 1 1 }
0 1 0 1 1 1 1 1 Semantically incorrect message
0 1 1 0 0 0 0 0 Invalid mandatory information
0 1 1 0 0 0 0 1 Message type non-existent or not implemented
0 1 1 0 0 0 1 0 Message type not compatible with the protocol
state
0 1 1 0 0 0 1 1 Information element non-existent or not
implemented
0 1 1 0 0 1 0 0 Conditional IE error
0 1 1 0 0 1 0 1 Message not compatible with the protocol state
0 1 1 0 1 1 1 1 Protocol error, unspecified
Any other value received by the mobile station shall be treated as 0110 1111, "Protocol
error, unspecified". Any other value received by the network shall be treated as 0110
1111, "Protocol error, unspecified".
NOTE: The listed reject cause values are defined in annex G.
10.5.5.15 Routing area identification

The purpose of the routing area identification information element is to provide an unambiguous identification of
routing areas within the GPRS coverage area.
The routing area identification is a type 3 information element with 7 octets length.
The routing area identification information element is coded as shown in figure 10.5.130/3GPP TS 24.008 and
table 10.5.148/3GPP TS 24.008.
ETSI
Release 18 639 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Routing Area Identification IEI octet 1
LAC octet 5
LAC cont'd octet 6
RAC octet 7
Figure 10.5.130/3GPP TS 24.008: Routing area identification information element
Table 10.5.148/3GPP TS 24.008: Routing area identification information element
MCC, Mobile country code (octet 2 and 3)

If the RAI is deleted, the MCC and MNC shall take the value from the deleted RAI.
In abnormal cases, the MCC stored in the mobile station can contain elements not in the set {0, 1 ... 9}. In such
cases the mobile station should transmit the stored values using full hexadecimal encoding. When receiving such
an MCC, the network shall treat the RAI as deleted.
The coding of this field is the responsibility of each administration but BCD coding shall be used. The MNC shall
consist of 2 or 3 digits. For PCS 1900 for NA, Federal regulation mandates that a 3-digit MNC shall be used.
However a network operator may decide to use only two digits in the MNC in the RAI over the radio interface. In
this case, bits 5 to 8 of octet 3 shall be coded as "1111". Mobile equipment shall accept RAI coded in such a way.
NOTE 1: In earlier versions of this protocol, the possibility to use a one digit MNC in RAI was provided on the
radio interface. However as this was not used this possibility has been deleted.
NOTE 2: In earlier versions of this protocol, bits 5 to 8 of octet 3 were coded as "1111". Mobile equipment
compliant with these earlier versions of the protocol may be unable to understand the 3-digit MNC
format of the RAI, and therefore unable to register on a network broadcasting the RAI in this format.
In abnormal cases, the MNC stored in the mobile station can have:
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ... 9, F} hex.
In such cases the mobile station shall transmit the stored values using full hexadecimal encoding. When
receiving such an MNC, the network shall treat the RAI as deleted.
The same handling shall apply for the network, if a 3-digit MNC is sent by the mobile station to a network using
only a 2-digit MNC.
LAC, Location area code (octet 5 and 6)
In the LAC field bit 8 of octet 5 is the most significant bit and bit 1 of octet 6 the least significant bit.
The coding of the location area code is the responsibility of each administration except that two values are used
to mark the LAC, and hence the RAI, as deleted. Coding using full hexadecimal representation may be used. The
location area code consists of 2 octets.
If a RAI has to be deleted then all bits of the location area code shall be set to one with the exception of the least
significant bit which shall be set to zero. If a SIM/USIM is inserted in a Mobile Equipment with the location area
code containing all zeros, then the Mobile Equipment shall recognise this LAC as part of a deleted RAI.
RAC, Routing area code (octet 7)
In the RAC field bit 8 of octet 7 is the most significant. The coding of the routing area code is the responsibility of
each administration. Coding using full hexadecimal representation may be used. The routing area code consists
of 1 octet.
ETSI
Release 18 640 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.5.15a Routing area identification 2

The purpose of the Routing area identification 2 information element is to provide an unambiguous identification of
routing areas within the GPRS coverage area.
The Routing area identification 2 is a type 4 information element with a length of 8 octets.
The Routing area identification 2 information element is coded as shown in figure 10.5.130a/3GPP TS 24.008 and
table 10.5.148a/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Routing area identification 2 IEI octet 1
Length of routing area identification 2 contents octet 2
octet 3
Routing area identification 2 value
octet 8
Figure 10.5.130a/3GPP TS 24.008: Routing area identification 2 information element
Table 10.5.148a/3GPP TS 24.008: Routing area identification 2 information element
Routing area identification 2 value (octet 3 to 8)
The routing area identification 2 value is coded as octet 2 to 7 of the Routing area identification information
element.
10.5.5.16 Spare
This is intentionally left spare.
10.5.5.17 Update result

The purpose of the update result information element is to specify the result of the associated updating procedure.
The update result is a type 1 information element.
The update result information element is coded as shown in figure 10.5.131/3GPP TS 24.008 and table 10.5.149/3GPP
TS 24.008.
8 7 6 5 4 3 2 1
Update result FOP Update result octet 1
IEI value
Figure 10.5.131/3GPP TS 24.008: Update result information element
ETSI
Release 18 641 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.149/3GPP TS 24.008: Update result information element
Update result value (octet 1)

Bits
3 2 1
0 0 0 RA updated
0 0 1 combined RA/LA updated
1 0 0 RA updated and ISR activated
1 0 1 combined RA/LA updated and ISR activated
Follow-on proceed (octet 1, bit 4)

Bit
4
0 Follow-on proceed
1 No follow-on proceed
Follow-on proceed is applicable only in Iu mode. This indication shall be ignored if

received in A/Gb mode.
10.5.5.18 Update type

The purpose of the update type information element is to specify the area the updating procedure is associated with.
The update type is a type 1 information element.
The update type information element is coded as shown in figure 10.5.132/3GPP TS 24.008 and table 10.5.150/3GPP
TS 24.008.
8 7 6 5 4 3 2 1
Update type FOR Update type octet 1
IEI value
Figure 10.5.132/3GPP TS 24.008: Update type information element
Table 10.5.150/3GPP TS 24.008: Update type information element
Update type value (octet 1, bit 1 to 3)
Bits
3 2 1
0 0 0 RA updating
0 0 1 combined RA/LA updating
0 1 0 combined RA/LA updating with IMSI attach
0 1 1 Periodic updating
Follow-on request (octet 1, bit 4)

Bit
4
Follow-on request pending is applicable only in Iu mode.
ETSI
Release 18 642 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.5.19 A&C reference number

The purpose of the A&C reference number information element is to indicate to the network in the
AUTHENTICATION AND CIPHERING RESPONSE message which AUTHENTICATION AND CIPHERING
REQUEST message the MS is replying to.
The A&C reference number is a type 1 information element.
The A&C reference number information element is coded as shown in figure 10.5.134/3GPP TS 24.008 and
table 10.5.152/3GPP TS 24.008.
8 7 6 5 4 3 2 1
A&C reference number A&C reference number octet 1
IEI value
Figure 10.5.134/3GPP TS 24.008: A&C reference number information element
Table 10.5.152/3GPP TS 24.008: A&C reference number information element
A&C reference number value (octet 1)
Unformatted 4 bit field
10.5.5.20 Service type

The purpose of the service type information element is to specify the purpose of the Service request procedure.
The service type is a type 1 information element.
The service type information element is coded as shown in figure 10.5.135/3GPP TS 24.008 and table 10.5.153a/3GPP
TS 24.008.
8 7 6 5 4 3 2 1
Service type 0 Service type octet 1
IEI spare
Figure 10.5.135/3GPP TS 24.008: Service type information element
Table 10.5.153a/3GPP TS 24.008: Service type information element
Service type value (octet 1)
Bits
3 2 1
0 0 0 Signalling
0 0 1 Data
0 1 0 Paging Response
0 1 1 MBMS Multicast Service Reception
1 0 0 MBMS Broadcast Service Reception
ETSI
Release 18 643 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.5.21 Cell Notification

The purpose of the Cell Notification information element is to indicate that the Cell Notification is supported by the
network and shall be then used by MS.
The Cell Notification information element is coded as shown in figure 10.5.135a/3GPP TS 24.008.
The Cell Notification is a type 2 information element.
8 7 6 5 4 3 2 1
Cell Notification IEI octet 1
Figure 10.5.135a/3GPP TS 24.008: Cell Notification information element

The purpose of the PS LCS Capability element is to indicate the positioning methods and additional positioning
capabilities supported by the MS for the provision of location services (LCS) via the PS domain in Gb-mode.
The PS LCS Capability is a type 4 information element with a length of 4 octets.
The PS LCS Capability element is coded as shown in figure 10.5.135b/3GPP TS 24.008 and
table 10.5.153b/3GPP TS 24.008.
8 7 6 5 4 3 2 1
PS LCS Capability IEI octet 1
Length of PS LCS Capability contents octet 2
MTA-E MTA-R APC OTD-A OTD-B GPS-A GPS-B GPS-C octet 3
Spare MOTD MTA-A octet 4*
0 0 0 0 0 0
ETSI
Release 18 644 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 10.5.135b/3GPP TS 24.008: PS LCS Capability information element
Table 10.5.153b/3GPP TS 24.008 PS LCS Capability information element
PS LCS Capability value (octet 3, bit 1 to 8)
MTA-E (Multilateration Timing Advance using Extended Access Burst method)

Bit 8
0 MTA-E not supported
1 MTA-E supported
MTA-R (Multilateration Timing Advance using RLC data block method)

Bit 7
0 MTA-R not supported
1 MTA-R supported
APC (Additional Positioning Capabilities)

Bit 6
0 Additional Positioning Capabilities which can be retrieved by RRLP are not supported
1 Additional Positioning Capabilities which can be retrieved by RRLP are supported
OTD-A (MS assisted E-OTD)

Bit 5
0 MS assisted E-OTD not supported
1 MS assisted E-OTD supported
OTD-B (MS based E-OTD)

Bit 4
0 MS based E-OTD not supported
1 MS based E-OTD supported
GPS-A (MS assisted GPS)

Bit 3
0 MS assisted GPS not supported
1 MS assisted GPS supported
GPS-B (MS based GPS)

Bit 2
0 MS based GPS not supported
1 MS based GPS supported
GPS-C (Conventional GPS)

Bit 1
0 Conventional GPS not supported
1 Conventional GPS supported
PS LCS Capability value (octet 4, bit 1 to 2)
MOTD (Multilateration Observed Time Difference)

Bit 2
0 MOTD not supported
1 MOTD supported
MTA-A (Multilateration Timing Advance using Access Burst method)

Bit 1
0 MTA-A not supported
1 MTA-A supported
Octet 4, bits 3-8 are spare and shall be coded as 0.
ETSI
Release 18 645 3GPP TS 24.008 V18.4.0 (2023-09)

The purpose of the network feature support information element is to indicate whether certain features are supported by
the network. If this IE is not included then the respective features are not supported.
The network feature support is a type 1 information element.
The network feature support information element is coded as shown in figure 10.5.135c/3GPP TS 24.008 and
table 10.5.153c/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Network feature support LCS- MBMS IMS EMC octet 1
IEI MOLR VoPS BS
Figure 10.5.135c/3GPP TS 24.008: Network feature support information element
Table 10.5.153c/3GPP TS 24.008: Network feature support information element
Network feature support value (octet 1, bit 1 to 4)
LCS-MOLR (1 bit field)
Bit
4
0 LCS-MOLR via PS domain not supported
1 LCS-MOLR via PS domain supported
MBMS (1 bit field)
Bit
3
0 MBMS not supported
1 MBMS supported
IMS voice over PS session indicator (IMS VoPS) (1 bit field)
Bit
2
0 IMS voice over PS session in Iu mode and A/Gb mode not supported
1 IMS voice over PS session supported in Iu mode, but not supported in
A/Gb mode
Emergency bearer services indicator (EMC BS) (1 bit field)
Bit
1
0 Emergency bearer services in Iu mode and A/Gb mode not supported
1 Emergency bearer services supported in Iu mode, but not supported in
A/Gb mode
10.5.5.23A Additional network feature support

The purpose of the Additional network feature support information element is to indicate whether certain features are
supported by the network.
The Additional network feature support is a type 4 information element with a length of 3 octets.
The Additional network feature support information element is coded as shown in figure 10.5.5.23A/3GPP TS 24.008
and table 10.5.5.23A/3GPP TS 24.008.
ETSI
Release 18 646 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Additional network feature support IEI octet 1
Length of additional network feature support contents octet 2
0 0 0 0 0 ePCO Restric GPRS-

Spare Spare Spare Spare Spare tEC SMS octet 3
Figure 10.5.5.23A: Additional network feature support information element
Table 10.5.5.23A: Additional network feature support information element
GPRS-SMS supported (GPRS-SMS) (octet 3, bit 1)
Bit
1
0 SMS via GPRS supported
1 SMS via GPRS not supported
Restriction on enhanced coverage (RestrictEC) (octet 3, bit 2)
Bit
2
0 Enhanced coverage not restricted
1 Enhanced coverage restricted
ePCO IE supported (ePCO) (octet 3, bit 3)
Bit
3
0 extended protocol configuration options IE not supported
1 extended protocol configuration options IE supported
Bits 4 to 8 of octet 3 are spare and shall be coded all zero.
10.5.5.24 Inter RAT information container

The purpose of the Inter RAT information container information element is to supply the network with Iu mode related
information that needs to be transferred at PS inter-system handover to Iu mode (see 3GPP TS 43.129 [113]).
The Inter RAT information container information element is coded as shown in figure 10.5.150/3GPP TS 24.008.
The Inter RAT information container information element is a type 4 information element with a minimum length of 3
octets and a maximum length of 250 octets.
The Inter RAT information container contains:
- predefined configuration status information;
- mobile station security information to be used after handover to Iu mode, which includes the START-PS value
that is stored by the MS at handover from Iu mode to A/Gb mode (see 3GPP TS 33.102 [5a]); and/or
- the specific Iu mode radio capabilities of the mobile station, i.e. UE RAC (see 3GPP TS 25.331 [23c]).
8 7 6 5 4 3 2 1
Inter RAT information container IEI octet 1
Length of inter RAT information container octet 2
Inter RAT information container value part octet 3-250
Figure 10.5.150/3GPP TS 24.008: Inter RAT information container information element
ETSI
Release 18 647 3GPP TS 24.008 V18.4.0 (2023-09)
The value part of the Inter RAT information container information element is the INTER RAT HANDOVER INFO as
defined in 3GPP TS 25.331 [23c]. If this field includes padding bits, they are defined in 3GPP TS 25.331 [23c].
10.5.5.25 Requested MS information

The purpose of the Requested MS information information element is to indicate whether certain feature-related
information is requested from the MS by the network. If this IE is not included then no information is requested.
The Requested MS information information element is coded as shown in figure 10.5.151/3GPP TS 24.008 and
table 10.5.166/3GPP TS 24.008.
The Requested MS information is a type 1 information element.
8 7 6 5 4 3 2 1
Requested MS information I-RAT I-RAT2 0 0 octet 1
IEI Spare
Figure 10.5.151/3GPP TS 24.008: Requested MS information information element
Table 10.5.166/3GPP TS 24.008: Requested MS information information element
Requested MS information value (octet 1, bit 1 to 4)
I-RAT (1 bit field)
Bit
4
0 Inter RAT information container IE not requested
1 Inter RAT information container IE requested
I-RAT2 (1 bit field)

Bit
3
0 See NOTE.
NOTE: The value '1' was allocated in a previous version of the protocol and shall
not be used. The behaviour of a mobile station receiving the Requested
MS information IE with the I-RAT2 field set to the value '1' is not specified.
Network implementations following previous versions of the specification
can set the I-RAT2 bit to request E-UTRAN Inter RAT information container
IE, but an MS implementation following this version of the specification
does not provide this information in the response and the procedure where
the request is included can fail.

See subclause 9.9.3.34 in 3GPP TS 24.301 [120].
10.5.5.27 E-UTRAN inter RAT information container

The purpose of the E-UTRAN inter RAT information container information element is to supply the network with E-
UTRAN related information that needs to be transferred at Inter-RAT PS handover to E-UTRAN (see
3GPP TS 23.401 [122]).
The E-UTRAN inter RAT information container information element is coded as shown in figure
10.5.151/3GPP TS 24.008.
The E-UTRAN inter RAT information container information element is a type 4 information element with a minimum
length of 3 octets and an upper length limit of 257 octets.
ETSI
Release 18 648 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
E-UTRAN Inter RAT information container IEI octet 1
Length of E-UTRAN Inter RAT information container octet 2
E-UTRAN Inter RAT information container value part octet 3-257
Figure 10.5.151/3GPP TS 24.008: E-UTRAN inter RAT information container information element
The value part of the E-UTRAN inter RAT information container information element is formatted and coded according
to the UE-EUTRA-Capability IE defined in 3GPP TS 36.331 [129].

The purpose of the Voice domain preference and UE's usage setting information element is to provide the network with
the UE's usage setting and the voice domain preference for WB-S1 mode. The network uses the UE's usage setting and
the voice domain preference for E-UTRAN (see 3GPP TS 24.167 [13B]) to select the RFSP index.
The UE's usage setting bit indicates the value configured on the ME as defined in 3GPP TS 23.221 [131].
The voice domain preference for E-UTRAN bit indicates the value configured on the ME of the Voice domain
preference for E-UTRAN as defined in 3GPP TS 24.167 [134].
The Voice domain preference and UE's usage setting information element is coded as shown in
figure 10.5.151A/3GPP TS 24.008 and table 10.5.166A/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Voice domain preference and UE's usage setting IEI octet 1
Length of Voice domain preference and UE's usage setting contents octet 2
0 0 0 0 0 UE's Voice domain octet 3
Spare Spare Spare Spare Spare usage preference for
setting E-UTRAN
Figure 10.5.151A/3GPP TS 24.008: Voice domain preference and UE's usage setting information
element
Table 10.5.166A/3GPP TS 24.008: Voice domain preference and UE's usage setting information
element
Voice domain preference and UE's usage setting value (octet 3, bit 1 to 3)
UE's usage setting (1 bit field)
Bit
3
0 Voice centric
1 Data centric
Voice domain preference for E-UTRAN (2 bit field)
Bit
2 1
0 0 CS Voice only
0 1 IMS PS Voice only
1 0 CS voice preferred, IMS PS Voice as secondary
1 1 IMS PS voice preferred, CS Voice as secondary
MS not supporting IMS voice shall indicate "CS Voice only".

MS only supporting IMS voice shall indicate "IMS PS Voice only".
ETSI
Release 18 649 3GPP TS 24.008 V18.4.0 (2023-09)

The purpose of the P-TMSI type information element is to indicate whether the P-TMSI included in the same message
in an information element of type mobile identity, or the P-TMSI used by the MS to derive a foreign TLLI (see
subclause 4.7.1.4.1) represents a native P-TMSI or a mapped P-TMSI.
The P-TMSI type information element information element is coded as shown in figure 10.5.5.29.1 and
table 10.5.5.29.1.
The P-TMSI type is a type 1 information element.
8 7 6 5 4 3 2 1
P-TMSI type IEI 0 0 0 P- octet 1
spare TMSI
type
Figure 10.5.5.29.1: P-TMSI type information element
Table 10.5.5.29.1: P-TMSI type information element
P-TMSI type (octet 1)

Bit
1
0 Native P-TMSI
1 Mapped P-TMSI
Bits 2 to 4 of octet 1 are spare and shall be coded as zero.
10.5.5.30 Location Area Identification 2

The purpose of the Location Area Identification 2 information element is to provide an unambiguous identification of
location areas within the area covered by the 3GPP system.
The Location Area Identification 2 information element is coded as shown in figure 10.5.5.30/3GPP TS 24.008 and
table 10.5.5.30/3GPP TS 24.008.
The Location Area Identification 2 is a type 4 information element with 7 octets length.
8 7 6 5 4 3 2 1
Location Area Identification 2 IEI octet 1
Length of Location Area Identification 2 IEI octet 2
octet 3
Location Area Identification 2 value
octet 7
Figure 10.5.5.30/3GPP TS 24.008: Location Area Identification 2 information element
Table 10.5.5.30/3GPP TS 24.008: Location Area Identification 2 information element
Location Area Identification 2 value (octet 3 to 7)
The Location Area Identification 2 value is coded as octet 2 to 6 of the Location Area Identification information
element.
10.5.5.31 Network resource identifier container

The purpose of the Network resource identifier container information element is to provide a part of the allocated TMSI
that the network will use to determine the actual NRI.
ETSI
Release 18 650 3GPP TS 24.008 V18.4.0 (2023-09)
The Network resource identifier container is a type 4 information element with a length of 4 octets.
The Network resource identifier container information element is coded as shown in figure 10.5.5.31/3GPP TS 24.008
and table 10.5.5.31/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Network resource identifier container IEI octet 1
Length of Network resource identifier container contents octet 2
NRI container value octet 3
NRI container spare octet 4
value 0 0 0 0 0 0
Figure 10.5.5.31/3GPP TS 24.008 Network resource identifier container information element
Table 10.5.5.31/3GPP TS 24.008: Network resource identifier container information element
NRI container value (octet 3 and bit 7-8 of octet 4)

The NRI container value consists of 10 bits which correspond to bits 23 to 14 of the
valid TMSI.
NRI container value shall start with bit 8 of octet 3, which corresponds to bit 23 of
TMSI. Bit 7 of octet 4 corresponds to TMSI bit 14.
Bits 6, 5, 4, 3, 2, and 1 in octet 4 are spare and shall be set to zero.

The purpose of the Extended DRX parameters information element is to indicate that the MS wants to use eDRX and
for the network to indicate the Paging Time Window length value and the extended DRX cycle value to be used for
eDRX.
The Extended DRX parameters is a type 4 information element with a minimum length of 3 octets and a maximum
length of 4 octets.
The Extended DRX parameters information element is coded as shown in figure 10.5.5.32/3GPP TS 24.008 and
table 10.5.5.32/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Extended DRX parameters IEI octet 1
Length of Extended DRX parameters octet 2
Paging Time Window eDRX value octet 3
Extended Paging Time Window octet 4*
Figure 10.5.5.32/3GPP TS 24.008: Extended DRX parameters information element
ETSI
Release 18 651 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.5.32/3GPP TS 24.008: Extended DRX parameters information element
ETSI
Release 18 652 3GPP TS 24.008 V18.4.0 (2023-09)
Paging Time Window (PTW), octet 3 (bit 8 to 5)

The field contains a PTW value. The PTW value can be applied for Iu mode, WB-S1
mode, NB-S1 mode, WB-N1 mode and NB-N1 mode as specified below.
Iu mode
The field contains the PTW value in seconds for Iu mode. The PTW value is used as
specified in 3GPP TS 23.682 [133a]. The PTW value is derived as follows:
bit
8 7 6 5 Paging Time Window length
0 0 0 0 0 seconds (PTW not used)
0 0 0 1 1 second
0 0 1 0 2 seconds
0 0 1 1 3 seconds
0 1 0 0 4 seconds
0 1 0 1 5 seconds
0 1 1 0 6 seconds
0 1 1 1 7 seconds
1 0 0 0 8 seconds
1 0 0 1 9 seconds
1 0 1 0 10 seconds
1 0 1 1 12 seconds
1 1 0 0 14 seconds
1 1 0 1 16 seconds
1 1 1 0 18 seconds
1 1 1 1 20 seconds
WB-S1 mode and WB-N1 mode

The field contains the PTW value in seconds for WB-S1 mode and WB-N1 mode. The
PTW value is used as specified in 3GPP TS 23.682 [133a] and 3GPP TS 23.501 [166].
The PTW value is derived as follows:
bit
0 0 0 0 1,28 seconds
0 0 0 1 2,56 seconds
0 0 1 0 3,84 seconds
0 0 1 1 5,12 seconds
0 1 0 0 6,4 seconds
0 1 0 1 7,68 seconds
0 1 1 0 8,96 seconds
0 1 1 1 10,24 seconds
1 0 0 0 11,52 seconds
1 0 0 1 12,8 seconds
1 0 1 0 14,08 seconds
1 0 1 1 15,36 seconds
1 1 0 0 16,64 seconds
1 1 0 1 17,92 seconds
1 1 1 0 19,20 seconds
1 1 1 1 20,48 seconds
NB-S1 mode and NB-N1 mode

The field contains the PTW value in seconds for NB-S1 mode and NB-N1 mode. The
PTW value is used as specified in 3GPP TS 23.682 [133a] and 3GPP TS 23.501 [166].
The PTW value is derived as follows:
bit
0 0 0 0 2,56 seconds
0 0 0 1 5,12 seconds
0 0 1 0 7,68 seconds
0 0 1 1 10,24 seconds
ETSI
Release 18 653 3GPP TS 24.008 V18.4.0 (2023-09)
0 1 0 0 12,8 seconds
0 1 0 1 15,36 seconds
0 1 1 0 17,92 seconds
0 1 1 1 20,48 seconds
1 0 0 0 23,04 seconds
1 0 0 1 25,6 seconds
1 0 1 0 28,16 seconds
1 0 1 1 30,72 seconds
1 1 0 0 33,28 seconds
1 1 0 1 35,84 seconds
1 1 1 0 38,4 seconds
1 1 1 1 40,96 seconds
In NR connected to 5GCN, the Paging Time Window field is ignored and the PTW value
is included in the Extended Paging Time Window field.
eDRX value, octet 3 (bit 4 to 1)

The field contains an eDRX value. The eDRX values are applied for A/Gb mode, Iu
mode, S1 mode and N1 mode as specified below.
A/Gb mode
The field contains the eDRX value for A/Gb mode. The GERAN eDRX cycle length
duration and Number of 51-MF per GERAN eDRX cycle values are derived from the
eDRX value as follows:
bit
4 3 2 1 GERAN eDRX cycle length Number of 51-MF per GERAN eDRX cycle
duration
0 0 0 0 ~1,88 seconds (NOTE 1, 8
NOTE 2)
0 0 0 1 ~3,76 seconds (NOTE 1, 16
NOTE 2)
0 0 1 0 ~7,53 seconds (NOTE 1, 32
NOTE 2)
0 0 1 1 12,24 seconds (NOTE 2) 52
0 1 0 0 24,48 seconds (NOTE 2) 104
0 1 0 1 48,96 seconds (NOTE 2) 208
0 1 1 0 97,92 seconds (NOTE 2) 416
0 1 1 1 195,84 seconds (NOTE 2) 832
1 0 0 0 391,68 seconds (NOTE 2) 1664
1 0 0 1 783,36 seconds (NOTE 2) 3328
1 0 1 0 1566,72 seconds (NOTE 2) 6656
1 0 1 1 3133,44 seconds (NOTE 2) 13312
All other values shall be interpreted as 0000 by this version of the protocol.
NOTE 1: The listed values are rounded.
NOTE 2: The value in seconds can be calculated with the formula ((3,06 / 13) *
(Number of 51-MF)). See 3GPP TS 45.001 [157], subclause 5.1.
Iu mode
The field contains the eDRX value for Iu mode. The UTRAN eDRX cycle length duration
value is derived from the eDRX value as follows:
bit
4 3 2 1 UTRAN eDRX cycle length duration
0 0 0 0 10,24 seconds
0 0 0 1 20,48 seconds
0 0 1 0 40,96 seconds
0 0 1 1 81,92 seconds
0 1 0 0 163,84 seconds
0 1 0 1 327,68 seconds
ETSI
Release 18 654 3GPP TS 24.008 V18.4.0 (2023-09)
0 1 1 0 655,36 seconds
0 1 1 1 1310,72 seconds
1 0 0 0 1966,08 seconds
1 0 0 1 2621,44 seconds
S1 mode, NB-N1 mode, and WB-N1 mode

The field contains the eDRX value for S1 mode, NB-N1 mode, and WB-N1 mode. The
eDRX cycle length duration value and the eDRX cycle parameter 'TeDRX' as defined in
3GPP TS 36.304 [121] are derived from the eDRX value as follows:
bit
4 3 2 1 eDRX cycle length duration eDRX cycle parameter 'TeDRX'
0 0 0 0 5,12 seconds (NOTE 4) NOTE 3
0 0 0 1 10,24 seconds (NOTE 4) 20
0 0 1 0 20,48 seconds 21
0 0 1 1 40,96 seconds 22
0 1 0 0 61,44 seconds (NOTE 5) 6
0 1 0 1 81,92 seconds 23
0 1 1 0 102,4 seconds (NOTE 5) 10
0 1 1 1 122,88 seconds (NOTE 5) 12
1 0 0 0 143,36 seconds (NOTE 5) 14
1 0 0 1 163,84 seconds 24
1 0 1 0 327,68 seconds 25
1 0 1 1 655,36 seconds 26
1 1 0 0 1310,72 seconds 27
1 1 0 1 2621,44 seconds 28
1 1 1 0 5242,88 seconds (NOTE 6) 29
1 1 1 1 10485,76 seconds (NOTE 6) 210
NOTE 3: For E-UTRAN, and for E-UTRA connected to 5GCN, eDRX cycle length
duration of 5,12 seconds the eDRX cycle parameter 'TeDRX' is not used as a
different algorithm compared to the other values is applied. See
3GPP TS 36.304 [121] for details.
NOTE 4: The value is applicable only in WB-S1 mode and in WB-N1 mode. If received
in NB-S1 mode or in NB-N1 mode it is interpreted as if the Extended DRX
parameters IE were not included in the message by this version of the
protocol.
NOTE 5: The value is applicable only in WB-S1 mode and in WB-N1 mode. If received
in NB-S1 mode or in NB-N1 mode it is interpreted as 0010 by this version of
the protocol.
NOTE 6: The value is applicable only in NB-S1 mode and in NB-N1 mode. If received in
WB-S1 mode or in WB-N1 mode it is interpreted as 1101 by this version of the
protocol.
ETSI
Release 18 655 3GPP TS 24.008 V18.4.0 (2023-09)
NR connected to 5GCN
The field contains the eDRX value for NR connected to 5GCN. The eDRX cycle length
duration value and the eDRX cycle parameter 'TeDRX' as defined in 3GPP TS 38.304 [183]
are derived from the eDRX value as follows:
bit
4 3 2 1 eDRX cycle length duration eDRX cycle parameter 'TeDRX'
0 0 0 0 2,56 seconds NOTE 7
0 0 0 1 5,12 seconds NOTE 7
0 0 1 0 10,24 seconds NOTE 7
0 0 1 1 20,48 seconds 21
0 1 0 0 40,96 seconds 22
0 1 0 1 81,92 seconds 23
0 1 1 0 163,84 seconds 24
0 1 1 1 327,68 seconds 25
1 0 0 0 655,36 seconds 26
1 0 0 1 1310,72 seconds 27
1 0 1 0 2621,44 seconds 28
1 0 1 1 5242,88 seconds 29
1 1 0 0 10485,76 seconds 210
NOTE 7: For NR connected to 5GCN, eDRX cycle length durations of 2,56

seconds,5,12 seconds or 10,24 seconds the eDRX cycle parameter 'TeDRX' is
not used as a different algorithm compared to the other values is applied. See
3GPP TS 38.304 [183] for details.
Extended Paging Time Window (ePTW), octet 4 (bit 8 to 1)

The field contains a PTW value. The PTW value is applied for NR connected to 5GCN as
specified below.
NR connected to 5GCN
The field contains the PTW value for NR connected to 5GCN. The PTW value is used as
specified in 3GPP TS 23.501 [166]. The PTW value is derived as follows:
bit
8 7 6 5 4 3 2 1 Paging Time Window length
0 0 0 0 0 0 0 0 1,28 seconds
0 0 0 0 0 0 0 1 2,56 seconds
0 0 0 0 0 0 1 0 3,84 seconds
0 0 0 0 0 0 1 1 5,12 seconds
0 0 0 0 0 1 0 0 6,4 seconds
0 0 0 0 0 1 0 1 7,68 seconds
0 0 0 0 0 1 1 0 8,96 seconds
0 0 0 0 0 1 1 1 10,24 seconds
0 0 0 0 1 0 0 0 11,52 seconds
0 0 0 0 1 0 0 1 12,8 seconds
0 0 0 0 1 0 1 0 14,08 seconds
0 0 0 0 1 0 1 1 15,36 seconds
0 0 0 0 1 1 0 0 16,64 seconds
0 0 0 0 1 1 0 1 17,92 seconds
0 0 0 0 1 1 1 0 19,20 seconds
0 0 0 0 1 1 1 1 20,48 seconds
0 0 0 1 0 0 0 0 21,76 seconds
0 0 0 1 0 0 0 1 23,04 seconds
0 0 0 1 0 0 1 0 24,32 seconds
0 0 0 1 0 0 1 1 25,6 seconds
0 0 0 1 0 1 0 0 26,88 seconds
0 0 0 1 0 1 0 1 28,16 seconds
ETSI
Release 18 656 3GPP TS 24.008 V18.4.0 (2023-09)
0 0 0 1 0 1 1 0 29,44 seconds
0 0 0 1 0 1 1 1 30,72 seconds
0 0 0 1 1 0 0 0 32 seconds
0 0 0 1 1 0 0 1 33,28 seconds
0 0 0 1 1 0 1 0 34,56 seconds
0 0 0 1 1 0 1 1 35,84 seconds
0 0 0 1 1 1 0 0 37,12 seconds
0 0 0 1 1 1 0 1 38,4 seconds
0 0 0 1 1 1 1 0 39,68 seconds
0 0 0 1 1 1 1 1 40,96 seconds

The purpose of the Message authentication code information element is to protect the integrity of a NAS message.
The Message authentication code is a type 3 information element with 6 octets length.
The Message authentication code information element is coded as shown in figure 10.5.5.33-1/3GPP TS 24.008 and
table 10.5.5.33-1/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Message authentication code IEI octet 1
Length of message authentication code contents octet 2
octet 3
Message authentication code value
octet 6
Figure 10.5.5.33-1/3GPP TS 24.008: Message authentication code information

element
Table 10.5.5.33-1/3GPP TS 24.008: Message authentication code information element
Message authentication code value (octet 3 to 6)
This field contains the 32 bit message authentication code calculated for GMM integrity
protection. Bit 1 of octet 3 contains the most significant bit, and bit 8 of octet 6 the least
significant bit of these 4 octets.

The purpose of the User Plane integrity indicator information element is to indicate to the MS that it shall integrity
protect user plane data in LLC layer.
The User Plane integrity indicator is allocated by the network and sent with the ATTACH ACCEPT message or
ROUTING AREA UPDATE ACCEPT message to the mobile station.
The User Plane integrity indicator information element is coded as shown in figure 10.5.5.34-1/3GPP TS 24.008 and
table 10.5.5.34-1/3GPP TS 24.008.
In A/Gb mode, in the case when a UMTS security context is established and if the MS supports integrity protection, ,
the purpose of the User Plane integrity indicator information element is to request the MS to start integrity protection of
user plane data in LLC layer.
The User Plane integrity indicator is a type 1 information element.
ETSI
Release 18 657 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
User Plane 0 0 0 Integr octet 1
Integrity Indicator spare spare spare ity
IEI indica
tor
Figure 10.5.5.34-1/3GPP TS 24.008 User Plane integrity indicator information element
Table 10.5.5.34-1/3GPP TS 24.008: User Plane integrity indicator information element
User Plane integrity indicator (octet 1)
Bits
1
0 MS shall disable integrity protection of user plane data in LLC layer

1 MS shall enable integrity protection of user plane data in LLC layer
10.5.5.35 DCN-ID
The purpose of the DCN-ID information element is to provide a DCN-ID for the registered PLMN to the MS.
The DCN-ID is a type 4 information element with 4 octets length.
The DCN-ID information element is coded as shown in figure 10.5.5.35-1/3GPP TS 24.008 and table 10.5.5.35-
1/3GPP TS 24.008.
8 7 6 5 4 3 2 1
DCN-ID IEI octet 1
Length of DCN-ID contents octet 2
DCN-ID value octet 3
octet 4
Figure 10.5.5.35-1/3GPP TS 24.008: DCN-ID information element
Table 10.5.5.35-1/3GPP TS 24.008: DCN-ID information element
DCN-ID value (octet 3 to 4)
This field contains the 16 bit DCN-ID. The coding of the DCN-ID value part is defined in
3GPP TS 23.003 [2].

The purpose of the PLMN identity of the CN operator information element is to indicate the PLMN identity of the CN
operator that has accepted the GPRS attach request or routing area update request in a shared network or in a multi-
operator core network (MOCN) with common GERAN.
The PLMN identity of the CN operator is a type 4 information element with 5 octets length.
The PLMN identity of the CN operator information element is coded as shown in figure 10.5.5.36-1/3GPP TS 24.008
and table 10.5.5.36-1/3GPP TS 24.008.
ETSI
Release 18 658 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
PLMN identity of the CN operator IEI octet 1
Length of PLMN identity of the CN operator contents octet 2
Figure 10.5.5.36-1/3GPP TS 24.008 PLMN identity of the CN operator information element
Table 10.5.5.36-1/3GPP TS 24.008: PLMN identity of the CN operator information element

MNC, Mobile network code (octet 5, octet 4 bits 5 to 8).

may decide to use only two digits in the MNC over the radio interface. In this case,
bits 5 to 8 of octet 4 shall be coded as "1111". Mobile equipment shall accept MNC
coded in such a way.

The purpose of the Non-3GPP NW provided policies information element is to indicate to the MS whether emergency
numbers provided via non-3GPP access (see 3GPP TS 24.302 [156]) can be used to initiate UE detected emergency
calls.
The Non-3GPP NW provided policies is indicated by the network and sent with the ATTACH ACCEPT message or
ROUTING AREA UPDATE ACCEPT message to the mobile station.
The Non-3GPP NW provided policies information element is coded as shown in figure 10.5.5.37-1/3GPP TS 24.008
and table 10.5.5.37-1/3GPP TS 24.008.
The Non-3GPP NW provided policies is a type 1 information element.
8 7 6 5 4 3 2 1
Non-3GPP NW provided 0 0 0 N3EN octet 1
policies spare spare spare indica
IEI tor
Figure 10.5.5.37-1/3GPP TS 24.008 Non-3GPP NW provided policies IE
Table 10.5.5.37-1/3GPP TS 24.008: Non-3GPP NW provided policies IE
Non-3GPP emergency number (N3EN) indicator (octet 1)
Bits
1
0 use of non-3GPP emergency numbers not permitted

1 use of non-3GPP emergency numbers permitted
ETSI
Release 18 659 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.6 Session management information elements
10.5.6.1 Access point name

The purpose of the Access point name information element is to identify the packet data network to which the GPRS
user wishes to connect and to notify the access point of the packet data network that wishes to connect to the MS.
The Access point name is a label or a fully qualified domain name according to DNS naming conventions (see
3GPP TS 23.003 [10]).
The Access point name is a type 4 information element with a minimum length of 3 octets and a maximum length of
102 octets.
The Access point name information element is coded as shown in figure 10.5.152/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Access point name IEI octet 1
Length of access point name contents octet 2
Access point name value octet 3
octet n*
Figure 10.5.152/3GPP TS 24.008: Access point name information element
The value part is defined in 3GPP TS 23.003 [10].
10.5.6.2 Network service access point identifier

The purpose of the Network service access point identifier information element is to identify the service access point
that is used for the GPRS data transfer at layer 3.
The Network service access point identifier is a type 3 information element with a length of 2 octets.
The value part of a Network service access point identifier information element is coded as shown in
8 7 6 5 4 3 2 1
NSAPI IEI octet 1
0 0 0 0 NSAPI octet 2
Spare value
Figure 10.5.153/3GPP TS 24.008: Network service access point identifier information element
ETSI
Release 18 660 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.167/3GPP TS 24.008: Network service access point identifier information element
NSAPI value (octet 2)
Bits
4 3 2 1
0 0 0 0 reserved
0 0 0 1 reserved
0 0 1 0 reserved
0 0 1 1 reserved
0 1 0 0 reserved
0 1 0 1 NSAPI 5
0 1 1 0 NSAPI 6
0 1 1 1 NSAPI 7
1 0 0 0 NSAPI 8
1 0 0 1 NSAPI 9
1 0 1 0 NSAPI 10
1 0 1 1 NSAPI 11
1 1 0 0 NSAPI 12
1 1 0 1 NSAPI 13
1 1 1 0 NSAPI 14
1 1 1 1 NSAPI 15
10.5.6.3.1 General
The purpose of the protocol configuration options information element is to:
- transfer external network protocol options associated with a PDP context activation, and
- transfer additional (protocol) data (e.g. configuration parameters, error codes or messages/events) associated
with an external protocol or an application.
The protocol configuration options is a type 4 information element with a minimum length of 3 octets and a maximum
The protocol configuration options information element is coded as shown in figure 10.5.136/3GPP TS 24.008 and
table 10.5.154/3GPP TS 24.008.
ETSI
Release 18 661 3GPP TS 24.008 V18.4.0 (2023-09)
ETSI
Release 18 662 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Protocol configuration options IEI octet 1
Length of protocol config. options contents octet 2
1 0 0 0 0 Configuration octet 3
ext Spare protocol
Protocol ID 1 octet 4
octet 5
Length of protocol ID 1 contents octet 6
octet 7
Protocol ID 1 contents
octet m
Protocol ID 2 octet m+1
octet m+2
Length of protocol ID 2 contents octet m+3
octet m+4
Protocol ID 2 contents
octet n
octet n+1
...
octet u
Protocol ID n-1 octet u+1
octet u+2
Length of protocol ID n-1 contents octet u+3
octet u+4
Protocol ID n-1 contents
octet v
Protocol ID n octet v+1
octet v+2
Length of protocol ID n contents octet v+3
octet v+4
Protocol ID n contents
octet w
Container ID 1 octet w+1
octet w+2
Length of container ID 1 contents octet w+3
Container ID 1 contents octet w+4
octet x
octet x+1
...
octet y
Container ID n octet y+1
octet y+2
Length of container ID n contents octet y+3
Container ID n contents octet y+4
octet z
Container ID n+1 octet z+1
octet z+2
Length of container ID n+1 contents (see NOTE) octet z+3
octet z+4
Container ID n+1 contents octet z+5
octet za
ETSI
Release 18 663 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE: If the container ID is:

- 0023H (QoS rules with the length of two octets);
- 0024H (QoS flow descriptions with the length of two octets);
- 0030H (ATSSS response with the length of two octets);
- 0031H (DNS server security information with length of two octets);
- 0032H (ECS address with the length of two octets);
- 0041H (Service-level-AA container with the length of two octets);
- 0051H (SDNAEPC EAP message with the length of two octets);or
- 0056H (UE policy container with the length of two octets)
for network to MS direction, then the octet z+3 and octet z+4 indicate the
length of container ID contents.
If the container ID is:
- 0051H (SDNAEPC EAP message with the length of two octets);or
- 0056H (UE policy container with the length of two octets)
for MS to network direction, then the octet z+3 and octet z+4 indicate the
length of container ID contents.
Figure 10.5.136/3GPP TS 24.008: Protocol configuration options information element
ETSI
Release 18 664 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.154/3GPP TS 24.008: Protocol configuration options information element
Configuration protocol (octet 3)

Bits
321
0 0 0 PPP for use with IP PDP type or IP PDN type (see 3GPP TS 24.301 [120])
All other values are interpreted as PPP in this version of the protocol.
After octet 3, i.e. from octet 4 to octet z, two logical lists are defined:
- the Configuration protocol options list (octets 4 to w), and
- the Additional parameters list (octets w+1 to za).
Configuration protocol options list (octets 4 to w)
The configuration protocol options list contains a variable number of logical units, they
may occur in an arbitrary order within the configuration protocol options list.
Each unit is of variable length and consists of a:
- protocol identifier (2 octets);

- the length of the protocol identifier contents of the unit (1 octet); and
- the protocol identifier contents itself (n octets).
The protocol identifier field contains the hexadecimal coding of the configuration
protocol identifier. Bit 8 of the first octet of the protocol identifier field contains the most
significant bit and bit 1 of the second octet of the protocol identifier field contains the
If the configuration protocol options list contains a protocol identifier that is not
supported by the receiving entity the corresponding unit shall be ignored.
The length of the protocol identifier contents field contains the binary coded
representation of the length of the protocol identifier contents field of a unit. The first bit
in transmission order is the most significant bit.
The protocol identifier contents field of each unit contains information specific to the
configuration protocol specified by the protocol identifier.
At least the following protocol identifiers (as defined in RFC 3232 [103]) shall be
supported in this version of the protocol:
- C021H (LCP);
- C023H (PAP) (see NOTE 3);
- C223H (CHAP) (see NOTE 3); and
- 8021H (IPCP).
The support of other protocol identifiers is implementation dependent and outside the
scope of the present document.
The protocol identifier contents field of each unit corresponds to a "Packet" as defined
in RFC 1661 [102] that is stripped off the "Protocol" and the "Padding" octets.
The detailed coding of the protocol identifier contents field is specified in the RFC that
is associated with the protocol identifier of that unit: LCP is specified in
RFC 1661 [102], PAP is specified in RFC 1334 [179], CHAP is specified in
RFC 1994 [180] and IPCP is specified in RFC 1332 [181].
Additional parameters list (octets w+1 to za)
The additional parameters list is included when special parameters and/or requests
(associated with a PDP context) need to be transferred between the MS and the
network. These parameters and/or requests are not related to a specific configuration
protocol (e.g. PPP), and therefore are not encoded as the "Packets" contained in the
configuration protocol options list.
The additional parameters list contains a list of special parameters, each one in a
separate container. The type of the parameter carried in a container is identified by a
ETSI
Release 18 665 3GPP TS 24.008 V18.4.0 (2023-09)
specific container identifier. In this version of the protocol, the following container
identifiers are specified:
MS to network direction:
- 0001H (P-CSCF IPv6 Address Request);
- 0002H (IM CN Subsystem Signaling Flag);
- 0003H (DNS Server IPv6 Address Request);
- 0004H (Not Supported);
- 0005H (MS Support of Network Requested Bearer Control indicator);
- 0006H (Reserved);
- 0007H (DSMIPv6 Home Agent Address Request);
- 0008H (DSMIPv6 Home Network Prefix Request);
- 0009H (DSMIPv6 IPv4 Home Agent Address Request);
- 000AH (IP address allocation via NAS signalling);
- 000BH (IPv4 address allocation via DHCPv4);
- 000CH (P-CSCF IPv4 Address Request);
- 000DH (DNS Server IPv4 Address Request);
- 000EH (MSISDN Request);
- 000FH (IFOM-Support-Request);
- 0010H (IPv4 Link MTU Request);
- 0011H (MS support of Local address in TFT indicator) (see NOTE 4);
- 0012H (P-CSCF Re-selection support);
- 0013H (NBIFOM request indicator);
- 0014H (NBIFOM mode);
- 0015H (Non-IP Link MTU Request);
- 0016H (APN rate control support indicator);
- 0017H (3GPP PS data off UE status);
- 0018H (Reliable Data Service request indicator);
- 0019H (Additional APN rate control for exception data support indicator);
- 001AH (PDU session ID);
- 001BH (reserved);
- 001CH (Reserved);
- 001DH (Reserved);
- 001EH (Reserved);
- 001FH (Reserved);
- 0020H (Ethernet Frame Payload MTU Request);
- 0021H (Unstructured Link MTU Request);
- 0022H (5GSM cause value);
ETSI
Release 18 666 3GPP TS 24.008 V18.4.0 (2023-09)
- 0023H (QoS rules with the length of two octets support indicator);
- 0024H (QoS flow descriptions with the length of two octets support indicator);
- 0025H (Reserved)
- 0026H (Reserved);
- 0027H (ACS information request);
-- 0028H (Reserved);
- 0029H (Reserved);
- 002AH (Reserved);
- 002BH (Reserved);
- 0030H (ATSSS request);
- 0031H (DNS server security information indicator);
- 0032H (ECS configuration information provisioning support indicator);
- 0035H (Reserved);
- 0036H (PVS information request);
- 0037H (Reserved);
- 0038H (Reserved);
- 0039H (DNS server security protocol support);
- 003AH (EAS rediscovery support indication);
- 003BH (Reserved);
- 003CH (Reserved);
- 003DH (Reserved);
- 003EH (Reserved);
- 003FH (Reserved);
- 0040H (Reserved);
- 0047H (EDC support indicator);
- 0048H (Reserved);
- 0049H (Reserved);
- 004AH (MS support of MAC address range in 5GS indicator);
- 0050H (SDNAEPC support indicator);
- 0051H (SDNAEPC EAP message with the length of two octets);
- 0052H (SDNAEPC DN-specific identity);
- 0056H (UE policy container with the length of two octets); and
- FF00H to FFFFH reserved for operator specific use.
Network to MS direction:
ETSI
Release 18 667 3GPP TS 24.008 V18.4.0 (2023-09)
- 0001H (P-CSCF IPv6 Address);
- 0002H (IM CN Subsystem Signaling Flag);
- 0003H (DNS Server IPv6 Address);
- 0004H (Policy Control rejection code);
- 0005H (Selected Bearer Control Mode);
- 0006H (Reserved);
- 0007H (DSMIPv6 Home Agent Address) ;
- 0008H (DSMIPv6 Home Network Prefix);
- 0009H (DSMIPv6 IPv4 Home Agent Address);
- 000AH (Reserved);
- 000BH (Reserved);
- 000CH (P-CSCF IPv4 Address);
- 000DH (DNS Server IPv4 Address);
- 000EH (MSISDN);
- 000FH (IFOM-Support);
- 0010H (IPv4 Link MTU);
- 0011H (Network support of Local address in TFT indicator);
- 0012H (Reserved);
- 0013H (NBIFOM accepted indicator);
- 0014H (NBIFOM mode);
- 0015H (Non-IP Link MTU);
- 0016H (APN rate control parameters);
- 0017H (3GPP PS data off support indication);
- 0018H (Reliable Data Service accepted indicator);
- 0019H (Additional APN rate control for exception data parameters);
- 001AH (reserved);
- 001BH (S-NSSAI);
- 001CH (QoS rules);
- 001DH (Session-AMBR);
- 001EH (PDU session address lifetime);
- 001FH (QoS flow descriptions);
- 0020H (Ethernet Frame Payload MTU);
- 0021H (Unstructured Link MTU);
- 0022H (Reserved);
- 0023H (QoS rules with the length of two octets);
- 0024H (QoS flow descriptions with the length of two octets);
ETSI
Release 18 668 3GPP TS 24.008 V18.4.0 (2023-09)
- 0025H (Small data rate control parameters);
- 0026H (Additional small data rate control for exception data parameters);
- 0027H (ACS information);
- 0028H (Initial small data rate control parameters);
- 0029H (Initial additional small data rate control for exception data parameters);
- 002AH (Initial APN rate control parameters);
- 002BH (Initial additional APN rate control for exception data parameters);
- 0030H (ATSSS response with the length of two octets);
- 0031H (DNS server security information with length of two octets);
- 0032H (ECS address with the length of two octets);
- 0035H (ECSP identifier);
- 0036H (PVS IPv4 Address);
- 0037H (PVS IPv6 Address);
- 0038H (PVS name);
- 0039H (reserved);
- 003AH (EAS rediscovery indication without indicated impact);
- 003BH (EAS rediscovery indication with impacted EAS IPv4 address range);
- 003CH (EAS rediscovery indication with impacted EAS IPv6 address range);
- 003DH (EAS rediscovery indication with impacted EAS FQDN);
- 003EH (Uplink data not allowed);
- 003FH (Uplink data allowed);
- 0040H (UAS services not allowed indication);
- 0047H (Reserved);
- 0048H (EDC usage allowed indicator);
- 0049H (EDC usage required indicator);
- 004AH (Network support of MAC address range in 5GS indicator);
- 0050H (Reserved);
- 0051H (SDNAEPC EAP message with the length of two octets);
- 0052H (Reserved);
- 0056H (UE policy container with the length of two octets);and
- FF00H to FFFFH reserved for operator specific use.
If the additional parameters list contains a container identifier that is not supported by
the receiving entity the corresponding unit shall be ignored.
ETSI
Release 18 669 3GPP TS 24.008 V18.4.0 (2023-09)
The container identifier field is encoded as the protocol identifier field and the length of
container identifier contents field is encoded as the length of the protocol identifier
contents field.
When the container identifier indicates P-CSCF IPv6 Address Request, DNS Server
IPv6 Address Request, MSISDN Request or DNS server security information indicator,
the container identifier contents field is empty and the length of container identifier
contents indicates a length equal to zero. If the container identifier contents field is not
empty, it shall be ignored. The DNS server security information indicator indicates that
the MS supports receiving DNS server security information with length of two octets.
When the DNS Server IPv6 Address Request is indicated in N1 mode, the DNS Server
IPv6 Address Request indicates that the MS supports handling of the DNS Server IPv6
address(es) received in the PDU session establishment procedure and network-
requested PDU session modification procedure(s), if any.
When the container identifier indicates IM CN Subsystem Signaling Flag (see 3GPP
TS 24.229 [95]), the container identifier contents field is empty and the length of
container identifier contents indicates a length equal to zero. If the container identifier
contents field is not empty, it shall be ignored. In Network to MS direction this
information may be used by the MS to indicate to the user whether the requested
dedicated signalling PDP context was successfully established.
When the container identifier indicates P-CSCF IPv6 Address, the container identifier
contents field contains one IPv6 address corresponding to a P-CSCF address (see
3GPP TS 24.229 [95]). This IPv6 address is encoded as a 128-bit address according
to IETF RFC 4291 [99]. When there is a need to include more than one P-CSCF IPv6
address, then more logical units with the container identifier indicating P-CSCF IPv6
Address are used. If more than 3 instances of the P-CSCF IPv6 Address logical unit
are received by the MS, then the MS may ignore all but the first 3 instances of the
P-CSCF IPv6 Address logical unit received.
When the container identifier indicates DNS Server IPv6 Address, the container
identifier contents field contains one IPv6 DNS server address (see 3GPP TS 27.060
[36a]). This IPv6 address is encoded as a 128-bit address according to
IETF RFC 4291 [99]. When there is a need to include more than one DNS Server IPv6
address, then more logical units with the container identifier indicating DNS Server
IPv6 Address are used.
When the container identifier indicates Policy Control rejection code, the container
identifier contents field contains a Go interface related cause code from the GGSN to
the MS (see 3GPP TS 29.207 [100]). The length of container identifier contents
indicates a length equal to one. If the container identifier contents field is empty or its
actual length is greater than one octet, then it shall be ignored by the receiver.
When the container identifier indicates MS Support of Network Requested Bearer

Control indicator, the container identifier contents field is empty and the length of
contents field is not empty, it shall be ignored.
When the container identifier indicates Selected Bearer Control Mode, the container
identifier contents field contains the selected bearer control mode, where '01H’
indicates that 'MS only’ mode has been selected and '02H’ indicates that 'MS/NW’
mode has been selected. The length of container identifier contents indicates a length
equal to one. If the container identifier contents field is empty or its actual length is
greater than one octet, then it shall be ignored by the receiver.
When the container identifier indicates DSMIPv6 Home Agent Address Request, the
container identifier contents field is empty and the length of container identifier
empty, it shall be ignored.
When the container identifier indicates DSMIPv6 Home Network Prefix Request, the
ETSI
Release 18 670 3GPP TS 24.008 V18.4.0 (2023-09)
When the container identifier indicates DSMIPv6 IPv4 Home Agent Address Request,
the container identifier contents field is empty and the length of container identifier
When the container identifier indicates DSMIPv6 Home Agent Address, the container
identifier contents field contains one IPv6 address corresponding to a DSMIPv6 HA
address (see 3GPP TS 24.303 [124] and 3GPP TS 24.327 [125]). This IPv6 address is
encoded as a 128-bit address according to IETF RFC 4291 [99].
When the container identifier indicates DSMIPv6 Home Network Prefix, the container
identifier contents field contains one IPv6 Home Network Prefix (see 3GPP TS 24.303
[124] and 3GPP TS 24.327 [125]). This IPv6 prefix is encoded as an IPv6 address
according to IETF RFC 4291 [99] followed by 8 bits which specifies the prefix length.
When the container identifier indicates DSMIPv6 IPv4 Home Agent Address, the
container identifier contents field contains one IPv4 address corresponding to a
DSMIPv6 IPv4 Home Agent address (see 3GPP TS 24.303 [124] and
3GPP TS 24.327 [125]).
When the container identifier indicates P-CSCF IPv4 Address Request, the container
identifier contents field is empty and the length of container identifier contents indicates
a length equal to zero. If the container identifier contents field is not empty, it shall be
ignored.
When the container identifier indicates DNS Server IPv4 Address Request, the
empty, it shall be ignored. When the DNS Server IPv4 Address Request is indicated in
N1 mode, the DNS Server IPv4 Address Request indicates that the MS supports
handling of the DNS Server IPv4 address(es) received in the PDU session
establishment procedure and network-requested PDU session modification
procedure(s), if any.
When the container identifier indicates P-CSCF IPv4 Address, the container identifier
contents field contains one IPv4 address corresponding to the P-CSCF address to be
used. When there is a need to include more than one P-CSCF IPv4 address, then
more logical units with the container identifier indicating P-CSCF IPv4 Address are
used. If more than 3 instances of the P-CSCF IPv4 Address logical unit are received
by the MS, then the MS may ignore all but the first 3 instances of the P-CSCF IPv4
Address logical unit received.
When the container identifier indicates DNS Server IPv4 Address, the container
identifier contents field contains one IPv4 address corresponding to the DNS server
address to be used. When there is a need to include more than one DNS Server IPv4
address, then more logical units with the container identifier indicating DNS Server
IPv4 Address are used.
P-CSCF IPv4 Address Request, P-CSCF IPv4 Address, DNS Server IPv4 Address
Request and DNS Server IPv4 Address are applicable in S1-mode and N1-mode.
When the container identifier indicates IP address allocation via NAS signalling, the
When the container identifier indicates IP address allocation via DHCPv4, the
When the container identifier indicates MSISDN, the container identifier contents field
contains the MSISDN (see 3GPP TS 23.003 [10]) assigned to the MS. Use of the
MSISDN provided is defined in subclause 6.4. The content of the MSISDN is coded as
the value part of the Called party BCD number information element as specified in
subclause 10.5.4.7.
When the container identifier indicates IFOM Support Request (see
ETSI
Release 18 671 3GPP TS 24.008 V18.4.0 (2023-09)
3GPP TS 24.303 [124] and 3GPP TS 24.327 [125]), the container identifier contents
field is empty and the length of container identifier contents indicates a length equal to
zero. If the container identifier contents field is not empty, it shall be ignored.
When the container identifier indicates IFOM Support, the container identifier contents
field is empty and the length of container identifier contents indicates a length equal to
zero. If the container identifier contents field is not empty, it shall be ignored. This
information indicates that the Home Agent supports IFOM.
When the container identifier indicates IPv4 Link MTU Request, the container identifier
contents field is empty and the length of container identifier contents indicates a length
equal to zero. If the container identifier contents field is not empty, it shall be ignored.
When the container identifier indicates IPv4 Link MTU, the length of container identifier
contents indicates a length equal to two. The container identifier contents field contains
the binary coded representation of the IPv4 link MTU size in octets. Bit 8 of the first
octet of the container identifier contents field contains the most significant bit and bit 1
of the second octet of the container identifier contents field contains the least
significant bit. If the length of container identifier contents is different from two octets,
then it shall be ignored by the receiver.
When the container identifier indicates MS support of Local address in TFT, the
empty, it shall be ignored. This information indicates that the MS supports Local
address in TFTs.
When the container identifier indicates Network support of Local address in TFT, the
empty, it shall be ignored. This information indicates that the network supports Local
address in TFTs.
When the container identifier indicates P-CSCF Re-selection support, the container
ignored. This PCO parameter may be present only if a container with P-CSCF IPv4
Address Request or P-CSCF IPv6 Address Request is present. This information
indicates that the UE supports P-CSCF re-selection based on procedures specified in
3GPP TS 24.229 [95] subclauses B.2.2.1C, L.2.2.1C, R.2.2.1C, U.2.2.1C and
W.2.2.1C.
When the container identifier indicates NBIFOM request indicator, the container
ignored. This information indicates that the MS requests the NBIFOM usage.
When the container identifier indicates NBIFOM accepted indicator, the container
ignored. This information indicates that the network accepts UE's request of the
NBIFOM usage.
When the container identifier indicates NBIFOM mode, the length of container
identifier contents indicates a length equal to one. If the length of container identifier
contents indicates length different to one, it shall be ignored. The container identifier
contents field containing value 00H indicates the UE-initiated NBIFOM mode. The
container identifier contents field containing value 01H indicates the network-initiated
NBIFOM mode. The container identifier contents field containing a value other than
00H and other than 01H shall be ignored.
When the container identifier indicates Non-IP Link MTU Request, the container
ignored. This information indicates that the MS requests link MTU for "non-IP" PDN
connection.
When the container identifier indicates Non-IP Link MTU, the length of container
identifier contents indicates a length equal to two. The container identifier contents field
contains the binary coded representation of the link MTU size for non-IP PDN
ETSI
Release 18 672 3GPP TS 24.008 V18.4.0 (2023-09)
connection in octets which is at least 128 octets. Bit 8 of the first octet of the container
identifier contents field contains the most significant bit and bit 1 of the second octet of
the container identifier contents field contains the least significant bit. If the length of
container identifier contents is different from two octets, then it shall be ignored by the
receiver.
When the container identifier indicates APN rate control support indicator, the
empty, it shall be ignored. This information indicates that the MS supports APN rate
control functionality.
When the container identifier indicates APN rate control parameters, the container
identifier contents field contains parameters for APN rate control functionality. The
container contents are coded as described in subclause 10.5.6.3.2.
When the container identifier indicates Initial APN data rate control parameters, the
container identifier contents field contains status parameters for APN rate control
functionality. The container contents are coded as described in subclause 10.5.6.3.8.
When the container identifier indicates 3GPP PS data off UE status, the container
identifier contents field contains information of the status of 3GPP PS data off in the
UE for a PDN connection where "01H" indicates ’deactivated’ and "02H" indicates
'activated’. The length of container identifier contents indicates a length equal to one. If
the container identifier contents field is empty or its actual length is greater than one
octet, then it shall be ignored by the receiver.
When the container identifier indicates 3GPP PS data off support indication, the
container identifier contents field is empty. The length of container identifier contents
indicates a length equal to zero. If the container identifier contents field is not empty,
then it shall be ignored by the receiver.
When the container identifier indicates Reliable Data Service request indicator, the
empty, it shall be ignored. This information indicates that the MS requests the Reliable
Data Service usage as specified in 3GPP TS 24.250 [162].
When the container identifier indicates Reliable Data Service accepted indicator, the
empty, it shall be ignored. This information indicates that the network accepts UE's
request of the Reliable Data Service usage as specified in 3GPP TS 24.250 [162].
When the container identifier indicates Additional APN rate control for exception data
support indicator, the container identifier contents field is empty and the length of
contents field is not empty, it shall be ignored. This information indicates that the MS
supports additional APN rate control for exception data functionality.
When the container identifier indicates Additional APN rate control for exception data
parameters, the container identifier contents field contains parameters for additional
APN rate control for exception data functionality. The container contents are coded as
described in subclause 10.5.6.3.3.
When the container identifier indicates Initial additional APN rate control for exception
data parameters, the container identifier contents field contains status parameters for
additional APN rate control for exception data functionality. The container contents are
coded as described in subclause 10.5.6.3.9.
ETSI
Release 18 673 3GPP TS 24.008 V18.4.0 (2023-09)
When the container identifier indicates PDU session identity, the container identifier
contents field contains the PDU session identity assigned by the MS. The encoding of
the PDU session identity and its usage are defined in 3GPP TS 24.007 [20].
When the container identifier indicates S-NSSAI, the container identifier contents field
contains one S-NSSAI value followed by one PLMN ID that the S-NSSAI relates to.
The S-NSSAI value is coded as the value part of S-NSSAI information element as
specified in subclause 9.11.2.8 of 3GPP TS 24.501 [167]. The PLMN ID is encoded as
the value of the PLMN identity of the CN operator IE in subclause 10.5.5.36. The
usage of the S-NSSAI and the associated PLMN ID is defined in
3GPP TS 24.501 [167].
When the container identifier indicates QoS rules, the container identifier contents field
contains the QoS rules for the QoS flow corresponding to the EPS bearer of the PDN
connection. The QoS rules is coded as the value part of QoS rules information element
as specified in subclause 9.11.4.13 of 3GPP TS 24.501 [167]. The usage of the QoS
rules is specified in 3GPP TS 24.501 [167].
When the container identifier indicates Session-AMBR, the container identifier

contents field contains the Session-AMBR for the PDU session corresponding to the
PDN connection. The Session-AMBR is coded as the value part of Session-AMBR
information element as specified in subclause 9.11.4.14 of 3GPP TS 24.501 [167]. The
usage of the Session-AMBR is specified in 3GPP TS 24.501 [167].
When the container identifier indicates PDU session address lifetime, the length of
container identifier contents indicates a length equal to two. The container identifier
contents field contains the binary coded representation of how long the network is
willing to maintain the PDU session in units of seconds. Bit 8 of the first octet of the
container identifier contents field contains the most significant bit and bit 1 of the
second octet of the container identifier contents field contains the least significant bit. If
the length of container identifier contents is different from two octets, then it shall be
ignored by the receiver.
When the container identifier indicates QoS flow descriptions, the container identifier
contents field contains the QoS flow descriptions for the QoS flow corresponding to the
EPS bearer of the PDN connection. The QoS flow descriptions is coded as the value
part of QoS flow descriptions information element as specified in subclause 9.11.4.12
of 3GPP TS 24.501 [167]. The usage of the QoS flow descriptions is specified in
3GPP TS 24.501 [167].
When the container identifier indicates Ethernet Frame Payload MTU Request, the
empty, it shall be ignored. This information indicates that the MS requests link MTU for
an Ethernet PDU session.
When the container identifier indicates Ethernet Frame Payload MTU, the length of
container identifier contents indicates a length equal to two. The container identifier
contents field contains the binary coded representation of Ethernet frame payload MTU
size, i.e. the maximum size of a payload of an Ethernet frame which can be sent via an
Ethernet PDU session in octets. Bit 8 of the first octet of the container identifier
contents field contains the most significant bit and bit 1 of the second octet of the
container identifier contents field contains the least significant bit. If the length of
container identifier contents is different from two octets, then it shall be ignored by the
receiver.
When the container identifier indicates Unstructured Link MTU Request, the container
ignored. This information indicates that the MS requests link MTU for an Unstructured
PDU session.
When the container identifier indicates Unstructured Link MTU, the length of container
identifier contents indicates a length equal to two. The container identifier contents field
contains the binary coded representation of unstructured link MTU size, i.e. the
ETSI
Release 18 674 3GPP TS 24.008 V18.4.0 (2023-09)
maximum size of a message which can be sent via an Unstructured PDU session in
octets. Bit 8 of the first octet of the container identifier contents field contains the most
significant bit and bit 1 of the second octet of the container identifier contents field
contains the least significant bit. If the length of container identifier contents is different
from two octets, then it shall be ignored by the receiver.
When the container identifier indicates 5GSM cause value, the container identifier
contents field contains a 5GSM cause value. The encoding of the 5GSM cause value
and its usage are specified in 3GPP TS 24.501 [167].
When the container identifier indicates QoS rules with the length of two octets support
indicator, the container identifier contents field is empty and the length of container
identifier contents indicates a length equal to zero. If the container identifier contents
field is not empty, it shall be ignored. The length of container identifier contents field
consists of one octet. This information indicates that the MS supports receiving QoS
rules with the length of two octets.
When the container identifier indicates QoS flow descriptions with the length of two
octets support indicator, the container identifier contents field is empty and the length
of container identifier contents indicates a length equal to zero. If the container
identifier contents field is not empty, it shall be ignored. The length of container
identifier contents field consists of one octet. This information indicates that the MS
supports receiving QoS flow descriptions with the length of two octets.
When the container identifier indicates QoS rules with the length of two octets, the
container identifier contents field contains the QoS rules for the QoS flow
corresponding to the EPS bearer of the PDN connection if the MS has indicated the
support of receiving QoS rules with the length of two octets. The QoS rules with the
length of two octets is coded as the value part of QoS rules information element as
specified in subclause 9.11.4.13 of 3GPP TS 24.501 [167]. The usage of the QoS rules
is specified in 3GPP TS 24.501 [167]. See NOTE 2.
When the container identifier indicates QoS flow descriptions with the length of two
octets, the container identifier contents field contains the QoS flow descriptions for the
QoS flow corresponding to the EPS bearer of the PDN connection if the MS has
indicated the support of receiving QoS flow descriptions with the length of two octets.
The QoS flow descriptions with the length of two octets is coded as the value part of
QoS flow descriptions information element as specified in subclause 9.11.4.12 of
3GPP TS 24.501 [167]. The usage of the QoS flow descriptions is specified in
3GPP TS 24.501 [167]. See NOTE 2.
When the container identifier indicates Small data rate control parameters, the
container identifier contents field contains parameters for small data rate control
When the container identifier indicates Initial small data rate control parameters, the
container identifier contents field contains status parameters for small data rate control
When the container identifier indicates Additional small data rate control for exception
data parameters, the container identifier contents field contains parameters for
additional small data rate control for exception data functionality. The container
contents are coded as described in subclause 10.5.6.3.5.
When the container identifier indicates Initial additional small data rate control for
exception data parameters, the container identifier contents field contains status
parameters for additional small data rate control for exception data functionality. The
container contents are coded as described in subclause 10.5.6.3.7.
When the container identifier indicates ACS information request, the container
ignored. This information indicates that the MS requests ACS information.
When the container identifier indicates ACS information, the length of container
identifier contents indicates non-zero length. The container identifier contents field
contains the UTF-8 (see IETF RFC 3629 [168]) coded representation of an ACS URL.
Bit 8 of the first octet of the container identifier contents field contains the most
significant bit and bit 1 of the last octet of the container identifier contents field contains
ETSI
Release 18 675 3GPP TS 24.008 V18.4.0 (2023-09)
the least significant bit.
When the container identifier indicates ATSSS request, the container identifier
contents field is coded according to 3GPP TS 24.193 [171] subclause 6.1.6.2. The
length of container identifier contents field consists of one octet. This information
indicates that the MS supports receiving ATSSS response with the length of two
octets.
When the container identifier indicates ATSSS response with the length of two octets,
the container identifier contents field is coded according to 3GPP TS 24.193 [171]
subclause 6.1.6.3. See NOTE 2.
When the container identifier indicates DNS server security information with length of
two octets, the container identifier contents field contains one of the parameters:
security protocol type, port number, authentication domain name, SPKI pin sets, root
certificate, raw public key.
When there is a need to send more than one parameter, then multiple containers with
the container identifier indicating DNS server security information with length of two
octets are used, each containing one parameter. The first octet of container identifier
contents of the DNS server security information with length of two octets contains the
type and all octets excluding the first octet of the container identifier contents field of
the DNS server security information with length of two octets contain the value part. If
the DNS server security information with length of two octets contains security protocol
type then the type is set to 00H and the value part is set to 00H if the security protocol
type is TLS (see IETF RFC 7858 [172]) and 01H if the security protocol type is DTLS
(see IETF RFC 8094 [173]). If the DNS server security information with length of two
octets contains port number then the type is set to 01H and the value part to content is
set ephemeral port (see IETF RFC 6056 [174]). If the DNS server security information
with length of two octets contains authentication domain name then the type is set to
02H and the value part is set authentication domain name (The FQDN shall be
encoded as defined in IEFT RFC 1035 [175]). If the DNS server security information
with length of two octets contains SPKI pin set then the type is set to 03H and the
value part is set SPKI pin set (The SPKI pin set shall be encoded as in DER as
specified in X 690.3 [177]). If the DNS server security information with length of two
octets contains a root certificate then the type is set to 04H and the value part is set
the root certificate (the root certificate is encoded as in DER as specified in
X 690 [177]). If the DNS server security information with length of two octets contains
raw public key then the type is set to 05H and the value part is set to raw public key
(The raw public key shall be encoded as in DER as specified in X 690.3 [177]). See
NOTE 2.
If the DNS server security information indicator or the DNS server security protocol
support is included by the MS, the network may configure the UE with the DNS server
security information. If the MS includes DNS server security information indicator but
does not include the DNS server security protocol support, the network may configure
the UE with both security protocols TLS and DTLS.
When the container identifier indicates DNS server security protocol support, the
container identifier contents field contains the parameter security protocol type. The
first octet of container identifier contents of the DNS server security protocol support
with length of one octet contains the security protocol type. If the security protocol type
is is set to 01H the UE indicates the support of the security protocol TLS (see
IETF RFC 7858 [172]) and if it is set to 02H the UE indicates the support of the
security protocol DTLS (see IETF RFC 8094 [173]), all other values are spare. When
there is a need to send more than one parameter, then multiple containers with the
container identifier indicating DNS server security protocol support with length of one
octet are used, each containing one parameter.
When the container identifier indicates ECS configuration information provisioning

support indicator (related to ECS IPv4 Address, ECS IPv6 Address, ECS FQDN and
ECSP identifier), the container identifier contents field is empty and the length of
contents field is not empty, it shall be ignored. This information indicates that the MS
supports to receive ECS address with the length of two octets. The usage of ECS
configuration information provisioning support indicator is specified in
3GPP TS 24.501 [167].
When the container identifier indicates ECS address with the length of two octets, the
container identifier contents field contains an ECS address and may contain spatial
ETSI
Release 18 676 3GPP TS 24.008 V18.4.0 (2023-09)
validity condition parameters as specified in subclause 9.11.4.34 of 3GPP TS

24.501 [167], if the MS has indicated ECS configuration information provisioning
support indicator. When there is a need to include more than one ECS address, then
more logical units with the container identifier indicating ECS address with the length of
two octets are used. The usage of ECS address and spatial validity condition is
When the container identifier indicates ECSP identifier, the container identifier
contents field contains one ECSP identifier (see 3GPP TS 23.558 [184]). There can be
multiple ECSP identifier logical units. Each logical unit shall be considered related to
any previous ECS address with length of two octets logical units. If an ECSP identifier
logical unit is not following an ECS address with length of two octets logical unit it shall
be ignored. The ECSP identifier is encoded as a UTF-8 string. The usage of ECSP
identifier is specified in 3GPP TS 24.501 [167].
When the container identifier indicates PVS information request, the container
ignored. This information indicates that the MS requests PVS information as specified
in 3GPP TS 23.501 [166].
When the container identifier indicates PVS IPv4 Address, the container identifier
contents field contains parameters for PVS IPv4 Address information. The container
contents are coded as described in subclause 10.5.6.3.10d. When there is a need to
include more than one PVS IPv4 address, then more logical units with the container
identifier indicating PVS IPv4 Address are used.
When the container identifier indicates PVS IPv6 Address, the container identifier
contents field contains parameters for PVS IPv6 Address information. The container
contents are coded as described in subclause 10.5.6.3.11. When there is a need to
include more than one PVS IPv6 address, then more logical units with the container
identifier indicating PVS IPv6 Address are used.
When the container identifier indicates PVS name, the container identifier contents
field contains parameters for fully qualified domain name information. The container
contents are coded as described in subclause 10.5.6.3.12. When there is a need to
include more than one PVS name, then more logical units with the container identifier
indicating PVS name are used.
When the container identifier indicates EAS rediscovery support indication, either the
contents indicates a length equal to zero, or the container identifier contents field
contains one octet long capability field. If the container identifier contents field is longer
than one octet, the octets after the first octet of the container identifier contents shall
be ignored by the receiving entity. EAS rediscovery support indication indicates that
the sending entity supports handling of the EAS rediscovery indication without
indicated impact received in PDU session modifications. Bit 1 of the capability field set
to zero indicates that the sending entity does not support handling of the EAS
rediscovery indication with impacted EAS IPv4 address range received in PDU session
modifications. Bit 1 of the capability field set to one indicates that the sending entity
supports handling of the EAS rediscovery indication with impacted EAS IPv4 address
range received in PDU session modifications. Bit 2 of the capability field set to zero
indicates that the sending entity does not support handling of the EAS rediscovery
indication with impacted EAS IPv6 address range received in PDU session
modifications. Bit 2 of the capability field set to one indicates that the sending entity
supports handling of the EAS rediscovery indication with impacted EAS IPv6 address
range received in PDU session modifications. Bit 3 of the capability field set to zero
indicates that the sending entity does not support handling of the EAS rediscovery
indication with impacted FQDN received in PDU session modifications. Bit 3 of the
capability field set to one indicates that the sending entity supports handling of the EAS
rediscovery indication with impacted FQDN received in PDU session modifications.
Bits 4 to 8 of the capability field shall be set to zero by the sending entity and shall be
ignored by the receiving entity. If the container identifier contents field is empty, the
receiving entity shall consider that the container identifier contents field with the
capability field with value 00H is received. The usage of EAS rediscovery support
indication is specified in 3GPP TS 24.501 [167].
When the container identifier indicates EAS rediscovery indication without indicated
impact, the container identifier contents field is empty and the length of container
ETSI
Release 18 677 3GPP TS 24.008 V18.4.0 (2023-09)
identifier contents indicates a length equal to zero. EAS rediscovery indication without
indicated impact indicates that all EAS information(s) as specified in
3GPP TS 23.548 [182] need to be refreshed. If the container identifier contents field is
not empty, it shall be ignored. The usage of EAS rediscovery indication without
indicated impact is specified in 3GPP TS 24.501 [167].
When the container identifier indicates EAS rediscovery indication with impacted EAS
IPv4 address range, the container identifier contents field contains binary encoded
lowest IPv4 address of the EAS IPv4 address range followed by binary encoded
highest IPv4 address of the EAS IPv4 address range, and the length of container
identifier contents indicates eight. EAS rediscovery indication with impacted EAS IPv4
address range indicates IPv4 address(es) of EAS information(s) as specified in
3GPP TS 23.548 [182] which needs to be refreshed. When there is a need to include
EAS rediscovery indication with more impacted EAS IPv4 address ranges, then more
logical units with the container identifier indicating EAS rediscovery indication with
impacted EAS IPv4 address range, are used. The usage of EAS rediscovery indication
with impacted EAS IPv4 address range is specified in 3GPP TS 24.501 [167].
IPv6 address range, the container identifier contents field contains binary encoded
lowest IPv6 address of the EAS IPv6 address range followed by binary encoded
highest IPv6 address of the EAS IPv6 address range, and the length of container
identifier contents indicates thirty two (decimal). EAS rediscovery indication with
impacted EAS IPv6 address range indicates IPv6 address(es) of EAS information(s) as
specified in 3GPP TS 23.548 [182] which needs to be refreshed. When there is a need
to include EAS rediscovery indications with more impacted EAS IPv6 address ranges,
then more logical units with the container identifier indicating EAS rediscovery
indication with impacted EAS IPv6 address range, are used. The usage of EAS
rediscovery indication with impacted EAS IPv6 address range is specified in
3GPP TS 24.501 [167].
FQDN, the container identifier contents field contains one EAS FQDN. EAS
rediscovery indication with impacted EAS FQDN indicates an FQDN of EAS
information as specified in 3GPP TS 23.548 [182] which needs to be refreshed. The
FQDN is constructed as specified in subclause 19.4.2 of 3GPP TS 23.003 [10]. When
there is a need to include EAS rediscovery indications with more impacted EAS
FQDNs, then more logical units with the container identifier indicating EAS rediscovery
indication with impacted EAS FQDN are used. The usage of EAS rediscovery
indication with impacted EAS FQDN is specified in 3GPP TS 24.501 [167]. See
NOTE 5.
When the container identifier indicates Uplink data not allowed (see
3GPP TS 24.301 [120]), the container identifier contents field is empty and the length
identifier contents field is not empty, it shall be ignored. This information indicates that
uplink user data shall not be sent over EPS bearer context(s) of the PDN connection.
When the container identifier indicates Uplink data allowed (see

3GPP TS 24.301 [120]), the container identifier contents field is empty and the length
identifier contents field is not empty, it shall be ignored. This information indicates that
uplink user data are allowed over EPS bearer context(s) of the PDN connection.
When the container identifier indicates UAS services not allowed indication, the
contents indicates a length equals to zero. The UAS services not allowed indication
indicates that the requested UAS services are not allowed by the network. If the
container identifier contents field is not empty, it shall be ignored.
When the container identifier indicates service-level-AA container with the length of
two octets, the container identifier contents field contains the service-level-AA
container. The conditions under which this PCO parameter can be used are specified
in 3GPP TS 24.301 [120]. The service-level-AA container is coded as the value part of
the service-level-AA container information element as specified in subclause 9.11.2.10
of 3GPP TS 24.501 [167]. See NOTE 2.
When the container identifier indicates EDC support indicator, the container identifier
contents field is empty and the length of container identifier contents indicates a length
ETSI
Release 18 678 3GPP TS 24.008 V18.4.0 (2023-09)
equal to zero. If the container identifier contents field is not empty, it shall be ignored.
This information indicates that the MS supports EDC as specified in
3GPP TS 23.548 [182]. The usage of EDC support indicator is specified in
3GPP TS 24.501 [167].
When the container identifier indicates EDC usage allowed indicator, the container
ignored. This information indicates that the network allows use of EDC as specified in
3GPP TS 23.548 [182]. The usage of EDC usage allowed indicator is specified in
3GPP TS 24.501 [167].
When the container identifier indicates EDC usage required indicator, the container
ignored. This information indicates that the network requires use of EDC as specified
in 3GPP TS 23.548 [182]. The usage of EDC usage required indicator is specified in
3GPP TS 24.501 [167].
When the container identifier indicates MS support of MAC address range in 5GS
field is not empty, it shall be ignored. This information indicates that the MS supports a
"destination MAC address range type" packet filter component and a "source MAC
address range type" packet filter component specified in 3GPP TS 24.501 [167].
When the container identifier indicates Network support of MAC address range in 5GS
field is not empty, it shall be ignored. This information indicates that the network
supports a "destination MAC address range type" packet filter component and a
"source MAC address range type" packet filter component specified in
3GPP TS 24.501 [167].
When the container identifier indicates SDNAEPC support indicator, the container
ignored. This information indicates that the MS supports secondary DN authentication
and authorization over EPC as specified in 3GPP TS 24.301 [120].
When the container identifier indicates SDNAEPC EAP message with the length of two
octets, the container identifier contents field contains the EAP message used for
secondary DN authentication and authorization over EPC if the MS has indicated that it
supports secondary DN authentication and authorization over EPC as specified in
3GPP TS 24.301 [120]. The SDNAEPC EAP message with the length of two octets is
coded as the value part of the EAP message information element as specified in
subclause 9.11.2.2 of 3GPP TS 24.501 [167]. See NOTE 2.
When the container identifier indicates SDNAEPC DN-specific identity, the container
identifier contents field contains a DN-specific identity of the UE in the network access
identifier (NAI) format according to IETF RFC 7542 [186], encoded as UTF-8 string.
See NOTE 6.
When the container identifier indicates UE policy container with the length of two
octets, the container identifier contents field is coded as specified in annex D of
3GPP TS 24.501 [167]. See NOTE 2.
When the container identifier indicates operator specific use, the Container contents
starts with MCC and MNC of the operator providing the relevant application and can be
followed by further application specific information. The coding of MCC and MNC is as
in octet 2 to 4 of the Location Area Identification information element in
subclause 10.5.1.3.
NOTE 1: The additional parameters list and the configuration protocol options list are
logically separated since they carry different type of information. The
beginning of the additional parameters list is marked by a logical unit, which
has an identifier (i.e. the first two octets) equal to a container identifier (i.e. it
is not a protocol identifier).
NOTE 2: If the QoS rules with the length of two octets, the QoS flow descriptions with
ETSI
Release 18 679 3GPP TS 24.008 V18.4.0 (2023-09)
the length of two octets, ATSSS response with the length of two octets,
DNS server security information with length of two octets, ECS address with
the length of two octets, the service-level-AA container with the length of
two octets , SDNAEPC EAP message with the length of two octets, or UE
policy container with the length of two octets is included, then extended
protocol configuration options as specified in the subclause 10.5.6.3A shall
be used.
NOTE 3: If PAP/CHAP protocol is supported by the UE in N1 mode, the UE can use
the PAP/CHAP protocol identifiers in the extended protocol configuration
options information element in N1 mode.
NOTE 4: The MS operating in single-registration mode shall indicate the support of
Local address in TFT in N1 mode as specified in subclause 6.4.1.2 of
3GPP TS 24.501 [167].
NOTE 5: The maximum length of an FQDN is 254 octets.
NOTE 6: The maximum length of a DN-specific identity is 253 octets
10.5.6.3.2 APN rate control parameters

The purpose of the APN rate control parameters container contents is to indicate the APN rate control parameters.
The APN rate control parameters container contents are coded as shown in figure 10.5.136A/3GPP TS 24.008 and
table 10.5.154A/3GPP TS 24.008.
The APN rate control parameters container contents can be 1 octet long or 4 octets long. If the APN rate control
parameters container contents is longer than 4 octets, the 5th octet and later octets are ignored.
8 7 6 5 4 3 2 1
Spare AER Uplink time unit octet 1
octet 2
Maximum uplink rate
octet 4
Figure 10.5.136A/3GPP TS 24.008: APN rate control parameters
Table 10.5.154A/3GPP TS 24.008: APN rate control parameters
Additional exception reports (AER) (octet 1)

Bit
4
0 Additional exception reports at maximum rate reached are not allowed
1 Additional exception reports at maximum rate reached are allowed
Uplink time unit (octet 1)

Bit
3 2 1
0 0 0 unrestricted
0 0 1 minute
0 1 0 hour
0 1 1 day
1 0 0 week
Maximum uplink rate (octet 2 to octet 4) is a binary coded representation of the maximum number of
messages the UE is restricted to send per time unit. The time unit is indicated in the uplink time unit. If the
uplink time unit is set to "unrestricted", the maximum uplink data volume the UE can send is not restricted.
ETSI
Release 18 680 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.6.3.3 Additional APN rate control parameters for exception data

The purpose of the Additional APN rate control parameters for exception data container contents is to indicate the
additional APN rate control parameters for exception data.
The Additional APN rate control parameters for exception data container contents are coded as shown in
figure 10.5.6.3.3-1/3GPP TS 24.008 and table 10.5.6.3.3-1/3GPP TS 24.008.
The Additional APN rate control parameters for exception data container contents can be 1 octet long or 3 octets long.
If the Additional APN rate control parameters for exception data container contents is longer than 3 octets, the 4th octet
and later octets are ignored.
8 7 6 5 4 3 2 1
Spare Uplink time unit octet 1
octet 2
Additional uplink rate for exception data
octet 3
Figure 10.5.6.3.3-1/3GPP TS 24.008: Additional APN rate control parameters for exception data
Table 10.5.6.3.3-1/3GPP TS 24.008: Additional APN rate control parameters for exception data
Uplink time unit (octet 1)

Bit
3 2 1
0 0 0 unrestricted
0 0 1 minute
0 1 0 hour
0 1 1 day
1 0 0 week
Additional uplink rate for exception data (octet 2 to octet 3) is a binary coded representation of the
maximum number of messages for exception data the UE is restricted to send per time unit. The time unit is
indicated in the uplink time unit. If the uplink time unit is set to "unrestricted", the maximum additional uplink
rate volume for exception data the UE can send is not restricted.
10.5.6.3.4 Small data rate control parameters

See subclause 10.5.6.3.2 in current specification.
10.5.6.3.5 Additional small data rate control parameters for exception data
10.5.6.3.6 Initial small data rate control parameters

The purpose of the Initial small data rate control parameters container contents is to indicate the Initial small data rate
control parameters.
The Initial small data rate control parameters container contents are coded as shown in figure 10.5.6.3.6-
1/3GPP TS 24.008 and table 10.5.6.3.6-1/3GPP TS 24.008.
The Initial small data rate control parameters container contents is 7 octets long. If the Initial small data rate control
parameters container contents is longer than 7 octets, the 8th octet and later octets are ignored.
ETSI
Release 18 681 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
octet 1
Maximum uplink rate allowed
octet 3
octet 4
Termination timestamp
octet 7
Figure 10.5.6.3.6-1/3GPP TS 24.008: Initial small data rate control parameters
Table 10.5.6.3.6-1/3GPP TS 24.008: Initial small data rate control parameters
Maximum uplink rate allowed (octet 1 to octet 3) is a binary coded representation of the maximum allowed
number of messages the UE is allowed to send before the validity period of the initial small data rate control
parameters expires.
Termination timestamp (octet 4 to octet 7) is a binary coded representation of the UTC time when the
validity period of the initial small data rate control parameters expires. Octets 4 to 7 are encoded in the
same format as the first four octets of the 64-bit timestamp format as defined in clause 6 of
IETF RFC 5905 [169].
NOTE: The encoding is defined as the time in seconds relative to 00:00:00 on 1 January 1900.
10.5.6.3.7 Initial additional small data rate control for exception data parameters
10.5.6.3.8 Initial APN rate control parameters

10.5.6.3.9 Initial additional APN rate control for exception data parameters
10.5.6.3.10 PVS IPv4 Address

The purpose of the PVS IPv4 Address container contents is to indicate the PVS IPv4 Address and, optionally, the related
DNN and S-NSSAI.
The PVS IPv4 Address container contents are coded as shown in figure 10.5.6.3.10-1/3GPP TS 24.008 and
table 10.5.6.3.10-1/3GPP TS 24.008.
8 7 6 5 4 3 2 1
octet 1
PVS IPv4 Address
octet 4
0 0 0 0 0 0 S- DNN octet 5*
Spare Spare Spare Spare Spare Spare NSSAI indicati
indicati on
on
octet 6*
DNN
octet m*
octet m+1*
S-NSSAI
octet n*
Figure 10.5.6.3.10-1/3GPP TS 24.008: PVS IPv4 Address
ETSI
Release 18 682 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.6.3.10-1/3GPP TS 24.008: PVS IPv4 Address
PVS IPv4 Address (octet 1 to octet 4) is a binary coded representation of the IPv4 Address of the PVS.
DNN indicator value (octet 5, bit 1)

Bit
1
0 DNN absent
1 DNN present
If the DNN indicator bit is set to "DNN present", the DNN field is present. If the DNN indicator bit is set to
"DNN absent", the DNN field is absent.
S-NSSAI indicator value (octet 5, bit 2)

Bit
2
0 S-NSSAI absent
1 S-NSSAI present
If the S-NSSAI indicator bit is set to " S-NSSAI present", the S-NSSAI field is present. If the S-NSSAI
indicator bit is set to " S-NSSAI absent", the S-NSSAI field is absent.
DNN (octet 6 to m)
DNN is coded as the length and value part of DNN information element as specified in subclause 9.11.2.1B
of 3GPP TS 24.501 [167] starting with the second octet.
S-NSSAI (octet m+1 to n)
S-NSSAI is coded as the length and value part of S-NSSAI information element as specified in
subclause 9.11.2.8 of 3GPP TS 24.501 [167] starting with the second octet.
10.5.6.3.11 PVS IPv6 Address

The purpose of the PVS IPv6 Address container contents is to indicate the PVS IPv6 Address and, optionally, the related
DNN and S-NSSAI.
The PVS IPv6 Address container contents are coded as shown in figure 10.5.6.3.11-1/3GPP TS 24.008 and
table 10.5.6.3.11-1/3GPP TS 24.008.
8 7 6 5 4 3 2 1
octet 1
PVS IPv6 Address
octet 16
0 0 0 0 0 0 S- DNN octet 17*
indicati on
on
octet 18*
DNN
octet m*
octet m+1*
S-NSSAI
octet n*
Figure 10.5.6.3.11-1/3GPP TS 24.008: PVS IPv6 Address
ETSI
Release 18 683 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.6.3.11-1/3GPP TS 24.008: PVS IPv6 Address
PVS IPv6 Address (octet 1 to octet 16) is a binary coded representation of the IPv6 Address of the PVS.
DNN indicator value (octet 17, bit 1)

Bit
1
0 DNN absent
1 DNN present
S-NSSAI indicator value (octet 17, bit 2)

Bit
2
0 S-NSSAI absent
1 S-NSSAI present
DNN (octet 18 to m)
S-NSSAI (octet m+1 to n)
10.5.6.3.12 PVS name

The purpose of the PVS name container contents is to indicate the fully qualified domain name information and,
optionally, the related DNN and S-NSSAI.
The PVS name container contents are coded as shown in figure 10.5.6.3.12-1/3GPP TS 24.008 and table 10.5.6.3.Z-
1/3GPP TS 24.008.
8 7 6 5 4 3 2 1
PVS name length octet 1
octet 2
PVS name
octet m
0 0 0 0 0 0 S- DNN octet m+1*
indicati on
on
octet m+2*
DNN
octet n*
octet n+1*
S-NSSAI
octet q*
Figure 10.5.6.3.12-1/3GPP TS 24.008: PVS name
ETSI
Release 18 684 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.6.3.12-1/3GPP TS 24.008: PVS name
PVS name (octet 1) length indicates the length of the PVS name.
PVS name (octet 2 to m) indicates the FQDN of the PVS which is a fully qualified domain name according
to DNS naming conventions (see 3GPP TS 23.003 [10]).
DNN indicator value (octet m+1, bit 1)

Bit
1
0 DNN absent
1 DNN present
S-NSSAI indicator value (octet m+1, bit 2)

Bit
2
0 S-NSSAI absent
1 S-NSSAI present
DNN (octet m+2 to n)
S-NSSAI (octet n+1 to q)
10.5.6.3A Extended protocol configuration options

The purpose of the extended protocol configuration options information element is to:
- transfer external network protocol options associated with a PDP context activation, and
- transfer additional (protocol) data (e.g. configuration parameters, error codes or messages/events) associated
with an external protocol or an application.
The extended protocol configuration options is a type 6 information element with a minimum length of 4 octets and a
maximum length of 65538 octets.
The extended protocol configuration options information element is coded as shown in figure 10.5.6.3A.1 and
table 10.5.6.3A.1.
8 7 6 5 4 3 2 1
Extended protocol configuration options IEI octet 1

Length of extended protocol configuration options contents octet 2
octet 3
octet 4
Extended protocol configuration options contents
octet n
Figure 10.5.6.3A.1: Extended protocol configuration options information element
ETSI
Release 18 685 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.6.3A.1: Extended protocol configuration options information element
Extended protocol configuration options contents (octet 4 to octet n); Max value of
65535 octets
The contents of extended protocol configuration options is coded as octet 3 and above
of protocol configuration options IE shown in subclause 10.5.6.3.
10.5.6.4 Packet data protocol address

The purpose of the packet data protocol address information element is to identify an address associated with a PDP.
The packet data protocol address is a type 4 information element with minimum length of 4 octets and a maximum
The packet data protocol address information element is coded as shown in figure 10.5.137/3GPP TS 24.008 and
table 10.5.155/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Packet data protocol address IEI octet 1
Length of PDP address contents octet 2
0 0 0 0 PDP type organisation octet 3
spare
PDP type number octet 4
octet 5
Address information
octet n
Figure 10.5.137/3GPP TS 24.008: Packet data protocol address information element
Table 10.5.155/3GPP TS 24.008: Packet data protocol address information element
Length of PDP address contents (octet 2)
If the value of octet 2 equals 0000 0010, then:
- No PDP address is included in this information element; and
- If the PDP type is IP, dynamic addressing is applicable.
NOTE: For PPP no address is required in this information element.
PDP type organisation (octet 3)

Bits
4321
In MS to network direction :
0000 ETSI allocated address
0001 IETF allocated address
1111 Empty PDP type
In network to MS direction :
0000 ETSI allocated address
0001 IETF allocated address
If bits 4,3,2,1 of octet 3 are coded 0 0 0 0

PDP type number value (octet 4)
Bits
ETSI
Release 18 686 3GPP TS 24.008 V18.4.0 (2023-09)
87654321
0 0 0 0 0 0 0 0 Reserved, used in earlier version of this protocol
0 0 0 0 0 0 0 1 PDP-type PPP
0 0 0 0 0 0 1 0 non IP
in this version of the protocol.

Bits
87654321
0 0 1 0 0 0 0 1 IPv4 address
0 1 0 1 0 1 1 1 IPv6 address
1 0 0 0 1 1 0 1 IPv4v6 address
All other values shall be interpreted as IPv4 address

in this version of the protocol.
In MS to network direction:
bits 8 to 1 are spare and shall be coded all 0.
Octet 3, bits 8, 7, 6, and 5 are spare and shall be coded all 0.
If PDP type number indicates IPv4, the Address information in octet 5 to octet 8 contains the IPv4 address. Bit 8 of
octet 5 represents the most significant bit of the IP address and bit 1 of octet 8 the least significant bit.
If PDP type number indicates IPv6, the Address information in octet 5 to octet 20 contains the IPv6 address. Bit 8 of
octet 5 represents the most significant bit of the IP address and bit 1 of octet 20 the least significant bit.
If PDP type number indicates IPv4v6:

The Address information in octet 5 to octet 8 contains the IPv4 address. Bit 8 of octet 5 represents the most significant
bit of the IP address and bit 1 of octet 8 the least significant bit.
The Address information in octet 9 to octet 24 contains the IPv6 address. Bit 8 of octet 9 represents the most significant
bit of the IP address and bit 1 of octet 24 the least significant bit.
If PDP type number indicates IPv4 or IPv4v6 and DHCPv4 is to be used to allocate the IPv4 address, the IPv4 address
shall be coded as 0.0.0.0.
10.5.6.5 Quality of service

The purpose of the quality of service information element is to specify the QoS parameters for a PDP context.
The QoS IE is defined to allow backward compatibility to earlier version of Session Management Protocol.
The quality of service is a type 4 information element with a minimum length of 14 octets and a maximum length of 22
octets. The QoS requested by the MS shall be encoded both in the QoS attributes specified in octets 3-5 and in the QoS
attributes specified in octets 6-14.
In the MS to network direction and in the network to MS direction the following applies:
- Octets 15-22 are optional. If octet 15 is included, then octet 16 shall also be included, and octets 17-22may be
included.
- If octet 17 is included, then octet 18 shall also be included and octets 19-22 may be included.
- If octet 19 is included, then octet 20 shall also be included, and octets 21 and 22 may be included.
- If octet 21 is included, then octet 22 shall also be included.
- A QoS IE received without octets 6-22, without octets 14-22, without octets 15-22, without octets 17-22, without
octets 19-22 or without octets 21-22 shall be accepted by the receiving entity.
ETSI
Release 18 687 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE: This behavior is required for interworking with entities supporting an earlier version of the protocol, or
when the Maximum bit rate for downlink or for downlink and uplink is negotiated to a value lower than
8700 kbps.
The quality of service information element is coded as shown in figure 10.5.138/3GPP TS 24.008 and
table 10.5.156/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Quality of service IEI octet 1
Length of quality of service IE octet 2
0 0 Delay Reliability octet 3
spare class class
Peak 0 Precedence octet 4
throughput spare class
0 0 0 Mean octet 5
spare throughput
Traffic Class Delivery order Delivery of erroneous octet 6
SDU
Maximum SDU size octet 7
Maximum bit rate for uplink octet 8
Maximum bit rate for downlink octet 9
Residual BER SDU error ratio octet 10
Transfer delay Traffic Handling octet 11
priority
octet 12
Guaranteed bit rate for uplink
Guaranteed bit rate for downlink octet 13
0 0 0 Signal- Source Statistics Descriptor octet 14
spare ling
Indicat-
ion
Maximum bit rate for downlink (extended) octet 15
Guaranteed bit rate for downlink (extended) octet 16
Maximum bit rate for uplink (extended) octet 17
Guaranteed bit rate for uplink (extended) octet 18
Maximum bit rate for downlink (extended-2) octet 19
Guaranteed bit rate for downlink (extended-2) octet 20
Maximum bit rate for uplink (extended-2) octet 21
Guaranteed bit rate for uplink (extended-2) octet 22
Figure 10.5.138/3GPP TS 24.008: Quality of service information element
ETSI
Release 18 688 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.156/3GPP TS 24.008: Quality of service information element
Reliability class, octet 3 (see 3GPP TS 23.107 [81])

Bits
321
0 0 0 Subscribed reliability class
In network to MS direction:
0 0 0 Reserved
In MS to network direction and in network to MS direction:
0 0 1 Unused. If received, it shall be interpreted as '010' (Note)
0 1 0 Unacknowledged GTP; Acknowledged LLC and RLC, Protected data
0 1 1 Unacknowledged GTP and LLC; Acknowledged RLC, Protected data
1 0 0 Unacknowledged GTP, LLC, and RLC, Protected data
1 0 1 Unacknowledged GTP, LLC, and RLC, Unprotected data
1 1 1 Reserved
All other values are interpreted as Unacknowledged GTP and LLC; Acknowledged RLC, Protected data in this version of
the protocol.
If network supports EPS, then it should not assign Reliability class value '010’.
NOTE: this value was allocated in earlier versions of the protocol.
Delay class, octet 3 (see 3GPP TS 22.060 [73] and 3GPP TS 23.107 [81])
Bits
654
0 0 0 Subscribed delay class
0 0 0 Reserved
0 0 1 Delay class 1
0 1 0 Delay class 2
0 1 1 Delay class 3
1 0 0 Delay class 4 (best effort)
1 1 1 Reserved
ETSI
Release 18 689 3GPP TS 24.008 V18.4.0 (2023-09)
All other values are interpreted as Delay class 4 (best effort) in this version
of the protocol.
Bit 7 and 8 of octet 3 are spare and shall be coded all 0.
Precedence class, octet 4 (see 3GPP TS 23.107 [81])
Bits
321
0 0 0 Subscribed precedence
0 0 0 Reserved
0 0 1 High priority
0 1 0 Normal priority
0 1 1 Low priority
1 1 1 Reserved
All other values are interpreted as Normal priority in this version of the protocol.
Bit 4 of octet 4 is spare and shall be coded as 0.
Peak throughput, octet 4 (see 3GPP TS 23.107 [81])

This field is the binary representation of the Peak Throughput Class (1 to 9). The corresponding peak throughput to each
peak throughput class is indicated.
Bits
8765
0000 Subscribed peak throughput
0000 Reserved
0001 Up to 1 000 octet/s
1000 Up to 128 000 octet/s
1001 Up to 256 000 octet/s
1111 Reserved
All other values are interpreted as Up to 1 000 octet/s in this

version of the protocol.
Mean throughput, octet 5 (see 3GPP TS 23.107 [81])
This field is the binary representation of the Mean Throughput Class (1 to 18; mean throughput class 30 is reserved and
31 is best effort). The corresponding mean throughput to each mean throughput class is indicated.
Bits
54321
ETSI
Release 18 690 3GPP TS 24.008 V18.4.0 (2023-09)
00000 Subscribed mean throughput
00000 Reserved
00001 100 octet/h
00010 200 octet/h
00011 500 octet/h
00100 1 000 octet/h
00101 2 000 octet/h
00110 5 000 octet/h
00111 10 000 octet/h
01000 20 000 octet/h
01001 50 000 octet/h
01010 100 000 octet/h
01011 200 000 octet/h
01100 500 000 octet/h
01101 1 000 000 octet/h
01110 2 000 000 octet/h
01111 5 000 000 octet/h
10000 10 000 000 octet/h
10001 20 000 000 octet/h
10010 50 000 000 octet/h
11110 Reserved
11111 Best effort
The value Best effort indicates that throughput shall be made available to the MS on a per need and availability basis.
All other values are interpreted as Best effort in this
version of the protocol.
Bits 8 to 6 of octet 5 are spare and shall be coded all 0.
Delivery of erroneous SDUs, octet 6 (see 3GPP TS 23.107 [81])

Bits
321
000 Subscribed delivery of erroneous SDUs
000 Reserved
001 No detect ('-')
010 Erroneous SDUs are delivered ('yes')
011 Erroneous SDUs are not delivered ('no')
111 Reserved
The network shall map all other values not explicitly defined onto one of the values defined in this version of the protocol.
The network shall return a negotiated value which is explicitly defined in this version of this protocol.
The MS shall consider all other values as reserved.
Delivery order, octet 6 (see 3GPP TS 23.107 [81])

Bits
543
00 Subscribed delivery order
00 Reserved
01 With delivery order ('yes')
10 Without delivery order ('no')
11 Reserved
ETSI
Release 18 691 3GPP TS 24.008 V18.4.0 (2023-09)
Traffic class, octet 6 (see 3GPP TS 23.107 [81])

Bits
876
000 Subscribed traffic class
000 Reserved
001 Conversational class
010 Streaming class
011 Interactive class
100 Background class
111 Reserved
Maximum SDU size, octet 7 (see 3GPP TS 23.107 [81])

00000000 Subscribed maximum SDU size
11111111 Reserved
00000000 Reserved
11111111 Reserved
For values in the range 00000001 to 10010110 the Maximum SDU size value is binary coded in 8 bits, using a
granularity of 10 octets, giving a range of values from 10 octets to 1500 octets.
Values above 10010110 are as below:
10010111 1502 octets
10011000 1510 octets
10011001 1520 octets
Maximum bit rate for uplink, octet 8

Bits
87654321
00000000 Subscribed maximum bit rate for uplink
00000000 Reserved
00000001 The maximum bit rate is binary coded in 8 bits, using a granularity of 1 kbps
00111111 giving a range of values from 1 kbps to 63 kbps in 1 kbps increments.
01000000 The maximum bit rate is 64 kbps + ((the binary coded value in 8 bits –01000000) * 8 kbps)
10000000 The maximum bit rate is 576 kbps + ((the binary coded value in 8 bits –10000000) * 64 kbps)
11111111 0kbps
If the sending entity wants to indicate a Maximum bit rate for uplink higher than 8640 kbps, it shall set octet 8 to
"11111110", i.e. 8640 kbps, and shall encode the value for the Maximum bit rate in octet 17.
ETSI
Release 18 692 3GPP TS 24.008 V18.4.0 (2023-09)
The network shall return a negotiated value which is explicitly defined in this version of the protocol.
Maximum bit rate for downlink, octet 9 (see 3GPP TS 23.107 [81])
Coding is identical to that of Maximum bit rate for uplink.
If the sending entity wants to indicate a Maximum bit rate for downlink higher than 8640 kbps, it shall set octet 9 to
"11111110", i.e. 8640 kbps, and shall encode the value for the Maximum bit rate in octet 15.
In this version of the protocol, for messages specified in the present document, the sending entity shall not request 0
kbps for both the Maximum bitrate for downlink and the Maximum bitrate for uplink at the same time. Any entity receiving
a request for 0 kbps in both the Maximum bitrate for downlink and the Maximum bitrate for uplink shall consider that as a
syntactical error (see clause 8).
Residual Bit Error Rate (BER), octet 10 (see 3GPP TS 23.107 [81])
Bits
8765
0000 Subscribed residual BER
0000 Reserved
The Residual BER value consists of 4 bits. The range is from 5*10 -2 to 6*10-8.
0001 5*10-2
0010 1*10-2
0011 5*10-3
0100 4*10-3
0101 1*10-3
0110 1*10-4
0111 1*10-5
1000 1*10-6
1001 6*10-8
1111 Reserved
SDU error ratio, octet 10 (see 3GPP TS 23.107 [81])

Bits
4321
0000 Subscribed SDU error ratio
0000 Reserved
The SDU error ratio value consists of 4 bits. The range is is from 1*10 -1 to 1*10-6.
0001 1*10-2
0010 7*10-3
0011 1*10-3
0100 1*10-4
0101 1*10-5
0110 1*10-6
0111 1*10-1
1111 Reserved
ETSI
Release 18 693 3GPP TS 24.008 V18.4.0 (2023-09)
Traffic handling priority, octet 11 (see 3GPP TS 23.107 [81])

Bits
21
00 Subscribed traffic handling priority
00 Reserved
01 Priority level 1
10 Priority level 2
11 Priority level 3
The Traffic handling priority value is ignored if the Traffic Class is Conversational class, Streaming class or Background
class.
Transfer delay, octet 11 (See 3GPP TS 23.107 [81])

Bits
876543
000000 Subscribed transfer delay
000000 Reserved
0 0 0 0 0 1The Transfer delay is binary coded in 6 bits, using a granularity of 10 ms

001111 giving a range of values from 10 ms to 150 ms in 10 ms increments
0 1 0 0 0 0The transfer delay is 200 ms + ((the binary coded value in 6 bits – 010000) * 50 ms)
011111 giving a range of values from 200 ms to 950 ms in 50ms increments
1 0 0 0 0 0The transfer delay is 1000 ms + ((the binary coded value in 6 bits – 100000) * 100 ms)
111110 giving a range of values from 1000 ms to 4000 ms in 100ms increments
111111 Reserved
The Transfer delay value is ignored if the Traffic Class is Interactive class or Background class.
Guaranteed bit rate for uplink, octet 12 (See 3GPP TS 23.107 [81])
If the sending entity wants to indicate a Guaranteed bit rate for uplink higher than 8640 kbps, it shall set octet 12 to
"11111110", i.e. 8640 kbps, and shall encode the value for the Guaranteed bit rate in octet 18.
The Guaranteed bit rate for uplink value is ignored if the Traffic Class is Interactive class or Background class, or
Maximum bit rate for uplink is set to 0 kbps.
Guaranteed bit rate for downlink, octet 13(See 3GPP TS 23.107 [81])
If the sending entity wants to indicate a Guaranteed bit rate for downlink higher than 8640 kbps, it shall set octet 13 to
"11111110", i.e. 8640 kbps, and shall encode the value for the Guaranteed bit rate in octet 16.
The Guaranteed bit rate for downlink value is ignored if the Traffic Class is Interactive class or Background class, or
Maximum bit rate for downlink is set to 0 kbps.
ETSI
Release 18 694 3GPP TS 24.008 V18.4.0 (2023-09)
Source Statistics Descriptor, octet 14 (see 3GPP TS 23.107 [81])

Bits
4321
In MS to network direction
0 0 0 0 unknown
0001 speech
The network shall consider all other values as unknown.
In network to MS direction
The Source Statistics Descriptor value is ignored if the Traffic Class is Interactive class or Background class.
Signalling Indication, octet 14 (see 3GPP TS 23.107 [81])

Bit
5
0 Not optimised for signalling traffic
1 Optimised for signalling traffic
If set to '1' the QoS of the PDP context is optimised for signalling
The Signalling Indication value is ignored if the Traffic Class is Conversational class, Streaming class or Background
class.
Maximum bit rate for downlink (extended), octet 15

Bits
87654321
00000000 Use the value indicated by the Maximum bit rate for downlink in octet 9.
For all other values: Ignore the value indicated by the Maximum bit rate for downlink in octet 9
and use the following value:
00000001 The maximum bit rate is 8600 kbps + ((the binary coded value in 8 bits) * 100 kbps),
01001010 giving a range of values from 8700 kbps
to 16000 kbps in 100 kbps increments.
01001011 The maximum bit rate is 16 Mbps + ((the binary coded value in 8 bits - 01001010) * 1 Mbps),
10111010 giving a range of values from 17 Mbps to 128 Mbps in 1 Mbps increments.
If the sending entity wants to indicate a Maximum bit rate for downlink higher than 256 Mbps, it shall set octet 15 to
"11111010", i.e. 256 Mbps, and shall encode the value for the maximum bit rate in octet 19.
Guaranteed bit rate for downlink (extended), octet 16

Bits
87654321
00000000 Use the value indicated by the Guaranteed bit rate for downlink in octet 13.
For all other values: Ignore the value indicated by the Guaranteed bit rate for downlink in octet 9
and use the following value:
00000001 The guaranteed bit rate is 8600 kbps + ((the binary coded value in 8 bits) * 100 kbps),
01001011 The guaranteed bit rate is 16 Mbps + ((the binary coded value in 8 bits - 01001010) * 1 Mbps),
ETSI
Release 18 695 3GPP TS 24.008 V18.4.0 (2023-09)
If the sending entity wants to indicate a Guaranteed bit rate for downlink higher than 256 Mbps, it shall set octet 16 to
"11111010", i.e. 256 Mbps, and shall encode the value for the guaranteed bit rate in octet 20.
Maximum bit rate for uplink (extended), octet 17
This field is an extension of the Maximum bit rate for uplink in octet 8. The coding is identical to that of the Maximum bit
rate for downlink (extended).
If the sending entity wants to indicate a Maximum bit rate for uplink higher than 256 Mbps, it shall set octet 17 to
"11111010", i.e. 256 Mbps, and shall encode the value for the maximum bit rate in octet 21.
Guaranteed bit rate for uplink (extended), octet 18
This field is an extension of the Guaranteed bit rate for uplink in octet 12. The coding is identical to that of the
Guaranteed bit rate for downlink (extended).
If the sending entity wants to indicate a Guaranteed bit rate for uplink higher than 256 Mbps, it shall set octet 18 to
"11111010", i.e. 256 Mbps, and shall encode the value for the guaranteed bit rate in octet 22.
Maximum bit rate for downlink (extended-2), octet 19

Bits
87654321
00000000 Use the value indicated by the Maximum bit rate for downlink in octet 9 and octet 15.
For all other values: Ignore the value indicated by the Maximum bit rate for downlink in octet 9 and
octet 15 and use the following value:
00000001 The maximum bit rate is 256 Mbps + ((the binary coded value in 8 bits) * 4 Mbps),
11110110 giving a range of values from 1600 Mbps to 10 Gbps in 100 Mbps increments.
If the sending entity wants to indicate a Maximum bit rate for downlink higher than 10 Gbps, it shall set octet 19 to
"11110110", i.e. 10 Gbps, and shall encode the value for the maximum bit rate in the extended quality of service
information element specified in subclause 10.5.6.5B.
The MS shall map all other values not explicitly defined onto the maximum value defined in this version of the protocol.
Guaranteed bit rate for downlink (extended-2), octet 20

Bits
87654321
00000000 Use the value indicated by the Maximum bit rate for downlink in octet 13 and octet 16.
For all other values: Ignore the value indicated by the Maximum bit rate for downlink in octet 13 and
octet 16 and use the following value:
00000001 The guaranteed bit rate is 256 Mbps + ((the binary coded value in 8 bits) * 4 Mbps),
ETSI
Release 18 696 3GPP TS 24.008 V18.4.0 (2023-09)
00111101 giving a range of values from 260 Mbps

to 500 Mbps in 4 Mbps increments.
11110110 giving a range of values from 1600 Mbps to 10 Gbps in 100 Mbps increments.
If the sending entity wants to indicate a Guaranteed bit rate for downlink higher than 10 Gbps, it shall set octet 20 to
"11110110", i.e. 10 Gbps, and shall encode the value for the guaranteed bit rate in the extended quality of service
Maximum bit rate for uplink (extended-2), octet 21
This field is an extension of the Maximum bit rate for uplink in octet 17. The coding is identical to that of the Maximum bit
rate for downlink (extended 2).
If the sending entity wants to indicate a Maximum bit rate for uplink higher than 10 Gbps, it shall set octet 21 to
"11110110", i.e. 10 Gbps, and shall encode the value for the maximum bit rate in the extended quality of service
Guaranteed bit rate for uplink (extended-2), octet 22
This field is an extension of the Guaranteed bit rate for uplink in octet 18. The coding is identical to that of the
Guaranteed bit rate for downlink (extended-2).
If the sending entity wants to indicate a Guaranteed bit rate for uplink higher than 10 Gbps, it shall set octet 22 to
"11110110", i.e. 10 Gbps, and shall encode the value for the guaranteed bit rate in the extended quality of service
10.5.6.5A Re-attempt indicator

The purpose of the Re-attempt indicator information element is to indicate a condition under which the MS is allowed,
in the current PLMN for the same APN, to re-attempt an EPS session management procedure (see
3GPP TS 24.301 [120]) corresponding to the session management procedure which was rejected by the network.
The Re-attempt indicator information element is coded as shown in figure 10.5.6.5A and table 10.5.6.5A.
8 7 6 5 4 3 2 1
Reattempt indicator IEI octet 1
Length of Reattempt indicator contents octet 2
0 0 0 0 0 0 EPLM RATC octet 3
Spare Spare Spare Spare Spare Spare NC value
value
Figure 10.5.6.5A: Re-attempt indicator information element
ETSI
Release 18 697 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.6.5A: Re-attempt indicator information element
Re-attempt indicator
RATC (octet 3, bit 1)
0 MS is allowed to re-attempt the procedure in S1 mode
1 MS is not allowed to re-attempt the procedure in S1 mode
EPLMNC (octet 3, bit 2)

0 MS is allowed to re-attempt the procedure in an equivalent PLMN
1 MS is not allowed to re-attempt the procedure in an equivalent PLMN
Bits 3 to 8 of octet 3 are spare and shall be encoded as zero.
10.5.6.5B Extended quality of service

See subclause 9.9.4.30 in 3GPP TS 24.301 [120].
NOTE: This IE has been added for protocol alignment with EPS in this version of the specification. This IE is
used only to indicate bit rates higher than 10 Gbps and such bit rates are currently not supported.
10.5.6.6 SM cause
The purpose of the SM cause information element is to indicate the reason why a session management request is
rejected.
The SM cause is a type 3 information element with 2 octets length.
The SM cause information element is coded as shown in figure 10.5.139/3GPP TS 24.008 and table 10.5.157/3GPP TS
24.008.
8 7 6 5 4 3 2 1
SM cause IEI octet 1
Cause value octet 2
Figure 10.5.139/3GPP TS 24.008: SM cause information element
ETSI
Release 18 698 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.157/3GPP TS 24.008: SM cause information element

Bits
87654321
00001000 Operator Determined Barring
00011000 MBMS bearer capabilities insufficient for the service
00011001 LLC or SNDCP failure(A/Gb mode only)
00011010 Insufficient resources
00011011 Missing or unknown APN
00011100 Unknown PDP address or PDP type
00011101 User authentication failed
00011110 Activation rejected by GGSN, Serving GW or PDN GW
00011111 Activation rejected, unspecified
00100000 Service option not supported
00100001 Requested service option not subscribed
00100010 Service option temporarily out of order
00100011 NSAPI already used (not sent)
00100100 Regular deactivation
00100101 QoS not accepted
00100110 Network failure
00100111 Reactivation requested
00101000 Feature not supported
00101001 Semantic error in the TFT operation
00101010 Syntactical error in the TFT operation
00101011 Unknown PDP context
00101100 Semantic errors in packet filter(s)
00101101 Syntactical errors in packet filter(s)
00101110 PDP context without TFT already activated
00101111 Multicast group membership time-out
00110000 Request rejected, BCM violation
00110010 PDP type IPv4 only allowed
00110011 PDP type IPv6 only allowed
00111001 PDP type IPv4v6 only allowed
00111010 PDP type non IP only allowed
00110100 Single address bearers only allowed
00111000 Collision with network initiated request
00111100 Bearer handling not supported
01000001 Maximum number of PDP contexts reached
01000010 Requested APN not supported in current RAT and PLMN combination
01010001 Invalid transaction identifier value
01011111 Semantically incorrect message
01100000 Invalid mandatory information
01100001 Message type non-existent or not implemented
01100010 Message type not compatible with the protocol state
01100011 Information element non-existent or not implemented
01100100 Conditional IE error
01100101 Message not compatible with the protocol state
01101111 Protocol error, unspecified
01110000 APN restriction value incompatible with active PDP context
0 1 1 1 0 0 0 1 Multiple accesses to a PDN connection not allowed
Any other value received by the mobile station shall be treated as 0010 0010, "Service
option temporarily out of order". Any other value received by the network shall be treated as
0110 1111, "Protocol error, unspecified".
NOTE: The listed cause values are defined in Annex I
10.5.6.6A SM cause 2
The purpose of the SM cause 2 information element is to provide further information when PDP context activation
initiated by the mobile station is successful.
The SM cause 2 is a type 4 information element with 3 octets length.
ETSI
Release 18 699 3GPP TS 24.008 V18.4.0 (2023-09)
The SM cause 2 information element is coded as shown in figure 10.5.139a/3GPP TS 24.008 and table 10.5.157a/3GPP
TS 24.008.
8 7 6 5 4 3 2 1
SM cause 2 IEI octet 1
Length of SM cause 2 contents octet 2
SM cause 2 value octet 3
Figure 10.5.139a/3GPP TS 24.008: SM cause 2 information element
Table 10.5.157a/3GPP TS 24.008: SM cause 2 information element
SM cause 2 value is coded as octet 2 of the SM cause information element.
10.5.6.7 Linked TI
The purpose of the Linked TI information element is to specify the active PDP context from which the PDP address for
the new PDP context could be derived by the network.
The Linked TI is a type 4 information element with a minimum length of 3 octets and a maximum length of 4 octets.
The Linked TI information element is coded as shown in figure 10.5.140/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Linked TI IEI octet 1
Length of Linked TI IE octet 2
0000
TI flag TI value octet 3
Spare
1
TI value octet 4
EXT
Figure 10.5.140/3GPP TS 24.008: Linked TI information element
The coding of the TI flag, the TI value and the EXT bit is defined in 3GPP TS 24.007[20].
10.5.6.8 Spare
10.5.6.9 LLC service access point identifier

The purpose of the LLC service access point identifier information element is to identify the service access point that is
used for the GPRS data transfer at LLC layer.
The LLC service access point identifier is a type 3 information element with a length of 2 octets.
The value part of a LLC service access point identifier information element is coded as shown in figure 10.5.141/3GPP
TS 24.008 and table 10.5.159/3GPP TS 24.008.
8 7 6 5 4 3 2 1
LLC SAPI IEI octet 1
0 0 0 0 LLC SAPI octet 2
Spare value
Figure 10.5.141/3GPP TS 24.008: LLC service access point identifier information element
ETSI
Release 18 700 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.159/3GPP TS 24.008: LLC service access point identifier information element
LLC SAPI value (octet 2)
Bit
4321
0000 LLC SAPI not assigned
0011 SAPI 3
0101 SAPI 5
1001 SAPI 9
1011 SAPI 11
10.5.6.10 Tear down indicator

The purpose of the tear down indicator information element is to indicate whether only the PDP context associated with
this specific TI or all active PDP contexts sharing the same PDP address and APN as the PDP context associated with
this specific TI shall be deactivated.
The tear down indicator is a type 1 information element.
The tear down indicator information element is coded as shown in figure 10.5.142/3GPP TS 24.008 and
table 10.5.160/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Tear down indicator 0 0 0 TDI octet 1
IEI spare flag
Figure 10.5.142/3GPP TS 24.008: Tear down indicator information element
Table 10.5.160/3GPP TS 24.008: Tear down indicator information element
Tear down indicator(TDI) flag (octet 1)
Bit
1
0 tear down not requested
1 tear down requested

The Packet Flow Identifier (PFI) information element indicates the Packet Flow Identifier for a Packet Flow Context.
The Packet Flow Identifier is a a type 4 information element with 3 octets length.
The Packet Flow Identifier information element is coded as shown in figure 10.5.143/3GPP TS 24.008 and
table 10.5.161/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Packet Flow Identifier IEI octet 1
Length of Packet Flow Identifier IE octet 2
Spare Packet Flow Identifier value octet 3
0
ETSI
Release 18 701 3GPP TS 24.008 V18.4.0 (2023-09)
Figure 10.5.143/3GPP TS 24.008: Packet Flow Identifier information element
Table 10.5.161/3GPP TS 24.008: Packet Flow Identifier information element
Packet Flow Identifier value (octet 3)

Bits
7654321
0 0 0 0 0 0 0 Best Effort
0 0 0 0 0 0 1 Signaling
0 0 0 0 0 1 0 SMS
0 0 0 0 0 1 1 TOM8
0000100 }
to } reserved
0000111 }
0001000 }
to } dynamically assigned
1111111 }
10.5.6.12 Traffic Flow Template

The purpose of the traffic flow template information element is to specify the TFT parameters and operations for a PDP
context. In addition, this information element may be used to transfer extra parameters to the network (e.g. the
Authorization Token; see 3GPP TS 24.229 [95]). The TFT may contain packet filters for the downlink direction, the
uplink direction or packet filters that are applicable to both directions. The packet filters determine the traffic mapping
to PDP contexts. The downlink packet filters shall be used by the network and the uplink packet filters shall be used by
the MS. A packet filter that is applicable to both directions shall be used by the network as a downlink packet filter and
by the MS as an uplink packet filter.
The traffic flow template is a type 4 information element with a minimum length of 3 octets. The maximum length for
the IE is 257 octets.
NOTE 1: The IE length restriction is due to the maximum length that can be encoded in a single length octet.
NOTE 2: A maximum size IPv4 packet filter can be 36 bytes. Therefore, 7 maximum size IPv4 type packet filters
can fit into one TFT IE, i.e. if needed not all packet filter components can be defined into one message. A
maximum size IPv6 packet filter can be 54 bytes. Therefore, only 4 maximum size IPv6 packet filters,
plus the last packet filter which can contain max 38 octets can fit into one TFT IE. However, using "Add
packet filters to existing TFT", it's possible to create a TFT data structure including 16 maximum size
IPv4 or IPv6 filters.
The traffic flow template information element is coded as shown in figure 10.5.144/3GPP TS 24.008 and table
10.5.162/3GPP TS 24.008.
NOTE 3: The 3GPP TS 24.301 [120] reuses the traffic flow template information element for the purpose of the
traffic flow aggregate description, where the use of individual TFT parameters, e.g. the packet filter
identifier in the parameter list, can differ from this specification.
ETSI
Release 18 702 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Traffic flow template IEI Octet 1
Length of traffic flow template IE Octet 2
TFT operation code E bit Number of packet filters Octet 3
Octet 4
Packet filter list
Octet z
Octet
Parameters list (z+1)*
Octet v*
Figure 10.5.144/3GPP TS 24.008: Traffic flow template information element
8 7 6 5 4 3 2 1
0 0 0 0 Packet filter identifier 1 Octet 4
Spare
0 0 0 0 Packet filter identifier 2 Octet 5
Spare
…
0 0 0 0 Packet filter identifier N Octet N+3
Spare
Figure 10.5.144a/3GPP TS 24.008: Packet filter list when the TFT operation is "delete packet filters
from existing TFT" (z=N+3)
8 7 6 5 4 3 2 1
0 0 Packet filter Packet filter identifier 1 Octet 4
Spare direction 1
Packet filter evaluation precedence 1 Octet 5
Length of Packet filter contents 1 Octet 6
Packet filter contents 1 Octet 7
Octet m
0 0 Packet filter Packet filter identifier 2 Octet m+1
Spare direction 2
Packet filter evaluation precedence 2 Octet m+2
Length of Packet filter contents 2 Octet m+3
Packet filter contents 2 Octet m+4
Octet n
… Octet n+1
Octet y
0 0 Packet filter Packet filter identifier N Octet y+1
Spare direction N
Packet filter evaluation precedence N Octet y+2
Length of Packet filter contents N Octet y+3
Packet filter contents N Octet y+4
Octet z
Figure 10.5.144b/3GPP TS 24.008: Packet filter list when the TFT operation is "create new TFT", or
"add packet filters to existing TFT" or "replace packet filters in existing TFT"
ETSI
Release 18 703 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Parameter identifier 1 Octet z+1
Length of Parameter contents 1 Octet z+2
Parameter contents 1 Octet z+3
Octet k
Parameter identifier 2 Octet k+1
Length of Parameter contents 2 Octet k+2
Parameter contents 2 Octet k+3
Octet p
… Octet p+1
Octet q
Parameter identifier N Octet q+1
Length of Parameter contents N Octet q+2
Parameter contents N Octet q+3
Octet v
Figure 10.5.144c/3GPP TS 24.008: Parameters list
ETSI
Release 18 704 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.162/3GPP TS 24.008: Traffic flow template information element
ETSI
Release 18 705 3GPP TS 24.008 V18.4.0 (2023-09)
TFT operation code (octet 3)

Bits
876
0 0 0 Ignore this IE
0 0 1 Create new TFT
0 1 0 Delete existing TFT
0 1 1 Add packet filters to existing TFT
1 0 0 Replace packet filters in existing TFT
1 0 1 Delete packet filters from existing TFT
1 1 0 No TFT operation
1 1 1 Reserved
The TFT operation code "No TFT operation" shall be used if a parameters list is
included but no packet filter list is included in the traffic flow template information
element.
The TFT operation code "Ignore this IE" shall be used by the MS if the Traffic flow
aggregate information element has presence requirement "M" in a message, but the
information element does not serve any useful purpose in the specific procedure for
which the message is sent (see 3GPP TS 24.301 [120], subclauses 6.5.3.2 and
6.5.4.2). If the TFT operation code indicates "Ignore this IE", the MS shall also set
the E bit and the number of packet filters to zero.
If the TFT operation code is set to "Ignore this IE" and the E bit and the number of
packet filters to zero, then the network shall ignore the contents of the traffic flow
template information element.
E bit (bit 5 of octet 3)

The E bit indicates if a parameters list is included in the TFT IE and it is encoded as
follows:
0 parameters list is not included
1 parameters list is included
Number of packet filters (bits 1 to 4 of octet 3)

The number of packet filters contains the binary coding for the number of packet
filters in the packet filter list. The number of packet filters field is encoded in bits 4
through 1 of octet 3 where bit 4 is the most significant and bit 1 is the least
significant bit. For the "delete existing TFT" operation and for the "no TFT
operation", the number of packet filters shall be coded as 0. For all other operations,
the number of packet filters shall be greater than 0 and less than or equal to 15.
Packet filter list (octets 4 to z)

The packet filter list contains a variable number of packet filters. For the "delete
existing TFT" operation and the "no TFT operation", the packet filter list shall be
empty.
For the "delete packet filters from existing TFT" operation, the packet filter list shall
contain a variable number of packet filter identifiers. This number shall be derived
from the coding of the number of packet filters field in octet 3.
For the "create new TFT", "add packet filters to existing TFT" and "replace packet
filters in existing TFT" operations, the packet filter list shall contain a variable
number of packet filters. This number shall be derived from the coding of the
number of packet filters field in octet 3.
Each packet filter is of variable length and consists of

- a packet filter identifier and direction (1 octet);
- a packet filter evaluation precedence (1 octet);
- the length of the packet filter contents (1 octet); and
- the packet filter contents itself (v octets).
The packet filter identifier field is used to identify each packet filter in a TFT. The
least significant 4 bits are used.
The packet filter direction is used to indicate, in bits 5 and 6, for what traffic direction
the filter applies:
00 - pre Rel-7 TFT filter
ETSI
Release 18 706 3GPP TS 24.008 V18.4.0 (2023-09)
01 - downlink only
10 - uplink only
11 - bidirectional
Bits 8 through 7 are spare bits.
The packet filter evaluation precedence field is used to specify the precedence for
the packet filter among all packet filters in all TFTs associated with this PDP
address. Higher the value of the packet filter evaluation precedence field, lower the
precedence of that packet filter is. The first bit in transmission order is the most
significant bit.
The length of the packet filter contents field contains the binary coded
representation of the length of the packet filter contents field of a packet filter. The
first bit in transmission order is the most significant bit.
The packet filter contents field is of variable size and contains a variable number (at
least one) of packet filter components. Each packet filter component shall be
encoded as a sequence of a one octet packet filter component type identifier and a
fixed length packet filter component value field. The packet filter component type
identifier shall be transmitted first.
In each packet filter, there shall not be more than one occurrence of each packet
filter component type. Among the "IPv4 local address type" and "IPv6 local address
type" packet filter components, only one shall be present in one packet filter. Among
the "IPv4 remote address type" and "IPv6 remote address type" packet filter
components, only one shall be present in one packet filter. Among the "single local
port type" and "local port range type" packet filter components, only one shall be
present in one packet filter. Among the "single remote port type" and "remote port
range type" packet filter components, only one shall be present in one packet filter.
If the "Ethertype type" packet filter component is present in the packet filter and the
"Ethertype type" packet filter component value is neither 0800H (for IPv4) nor
86DDH (for IPv6), no IP packet filter component shall be present in the packet filter.
The term "IP packet filter component" refers to "IPv4 remote address type", "IPv4
local address type", "IPv6 remote address/prefix length type", "IPv6 local
address/prefix length type", "Protocol identifier/Next header type", "Single local port
type", "Local port range type", "Single remote port type", "Remote port range type",
"Security parameter index type", "Type of service/Traffic class type" and "Flow label
type".
The term local refers to the MS and the term remote refers to an external network
entity.
Packet filter component type identifier

Bits
87654321
00010000 IPv4 remote address type
00010001 IPv4 local address type
00100000 IPv6 remote address type
00100001 IPv6 remote address/prefix length type
00100011 IPv6 local address/prefix length type
00110000 Protocol identifier/Next header type
01000000 Single local port type
01000001 Local port range type
01010000 Single remote port type
01010001 Remote port range type
01100000 Security parameter index type
01110000 Type of service/Traffic class type
10000000 Flow label type
10000001 Destination MAC address type
10000010 Source MAC address type
10000011 802.1Q C-TAG VID type
10000100 802.1Q S-TAG VID type
10000101 802.1Q C-TAG PCP/DEI type
10000110 802.1Q S-TAG PCP/DEI type
10000111 Ethertype type
ETSI
Release 18 707 3GPP TS 24.008 V18.4.0 (2023-09)
The description and valid combinations of packet filter component type identifiers in
a packet filter are defined in 3GPP TS 23.060 [74] subclause 15.3.2.
For "IPv4 remote address type", the packet filter component value field shall be
encoded as a sequence of a four octet IPv4 address field and a four octet IPv4
address mask field. The IPv4 address field shall be transmitted first.
For "IPv4 local address type", the packet filter component value field shall be
encoded as defined for "IPv4 remote address type".
Both the MS and network indication for support of the Local address in TFTs are
required to use this packet filter component.
For "IPv6 remote address type", the packet filter component value field shall be
encoded as a sequence of a sixteen octet IPv6 address field and a sixteen octet
IPv6 address mask field. The IPv6 address field shall be transmitted first.
For "IPv6 remote address/prefix length type", the packet filter component value field
shall be encoded as a sequence of a sixteen octet IPv6 address field and one octet
prefix length field. The IPv6 address field shall be transmitted first.
This parameter shall be used, instead of IPv6 remote address type, when both the
MS and network indication for support of the Local address in TFT are present.
For "IPv6 local address/prefix length type", the packet filter component value field
shall be encoded as defined for "IPv6 remote address /prefix length".
Both the MS and network indication for support of the Local address in TFTs are
required to use this packet filter component.
NOTE 1: Local IP address and mask can be used when IPv6 prefix delegation is
used (see 3GPP TS 23.060 [74] subclause 9.2.1.2).
NOTE 2: After inter-system change from N1 mode to S1 mode, the MS operating
in single-registration mode in a network supporting N26 interface shall
deem that Local address in TFT is supported by the network on the PDN
connection corresponding to the PDU session (see subclause 6.1.4.1 of
3GPP TS 24.501 [167]).
For "Protocol identifier/Next header type", the packet filter component value field
shall be encoded as one octet which specifies the IPv4 protocol identifier or IPv6
next header.
For "Single local port type" and "Single remote port type", the packet filter
component value field shall be encoded as two octet which specifies a port number.
For "Local port range type" and "Remote port range type", the packet filter
component value field shall be encoded as a sequence of a two octet port range low
limit field and a two octet port range high limit field. The port range low limit field
shall be transmitted first.
For "Security parameter index", the packet filter component value field shall be
encoded as four octet which specifies the IPSec security parameter index.
For "Type of service/Traffic class type", the packet filter component value field shall
be encoded as a sequence of a one octet Type-of-Service/Traffic Class field and a
one octet Type-of-Service/Traffic Class mask field. The Type-of-Service/Traffic
Class field shall be transmitted first.
For "Flow label type", the packet filter component value field shall be encoded as
three octet which specifies the IPv6 flow label. The bits 8 through 5 of the first octet
shall be spare whereas the remaining 20 bits shall contain the IPv6 flow label.
Parameters list (octets z+1 to v)
For "destination MAC address type" and "source MAC address type", the packet
filter component value field shall be encoded as 6 octets which specify a MAC
address. When the packet filter direction field indicates "bidirectional", the
destination MAC address is the remote MAC address and the source MAC address
is the local MAC address.
For "802.1Q C-TAG VID type", the packet filter component value field shall be
ETSI
Release 18 708 3GPP TS 24.008 V18.4.0 (2023-09)
encoded as two octets which specify the VID of the customer-VLAN tag (C-TAG).
The bits 8 through 5 of the first octet shall be spare whereas the remaining 12 bits
shall contain the VID. If there are more than one C-TAG in the Ethernet frame
header, the outermost C-TAG is evaluated.
For "802.1Q S-TAG VID type", the packet filter component value field shall be
encoded as two octets which specify the VID of the service-VLAN tag (S-TAG). The
bits 8 through 5 of the first octet shall be spare whereas the remaining 12 bits shall
contain the VID. If there are more than one S-TAG in the Ethernet frame header, the
outermost S-TAG is evaluated.
For "802.1Q C-TAG PCP/DEI type", the packet filter component value field shall be
encoded as one octet which specifies the 802.1Q C-TAG PCP and DEI. The bits 8
through 5 of the octet shall be spare, the bits 4 through 2 contain the PCP and bit 1
contains the DEI. If there are more than one C-TAG in the Ethernet frame header,
the outermost C-TAG is evaluated.
For "802.1Q S-TAG PCP/DEI type", the packet filter component value field shall be
encoded as one octet which specifies the 802.1Q S-TAG PCP. The bits 8 through 5
of the octet shall be spare, the bits 4 through 2 contain the PCP and bit 1 contains
the DEI. If there are more than one S-TAG in the Ethernet frame header, the
outermost S-TAG is evaluated.
For "ethertype type", the packet filter component value field shall be encoded as two
octets which specify an ethertype.
The parameters list contains a variable number of parameters that may be

transferred. If the parameters list is included, the E bit is set to 1; otherwise, the E
bit is set to 0.
Each parameter included in the parameters list is of variable length and consists of:
- a parameter identifier (1 octet);
- the length of the parameter contents (1 octet); and
- the parameter contents itself (v octets).
The parameter identifier field is used to identify each parameter included in the
parameters list and it contains the hexadecimal coding of the parameter identifier.
Bit 8 of the parameter identifier field contains the most significant bit and bit 1
contains the least significant bit. In this version of the protocol, the following
parameter identifiers are specified:
- 01H (Authorization Token);
- 02H (Flow Identifier); and
- 03H (Packet Filter Identifier).
If the parameters list contains a parameter identifier that is not supported by the
receiving entity the corresponding parameter shall be discarded.
The length of parameter contents field contains the binary coded representation of
the length of the parameter contents field. The first bit in transmission order is the
most significant bit.
When the parameter identifier indicates Authorization Token, the parameter

contents field contains an authorization token, as specified in 3GPP TS 29.207
[100]. The first octet is the most significant octet of the authorization token and the
last octet is the least significant octet of the authorization token.
The parameters list shall be coded in a way that an Authorization Token (i.e. a
parameter with identifier 01H) is always followed by one or more Flow Identifiers
(i.e. one or more parameters with identifier 02H).
If the parameters list contains two or more consecutive Authorization Tokens without
any Flow Identifiers in between, the receiver shall treat this as a semantical TFT
error.
When the parameter identifier indicates Flow Identifier, the parameter contents field
contains the binary representation of a flow identifier. The Flow Identifier consists of
four octets. Octets 1 and 2 contains the Media Component number as specified in
3GPP TS 29.207 [100]. Bit 1 of octet 2 is the least significant bit, and bit 8 of octet 1
is the most significant bit. Octets 3 and 4 contains the IP flow number as specified in
3GPP TS 29.207 [100]. Bit 1 of octet 4 is the least significant bit, and bit 8 of octet 3
ETSI
Release 18 709 3GPP TS 24.008 V18.4.0 (2023-09)
is the most significant bit.
When the parameter identifier indicates Packet Filter Identifier, the parameter
contents field contains the binary representation of one or more packet filter
identifiers. Each packet filter identifier is encoded in one octet, in the 4 least
significant bits. This parameter is used by the MS and the network to identify one or
more packet filters in a TFT when modifying the QoS of a PDP context without
modifying the packet filter itself.
10.5.6.13 Temporary Mobile Group Identity (TMGI)

The purpose of the TMGI element is for group paging in MBMS.
The TMGI information element is a type 4 information element with a minimum length of 5 octets and a maximum
length of 8 octets. If octet 6 is included, then octets 7 and 8 shall also be included.
The content of the TMGI element is shown in Figure 10.5.154/3GPP TS 24.008 and table 10.5.168/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Temporary Mobile Group Identity IEI Octet 1
Length of Temporary Mobile Group Identity contents Octet 2
Octet 3
MBMS Service ID Octet 4
Octet 5
MCC digit 2 MCC digit 1 Octet 6*
MNC digit 3 MCC digit 3 Octet 7*
MNC digit 2 MNC digit 1 Octet 8*
Figure 10.5.154/3GPP TS 24.008: TMGI information element
Table 10.5.168/3GPP TS 24.008: TMGI information element
MBMS Service ID (octet 3, 4 and 5)
In the MBMS Service ID field bit 8 of octet 3 is the most significant bit and bit 1 of octet 5 the least significant bit.
The coding of the MBMS Service ID is the responsibility of each administration. Coding using full hexadecimal
representation may be used. The MBMS Service ID consists of 3 octets.
The MCC field is coded as in ITU-T Rec. E.212 [46], Annex A.
The coding of this field is the responsibility of each administration but BCD coding shall be used. The MNC shall
consist of 2 or 3 digits. If a network operator decides to use only two digits in the MNC, bits 5 to 8 of octet 7 shall
be coded as "1111".
10.5.6.14 MBMS bearer capabilities

The purpose of the MBMS bearer capabilities information element is to indicate the maximum bit rate for downlink
supported by the MS for an MBMS context.
NOTE: The information element indicates the static physical capabilities of the MS, independent of the radio
access (UTRAN or GERAN), the radio conditions, or other CS or PS services possibly activated by the
MS.
ETSI
Release 18 710 3GPP TS 24.008 V18.4.0 (2023-09)
The MBMS bearer capabilities is a type 4 information element with a maximum length of 4 octets.
The MBMS bearer capabilities information element is coded as shown in figure 10.5.155/3GPP TS 24.008 and
table 10.5.169/3GPP TS 24.008.
8 7 6 5 4 3 2 1
MBMS bearer capabilities IEI Octet 1
Length of MBMS bearer capabilities IE Octet 2
Maximum bit rate for downlink Octet 3
Maximum bit rate for downlink (extended) Octet 4
Figure 10.5.155/3GPP TS 24.008: MBMS bearer capabilities information element
Table 10.5.169/3GPP TR 24.008: MBMS bearer capabilities information element
Maximum bit rate for downlink, octet 3 (see 3GPP TS 23.107 [81])
The coding is identical to that of the maximum bit rate for downlink, octet 9, in the Quality of service information element
(see subclause 10.5.6.5).
If the sending entity wants to indicate a maximum bit rate for downlink higher than 8640 kbps, it shall set octet 3 to
"11111110", i.e. 8640 kbps, and shall encode the value for the maximum bit rate in octet 4.
Maximum bit rate for downlink (extended), octet 4
The coding is identical to that of the maximum bit rate for downlink (extended), octet 15, in the Quality of service
information element (see subclause 10.5.6.5).

The purpose of the MBMS protocol configuration options information element is to:
- transfer protocol options associated with the bearer level of an MBMS context activation, and
- transfer additional MBMS bearer related (protocol) data (e.g. configuration parameters, error codes or
messages/events).
The MBMS protocol configuration options is a type 4 information element with a minimum length of 3 octets and a
The MBMS protocol configuration options information element is coded as shown in figure 10.5.156/3GPP TS 24.008
and table 10.5.170/3GPP TS 24.008.
8 7 6 5 4 3 2 1
MBMS protocol configuration options IEI octet 1
Length of MBMS protocol configuration options contents octet 2
0 0 0 0 0 0 0 0 octet 3
Spare
Figure 10.5.156/3GPP TS 24.008: MBMS protocol configuration options information element
ETSI
Release 18 711 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.170/3GPP TR 24.008: MBMS protocol configuration options information element
Bits 1 to 8 of octet 3 are spare and shall be coded as "0".
NOTE: The reason for defining the information element is to have a transparent
mechanism in the SGSN available from the introduction of MBMS. This
will ensure that MS – GGSN communication is possible if new MBMS
bearer service related parameters are defined.
10.5.6.16 Enhanced network service access point identifier

The purpose of the Enhanced network service access point identifier information element is to identify the service
access point that is used at layer 3.
The Enhanced network service access point identifier is a type 3 information element with a length of 2 octets.
The value part of an Enhanced network service access point identifier information element is coded as shown in
8 7 6 5 4 3 2 1
Enhanced NSAPI IEI octet 1
Enhanced NSAPI octet 2
value
Figure 10.5.157/3GPP TS 24.008: Enhanced network service access point identifier information
element
Table 10.5.171/3GPP TS 24.008: Enhanced network service access point identifier information
element
Enhanced NSAPI value (octet 2, bits 1 to 7)
Bits
8 7 6 5 4 3 2 1
0 0 0 0 0 0 0 0 Reserved
through
0 1 1 1 1 1 1 1 Reserved
1 0 0 0 0 0 0 0 NSAPI 128 for Multimedia Broadcast/Multicast

Service (MBMS) Multicast mode
through
1 1 1 1 1 1 1 0 NSAPI 254 for Multimedia Broadcast/Multicast
Service (MBMS) Multicast mode
1 1 1 1 1 1 1 1 Reserved (NOTE)
NOTE: NSAPI 255 is reserved for use by lower layers in the point-to-point radio bearer
allocation message for Multimedia Broadcast/Multicast Service (MBMS)
Broadcast mode (see 3GPP TS 25.331 [23c]).
10.5.6.17 Request type

The purpose of the Request type information element is to indicate whether the MS requests to establish a new
connectivity to a PDN or keep the connection(s) to which it has connected via non-3GPP access, or to keep the PDU
session to which it has connected via 3GPP access or non-3GPP access.
The Request type information element is also used to indicate that the MS is requesting connectivity to a PDN that
provides emergency bearer services, or DN that provides emergency services or keep the connection that provides
emergency services to which it has connected via non-3GPP access, or to keep the PDU session to which it has
connected via 3GPP access or non-3GPP access.
ETSI
Release 18 712 3GPP TS 24.008 V18.4.0 (2023-09)
The Request type information element is coded as shown in figure 10.5.158/3GPP TS 24.008 and
table 10.5.173/3GPP TS 24.008.
The Request type is a type 1 information element.
8 7 6 5 4 3 2 1
Request type IEI 0 Request type value octet 1
Spare
Figure 10.5.158/3GPP TS 24.008: Request type information element
Table 10.5.173/3GPP TS 24.008: Request type information element
Request type value (octet 1)

Bits
3 2 1
0 0 1 initial request
0 1 0 Handover (NOTE 1)
0 1 1 RLOS (NOTE 3)
1 0 0 emergency
1 1 0 handover of emergency bearer services (NOTE 1) (NOTE 2)
NOTE 1: This code point denotes a transfer of a PDN connection from non-3GPP
access to 3GPP access (and vice versa), or a transfer of a PDU session
from N1 mode to S1 mode (see 3GPP TS 24.501 [167]). Such transfers are
not handovers controlled by 3GPP connected mode mobility procedures as
specified in e.g. 3GPP TS 25.331 [23c] or 3GPP TS 36.331 [129].
NOTE 2: "handover of emergency bearer services" is not applicable in A/Gb-mode
and Iu-mode and shall be treated as "reserved".
NOTE 3: "RLOS" is not applicable in A/Gb-mode and Iu-mode and shall be treated as
"initial request". "RLOS" shall be treated as "initial request" in S1 mode by
network not supporting access to RLOS.
10.5.6.18 Notification indicator

The purpose of the Notification indicator information element is to inform the MS about an event which is relevant for
the upper layer using a PDP context or having requested a session management procedure.
The Notification indicator information element is coded as shown in figure 10.5.159/3GPP TS 24.008 and
table 10.5.174/3GPP TS 24.008.
The Notification indicator is a type 4 information element with 3 octets length.
8 7 6 5 4 3 2 1
Notification indicator IEI octet 1
Length of notification indicator contents octet 2
Notification indicator value octet 3
Figure 10.5.159/3GPP TS 24.008: Notification indicator information element
ETSI
Release 18 713 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.174/3GPP TS 24.008: Notification indicator information element
Notification indicator value (octet 3)
Bits
8 7 6 5 4 3 2 1
0 0 0 0 0 0 0 1 SRVCC handover cancelled, IMS session re-
establishment required (see 3GPP TS 23.216 [126])
0 0 0 0 0 0 1 0
to Unused, shall be ignored if received by the MS
0 1 1 1 1 1 1 1
10.5.6.19 Connectivity type

The purpose of the Connectivity type information element is to specify the type of connectivity selected by the network
for the PDN connection.
The Connectivity type information element is coded as shown in figure 10.5.6.19-1/3GPP TS 24.008 and
table 10.5.6.19-1/3GPP TS 24.008.
The Connectivity type is a type 1 information element.
8 7 6 5 4 3 2 1
Connectivity type Connectivity type octet 1
IEI value
Figure 10.5.6.19-1/3GPP TS 24.008: Connectivity type information element
Table 10.5.6.19-1/3GPP TS 24.008: Connectivity type information element
Connectivity type value (octet 1)

Bits
4321
0000 The PDN connection type is not indicated
0001 The PDN connection is considered a LIPA PDN connection
All other values shall be interpreted as "the PDN connection type is not
indicated".
10.5.6.20 WLAN offload acceptability

The purpose of the WLAN offload acceptability information element is to indicate whether traffic can be offloaded using
a PDN connection via a WLAN, or not.
The values "offloading the traffic of the PDN connection via a WLAN when in S1 mode is acceptable" and "offloading
the traffic of the PDN connection via a WLAN when in Iu mode is acceptable" map to "indication that the PDP context
is offloadable" as defined in 3GPP TS 23.060 [74] and 3GPP TS 23.401 [122]. The value "offloading the traffic of the
PDN connection via a WLAN when in S1 mode is not acceptable" and "offloading the traffic of the PDN connection
via a WLAN when in Iu mode is not acceptable" map to "indication that the PDP context is not offloadable" as defined
in 3GPP TS 23.060 [74] and 3GPP TS 23.401 [122]. The procedures in 3GPP TS 23.060 [74] when the MS receives the
UTRAN offload acceptability value in A/Gb mode or Iu mode apply. The procedures in 3GPP TS 23.401 [122] when
the MS receives the E-UTRAN offload acceptability value in S1 mode apply.
The WLAN offload acceptability information element is coded as shown in figure 10.5.6.20-1/3GPP TS 24.008 and
table 10.5.6.20-1/3GPP TS 24.008.
ETSI
Release 18 714 3GPP TS 24.008 V18.4.0 (2023-09)
The WLAN offload acceptability is a type 1 information element.
8 7 6 5 4 3 2 1
WLAN offload acceptability 0 0 UTRAN E-UTRAN octet 1
IEI spare spare offload offload
acceptability acceptabilit
value y value
Figure 10.5.6.20-1/3GPP TS 24.008: WLAN offload acceptability information element
Table 10.5.6.20-1/3GPP TS 24.008: WLAN offload acceptability information element
E-UTRAN offload acceptability value (octet 1)

Bit
1
0 Offloading the traffic of the PDN connection via a WLAN when in S1 mode is not acceptable
1 Offloading the traffic of the PDN connection via a WLAN when in S1 mode is acceptable
UTRAN offload acceptability value (octet 1)

Bit
2
0 Offloading the traffic of the PDN connection via a WLAN when in Iu mode is not acceptable
1 Offloading the traffic of the PDN connection via a WLAN when in Iu mode is acceptable
Bits 3 and 4 of octet 1 are spare and shall be coded as zero

The purpose of the NBIFOM container information element is to transfer parameters associated with the network-based
IP flow mobility (NBIFOM).
The NBIFOM container is a type 4 information element with a minimum length of 3 octets and a maximum length of
257 octets.
The NBIFOM container information element is coded as shown in figure 10.5.6.21-1/3GPP TS 24.008 and
table 10.5.6.21-1/3GPP TS 24.008.
8 7 6 5 4 3 2 1
NBIFOM container IEI octet 1
Length of NBIFOM container contents octet 2
octet 3
NBIFOM container contents
octet x
Figure 10.5.6.21-1/3GPP TS 24.008: NBIFOM container information element
Table 10.5.6.21-1/3GPP TS 24.008: NBIFOM container information element
NBIFOM container contents field contains the NBIFOM parameter list as defined in
3GPP TS 24.161 [158], subclause 6.1.
10.5.7 GPRS Common information elements

The purpose of the PDP context status information element is to indicate the state of each PDP context which can be
identified by NSAPI.
ETSI
Release 18 715 3GPP TS 24.008 V18.4.0 (2023-09)
The PDP context status information element is a type 4 information element with 4 octets length.
The PDP context status information element is coded as shown in figure 10.5.148/3GPP TS 24.008 and
table 10.5.164/3GPP TS 24.008.
8 7 6 5 4 3 2 1
PDP context status IEI octet 1
Length of PDP context status contents Octet 2
NSAPI NSAPI NSAPI NSAPI NSAPI NSAPI NSAPI NSAPI octet 3
(7) (6) (5) (4) (3) (2) (1) (0)
(15) (14) (13) (12) (11) (10) (9) (8)
Figure 10.5.148/3GPP TS 24.008 PDP context status information element
Table 10.5.164/3GPP TS 24.008: PDP context status information element
NSAPI(x) shall be coded as follows:
NSAPI(0) - NSAPI(4):
are coded as '0' and shall be treated as spare in this version of the protocol.
NSAPI(5) – NSAPI(15):
0 indicates that the SM state of the corresponding PDP context is PDP-INACTIVE.
1 indicates that the SM state of the corresponding PDP context is not PDP-INACTIVE.
10.5.7.2 Radio priority

The purpose of the radio priority information element is to specify the priority level that the MS shall use at the lower
layers for transmission of data related to a PDP context or for mobile originated SMS transmission.
The radio priority information element is coded as shown in figure 10.5.145/3GPP TS 24.008 and
table 10.5.161/3GPP TS 24.008.
The radio priority is a type 1 information element.
8 7 6 5 4 3 2 1
Radio priority IEI 0 Radio priority octet 1
spare level value
Figure 10.5.145/3GPP TS 24.008: Radio priority information element
Table 10.5.161/3GPP TS 24.008: Radio priority information element
Radio priority level value (octet 1)

Bits
321
001 priority level 1 (highest)

010 priority level 2
011 priority level 3
100 priority level 4 (lowest)
All other values are interpreted as priority level 4 by this version of

the protocol.
ETSI
Release 18 716 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.7.3 GPRS Timer

The purpose of the GPRS timer information element is to specify GPRS specific timer values, e.g. for the READY
timer.
The GPRS timer is a type 3 information element with 2 octets length.
The GPRS timer information element is coded as shown in figure 10.5.146/3GPP TS 24.008 and table 10.5.172/3GPP
TS 24.008.
8 7 6 5 4 3 2 1
GPRS Timer IEI octet 1
Unit Timer value octet 2
Figure 10.5.146/3GPP TS 24.008: GPRS Timer information element
Table 10.5.172/3GPP TS 24.008: GPRS Timer information element
Timer value (octet 2)
Bits 6 to 8 defines the timer value unit for the GPRS timer as follows:
Bits
876
0 1 0 value is incremented in multiples of decihours
1 1 1 value indicates that the timer is deactivated.
Other values shall be interpreted as multiples of 1 minute in this version of the

protocol.
10.5.7.4 GPRS Timer 2

The purpose of the GPRS timer 2 information element is to specify GPRS specific timer values, e.g. for the timer T3302
or timer T3319.
The GPRS timer 2 is a type 4 information element with 3 octets length.
The GPRS timer 2 information element is coded as shown in figure 10.5.147/3GPP TS 24.008 and table 10.5.163/3GPP
TS 24.008.
8 7 6 5 4 3 2 1
GPRS Timer 2 IEI octet 1
Length of GPRS Timer 2 contents octet 2
GPRS Timer 2 value octet 3
Figure 10.5.147/3GPP TS 24.008: GPRS Timer 2 information element
Table 10.5.163/3GPP TS 24.008: GPRS Timer 2 information element
GPRS Timer 2 value is coded as octet 2 of the GPRS timer information element.
ETSI
Release 18 717 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.7.4a GPRS Timer 3

The purpose of the GPRS timer 3 information element is to specify GPRS specific timer values, e.g. for the
timer T3396.
The GPRS timer 3 is a type 4 information element with 3 octets length.
The GPRS timer 3 information element is coded as shown in figure 10.5.147a/3GPP TS 24.008 and
table 10.5.163a/3GPP TS 24.008.
8 7 6 5 4 3 2 1
GPRS Timer 3 IEI octet 1
Length of GPRS Timer 3 contents octet 2
Unit Timer value octet 3
Figure 10.5.147a/3GPP TS 24.008: GPRS Timer 3 information element
Table 10.5.163a/3GPP TS 24.008: GPRS Timer 3 information element
GPRS Timer 3 value (octet 3)
Bits 6 to 8 defines the timer value unit for the GPRS timer as follows:
Bits
876
0 0 0 value is incremented in multiples of 10 minutes
0 0 1 value is incremented in multiples of 1 hour
0 1 0 value is incremented in multiples of 10 hours
1 1 0 value is incremented in multiples of 320 hours (NOTE 1)
1 1 1 value indicates that the timer is deactivated (NOTE 2).
NOTE 1: This timer value unit is only applicable to the T3312 extended value IE,
the T3412 extended value IE (see 3GPP TS 24.301 [120]) and the T3512
value IE (see 3GPP TS 24.501 [167]). If the UE receives the IE in an
integrity protected message, then it shall interpret the value as multiples
of 320 hours. Otherwise it shall interpret the value as multiples of 1 hour.
If the network receives the IE in S1 mode, the network shall interpret the
value as multiples of 320 hours, regardless whether the IE is received in
an integrity protected message (e.g., an ATTACH REQUEST message or
TRACKING AREA UPDATE REQUEST message (see
3GPP TS 24.301 [120])) or not. Otherwise it shall interpret the value as
multiples of 1 hour.
NOTE 2: This timer value unit is not applicable to the T3412 extended value IE. If
this timer value is received, the T3412 extended value IE shall be
considered as not included in the message (see 3GPP TS 24.301 [120]).
10.5.7.5 Radio priority 2

The purpose of the radio priority 2 information element is to specify the priority level that the MS shall use at the lower
layers for transmission of mobile originated TOM8 transmission.
The radio priority 2 information element is coded as shown in figure 10.5.7.5-1/3GPP TS 24.008 and table 10.5.7.5-
1/3GPP TS 24.008.
The radio priority is a type 1 information element.
ETSI
Release 18 718 3GPP TS 24.008 V18.4.0 (2023-09)
8 7 6 5 4 3 2 1
Radio priority 2 IEI 0 Radio priority octet 1
spare level value
Figure 10.5. 7.5-1/3GPP TS 24.008: Radio priority 2 information element
Table 10.5. 7.5-1/3GPP TS 24.008: Radio priority 2 information element
Radio priority level value (octet 1, bits 1-3)
Bits
3 2 1
0 0 1 priority level 1 (highest)
0 1 0 priority level 2
0 1 1 priority level 3
1 0 0 priority level 4 (lowest)
All other values are interpreted as priority level 4 by this version of the protocol.

The purpose of the MBMS context status information element is to indicate the state of each MBMS context which can
be identified by an NSAPI.
The MBMS context status information element is a type 4 information element with a minimum length of 2 octets and a
The MBMS context status information element is coded as shown in figure 10.5.149/3GPP TS 24.008 and
table 10.5.165/3GPP TS 24.008.
8 7 56 4 3 2 1
MBMS context status IEI octet 1
Length of MBMS context status contents octet 2
(135) (134) (133) (132) (131) (130) (129) (128)
(143) (142) (141) (140) (139) (138) (137) (136)

(255) (254 (253) (252) (251) (250) (249) (248)
Figure 10.5.149/3GPP TS 24.008 MBMS context status information element
Table 10.5.165/3GPP TS 24.008: MBMS context status information element
For x = 128 to 255, NSAPI(x) shall be coded as follows:
0 indicates that the SM state of the corresponding MBMS context is PDP-INACTIVE.

1 indicates that the SM state of the corresponding MBMS context is not PDP-INACTIVE.
If octets are not included in the information element, the receiver shall interprete the NSAPI(x) values of these
octets as set to 0.
ETSI
Release 18 719 3GPP TS 24.008 V18.4.0 (2023-09)
10.5.7.7 Uplink data status

The purpose of the Uplink data status information element is to indicate to the network which preserved PDP contexts
have uplink data pending.
The Uplink data status information element is a type 4 information element with 4 octets length.
The Uplink data status information element is coded as shown in figure 10.5.149/3GPP TS 24.008 and
table 10.5.166/3GPP TS 24.008.
8 7 6 5 4 3 2 1
Uplink data status IEI octet 1
Length of Uplink data status contents octet 2
NSAPI NSAPI NSAPI Spare Spare Spare Spare Spare octet 3
(7) (6) (5) (0) (0) (0) (0) (0)
(15) (14) (13) (12) (11) (10) (9) (8)
Figure 10.5.149A/3GPP TS 24.008 Uplink data status information element
Table 10.5.166/3GPP TS 24.008: Uplink data status information element
NSAPI uplink status (octet 3 and 4)
Octet 3, bits 1 to 5 are all spare and shall be encoded as 0
NSAPI(5) – NSAPI(15) (octets 3 – 4):

0 no uplink data are pending for the preserved PDP context or the PDP context is PDP-INACTIVE or is
PDP-ACTIVE with a RAB already established.
1 uplink data are pending for the preserved PDP context.

The purpose of the Device properties information element is to indicate if the MS is configured for NAS signalling low
priority. The network uses the Device properties information element for core-network congestion handling and for
charging purposes.
The Device properties information element is coded as shown in figure 10.5.7.8.1/3GPP TS 24.008 and
table 10.5.7.8.1/3GPP TS 24.008.
The Device properties is a type 1 information element.
8 7 6 5 4 3 2 1
Device properties 0 0 0 Low octet 1
IEI Spare Spare Spare priority
Figure 10.5.7.8.1/3GPP TS 24.008: Device properties information element
ETSI
Release 18 720 3GPP TS 24.008 V18.4.0 (2023-09)
Table 10.5.7.8.1/3GPP TS 24.008: Device properties information element
Low priority (octet 1)
Bit
1
0 MS is not configured for NAS signalling low priority
1 MS is configured for NAS signalling low priority
The value "0" can also be used by an MS configured for NAS signalling low priority for
the exception cases specified in subclause 1.8.
Bits 2, 3 and 4 of octet 1 are spare and shall be coded as zero.
ETSI
Release 18 721 3GPP TS 24.008 V18.4.0 (2023-09)
11 List of system parameters

The description of timers in the following table should be considered a brief summary. The precise details are found in
clauses 3 to 6, which should be considered the definitive descriptions.
11.1 Timers and counters for radio resource management

See 3GPP TS 44.018 [84].
11.2 Timers of mobility management

Table 11.1/3GPP TS 24.008: Mobility management timers - MS-side
ETSI
Release 18 722 3GPP TS 24.008 V18.4.0 (2023-09)
TIMER MM TIME CAUSE FOR START NORMAL STOP AT THE EXPIRY

NUM. STATE OUT
VAL.
T3210 20s - LOCATION - LOCATION UPDATING
LOCATION UPDATING UPDATING ACCEPT
INITIATED REQUEST sent - LOCATIONG Start T3211
UPDATING_REJECT
- AUTHTICATION
_REJECT
- Lower layer failure
T3211 15s - LOCATION - cell change Restart the
MM IDLE, UPDATING - request for MM location updating
REJECT with other connection procedure.
cause values as establishment
described in section - change of LA
4.4.4.9
- lower layer failure or
RR connection
released after RR
connection abort
during location
updating procedure
T3212 Note 1 - termination of MM - initiation of MM service initiate periodic
MM IDLE service or MM or MM signalling updating
signalling
T3213 4s - location updating - change of BCCH new random
LOCATION UPDATING failure parameter attempt
INITIATED
T3214 20s AUTHENTICATION - AUTHENTICATION Consider the
LOCATION UPDATING FAILURE REQUEST received network as ’false’
INITIATED Cause = 'MAC failure’ - AUTHENTICATION (see 4.3.2.6.1)
or 'GSM REJECT received
WAIT FOR OUTGOING authentication - Lower layer failure
MM CONNECTION unacceptable’ sent
IMSI DETACH INITIATED

T3216 15s AUTHENTICATION - AUTHENT REQUEST Consider the
LOCATION UPDATING FAILURE received network as ’false’
INITIATED Cause = Synch failure - AUTHENTICATION (see 4.3.2.6.1)
sent REJECT received
WAIT FOR OUTGOING - Lower layer failure
MM CONNECTION
IMSI DETACH INITIATED

T3218 20s - RAND and RES - CIPHERING MODE Delete the stored
LOCATION UPDATING stored as a result of COMMAND received RAND and either
INITIATED of a UMTS (A/Gb mode only) RES (if it was a
authentication - SECURITY MODE UMTS
WAIT FOR OUTGOING challenge COMMAND received authentication
MM CONNECTION - RAND and SRES (Iu mode only) challenge) or
stored as a result of CM SERVICE ACCEPT SRES (if it was a
IMSI DETACH INITIATED of a GSM received GSM
authentication CM SERVICE REJECT authentication
challenge received challenge)
- LOCATION UPDATING
ACCEPT received
- AUTHENTICATION
REJECT received
- AUTHENTICATION
FAILURE sent
- enter MM IDLE or NULL
T3220 5s - IMSI DETACH - release from RM- enter Null or Idle,
IMSI DETACH INITIATED sublayer ATTEMPTING TO
UPDATE
T3230 15s - CM SERVICE - Cipher mode setting provide release
WAIT FOR OUTGOING REQUEST - CM SERVICE REJECT ind.
MM CONNECTION received
CM RE- - CM SERVICE ACCEPT
ETSI
Release 18 723 3GPP TS 24.008 V18.4.0 (2023-09)

NUM. STATE OUT
VAL.
WAIT FOR ADDITIONAL ESTABLISHMENT received
OUTGOING MM REQUEST - CM SERVICE ABORT
CONNECTION sent
WAIT FOR
REESTABLISH
ETSI
Release 18 724 3GPP TS 24.008 V18.4.0 (2023-09)

NUM. STATE OUT
VAL.
T3240 10s see subclause 11.2.1 see subclause 11.2.1 abort the RR
WAIT FOR NETWORK connection
COMMAND
LOCATION UPDATE
REJECTED
T3241 RR CONNECTION 300s see subclause 11.2.1 see subclause 11.2.1 abort the RR
RELEASE NOT connection
ALLOWED
T3242 All except NULL Note 5 eCall only MS enters - Removal of eCall only Perform eCall
MM IDLE state after restriction Inactivity
an emergency call - Intersystem change procedure in
- eCall only MS from Iu or A/Gb mode to subclause 4.4.7 or
capable of eCall S1 mode for MS GMM eCall
over IMS performs capable of eCall over inactivity
intersystem change IMS procedure in
from S1 mode to Iu subclause 4.7.15
or A/Gb mode while
timer T3444 (see
3GPP TS 24.301 [12
0]) is running
T3243 All except NULL Note 6 eCall only MS enters - Removal of eCall only Perform eCall
MM IDLE state after restriction Inactivity
a - Intersystem change procedure in
test/reconfiguration from Iu or A/Gb mode to subclause 4.4.7 or
call S1 mode for MS GMM eCall
- eCall only MS capable of eCall over inactivity
capable of eCall IMS procedure in
over IMS enters subclause 4.7.15
PMM-IDLE (Iu
mode) state after a
test/reconfiguration
call
- return to packet idle
mode at eCall only
MS capable of eCall
over IMS after a
test/reconfiguration
call (A/Gb mode)
- eCall only MS
capabable of eCall
over IMS performs
intersystem change
from S1 mode to Iu
or A/Gb mode while
timer T3445 (see
3GPP TS 24.301 [12
0]) is running
T3245 All except NULL Note 2 see subclause 4.1.1.6 - SIM/USIM is removed see subclause
(A/Gb or Iu mode 4.1.1.6 (A/Gb or Iu
only) mode only)
see subclause 5.3.7a see subclause
in 3GPP TS 5.3.7a in 3GPP
24.301[120] (S1 TS 24.301[120]
mode only) (S1 mode only)
see subclause 5.3.19a see
in subclause 5.3.19a
3GPP TS 24.501 [16 in
7] (N1 mode only) 3GPP TS 24.501 [
see subclause 4.6 in 167] (N1 mode
3GPP TS 24.502 [17 only)
8] (N1 mode only) see subclause 4.6
in
3GPP TS 24.502 [
178] (N1 mode
ETSI
Release 18 725 3GPP TS 24.008 V18.4.0 (2023-09)

NUM. STATE OUT
VAL.
only)
T3246 LOCATION UPDATING Note 3 LOCATION - paging Restart the

INITIATED UPDATING - see subclause 4.1.1.7 Location update
REJECT or CM procedure or CM
WAIT FOR OUTGOING SERVICE REJECT service request
MM CONNECTION received with a timer procedure,
value for T3246; dependent on MM
WAIT FOR ADDITIONAL "Extended wait time" state and update
OUTGOING MM for CS domain from status
CONNECTION the lower layers
WAIT FOR
REESTABLISH
T3247 All except NULL Note 4 see subclauses - SIM/USIM is removed see subclause
4.1.1.6A, 4.3.2.5 and or the entry of the "list 4.1.1.6A (A/Gb or
4.7.7.5 (A/Gb or Iu of subscriber data" with Iu mode only)
mode only) the SNPN identity of the
current SNPN is see subclause
see subclauses 5.3.7B 5.3.7B in 3GPP
and 5.4.2.5 in 3GPP updated (see
3GPP TS 23.122 [14] TS 24.301 [120]
TS 24.301 [120] (S1 (S1 mode only)
mode only) and
see 3GPP TS 24.501 [167]); see
subclauses 5.3.20, or subclauses 5.3.20
5.4.1.2.2.11, - the MS is switched off in
5.4.1.2.3.1, 3GPP TS 24.501 [
5.4.1.2.3A.1, 167] (N1 mode
5.4.1.2.3B.1 and only)
5.4.1.3.5 in
3GPP TS 24.501 [167]
(N1 mode only)
NOTE 1: The timeout value is broadcasted in a SYSTEM INFORMATION message or received in a LOCATION
UPDATING ACCEPT message.
NOTE 2: The MS starts the timer with a random value, uniformly drawn from the range between 12h and 24h.
NOTE 3: The timer value is provided by the network in a LOCATION UPDATING REJECT or a CM SERVICE
REJECT message or as an "Extended wait time" value by the lower layers, or chosen randomly from a
default value range of 15 – 30 minutes.
NOTE 4: The MS starts the timer with a random value, uniformly drawn from the range between 15 minutes and 30
minutes for 5GMM cause value #74 as specified in 3GPP TS 24.501 [167] or between 30 minutes and 60
minutes for other cause values.
NOTE 5: If the timer is started by an eCall only MS capable of eCall over IMS due to performing intersystem change
from S1 mode to Iu or A/Gb mode while timer T3444 (see 3GPP TS 24.301 [120]) is running, the MS starts
the timer with a value set to the time left on timer T3444. Otherwise the MS starts the timer with a value set
to 12 hours.
NOTE 6: If the timer is started by an eCall only MS capable of eCall over IMS due to performing intersystem change
from S1 mode to Iu or A/Gb mode while timer T3445 (see 3GPP TS 24.301 [120]) is running, the MS starts
the timer with a value set to the time left on timer T3445. Otherwise the MS starts the timer with a value set
to 12 hours.
ETSI
Release 18 726 3GPP TS 24.008 V18.4.0 (2023-09)
Table 11.2/3GPP TS 24.008: Mobility management timers - network-side
TIMER MM TIME CAUSE FOR NORMAL STOP AT THE AT THE

NUM. STATE OUT START EXPIRY SECOND
VAL. EXPIRY
T3250 TMSI 12s TMSI TMSI Optionally
REALLOCATION REALLOCATIO REALLOCATION Release RR
INITIATED N COMMAND or COMPLETE connection
LOCATION received
UPDATING
ACCEPT with
new TMSI sent
T3255 Note LOCATION CM SERVICE Release RR
2 UPDATING REQUEST Connection or
ACCEPT sent use for mobile
with"Follow on station
Proceed" terminating call
T3260 AUTHENTICATION 12s AUTHENTICATIO AUTHENTICATION Optionally
INITIATED N REQUEST RESPONSE Release RR
sent received connection
AUTHENTICATION
FAILURE
received
T3270 IDENTIFICATION 12s IDENTITY IDENTITY Optionally
INITIATED REQUEST sent RESPONSE Release RR
received connection
NOTE 2: The value of this timer is not specified by this recommendation.
11.2.1 Timer T3240 and Timer T3241

Timer T3240 is started in the mobile station when:
- the mobile station receives a LOCATION UPDATING ACCEPT message completing a location updating
procedure in the cases specified in subclauses 4.4.4.6 and 4.4.4.8;
- the mobile station receives a LOCATION UPDATING REJECT message in the cases specified in
subclause 4.4.4.7;
- the mobile station has sent a CM SERVICE ABORT message as specified in subclause 4.5.1.7;
- the mobile station has released or aborted all MM connections in the cases specified in 4.3.2.5, 4.3.5.2, 4.5.1.1,
and 4.5.3.1;
- the mobile station receives the paging message from network and enter the MM state 9 (WAIT FOR
NETWORK COMMAND).
Timer T3240 is stopped, reset, and started again at receipt of an MM message.
Timer T3240 is stopped and reset (but not started) at receipt of a CM message that initiates establishment of an CM
connection (an appropriate SETUP, REGISTER, or CP-DATA message as defined in 3GPP TS 24.008, 3GPP TS
24.010 [21] or 3GPP TS 24.011 [22]).
If timer T3240 expires, the MS shall abort the RR connection and enter the MM state MM IDLE.
Timer T3241 is started in the mobile station when entering MM state RR CONNECTION RELEASE NOT
ALLOWED.
Timer T3241 is stopped and reset (but not started) when the MM state RR CONNECTION RELEASE NOT
ALLOWED is left.
If timer T3241 expires, the MS shall abort the RR connection and enter the MM state MM IDLE.
ETSI
Release 18 727 3GPP TS 24.008 V18.4.0 (2023-09)
11.2.2 Timers of GPRS mobility management

Table 11.3/3GPP TS 24.008: GPRS Mobility management timers - MS side
ETSI
Release 18 728 3GPP TS 24.008 V18.4.0 (2023-09)
TIMER TIMER STATE CAUSE OF START NORMAL STOP ON THE

NUM. VALUE st nd
1 ,2 ,3 ,4
rd th
EXPIRY Note 3
T3310 15s GMM- ATTACH REQUEST sent ATTACH ACCEPT Retransmission of
NOTE 2 REG-INIT received ATTACH
ATTACH REJECT REQUEST
received
T3311 15s GMM-DEREG ATTACH REJECT with other Change of the Restart of the
ATTEMPTING cause values as described in routing area GPRS attach or the
TO ATTACH or chapter 'GPRS Attach' GPRS attach RAU procedure with
GMM-REG ROUTING AREA UPDATE procedure initiated updating of the
ATTEMPTING REJECT with other cause values relevant attempt
RAU procedure counter
TO UPDATE as described in chapter 'Routing initiated
GMM-REG Area Update'
Iu mode - PMM
NORMAL Low layer failure CONNECTED
SERVICE mode entered
(NOTE 1)
A/Gb mode -
READY timer is
started (Note 1)
T3316 30s GMM- RAND and RES stored as a result Security mode Delete the stored
NOTE 2 REG-INIT of a UMTS authentication setting RAND, and either
GMM-REG challenge (Iu mode only) RES (if it was a
GMM-DEREG- RAND and SRES stored as a SERVICE ACCEPT UMTS

INIT result of a GSM authentication received. (Iu mode authentication
challenge only) challenge) or SRES
GMM-RA- (if it was a GSM
UPDATING-INT SERVICE REJECT authentication
received challenge)
GMM-SERV- (Iu mode only)
REQ-INIT
(Iu mode only) ROUTING AREA
UPDATE ACCEPT
received
AUTHENTICATION
AND CIPHERING
REJECT received
AUTHENTICATION
AND CIPHERING
FAILURE sent
Enter GMM-
DEREGISTERED,
GMM-NULL or
PMM-IDLE mode
(Iu mode only)
ETSI
Release 18 729 3GPP TS 24.008 V18.4.0 (2023-09)
T3318 20s GMM- AUTHENTICATION AND AUTHENTICATION On first expiry, the

NOTE 2 REG-INIT CIPHERING FAILURE AND CIPHERING MS should consider
GMM-REG (cause=’MAC failure’ or 'GSM REQUEST received the network as false
authentication unacceptable’) sent AUTHENTICATION and will follow
GMM-DEREG- subclause 4.7.7.6.1,
INIT AND CIPHERING
REJECT received if the MS is not
GMM-RA- attached for
UPDATING-INT Lower layer failure emergency bearer
PS signalling services.
GMM-SERV-
REQ-INIT (Iu connection released On the first expiry,
mode only) (Iu mode only) the MS will follow
Inter-system subclause 4.7.7.6,
change to S1 mode under "for items f
performed and g", if the MS is
attached for
GPRS services
emergency bearer
suspended
services.
(Gb mode only)
T3320 15s GMM- AUTHENTICATION AND AUTHENTICATION On first expiry, the
NOTE 2 REG-INIT CIPHERING FAILURE AND CIPHERING MS should consider
GMM-REG (cause=synch failure) sent REQUEST received the network as false
GMM-DEREG- AUTHENTICATION and will follow the

AND CIPHERING subclause 4.7.7.6.1,
INIT if the MS is not
REJECT received
GMM-RA- attached for
UPDATING-INT Lower layer failure emergency bearer
PS signalling services.
GMM-SERV-
REQ-INIT (Iu connection released On the first expiry,
mode only) (Iu mode only) the MS will follow
Inter-system subclause 4.7.7.6,
change to S1 mode under "for items f
performed and g", if the MS is
attached for
GPRS services
emergency bearer
suspended
services.
(Gb mode only)
T3321 15s GMM- DETACH REQUEST sent DETACH ACCEPT Retransmission of
NOTE 2 DEREG-INIT received the DETACH
REQUEST
GMM-REG.
IMSI-DETACH-
INITIATED
T3330 15s GMM- ROUTING AREA UPDATE ROUTING AREA Retransmission of
NOTE 2 ROUTING- REQUEST sent UPDATE ACCEPT the ROUTING
UPDATING- received AREA UPDATE
INITIATED REQUEST
message
ROUTING AREA
UPDATE REJECT
received
ETSI
Release 18 730 3GPP TS 24.008 V18.4.0 (2023-09)
T3340 10s GMM-DEREG ATTACH REJECT, DETACH PS signalling Release the PS

(Iu mode GMM-REG REQUEST, ROUTING AREA connection released signalling
only) UPDATE REJECT or SERVICE connection and
REJECT with any of the causes proceed as
#3, #6, #7, #8, #11, #12, #13, described in
#15, or #25. subclause 4.7.1.9
ATTACH ACCEPT or ROUTING
AREA UPDATE ACCEPT is
received with "no follow-on
proceed" indication and user
plane radio access bearers have
not been setup.
DETACH ACCEPT received after
the MS sent DETACH REQUEST
with detach type to "IMSI detach"
AUTHENTICATION AND
CIPHERING REJECT received
NOTE 1: The conditions for which this applies are described in subclause 4.7.5.1.5.
NOTE 2: If the MS is using EC-GSM-IoT, the timer value shall be calculated as described in subclause 4.7.2.12.
ETSI
Release 18 731 3GPP TS 24.008 V18.4.0 (2023-09)
Table 11.3a/3GPP TS 24.008: GPRS Mobility management timers – MS side
ETSI
Release 18 732 3GPP TS 24.008 V18.4.0 (2023-09)
TIMER TIMER STATE CAUSE OF START NORMAL STOP ON

NUM. VALUE EXPIRY
T3302 Default 12 GMM-DEREG At attach failure and the attempt GPRS attach On every expiry,
min or counter is greater than or equal procedure initiated initiation of the
to 5. GPRS attach
GMM-REG
NOTE 5 At routing area updating failure RAU procedure procedure
and the attempt counter is greater initiated or
than or equal to 5.
ATTACH ACCEPT with MM cause RAU procedure
#16 or #17 and the attempt
counter is equal to 5, or ATTACH
ACCEPT with MM cause #22, as
described in
subclause 4.7.3.2.3.2.
ROUTING AREA UPDATE
ACCEPT with MM cause #16 or
#17 and the attempt counter is
equal to 5, or ROUTING AREA
UPDATE ACCEPT with MM cause
#22, as described in
subclause 4.7.5.2.3.2.
DETACH REQUEST received with
no cause code and detach type IE
indicates "re-attach not required",
as described in
T3312 Default GMM-REG In A/Gb mode, when READY state When entering state Initiation of the
54 min is left. GMM- Periodic RAU
NOTE 8 In Iu mode, when PMM- DEREG,READY procedure if the MS
CONNECTED mode is left. state in A/Gb mode, is not attached for
or PMM- emergency bearer
CONNECTED mode services or T3323
in Iu mode. started under the
conditions as
specified in
subclause 4.7.2.2.
Implicit detach from
network if the MS is
attached for
emergency bearer
services.
T3314 Default All except GMM- Transmission of a PTP PDU Forced to Standby No cell-updates are
READY 44 sec DEREG performed
NOTE 2
(A/Gb
mode only)
T3317 15s GMM-SERVICE- SERVICE REQUEST sent Security mode Abort the procedure
(Iu mode REQUEST- control procedure is
only) INITIATED completed,
SERVICE ACCEPT
received, or
SERVICE REJECT
received
T3319 Default 30s GMM-REG Completion of the Security Mode When entering SERVICE
(Iu mode NOTE 1 Control procedure after sending a PMM-IDLE mode. REQUEST with
only) SERVICE REQUEST with service When the radio service type "data"
NOTE 4 type "data". may be invoked
access bearer is
Reception of a SERVICE released for any again, if required.
ACCEPT message. active PDP context.
When entering state
GMM-DEREG
ETSI
Release 18 733 3GPP TS 24.008 V18.4.0 (2023-09)
T3323 NOTE 6 GMM- T3312 expires while ISR is When entering state Deactivation of ISR
REGISTERED activated and either T3346 is GMM- by setting TIN to
running or the MS is in one of the DEREGISTERED or "GUTI"
following states: when entering
-GMM-REGISTERED.NO-CELL- PMM-CONNECTED
AVAILABLE; mode.
-GMM-REGISTERED.PLMN-
SEARCH;
-GMM-REGISTERED.UPDATE-
NEEDED;or
-GMM-REGISTERED.LIMITED-
SERVICE.
T3324 NOTE 9 GMM- In A/Gb mode, when READY state When entering state The MS may
REGISTERED.N is left. GMM- activate PSM if in
ORMAL- In Iu mode, when PMM- DEREGISTERED, GMM-
SERVICE CONNECTED mode is left. READY state in REGISTERED.NOR
EMM- A/Gb mode, or MAL-SERVICE.
In S1 mode, when the EMM-
REGISTERED.N CONNECTED mode is left PMM-CONNECTED The MS may
ORMAL- (defined in mode in Iu mode, activate PSM if in
SERVICE 3GPP TS 24.301 [120]). EMM-
(defined in When entering state REGISTERED.NOR
3GPP TS 24.301 In N1 mode, when the 5GMM- EMM- MAL-SERVICE
[120]) CONNECTED mode over 3GPP DEREGISTERED, (defined in
acess is left (defined in or 3GPP TS 24.301 [1
5GMM- 3GPP TS 24.501 [167])
REGISTERED.N EMM-CONNECTED 20]).
ORMAL- mode in S1 mode The MS may
SERVICE over (defined in activate MICO mode
3GPP access 3GPP TS 24.301 [1 if in 5GMM-
(defined in 20]). REGISTERED.NOR
3GPP TS 24.501 When entering state MAL-SERVICE over
[167]) 5GMM- 3GPP access
DEREGISTERED (defined in
over 3GPP access, 3GPP TS 24.501 [1
or 67])
5GMM-
CONNECTED mode
in N1 mode over
3GPP access
(defined in
3GPP TS 24.501 [1
67])
T3325 Default 60s GMM- In A/Gb mode and Iu mode when When entering state The MS may initiate
REGISTERED.N T3317 expires and service request other than GMM- SERVICE
NOTE 10 ORMAL- attempt counter is greater than or REGISTERED. REQUEST
SERVICE equal to 5 NORMAL-SERVICE procedure
state, or.
EMM-
REGISTERED.N In S1 mode when T3417 expires When entering state
ORMAL- and service request attempt other than EMM-
SERVICE counter is greater than or equal to REGISTERED.
(defined in 5 NORMAL-SERVICE
3GPP TS 24.301 state, or.
[120])
MS camped to a
new PLMN other
than the PLMN on
which timer started,
or DRB established
from network.
ETSI
Release 18 734 3GPP TS 24.008 V18.4.0 (2023-09)
T3346 NOTE 7 GMM- ATTACH REJECT, ROUTING - Paging received Initiation of GPRS
DEREGISTERE AREA UPDATE REJECT or or DETACH attach procedure,
D. SERVICE REJECT received with REQUEST with the routing area
ATTEMPTING- a timer value for T3346; "Extended detach type "re- updating procedure
TO-ATTACH wait time" for PS domain from the attach required" or service request
GMM- lower layers (defined in received procedure,
REGISTERED. 3GPP TS 25.331 [23c]). dependent on GMM
ATTEMPTING- - see subclause
ATTACH REJECT, TRACKING 4.1.1.7 (A/Gb mode state and GPRS
TO-UPDATE update status.
AREA UPDATE REJECT or or Iu mode only)
GMM- SERVICE REJECT (defined in Initiation of EPS
REGISTERED 3GPP TS 24.301 [120]) received - see subclause attach procedure,
EMM- 5.3.9,
with a timer value for T3346; subclause 5.5.1.2.5, tracking area
DEREGISTERE "Extended wait time" from the
D. subclause 5.5.1.3.5, updating procedure
lower layers. (defined in subclause 5.5.3.2.5, or service request
ATTEMPTING- 3GPP TS 36.331 [129]).
TO-ATTACH subclause 5.5.3.3.5, procedure,
EMM- REGISTRATION REJECT, DE- subclause 5.6.1.5, dependent on EMM
REGISTRATION REQUEST or and state and EPS
REGISTERED.
ATTEMPTING- SERVICE REJECT (defined in subclause 5.6.2.2.2 update status.
(defined in
TO-UPDATE 3GPP TS 24.501 [167]) received in 3GPP TS 24.301 3GPP TS 24.301 [1
with a timer value for T3346. [122] (S1 mode
EMM- only) 20])
REGISTERED
(defined in - see subclause Initiation of
5.3.9, registration
3GPP TS 24.301
[120]). subclause 5.4.4.3, procedure or service
5GMM- subclause 5.4.7.2.1, request procedure,
DEREGISTERE subclause 5.5.1.2.5, dependent on
D. subclause 5.5.1.3.5, 5GMM state and
ATTEMPTING- subclause 5.5.2.3.2 5GS update status.
and (defined in
REGISTRATION
5GMM- subclause 5.6.1.5 in 3GPP TS 24.501 [1
3GPP TS 24.501 67])
REGISTERED.
ATTEMPTING- [167] (N1 mode
REGISTRATION only)
-UPDATE
5GMM-
REGISTERED
(defined in
3GPP TS 24.501
[167]).
NOTE 1: The default value of this timer is used if the network does not indicate another value in a GMM signalling
procedure.
NOTE 2: The default value of this timer is used if neither the MS nor the Network send another value, or if the Network
sends this value, in a signalling procedure.
NOTE 3: Typically, the procedures are aborted on the fifth expiry of the relevant timer. Exceptions are described in the
corresponding procedure description.
NOTE 4: The purpose of this timer is to prevent the MS from repeating the SERVICE REQUEST message with service
type "data" too early in case the request to setup the radio access bearer is queued by the radio access
network.
NOTE 5: The cases in which the default value of this timer is used are described in subclause 4.7.2.7.
NOTE 6: The value of this timer may be provided by the network to the MS in the ATTACH ACCEPT message and
ROUTING AREA UPDATE ACCEPT message. The default value of this timer is identical to the value of
timer T3312.
NOTE 7: The timer value is provided by the network in an ATTACH REJECT, ROUTING AREA UPDATE REJECT,
TRACKING AREA UPDATE REJECT, REGISTRATION REJECT, DE-REGISTRATION REQUEST or
SERVICE REJECT message or as a "Extended wait time" value by the lower layers, or chosen randomly
from a default value range of 15 – 30 minutes. In this release, receipt of the "Extended wait time" as part of
5GMM from the lower layers is not defined.
NOTE 8: The cases in which the default value of this timer is used are described in subclause 4.7.2.2.
NOTE 9: The timer value is provided by the network in an ATTACH ACCEPT, ROUTING AREA UPDATE ACCEPT,
TRACKING AREA UPDATE ACCEPT or REGISTRATION ACCEPT message.
NOTE 10: The value of this timer is UE implementation specific, with a minimum value of 60 seconds.
ETSI
Release 18 735 3GPP TS 24.008 V18.4.0 (2023-09)
Table 11.4/3GPP TS 24.008: GPRS Mobility management timers - network side

NUM. VALUE st nd
1 ,2 ,3 ,4
rd th
EXPIRY Note 3
T3322 6s GMM- DETACH REQUEST sent DETACH ACCEPT Retransmission of
NOTE 1 DEREG-INIT received DETACH
REQUEST
T3350 6s GMM- ATTACH ACCEPT ATTACH Retransmission of
NOTE 1 COMMON- sent with P-TMSI and/or TMSI COMPLETE the same message
PROC-INIT received type, i.e. ATTACH
RAU ACCEPT sent with P-TMSI RAU COMPLETE ACCEPT, RAU
and/or TMSI received ACCEPT or
REALLOCATION
P-TMSI REALLOCATION P-TMSI COMMAND
COMMAND REALLOCATION
sent COMPLETE
received
T3360 6s GMM- AUTHENTICATION AND AUTHENTICATION Retransmission of
NOTE 1 COMMON- CIPHERING REQUEST AND CIPHERING AUTHENTICATION
PROC-INIT sent RESPONSE AND CIPHERING
received REQUEST
AUTHENTICATION-
AND CIPHERING-
FAILURE received
T3370 6s GMM- IDENTITY REQUEST sent IDENTITY Retransmission of
NOTE 1 COMMON- RESPONSE IDENTITY
PROC-INIT received REQUEST
NOTE 1 If the SGSN supports EC-GSM-IoT and if the MS is using EC-GSM-IoT, the timer value is calculated as
described in subclause 4.7.2.12.
ETSI
Release 18 736 3GPP TS 24.008 V18.4.0 (2023-09)
Table 11.4a/3GPP TS 24.008: GPRS Mobility management timers - network side
ETSI
Release 18 737 3GPP TS 24.008 V18.4.0 (2023-09)
TIMER TIMER STATE CAUSE OF START NORMAL STOP ON

NUM. VALUE EXPIRY
T3313 NOTE 1 GMM- Paging procedure initiated Paging procedure Network dependent
NOTE 9 REGISTERED completed
T3314 Default All except GMM- Receipt of a PTP PDU Forced to Standby The network shall
READY 44 sec DEREGISTERE Completion of a page the MS if a
(A/Gb NOTE 2 D successful GPRS PTP PDU has to be
mode only) attach or routing sent to the MS
area updating
procedure in Iu
mode.
Indication received
from HLR/HSS that
the MS performed
an EPS attach or
indication received
from the MME that
the MS is
performing a
tracking area
updating procedure.
T3315 NOTE 7 GMM- Paging procedure initiated for an Paging procedure Paging procedure is
REGISTERED MS which the network accepted completed aborted and the
the request to use eDRX Paging procedure is network proceeds
aborted as specified in
3GPP TS 23.060 [7
4]
mobile NOTE 4 All except GMM- In A/Gb mode, when entering PTP PDU received Network dependent
reachable DEREGISTERE STANDBY state but typically paging
D In Iu mode, when entering PMM- is halted on 1st
IDLE mode. expiry if the MS is
not attached for
emergency bearer
services.
Implicitly detach the

MS which is
attached for the
emergency bearer
services.
Start implicit detach

timer if ISR is
activated.
implicit NOTE 5 All except GMM- The mobile reachable timer PTP PDU received Implicitly detach the
detach DEREGISTERE expires while the network is in MS on 1st expiry
timer D PMM-IDLE mode or STANDBY
state.
active timer NOTE 6 All except In A/Gb mode, when entering PTP PDU received Network dependent
STANDBY state. but typically paging
GMM- is halted on 1st
DEREGISTERE In Iu mode, when entering PMM- expiry
D IDLE mode.
ETSI
Release 18 738 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 1: The value of this timer is network dependent.

NOTE 2: The default value of this timer is used if neither the MS nor the Network send another value, or if the Network
sends this value, in a signalling procedure. The value of this timer should be slightly shorter in the network
than in the MS, this is a network implementation issue.
NOTE 3: Typically, the procedures are aborted on the fifth expiry of the relevant timer. Exceptions are described in the
corresponding procedure description.
NOTE 4: The default value of this timer is 4 minutes greater than T3312. If T3346 is larger than T3312 and the SGSN
includes timer T3346 in the ROUTING AREA UPDATE REJECT message or the SERVICE REJECT
message, the value of the mobile reachable timer and implicit detach timer is set such that the sum of the
timer values is greater than T3346. If the MS is attached for emergency bearer services, the value of this
timer is set equal to T3312.
NOTE 5: The value of this timer is network dependent. If ISR is activated, the default value of this timer is 4 minutes
greater than T3323.
NOTE 6: If the network includes timer T3324 in the ATTACH ACCEPT message or ROUTING AREA UPDATE
ACCEPT message and if the MS is not attached for emergency bearer services and has no PDN connection
for emergency bearer services, the value of this timer is equal to the value of timer T3324.
NOTE 7: The value of this timer is smaller than the value of timer T3-RESPONSE (see 3GPP TS 29.274 [16D]).
NOTE 8: If the SGSN supports EC-GSM-IoT and if the MS is using EC-GSM-IoT, the timer value is calculated as
NOTE 9: If the SGSN supports EC-GSM-IoT and if the MS is using EC-GSM-IoT, then the timer value shall be
calculated by using a multiplier which value is network dependent.
ETSI
Release 18 739 3GPP TS 24.008 V18.4.0 (2023-09)
11.2.3 Timers of GPRS session management

Table 11.2c/3GPP TS 24.008: GPRS session management timers - MS side
ETSI
Release 18 740 3GPP TS 24.008 V18.4.0 (2023-09)

NUM. VALUE st nd
1 ,2 ,3 ,4
rd th
EXPIRY
T3380 30s PDP- ACTIVATE PDP CONTEXT ACTIVATE Retransmission of
NOTE 3 ACTIVE-PEND REQUEST, ACTIVATE PDP CONTEXT ACTIVATE PDP
or MBMS SECONDARY PDP CONTEXT ACCEPT, CONTEXT REQ,
ACTIVE- REQUEST or ACTIVATE MBMS ACTIVATE ACTIVATE
PENDING CONTEXT REQUEST sent SECONDARY PDP SECONDARY PDP
CONTEXT CONTEXT
ACCEPT or REQUEST or
ACTIVATE MBMS ACTIVATE MBMS
CONTEXT CONTEXT
ACCEPT received REQUEST
ACTIVATE
PDP CONTEXT
REJECT,
ACTIVATE
SECONDARY PDP
CONTEXT
REJECT or
ACTIVATE MBMS
CONTEXT
REJECT received
T3381 8s PDP-MODIFY- MODIFY PDP CONTEXT MODIFY PDP Retransmission of
NOTE 3 PENDING REQUEST sent CONTEXT MODIFY PDP
ACCEPT received CONTEXT
REQUEST
T3390 8s PDP- DEACTIVATE PDP CONTEXT DEACTIVATE PDP Retransmission of
NOTE 3 INACT-PEND REQUEST sent CONTEXT ACC DEACTIVATE
received PDP CONTEXT
REQUEST
ETSI
Release 18 741 3GPP TS 24.008 V18.4.0 (2023-09)
T3396 NOTE 1 PDP- ACTIVATE PDP CONTEXT REQUEST PDP None

ACT-PEND or REJECT, ACTIVATE MBMS CONTEXT
MBMS ACTIVE- CONTEXT REJECT, ACTIVATE ACTIVATION or
PENDING SECONDARY PDP CONTEXT REQUEST
PROCEDURE REJECT, DEACTIVATE PDP SECONDARY PDP
TRANSACTION CONTEXT REQUEST or CONTEXT
PENDING MODIFY PDP CONTEXT ACTIVATION or
(defined in REJECT received with SM cause MODIFY PDP
3GPP TS 24.301 #26 and with a timer value for CONTEXT
[120]) T3396 REQUEST or
REQUEST MBMS
PROCEDURE CONTEXT
TRANSACTION PDN CONNECTIVITY REJECT, ACTIVATION or
PENDING BEARER RESOURCE ACTIVE DEFAULT
(defined in MODIFICATION REJECT, EPS BEARER
3GPP TS 24.501 BEARER RESOURCE CONTEXT
[167]) ALLOCATION REJECT or REQUEST or
DEACTIVATE EPS BEARER ACTIVATE
CONTEXT REQUEST (defined in DEDICATED EPS
3GPP TS 24.301 [120]) received BEARER
with ESM cause #26 and with a CONTEXT
timer value for T3396 REQUEST or
PDU SESSION MODIFY EPS
ESTABLISHMENT REJECT, BEARER
PDU SESSION MODIFICATION CONTEXT
REJECT, or PDU SESSION REQUEST or
RELEASE COMMAND (defined DETACH
in 3GPP TS 24.501 [167]) REQUEST with the
received with 5GSM cause #26 detach type "re-
and with a timer value for T3396 attach required" or
paging for EPS
services using IMSI
PDU SESSION or paging for GPRS
ESTABLISHMENT REQUEST, or services using IMSI
PDU SESSION MODIFICATION received or PDU
REQUEST received in a DL NAS SESSION
TRANSPORT message (defined RELEASE
in 3GPP TS 24.501 [167]) with COMMAND or
5GMM cause #22 and with a PDU SESSION
timer value for T3396 MODIFICATION
COMMAND or
PDU SESSION
AUTHENTICATIO
N COMMAND or
DEREGISTRATIO
N REQUEST with
the re-registration
type "re-registration
required".
ETSI
Release 18 742 3GPP TS 24.008 V18.4.0 (2023-09)
Back-off 12 min PDP- ACTIVATE PDP CONTEXT None None

timer NOTE 2 ACT-PEND REJECT, ACTIVATE MBMS
PROCEDURE CONTEXT REJECT, ACTIVATE
TRANSACTION SECONDARY PDP CONTEXT
PENDING REJECT, or MODIFY PDP
(defined in CONTEXT REJECT received
3GPP TS 24.301 with SM cause value #8 "operator
[120]) determined barring", #27 "missing
or unknown APN", #32 "service
option not supported", or #33
"requested service option not
subscribed", or
received with an SM cause
different from #26 "insufficient
resources" and with a back-off
timer value as specified in
subclauses 6.1.3.1.3.3,
6.1.3.2.2.3, 6.1.3.3.3.3, and
6.1.3.8.2.3
PDN CONNECTIVITY REJECT,
BEARER RESOURCE
MODIFICATION REJECT or
BEARER RESOURCE
ALLOCATION REJECT (defined
in 3GPP TS 24.301 [120])
received with ESM cause value
#8 "operator determined barring",
#27 "missing or unknown APN",
#32 "service option not
supported", or #33 "requested
service option not subscribed", or
received with an ESM cause
different from #26 "insufficient
resources" and with a back-off
timer value as specified in
3GPP TS 24.301 [120]
PDU SESSION
ESTABLISHMENT REJECT or
PDU SESSION MODIFICATION
REJECT (defined in
3GPP TS 24.501 [167]) received
with 5GSM cause value #8
"operator determined barring",
#27 "missing or unknown DNN",
#32 "service option not
supported", #33 "requested
service option not subscribed" or
#70 "missing or unknown DNN in
a slice", or received with an
5GSM cause different from #26
"insufficient resources", #67
"insufficient resources for specific
slice and DNN", or #69
"insufficient resources for specific
slice" and with a back-off timer
value as specified in
3GPP TS 24.501 [167]
PDU SESSION RELEASE
COMMAND (defined in
3GPP TS 24.501 [167]) received
with 5GSM cause value #29 "
user authentication or
authorization failed " and with a
back-off timer value as specified
in 3GPP TS 24.501 [167].
ETSI
Release 18 743 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 1: The value of this timer or the value of this timer unit can be provided by the network operator when:
- a request to activate a PDP context, a request to activate a MBMS context or a request to modify a
PDP context is rejected by the network with a certain SM cause;
- a request to deactivate a PDP context is received with a certain SM cause value;
- a request to establish a PDN connection, a request to allocate bearer resources or a request to modify
bearer resources (defined in 3GPP TS 24.301 [120]) is rejected by the network with a certain ESM
cause;
- a request to deactivate a EPS bearer context is received with a certain ESM cause value;
- a request to establish a PDU session or a request to modify a PDU session (defined in

3GPP TS 24.501 [167]) is rejected by the network:
1) with a certain 5GSM cause; or
2) indication that the 5GSM message was not forwarded due to DNN based congestion control; or
- a command to release a PDU session is received with a certain 5GSM cause value.
If the timer unit is not set to indicate that the timer is deactivated, the value of the timer when included with
SM cause, ESM cause, 5GSM cause #26, or due to DNN based congestion control is zero or the timer value
is taken randomly from an operator dependent range not greater than 70 hours. If the PDN CONNECTIVITY
REJECT was sent together with an ATTACH REJECT message and the ATTACH REJECT message was not
integrity protected, MS uses a random value from a default range of 10mins to 30mins.
NOTE 2: The default value of 12 minutes applies only for certain SM, ESM and 5GSM cause values as specified in
subclauses 6.1.3.1.3.3, 6.1.3.2.2.3, and 6.1.3.3.3.3 in 3GPP TS 24.301 [120] and 3GPP TS 24.501 [167].
NOTE 3: If the MS is using EC-GSM-IoT, the timer value shall be calculated as described in subclause 4.7.2.12.
NOTE 1: Typically, the procedures are aborted on the fifth expiry of the relevant timer. Exceptions are described in
the corresponding procedure description.
different packet system specific timers as back-off timers is left up to MS implementation.
Table 11.2d/3GPP TS 24.008: GPRS session management timers - network side

NUM. VALUE st nd
1 ,2 ,3 ,4
rd th
EXPIRY
T3385 8s PDP- REQUEST PDP CONTEXT ACTIVATE PDP Retransmission of
NOTE 1 ACT-PEND or ACTIVATION or CONTEXT REQUEST PDP
MBMS ACTIVE- REQUEST SECONDARY PDP REQUEST or CONTEXT
PENDING CONTEXT ACTIVATION or ACTIVATE ACTIVATION or
REQUEST MBMS CONTEXT SECONDARY PDP REQUEST
ACTIVATION sent CONTEXT SECONDARY PDP
REQUEST or CONTEXT
ACTIVATE MBMS ACTIVATION or
CONTEXT REQUEST MBMS
REQUEST CONTEXT
received ACTIVATION
T3386 8s PDP- MODIFY PDP CONTEXT MODIFY PDP Retransmission of
NOTE 1 MOD-PEND REQUEST sent CONTEXT ACC MODIFY PDP
received CONTEXT REQ
T3395 8s PDP- DEACTIVATE PDP CONTEXT DEACTIVATE PDP Retransmission of
NOTE 1 INACT-PEND or REQUEST sent CONTEXT ACC DEACTIVATE PDP
MBMS received CONTEXT REQ
INACTIVE-
PENDING
NOTE 1: If the SGSN supports EC-GSM-IoT and if the MS is using EC-GSM-IoT, the timer value shall be calculated as
ETSI
Release 18 744 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 4: Typically, the procedures are aborted on the fifth expiry of the relevant timer. Exceptions are described in
the corresponding procedure description.
11.3 Timers of circuit-switched call control

Table 11.3/3GPP TS 24.008: Call control timers - MS side
TIM TIM STATE OF CAUSE OF NORMAL AT FIRST AT SECOND

NUM. VAL CALL START STOP EXPIRY EXPIRY
T303 30s Call initiated CM SER RQ ALERT,CONN, Clear the call Timer is not
sent CALL PROC, or restarted
REL COMP
received
T305 30s Disconnect DISC sent REL or DISC REL sent. Timer is not
Request received restarted
T308 30s Release REL sent REL COMP or Retrans. Call ref. release
request REL received RELEASE
restart T308
T310 30s Outgoing CALL PROC ALERT,CONN, Send DISC Timer is not
Note call received DISC or PROG restarted
1 Proceeding rec.
T313 30s Connect CONN sent CONNect Send DISC Timer is not
Request ACKnowledge restarted
received
T322 Note All states STATUS STATUS, REL, Retrans. Clear the call
2 ENQUIRY REL COMP or STATUS
sent DISC received ENQUIRY
or
Clear the call
T323 30s Modify MOD sent MOD COMP or Clear the call Timer is not
Request MOD REJ restarted
received
T324 15s Modify MOD received MOD COMP or MOD REJ Timer is not
request MOD REJ sent with old restarted
bearer
capability
T332 30s Wait for START_CC CC-EST. Clear the call Timer is not
network info sent received restarted
T335 30s CC-Est. CC-EST RECALL Clear the call Timer is not
Confirmed CONF.sent received restarted
T336 10s START DTMF START DTMF Timer is not
sent ACK or START restarted
DTMF REJECT
received
The MS
considers the
DTMF
Procedure
(for the digit)
to be
terminated
T337 10s STOP DTMF STOP DTMF The MS Timer is not
sent ACK received considers the restarted
DTMF
procedure (for
the current
digit) to be
terminated
NOTE 1: T310 is not started if progress indicator #1, #2, or #64 has been delivered in the CALL PROCEEDING
message or in a previous PROGRESS message.
NOTE 2: The value of this timer is implementation dependent.
ETSI
Release 18 745 3GPP TS 24.008 V18.4.0 (2023-09)
Table 11.4/3GPP TS 24.008: Call control timers - network side
TIM DFT STATE OF CAUSE FOR NORMAL AT FIRST AT SECOND

NUM. TIM CALL START STOP EXPIRY EXPIRY
VAL
T301 Min18 Call ALERT CONN received Clear the call Timer is not
Note 0s received received restarted
1
T303 Note 2 Call present SETUP sent CALL CONF or Clear the call Timer is not
REL COMP restarted
received
T305 30s Disconnect DISC without REL or DISC Network Timer is not
Indication progress received sends restarted
indic. #8 RELEASE
sent or
CCBS
Possible
T306 30s Disconnect DISC with REL or DISC Stop the tone/ Timer is not
Indication progress received announc. restarted
indic. #8 Send REL
sent but no
CCBS
possible
T308 Note 2 Release REL sent REL COMP or Retrans. Release call
request REL received RELEASE reference
restart T308
T310 Note 2 Incoming CALL CONF ALERT, CONN Clear the call Timer is not
call received or DISC restarted
proceeding received
T313 Note 2 Connect CON sent CON ACK Clear the call Timer is not
Indication received restarted
T322 Note 2 All states STATUS STATUS, REL, Retran. Clear the call
ENQUIRY REL COMP or STATUS
sent DISC received ENQUIRY
or
Clear the call
T323 30s Modify MOD sent MOD COMP or Clear the call Timer is not
request MOD REJ restarted
received
T331 Note 2 CC Connec. CM-SERV START CC Clear the call Timer is not
Pending PROMPT received restarted
sent
T333 Note 2 CC-Est. START CC CC-EST.CONF Clear the call Timer is not
Present received or REL COMP restarted
received
T334 Min CC-Est. RECALL sent SETUP Clear the call Timer is not
Note 15s Confirmed received restarted
3
T338 Note 2 Disconnect DISC with REL or DISC stop any tone/ Timer is not
indication CCBS received announc. restarted
possible Send REL
NOTE 1: The network may already have applied an internal alerting supervision function; e.g. incorporated within
call control. If such a function is known to be operating on the call, then timer T301 is not used.
NOTE 2: These time values are set by the network operator.
NOTE 3: When applied to the supplementary service CCBS, the timer T334 can either represent the recall timer T4
or the notification timer T10 (see 3GPP TS 23.093 [88a]). Thus the timer T334 can take two different
values. 3GPP TS 23.093 [88a] defines the range of these values.
ETSI
Release 18 746 3GPP TS 24.008 V18.4.0 (2023-09)
Annex A (informative):
Example of subaddress information element coding
This annex gives an example of how the Called Party Subaddress IE is encoded to carry subaddress digits that use IA5
characters. This example is also applicable to the Calling Party Subaddress IE.
8 7 6 5 4 3 2 1 octet
0 1 1 0 1 1 0 1 1
called party subaddress IEI
0 0 0 0 0 1 1 1 2
Length
1 0 0 0 X 0 0 0 3
not NSAP odd/ev
ext (X.213/ISO 8348 AD2) note 1 note 2
0 1 0 1 0 0 0 0 4
AFI (note 3)
IA5 Character (note 4) 5
NOTE 1: The value of this bit has no significance when the type of subaddress is "NSAP".
NOTE 2: These bits are spare.
NOTE 3: The Authority and Format Identifier code 50 (in BCD) indicates that the subaddress consists of IA5
characters (see ISO standard 8348 AD2).
NOTE 4: IA5 character as defined in ITU-T Recommendation T.50 [52]/ISO 646 and then encoded into two semi-
octets according to the "preferred binary encoding" defined in X.213 [144]/ISO 8348 AD2. (Each
character is converted into a number in the range 32 to 127 using the ISO 646 encoding with zero parity
and the parity bit in the most significant position. This number is then reduced by 32 to give a new
number in the range 0 to 95. The new number is then treated as a pair of decimal digits with the value of
each digit being encoded in a semi-octet.)
NOTE 5: the number of IA5 characters in the subaddress may vary, subject to an upper limit of 19 IA5 characters.
ETSI
Release 18 747 3GPP TS 24.008 V18.4.0 (2023-09)
Annex B (normative):
Compatibility checking
B.1 Introduction
This annex describes the various compatibility checks which shall be carried out to ensure that the best matched MS and
network capabilities are achieved on a call between a PLMN and the ISDN.
Three different processes of compatibility checking shall be performed:
i) at the user-to-network interface on the calling side (see B.2);
ii) at the network-user interface on the called side (see B.3.2);
iii) user-to-user (see B 3.3).
NOTE: In this context and throughout this annex the term "called user" is the end point entity which is explicitly
addressed.
For details on the coding of the information required for compatibility checking, see annex C.
B.2 Calling side compatibility checking
B.2.1 Compatibility checking of the CM SERVICE REQUEST

message
The network shall check if the service requested in the CM SERVICE REQUEST message is permitted for that
subscriber.
B.2.2 Compatibility/Subscription checking of the SETUP message

At the calling side the network shall check that the basic service(s) requested by the calling MS in the Bearer Capability
information element(s) match(es) with the basic services provided to that subscriber by the PLMN. If for at least one
bearer capability information element contained in the SETUP message a mismatch is detected, then the network shall
proceed as follows:
- if the SETUP message contained two bearer capability information elements for only one of which a mismatch is
detected, the network shall either:
- under the conditions specified in 3GPP TS 27.001 [36] (e.g. TS 61 and TS 62), accept the SETUP message
with a CALL PROCEEDING message containing the, possibly negotiated, bearer capability information
element for which no mismatch is detected, or
- reject the call using one of the causes listed in annex H.
- otherwise the network shall reject the call using one of the causes listed in annex H.
Network services are described in 3GPP TS 22.002 [3] and 3GPP TS 22.003 [4] as bearer services and teleservices,
respectively.
B.3 Called side compatibility checking

In this clause, the word "check" means that the MS examines the contents of the specified information element.
ETSI
Release 18 748 3GPP TS 24.008 V18.4.0 (2023-09)
B.3.1 Compatibility checking with addressing information

If an incoming SETUP message is offered to the MS with addressing information (i.e. sub-address or called party
number) the following shall occur:
a) if the MS has a DDI number or a sub-address, then the information in any Called Party BCD Number or any
Called Party subaddress information elements of the incoming SETUP message shall be checked by the MS
against the corresponding part of the number assigned to the user (e.g. for DDI) or the user's own sub-address.
In the cases of a mismatch, the MS shall release the call. In the case of a match, the compatibility checking
described in B.3.2 and B.3.3 shall be performed.
b) if the MS has no DDI number and no sub-address, then the Called Party BCD Number and Called Party Sub-
address information element shall be ignored for the purposes of compatibility checking. The compatibility
checking described in B.3.2 and B.3.3 shall be performed.
NOTE: According to the user's requirements, compatibility checking can be performed in various ways from the
viewpoint of execution order and information to be checked, e.g. first DDI number/sub-address and then
bearer capability or vice versa.
B.3.2 Network-to-MS compatibility checking

When the network is providing a basic service at the called side, the MS shall check that the basic service(s) offered by
the network in the Bearer Capability information element(s) match(es) the basic services that the MS is able to support.
If a mismatch is detected, then the MS shall proceed as follows:
- if the SETUP message contained two bearer capability information elements for only one of which a mismatch is
detected, the MS shall either:
- under the conditions specified in 3GPP TS 27.001 [36] (e.g. TS 61 and TS 62), accept the SETUP message
with a CALL CONFIRMED message containing the, possibly negotiated, bearer capability information
element for which no mismatch is detected, or
- reject the call using cause No. 88 "incompatible destination".
- otherwise the MS shall reject the offered call using a RELEASE COMPLETE message with cause No. 88
"incompatible destination".
NOTE: The backup bearer capability IE is not subject to compatibility checking.
When interworking with existing networks, limitations in network or distant user signalling (e.g. in the case of an
incoming call from a PSTN or a call from an analogue terminal) may restrict the information available to the called MS
in the incoming SETUP message (e.g. missing Bearer Capability Information Element or missing High Layer
Compatibility Information Element). For compatibility checking, and handling of such calls see 3GPP TS 27.001 [36].
B.3.3 User-to-User compatibility checking

See 3GPP TS 27.001 [36].
B.4 High layer compatibility checking

See 3GPP TS 27.001 [36].
ETSI
Release 18 749 3GPP TS 24.008 V18.4.0 (2023-09)
Annex C (normative):
Low layer information coding principles
C.1 Purpose
This annex describes principles that shall be used when the calling MS specifies information during call setup regarding
low layer capabilities required in the network and by the destination terminal. Refer also to 3GPP TS 27.001 [36].
NOTE: In this context and throughout this annex the term "called user" is the end point entity which is explicitly
addressed. This may also be an explicitly addressed interworking unit (IWU) (see ITU-T I.500-Series
Recommendations and ITU-T Recommendation X.31 case a).
C.2 Principles
C.2.1 Definition of types of information

There are three different types of information that the calling PLMN user may specify during call setup to identify low
layer capabilities needed in the network and in the destination terminal:
a) type I information is information about the calling terminal which is only used at the destination end to allow a
decision regarding terminal compatibility. An example would be the user information layer 3 protocol. Type I
information is encoded in octets 5 to 7 of the low layer compatibility information element;
b) type II information is only used by the network (PLMN) to which the calling user is connected for selection of
PLMN specific network resources, e.g. channel type or specific functionality within the interworking function
(IWF, see 3GPP TS 23.093 [88a]). This type of information is always present. An example is the connection
element. Type II information is coded in:
i) octet 3 of the bearer capability information element when the information transfer capability required by the
calling user is speech ;
ii) octets 3, 4, 5, and optionally octet 7 of the bearer capability information element when the information
transfer capability required by the calling user is not speech;
c) type III information is required for selection of a basic service from the choice of basic services offered by the
network and together with type II information for selection of an appropriate interworking function (IWF, see
3GPP TS 29.007 [38]), as well as for terminal compatibility checking at the destination terminal. An example is
the information transfer capability. Type III information is always present and is encoded in:
i) octet 3 of the bearer capability information element when the information transfer capability required by the
calling user is speech ;
ii) octets 3, 5, 6, 6a, 6b and 6c of the bearer capability information element when the information transfer
capability required by the calling user is not speech;
C.2.2 Examination by network

Type I information is user-to-user (i.e. at the calling side not examined by network) while type II and III information
should be available for examination by the destination user and the network.
NOTE: In the case of a mobile terminated call, if the type II and type III information is not sufficient for the
selection of an appropriate interworking function, the type I information will also examined by the
network.
ETSI
Release 18 750 3GPP TS 24.008 V18.4.0 (2023-09)
C.2.3 Location of type I information

Type I information (i.e. terminal information only significant to the called user) shall, when used, be included in the low
layer compatibility information element.
C.2.4 Location of types II and III information

Type II information is included in the bearer capability information element. Type III information is also included in the
bearer capability information element. The network may use and modify type III information (e.g. to provide
interworking).
In any case a modification of the bearer capability information element has to be performed when interworking to the
fixed network (e.g. ISDN) is required, where the signalling of the radio interface has to be mapped to fixed network
signalling (e.g. mapping of GSM BCIE to ISDN BCIE, see 3GPP TS 29.007 [38]).
C.2.5 Relationship between bearer capability and low layer

compatibility information elements
There shall be no contradiction of information between the low layer compatibility and the bearer capability at the
originating side. However, as some bearer capability code points may be modified during the transport of the call (e.g.
by the interworking function), this principle implies that there should be minimal duplication of information between
the bearer capability information element and the low layer compatibility information element.
NOTE: If as a result of duplication, a contradiction occurs at the terminating side between the bearer capability
information element and the low layer compatibility information element at the terminating side, the
receiving entity shall ignore the conflicting information in the low layer compatibility information
element.
ETSI
Release 18 751 3GPP TS 24.008 V18.4.0 (2023-09)
Annex D (informative):
Examples of bearer capability information element coding
This annex gives examples of the coding of bearer capability information elements for various telecommunication
services. This annex is included for information purposes only. In the case of any inconsistency between this annex and
3GPP TS 27.001 [36], then 3GPP TS 27.001 [36] shall take precedence over this annex.
D.1 Coding for speech for a full rate support only mobile
station
D.1.1 Mobile station to network direction
8 7 6 5 4 3 2 1
0 0 0 0 0 1 0 0 octet 1
Bearer capability IEI
0 0 0 0 0 0 0 1
1 0 1 0 0 0 0 0
not full rate GSM circ. speech octet 3
ext only mode
D.1.2 Network to mobile station direction
8 7 6 5 4 3 2 1
0 0 0 0 0 1 0 0 octet 1
0 0 0 0 0 0 0 1
1 0 1 0 0 0 0 0
not spare spare GSM circ. speech octet 3
ext mode
ETSI
Release 18 752 3GPP TS 24.008 V18.4.0 (2023-09)
D.2 An example of a coding for modem access with V22-

bis, 2,4 kbit/s, 8 bit no parity
D.2.1 Mobile station to network direction, data compression

allowed
8 7 6 5 4 3 2 1
0 0 0 0 0 1 0 0 octet 1
0 0 0 0 0 1 1 1
1 1 0 0 0 0 1 0
not dual, half GSM circ. 3.1 kHz audio octet 3
ext preferred mode ex PLMN
1 1 0 0 1 0 0 0
not comp- SDU full pt to pt no de- octet 4
ext ress. integrity dupl. NIRR mand
1 0 0 0 0 0 0 1
not access id. no rate I.440/450 octet 5
ext adaption
0 0 1 0 0 0 0 1
ext layer 1 default layer 1 async octet 6
0 0 0 1 0 0 1 1
ext 1 bit no neg 2.4 kbit/s octet 6a
8 bits
0 1 1 0 0 0 1 1
ext 16 kbit/s no no (parity) none octet 6b
inter. rate NICtx NICrx
1 0 1 0 0 0 1 1
not non trans V.22 bis octet 6c
ext RLP)
ETSI
Release 18 753 3GPP TS 24.008 V18.4.0 (2023-09)
D.2.2 Network to mobile station direction, data compression

possible
8 7 6 5 4 3 2 1
0 0 0 0 0 1 0 0 octet 1
0 0 0 0 0 1 1 1
1 0 1 0 0 0 1 0
not spare spare GSM circ. 3.1 kHz audio octet 3
ext mode ex PLMN
1 1 0 0 1 0 0 0
not comp- SDU full pt to pt no de- octet 4
ext ress. integrity dupl. NIRR mand
1 0 0 0 0 0 0 1
ext adaption
0 0 1 0 0 0 0 1
ext layer 1 default layer 1 async octet 6
0 0 0 1 0 0 1 1
ext 1 bit no 8 bits 2.4 kbit/s octet 6a
neg
0 1 1 0 0 0 1 1
1 0 1 0 0 0 1 1
not non trans V.22 bis octet 6c
ext (RLP)
ETSI
Release 18 754 3GPP TS 24.008 V18.4.0 (2023-09)
D.3 An example of a coding for group 3 facsimile (9,6

kbit/s, transparent)
D.3.1 Mobile station to network direction
8 7 6 5 4 3 2 1
0 0 0 0 0 1 0 0 octet 1
0 0 0 0 0 1 1 1
1 0 1 0 0 0 1 1
not full rate GSM circ. facsimile octet 3
ext only MS mode group 3
1 0 1 1 1 0 0 0
not comp- unstructured full pt to no de- octet 4
ext ress. dupl. pt NIRR mand
1 0 0 0 0 0 0 1
ext adaption
0 0 1 0 0 0 0 0
ext layer 1 default layer 1 sync octet 6
0 0 0 1 0 1 0 1
ext (syn) no (syn) 9.6 kbit/s octet 6a
neg
0 1 1 0 0 0 1 1
1 0 0 0 0 0 1 1
not transparent none octet 6c
ext (modem type)
ETSI
Release 18 755 3GPP TS 24.008 V18.4.0 (2023-09)
D.3.2 Network to mobile station direction
8 7 6 5 4 3 2 1
0 0 0 0 0 1 0 0 octet 1
0 0 0 0 0 1 1 1
1 0 1 0 0 0 1 1
not spare spare GSM circ. facsimile octet 3
ext mode group 3
1 0 1 1 1 0 0 0
not comp- unstructured full pt to no de- octet 4
ext ress. dupl. pt NIRR mand
1 0 0 0 0 0 0 1
ext adaption
0 0 1 0 0 0 0 0
ext layer 1 default layer 1 sync octet 6
0 0 0 1 0 1 0 1
ext (syn) no (syn) 9.6 kbit/s octet 6a
neg
0 1 1 0 0 0 1 1
1 0 0 0 0 0 0 0
not transparent none octet 6c
ext (modem type)
ETSI
Release 18 756 3GPP TS 24.008 V18.4.0 (2023-09)
Annex E (informative):
Comparison between call control procedures specified in
3GPP TS 24.008 and ITU-T Recommendation Q.931
This annex summarizes a comparison of the procedures for call control as specified in ITU-T Recommendation Q.931
(blue book) and 3GPP TS 24.008.
If no comment is given, it means that the procedures specified in ITU-T Recommendation Q.931 and 3GPP TS 24.008
are similar. However, it should be noted that even in such cases the procedures may be described in slightly different
ways in the two documents.
Table E.1/3GPP TS 24.008: Circuit-switched call control procedures
Procedure Q.931 3GPP TS 24.008

Call establishment at the 5.1 5.2.1
originating interface
- call request 5.1.1 5.2.1.1.1

en-bloc sending only
- B-channel selection originating 5.1.2 not applicable
- overlap sending 5.1.3 not supported
- invalid call information 5.1.4 5.2.1.1.2
- call proceeding, en-bloc sending 5.1.5.1 5.2.1.1.3
- call proceeding, overlap sending 5.1.5.2 not supported
- notification of interworking at the 5.1.6 5.2.1.1.4

originating interf.
- call confirmation indication 5.1.7 5.2.1.1.5
- call connected 5.1.8 5.2.1.1.6
- call rejection 5.1.9 5.2.1.1.7
- transit network selection 5.1.10 5.2.1.1.8
ETSI
Release 18 757 3GPP TS 24.008 V18.4.0 (2023-09)
Table E.1/3GPP TS 24.008: Circuit-switched call control procedures (continued)

Call establishment at the 5.2 5.2.2
destination interface
- call indication 5.2.1 5.2.2.1

procedure for multiple terminal
configuration not required, i.e.
delivery of SETUP messages on
broadcast data links is not supported
- compatibility checking 5.2.2 5.2.2.2

equivalent, except that delivery of
SETUP messages on broadcast data
links is not supported
- B-channel selection destination 5.2.3 not applicable
- overlap receiving 5.2.4 not supported
- call confirmation information 5.2.5 5.2.2.3

equivalent, except that delivery of
SETUP messages on broadcast data
links is not supported
- notification of interworking at the 5.2.6 5.2.2.4

terminating interf.
- call accept indication 5.2.7 5.2.2.5
- active indication 5.2.8 5.2.2.6

equivalent, except that SETUP
messages are not sent on broadcast
data links
- non-selected user clearing 5.2.9 not applicable
ETSI
Release 18 758 3GPP TS 24.008 V18.4.0 (2023-09)

Call clearing 5.3 5.4
- terminology 5.3.1 5.4.1

terminology adapted to A/Gb mode
and GERAN Iu mode applications
- exception conditions 5.3.2 5.4.2

only case a) of clause 5.3.2 of Rec.
Q.931 applies. All other exceptions
apply to functions which are not
relevant to A/Gb mode and GERAN
Iu mode
- clearing initiated by the user/MS 5.3.3 5.4.3
- clearing initiated by the network 5.3.4 5.4.4
- clearing when 5.3.4.1 5.4.4.1.1 and 5.4.4.2.1

tones/announcements are exception: if not already connected,
provided the traffic channel is connected in
order to provide the
tone/announcement
- clearing when 5.3.4.2 5.4.4.1.2 and 5.4.4.2.3

tones/announcements are not
provided
- completion of clearing 5.3.4.3 5.4.4.1.3 and 5.4.4.2.5
Clear collision 5.3.5 5.4.5
ETSI
Release 18 759 3GPP TS 24.008 V18.4.0 (2023-09)

In-band tones and 5.4 5.5.1
announcements
Restart procedure 5.5 not supported
Call rearrangements 5.6 5.3.4

call suspension/call re-establishment
not supported on the radio path.
The functions, if required, are to be
supported locally in the MS. On the
radio interface, the notification
procedure of Rec. Q.931
(clause5.6.7) applies
Call collisions 5.7 5.5.2

call collisions cannot occur
Emergency call establishment at not specified 5.2.1.2

the originating interface not supported
In-call modification Annex O 5.3.4

Rec. Q.931 is
incomplete with
regard to in-call
modification
procedures
DTMF protocol control not specified 5.3.3

procedures not supported
Call re-establishment not specified 5.5.4

not supported
Status enquiry procedure 5.8.10, 5.8.11 5.5.3
User-to-user signalling 7 3GPP TS 24.010 [21]
User notification procedure 5.9 5.3.1
ETSI
Release 18 760 3GPP TS 24.008 V18.4.0 (2023-09)
Annex F (informative):
A/Gb mode specific cause values for radio resource
management
See 3GPP TS 44.018 [84].
ETSI
Release 18 761 3GPP TS 24.008 V18.4.0 (2023-09)
Annex G (informative):
3GPP specific cause values for mobility management
This annex describes the cause values for the mobility management procedures for non-GPRS services (MM) and
GPRS services (GMM). Clauses G1 to G5 are valid for both MM and GMM. However, the following codes are
applicable for non-GPRS services only:
#38 Call cannot be identified
Clause G.6 applies only for GMM procedures.
G.1 Causes related to MS identification

Cause value = 2 IMSI unknown in HLR
This cause is sent to the MS if the MS is not known (registered) in the HLR, or if the MS has packet only
subscription (see 3GPP TS 29.272 [150]). This cause code does not affect operation of the GPRS service,
although is may be used by a GMM procedure.
Cause value = 3 Illegal MS
This cause is sent to the MS when the network refuses service to the MS either because an identity of the MS is
not acceptable to the network or because the MS does not pass the authentication check, i.e. the SRES received
from the MS is different from that generated by the network. When used by an MM procedure, except the
authentication procedure, this cause does not affect operation of the GPRS service.
Cause value = 4 IMSI unknown in VLR
This cause is sent to the MS when the given IMSI is not known at the VLR.
Cause value = 5 IMEI not accepted
This cause is sent to the MS if the network does not accept emergency call establishment using an IMEI or not
accept attach procedure for emergency services using an IMEI.
Cause value = 6 Illegal ME
This cause is sent to the MS if the ME used is not acceptable to the network, e.g. prohibit listed When used by an
MM procedure, this cause does not affect operation of the GPRS service.
G.2 Cause related to subscription options

Cause value = 11 PLMN not allowed
This cause is sent to the MS if it requests service, or if the network initiates a detach request, in a PLMN where
the MS, by subscription or due to operator determined barring is not allowed to operate.
Cause value = 12 Location Area not allowed
This cause is sent to the MS if it requests service, or if the network initiates a detach request, in a location area
where the HPLMN determines that the MS, by subscription, is not allowed to operate.
NOTE 1: If cause #12 is sent to a roaming subscriber the subscriber is denied service even if other PLMNs are
available on which registration was possible.
Cause value = 13 Roaming not allowed in this location area
This cause is sent to an MS which requests service, or if the network initiates a detach request, in a location area
of a PLMN which by subscription offers roaming to that MS but not in that location area.
ETSI
Release 18 762 3GPP TS 24.008 V18.4.0 (2023-09)
Cause value = 15 No Suitable Cells In Location Area
This cause is sent to the MS if it requests service, or if the network initiates a detach request, in a location area
where the MS, by subscription, is not allowed to operate, but when it should find another allowed location area
or tracking area in the same PLMN or an equivalent PLMN.
NOTE 2: Cause #15 and cause #12 differ in the fact that cause #12 does not trigger the MS to search for another
allowed location area on the same PLMN.
Cause value = 25 Not authorized for this CSG
This cause is sent to the MS if it requests access, or if the network initiates a detach request, in a CSG cell where
the MS either has no subscription to operate or the MS's subscription has expired and it should find another cell
in the same PLMN or an equivalent PLMN.
NOTE 3: The MS not supporting CSG will not receive cause# 25, as such a MS is not supposed to try to access a
CSG cell.
G.3 Causes related to PLMN specific network failures

and congestion/Authentication Failures
Cause value = 20 MAC failure
This cause is sent to the network if the USIM detects that the MAC in the AUTHENTICATION REQUEST or
AUTHENTICATION_AND_CIPHERING REQUEST message is not fresh (see 3GPP TS 33.102 [5a]).
Cause value = 21 Synch failure
This cause is sent to the network if the USIM detects that the SQN in the AUTHENTICATION REQUEST or
AUTHENTICATION_AND_CIPHERING REQUEST message is out of range (see 3GPP TS 33.102 [5a]).
Cause value = 17 Network failure
This cause is sent to the MS if the MSC cannot service an MS generated request because of PLMN failures, e.g.
problems in MAP.
Cause value = 22 Congestion
This cause is sent to the MS if the network cannot serve a request from the MS because of congestion (e.g.
congestion of the MSC or SGSN or GGSN or PDN Gateway; no channel; facility busy/congested etc.).
Cause value = 23 GSM authentication unacceptable
This cause is sent to the network in Iu mode if a USIM is inserted in the MS and there is no Authentication
Parameter AUTN IE present in the AUTHENTICATION REQUEST or
AUTHENTICATION_AND_CIPHERING REQUEST message.
G.4 Causes related to nature of request

Cause value = 32 Service option not supported
This cause is sent when the MS requests a service/facility in the CM SERVICE REQUEST message which is not
supported by the PLMN.
Cause value = 33 Requested service option not subscribed
This cause is sent when the MS requests a service option for which it has no subscription.
Cause value = 34 Service option temporarily out of order
ETSI
Release 18 763 3GPP TS 24.008 V18.4.0 (2023-09)
This cause is sent when the MSC cannot service the request because of temporary outage of one or more
functions required for supporting the service.
Cause value = 38 Call cannot be identified
This cause is sent when the network cannot identify the call associated with a call re-establishment request.
G.5 Causes related to invalid messages

Cause value = 95 Semantically incorrect message.
See annex H, subclause H.5.10.
Cause value = 96 Invalid mandatory information.
Cause value = 97 Message type non-existent or not implemented.
Cause value = 98 Message type not compatible with protocol state.
Cause value = 99 Information element non-existent or not implemented.
Cause value = 100 Conditional IE error.
Cause value = 101 Message not compatible with protocol state.
Cause value = 111 Protocol error, unspecified.
G.6 Additional cause codes for GMM

Cause value = 7 GPRS services not allowed
This cause is sent to the MS when it is not allowed to operate GPRS services.
Cause value = 8 GPRS services and non-GPRS services not allowed
This cause is sent to the MS when it is not allowed to operate either GPRS or non-GPRS services.
Cause value = 9 MS identity cannot be derived by the network
This cause is sent to the MS when the network cannot derive the MS's identity from the P-TMSI/GUTI, e.g.
because no matching identity/context can be found in the network.
Cause value = 10 Implicitly detached
This cause is sent to the MS either if the network has implicitly detached the MS, e.g. some while after the
mobile reachable timer has expired, or if the GMM context data related to the subscription dose not exist in the
SGSN e.g. because of a SGSN restart, or because of a periodic routing area update request routed to a new
SGSN.
ETSI
Release 18 764 3GPP TS 24.008 V18.4.0 (2023-09)
Cause value = 14 GPRS services not allowed in this PLMN
This cause is sent to the MS which requests GPRS service, or if the network initiates a detach request in a PLMN
which does not offer roaming for GPRS services to that MS.
Cause value = 16 MSC temporarily not reachable
This cause is sent to the MS if it requests a combined GPRS attach or routing are updating in a PLMN where the
MSC is temporarily not reachable via the GPRS part of the network.
Cause value = 28 SMS provided via GPRS in this routing area
This cause is sent to the MS if the SGSN decides not to establish a Gs association since the MS is supposed to
send and receive short messages via GPRS.
Cause value = 40 No PDP context activated
This cause is sent to the MS if the MS requests an establishment of the radio access bearers for all active PDP
contexts by sending a SERVICE REQUEST message indicating "data" to the network, but the SGSN does not
have any active PDP context(s).
ETSI
Release 18 765 3GPP TS 24.008 V18.4.0 (2023-09)
Annex H (informative):
3GPP specific cause values for call control
H.1 Normal class
H.1.1 Cause No. 1 "unassigned (unallocated) number"

This cause indicates that the destination requested by the mobile station cannot be reached because, although the
number is in a valid format, it is not currently assigned (allocated).
H.1.2 Cause No. 3 "no route to destination"

This cause indicates that the called user cannot be reached because the network through which the call has been routed
does not serve the destination desired.
H.1.3 Cause No. 6 "channel unacceptable"

This cause indicates the channel most recently identified is not acceptable to the sending entity for use in this call.
H.1.4 Cause No. 8 "operator determined barring"

This cause indicates that the MS has tried to access a service that the MS's network operator or service provider is not
prepared to allow.
H.1.4a Cause No. 13 "call completed elsewhere"

This cause indicates that the call is being cleared by the network towards the present device because the called user has
responded to the call on another device. This cause only applies when the MSC/VLR is an MSC server enhanced for
ICS as specified in 3GPP TS 24.292 [163] and performs interworking with SIP as specified in 3GPP TS 29.292 [164].
H.1.5 Cause No.16 "normal call clearing"

This cause indicates that the call is being cleared because one of the users involved in the call has requested that the call
be cleared.
Under normal situations, the source of this cause is not the network.
H.1.6 Cause No.17 "user busy"

This cause is used when the called user has indicated the inability to accept another call.
It is noted that the user equipment is compatible with the call.
H.1.7 Cause No. 18 "no user responding"

This cause is used when a user does not respond to a call establishment message with either an alerting or connect
indication within the prescribed period of time allocated (defined by the expiry of either timer T303 or T310).
ETSI
Release 18 766 3GPP TS 24.008 V18.4.0 (2023-09)
H.1.8 Cause No. 19 "user alerting, no answer"

This cause is used when a user has provided an alerting indication but has not provided a connect indication within a
prescribed period of time.
H.1.9 Cause No. 21 "call rejected"

This cause indicates that the equipment sending this cause does not wish to accept this call, although it could
have accepted the call because the equipment sending this cause is neither busy nor incompatible.
H.1.10 Cause No. 22 "number changed"

This cause is returned to a calling mobile station when the called party number indicated by the calling mobile station is
no longer assigned. The new called party number may optionally be included in the diagnostic field. If a network does
not support this capability, cause No. 1 "unassigned (unallocated) number" shall be used.
H.1.10a Cause No. 24 "call rejected due to feature at the

destination"
This cause is returned when the call is rejected due to a feature at the destination, e.g. Anonymous Call Rejection. This
cause is only generated by the network. This cause is not generated by the MS.
H.1.11 Cause No. 25 "pre-emption"

This cause is returned to the network when a mobile station clears an active call which is being pre-empted by another
call with higher precedence.
H.1.12 Cause No. 26 "non-selected user clearing"

Not supported. Treated as cause no. 31.
H.1.13 Cause No. 27 "destination out of order"

This cause indicates that the destination indicated by the mobile station cannot be reached because the interface to the
destination is not functioning correctly. The term "not functioning correctly" indicates that a signalling message was
unable to be delivered to the remote user; e.g., a physical layer or data link layer failure at the remote user, user
equipment off-line, etc.
H.1.14 Cause No. 28 "invalid number format (incomplete number)"

This cause indicates that the called user cannot be reached because the called party number is not a valid format or is
not complete.
H.1.15 Cause No. 29 "facility rejected"

This cause is returned when a facility requested by user can not be provided by the network.
H.1.16 Cause No. 30 "response to STATUS ENQUIRY"

This cause is included in STATUS messages if the message is sent in response to a STATUS ENQUIRY message. See
also subclause 5.5.3.
ETSI
Release 18 767 3GPP TS 24.008 V18.4.0 (2023-09)
H.1.17 Cause No. 31 "normal, unspecified"

This cause is used to report a normal event only when no other cause in the normal class applies.
H.2 Resource unavailable class
H.2.1 Cause No. 34 "no circuit/channel available"

This cause indicates that there is no appropriate circuit/channel presently available to handle the call.
H.2.2 Cause No. 38 "network out of order"

This cause indicates that the network is not functioning correctly and that the condition is likely to last a relatively long
period of time; e.g., immediately re-attempting the call is not likely to be successful.
H.2.3 Cause No. 41 "temporary failure"

This cause indicates that the network is not functioning correctly and that the condition is not likely to last a long period
of time; e.g., the mobile station may wish to try another call attempt almost immediately.
H.2.4 Cause No. 42 "switching equipment congestion"

This cause indicates that the switching equipment generating this cause is experiencing a period of high traffic.
H.2.5 Cause No. 43 "access information discarded"

This cause indicates that the network could not deliver access information to the remote user as requested; i.e., a user-
to-user information, low layer compatibility, high layer compatibility, or sub-address as indicated in the diagnostic.
It is noted that the particular type of access information discarded is optionally included in the diagnostic.
H.2.6 Cause No. 44 "requested circuit/channel not available"

This cause is returned when the circuit or channel indicated by the requesting entity cannot be provided by the other
side of the interface.
H.2.7 Cause No. 47 "resource unavailable, unspecified"

This cause is used to report a resource unavailable event only when no other cause in the resource unavailable class
applies.
H.3 Service or option not available class
H.3.1 Cause No. 49 "quality of service unavailable"

This cause indicates to the mobile station that the requested quality of service, as defined in ITU-T Recommendation
X.213 [144], cannot be provided.
ETSI
Release 18 768 3GPP TS 24.008 V18.4.0 (2023-09)
H.3.2 Cause No. 50 "Requested facility not subscribed"

This cause indicates that the requested supplementary service could not be provided by the network because the user
has no completed the necessary administrative arrangements with its supporting networks.
H.3.3 Cause No. 55 "Incoming calls barred within the CUG"

This cause indicates that although the called party is a member of the CUG for the incoming CUG call, incoming calls
are not allowed within this CUG.
H.3.4 Cause No. 57 "bearer capability not authorized"

This cause indicates that the mobile station has requested a bearer capability which is implemented by the equipment
which generated this cause but the mobile station is not authorized to use.
H.3.5 Cause No. 58 "bearer capability not presently available"

This cause indicates that the mobile station has requested a bearer capability which is implemented by the equipment
which generated this cause but which is not available at this time.
H.3.6 Cause No. 63 "service or option not available, unspecified"

This cause is used to report a service or option not available event only when no other cause in the service or option not
available class applies.
H.3.7 Cause No. 68 "ACM equal to or greater than ACMmax"

This cause is used by the mobile to indicate that call clearing is due to ACM being greater than or equal to ACMmax.
H.4 Service or option not implemented class
H.4.1 Cause No. 65 "bearer service not implemented"

This cause indicates that the equipment sending this cause does not support the bearer capability requested.
H.4.2 Cause No. 69 "Requested facility not implemented"

This cause indicates that the equipment sending this cause does not support the requested supplementary service.
H.4.3 Cause No. 70 "only restricted digital information bearer

capability is available"
This cause indicates that one equipment has requested an unrestricted bearer service, but that the equipment
sending this cause only supports the restricted version of the requested bearer capability.
ETSI
Release 18 769 3GPP TS 24.008 V18.4.0 (2023-09)
H.4.4 Cause No. 79 "service or option not implemented,

unspecified"
This cause is used to report a service or option not implemented event only when no other cause in the service or
option not implemented class applies.
H.5 Invalid message (e.g., parameter out of range) class
H.5.1 Cause No. 81 "invalid transaction identifier value"

This cause indicates that the equipment sending this cause has received a message with a transaction identifier
which is not currently in use on the MS-network interface.
H.5.2 Cause No. 87 "user not member of CUG"

This cause indicates that the called user for the incoming CUG call is not a member of the specified CUG.
H.5.3 Cause No. 88 "incompatible destination"

This cause indicates that the equipment sending this cause has received a request to establish a call which has
low layer compatibility, high layer compatibility, or other compatibility attributes (e.g., data rate) which cannot
be accommodated.
H.5.4 Cause No. 91 "invalid transit network selection"

For further study. Treated as cause no. 95.
H.5.5 Cause No. 95 "semantically incorrect message"

This cause is used to report receipt of a message with semantically incorrect contents (see subclause 8.8).
H.6 Protocol error (e.g., unknown message) class
H.6.1 Cause No. 96 "invalid mandatory information"

This cause indicates that the equipment sending this cause has received a message with a non-semantical
mandatory IE error (see subclause 8.5).
H.6.2 Cause No. 97 "message type non-existent or not

implemented"
This cause indicates that the equipment sending this cause has received a message with a message type it does
not recognize either because this is a message not defined, or defined but not implemented by the equipment
sending this cause.
ETSI
Release 18 770 3GPP TS 24.008 V18.4.0 (2023-09)
H.6.3 Cause No. 98 "message type not compatible with protocol

state"
This cause indicates that the equipment sending this cause has received a message not compatible with the
protocol state (subclause 8.4).
H.6.4 Cause No. 99 "information element non-existent or not

implemented"
This cause indicates that the equipment sending this cause has received a message which includes information
elements not recognized because the information element identifier is not defined or it is defined but not
implemented by the equipment sending the cause. However, the information element is not required to be
present in the message in order for the equipment sending the cause to process the message.
H.6.5 Cause No. 100 "conditional IE error"

This cause indicates that the equipment sending this cause has received a message with conditional IE errors (see
subclause 8.7.2).
H.6.6 Cause No. 101 "message not compatible with protocol

state"
This cause indicates that a message has been received which is incompatible with the protocol state or that a
STATUS message has been received indicating an incompatible call state.
H.6.7 Cause No. 102 "recovery on timer expiry"

This cause indicates that a procedure has been initiated by the expiry of a timer in association with
3GPP TS 24.008 error handling procedures.
H.6.8 Cause No. 111 "protocol error, unspecified"

This cause is used to report a protocol error event only when no other cause in the protocol error class applies.
H.7 Interworking class
H.7.1 Cause No. 127 "interworking, unspecified"

This cause indicates that there has been interworking with a network which does not provide causes for actions it
takes; thus, the precise cause for a message which is being sent cannot be ascertained.
ETSI
Release 18 771 3GPP TS 24.008 V18.4.0 (2023-09)
Annex I (informative):
GPRS specific cause values for GPRS Session
Management
I.1 Causes related to nature of request

Cause value = 8 Operator Determined Barring
This cause code is used by the network to indicate that the requested service was rejected by the SGSN due to
Operator Determined Barring.
Cause value = 24 MBMS bearer capabilities insufficient for the service
This cause code is used by the network to indicate that an MBMS context activation request was rejected by the
network, because the MBMS bearer capabilities are insufficient for the MBMS service.
Cause value = 25 LLC or SNDCP failure (A/Gb mode only)

This cause code is used by the MS indicate that a PDP context is deactivated because of a LLC or SNDCP
failure (e.g. if the SM receives a SNSM-STATUS.request message with cause "DM received " or " invalid XID
response ", see 3GPP TS 44.065 [78])
Cause value = 26 Insufficient resources

This cause code is used by the MS or by the network to indicate that a PDP context activation request, secondary
PDP context activation request, PDP context modification request, or MBMS context activation request cannot
be accepted due to insufficient resources.
Cause value = 27 Missing or unknown APN
This cause code is used by the network to indicate that the requested service was rejected by the external packet
data network because the access point name was not included although required, or if the access point name
could not be resolved.
Cause value = 28 Unknown PDP address or PDP type
data network because the PDP address or type could not be recognised.
Cause value = 29 User authentication failed
data network due to a failed user authentication.
Cause value = 30 Activation rejected by GGSN, Serving GW or PDN GW
This cause code is used by the network to indicate that the requested service was rejected by the GGSN, Serving
GW or PDN GW.
Cause value = 31 Activation rejected, unspecified
This cause code is used by the network or by the MS to indicate that the requested service was rejected due to
unspecified reasons.
Cause value = 32 Service option not supported
This cause code is used by the network when the MS requests a service which is not supported by the PLMN.
Cause value = 33 Requested service option not subscribed
See Annex G, clause 4.
ETSI
Release 18 772 3GPP TS 24.008 V18.4.0 (2023-09)
Cause value = 34 Service option temporarily out of order
See Annex G, clause 4.
Cause value = 35 NSAPI already used
This cause code may be used by a network to indicate that the NSAPI requested by the MS in the PDP context
activation request is already used by another active PDP context of this MS.
Never to be sent, but can be received from a R97/R98 network at PDP context activation
Cause value = 36 Regular deactivation
This cause code is used to indicate a regular MS or network initiated PDP context deactivation or a regular
network initiated MBMS context deactivation.
Cause value = 37 QoS not accepted
This cause code is used by the MS if the new QoS cannot be accepted that were indicated by the network in the
PDP Context Modification procedure.
Cause value = 38 Network failure
This cause code is used by the network to indicate that the requested service is rejected due to an error situation
in the network.
Cause value = 39 Reactivation requested
This cause code is used by the network to request a PDP context reactivation (e.g. after a GGSN restart or after
selection of a different GGSN by the network for Selected IP Traffic Offload).
Cause value = 40 Feature not supported
This cause code is used by the MS to indicate that the PDP context activation or the MBMS context activation
initiated by the network is not supported by the MS.
Cause value = 41 semantic error in the TFT operation.
This cause code is used by the network or the MS to indicate that there is a semantic error in the TFT operation
included in a secondary PDP context activation request or an MS-initiated PDP context modification or a
network requested secondary PDP context activation.
Cause value = 42 syntactical error in the TFT operation.
This cause code is used by the network or the MS to indicate that there is a syntactical error in the TFT operation
included in a secondary PDP context activation request or an MS-initiated PDP context modification or a
network requested secondary PDP context activation.
Cause value = 43 unknown PDP context
This cause code is used by the network or the MS to indicate that the PDP context identified by the Linked TI IE
in the secondary PDP context activation request or a network requested secondary PDP context activation is not
active.
Cause value = 44 semantic errors in packet filter(s)
This cause code is used by the network or the MS to indicate that there is one or more semantic errors in packet
filter(s) of the TFT included in a secondary PDP context activation request or an MS-initiated PDP context
modification or a network requested secondary PDP context activation.
Cause value = 45 syntactical error in packet filter(s)
This cause code is used by the network or the MS to indicate that there is one or more syntactical errors in packet
filter(s) of the TFT included in a secondary PDP context activation request or an MS-initiated PDP context
modification or a network requested secondary PDP context activation.
Cause value = 46 PDP context without TFT already activated
ETSI
Release 18 773 3GPP TS 24.008 V18.4.0 (2023-09)
This cause code is used by the network or the MS to indicate that it has already activated a PDP context without
TFT.
Cause value = 47 Multicast group membership time-out
This cause code is used by the network to indicate that the MBMS context is deactivated because the timer
supervising the IGMP group membership interval (see RFC 3376 [107], subclause 8.4) or the MLD multicast
listener interval (see RFC 2710 [108], subclause 7.4, and RFC 3810 [148], subclause 9.4) expired.
Cause value = 48 Request rejected, Bearer Control Mode violation
This cause code is used by the network or the MS to indicate that the requested service was rejected because of
Bearer Control Mode violation.
Cause value = 50 PDP type IPv4 only allowed
This cause code is used by the network to indicate that only PDP type IPv4 is allowed for the requested PDN
connectivity.
Cause value = 51 PDP type IPv6 only allowed
This cause code is used by the network to indicate that only PDP type IPv6 is allowed for the requested PDN
connectivity.
Cause value = 52 single address bearers only allowed
This cause code is used by the network to indicate that the requested PDN connectivity is accepted with the
restriction that only single IP version bearers are allowed.
Cause value = 56 Collision with network initiated request.
This cause code is used by the network to indicate that the MS-initiated request was rejected since the network
has requested a secondary PDP context activation for the same service using a network-initiated procedure.
Cause value = 57 PDP type IPv4v6 only allowed
This cause code is used by the network to indicate that only PDP types IPv4, IPv6 or IPv4v6 are allowed for the
requested PDN connectivity.
Cause value = 58 PDP type non IP only allowed
This cause code is used by the network to indicate that only PDP type non IP is allowed for the requested PDN
connectivity.
Cause value = 60 Bearer handling not supported
This cause code is used by the network to indicate that the procedure requested by the MS was rejected because
the bearer handling is not supported.
Cause value = 65 Maximum number of PDP contexts reached
This cause code is used by the network to indicate that the procedure requested by the MS was rejected as the
network has reached the maximum number of simultaneously active PDP contexts for the MS.
Cause value = 66 Requested APN not supported in current RAT and PLMN combination
This cause code is used by the network to indicate that the procedure requested by the MS was rejected because
the requested APN is not supported in the current RAT and PLMN.
Cause value = 112 APN restriction value incompatible with active PDP context.
This cause code is used by the network to indicate that the PDP context(s) or MBMS context(s) have an APN
restriction value that is not allowed in combination with a currently active PDP context. Restriction values are
defined in 3GPP TS 23.060 [74], subclause 15.4.
Cause value = 113 Multiple accesses to a PDN connection not allowed
ETSI
Release 18 774 3GPP TS 24.008 V18.4.0 (2023-09)
This ESM cause is used by the network to indicate that multiple accesses to a PDN connection for NBIFOM is
not allowed.
I.2 Causes related to invalid messages

Cause value = 81 Invalid transaction identifier value.
Cause value = 95 Semantically incorrect message.
Cause value = 96 Invalid mandatory information.
Cause value = 97 Message type non-existent or not implemented.
Cause value = 98 Message type not compatible with protocol state.
Cause value = 99 Information element non-existent or not implemented.
Cause value = 100 Conditional IE error.
Cause value = 101 Message not compatible with protocol state.
Cause value = 111 Protocol error, unspecified.
I.3 Void
ETSI
Release 18 775 3GPP TS 24.008 V18.4.0 (2023-09)
Annex J (informative):
Algorithm to encode frequency list information elements
See 3GPP TS 44.018 [84].
ETSI
Release 18 776 3GPP TS 24.008 V18.4.0 (2023-09)
Annex K (informative):
Default Codings of Information Elements
The information in this annex does NOT define the value of any IEI for any particular message. This annex exists to aid
the design of new messages, in particular with regard to backward compatibility with phase 1 mobile stations.
K.1 Common information elements.

For the common information elements types listed below, the default coding of information element identifier bits is
summarized in table K.1/3GPP TS 24.008.
Table K.1/3GPP TS 24.008: Default information element identifier coding

for common information elements
Reference
clause
8 7 6 5 4 3 2 1
1 : : : - - - - Type 1 info elements
1 1 1 1 - - - - Note 1
0 : : : : : : : Type 3 & 4 info elements
0 0 0 1 0 0 0 1 Note 1
0 0 0 1 0 0 1 1 Location Area Identification 10.5.1.3
0 0 0 1 0 1 1 1 Mobile Identity 10.5.1.4
0 0 0 1 1 0 0 0 Note 1
0 0 0 1 1 1 1 1 Note 1
0 0 1 0 0 0 0 0 Mobile Station classmark 3 10.5.1.7
Spare Half Octet 10.5.1.8

NOTE 1: These values were allocated but never used in earlier phases of the protocol.
NOTE 2: For GPRS common information elements no default values are defined:
K.2 Radio Resource management information elements.

See 3GPP TS 44.018 [84], annex K.
K.3 Mobility management information elements.

For the mobility management information elements listed below, the default coding of the information element
identifier bits is summarized in table K.3/3GPP TS 24.008.
ETSI
Release 18 777 3GPP TS 24.008 V18.4.0 (2023-09)
Table K.3/3GPP TS 24.008: Default information element identifier coding for mobility management
information elements
Reference
clause
8 7 6 5 4 3 2 1
Type 1 info elements

1 0 0 1 - - - - Note
1 1 0 0 - - - - Note
1 1 1 0 - - - - Note
1 0 1 0 - - - - Type 2 info elements

0 0 0 1 Follow-on Proceed 10.5.3.7
0 0 1 0 CTS Permission 10.5.3.10
Type 3 & 4 info elements

0 1 0 0 0 0 0 1 Note
0 1 0 0 0 0 1 0 Note
0 1 0 0 0 1 0 0 Note
NOTE: These values were allocated but never used in earlier versions of the protocol
K.4 Call control information elements.

For the call control information elements listed below, the default coding of the information element identifiers is
defined in table K.4/3GPP TS 24.008.
ETSI
Release 18 778 3GPP TS 24.008 V18.4.0 (2023-09)
Table K.4/3GPP TS 24.008: Default information element identifier coding for call control information
elements
Reference
clause
8 7 6 5 4 3 2 1
1 : : : - - - - Type 1 info elements
0 0 1 - - - - shift 10.5.4.2
and .3
0 1 1 - - - - Note
1 0 1 - - - - Repeat indicator 10.5.4.22
1 0 1 0 : : : : Type 2 information elements

0 0 0 0 More data 10.5.4.19
0 0 0 1 CLIR Suppression 10.5.4.11a
0 0 1 0 CLIR Invocation 10.5.4.11b
0 0 1 1 Reverse call setup direction 10.5.4.22a
0 : : : : : : : Type 3 & 4 info elements

0 0 0 0 1 0 0 Bearer capability 10.5.4.5
0 0 0 1 0 0 0 Cause 10.5.4.11
0 0 1 0 1 0 0 Note
0 0 1 0 1 0 1 Call Control Capabilities 10.5.4.5a
0 0 1 1 1 0 0 Facility 10.5.4.15
0 0 1 1 1 1 0 Progress indicator 10.5.4.21
0 1 0 0 1 0 0 Auxiliary states 10.5.4.4
0 1 0 0 1 1 1 Note
0 1 0 1 1 0 0 Keypad facility 10.5.4.17
0 1 1 0 1 0 0 Signal 10.5.4.23
1 0 0 1 1 0 0 Connected number 10.5.4.13
1 0 0 1 1 0 1 Connected subaddress 10.5.4.14
1 0 1 1 1 0 0 Calling party BCD number 10.5.4.9
1 0 1 1 1 0 1 Calling party subaddress 10.5.4.10
1 0 1 1 1 1 0 Called party BCD number 10.5.4.7
1 1 0 1 1 0 1 Called party subaddress 10.5.4.8
1 1 1 0 1 0 0 Redirecting Party BCD 10.5.4.21b
1 1 1 1 1 0 1 Redirecting Party subaddress 10.5.4.21c
1 1 1 1 1 0 0 Low layer compatib. 10.5.4.18
1 1 1 1 1 0 1 High layer compatib. 10.5.4.16
1 1 1 1 1 1 0 User-user 10.5.4.25
1 1 1 1 1 1 1 SS version indicator 10.5.4.24
NOTE: These values were allocated but never used in earlier phases of the protocol.
ETSI
Release 18 779 3GPP TS 24.008 V18.4.0 (2023-09)
Annex L (normative):
Establishment cause (Iu mode only)
L.1 Mapping of NAS procedure to RRC establishment

cause(Iu mode only)
When MM requests the establishment of an RR connection, the RRC establishment cause used by the MS shall be
selected according to the CS NAS procedure as specified in table L.1.1.
Table L.1.1/3GPP TS 24.008: Mapping of CS NAS procedure to establishment cause
CS NAS procedure RRC Establishment cause (according 3GPP TS 25.331 [23c])

Originating CS speech call Originating Conversational Call
Originating CS data call Originating Conversational Call
CS Emergency call Emergency call
Call re-establishment Call re-establishment
Location update Registration
IMSI Detach Detach
MO SMS via CS domain Originating Low Priority Signalling
Supplementary Services Originating High Priority Signalling
Answer to circuit switched paging Set equal to the value of the paging cause used in the reception of paging in the
RRC layer
Answer to paging for CS fallback Terminating Conversational Call
Terminating High Priority Signalling, if in the E-UTRAN, the RRC connection is
released with cause CS Fallback High Priority.
SS part of Location services Originating High Priority Signalling
Any CS NAS procedure where the Delay tolerant
initiating uplink signalling message
has the Device properties IE with
low priority indicator set to "MS is
configured for NAS signalling low
priority"
When MM requests the establishment of an RR connection, if the MS is configured for EAB (see the
"ExtendedAccessBarring" leaf of the NAS configuration MO in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]), the
MS is not an MS configured to use AC11 – 15 in selected PLMN, the MS is not answering to paging and the RRC
Establishment cause is not set to "Emergency call", then the MM shall indicate to the lower layer for the purpose of
access control that EAB applies for this request.
NOTE 1: void.
NOTE 2: EAB override is not supported in the CS domain.
When GMM requests the establishment of a PS signalling connection, the RRC establishment cause used by the MS
shall be selected according to the PS NAS procedure as specified in Table L.1.2.
ETSI
Release 18 780 3GPP TS 24.008 V18.4.0 (2023-09)
Table L.1.2/3GPP TS 24.008: Mapping of PS NAS procedure to establishment cause
ETSI
Release 18 781 3GPP TS 24.008 V18.4.0 (2023-09)
PS NAS procedure RRC Establishment cause (according 3GPP TS 25.331 [23c])

GPRS Attach If the ATTACH REQUEST has Attach type not set to "Emergency attach", the RRC
establishment cause shall be set to Registration except when the MS initiates
attach procedure to establish emergency bearer services.
If the ATTACH REQUEST has Attach type set to "Emergency attach" or if the
ATTACH REQUEST has Attach type not set to "Emergency attach" but the MS
initiates the attach procedure on receiving request from upper layer to establish
emergency bearer services, the RRC establishment cause shall be set to
Emergency call. (See Note 2)
Routing Area Update – for the case If the MS does not have a PDN connection established for emergency bearer
of 'Directed Signalling Connection services, the RRC establishment cause shall be set to Call Re-Establishment.
Re-Establishment (see chapter
4.7.2.5.) If the MS has a PDN connection established for emergency bearer services, the
RRC establishment cause shall be set to Emergency call. (See Note 2)
Routing area Update – all cases If the MS does not have a PDN connection established for emergency bearer
other than 'Directed Signalling services, the RRC establishment cause shall be set to Registration.
Connection Re-Establishment or
answer to packet paging If the MS has a PDN connection established for emergency bearer services, or is
initiating a PDP CONTEXT ACTIVATION that has request type set to "emergency",
the RRC establishment cause shall be set to Emergency call. (See Note 2)
GPRS Detach Detach

Request to re-establish RABs If the request is not to re-establish RABs for emergency bearer services, the RRC
establishment cause shall be set to either 'Originating Conversational Call’ or
'Originating Streaming Call’ or 'Originating Interactive Call’ or 'Originating
Background Call ' – depending on the Traffic Class in QoS of the "most
demanding" Traffic Class, considering all active PDP contexts. (see Note 1)
If the request is to re-establish RABs for emergency bearer services, the RRC
establishment cause shall be set to Emergency call. (See Note 2)
Request to establish a PS signalling MBMS reception or MBMS p-t-p RB request

connection for MBMS
Activate PDP Context If the ACTIVATE PDP CONTEXT REQUEST has the Request Type not set to
"emergency", the RRC establishment cause shall be set to either 'Originating
Conversational Call’ or 'Originating Streaming Call’ or 'Originating Interactive Call’
or 'Originating Background Call ' – depending on the Traffic Class in QoS of the
"most demanding" Traffic Class, considering all active PDP contexts together with
the PDP context to be activated. (see Note 1) –
If Traffic Class in QoS is not 'Conversational Class’ or 'Streaming Class’ or
'Interactive Class’ or 'Background Class’ but is 'Subscribed Traffic Class’, then
'Originating Subscribed traffic Call’ shall be used.
If the ACTIVATE PDP CONTEXT REQUEST has the Request Type set to
"emergency", the RRC establishment cause shall be set to Emergency call. (See
Note 2)
Modify PDP Context Originating High Priority Signalling

Deactivate PDP Context Originating High Priority Signalling
MO SMS via PS domain Originating Low Priority Signalling
SS part of Location services Originating High Priority Signalling
Answer to packet paging or receipt If the MS does not have a PDN connection established for emergency bearer
of a "call-pull-initiated" indication services, the RRC establishment cause shall be set equal to the value of the
from the upper layer (see paging cause used in the reception of paging in the RRC layer.
3GPP TS 24.174 [185])
If the MS has a PDN connection established for emergency bearer services, the
RRC establishment cause shall be set to Emergency call. (See Note 2)
Any PS NAS procedure where the Delay tolerant

initiating uplink signalling message
has the Device propertiesIE with low
priority indicator set to "MS is
configured for NAS signalling low
priority"
ETSI
Release 18 782 3GPP TS 24.008 V18.4.0 (2023-09)
NOTE 1: For classification of "most demanding" Traffic Class the following ranking order applies: "Conversational"
followed by "Streaming" followed by "Interactive" followed by "Background", where "Conversational" is the most
demanding Traffic class in terms of being delay sensitive.
NOTE 2: The emergency bearer services are only supported in UTRAN Iu mode.
NOTE 3: The RRC establishment cause can be used by the network to prioritise the connection establishment
request from the MS at high load situations in the network.
When GMM requests the establishment of a PS signalling connection, if the MS is configured for EAB (see the
"ExtendedAccessBarring" leaf of the NAS configuration MO as specified in 3GPP TS 24.368 [135] or
3GPP TS 31.102 [112]), the GMM shall indicate to the lower layer for the purpose of access control that EAB applies
for this request except for the following cases:
- the MS is answering to paging or a "call-pull-initiated" indication is received from the upper layer (see
3GPP TS 24.174 [185]);
- the RRC Establishment cause is set to "Emergency call";
- the MS is configured to allow overriding EAB (see the "Override_ExtendedAccessBarring" leaf of the NAS
configuration MO as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) and receives an indication
from the upper layers to override EAB; or
- the MS is configured to allow overriding EAB (see the "Override_ExtendedAccessBarring" leaf of the NAS
configuration MO as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) and already has a PDN
connection that was established with EAB override.
NOTE 4: void.
ETSI
Release 18 783 3GPP TS 24.008 V18.4.0 (2023-09)
Annex M (normative):
Additional Requirements for backward compatibility with
PCS 1900 for NA revision 0 ME
This annex provides additional requirements to support network mechanisms for backward compatibility with PCS
1900 for NA revision 0 mobile equipments (applicable until July 1, 1998).
PCS 1900 for NA revision 0 mobile equipments are defined to understand Mobile Network Codes made of up to 2
digits. However federal regulation mandates that a 3-digit MNC shall be allocated by each administration to network
operators. Therefore each network operator is identified by a 3-digit Mobile Country Code and a 3-digit Mobile
Network Code. An operator whose network code complies to the allocation principle specified for PCS 1900 for NA
and wants to achieve for a transition period of time the backward compatibility with PCS 1900 for NA revision 0
mobile equipments shall apply the following:
- The network shall send over the air interface the 3-digit Mobile Country Code and only the two most significant
digits of the Mobile Network Code (the value of the "digit" sent instead of the 3rd digit is specified in 3GPP TS
24.008, subclause 10.5.1.3) (see note).
When a PCS 1900 for NA (revision greater than 0) mobile equipment recognizes over the air the Mobile Country Code
and the two most significant digits of the Mobile Network Code as being the HPLMN codes of the current IMSI, the
mobile equipment shall take into account the value of the sixth IMSI digit read from the SIM/USIM. If this value
matches to a value contained in the limited set of values for the least significant MNC digit assigned by the number
administration bodies for PCS 1900 for NA then the following applies for the mobile equipment:
- The value sent over the air instead of the 3rd MNC digit in the Location Area Identification (for coding see 3GPP
TS 24.008, subclause 10.5.1.3) shall be interpreted as the value of the sixth IMSI digit read from the SIM/USIM.
NOTE: It is still a network operator option to apply this requirement after July 1, 1998. However, in this case the
following shall be considered:
1. Network selection considerations for overlapping networks:
- Networks overlapping to the HPLMN, identified over the radio interface by an identical combination
MCC1 MCC2 MCC3 MNC1 MNC2 (possible after July 1, 1998) may be selectable by PCS 1900 for
NA mobile equipments revision 0 with the same priority as the HPLMN or presented to the user as the
HPLMN.
2 Roaming considerations:
- Roamers (SIM/USIM) from networks identified by an identical combination MCC1 MCC2 MCC3
MNC1 MNC2 (possible after July 1, 1998) when roaming into the operator network with PCS 1900
for NA mobile equipments revision 0, may cause these equipments to exhibit an unpredictable
behaviour (e.g. looping in the HPLMN selection and registration procedures).
- Home subscribers (SIM/USIM) roaming with PCS 1900 for NA mobile equipments revision 0 into
networks identified by an identical combination MCC1 MCC2 MCC3 MNC1 MNC2 (possible after
July 1, 1998), may consider being attached to the HPLMN.
Annex N (normative):
Ranking of reject causes for Location Registration (MM and
GMM) in a shared network
This annex describes how the reject cause is determined:
- for a network sharing non-supporting MS in a shared network with multi-operator core network (MOCN)
configuration; or
ETSI
Release 18 784 3GPP TS 24.008 V18.4.0 (2023-09)
- for any MS in a multi-operator core network (MOCN) with common GERAN,
when a location registration request from the MS is redirected among CN operators via the shared RAN (see 3GPP TS
23.251 [109]) and is rejected by all core networks. In the following, the term 'location registration' is used for location
area updating, GPRS attach, combined GPRS attach, routing area updating, and combined routing area updating.
i) If the location registration request was either:
1) accepted;
2) rejected with a reject cause different from #11, #12, #13, #14, #15, #17, and #25; or
3) rejected with a reject cause #17 when the MSC or the SGSN received an error not indicating "system
failure", "data missing" or "unexpected data value" from the HLR (see 3GPP TS 29.002 [37] and
3GPP TS 29.010 [152]),
then one of the following actions is taken:
- in UTRAN Iu mode, the MSC or SGSN shall include the redirection completed information element in the
RANAP DIRECT TRANSFER message transmitting the location registration accept message or location
registration reject message to the RNC. According to 3GPP TS 25.413 [19c], the RNC will then forward the
location registration accept message or the location registration reject message to the MS.
- in A/Gb mode, the MSC shall use DTAP message and SGSN shall use BSSGP DL-UNIDATA message to
carry the location registration accept message or location registration reject message to the BSC. According
to 3GPP TS 48.008 [85] and 3GPP TS 48.018 [86], the BSC will then forward the location registration accept
message or location registration reject message to the MS.
ii) If the location registration request was either:
1) rejected with one of the reject causes #11, #12, #13, #14, #15, and #25; or
2) rejected with a reject cause #17 when the MSC or the SGSN received an error indicating "system failure",
"data missing" or "unexpected data value" from the HLR (see 3GPP TS 29.002 [37] and
3GPP TS 29.010 [152]),
then one of the following actions is taken:
- in UTRAN Iu mode, the MSC or SGSN shall include a redirection indication in the RANAP DIRECT
TRANSFER message transmitting the location registration reject message to the RNC. According to 3GPP
TS 25.413 [19c], the RNC will then initiate the redirection procedure towards the next CN operator and treat
the response from the core network according to (i) and (ii).
- in A/Gb mode, the MSC shall use BSSMAP Reroute Command message and SGSN shall use BSSGP DL-
UNIDATA message to transmit the location registration reject message to the BSC with a redirection
indication. According to 3GPP TS 48.008 [85] and 3GPP TS 48.018 [86], the BSC will then initiate the
redirection procedure towards the next CN operator and treat the response from the core network according
to (i), (ii) and (iii).
iii) If the location registration request was rejected including a redirection indication and with one of the reject
causes #11, #12, #13, #14, #15, #17, and #25 by all CN operators taking part in a shared network, the RNC for
UTRAN Iu mode or the BSC for A/Gb mode shall determine the reject cause with the highest rank from the
received reject causes and send a location registration reject message containing this reject cause to the MS.
The ranking of the reject causes, from the lowest rank to the highest rank, is given by:
#11 < #12 < #13 < #14 < #15 < #25 < #17.
iv) If the location registration request was rejected with one of the reject causes #11, #12, #13, #14, and #15 by all
CN operators taking part in a shared network in a specific location area, but there is at least one additional CN
operator taking part in a shared network in another location area of the shared network defined by the same
common PLMN identity, the RNC for UTRAN Iu mode or the BSC for A/Gb mode shall send a location
registration reject message with the reject cause #15 to the MS.
ETSI
Release 18 785 3GPP TS 24.008 V18.4.0 (2023-09)
Annex O (normative):
3GPP capability exchange protocol
O.1 Scope
This annex specifies the protocol data units used by the 3GPP capability exchange protocol and procedures for the
handling of unknown, unforeseen, and erroneous protocol data by the receiving MS.
The 3GPP capability exchange protocol provides services for the end-to-end exchange of capabilities between MSs. It is
a separate protocol which uses the user-to-user signalling service 1 of the layer 3 call control protocol as a means of
transport.
Functional procedures which use the 3GPP capability exchange protocol in the context of CSI are specified in
3GPP TS 24.279 [116].
O.2 User-user protocol contents

The user-user protocol contents is included in the user-user information element described in subclause 10.5.4.25.
The user-user protocol contents is structured like the non-imperative part of a standard L3 message (see
3GPP TS 24.007 [20], subclause 11.2) and is composed of a variable number of information elements of type 1, 2, 3
and 4. The different formats (TV, TLV) and the categories of information elements (type 1, 2, 3 and 4) are defined in
3GPP TS 24.007 [20].
Within the user-user protocol contents the information elements may occur in an arbitrary order.
All information elements shall be included only once.
8 7 6 5 4 3 2 1
Information element 1 octet 4*
octet 5*
octet k*
Information element 2 octet k+1*
octet l*
… octet l+1*
octet m*
Information element K octet m+1*
octet n*
Figure O.1/3GPP TS 24.008 User-user information when the user-user protocol indicator is set to
"3GPP capability exchange protocol"
O.3 Information element identifier

The information element identifier and its use are defined in 3GPP TS 24.007 [20].
For the information elements defined in subclause O.4, the coding of the information element identifier bits is defined
in table O.2/3GPP TS 24.008.
ETSI
Release 18 786 3GPP TS 24.008 V18.4.0 (2023-09)
For a method to determine from the information element identifier whether an unknown information element is of type
1 or 2 (i.e. it is an information element of one octet length) or type 4 (i.e. the next octet is the length indicator indicating
the length of the remaining of the information element) see 3GPP TS 24.007 [20], subclause 11.2.4.
Table O.1/3GPP TS 24.008: Information element identifier coding for user-user protocol information
elements
Reference
clause
8 7 6 5 4 3 2 1
Type 1 information elements:

1 0 0 0 - - - - Radio environment capability O.4.2
1 1 0 0 - - - - IM Status O.4.4
Type 2 information elements:

1 0 1 0 - - - - Unused
Type 3 and 4 information elements:

0 0 0 1 0 0 0 1 Personal ME identifier O.4.1
0 0 1 0 0 0 0 0 UE capability version O.4.3
All other values are unused
O.4 Information elements
O.4.1 Personal ME identifier

The purpose of the personal ME identifier is to discriminate between MEs used by the same user (see TS 24.279 [116],
subclause 4.2).
NOTE: As the personal ME identifier is generated randomly, it is not guaranteed that it uniquely identifies a
specific ME used by the same user.
The personal ME identifier has the form PMI-XXXX, where XXXX is a 4-digit hexadecimal number. Only the
hexadecimal number XXXX is coded in the personal ME identifier information element.
The personal ME identifier information element is coded as shown in figure O.2/3GPP TS 24.008 and table O.2/3GPP
TS 24.008.
The personal ME identifier is a type 3 information element with 3 octets length.
8 7 6 5 4 3 2 1
Personal ME identifier IEI octet 1
ME identifier digit 2 ME identifier digit 1 octet 2
ME identifier digit 4 ME identifier digit 3 octet 3
Figure O.2/3GPP TS 24.008 Personal ME identifier
ETSI
Release 18 787 3GPP TS 24.008 V18.4.0 (2023-09)
Table O.2/3GPP TS 24.008: Personal ME identifier
ME identifier digits (octets 2, 3)
Bits 1 to 4 or bits 5 to 8, respectively, contain the binary encoding of a hexadecimal ME

identifier digit. Digit 1 is the leftmost digit in the 4-digit hexadecimal number XXXX.
Bits ME identifier digit value

4 3 2 1 Or
8 7 6 5
0 0 0 0 0
0 0 0 1 1
0 0 1 0 2
0 0 1 1 3
0 1 0 0 4
0 1 0 1 5
0 1 1 0 6
0 1 1 1 7
1 0 0 0 8
1 0 0 1 9
1 0 1 0 A
1 0 1 1 B
1 1 0 0 C
1 1 0 1 D
1 1 1 0 E
1 1 1 1 F
O.4.2 Radio environment capability

The purpose of the radio environment capability is to provide information about the current radio environment of the
MS.
The radio environment capability information element is coded as shown in figure O.3/3GPP TS 24.008 and
table O.3/3GPP TS 24.008.
The radio environment capability is a type 1 information element with 1 octet length.
8 7 6 5 4 3 2 1
Radio environment capability 0 0 0 CS/
IEI spare spare Spare PS octet 1
Figure O.3/3GPP TS 24.008 Radio environment capability contents
Table O.3/3GPP TS 24.008: Radio environment capability contents
CS and PS capability (octet 1, bit 1)
The CS and PS capability indicates whether the MS is in a radio environment that

supports simultaneous use of CS and PS services (see 3GPP TS 24.279 [116]).
0 simultaneous use of CS and PS services not supported

1 simultaneous use of CS and PS services supported
O.4.3 UE capability version

The purpose of the UE capability version is to inform the receiving MS that the capability of the sending MS has
changed since the last UE capability exchange (see 3GPP TS 24.279 [116]).
ETSI
Release 18 788 3GPP TS 24.008 V18.4.0 (2023-09)
The UE capability version information element is coded as shown in figure O.4/3GPP TS 24.008 and table O.4/3GPP
TS 24.008.
The UE capability version has the form UCV-XX, where XX is a 2-digit hexadecimal number. Only the hexadecimal
number XX is coded in the UE capability version information element.
The UE capability version information element is coded as shown in figure O.4/3GPP TS 24.008 and table O.4/3GPP
TS 24.008.
The UE capability version is a type 3 information element with 2 octets length.
8 7 6 5 4 3 2 1
UE capability version IEI octet 1
UE capability version digit 2 UE capability version digit 1 octet 2

Figure O.4/3GPP TS 24.008: UE capability version
Table O.4/3GPP TS 24.008: UE capability version
UE capability version digits(octet 2)
Bits 1 to 4 and bits 5 to 8, respectively, contain the binary encoding of a 2-digit

hexadecimal UE capability version. Digit 1 is the leftmost digit.
Bits UE capability version digit value

4 3 2 1 Or
8 7 6 5
0 0 0 0 0
0 0 0 1 1
0 0 1 0 2
0 0 1 1 3
0 1 0 0 4
0 1 0 1 5
0 1 1 0 6
0 1 1 1 7
1 0 0 0 8
1 0 0 1 9
1 0 1 0 A
1 0 1 1 B
1 1 0 0 C
1 1 0 1 D
1 1 1 0 E
1 1 1 1 F
O.4.4 IM Status
The purpose of the IM Status is to provide information about the IMS capability and registration state of a specific
public user identity and it MS.
NOTE: The definition of what is a public user identity can be found in 3GPP TS 23.003 [10].
The IM Status information element is coded as shown in figure O.5/3GPP TS 24.008 and table O.5/3GPP TS 24.008.
The IM Status is a type 1 information element with 1 octet length.
8 7 6 5 4 3 2 1
IM Status IEI 0 0 IM
Spare spare Status octet 1
ETSI
Release 18 789 3GPP TS 24.008 V18.4.0 (2023-09)
Figure O.5/3GPP TS 24.008 IM Status contents
Table O.5/3GPP TS 24.008: IM Status contents
IM Status (octet 1)
Bits
2 1
0 0 MS is not IM subsystem capable
0 1 MS is IM subsystem registered
1 0 MS is IM subsystem capable and willing to register to IM subsystem (NOTE 1)
1 1 MS is IM subsystem capable but will not register to IM subsystem (NOTE 2)
NOTE 1: This value indicates that a terminal can be configured to allow IMS registration
without user intervention when required, for example when prompted by receiving
an IM Status of "MS is IM subsystem registered" or "MS is IM subsystem capable
and willing to register to IM subsystem" during establishment of a CS call.
NOTE 2: This value indicates that the terminal will not IMS register without user permission.
O.5 Handling of unknown, unforeseen, and erroneous

protocol data
O.5.1 General
The following subclauses specifies procedures for the handling of unknown, unforeseen, and erroneous protocol data by
the receiving MS. These procedures are called "error handling procedures", but in addition to providing recovery
mechanisms for error situations they define a compatibility mechanism for future extensions of the protocols.
Subclauses O.5.2 to O.5.5 shall be applied in order of precedence.
For the definition of semantical and syntactical errors see 3GPP TS 24.007 [20], subclause 11.4.2.
Where the description of information elements in the present document contains bits defined to be "spare bits", these
bits shall set to the indicated value (usually 0) by the sending side, and their value shall be ignored by the receiving side.
O.5.2 Not supported IEs, unknown IEIs

The MS shall ignore all information elements which are not supported and all information elements with unknown IEI.
O.5.3 Repeated IEs

If an information element, for which repetition is not specified in subclause O.2, is repeated in the user-user protocol
contents, only the contents of the information element appearing first shall be handled and all subsequent repetitions of
the information element shall be ignored. When repetition of information elements is specified, only the contents of
specified repeated information elements shall be handled. If the limit on repetition of information elements is exceeded,
the contents of information elements appearing first up to the limit of repetitions shall be handled and all subsequent
repetitions of the information element shall be ignored.
O.5.4 Syntactically incorrect IEs

The MS shall treat all IEs that are syntactically incorrect as not present in the user-user protocol contents.
ETSI
Release 18 790 3GPP TS 24.008 V18.4.0 (2023-09)
O.5.5 Semantically incorrect IEs

When an IE with semantically incorrect contents is received, the foreseen reactions specified for the respective
procedure are performed (e.g. in the context of CSI see 3GPP TS 24.279 [116], clauses 5, 6). If however no such
reactions are specified, the MS shall ignore the IE.
ETSI
Release 18 791 3GPP TS 24.008 V18.4.0 (2023-09)
Annex P (normative):
Mobility management for IMS voice termination
P.1 Introduction
The present annex specifies additional requirements for GMM and EMM in the MS for the support of terminating
access domain selection for voice calls or voice sessions by the network.
Support of these mobility management procedures can be configured in the MS by a setting. Whether the mobility
management for IMS voice termination setting is stored in the IMS management object as defined in
3GPP TS 24.167 [134] (see the "Mobility Management for IMS Voice Termination" leaf) or in an alternative way in the
ME is an implementation option. If this setting is missing, then mobility management for IMS voice termination is
disabled.
P.2 Activation of mobility management for IMS voice

termination
An MS activates mobility management for IMS voice termination when:
1) the MS's availability for voice calls in the IMS (see 3GPP TS 24.301 [120], subclause 3.1) changes from "not
available" to "available";
2) the MS is enabled for mobility management for IMS voice termination;
3) the IMS voice over PS session indicator received for Iu mode has the value
- "IMS voice over PS session supported in Iu mode, but not supported in A/Gb mode", or
the IMS voice over PS session indicator received for S1 mode has the value
- "IMS voice over PS session in S1 mode supported"; and
4) at least one of the two parameters voice domain preference for UTRAN and voice domain preference for
E-UTRAN as defined in 3GPP TS 24.167 [134] is not "CS voice only".
The MS deactivates mobility management for IMS voice termination when the MS's availability for voice calls in the
IMS (see 3GPP TS 24.301 [120], subclause 3.1) changes from "available" to "not available".
P.3 Inter-system change between A/Gb mode and

Iu mode
An MS is required to perform routing area updating for IMS voice termination if:
1) the upper layers have indicated that the MS is available for voice calls in the IMS (see 3GPP TS 24.301 [120],
subclause 3.1);
2) the MS is enabled for mobility management for IMS voice termination;
3) the "IMS voice over PS session indicator" received for Iu mode has the value "IMS voice over PS session
supported in Iu mode, but not supported in A/Gb mode"; and
4) the voice domain preference for UTRAN as defined in 3GPP TS 24.167 [134] is not "CS voice only".
ETSI
Release 18 792 3GPP TS 24.008 V18.4.0 (2023-09)
P.4 Inter-system change between A/Gb mode and

S1 mode
An MS is required to perform routing area updating for IMS voice termination at inter-system change from S1 mode to
A/Gb mode and tracking area updating for IMS voice termination at inter-system change from A/Gb mode to S1 mode
if:
1) conditions 1 and 2 of annex P.3 are fulfilled;
2) the "IMS voice over PS session indicator" received for S1 mode has the value "IMS voice over PS session in
S1 mode supported"; and
3) the voice domain preference for E-UTRAN as defined in 3GPP TS 24.167 [134] is not "CS voice only".
P.5 Inter-system change between Iu mode and S1 mode

An MS is required to perform routing area updating for IMS voice termination at inter-system change from S1 mode to
Iu mode and tracking area updating for IMS voice termination at inter-system change from Iu mode to S1 mode if:
1) conditions 1 and 2 of annex P.3 are fulfilled; and
2) any of the following conditions a, b and c is fulfilled:
a) the IMS voice over PS session indicators received for Iu mode and S1 mode have the values
- "IMS voice over PS session supported in Iu mode, but not supported in A/Gb mode" and
- "IMS voice over PS session in S1 mode not supported", and
the voice domain preference for UTRAN as defined in 3GPP TS 24.167 [134] is not "CS voice only";
b) the IMS voice over PS session indicators received for Iu mode and S1 mode have the values
- "IMS voice over PS session in Iu mode and A/G mode not supported" and
- "IMS voice over PS session in S1 mode supported", and
the voice domain preference for E-UTRAN as defined in 3GPP TS 24.167 [134] is not "CS voice only"; or
c) the IMS voice over PS session indicators received for Iu mode and S1 mode have the values
- "IMS voice over PS session supported in Iu mode, but not supported in A/Gb mode" and
- "IMS voice over PS session in S1 mode supported", and
exactly one of the voice domain preferences for UTRAN and E-UTRAN as defined in 3GPP TS 24.167 [134]
is "CS voice only".
ETSI
Release 18 793 3GPP TS 24.008 V18.4.0 (2023-09)
Annex Q (normative):
Application specific Congestion control for Data
Communication (ACDC) (Iu mode only)
The MS may support the procedures in this annex.
When GMM requests the establishment of a PS signalling connection, if the MS supports ACDC, the GMM layer shall
determine the ACDC category applicable to the request based on the application identifier received from the upper
layers and the configuration information in the "ACDCConf" leaf of ACDC MO as specified in 3GPP TS 24.105 [154]
or in the USIM EFACDC as specified in 3GPP TS 31.102 [112].
NOTE 1: As an implementation option, the upper layers can determine the ACDC category and send it to the GMM
layer. Then the GMM layer need not read the ACDC MO or USIM to determine the ACDC category.
The GMM sublayer shall indicate to the lower layers, for the purpose of access control:
- the ACDC category that applies to this request if only one ACDC category is applicable;
- the highest ranked ACDC category among the ACDC categories that applies to this request if multiple ACDC
categories are applicable; or
- this request is for an uncategorized application if an application identifier received from the upper layers is not
mapped to any ACDC category,
except for the following cases:
- the MS is a MS configured to use AC11 – 15 in selected PLMN;
- the MS is answering to paging;
- the RRC Establishment cause is set to "Emergency call";
- if conditions MO MMTEL voice call is started or MO MMTEL video call is started or MO SMSoIP is started, is
satisfied; or
- if a "call-pull-initiated" indication is received from the upper layer (see 3GPP TS 24.174 [185]).
NOTE 2: The request from the GMM sublayer refers to either a request to establish an initial NAS signalling
connection or a request to re-establish a NAS signalling connection.
If the MS supports ACDC and access is barred because of ACDC, the GMM layer shall keep track of the ACDC
category for which access is barred and it shall not send a request for the same ACDC category or a lower ACDC
category until access is granted.
If the MS supports ACDC and access is barred because of ACDC, the GMM layer shall not send a request for any
uncategorized application until access is granted.
ETSI
Release 18 794 3GPP TS 24.008 V18.4.0 (2023-09)
Annex R (informative):
Change History
Release 4 for 3GPP TS 24.008 v4.0.0 is based on 3GPP TS 24.008 version 3.5.0.
Date TSG # TSG Doc. CR Rev Subject/Comment Old New

09-2000 TSG-CN- New release 4 for 24.008, based on V3.5.0 which was approved at
9 the same Plenary.
12-2000 NP-09 NP-000448 073 5 CC Enhancements for Codec Selection 3.5.0 4.0.0
12-2000 NP-09 NP-000447 245 3 Emergency Call Additions 3.5.0 4.0.0
12-2000 NP-10 NP-000667 262 1 The Group or Broadcast Call Reference from the mobile station to 4.0.0 4.1.0
the network
12-2000 NP-10 NP-000669 264 1 GSM 700 addition into MS classmark & radio access capability IE 4.0.0 4.1.0
12-2000 NP-10 NP-000670 268 Clarification to the network initiated GPRS detach procedure (IMSI 4.0.0 4.1.0
detach)
12-2000 NP-10 NP-000670 278 Correction of update status on Authentication Reject 4.0.0 4.1.0
12-2000 NP-10 NP-000671 283 Description Of Timer T3317 on expiry 4.0.0 4.1.0
12-2000 NP-10 NP-000671 286 2 Removal of "recently deactivated" condition for PDP contexts and 4.0.0 4.1.0
some references corrections
12-2000 NP-10 NP-000672 290 2 The application of security procedures to emergency calls 4.0.0 4.1.0
12-2000 NP-10 NP-000671 295 1 Updating of Bearer Capability IE 4.0.0 4.1.0
12-2000 NP-10 NP-000673 301 3.1 kHz multimedia calls at 33.6 kbit/s data rate 4.0.0 4.1.0
12-2000 NP-10 NP-000673 303 32 kbit/s UDI/RDI multimedia 4.0.0 4.1.0
12-2000 NP-10 NP-000676 310 1 Change of reference to 26.103 for use of codec bitmap in the 4.0.0 4.1.0
Supported Codec List
12-2000 NP-10 NP-000668 311 Introduction of EGPRS for DTM 4.0.0 4.1.0
12-2000 NP-10 NP-000670 312 Clarification of response handling of Service Request 4.0.0 4.1.0
12-2000 NP-10 NP-000670 313 Clarification of RAB re-establishment 4.0.0 4.1.0
12-2000 NP-10 NP-000670 314 APN used for detection of duplicated PDP context activation 4.0.0 4.1.0
12-2000 NP-10 NP-000670 315 1 Unsynchronized PDP contexts handling - MS less 4.0.0 4.1.0
12-2000 NP-10 NP-000671 317 Correction on TFT setting condition 4.0.0 4.1.0
12-2000 NP-10 NP-000672 318 Correction of the timer list 4.0.0 4.1.0
12-2000 NP-10 NP-000670 319 Correction of PDP context duplication handling 4.0.0 4.1.0
12-2000 NP-10 NP-000670 321 DRX parameter range correction 4.0.0 4.1.0
12-2000 NP-10 NP-000671 323 RR connection replaced with PS signalling connection 4.0.0 4.1.0
Jan-01 Correction of the version and date in the Header title /Page1 4.1.0 4.1.1
03-2001
NP_11 NP-010123 266 2 Addition of type 4 IEs for P-TMSI Signature and GPRS Timer 4.1.1 4.2.0
03-2001
NP_11 NP-010127 281 4 Optional support of UMTS AKA by a GSM only R99 ME 4.1.1 4.2.0
03-2001
NP_11 NP-010116 324 1 Add new cause value on 'ODB for the Packet Oriented Services’ 4.1.1 4.2.0
03-2001
NP_11 NP-010123 328 1 Correction to MM timer handling 4.1.1 4.2.0
03-2001
NP_11 NP-010151 334 1 Add UMTS 1.28 Mcps TDD capability support to MS CM3 4.1.1 4.2.0
03-2001 Clarification of the establishment confirm for the signalling
NP_11 NP-010123 336 connection 4.1.1 4.2.0
03-2001 Clarification of the location update abnormal cases b) and c) on
NP_11 NP-010123 338 the MS side 4.1.1 4.2.0
03-2001
NP_11 NP-010205 344 4 unsynchronised PDP contexts - MS less (2) 4.1.1 4.2.0
03-2001 Update of MS classmark 2 and MS Network Capability to support
NP_11 NP-010128 345 1 LCS 4.1.1 4.2.0
03-2001
NP_11 NP-010123 348 Correction of GPRS ciphering key sequence number IEI 4.1.1 4.2.0
03-2001 Collisions cases of core network initiated paging and MS initiated
NP_11 NP-010123 350 1 GMM specific procedures 4.1.1 4.2.0
ETSI
Release 18 795 3GPP TS 24.008 V18.4.0 (2023-09)
03-2001
NP_11 NP-010125 358 Using RAU procedure for MS RAC IE update 4.1.1. 4.2.0
03-2001
NP_11 NP-010129 360 1 Connection re-establishment on forward handover without Iur 4.1.1 4.2.0
03-2001
NP_11 NP-010147 363 2 Roaming restrictions for GPRS service 4.1.1 4.2.0
03-2001
NP_11 NP-010205 365 3 Correction related to Cause of no CLI 4.1.1 4.2.0
03-2001 Clarification of TFT request during secondary PDP context
NP_11 NP-010129 367 1 activation. 4.1.1 4.2.0
03-2001 Correction of DTM Multislot Capabilities in MS Classmark 3 and
NP_11 NP-010146 377 MS Radio Classmark 4.1.1 4.2.0
03-2001 Alignment of MS identity IE length in ATTACH ACCEPT and
NP_11 NP-010147 378 RAU ACCEPT Messages 4.1.1 4.2.0
03-2001
NP_11 NP-010207 379 1 Mapping of upper layer event to establishment cause 4.1.1 4.2.0
03-2001
NP_11 NP-010207 380 1 Resume at Intersystem change from GSM to UMTS 4.1.1 4.2.0
03-2001 Collision case of CN initiated paging and MS initiated MM
NP_11 NP-010207 381 1 specific procedures 4.1.1 4.2.0
03-2001 Addition of 1.28 Mcps UTRA TDD capability support to MS Radio
NP_11 NP-010151 382 Access Capability 4.1.1 4.2.0
03-2001 Add cause value #8(ODB) to the PDP context deactivation
NP_11 NP-010154 383 initiated by the network 4.1.0 4.2.0
03-2001 Re-transmission of AUTHENTICATION REQUEST and
NP_11 NP-010155 384 1 AUTHENTICATION & CIPHERING REQUEST messages 4.1.1 4.2.0
03-2001
NP_11 NP-010205 385 1 MS behaviour for "RB Release followed by RB setup" 4.1.1 4.2.0
03-2001
NP_11 NP-010160 386 Presence of PDP address IE in Activate PDP Context Accept 4.1.1 4.2.0
03-2001 Correction of Revision Level in MS Classmark and MS Network
NP_11 NP-010160 387 Capability 4.1.1 4.2.0
03-2001
NP_11 NP-010160 388 Unsync_MSmore_Rel4 4.1.1 4.2.0
03-2001
NP_11 NP-010160 389 1 Correction of incorrect references 4.1.1 4.2.0
03-2001
NP_11 NP-010210 391 1 Equiv handling of PLMN with different PLMN codes 4.1.1 4.2.0
03-2001
NP_11 NP-010208 392 Removal of CODEC type octet in supported CODECS list 4.1.1 4.2.0
06-2001 Editorials.
Page 371 was missing,- which is a part of the table 10.5.146 (MS
Radio Access Capability IE). Editors note in 4.5.1.3.1 is deleted,
and in chapter 4.7.3.2.4 and 4.7.5.2.4 the cause value #8 was
swopped back to its original place as it was in v4.1.1. 4.2.0 4.2.1
06-2001
NP_12 NP-010275 333 2 Length of User-user IE 4.2.1 4.3.0
06-2001
NP_12 NP-010355 394 Missing SM cause 40 in table 10.5.6.6 4.2.1 4.3.0
06-2001 Modification to MS's MM states to enable LCS signalling on RR
NP_12 NP-010272 396 3 layer 4.2.1 4.3.0
06-2001
NP_12 NP-010352 400 Stored list of equivalent PLMNs and error/abnormal cases 4.2.1 4.3.0
06-2001
NP_12 NP-010351 403 4 CLASSMARK1, 2 and 3 corrections. 4.2.1 4.3.0
06-2001
NP_12 NP-010355 411 2 Clarification of Network Initiated GPRS Detach Procedure 4.2.1 4.3.0
06-2001
NP_12 NP-010275 416 2 Partial Roaming – restriction by location area 4.2.1 4.3.0
06-2001 The priority in the CALL PROCEEDING message for eMLPP
NP_12 NP-010275 418 2 supporting network 4.2.1 4.3.0
06-2001
NP_12 NP-010271 419 1 Clean up related to V.23, X.75, X.25 and X.32 4.2.1 4.3.0
06-2001
NP_12 NP-010275 421 1 Handling of MM reject causes 2, 3 and 6 by mobile stations 4.2.1 4.3.0
ETSI
Release 18 796 3GPP TS 24.008 V18.4.0 (2023-09)
06-2001
NP_12 NP-010273 422 Extended uplink TBF 4.2.1 4.3.0
06-2001
NP_12 NP-010267 423 1 Correct coding errors in the MS Radio Access Capability IE 4.2.1 4.3.0
06-2001
NP_12 NP-010343 428 1 Alignment of 24.008 authentication procedures with 33.102 4.2.1 4.3.0
06-2001
NP_12 NP-010268 426 1 Introduction of GTT (CTM) support 4.3.0 5.0.0
09-2001
NP-13 NP-010493 444 1 Old RAI handling 5.0.0 5.1.0
09-2001
NP-13 NP-010499 452 1 Modification of session management between MS and network 5.0.0 5.1.0
09-2001
NP-13 NP-010533 475 2 Introduction of default codec UMTS_AMR_2 5.0.0 5.1.0
09-2001
NP-13 NP-010493 457 Correction of Protocol configuration options 5.0.0 5.1.0
09-2001
NP-13 NP-010490 465 Clarification of 8-PSK power class coding 5.0.0 5.1.0
09-2001
NP-13 NP-010498 468 2 Definition of new DTM multislot classes 5.0.0 5.1.0
09-2001
NP-13 NP-010496 474 Remove references to specific sections of 25.331 5.0.0 5.1.0
12-2001
NP-14 NP-010660 458 3 Introduction of Source Statistics Descriptor 5.1.0 5.2.0
12-2001
NP-14 NP-010648 479 1 Correction of the criteria for the usage of combined RAU 5.1.0 5.2.0
12-2001
NP-14 NP-010654 481 Correction of default codec selection criterion 5.1.0 5.2.0
12-2001
NP-14 NP-010678 487 1 Mapping of NAS procedures to RRC Establishment Causes 5.1.0 5.2.0
12-2001
NP-14 NP-010660 488 Correction of missing actions on RAND and T3218, T3316 5.1.0 5.2.0
12-2001
NP-14 NP-010658 489 2 LCS capability for GPRS 5.1.0 5.2.0
12-2001 Usage of TMSI in Intra Domain Connection of RAN Nodes to
NP-14 NP-010659 493 2 Multiple CN Nodes 5.1.0 5.2.0
12-2001
NP-14 NP-010655 495 2 RRC Establishment Causes for LCS Procedures 5.1.0 5.2.0
12-2001 5.2.0
NP-14 NP-010647 498 P-TMSI Signature handling 5.1.0
12-2001 5.2.0
NP-14 NP-010652 501 Correction of maximum transfer delay value in Qos IE 5.1.0
12-2001 5.2.0
NP-14 NP-010647 507 Handling of new/old TLLI in the network 5.1.0
12-2001 Clarification on the EDGE parameters in the Mobile Station
NP-14 NP-010660 510 2 Classmark 3 IE 5.1.0 5.2.0
12-2001
NP-14 NP-010657 516 2 Use of Supported Codec List (SCL) IE for all codec types 5.1.0 5.2.0
12-2001 5.2.0
NP-14 NP-010700 527 4 Impact of regional roaming restrictions on the GMM context 5.1.0
12-2001 5.2.0
NP-14 NP-010678 528 2 Conditions for the deletion of the equivalent PLMN list 5.1.0
12-2001 5.2.0
NP-14 NP-010665 532 Correction of references in 24.008 5.1.0
12-2001 5.2.0
NP-14 NP-010690 534 1 Introduction of GERAN feature indicator 5.1.0
03-2002
Editorial clean-up by ETSI/MCC. 5.2.0
03-2002
NP-15 NP-020042 520 2 P-TMSI allocation in Attach procedure 5.2.0 5.3.0
03-2002
NP-15 NP-020042 537 1 Mobile terminated call with single numbering scheme 5.2.0 5.3.0
03-2002
NP-15 NP-020039 546 Missing 3rd MNC definition 5.2.0 5.3.0
ETSI
Release 18 797 3GPP TS 24.008 V18.4.0 (2023-09)
03-2002
NP-15 NP-020042 550 1 Applicability of CM3 IE Modulation Capability information 5.2.0 5.3.0
03-2002
NP-15 NP-020043 556 3 Upgrading PCO for supporting IMS services 5.2.0 5.3.0
03-2002
NP-15 NP-020044 557 2 Upgrading TFT for supporting IMS services 5.2.0 5.3.0
03-2002
NP-15 NP-020038 564 1 Handlling for QoS profile parameter "transfer delay" 5.2.0 5.3.0
03-2002
NP-15 NP-020038 571 1 Conditions for including R97 QoS attributes in the QoS IE 5.2.0 5.3.0
03-2002
NP-15 NP-020133 575 Deletion of reference to 23.071 in 24.008 5.2.0 5.3.0
06-2002
NP-16 NP-020220 536 2 Correction of codec negotiation procedure 5.3.0 5.4.0
06-2002
NP-16 NP-020241 551 3 Service change and fallback for UDI/RDI multimedia calls 5.3.0 5.4.0
06-2002
NP-16 NP-020242 554 2 Restriction of the 0kbits maximum bitrate 5.3.0 5.4.0
06-2002
NP-16 NP-020223 578 2 Authentication not accepted by MS 5.3.0 5.4.0
06-2002
NP-16 NP-020219 581 1 Correction to CS domain specific system information 5.3.0 5.4.0
06-2002
NP-16 NP-020219 592 2 Impact of regional roaming restrictions on the MM state 5.3.0 5.4.0
06-2002
NP-16 NP-020223 595 Correction of repeat indicator IE 5.3.0 5.4.0
06-2002
NP-16 NP-020223 598 Removal of the coding rules of type 4 IEs 5.3.0 5.4.0
06-2002
NP-16 NP-020221 601 1 Correction to text on DTMF handling 5.3.0 5.4.0
06-2002 Handling of SM STATUS(#81, #97) and invalid TI of Secondary
NP-16 NP-020242 607 1 PDP context 5.3.0 5.4.0
06-2002
NP-16 NP-020219 612 R97 and R99 compatibility 5.3.0 5.4.0
06-2002
NP-16 NP-020242 615 Deletion of ePLMN list when the fifth RAU attempt is reached 5.3.0 5.4.0
06-2002 Conditions when to update the "RPLMN Last used Access
NP-16 NP-020242 618 1 Technology" information 5.3.0 5.4.0
06-2002
NP-16 NP-020242 619 1 SIM removal and change of RA during detach procedure 5.3.0 5.4.0
06-2002 Conflicting behaviour when UE receives
NP-16 NP-020216 625 1 AUTHENTICATION_REJECT 5.3.0 5.4.0
06-2002
NP-16 NP-020242 626 Correction of definition of SSD in QoS IE 5.3.0 5.4.0
06-2002 Support for IMS media Multiplexing in Session Management –
NP-16 NP-020225 630 TFT 5.3.0 5.4.0
06-2002
NP-16 NP-020242 631 Addition of missing references to TS 25.304 5.3.0 5.4.0
06-2002
NP-16 NP-020242 632 1 DRX parameter update with RAU procedure 5.3.0 5.4.0
06-2002
NP-16 NP-020225 634 1 PCO in Session Management procedures 5.3.0 5.4.0
06-2002
NP-16 NP-020217 639 1 Alternative coding of radio access capabilities 5.3.0 5.4.0
06-2002
NP-16 NP-020300 641 1 Indication of support of LCS via the PS domain in Iu-mode 5.3.0 5.4.0
06-2002
NP-16 NP-020311 642 2 Addition of missing code point for 8-PSK Half Rate AMR 5.3.0 5.4.0
09-2002 MM behaviour in case of a combined attach reject for the PS
NP-17 NP-020382 561 3 service 5.4.0 5.5.0
09-2002
NP-17 NP-020384 643 2 GERAN Iu Mode Capability 5.4.0 5.5.0
09-2002
NP-17 NP-020380 644 Go related error code to UE 5.4.0 5.5.0
ETSI
Release 18 798 3GPP TS 24.008 V18.4.0 (2023-09)
09-2002
NP-17 NP-020369 650 Removal of CBQ2 5.4.0 5.5.0
09-2002
NP-17 NP-020381 651 1 Usage of the Service Request procedure 5.4.0 5.5.0
09-2002
NP-17 NP-020394 652 1 MS behavior in case of change of network mode of operation 5.4.0 5.5.0
09-2002
NP-17 NP-020382 653 1 MS behavior in case of T3312 expiry 5.4.0 5.5.0
09-2002 Ambiguous MM behavior in case of a failed combined Attach or
NP-17 NP-020382 654 1 RAU 5.4.0 5.5.0
09-2002
NP-17 NP-020368 667 Usage of Service Request type 'data' 5.4.0 5.5.0
09-2002
NP-17 NP-020371 668 Introduction of PCO in more session management messages 5.4.0 5.5.0
09-2002
NP-17 NP-020372 669 Request for DNS IPv6 server address 5.4.0 5.5.0
09-2002
NP-17 NP-020371 670 Clean-up of text for the PCO-IE 5.4.0 5.5.0
09-2002
NP-17 NP-020368 673 3 Correction to service request procedure 5.4.0 5.5.0
09-2002 Indication of successful establishment of Dedicated Signalling
NP-17 NP-020371 675 PDP context to the UE 5.4.0 5.5.0
09-2002
NP-17 NP-020368 678 1 Routing Area Update at network change 5.4.0 5.5.0
09-2002
NP-17 NP-020371 679 1 Coding of Authorisation Token in Traffic Flow Template 5.4.0 5.5.0
09-2002
NP-17 NP-020382 687 Precedence of different RAU 5.4.0 5.5.0
12-2002 No MT calls after resumption of GPRS in Network Operation
NP-18 NP-020546 697 1 Mode I 5.5.0 5.6.0
12-2002
NP-18 NP-020570 698 Inclusion of EDGE RF Power Capability in the CM3 IE 5.5.0 5.6.0
12-2002
NP-18 NP-020670 701 3 Flow Identifier Encoding 5.5.0 5.6.0
12-2002
NP-18 NP-020548 703 1 Clarification of the codec change procedure 5.5.0 5.6.0
12-2002
NP-18 NP-020629 704 Use of "LLC SAPI not assigned" by the network 5.5.0 5.6.0
12-2002
NP-18 NP-020545 707 1 Cell barring after Network authentication rejection from the UE 5.5.0 5.6.0
12-2002
NP-18 NP-020674 716 4 Downloading of local emergency numbers to the mobile station 5.5.0 5.6.0
12-2002
NP-18 NP-020549 721 1 Correcting errors and making improvements to references 5.5.0 5.6.0
12-2002
NP-18 NP-020547 724 Clarification on revision level 5.5.0 5.6.0
03-2003
NP-19 NP-030042 730 Correction on CC Capabilities IE length 5.6.0 5.7.0
03-2003 NP-030055 731 1 Support of UMTS authentication by GERAN only terminals
NP-19 5.6.0 5.7.0
03-2003 NP-030141 736 2 MS RAC for UMTS only terminal
NP-19 5.6.0 5.7.0
03-2003 NP-030055 737 1 High multislot classes for type 1 mobiles
NP-19 5.6.0 5.7.0
03-2003 NP-030054 738 2 Signalling PDP Context Indication to Core Network
NP-19 5.6.0 5.7.0
03-2003 NP-030055 740 1 Missing IEI definition in locking shift (CC) IE and non-locking shift
NP-19 (CC) IE 5.6.0 5.7.0
03-2003 NP-030055 741 1 Combined RAU successful for GPRS only, missing GMM cause
NP-19 IE 5.6.0 5.7.0
03-2003 NP-030055 746 Enhanced Power Control (EPC) information in classmark 3
NP-19 5.6.0 5.7.0
03-2003 NP-030062 747 Introduction of USIM in the figure "Overview mobility
NP-19 management protocol" 5.6.0 5.7.0
ETSI
Release 18 799 3GPP TS 24.008 V18.4.0 (2023-09)
03-2003 NP-19 NP-030057 733 1 Interruption of DL user data transmission during P-TMSI 5.7.0
reallocation 6.0.0
03-2003 NP-19 NP-030058 739 2 Implementation of new frequency ranges into 24.008 5.7.0
6.0.0
06-2003 NP-20 NP-030284 750 MS RAC encoding 6.0.0
6.1.0
06-2003 NP-20 NP-030269 756 3 Bearer Capability IE 6.0.0
6.1.0
06-2003 NP-20 NP-030273 760 Alignment of parameter 'signalling information’ with other QoS 6.0.0
parameters 6.1.0
06-2003 NP-20 NP-030273 764 1 Cleanup and correction of the PCO-IE 6.0.0
6.1.0
06-2003 NP-20 NP-030271 767 1 Indication of the MS support of "Modulation based multislot 6.0.0
class" 6.1.0
06-2003 NP-20 NP-030284 768 Wrong references in SETUP and redirected number/subaddress 6.0.0
IEs 6.1.0
06-2003 NP-20 NP-030270 772 Alignment on BC IE coding for FAX between TS24.008 and 6.0.0
TS27.001 6.1.0
06-2003 NP-20 NP-030267 776 Unciphered transmission of Authentication and Ciphering Failure 6.0.0
in A/Gb mode 6.1.0
06-2003 NP-20 NP-030282 780 Correction of the static conditions for the bearer capability IE 6.0.0
contents 6.1.0
06-2003 NP-20 NP-030270 784 1 Clarification of the procedure for the change of DRX parameter 6.0.0
6.1.0
09-2003 ETSI/MCC changed chapter numbering from 10.5.4.5.1 to 6.1.0
10.5.4.4a.1 for Backup BC IE. Wrong since v6.0.0 6.2.0
09-2003 NP-21 NP-030416 787 Correction of the static conditions for the 'backup’ bearer 6.1.0
capability IE contents 6.2.0
09-2003 NP-21 NP-030416 793 Deletion of EFRPLMNAcT 6.1.0 6.2.0
09-2003 NP-21 NP-030416 795 1 Clarification of handover – BC-IE 6.1.0 6.2.0
09-2003 NP-21 NP-030347 797 2 Support of the maximum bit rate for HSDPA 6.1.0
6.2.0
09-2003 NP-21 NP-030420 798 Source of the CS domain specific system information 6.1.0
6.2.0
09-2003 NP-21 NP-030420 799 1 Signaling connection release after GMM procedure 6.1.0
6.2.0
09-2003 NP-21 NP-030406 807 2 Clarification of BC negotiation for multimedia calls 6.1.0
6.2.0
09-2003 NP-21 NP-030405 813 1 Change of DTM core capability 6.1.0 6.2.0
09-2003 NP-21 NP-030416 815 1 CR on introduction of mobile station multislot power classes. 6.1.0 6.2.0
12-2003 NP-22 NP-030485 803 2 TFT error handling 6.2.0 6.3.0
12-2003 NP-22 NP-030485 816 ePLMN list extension 6.2.0 6.3.0
12-2003 NP-22 NP-030485 818 1 SM signalling in case tear down is requested 6.2.0 6.3.0
12-2003 NP-22 NP-030487 819 Addition of multiple TBF capability flag to MS RAC IE 6.2.0 6.3.0
12-2003 NP-22 NP-030485 820 Order of frequency bands in MS Radio Access Capability IE 6.2.0 6.3.0
12-2003 NP-22 NP-030481 822 Correction to the Multislot Power Profile Classes 6.2.0 6.3.0
12-2003 NP-22 NP-030485 823 Correction of timer handling in diagram 4.7.7a 6.2.0 6.3.0
12-2003 NP-22 NP-030485 826 Removal of codepoint for GTP ack mode 6.2.0 6.3.0
12-2003 NP-22 NP-030485 827 SSD and Signalling indication in QoS IE 6.2.0 6.3.0
03-2004 NP-23 NP-040038 831 2 Use of TMSI/IMSI in CM SERVICE REQUEST message in case 6.3.0 6.4.0
of emergency call redirection and change of LAI
03-2004 NP-23 NP-040038 832 Clarification on the meaning of MS network capability indicator 6.3.0 6.4.0
bits
03-2004 NP-23 NP-040025 836 1 Conditions for PFI usage 6.3.0 6.4.0
03-2004 NP-23 NP-040038 841 2 Added Session Management (SM) Cause Value for APN Type 6.3.0 6.4.0
Conflict
03-2004 NP-23 NP-040038 842 Correction of the condition for the tear down of PDP contexts 6.3.0 6.4.0
03-2004 NP-23 NP-040038 844 Status of PFI value after PDP context modification 6.3.0 6.4.0
03-2004 NP-23 NP-040038 845 1 MS reaction upon RRC connection release with cause "Directed 6.3.0 6.4.0
signalling connection re-establishment"
03-2004 NP-23 NP-040099 846 3 Handling of key sets 6.3.0 6.4.0
03-2004 NP-23 NP-040038 849 2 Clarification of UE behaviour at network initiated GPRS Detach 6.3.0 6.4.0
ETSI
Release 18 800 3GPP TS 24.008 V18.4.0 (2023-09)
03-2004 NP-23 NP-040038 851 MS class behaviour in case of a network inititated detach with 6.3.0 6.4.0
detach type "IMSI detach"
06-2004 NP-24 NP-040185 856 1 Clarification of the use of service type 'Location services' 6.4.0 6.5.0
06-2004 NP-24 NP-040186 860 1 Correction of the network initiated in-call modification 6.4.0 6.5.0
06-2004 NP-24 NP-040187 863 1 Suspension of CM layer services during GMM procedures 6.4.0 6.5.0
06-2004 NP-24 NP-040187 866 1 LCS VA capability in MS network capability IE for PS 6.4.0 6.5.0
06-2004 NP-24 NP-040203 869 1 Introduction of Flexible Layer One Iu capability 6.4.0 6.5.0
06-2004 NP-24 NP-040203 871 2 Identity request for identity that is not available 6.4.0 6.5.0
06-2004 NP-24 NP-040186 879 2 Reference to 4.7.x.4 6.4.0 6.5.0
06-2004 NP-24 NP-040190 881 1 Handling of key sets at inter-system change 6.4.0 6.5.0
09-2004 NP-25 NP-040432 882 4 Follow-on proceed for the PS domain 6.5.0 6.6.0
09-2004 NP-25 NP-040375 901 3 Clarification on the registered PLMN for UEs that support 6.5.0 6.6.0
network sharing in a shared network
09-2004 NP-25 NP-040376 905 Introduction of Downlink Advanced Receiver Performance 6.5.0 6.6.0
(DARP) capability
09-2004 NP-25 NP-040377 889 1 Introduction of the MBMS general procedure and states 6.5.0 6.6.0
09-2004 NP-25 NP-040377 890 1 Introduction of the MBMS Context Activation procedure 6.5.0 6.6.0
09-2004 NP-25 NP-040377 891 1 Introduction of the MBMS Context Activation messages 6.5.0 6.6.0
09-2004 NP-25 NP-040377 896 Update of the Service Request procedure - MBMS 6.5.0 6.6.0
09-2004 NP-25 NP-040377 894 Introduction of the MBMS Multicast Service Deactivation 6.5.0 6.6.0
procedure - Reuse of PDP context deactivation messages
09-2004 NP-25 NP-040377 895 1 Introduction of the MBMS Multicast Service Deactivation 6.5.0 6.6.0
messages - Reuse of PDP context deactivation messages
09-2004 NP-25 NP-040377 898 1 Introduction of MBMS context handling 6.5.0 6.6.0
09-2004 NP-25 NP-040377 897 1 Update of Annex I for MBMS 6.5.0 6.6.0
09-2004 NP-25 NP-040378 904 Introduction of Extended RLC/MAC Control Message 6.5.0 6.6.0
segmentation capability
09-2004 NP-25 NP-040378 883 1 Mapping of QoS Traffic Class to RRC Establishment Cause 6.5.0 6.6.0
09-2004 NP-25 NP-040378 852 3 Network Search for recovering from Faulty Networks 6.5.0 6.6.0
09-2004 NP-25 NP-040379 886 2 Correction to list of received N-PDU number in Rau Accept 6.5.0 6.6.0
message
12-2004 NP-26 NP-040504 907 MBMS update 6.6.0 6.7.0
12-2004 NP-26 NP-040504 908 2 NSAPI at MBMS context activation 6.6.0 6.7.0
12-2004 NP-26 NP-040510 922 Addition of DTM enhancements capability 6.6.0 6.7.0
12-2004 NP-26 NP-040513 Location registration in a shared network when multiple PLMNs 6.6.0 6.7.0
926 2 are broadcast
12-2004 NP-26 NP-040513 927 1 Reject cause ranking during rerouting in MOCN 6.6.0 6.7.0
12-2004 NP-26 NP-040514 910 2 Correction of terminology -GSM and UMTS 6.6.0 6.7.0
12-2004 NP-26 NP-040514 911 1 Paging for GPRS Services in GSM 6.6.0 6.7.0
12-2004 NP-26 NP-040514 912 1 Service request conditions 6.6.0 6.7.0
12-2004 NP-26 NP-040514 913 1 Service request - Abnormal cases in the MS 6.6.0 6.7.0
12-2004 NP-26 NP-040514 914 2 No follow on proceed indication 6.6.0 6.7.0
12-2004 NP-26 NP-040514 915 3 Mobile identity - No identity 6.6.0 6.7.0
12-2004 NP-26 NP-040514 920 1 Correction of the description of causes #7 and #8 in Annex G.6 6.6.0 6.7.0
12-2004 NP-26 NP-040514 921 1 CC cause reference correction 6.6.0 6.7.0
12-2004 NP-26 NP-040514 923 Handling of zero T3312 timer value 6.6.0 6.7.0
12-2004 NP-26 NP-040514 924 Introduction of new references for DTMF 6.6.0 6.7.0
03-2005 NP-27 933 2 Defining TMGI and MBMS Session Id in the mobile identity field
NP-050070 6.7.0 6.8.0
03-2005 NP-27 934 1 Correct GPRS SM List and MBMS IE Descriptions
NP-050070 6.7.0 6.8.0
ETSI
Release 18 801 3GPP TS 24.008 V18.4.0 (2023-09)
03-2005 NP-27 Mapping of 'MBMS notification response’ to RRC establishment

958 cause
NP-050070 6.7.0 6.8.0
03-2005 NP-27 931 1 Synchronization of MBMS context status between UE and SGSN
NP-050071 6.7.0 6.8.0
03-2005 NP-27 954 1 MBMS Session Management clarifications
NP-050071 6.7.0 6.8.0
03-2005 NP-27 956 1 Introduction of MBMS in clause 8
NP-050071 6.7.0 6.8.0
03-2005 NP-27 952 1 Detach for PS and CS during a ongoing CS connection
NP-050076 6.7.0 6.8.0
03-2005 NP-27 951 1 GPRS attach type while in DTM
NP-050076 6.7.0 6.8.0
03-2005 NP-27 953 1 Condition for Combined RAU after a DTM connection
NP-050076 6.7.0 6.8.0
03-2005 NP-27 935 1 Missing Messages in MM and CC Summary Tables
NP-050076 6.7.0 6.8.0
03-2005 NP-27 932 Correction of the heading of subclause 4.7.3.1.6, bullet d.1
NP-050076 6.7.0 6.8.0
03-2005 NP-27 Modification of MS Behaviour under GPRS Attach with Reject
957 2 Cause #14
NP-050077 6.7.0 6.8.0
03-2005 NP-27 939 3 Addition of domain specific access control
NP-050083 6.7.0 6.8.0
03-2005 NP-27 Provision of MS specific UTRAN capabilities for the PS handover
950 2 from GERAN to UTRAN
NP-050085 6.7.0 6.8.0
06-2005 CP-28 987 GSM 750 corrections
CP-050058 6.8.0 6.9.0
06-2005 CP-28 977 1 Introduction of MBMS support indication to the UE
CP-050062 6.8.0 6.9.0
06-2005 982 Correction on handling of forbidden lists
CP-28 CP-050067 6.8.0 6.9.0
06-2005 974 1 Cell Update triggered by low layers
CP-28 CP-050069 6.8.0 6.9.0
06-2005 989 Extension of DTM to high multislot classes
CP-28 CP-050069 6.8.0 6.9.0
06-2005 975 MS initiated RAU for re-negotiation of MS configuration
CP-28 CP-050069 6.8.0 6.9.0
06-2005 973 1 Handling of duplicated RAU on the network side
CP-28 CP-050069 6.8.0 6.9.0
06-2005 978 2 Clarification on locking shift procedure
CP-28 CP-050069 6.8.0 6.9.0
06-2005 984 1 Mobile identity IE length when 'No identity'
CP-28 CP-050069 6.8.0 6.9.0
06-2005 916 4 Attach type and Update type IEs
CP-28 CP-050069 6.8.0 6.9.0
06-2005 Corrections of designations and references of figures and
972 1 tables
CP-28 CP-050069 6.8.0 6.9.0
06-2005 SCUDIF: Introduction of a Network-initiated Service Upgrade
990 1 capability
CP-28 CP-050071 6.8.0 6.9.0
06-2005 SCUDIF: Introduction of a Network-initiated Service Upgrade
991 1 indicator
CP-28 CP-050071 6.8.0 6.9.0
06-2005 983 1 SCUDIF: Introduction of a new timer for service change
CP-28 CP-050071 6.8.0 6.9.0
06-2005 937 3 SETUP Message Enhancement for Voice Video Switching
CP-28 CP-050072 6.8.0 6.9.0
06-2005 962 5 Transparent data call request in dual mode case
CP-28 CP-050231 6.8.0 6.9.0
06-2005 988 Introduction of GSM 710
CP-28 CP-050058 6.9.0 7.0.0
09-2005 1012 2 Clarification in TFT for the 'parameters list'
CP-29 CP-050355 7.0.0 7.1.0
09-2005 Mapping RRC's "MBMS p-t-p RB Request" to a NAS service
1003 1 type
CP-29 CP-050356 7.0.0 7.1.0
09-2005 995 1 MBMS context procedures cleanup
CP-29 CP-050356 7.0.0 7.1.0
09-2005 997 T3390 is not used for MBMS
CP-29 CP-050356 7.0.0 7.1.0
ETSI
Release 18 802 3GPP TS 24.008 V18.4.0 (2023-09)
09-2005 1014 1 Support of encryption algorithms in mobile stations

CP-29 CP-050361 7.0.0 7.1.0
09-2005 1016 Correction of terminology
CP-29 CP-050361 7.0.0 7.1.0
09-2005 Correction of the definition of cause #13 "Roaming not allowed in
1001 1 this location area"
CP-29 CP-050366 7.0.0 7.1.0
09-2005 1004 Editorial alignment of SM Cause values
CP-29 CP-050366 7.0.0 7.1.0
09-2005 1009 2 Clarification to Quality of Service Information Element
CP-29 CP-050366 7.0.0 7.1.0
09-2005 1022 1 Clarification of requirement on the emergency category
CP-29 CP-050366 7.0.0 7.1.0
09-2005 963 3 Guard timer for PS signaling connection release
CP-29 CP-050366 7.0.0 7.1.0
09-2005 999 1 Alignement of GMM T3317 timer value
CP-29 CP-050366 7.0.0 7.1.0
09-2005 1023 1 Introduction of T-GSM 810
CP-29 CP-050370 7.0.0 7.1.0
09-2005 1006 2 Modifications for PS HO in A/Gb mode
CP-29 CP-050449 7.0.0 7.1.0
12-2005 1032 1 Description of 8-PSK capability on the uplink in MS Classmark 3
CP-30 CP-050535 7.1.0 7.2.0
12-2005 1039 Emergency number length in Emergency Number List IE
CP-30 CP-050536 7.1.0 7.2.0
12-2005 1035 Correction of wrong codepoint in the user-user information IE
CP-30 CP-050536 7.1.0 7.2.0
12-2005 1025 MBMS INACTIVE state does not exist
CP-30 CP-050540 7.1.0 7.2.0
12-2005 Correction of Mobile Identity used in PAGING RESPONSE
1041 1 message
CP-30 CP-050545 7.1.0 7.2.0
12-2005 Rationalised guard timer for Service Request (Service Type =
1027 3 Data)
CP-30 CP-050553 7.1.0 7.2.0
03-2006 1044 1 Use on cause #12 in VPLMNs
CP-31 CP-060126 7.2.0 7.3.0
03-2006 1050 4 Correction of domain specific access control
CP-31 CP-060114 7.2.0 7.3.0
03-2006 1052 - Missing subclause in TS 24.008
CP-31 CP-060115 7.2.0 7.3.0
03-2006 1054 2 Inclusion of support for DTM Handover for GERAN A/Gb mode
CP-31 CP-060179 7.2.0 7.3.0
03-2006 1056 1 Clarification for collision of PDP context activation
CP-31 CP-060126 7.2.0 7.3.0
03-2006 Transfer of Text from the Combinational Services TR 24.879 to
1062 1 TS 24.008
CP-31 CP-060121 7.2.0 7.3.0
03-2006 1064 - Inclusion of support for Repeated SACCH
CP-31 CP-060113 7.2.0 7.3.0
06-2006 1067 Incorrect reference to RFC 3513
CP-32 CP-060262 7.3.0 7.4.0
06-2006 1081 1 Indication of support for Repeated ACCH
CP-32 CP-060267 7.3.0 7.4.0
06-2006 Removal of references to "MBMS notification response" service
1071 2 type
CP-32 CP-060353 7.3.0 7.4.0
09-2006 Mitigating the risk of DoS attacks that utilises non-integrity
1103 2 protected NAS messages
CP-33 CP-060454 7.4.0 7.5.0
09-2006 1098 1 Enhanced NSAPI for MBMS Broadcast Mode
CP-33 CP-060455 7.4.0 7.5.0
09-2006 Clarification on the handling of T3311 and T3302 timers during
1089 2 DSAC
CP-33 CP-060459 7.4.0 7.5.0
09-2006 Procedure at UE after unbarred for both domains on DSAC in
1085 1 NMO I
CP-33 CP-060459 7.4.0 7.5.0
09-2006 1083 1 Postponed RAU if T3312 expires while PS domain is barred
CP-33 CP-060459 7.4.0 7.5.0
09-2006 1104 4 Coding of the User-User Information Element for IMS status
CP-33 CP-060473 7.4.0 7.5.0
ETSI
Release 18 803 3GPP TS 24.008 V18.4.0 (2023-09)
09-2006 Implementation option to improve the performance of MM/GMM

1099 1 signaling procedures
CP-33 CP-060506 7.4.0 7.5.0
11-2006 1115 1 Correction of the GPRS MS action in NMO I when PS is barred
CP-34 CP-060658 7.5.0 7.6.0
11-2006 Clarification on the detach procedure during domain specific
1111 2 access class barring
CP-34 CP-060658 7.5.0 7.6.0
11-2006 PDP Context Activity Indication for Service Request (Service
1053 4 Type = Data)
CP-34 CP-060670 7.5.0 7.6.0
11-2006 Deletion of LAI and PLMN from forbidden lists after LOCATION
1116 - UPDATING ACCEPT
CP-34 CP-060670 7.5.0 7.6.0
11-2006 1117 - Adding a Cipheirng Mode Setting indicator to MS Classmark3
CP-34 CP-060670 7.5.0 7.6.0
11-2006 Initiation of Service Request to support MBMS broadcast
1108 5 services
CP-34 CP-060744 7.5.0 7.6.0
03-2007 1118 1 Addition of support for Network Bearer
CP-35 CP-070143 7.6.0 7.7.0
03-2007 1119 2 Criteria used by network to select a CKSN/KSI value
CP-35 CP-070155 7.6.0 7.7.0
03-2007 Authentication parameter values stored in the UE separately for
1120 1 the CS and the PS domain
CP-35 CP-070155 7.6.0 7.7.0
03-2007 1122 Downlink Dual carrier multislot class indication
CP-35 CP-070156 7.6.0 7.7.0
03-2007 Corrections to Network initiated PDP context modification
1124 1 procedure
CP-35 CP-070155 7.6.0 7.7.0
03-2007 Introduction of Downlink Advanced Receiver Performance –
1128 2 phase II capability
CP-35 CP-070155 7.6.0 7.7.0
06-2007 1136 1 Signalling connection for MBMS reception in PTP mode
CP-36 CP-070369 7.7.0 7.8.0
06-2007 Support of higher maximum bitrate and guaranteed bit rate in the
1142 1 QoS IE
CP-36 CP-070386 7.7.0 7.8.0
06-2007 1144 2 MS indication of support of GAN PS Handover
CP-36 CP-070387 7.7.0 7.8.0
06-2007 1138 1 Clarification for the Codec Bitmap
CP-36 CP-070387 7.7.0 7.8.0
06-2007 Bearer capability IE for Emergency calls and EFR capable
1137 - terminals
CP-36 CP-070387 7.7.0 7.8.0
06-2007 1133 - Indication of Flexible Timeslot Assignment support
CP-36 CP-070387 7.7.0 7.8.0
06-2007 1134 1 Introduction of Latency Reduction capabilities
CP-36 CP-070392 7.7.0 7.8.0
09-2007 1149 1 Prohibition of implementing A5/2 in terminalsA5/2 in termi
CP-37 CP-070582 7.8.0 7.9.0
09-2007 Stage 3 alignment of Network Bearer control when BCM is
1148 2 MS/NW
CP-37 CP-070591 7.8.0 7.9.0
09-2007 1147 1 Extension of MS Classmark 3 IE length
CP-37 CP-070598 7.8.0 7.9.0
09-2007 Clarification of UE behavior after receipt of ATTACH ACCEPT
1146 1 with Cause IE in response to combined ATTACH REQUEST
CP-37 CP-070598 7.8.0 7.9.0
09-2007 1145 2 Addition of Positioning Capability Transfer over RRLP
CP-37 CP-070598 7.8.0 7.9.0
12-2007 CP-38 CP-070789 1158 1 Correction to MBMS context deactivation 7.9.0 7.10.0
12-2007 CP-38 CP-070789 1156 2 Correction to the TMGI 7.9.0 7.10.0
12-2007 CP-38 CP-070804 1153 1 Introduction of EGPRS2 capabilities 7.9.0 7.10.0
12-2007 Correction of misleading comments in the MS Classmark 3 and

CP-38 CP-070815 1152 1 MS Radio Access Capability 7.10.0 8.0.0
03-2008 CP-39 CP-080034 1168 TMGI misalignment between figure and table text 8.0.0 8.1.0
ETSI
Release 18 804 3GPP TS 24.008 V18.4.0 (2023-09)
03-2008 CP-39 CP-080136 1165 Handling of NAS-layer cause value when in GAN 8.0.0 8.1.0
06-2008 Correction of description of security handling during inter-system

CP-40 CP-080339 1177 handover 8.1.0 8.2.0
06-2008 Correction of handling unkown or unforseen transaction identifier

CP-40 CP-080347 1174 1 in session management 8.1.0 8.2.0
06-2008 CP-40 CP-080347 1191 Downlink Dual Carrier capability signalling for DTM 8.1.0 8.2.0
06-2008 CP-40 CP-080361 1186 2 RAU attempt counter and PLMN-SEARCH substate 8.1.0 8.2.0
06-2008 Add cause value #112(APN restriction value incompatible with

active PDP context) to the PDP context deactivation initiated by
CP-40 CP-080361 1172 1 the network 8.1.0 8.2.0
06-2008 CP-40 CP-080361 1184 Correction of MM states in the tables in the timer section 8.1.0 8.2.0
06-2008 CP-40 CP-080361 1178 Correction to CS messages and tables 8.1.0 8.2.0
06-2008 CP-40 CP-080362 1193 2 Changes to TS24.008_AccessControl 8.1.0 8.2.0
06-2008 CP-40 CP-080363 1169 3 eCall identifier for differential routing 8.1.0 8.2.0
09-2008 CP-41 CP-080534 1189 4 Avoidance of MM signalling for an eCall only terminal 8.2.0 8.3.0
09-2008 CP-41 CP-080536 1201 1 Correction for IMSI detach procedure during dedicated mode 8.2.0 8.3.0
09-2008 CP-41 CP-080519 1203 1 Latency Reduction support for non RTTI capable MSs 8.2.0 8.3.0
09-2008 CP-41 CP-080519 1205 1 Stage 2 alignment related to Network bearer control 8.2.0 8.3.0
09-2008 CP-41 CP-080529 1207 1 Clarification of access control for PPAC 8.2.0 8.3.0
09-2008 CP-41 CP-080536 1209 1 TMSI reallocation in a location area where the UE isn’t updated 8.2.0 8.3.0
12-2008 CP-42 CP-080860 1211 2 Changes to TS24.008_AccessControl 8.3.0 8.4.0
12-2008 CP-42 CP-080834 1213 1 Multimedia CAT in the CS domain 8.3.0 8.4.0
12-2008 CP-42 CP-080867 1214 3 Paging response for CS Fallback 8.3.0 8.4.0
12-2008 CP-42 CP-080837 1216 Indication of mobile station's E-UTRAN capability 8.3.0 8.4.0
12-2008 CSG access control for HNB - defining new cause value and UE
CP-42 CP-080838 1218 3 behavior 8.3.0 8.4.0
12-2008 CP-42 CP-080867 1219 1 CR on 24.008 -CSFB timer 8.3.0 8.4.0
12-2008 CP-42 CP-080867 1226 1 ISR for CSFB 8.3.0 8.4.0
12-2008 CP-42 CP-080866 1227 2 NAS recovery specification in TS 24.008 8.3.0 8.4.0
12-2008 CP-42 CP-080866 1228 1 DRX Parameter support for S1 mode 8.3.0 8.4.0
12-2008 Corrections for GPRS attach attempt counter and routing area
CP-42 CP-080873 1229 1 update attempt counter 8.3.0 8.4.0
12-2008 P-TMSI signature handling due to S1 mode to Iu or A/Gb mode

CP-42 CP-080866 1233 1 intersystem change 8.3.0 8.4.0
12-2008 CP-42 CP-080866 1238 1 Support of EPS NAS protocols 8.3.0 8.4.0
12-2008 CP-42 CP-080868 1239 1 Introduction of UE network capability IE 8.3.0 8.4.0
12-2008 CP-42 CP-080866 1240 1 PCO for IP address allocation options 8.3.0 8.4.0
12-2008 CP-42 CP-080868 1242 2 Indication of HSPA SRVCC capability 8.3.0 8.4.0
12-2008 CP-42 Editorial cleanup by MCC 8.3.0 8.4.0
03-2009 CP-43 CP-090125 1243 2 Additon of E-UTRAN support in MS Network Capability 8.4.0 8.5.0
ETSI
Release 18 805 3GPP TS 24.008 V18.4.0 (2023-09)
03-2009 Security context handling on inter RAT mobility to

CP-43 CP-090130 1246 1 GERAN/UTRAN 8.4.0 8.5.0
03-2009 CP-43 CP-090125 1247 2 AMF coding for EPS 8.4.0 8.5.0
03-2009 CP-43 CP-090130 1248 2 SM and GMM sublayers coordination for supporting ISR 8.4.0 8.5.0
03-2009 UE specific DRX Parameters handling in ATTACH/RAU

CP-43 CP-090131 1249 2 procedure 8.4.0 8.5.0
03-2009 CP-43 CP-090159 1253 1 Corrections for attach and RAU attempt counters 8.4.0 8.5.0
03-2009 CP-43 CP-090153 1254 1 ISR local deactivation in the UE 8.4.0 8.5.0
03-2009 CP-43 CP-090159 1255 2 Miscellaneous corrections for 24.008 8.4.0 8.5.0
03-2009 CP-43 CP-090156 1257 2 CC and MM procedures for SRVCC 8.4.0 8.5.0
03-2009 CP-43 CP-090157 1266 1 Invoking detach procedure through a CSG cell 8.4.0 8.5.0
03-2009 CP-43 CP-090157 1267 1 Miscellaneous corrections 8.4.0 8.5.0
03-2009 CP-43 CP-090157 1268 1 LU/RAU after manual selection of CSG cell 8.4.0 8.5.0
03-2009 Correction of initial conditions when UE registered for CS

services in an area supporting NMO III moves to another area
CP-43 CP-090159 1270 2 with a different NMO 8.4.0 8.5.0
03-2009 CP-43 CP-090159 1271 Reference corrections 8.4.0 8.5.0
03-2009 Additon of CS Fallback capability support in MS Network

CP-43 CP-090153 1274 1 Capability 8.4.0 8.5.0
03-2009 CP-43 CP-090129 1275 NAS recovery on/off mechanism(3G) 8.4.0 8.5.0
03-2009 Add new subclause which describes coordination between GMM

CP-43 CP-090125 1277 1 and EMM 8.4.0 8.5.0
03-2009 Proposal of UE EMM behavior on reception of error cause #9

CP-43 CP-090129 1278 1 when UE executed RAU, combined RAU and Service Request 8.4.0 8.5.0
03-2009 CP-43 CP-090126 1279 2 Clarifications for request type 8.4.0 8.5.0
03-2009 CP-43 CP-090131 1280 3 Use of S-TMSI for the GPRS attach procedure 8.4.0 8.5.0
03-2009 CP-43 CP-090157 1281 2 Update of CSG list in manual mode 8.4.0 8.5.0
03-2009 CP-43 CP-090123 1283 1 Enhancement of inter RAT information container 8.4.0 8.5.0
03-2009 CP-43 CP-090128 1284 2 Introducing E-UTRAN UE RAC Information 8.4.0 8.5.0
03-2009 CP-43 CP-090130 1285 Removal of EN for RAU reject (cause #12) 8.4.0 8.5.0
03-2009 CP-43 CP-090131 1286 2 Update the PDN type with IPv4v6 8.4.0 8.5.0
03-2009 Attach and routing area update abnormal cases: interaction with
CP-43 CP-090125 1290 1 EMM 8.4.0 8.5.0
03-2009 CP-43 CP-090153 1292 1 T3280 removal and corrections to procedures for CS fallback 8.4.0 8.5.0
03-2009 CP-43 CP-090157 1295 1 Clarification on CSG related NAS behavior 8.4.0 8.5.0
03-2009 Proposal of UE EMM behavior on reception of error cause #10

CP-43 CP-090130 1297 1 when UE executed RAU, combined RAU and Service Request 8.4.0 8.5.0
06-2009 CP-44 CP-090410 1298 Combined RAU Reject(cause #12) 8.5.0 8.6.0
06-2009 CP-44 CP-090410 1299 Authentication failure parameter applicability 8.5.0 8.6.0
06-2009 CP-44 CP-090424 1303 1 Subclause on PDP address allocation 8.5.0 8.6.0
06-2009 CP-44 CP-090421 1304 2 Mobile Id for Paging Response 8.5.0 8.6.0
ETSI
Release 18 806 3GPP TS 24.008 V18.4.0 (2023-09)
06-2009 CP-44 CP-090424 1306 1 Clarification of TMSI reallocation procedure 8.5.0 8.6.0
06-2009 CP-44 CP-090410 1308 1 Introduction of "reserved" code points for Request type IE 8.5.0 8.6.0
06-2009 CP-44 CP-090410 1314 1 Correction for the main state change in the MS 8.5.0 8.6.0
06-2009 CP-44 CP-090421 1317 New trigger for location area updating procedure 8.5.0 8.6.0
06-2009 CP-44 CP-090421 1318 MM state when MS is under E-UTRAN coverage 8.5.0 8.6.0
06-2009 CP-44 CP-090421 1319 Emergency calls handling 8.5.0 8.6.0
06-2009 Behaviour of GPRS MS operating in MS operation mode A or B

CP-44 CP-090424 1321 1 on Service Reject with cause #7 8.5.0 8.6.0
06-2009 CP-44 CP-090410 1323 1 Correction to mobile identity IE 8.5.0 8.6.0
06-2009 CP-44 CP-090426 1326 1 Introduction of MS E-UTRA Capabilities 8.5.0 8.6.0
06-2009 Replacing TRACKING AREA UPDATE REQUEST by ROUTING

CP-44 CP-090410 1327 AREA UPDATE REQUEST 8.5.0 8.6.0
09-2009 CP-45 CP-090652 1307 3 Protocol Configuration Options support of PAP CHAP in EPS 8.6.0 8.7.0
09-2009 CP-45 CP-090652 1311 7 Providing the MSISDN to the MS 8.6.0 8.7.0
09-2009 Update of triggers for normal and combined routing area

CP-45 CP-090733 1320 3 updating procedure 8.6.0 8.7.0
09-2009 CP-45 CP-090653 1328 1 Security corrections to the RAU procedure 8.6.0 8.7.0
09-2009 CP-45 CP-090653 1331 Replacing "UE" by "MS" 8.6.0 8.7.0
09-2009 CP-45 CP-090677 1332 1 Clarifications related to manual CSG selection 8.6.0 8.7.0
09-2009 CP-45 CP-090773 1333 3 Correction of security key handling for SR VCC 8.6.0 8.7.0
09-2009 CP-45 CP-090677 1337 Correction to abnormal cases on the network side 8.6.0 8.7.0
09-2009 CP-45 CP-090652 1339 2 Interaction between A/Gb or Iu mode and S1 mode 8.6.0 8.7.0
09-2009 CP-45 CP-090652 1340 1 Local ISR deactivation upon last PDP context deactivation 8.6.0 8.7.0
09-2009 Emergency calls when the MS is not registered to CS domain

CP-45 CP-090674 1341 1 and camped on an E-UTRAN cell 8.6.0 8.7.0
09-2009 Cause code to resolve race condition between UE-initiated and

CP-45 CP-090679 1343 1 NW-initiated secondary PDP context activation 8.6.0 8.7.0
09-2009 CP-45 CP-090652 1344 2 Inclusion of DNS server and P-CSCF IPv4 addresses in PCO 8.6.0 8.7.0
09-2009 CP-45 CP-090650 1345 Align the description of default bearer 8.6.0 8.7.0
09-2009 CP-45 CP-090668 1348 1 eCall miscellaneous corrections 8.6.0 8.7.0
09-2009 CP-45 CP-090668 1350 1 Amendments to mobility management procedures 8.6.0 8.7.0
09-2009 CP-45 CP-090651 1357 2 Corrections to the figure of the GMM main states in the MS 8.6.0 8.7.0
09-2009 CP-45 CP-090653 1358 1 Security for inter-system RAU from S1 mode 8.6.0 8.7.0
09-2009 CP-45 CP-090651 1360 Corrections for description of cause #25 8.6.0 8.7.0
09-2009 CP-45 CP-090651 1361 1 Correction on SM error cause #30 8.6.0 8.7.0
09-2009 CP-45 CP-090668 1368 1 Determination of "eCall only" mode of operation 8.6.0 8.7.0
09-2009 CP-45 CP-090675 1372 1 Parameters for SMS over SGs charging 8.6.0 8.7.0
09-2009 CP-45 CP-090689 1330 1 Introducing reject cause value for emergency service over GPPS 8.7.0 9.0.0
09-2009 CP-45 CP-090690 1334 3 PDN Connection request type for emergency 8.7.0 9.0.0
ETSI
Release 18 807 3GPP TS 24.008 V18.4.0 (2023-09)
09-2009 CP-45 CP-090682 1336 1 Periodic routing area updating: editorial correction 8.7.0 9.0.0
09-2009 CP-45 CP-090689 1346 2 GPRS Attach for emergency services 8.7.0 9.0.0
09-2009 CP-45 CP-090689 1347 1 GPRS detach for emergency services 8.7.0 9.0.0
09-2009 CP-45 CP-090682 1353 2 Enhanced Flexible Timeslot Assignment 8.7.0 9.0.0
09-2009 CP-45 CP-090682 1354 1 Modification of Length Indicator Usage 8.7.0 9.0.0
09-2009 Support indications for IMS Voice over PS session and

CP-45 CP-090690 1359 1 emergency call 8.7.0 9.0.0
09-2009 CP-45 CP-090689 1367 2 HLR detach request and PDP context deactivation by the SGSN 8.7.0 9.0.0
09-2009 Update of allowed CSG list after successful manual selection of

CP-45 CP-090694 1370 1 a CSG cell in a different PLMN 8.7.0 9.0.0
09-2009 CP-45 CP-090692 1371 1 Introduction of 128-bit ciphering key for A5/4 and GEA/4 8.7.0 9.0.0
12-2009 CP-46 CP-090918 1374 1 Correction for detach procedure 9.0.0 9.1.0
12-2009 CP-46 CP-090930 1375 2 Add paging optimization procedure for CSG cell 9.0.0 9.1.0
12-2009 CP-46 CP-090935 1376 3 Clarification on the Closed mode CSG cell 9.0.0 9.1.0
12-2009 CP-46 CP-090922 1377 3 UE voice capabilities/settings in MS network capability 9.0.0 9.1.0
12-2009 CP-46 CP-090922 1378 5 Triggering conditions update for RAU 9.0.0 9.1.0
12-2009 CP-46 CP-090935 1379 3 Operator CSG List 9.0.0 9.1.0
12-2009 CP-46 CP-090899 1382 1 Handling of cause #15 in UE with S1 mode support 9.0.0 9.1.0
12-2009 CP-46 CP-090930 1386 1 Detach on Timeout of Periodical Upate Timer 9.0.0 9.1.0
12-2009 CP-46 CP-090917 1388 1 Clarification on setting SI value after SRVCC handover 9.0.0 9.1.0
12-2009 CP-46 CP-090915 1396 2 LAU clarification for ISR and CSFB interworking 9.0.0 9.1.0
12-2009 CP-46 CP-090935 1397 5 Processing the reject cause code #25 for the Operator CSG List 9.0.0 9.1.0
12-2009 CP-46 CP-090920 1399 PDP type IPv4v6 address length corrections 9.0.0 9.1.0
12-2009 PDP Context activation and modification for emergency bearer

CP-46 CP-090930 1400 2 services 9.0.0 9.1.0
12-2009 CP-46 CP-090922 1401 1 Correction to conditions for GMM initiating service request 9.0.0 9.1.0
12-2009 CP-46 CP-090915 1403 1 Missing establishment cause code mapping for CS fallback 9.0.0 9.1.0
12-2009 CP-46 CP-090922 1410 Introduction of Enhanced Multiplexing for Single TBF capability 9.0.0 9.1.0
12-2009 CP-46 CP-090899 1413 Key derivation in idle mode inter-RAT mobility 9.0.0 9.1.0
12-2009 CP-46 CP-090898 1414 Correction for Seperation bit of AMF 9.0.0 9.1.0
12-2009 CP-46 CP-090930 1420 GMM state machine on the UE side for emergency attach 9.0.0 9.1.0
12-2009 CP-46 CP-090930 1421 2 GMM context handling for emergency attach 9.0.0 9.1.0
12-2009 CP-46 CP-090930 1423 2 MS behaviour in case of EMC 9.0.0 9.1.0
12-2009 Deactivate non-EMC bearers with CSG ID not in allowed CSG

CP-46 CP-090930 1424 2 list 9.0.0 9.1.0
12-2009 CP-46 CP-090930 1425 1 Handling of the forbidded list 9.0.0 9.1.0
12-2009 CP-46 CP-090930 1426 2 Authentication procedure for EMC attach 9.0.0 9.1.0
12-2009 CP-46 CP-090922 1427 1 Introduction of generic notification procedure 9.0.0 9.1.0
ETSI
Release 18 808 3GPP TS 24.008 V18.4.0 (2023-09)
12-2009 CP-46 CP-090930 1428 Checks restrictions on attach for emergency bearer services 9.0.0 9.1.0
12-2009 GPRS update status while UE is attached for emergency bearer

CP-46 CP-090930 1437 1 services 9.0.0 9.1.0
12-2009 CP-46 CP-090939 1438 128-bit ciphering key for SRVCC 9.0.0 9.1.0
12-2009 Correction to the definition of the UMTS security context and

CP-46 CP-090939 1439 faulty message 9.0.0 9.1.0
12-2009 Alignment with TS23.401 caused by changing the term CSFB to

CP-46 CP-091052 1441 2 "CSFB and SMS over SGs". 9.0.0 9.1.0
12-2009 CP-46 CP-090919 1409 4 Protecting the allowed CSG list 9.0.0 9.1.0
03-2010 CP-47 CP-100144 1392 5 Normal and Periodic Routing Area Update Procedure 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1418 3 Deactive ISR for UE attached for emergency bearer services 9.1.0 9.2.0
03-2010 CP-47 CP-100103 1445 Removal of T-GSM 900 capability 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1446 1 Disabling Integrity Checking for GMM, SM messages 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1447 MS Initiated Detach Procedure 9.1.0 9.2.0
03-2010 CP-47 CP-100140 1448 1 Clarification to key derivation at SRVCC 9.1.0 9.2.0
03-2010 CP-47 CP-100134 1450 1 Correction on CSG Id removal from Allowed CSG list 9.1.0 9.2.0
03-2010 GPRS Kc handling at inter-system change from E-UTRAN to

CP-47 CP-100106 1452 2 UTRAN/GERAN 9.1.0 9.2.0
03-2010 CP-47 CP-100129 1454 2 Kc handling in SRVCC 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1455 1 Definition of attached for emergency bearer service 9.1.0 9.2.0
03-2010 CP-47 CP-100134 1456 1 Selective camping capability correction 9.1.0 9.2.0
03-2010 CP-47 CP-100134 1457 2 Defining Selective camping capability IE 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1458 2 RRC establishment cause for EMC of Iu mode 9.1.0 9.2.0
03-2010 CP-47 CP-100126 1460 2 Handling of Paging Response for CSFB 9.1.0 9.2.0
03-2010 CP-47 CP-100134 1461 Handling of CSFB mobile originating call 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1462 1 Handling authentication failure for EMC during RAU 9.1.0 9.2.0
03-2010 Alignment term "CSFB and SMS over SGs" with TS23.401 (Part
CP-47 CP-100126 1467 1 II) 9.1.0 9.2.0
03-2010 CP-47 CP-100106 1469 2 Clarification on routing parameter for access stratum 9.1.0 9.2.0
03-2010 CP-47 CP-100135 1470 2 Operator specific values for PCO 9.1.0 9.2.0
03-2010 Use of Cause #25 when MS's subscription to CSG has expired –
CP-47 CP-100148 1471 1 24.008 9.1.0 9.2.0
03-2010 Handling of inter RAT information container and E-UTRAN inter

CP-47 CP-100134 1473 RAT information container 9.1.0 9.2.0
03-2010 Removing triggers for rau after S1 mode to UTRAN Iu mode

CP-47 CP-100126 1476 1 intersystem change due to CS fallback without PS handover 9.1.0 9.2.0
03-2010 Corrections on periodic routeing area update timer and

CP-47 CP-100126 1478 1 GERAN/UTRAN Deactivate ISR timers in the UE 9.1.0 9.2.0
03-2010 CP-47 CP-100134 1483 1 Using NAS-token in Attach Request 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1486 2 Emergency secondary PDP context activation 9.1.0 9.2.0
03-2010 CP-47 CP-100130 1488 1 MM cause #25 for MM connection establishment 9.1.0 9.2.0
ETSI
Release 18 809 3GPP TS 24.008 V18.4.0 (2023-09)
03-2010 CP-47 CP-100144 1489 Definition of non-emergency PDP context 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1490 MS Substate PLMN Search 9.1.0 9.2.0
03-2010 Attach for emergency bearer services to a network not

CP-47 CP-100144 1491 2 supporting EM BS 9.1.0 9.2.0
03-2010 CP-47 CP-100134 1493 1 Corrections to Network Feature Support IE. 9.1.0 9.2.0
03-2010 CP-47 CP-100126 1498 2 Correction of CSFB capability indicator 9.1.0 9.2.0
03-2010 CP-47 CP-100144 1499 2 Mobility aspects of Emergency attached UEs 9.1.0 9.2.0
03-2010 Introduction of indication of support of GERAN to UTRAN

CP-47 CP-100132 1501 priority-based cell reselection – Option 1 9.1.0 9.2.0
03-2010 CP-47 CP-100211 1504 2 Correct terminating domain selection for IMS voice UEs 9.1.0 9.2.0
06-2010 CP-48 CP-100371 1509 2 Correction of LAU initiation during CSFB 9.2.0 9.3.0
06-2010 CP-48 CP-100354 1510 2 Correction of LAU for CSFB in NMO I 9.2.0 9.3.0
06-2010 CP-48 CP-100351 1514 Requested QoS in PDP context activation procedure 9.2.0 9.3.0
06-2010 GPRS Kc128 handling at inter-system change from E-UTRAN to

CP-48 CP-100355 1515 1 UTRAN/GERAN 9.2.0 9.3.0
06-2010 CP-48 CP-100360 1517 3 GMM Authentication procedure for emergency services 9.2.0 9.3.0
06-2010 CP-48 CP-100354 1518 1 Security context deletion 9.2.0 9.3.0
06-2010 CP-48 CP-100355 1521 Multiple TTI TBF capability 9.2.0 9.3.0
06-2010 CP-48 CP-100355 1522 Interpretation of Multislot Class Parameters for EFTA 9.2.0 9.3.0
06-2010 CP-48 CP-100354 1525 1 Correction of conditions for RAU and ISR deactivation for T-ADS 9.2.0 9.3.0
06-2010 CP-48 CP-100360 1536 2 Some corrections to the EMC procedure. 9.2.0 9.3.0
06-2010 Clarification to network initiated detach procedure with cause

CP-48 CP-100350 1538 2 #25 9.2.0 9.3.0
06-2010 Correction to MS Radio Access Capability Information Element

CP-48 CP-100355 1544 1 encoding 9.2.0 9.3.0
06-2010 Derivation of the security context for CS domain because of

CP-48 CP-100349 1547 1 SRVCC 9.2.0 9.3.0
06-2010 Correction to the applicability of security key for inter-sytem

CP-48 CP-100354 1548 1 change from S1 to Iu 9.2.0 9.3.0
06-2010 Correction to the derivation of GPRS GSM Kc128 for inter-sytem

CP-48 CP-100365 1549 1 change from S1 to Gb 9.2.0 9.3.0
06-2010 CP-48 CP-100365 1550 1 Correction to 128-bit ciphering key handling 9.2.0 9.3.0
06-2010 CP-48 CP-100360 1551 2 Emergency attach reject from GMM in shared networks 9.2.0 9.3.0
09-2010 CP-49 CP-100501 1532 2 Corrections for Selective Camping 9.3.0 9.4.0
09-2010 CP-49 CP-100491 1553 4 Correction to timer T3242 and T3243 values (eCall only MS) 9.3.0 9.4.0
09-2010 Clarification to the T3302 timer value when a UE is emergency

CP-49 CP-100506 1554 2 attached without security procedure. 9.3.0 9.4.0
09-2010 Handling of Detach Procedure for IMSI services on a CSG cell

CP-49 CP-100506 1555 2 which is no longer valid for the UE.and IMS EMG call is active. 9.3.0 9.4.0
09-2010 Clarification to timer T3318 and T3320 timer description in the

CP-49 CP-100506 1560 1 EMC case. 9.3.0 9.4.0
09-2010 CP-49 CP-100485 1581 1 Correction to the protocol configuration options IEI 9.3.0 9.4.0
ETSI
Release 18 810 3GPP TS 24.008 V18.4.0 (2023-09)
09-2010 Handling of location updating after CS fallback for mobile

CP-49 CP-100501 1585 4 terminating calls 9.3.0 9.4.0
09-2010 CP-49 CP-100507 1593 2 Introduction of MS CSG interworking capabilities 9.3.0 9.4.0
09-2010 CP-49 CP-100501 1595 Correction of implementation error of CR1372R1 9.3.0 9.4.0
09-2010 Handling of collision of a Network Initiated Detach procdure with

CP-49 CP-100501 1598 2 a Service Request procedure and a RAU procedure. 9.3.0 9.4.0
09-2010 CP-49 CP-100495 1603 1 Location updating during CS fallback 9.3.0 9.4.0
09-2010 CP-49 CP-100506 1604 1 Correction on storage of equivalent PLMNs list 9.3.0 9.4.0
09-2010 Corrections to UE mode of operation selection taking into

CP-49 CP-100520 1613 account the UE's availability for voice calls in the IMS 9.3.0 9.4.0
09-2010 Alignment with 23.060 for SM cause value #52 "single address
CP-49 CP-100501 1621 2 bearers only allowed" 9.3.0 9.4.0
09-2010 CP-49 CP-100517 1528 2 Local ISR deactivation in the UE when T3412 has expired 9.4.0 10.0.0
09-2010 CP-49 CP-100517 1540 3 Correcting ISR handling in UE 9.4.0 10.0.0
09-2010 CP-49 CP-100514 1562 5 PDN connection redirection in SIPTO scenario 9.4.0 10.0.0
09-2010 CP-49 CP-100514 1563 1 Clarification on PDP Context re-activation 9.4.0 10.0.0
09-2010 CP-49 CP-100517 1564 1 Correction for value setting of the mobile reachable timer 9.4.0 10.0.0
09-2010 CP-49 CP-100517 1566 2 Correction for implicit detach timer 9.4.0 10.0.0
09-2010 CP-49 CP-100520 1573 1 eCALL INACTIVE state and ATT flag 9.4.0 10.0.0
09-2010 CP-49 CP-100642 1579 2 Maximum number of packet filters 9.4.0 10.0.0
09-2010 LLC SAPI on PDP context activation for an MS capable of S1

CP-49 CP-100517 1586 mode 9.4.0 10.0.0
09-2010 MS behaviour when the network unexpectedly sets Selected

CP-49 CP-100520 1587 1 Bearer Control Mode 9.4.0 10.0.0
09-2010 CP-49 CP-100520 1594 Introduction of Dynamic Timeslot Reduction capability 9.4.0 10.0.0
09-2010 CP-49 CP-100517 1599 1 TIN setting after location updating 9.4.0 10.0.0
09-2010 CP-49 CP-100520 1600 2 Handling of cause #27 (missing or unknown APN) 9.4.0 10.0.0
09-2010 CP-49 CP-100517 1605 1 Correction on network initiated GPRS detach with cause #2 9.4.0 10.0.0
09-2010 CP-49 CP-100520 1608 Clarifying the updation of forbidden LA list 9.4.0 10.0.0
09-2010 CP-49 CP-100520 1610 1 Clarification on READY timer behaviour 9.4.0 10.0.0
09-2010 CP-49 CP-100520 1617 Correction to UTRAN Network sharing 9.4.0 10.0.0
12-2010 Correcting CJKV ideograph language ambiguity with the NITZ

CP-50 CP-100761 1589 4 feature and UCS2 10.0.0 10.1.0
12-2010 CP-50 CP-100748 1625 1 Add HNB name 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1628 1 Attach with IMSI 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1629 7 Extended Routing Area Update Timer 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1630 4 Rejection due to per APN congestion 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1631 3 Modified GMM Cause values for NIMTC 10.0.0 10.1.0
12-2010 CP-50 CP-100761 1632 Authentication not accepted by the network 10.0.0 10.1.0
12-2010 CP-50 CP-100751 1634 1 MS capability indication of VAMOS 10.0.0 10.1.0
ETSI
Release 18 811 3GPP TS 24.008 V18.4.0 (2023-09)
12-2010 CP-50 CP-100742 1635 1 Correction of conditions for setting the CMST flag 10.0.0 10.1.0
12-2010 CP-50 CP-100761 1638 1 Deleting unnecessary trigger for initiating LAU procedure 10.0.0 10.1.0
12-2010 CP-50 CP-100742 1648 1 DCDL for EFTA 10.0.0 10.1.0
12-2010 CP-50 CP-100761 1649 1 Enhanced Multiplexing for a Single RLC Entity (EMSR) 10.0.0 10.1.0
12-2010 Handling of equivalent PLMN list when attached for emergency

CP-50 CP-100747 1653 1 bearer services only 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1655 1 NMOI indicator for MTC 10.0.0 10.1.0
12-2010 CP-50 CP-100761 1657 1 Correctin to the use of label "UMTS only" in various procedure. 10.0.0 10.1.0
12-2010 CP-50 CP-100736 1660 1 Correction of normal stop conditions for eCall and other timers 10.0.0 10.1.0
12-2010 Correction to the network intiated detach procedure with detach

CP-50 CP-100761 1662 1 type "Re-attach required" 10.0.0 10.1.0
12-2010 CP-50 CP-100758 1669 3 Cause value for terminating eMPS CS Fallback calls 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1670 4 RAU procedure when Low Priority indicator in MS changes 10.0.0 10.1.0
12-2010 CP-50 CP-100761 1672 2 Explicit signalling of native vs mapped P-TMSI during RAU 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1673 2 Adding NAS signalling priority indication in Attach Request 10.0.0 10.1.0
12-2010 CP-50 CP-100754 1674 IFOM support PCO definition 10.0.0 10.1.0
12-2010 Correcting conditions for inclusion of "voice domain preference

CP-50 CP-100742 1678 2 and UE’s usage setting" IE in Attach and RAU. 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1681 3 Clarifying the APN congestion control for EMC attached MS 10.0.0 10.1.0
12-2010 CP-50 CP-100747 1685 1 Correction on GMM authentication failure for EMC services 10.0.0 10.1.0
12-2010 CP-50 CP-100760 1686 1 SM procedures for low priority 10.0.0 10.1.0
12-2010 CP-50 CP-100761 1690 Correction of bearer capability length 10.0.0 10.1.0
12-2010 CP-50 CP-100753 1641 4 PDN disconnection for LIPA 10.0.0 10.1.0
12-2010 CP-50 CP-100767 1644 4 Introduction of MOCN GERAN 10.0.0 10.1.0
03-2011 Handling of periodic RAU timer, mobile reachable timer and MM

CP-51 CP-110193 1683 3 back-off timer 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1691 3 Clarification to the handling of SM cause value 27 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1692 3 Clarification to the handling of timer T3245 10.1.0 10.2.0
03-2011 Handling of secondary PDP context activation procedure in case

CP-51 CP-110193 1693 5 of APN congestion 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1696 2 Explicit Signalling Indication During Attach 10.1.0 10.2.0
03-2011 Introduce cause value to reflect call rejection due to destinaton

CP-51 CP-110195 1701 3 feature 10.1.0 10.2.0
03-2011 CP-51 CP-110183 1704 3 Corrections to the PDP Context Deactivation 10.1.0 10.2.0
03-2011 Low priority indication by the MS for the service request

CP-51 CP-110193 1705 2 procedure 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1706 2 Integrity protection of periodic updates 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1710 1 Attach with IMSI Alignment of Terminology 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1711 1 Specific requirements Alignment of Terminology 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1712 1 NMO I behavior 10.1.0 10.2.0
ETSI
Release 18 812 3GPP TS 24.008 V18.4.0 (2023-09)
03-2011 Notify UE when a HNB provides access to a

CP-51 CP-110183 1713 5 residential/enterprise IP network 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1715 Clarification to SM cause value#31 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1717 3 Storage and handling of the NAS signalling low priority indicator 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1720 2 Correction on GPRS detach and service request collision 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1721 1 Correction on MS substate selection 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1722 2 Correction to reject cause value 48 name 10.1.0 10.2.0
03-2011 Correction to Unsuccessful secondary PDP context activation

CP-51 CP-110195 1723 2 procedure initiated by the MS 10.1.0 10.2.0
03-2011 Completion of introduction of "Low priority" indication in 24.008

CP-51 CP-110193 1724 2 CS messages 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1725 4 Adding NAS signalling priority indication in SM messages 10.1.0 10.2.0
03-2011 Handling of Location Updating and CS Service Request after CS

CP-51 CP-110195 1726 1 fallback for mobile originating calls 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1727 3 Correction of the handling of the P-TMSI type IE 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1728 1 Maximum Transmission Unit in Protocol configuration options 10.1.0 10.2.0
03-2011 Allocation of TI and assignment of CC state to alerting call for

CP-51 CP-110199 1731 1 SRVCC 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1734 GMM state after lower layers failure during TAU when TIN=GUTI 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1735 3 Stopping T3311 when UE moves to PMM-CONNECTED mode 10.1.0 10.2.0
03-2011 Changing "P-TMSI or IMSI" Information Element to "Mobile

CP-51 CP-110253 1744 1 Identity" 10.1.0 10.2.0
03-2011 CP-51 CP-110171 1747 Correction to detection of CSG cell based on CSG ID 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1750 4 EAB support 10.1.0 10.2.0
03-2011 Correction on PPAC description to include GPRS Attach

CP-51 CP-110195 1753 1 procedure 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1756 1 Radio resource sublayer address TLLI handling 10.1.0 10.2.0
03-2011 CP-51 CP-110193 1758 2 SM Backoff timer, Editor’s note removal 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1761 1 MS initiated PDP Context Activation without PDP address 10.1.0 10.2.0
03-2011 CP-51 CP-110183 1762 3 Restriction on the use of PDN connection for LIPA 10.1.0 10.2.0
03-2011 CP-51 CP-110195 1763 Editorial correction on Congestion level IE definition 10.1.0 10.2.0
03-2011 RRC establishment cause for emergency PDP after normal

CP-51 CP-110253 1765 1 GPRS attach 10.1.0 10.2.0
03-2011 Missing handling of undefined values for MBR and GBR by the
CP-51 CP-110195 1766 MS 10.1.0 10.2.0
03-2011 CP-51 CP-110206 1700 4 Mobility management congestion control and back-off timer 10.1.0 10.2.0
03-2011 Device properties and RRC establishment cause = Delay

CP-51 CP-110305 1699 3 tolerant – 24.008 10.1.0 10.2.0
06-2011 CP-52 CP-110462 1776 1 Corrections for overload behavior 10.2.0 10.3.0
06-2011 Clearly specify conditions for UE actions at switch off for T3245,
CP-52 CP-110462 1779 1 T3346 and T3396. 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1780 1 Further clarification of PLMN reselection and handling of MM 10.2.0 10.3.0
ETSI
Release 18 813 3GPP TS 24.008 V18.4.0 (2023-09)
back-off timer
06-2011 CP-52 CP-110466 1782 1 Modifications to Emergency Number List IE. 10.2.0 10.3.0
06-2011 CP-52 CP-110466 1785 Support of IPv6 Prefix Delegation 10.2.0 10.3.0
06-2011 Manipulation of CSG ID entries (in ACL and OCL) and the
CP-52 CP-110446 1788 associated PLMNID - 3G 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1792 Specification of missing timer identities 10.2.0 10.3.0
06-2011 CP-52 CP-110476 1793 Correct conditions for including the connectivity type IE 10.2.0 10.3.0
06-2011 CP-52 CP-110476 1794 1 Correct the trigger of the LIPA PDN disconnection 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1795 1 Reference to NAS configuration in USIM 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1796 2 Inter RAT Change 10.2.0 10.3.0
06-2011 Handling Network initiated procedure when backoff timer is

CP-52 CP-110462 1798 2 running 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1799 2 Emergency attach during backoff 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1801 1 alignment about MM congestion control 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1808 2 Correction on MS behavior for SM cause #26 and #27 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1812 1 Clarification about APN based congestion control procedure 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1815 2 Correction of T3396 handling for PDN connection reactivation 10.2.0 10.3.0
06-2011 Clarification to condition of sending the Network feature durning

CP-52 CP-110464 1818 2 periodic RAU procedure. 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1820 1 Per MS T3212 rather than T3212 multiplier 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1822 2 Attach with IMSI in CS domain at PLMN change for MTC devices 10.2.0 10.3.0
06-2011 CP-52 CP-110466 1790 Introduction of fast downlink frequency switching capability 10.2.0 10.3.0
06-2011 CP-52 CP-110462 1791 2 Addition of MM backoff timer for CS 10.2.0 10.3.0
06-2011 CP-52 CP-110466 1806 1 Preservation and network controlled QoS 10.2.0 10.3.0
06-2011 CP-52 CP-110463 1807 1 NAS signalling low priority indication for exception cases 10.2.0 10.3.0
06-2011 CP-52 CP-110515 1827 1 Signalling of TIGHTER capabilities 10.2.0 10.3.0
09-2011 Handling mobile reachable timer for back-off UE with emergency

CP-53 CP-110680 1770 4 PDN connection 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1821 6 Call forwarding, paging and long periodic timers 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1831 1 PDP Context Deactivation 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1832 1 Handling Timers T3246, T3346 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1833 1 Timer Table Update with EPS details 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1834 2 Handling NAS Low Priority Indication 10.3.0 10.4.0
09-2011 Correction and clarification on the terminologies of NAS level

CP-53 CP-110680 1835 4 congestion control 10.3.0 10.4.0
09-2011 CP-53 CP-110682 1847 1 Clarification of UE behavior when combined RAU is not accepted 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1850 1 Clarify the bit in the device properties 10.3.0 10.4.0
09-2011 CP-53 CP-110683 1854 2 Clarification on periodic routing area update 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1856 1 Scope of SM APN congestion control 10.3.0 10.4.0
ETSI
Release 18 814 3GPP TS 24.008 V18.4.0 (2023-09)
09-2011 Handling of paging for MT in CS when a MM back-off timer is

CP-53 CP-110680 1859 2 running 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1861 4 Clarification of RAU triggered after paging 10.3.0 10.4.0
09-2011 Establishing emergency services when T3246 or T3346 is

CP-53 CP-110680 1862 1 running 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1882 1 Correction to cause #22 handling 10.3.0 10.4.0
09-2011 Clarification on paging response for CSFB when a MM back-off

CP-53 CP-110680 1908 1 timer is running 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1910 1 T3323 may not be started 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1911 Removal of EMM cause 10.3.0 10.4.0
09-2011 Reject Cause handling while MS attaching for emergency bearer

CP-53 CP-110665 1914 2 services 10.3.0 10.4.0
09-2011 CP-53 CP-110680 1917 1 Value of timer T3312 in the network 10.3.0 10.4.0
09-2011 CP-53 CP-110708 1855 5 Correction to network-initiated detach procedure 10.3.0 10.4.0
09-2011 Clarifications for removal of numbers from the Local Emergency

CP-53 CP-110694 1783 4 Numbers List 10.4.0 11.0.0
09-2011 CP-53 CP-110695 1842 1 Editorial correction to the SM cause #27 10.4.0 11.0.0
09-2011 Starting deactivate ISR timer in substate PLMN-SEARCH when

CP-53 CP-110690 1853 3 T3312 expires 10.4.0 11.0.0
09-2011 CP-53 CP-110694 1858 1 GPRS detach procedure collision handling 10.4.0 11.0.0
09-2011 CP-53 CP-110695 1863 1 Correction on packet filter list description 10.4.0 11.0.0
09-2011 vSRVCC Enhancements in TS 24.008 excluding vSRVCC

CP-53 CP-110697 1866 4 indicator (terminology variant 1) 10.4.0 11.0.0
09-2011 CP-53 CP-110695 1871 1 Emergency Attach from PLMN-SEARCH, ATTACH NEEDED 10.4.0 11.0.0
09-2011 CP-53 CP-110695 1878 2 Clarification to the codec selection during SRVCC HO procedure 10.4.0 11.0.0
09-2011 CP-53 CP-110692 1885 2 EAB reference for UTRAN 10.4.0 11.0.0
09-2011 Clarification to the GMM procedures when a UE receives GMM

CP-53 CP-110694 1886 1 cause #10 10.4.0 11.0.0
09-2011 CP-53 CP-110695 1897 1 RPLMN to PLMN in handling of Emergency Numbers List 10.4.0 11.0.0
09-2011 CP-53 CP-110695 1901 1 Support for multiple MCC countries 10.4.0 11.0.0
09-2011 CP-53 CP-110691 1902 1 Correction on TIN setting for LAU procedure 10.4.0 11.0.0
09-2011 CP-53 CP-110695 1903 1 Correction on integrity checking 10.4.0 11.0.0
09-2011 CP-53 CP-110694 1904 1 Handling of timer T3302 10.4.0 11.0.0
09-2011 CP-53 CP-110694 1906 2 Stopping of timer T3311 and T3302 10.4.0 11.0.0
09-2011 CP-53 CP-110694 1907 Correction to references 10.4.0 11.0.0
09-2011 CP-53 CP-110694 1916 2 Handling of timer T3312 10.4.0 11.0.0
09-2011 CP-53 CP-110695 1918 1 Editorial corrections in TS 24.008 10.4.0 11.0.0
12-2011 CP-54 CP-110882 1802 11 Re-attach for emergency bearer service 11.0.0 11.1.0
12-2011 CP-54 CP-110851 1923 1 PSAP Callback for eCalls 11.0.0 11.1.0
12-2011 CP-54 CP-110871 1925 4 Setting Mobile Reachable timer, Implicit Detach Timer 11.0.0 11.1.0
ETSI
Release 18 815 3GPP TS 24.008 V18.4.0 (2023-09)
12-2011 CP-54 CP-110884 1928 Codec negotiation after vSRVCC HO. 11.0.0 11.1.0
12-2011 CP-54 CP-110871 1930 Timer granularity of GPRS timer 3 11.0.0 11.1.0
12-2011 Resetting GPRS attach attempt counter after successful EPS

CP-54 CP-110888 1932 1 attach 11.0.0 11.1.0
12-2011 Update of handling of collision between MS initiated detach

procedure and network initiated detach procedure with "re-
CP-54 CP-110882 1933 2 attached required" 11.0.0 11.1.0
12-2011 Correction on starting deactivate ISR timer in substate PLMN-

CP-54 CP-110888 1934 1 SEARCH when T3312 expires 11.0.0 11.1.0
12-2011 CP-54 CP-110882 1938 2 Emergency bearer services from GMM-REGISTERED substates 11.0.0 11.1.0
12-2011 CP-54 CP-110882 1941 IMSI detach and GMM common procedure collision 11.0.0 11.1.0
12-2011 CP-54 CP-110882 1942 3 Correction to authentication not accepted by the MS 11.0.0 11.1.0
12-2011 Handling of equivalent PLMN list for GPRS services during the
CP-54 CP-110882 1943 1 attach and RAU procedure. 11.0.0 11.1.0
12-2011 Correction to MS initiated PDP context modification without

CP-54 CP-110882 1947 2 changing packet filter(s) procedure 11.0.0 11.1.0
12-2011 CP-54 CP-110879 1950 1 Clarifications for user connection attachment for SRVCC 11.0.0 11.1.0
12-2011 Removal of undefined "forbidden PLMN for attach in S1 mode"

CP-54 CP-110871 1952 1 list. 11.0.0 11.1.0
12-2011 Update of the forbidden PLMN list for GPRS services on receipt
CP-54 CP-110882 1953 1 of Detach request 11.0.0 11.1.0
12-2011 Clarification of network's knowledge of MS's valid CSG

CP-54 CP-110882 1954 1 subscription 11.0.0 11.1.0
12-2011 Clarification to the description of the cause value #22

CP-54 CP-110882 1957 1 (congestion) 11.0.0 11.1.0
12-2011 CP-54 CP-110871 1963 Correction of MM back-off timer reference 11.0.0 11.1.0
12-2011 CP-54 CP-110871 1965 1 Clarification on SM backoff while paged using IMSI 11.0.0 11.1.0
12-2011 CP-54 CP-110871 1967 2 Correction of LAU trigger when EMM/GMM backoff 11.0.0 11.1.0
12-2011 CP-54 CP-110860 1973 START value storage on USIM at SRVCC handover 11.0.0 11.1.0
12-2011 CP-54 CP-110875 1975 1 Introduction of Selective Ciphering on SACCH 11.0.0 11.1.0
12-2011 CP-54 CP-110888 1976 1 Correction to length field label of routing area identification 2 IE 11.0.0 11.1.0
12-2011 CP-54 CP-110882 1977 1 Removal of cause values #52 from activate PDP context reject 11.0.0 11.1.0
12-2011 CP-54 CP-110871 1979 1 Default Value for SM back-off timer 11.0.0 11.1.0
12-2011 CP-54 CP-110859 1987 4 Old LAI in Attach/RAU procedure 11.0.0 11.1.0
12-2011 CP-54 CP-110884 1993 Remove Editor’s Note on assumed BS30 properties 11.0.0 11.1.0
12-2011 Release of the NAS signalling connection after completion of

CP-54 CP-110871 1996 2 MS-initiated detach procedure 11.0.0 11.1.0
12-2011 CP-54 CP-110882 1997 2 MM state in combine GMM procedure initiated 11.0.0 11.1.0
12-2011 CP-54 CP-110882 1998 1 MLD RFC references 11.0.0 11.1.0
12-2011 CP-54 CP-110874 1999 2 Coordination between SM and GMM for supporting ISR 11.0.0 11.1.0
12-2011 CP-54 CP-110871 2001 1 LAU trigger when GMM backoff timer running 11.0.0 11.1.0
12-2011 CP-54 CP-110871 2018 2 Remove "CN congestion" indication and Introduce CN domain 11.0.0 11.1.0
ETSI
Release 18 816 3GPP TS 24.008 V18.4.0 (2023-09)
indicator
12-2011 CP-54 CP-110871 2020 2 Correction on the MO CSFB procedure during T3246 running 11.0.0 11.1.0
12-2011 CP-54 CP-110883 1893 4 Full support of Mult-Operator Core Network by GERAN 11.0.0 11.1.0
01-2012 Editorial corrections (reset of corrupted style B1, addition of

missing line break in 5.1.2.2.2d) 11.1.0 11.1.1
01-2012 Correction of implementation error of CR2018 11.1.1 11.1.2
03-2012 CP-55 CP-120114 1920 7 Selected PLMN Id indication for the CS domain 11.1.2 11.2.0
03-2012 CP-55 CP-120126 1948 2 Clarifications for user connection attachment for vSRVCC 11.1.2 11.2.0
03-2012 Handling of security related parameters at switch on and switch

CP-55 CP-120125 1994 3 off 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2026 RRC Establishment cause correction for emergency and detach 11.1.2 11.2.0
03-2012 CP-55 CP-120100 2030 1 Removal of LLC Acknowledged mode 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2031 Normal stop of T303. 11.1.2 11.2.0
03-2012 Modification of the location registration method in CS fallback

CP-55 CP-120105 2036 1 procedure 11.1.2 11.2.0
03-2012 CP-55 CP-120098 2044 1 Correction of Combined RA/LA update triggers by CSFB UE 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2046 Correction of the Emergency number list IE 11.1.2 11.2.0
03-2012 CP-55 CP-120123 2047 2 Extended Access Barring for UTRAN 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2049 Clarification and alignment of CC#38 applicability 11.1.2 11.2.0
03-2012 Local ISR deactivation in the MS upon change of the UE's usage
CP-55 CP-120122 2050 1 setting or the voice domain preference for E-UTRAN 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2052 1 Correction of "Extended Wait Time" in the timer tables. 11.1.2 11.2.0
03-2012 CP-55 CP-120111 2054 2 Release of NAS signalling connection with EWT 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2058 1 Rejecting SM messages with low priority indicator 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2060 2 Indication of supporting T3312 extended value in RAU 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2061 1 Correction of LAU trigger when EMM/GMM backoff 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2065 Removing reference to non- existent timer T3247 11.1.2 11.2.0
03-2012 CP-55 CP-120111 2067 Location Update when T3346 is running in NMO1 11.1.2 11.2.0
03-2012 CP-55 CP-120125 2068 1 Clarification of location update type for manual CSG selection 11.1.2 11.2.0
03-2012 CP-55 CP-120122 2069 1 QoS for default bearer 11.1.2 11.2.0
03-2012 CP-55 CP-120111 2073 3 Handling NAS signalling low priority indication 11.1.2 11.2.0
03-2012 CP-55 CP-120111 2076 3 Correction to the handling of wait time from AS 11.1.2 11.2.0
03-2012 CP-55 CP-120120 2077 2 Call clearing in CS for rSRVCC 11.1.2 11.2.0
03-2012 Correction for RAU triggering while T3346 and receiving of

CP-55 CP-120111 2080 1 paging 11.1.2 11.2.0
03-2012 CP-55 CP-120111 2082 1 Back-off timer handling in connected mode mobility 11.1.2 11.2.0
03-2012 Handling of stored RAND and RES values in case of connection

CP-55 CP-120122 2084 aborted 11.1.2 11.2.0
03-2012 CP-55 CP-120102 2085 1 Re-attach for emergency bearer service 11.1.2 11.2.0
ETSI
Release 18 817 3GPP TS 24.008 V18.4.0 (2023-09)
03-2012 CP-55 CP-120106 2086 1 Call Control state modelling for aSRVCC 11.1.2 11.2.0
03-2012 CP-55 CP-120120 2087 1 Call Control state modelling for rSRVCC 11.1.2 11.2.0
03-2012 CP-55 Editorial corrections 11.2.0 11.2.1
06-2012 CP-56 CP-120305 1983 6 State verification to avoid state mismatch 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2048 3 Extension of maximum bitrates in QoS IE 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2062 2 Correction of detach procedure collision 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2088 2 Traffic flow aggregate description and TFT IE extension 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2089 7 SMS-only Support for PS-only Subscription 11.2.1 11.3.0
06-2012 Correction to RAU trigger for the support of terminating access

CP-56 CP-120308 2090 1 domain selection for voice calls 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2092 1 FANR capability indication 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2093 Checking T3246 for CS Fallback emergency call 11.2.1 11.3.0
06-2012 CP-56 CP-120312 2094 1 Introduction of GERAN network sharing capability 11.2.1 11.3.0
06-2012 CP-56 CP-120293 2099 3 Additional trigger to GPRS detach and abnormal case handling 11.2.1 11.3.0
06-2012 Application of ESM backoff Timer when UE received ESM cause

CP-56 CP-120308 2102 5 #50 or #51(Alt.3) 11.2.1 11.3.0
06-2012 Addition of SM-backoff timer handling for NW initiated PDN

CP-56 CP-120308 2104 3 connectivity deactivation 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2106 Correction to incomplete title of reference 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2107 1 Handling of the Local Emergency Numbers List 11.2.1 11.3.0
06-2012 Trigger to Location Update procedure due to Manual PLMN

CP-56 CP-120302 2109 4 selection when T3346 timer is running. 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2112 1 Clarification to the GMM cause #9 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2113 1 Clarification to the description of GPRS UPDATE Status 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2115 1 Extended access barring not applicable for MT, AC11-15 11.2.1 11.3.0
06-2012 ISR deactivation and RAU/combined RAU in connected mode

CP-56 CP-120318 2116 3 mobility from E-UTRAN to GERAN 11.2.1 11.3.0
06-2012 CP-56 CP-120296 2125 1 Corrections to Alternative EFTA multislot class field 11.2.1 11.3.0
06-2012 Request for call clearing from upper layer after CS to PS

CP-56 CP-120317 2126 handover 11.2.1 11.3.0
06-2012 CP-56 CP-120313 2128 2 Mobility management procedures for IMS voice terminations 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2129 2 "SMS only" definition 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2130 5 Combined procedures for "SMS only" 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2131 3 Cause value for PS-only 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2132 4 "SMS supported" indication 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2133 4 GPRS MS behavior for "SMS only" 11.2.1 11.3.0
06-2012 CP-56 CP-120302 2135 1 Abnormal cases when Extended Wait Time is received 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2139 Alignment of disconnecting PDN connection 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2140 4 Correction of APN based congestion control 11.2.1 11.3.0
ETSI
Release 18 818 3GPP TS 24.008 V18.4.0 (2023-09)
06-2012 CP-56 CP-120302 2141 2 Correction of high priority user 11.2.1 11.3.0
06-2012 Clarification on the EPS re-use of the Traffic Flow Template IE

CP-56 CP-120318 2143 1 format 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2144 2 PDP context for emergency call 11.2.1 11.3.0
06-2012 CP-56 CP-120309 2145 3 Gs Support for MSC in Pool to avoid dual VLR registration 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2150 1 Timer of mobility management in MM state 9 11.2.1 11.3.0
06-2012 Allowing MS with AC 11-15 to access the network when T3396 is

CP-56 CP-120308 2157 1 running 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2160 1 Improvement in the definition of cause codes 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2161 2 SM Timer handling for dual priority requirement 11.2.1 11.3.0
06-2012 Restatement of detach and re-attach upon end of attached for

CP-56 CP-120309 2163 1 emergency bearer service – 24.008 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2169 2 MM timer handling for dual priority requirement 11.2.1 11.3.0
06-2012 CP-56 CP-120302 2172 1 Back-off timer handling in connected mode mobility/GERAN 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2174 1 Correction on behavior of MS configured for AC 11-15 11.2.1 11.3.0
06-2012 CP-56 CP-120315 2175 2 Handling of NAS signalling low priority overriding indication 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2176 1 New SM cause codes 11.2.1 11.3.0
06-2012 CP-56 CP-120308 2178 1 Capability indication for Immediate Packet Assignment 11.2.1 11.3.0
06-2012 CP-56 CP-120317 2147 2 Providing UE’s PS Domain Registration Info to MSC for rSRVCC 11.2.1 11.3.0
06-2012 CP-56 CP-120313 2119 2 Outstanding NAS Modifications as a result of vSRVCC handover 11.2.1 11.3.0
09-2012 CP-57 CP-120593 2105 5 Security context mapping for SRVCC from CS to PS 11.3.0 11.4.0
09-2012 CP-57 CP-120589 2164 4 Posibility to ignore paging for non-GPRS services 11.3.0 11.4.0
09-2012 CP-57 CP-120594 2165 2 CKSN allocation for idle mode inter-system change 11.3.0 11.4.0
09-2012 Correction and completion of handling of the maximum number

CP-57 CP-120594 2179 2 of active PDP contexts 11.3.0 11.4.0
09-2012 CP-57 CP-120594 2180 1 Clearing of the maximum number of active PDP contexts 11.3.0 11.4.0
09-2012 CP-57 CP-120584 2183 1 Corrections to Gs Support for MSC in Pool 11.3.0 11.4.0
09-2012 CP-57 CP-120589 2188 4 Additional condition for attach exceptions 11.3.0 11.4.0
09-2012 RAU/combined RAU after E-UTRAN/UTRAN to GERAN Inter

CP-57 CP-120594 2192 1 RAT handover 11.3.0 11.4.0
09-2012 CP-57 CP-120584 2193 1 Considering ePLMN for SM backoff Timer with cause #50 or #51 11.3.0 11.4.0
09-2012 CP-57 CP-120585 2196 2 Skip Indicator for GERAN sharing 11.3.0 11.4.0
09-2012 CP-57 CP-120581 2198 2 Clarify MS behaviour after deletion of forbidden lists 11.3.0 11.4.0
09-2012 CP-57 CP-120594 2199 2 Setting method of EMM combined procedure capability bit 11.3.0 11.4.0
09-2012 CP-57 CP-120589 2203 2 CS congestion control handling for combined procedure 11.3.0 11.4.0
09-2012 CP-57 CP-120581 2206 2 Handling of MM procedure during combined RAU procedure 11.3.0 11.4.0
09-2012 CP-57 CP-120584 2207 Correcting error introduced by C1-122339 11.3.0 11.4.0
09-2012 CP-57 CP-120572 2211 1 IMSI detach triggered by last PDP context deactivation 11.3.0 11.4.0
09-2012 CP-57 CP-120589 2213 5 Handling of PDN connection for dual-priority functionality 11.3.0 11.4.0
ETSI
Release 18 819 3GPP TS 24.008 V18.4.0 (2023-09)
09-2012 CP-57 CP-120589 2214 3 Correction on handling of SM NAS request for dual-priority 11.3.0 11.4.0
09-2012 CP-57 CP-120589 2215 1 Correction on handling of SM back-off timer for dual-priority 11.3.0 11.4.0
09-2012 CP-57 CP-120589 2216 Dual priority definition 11.3.0 11.4.0
09-2012 Clarifications for user connection attachment for vSRVCC –

CP-57 CP-120587 2218 3 removal of editor’s note 11.3.0 11.4.0
09-2012 Low Priority Indicator vs NAS Signalling Low Priority Indication

CP-57 CP-120584 2219 Terminology 11.3.0 11.4.0
09-2012 CP-57 CP-120584 2221 2 Removing NMO-III 11.3.0 11.4.0
09-2012 CP-57 CP-120584 2222 1 Changes to the security context handling at power on 11.3.0 11.4.0
09-2012 CP-57 CP-120589 2227 2 UE configured for "Override_ExtendedAccessBarring" 11.3.0 11.4.0
09-2012 Clarifying in GMM substates ATTEMPTING-TO-ATTACH and

ATTEMPTING-TO-UPDATE, CM layer triggered GMM message
CP-57 CP-120584 2228 1 will be sent if T3346 is not running 11.3.0 11.4.0
09-2012 Correct the requirement on QoS modification of default PDP

CP-57 CP-120594 2229 1 context 11.3.0 11.4.0
09-2012 Remove the "combined routing area update procedure" in CSFB

CP-57 CP-120594 2230 1 mobile terminating call 11.3.0 11.4.0
09-2012 CP-57 CP-120584 2234 Correction of device properties in cause mapping 11.3.0 11.4.0
09-2012 CP-57 CP-120584 2239 2 Clarification on description of SMS over GPRS 11.3.0 11.4.0
09-2012 CP-57 CP-120589 2240 Correction on NAS signalling low priority overriding handling 11.3.0 11.4.0
12-2012 Cause code setting for combined procedures in case of PS-only

CP-58 CP-120803 2187 8 subscription 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2225 4 Detecting a request for emergency service 11.4.0 11.5.0
12-2012 Addtion of a trigger condition of a MS to enter EMM-

CP-58 CP-120794 2235 2 DEREGISTERED state 11.4.0 11.5.0
12-2012 Coordination between EMM and GMM parameters for MS

CP-58 CP-120794 2236 2 receiving GMM cause #22 11.4.0 11.5.0
12-2012 Fixes to P-CSCF addresses and DNS Server IP addresses

CP-58 CP-120794 2241 2 included in the PCO 11.4.0 11.5.0
12-2012 CP-58 CP-120807 2243 2 T3212 trigger in network initiated GPRS detach 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2244 2 Emergency handling for abnormal cases 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2245 GMM state correction for network initiated GPRS detach 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2246 Correction on NRI container IE 11.4.0 11.5.0
12-2012 CP-58 CP-120807 2250 1 Fix timer specification 11.4.0 11.5.0
12-2012 CP-58 CP-120803 2251 1 Corrections for Dual priority PDP contex handling 11.4.0 11.5.0
12-2012 CP-58 CP-120792 2253 1 TI flassignment in an originating call case 11.4.0 11.5.0
12-2012 Correction to Combined Attach/RAU Accept abnormal case

CP-58 CP-120794 2254 2 handling 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2263 Correcting description of MM update status U2 11.4.0 11.5.0
12-2012 CP-58 CP-120797 2264 2 Encoding the Skip Indicator for GERAN Network Sharing 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2265 6 Network behavior in case of PDP Context Activation Procedure 11.4.0 11.5.0
12-2012 CP-58 CP-120803 2266 4 MS knowledge that the back-off timer is running for low or 11.4.0 11.5.0
ETSI
Release 18 820 3GPP TS 24.008 V18.4.0 (2023-09)
normal priority
12-2012 CP-58 CP-120794 2268 7 Handling maximum number of active PDP contexts 11.4.0 11.5.0
12-2012 CP-58 CP-120798 2270 2 Access class control in shared networks 11.4.0 11.5.0
12-2012 CP-58 CP-120797 2271 1 GERAN network sharing in PS domain 11.4.0 11.5.0
12-2012 CP-58 CP-120797 2272 1 Terminology consistency for GERAN network sharing 11.4.0 11.5.0
12-2012 CP-58 CP-120803 2273 4 Clarification on handling of SM for dual priority 11.4.0 11.5.0
12-2012 CP-58 CP-120792 2275 4 Corrections to UE behaviour on originating aSRVCC call 11.4.0 11.5.0
12-2012 Clarification on UE with T3396 running receiving a new T3396

CP-58 CP-120803 2276 2 value 11.4.0 11.5.0
12-2012 MM state when GPRS service only is accepted in combined

CP-58 CP-120794 2277 1 procedures 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2286 1 Correction to the timer table 11.2.3 11.4.0 11.5.0
12-2012 Correction to session management handling for MBMS context

CP-58 CP-120789 2291 activation 11.4.0 11.5.0
12-2012 CP-58 CP-120803 2293 2 Handling of timer T3396 for dual priority MS 11.4.0 11.5.0
12-2012 CP-58 CP-120806 2295 1 Removing UTRA to UTRA rSRVCC 11.4.0 11.5.0
12-2012 MS behaviour when receiving mobile identity during periodic

CP-58 CP-120794 2296 1 RAU 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2297 2 Reject cause #8 used for normal RAU and SR 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2298 Clean-up the confusion on term "network sharing" 11.4.0 11.5.0
12-2012 NW-initiated detach with re-attach not required and no cause

CP-58 CP-120794 2299 2 code 11.4.0 11.5.0
12-2012 Correction on handling for attach and NW initiated detach

CP-58 CP-120794 2300 1 procedure collision 11.4.0 11.5.0
12-2012 CP-58 CP-120794 2301 Bullet correction 11.4.0 11.5.0
12-2012 Removing LAU trigger and combined RAU trigger for TIN="RAT-
CP-58 CP-120817 2255 3 related TMSI" 11.5.0 12.0.0
03-2013 CP-59 CP-130129 2304 1 Correction of the use of RRC establishment cause 12.0.0 12.1.0
03-2013 Correction and cleanup of maximum number of context

CP-59 CP-130115 2306 2 procedures 12.0.0 12.1.0
03-2013 CP-59 CP-130187 2307 6 LU after intersystem change from S1 12.0.0 12.1.0
03-2013 CP-59 CP-130129 2308 1 Spelling of mobile reachable timer 12.0.0 12.1.0
03-2013 CP-59 CP-130108 2310 Correction of reference to 29.272 12.0.0 12.1.0
03-2013 Corrections for attachment of user connection in "call delivered"

CP-59 CP-130103 2313 2 state for SRVCC. 12.0.0 12.1.0
03-2013 CP-59 CP-130124 2314 2 Addition of SRVCC in the pre-alerting (before ringing) phase. 12.0.0 12.1.0
03-2013 CP-59 CP-130125 2315 2 LAU trigger for the case the MS is in 2G/3G when T3423 expires 12.0.0 12.1.0
03-2013 CP-59 CP-130125 2316 3 Correction to ISR handling during PS handover 12.0.0 12.1.0
03-2013 CP-59 CP-130189 2330 4 Specification of value of timer T322 12.0.0 12.1.0
03-2013 CP-59 CP-130184 2331 1 Clarification to timer T3312 in the time timer table 12.0.0 12.1.0
03-2013 CP-59 CP-130129 2335 1 Abnormal case handling when in NMOII LAU/RAU fails but 12.0.0 12.1.0
ETSI
Release 18 821 3GPP TS 24.008 V18.4.0 (2023-09)
RAU/LAU succeeds
03-2013 CP-59 CP-130129 2336 2 GPRS MS in NMO I and the ATT flag 12.0.0 12.1.0
03-2013 CP-59 CP-130129 2338 1 Stopping T3340 when radio bearers are established 12.0.0 12.1.0
03-2013 CP-59 CP-130129 2339 1 Correction to the ATT flag description 12.0.0 12.1.0
03-2013 CP-59 CP-130112 2341 2 Mobile CS to PS SRVCC capability 12.0.0 12.1.0
06-2013 Performing Emergency Attach from Attempting to Attach/Update

CP-60 CP-130264 2329 3 substates 12.1.0 12.2.0
06-2013 Correct the requests from CM layers for combined attach/RAU

CP-60 CP-130264 2334 4 trigger 12.1.0 12.2.0
06-2013 CP-60 CP-130255 2343 1 MS Network Sharing capability 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2345 Corrections to spelling of implicit detach timer 12.1.0 12.2.0
06-2013 Introduction of additional Cause Codes as triggers for redirection

CP-60 CP-130250 2347 2 for MOCN. 12.1.0 12.2.0
06-2013 Setting of Device properties IE by NAS for MSs allowed to use

CP-60 CP-130264 2350 2 AC 11 to 15 12.1.0 12.2.0
06-2013 CP-60 CP-130250 2352 2 Prohibited usage of GEA1 by SA3 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2353 1 Correction to T3321 in timer tables 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2354 1 Clarifications on terminology of last PDP context 12.1.0 12.2.0
06-2013 Modification of Cause #65 to not include consideration for

CP-60 CP-130264 2355 2 emergency PDP contexts. 12.1.0 12.2.0
06-2013 Correction to the exception of not stopping T3396 for dual-

CP-60 CP-130244 2358 priority MS 12.1.0 12.2.0
06-2013 Limit the emergency services to UTRAN Iu mode for service

CP-60 CP-130264 2361 request procedure 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2362 3 GERAN Iu mode 12.1.0 12.2.0
06-2013 CP-60 CP-130267 2363 1 Terminology for SIPTO at the local network 12.1.0 12.2.0
06-2013 Updates to GMM and SM procedures because of SIPTO at the

CP-60 CP-130267 2364 2 local network 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2380 2 Clarifications of RAU following SRVCC handover 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2381 4 Coordination between SM and GMM for supporting ISR 12.1.0 12.2.0
06-2013 Correction on encoding for Quality of Service information

CP-60 CP-130264 2383 2 element 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2384 1 Non-GPRS update triggered during periodic routing area update 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2386 2 Clarification to the attach attempt counter 12.1.0 12.2.0
06-2013 MS behaviour on cause #25 in messages that are NOT integrity

CP-60 CP-130264 2387 2 protected 12.1.0 12.2.0
06-2013 Updating forbidden lists during RAU for a MS with emergency

CP-60 CP-130264 2388 bearers 12.1.0 12.2.0
06-2013 CP-60 CP-130264 2390 Addition of T3302 timer handling 12.1.0 12.2.0
09-2013 CP-61 CP-130510 2392 Correction of conditions brought about by approval of C1-132663 12.2.0 12.3.0
09-2013 CP-61 CP-130510 2393 1 Addition of cause #25 to "abnormal cases in the MS" 12.2.0 12.3.0
09-2013 CP-61 CP-130510 2403 2 Correction on encoding for Quality of Service information 12.2.0 12.3.0
ETSI
Release 18 822 3GPP TS 24.008 V18.4.0 (2023-09)
element
09-2013 Including the last used LTE PLMN ID in the EPLMN list for CSFB
CP-61 CP-130498 2407 3 return 12.2.0 12.3.0
09-2013 CP-61 CP-130510 2409 1 Non-GPRS update triggered during periodic routing area update 12.2.0 12.3.0
09-2013 CP-61 CP-130510 2413 1 Conditions when T3346 is not running 12.2.0 12.3.0
09-2013 CP-61 CP-130510 2416 1 MS Class Mark3 Table numbering 12.2.0 12.3.0
09-2013 Service request procedure for SIPTO at the local network with
CP-61 CP-130514 2420 1 stand-alone GW 12.2.0 12.3.0
09-2013 CP-61 CP-130514 2422 1 Local home network identifier 12.2.0 12.3.0
09-2013 Allow access to CS Services for AC 11-15 when timer T3246 is

CP-61 CP-130499 2429 3 running 12.2.0 12.3.0
09-2013 CP-61 CP-130494 2434 2 Reset LAU Counter 12.2.0 12.3.0
09-2013 Remove mention of starting T3246 when noT3246 timeout value

CP-61 CP-130510 2437 1 was provided by the network 12.2.0 12.3.0
09-2013 Suitable cell search when the MS receives a reject cause code
CP-61 CP-130510 2439 1 #15 or #25 12.2.0 12.3.0
09-2013 CP-61 CP-130510 2442 1 MS behavior for MS abnormal case in RAU procedure 12.2.0 12.3.0
12-2013 CP-62 CP-130737 2324 3 Correction of Back-off timer handling for GERAN 12.3.0 12.4.0
12-2013 MS-originated detach procedure during attach and routing area

CP-62 CP-130762 2411 3 updating procedures 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2415 3 Deletion of the ePLMNs list upon receipt of #9, #10 or #40 12.3.0 12.4.0
12-2013 Correcting trigger for completion of CM Service Request

CP-62 CP-130762 2421 2 procedure 12.3.0 12.4.0
12-2013 CP-62 CP-130737 2425 2 MS's inconsistent behaviour when PS back-off timer is running 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2448 2 SM cause #50,51,52 handling at the MS 12.3.0 12.4.0
12-2013 Detect that SIPTO@LN PDN connection involves a stand-alone

CP-62 CP-130769 2449 2 GW after during inter-SGSN HO 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2456 P-TMSI handling in Network abnormal case in attach procedure 12.3.0 12.4.0
12-2013 Stop ongoing user data transmission for MS abnormal case in

CP-62 CP-130762 2457 RAU procedure 12.3.0 12.4.0
12-2013 Correction of condition for including an IMEI in the Attach

CP-62 CP-130762 2463 Request 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2465 1 Clarification of PDP context modification 12.3.0 12.4.0
12-2013 PS signalling connection release with "follow-on proceed" and no

CP-62 CP-130762 2466 4 service request pending 12.3.0 12.4.0
12-2013 CP-62 CP-130760 2468 1 Introduction of VAMOS III Capability Indicator 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2469 1 TCRT: Introduction of ER-GSM band 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2470 Reference Corrections for TS 24.008 12.3.0 12.4.0
12-2013 CP-62 CP-130745 2472 1 MS Wideband RSRQ Measurement capability 12.3.0 12.4.0
12-2013 Handling of Mobile Identity, old RAI and P-TMSI signature for
CP-62 CP-130738 2476 1 combined Attach 12.3.0 12.4.0
12-2013 Clarification to the periodic RAU procedure when rejected with

CP-62 CP-130762 2477 2 GMM cause #10 12.3.0 12.4.0
ETSI
Release 18 823 3GPP TS 24.008 V18.4.0 (2023-09)
12-2013 CP-62 CP-130762 2479 1 Syntactic rules in comments in the MS RAC IE 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2480 GERAN Iu mode correction 12.3.0 12.4.0
12-2013 CP-62 CP-130745 2482 2 Cases of #17 to trigger redirection 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2485 1 Paging response when running T3346 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2486 2 Requirement for resetting the RAU attempt counter 12.3.0 12.4.0
12-2013 MS behavior in state GMM-REGISTERED.ATTEMPTING-TO-

CP-62 CP-130762 2487 UPDATE 12.3.0 12.4.0
12-2013 CP-62 CP-130769 2491 Update of PDP context activation for SIPTO at the local network 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2492 Correction on a normal RAU trigger 12.3.0 12.4.0
12-2013 Cleanup of duplicate requirements, message and procedure

CP-62 CP-130762 2494 2 names 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2495 1 Clarification of requirements for MSs configured for dual priority 12.3.0 12.4.0
12-2013 CP-62 CP-130754 2499 2 Clarification for T3323 start condition 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2500 Clarification on handling of timer T3396 12.3.0 12.4.0
12-2013 CP-62 CP-130762 2502 1 Reset of location update attempt counter 12.3.0 12.4.0
12-2013 CP-62 CP-130769 2382 4 ISR handling for SIPTO at the local network 12.3.0 12.4.0
12-2013 Update of ePLMN list for an MS with a PDN connection for

CP-62 CP-130813 2412 4 emergency bearer services 12.3.0 12.4.0
03-2014 CP-63 CP-140127 2462 7 Selective RAU when ISR is activated 12.4.0 12.5.0
03-2014 CP-63 CP-140134 2484 5 TMSI handling during routing area update procedures 12.4.0 12.5.0
03-2014 CP-63 CP-140142 2488 3 Handling Service Request failure due to timeout 12.4.0 12.5.0
03-2014 CP-63 CP-140144 2496 3 Conditions to ignore paging for non-GPRS services 12.4.0 12.5.0
03-2014 Emergency Attach in the network not supporting IMS emergency

CP-63 CP-140144 2510 3 call for limited service state 12.4.0 12.5.0
03-2014 Disabling the request for E-UTRAN inter RAT handover

CP-63 CP-140134 2515 2 information 12.4.0 12.5.0
03-2014 Minimum UE capability requirements for an MS to support CS to

CP-63 CP-140134 2517 PS SRVCC from GERAN to E-UTRAN 12.4.0 12.5.0
03-2014 CP-63 CP-140144 2520 2 Missing condition for cause of start of T3302 12.4.0 12.5.0
03-2014 CP-63 CP-140144 2523 1 Clarification on T3396 stopping conditions 12.4.0 12.5.0
03-2014 CP-63 CP-140135 2524 1 Removing redundant SIPTO@LN procedures 12.4.0 12.5.0
03-2014 CP-63 CP-140135 2525 1 Aligning SIPTO@LN IE name with IE name used in TS 25.413 12.4.0 12.5.0
03-2014 CP-63 CP-140136 2527 3 Introduction of UE power saving mode 12.4.0 12.5.0
03-2014 Correction of term 'GMM-CONNECTED mode’ to 'PMM-

CP-63 CP-140141 2531 1 CONNECTED’ mode’ 12.4.0 12.5.0
03-2014 CP-63 CP-140144 2535 Handling of T3246 and T3346 when the MS is switched off 12.4.0 12.5.0
03-2014 CP-63 CP-140200 2538 2 RRC Establishment Cause for RAU procedure 12.4.0 12.5.0
06-2014 Continuation of EAB override for requests on a PDN connection

CP-64 CP-140310 2490 5 established with EAB override. 12.5.0 12.6.0
06-2014 Conditions for performing RAU for MS configured with Dual

CP-64 CP-140331 2497 4 Priority 12.5.0 12.6.0
ETSI
Release 18 824 3GPP TS 24.008 V18.4.0 (2023-09)
06-2014 CP-64 CP-140459 2505 9 TFT filter settings 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2508 3 Cases of #17 to trigger redirection 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2546 3 T3346 and T3312 correction 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2547 1 Capability indicator for MFBI-support 12.5.0 12.6.0
06-2014 Setting "Call in MPTY" MPTY auxiliary state after access transfer
CP-64 CP-140331 2548 1 of a conference call 12.5.0 12.6.0
06-2014 Correction of wrong action and reference to procedure when

CP-64 CP-140311 2550 handling reject cause #8 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2552 2 Disable E-UTRA capability for GPRS only detach 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2553 2 New RAU trigger for PMM mode re-synchronization 12.5.0 12.6.0
06-2014 Handling of Abnormal Cases related to Emergency PDP

CP-64 CP-140331 2555 5 Activation Request Procedure 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2556 1 PS signaling connection release 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2557 Implicit detach cause value used for P-RAU 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2558 A missed handling for a non-semantical mandatory IE error 12.5.0 12.6.0
06-2014 CP-64 CP-140447 2559 3 Correction to TFT checks 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2560 6 Correction to packet filters 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2563 3 Timer T3324 expiry 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2564 2 Power saving mode activation 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2565 3 Editorials on power saving mode 12.5.0 12.6.0
06-2014 CP-64 CP-140329 2566 1 Correction to Service Request procedure 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2543 7 BCM handling in NW init procedures 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2567 1 TMSI reallocation – abnormal cases in the MS 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2568 2 Corrections for newly introduced PSM 12.5.0 12.6.0
06-2014 Handling of Service request procedure for emergency bearer

CP-64 CP-140329 2569 3 services. 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2572 2 No data transmission when PSM is activated 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2573 2 PSM not applying for MS with emergency bearer service 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2576 3 Start T3340 for cause values #7 and #8 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2577 2 TMSI reallocation – abnormal cases in the network side 12.5.0 12.6.0
06-2014 Removing editor's note on handling ongoing signalling when a

CP-64 CP-140308 2579 CS to PS handover occurs 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2581 1 Paging at GERAN stops T3246 12.5.0 12.6.0
06-2014 Correcting inconsistent text - CR2415r3 based on unofficial

CP-64 CP-140331 2582 1 version of 24.008 v12.3.0 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2584 1 Correction of selective RAU if PS back-off timer is running 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2608 5 The set of mobile reachable timer considering PSM 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2609 2 Correction for attempt counter 12.5.0 12.6.0
06-2014 Clarification of for how long the MS remembers selected

CP-64 CP-140331 2589 1 ciphering algorithm 12.5.0 12.6.0
ETSI
Release 18 825 3GPP TS 24.008 V18.4.0 (2023-09)
06-2014 CP-64 CP-140331 2590 2 Emergency call clarifications 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2591 1 ISR should be activated in the UE when T3412 is deactivated. 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2592 2 Clarifications on emergency attach and PSM 12.5.0 12.6.0
06-2014 CP-64 CP-140328 2596 1 RAU trigger with RRC connection failure 12.5.0 12.6.0
06-2014 CP-64 CP-140331 2597 1 Name alignment on LOCATION UPDATING ACCEPT message 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2601 1 T3324 value set to zero 12.5.0 12.6.0
06-2014 Mapping between the RAU procedure and the RRC

CP-64 CP-140331 2604 1 establishment cause 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2605 2 ISR deactivation for Power Saving Mode 12.5.0 12.6.0
06-2014 CP-64 CP-140323 2606 Corrections to UE power saving mode 12.5.0 12.6.0
09-2014 CP-65 CP-140664 2583 4 Stopping T3412 for RAU ACCEPT (ISR not activated) 12.6.0 12.7.0
09-2014 CP-65 CP-140640 2595 4 Correction on handling of cause #27 (missing or unknown APN) 12.6.0 12.7.0
09-2014 CP-65 CP-140664 2612 1 Setting TIN to P-TMSI if RAU is done to update DRX parameters 12.6.0 12.7.0
09-2014 CP-65 CP-140660 2613 3 PCO parameters for P-CSCF restoration support 12.6.0 12.7.0
09-2014 CP-65 CP-140664 2615 Clarification of actions for MS in LIMITED SERVICE state 12.6.0 12.7.0
09-2014 Avoiding failure of LCS/RRLP Procedure due to CM SERVICE

CP-65 CP-140664 2616 1 ABORT procedure. 12.6.0 12.7.0
09-2014 PS signalling connection release in order to perform PLMN

CP-65 CP-140664 2617 2 search. 12.6.0 12.7.0
09-2014 CP-65 CP-140572 2618 2 Service request counter for AC 11-15 UEs 12.6.0 12.7.0
09-2014 CP-65 CP-140664 2619 1 TMSI handling in the combined attach procedure 12.6.0 12.7.0
09-2014 CP-65 CP-140664 2624 1 Editorial Corrections 12.6.0 12.7.0
09-2014 CP-65 CP-140657 2625 3 Optimization for PSM 12.6.0 12.7.0
09-2014 CP-65 CP-140664 2628 Stop NAS retry timer upon receipt of EWT from AS 12.6.0 12.7.0
09-2014 CP-65 CP-140664 2629 Correction for location update attempt counter 12.6.0 12.7.0
09-2014 CP-65 CP-140647 2630 1 Introduction of Downlink Multi-Carrier 12.6.0 12.7.0
09-2014 CP-65 CP-140657 2631 Correction on the implicit detach timer set 12.6.0 12.7.0
09-2014 CP-65 CP-140657 2632 Correction on the Periodic RA update timer IE 12.6.0 12.7.0
09-2014 CP-65 CP-140657 2634 1 MS network feature support usage with PSM 12.6.0 12.7.0
09-2014 CP-65 CP-140643 2637 1 Correction to EAB override 12.6.0 12.7.0
09-2014 Disabling the request for E-UTRAN inter RAT handover

CP-65 CP-140644 2639 information 12.6.0 12.7.0
09-2014 CP-65 CP-140664 2640 1 Editorial on secondary PDP context activation procedure 12.6.0 12.7.0
09-2014 CP-65 CP-140661 2641 2 Local IP address and mask 12.6.0 12.7.0
09-2014 Adding an indication of WLAN offloading permission to the MS

CP-65 CP-140670 2643 2 per activated context 12.6.0 12.7.0
09-2014 CP-65 CP-140724 2635 1 Correction to P-TMSI reallocation – abnormal cases 12.6.0 12.7.0
12-2014 Request for emergency services allowed even if back-off timer

CP-66 CP-140836 2627 4 running 12.7.0 12.8.0
ETSI
Release 18 826 3GPP TS 24.008 V18.4.0 (2023-09)
12-2014 CP-66 CP-140854 2645 6 Enable per RAN indication of WLAN offloading permission 12.7.0 12.8.0
12-2014 Correction of typo in the term " MS configured to use AC11 – 15

CP-66 CP-140836 2650 in selected PLMN" 12.7.0 12.8.0
12-2014 CP-66 CP-140854 2651 3 Handling of WLAN offload indication from the SGSN 12.7.0 12.8.0
12-2014 CP-66 CP-140836 2652 1 Correction of wrong reference to "MM cause" 12.7.0 12.8.0
12-2014 CP-66 CP-140843 2657 Implicit detach timer setting for PSM MS 12.7.0 12.8.0
12-2014 CP-66 CP-140836 2666 1 Reference correction 12.7.0 12.8.0
12-2014 Stopping wrong timer in Combined routing area updating

CP-66 CP-140824 2668 procedure 12.7.0 12.8.0
12-2014 CP-66 CP-140846 2669 4 Trigger to re-initiate service request procedure. 12.7.0 12.8.0
12-2014 CP-66 CP-140854 2672 SGSN initiating SM procedure 12.7.0 12.8.0
12-2014 CP-66 CP-140836 2674 1 Abnormal case in the MS during P-TMSI reallocation procedure 12.7.0 12.8.0
12-2014 CP-66 CP-140836 2677 Setting the values of MRT and IDT in the SGSN 12.7.0 12.8.0
12-2014 CP-66 CP-140836 2678 1 PDP context handling upon inter-system change 12.7.0 12.8.0
12-2014 CP-66 CP-140824 2682 3 Conditions to stop the APN based timer 12.7.0 12.8.0
12-2014 Clarification on GMM/MM Procedure Timer handling during

CP-66 CP-140836 2686 1 network authentication failure while an emergency call is active 12.7.0 12.8.0
12-2014 CP-66 CP-140854 2687 6 Add WLAN offload indication to NAS 12.7.0 12.8.0
12-2014 "old" P-TMSI for the case of multiple P-TMSI REALLOCATION

CP-66 CP-140836 2688 2 COMMAND messages 12.7.0 12.8.0
12-2014 CP-66 CP-140843 2689 2 Condition for including the T3324 IE 12.7.0 12.8.0
12-2014 CP-66 CP-140843 2691 5 Trigger to RAU procedure 12.7.0 12.8.0
12-2014 CP-66 CP-140836 2697 1 Correction for handling of NAS signaling low priority indication 12.7.0 12.8.0
12-2014 CP-66 CP-140836 2698 Amendment to T3340 starting cause 12.7.0 12.8.0
12-2014 CP-66 CP-140854 2671 1 Add WLAN offload indication to NAS 12.7.0 12.8.0
12-2014 CP-66 CP-140992 2655 9 Handling secondary PDP context without a TFT 12.7.0 12.8.0
12-2014 T3230 timer handling in case of CM SERVICE ABORT

CP-66 CP-140858 2646 1 procedure. 12.8.0 13.0.0
12-2014 CP-66 CP-140858 2653 1 Removal of text on static PDP address usage and detection 12.8.0 13.0.0
12-2014 Removal of GPRS update status in sub-states NORMAL-

CP-66 CP-140858 2673 1 SERVICE and LIMITED-SERVICE of GMM-DEREGISTERED 12.8.0 13.0.0
12-2014 CP-66 CP-140858 2675 2 Update to P-TMSI reallocation procedure 12.8.0 13.0.0
12-2014 CP-66 CP-140858 2685 Corection of CS/PS mode of operation 12.8.0 13.0.0
12-2014 CP-66 CP-140858 2690 1 Editorials on PSM 12.8.0 13.0.0
03-2015 CP-67 CP-150077 2703 2 Initiating a location update in unsuccessful and abnormal cases 13.0.0 13.1.0
03-2015 CP-67 CP-150083 2704 1 Initiating a location update in additional unsuccessful cases 13.0.0 13.1.0
03-2015 Correction of periodic RAU for an MS attached for GPRS and

CP-67 CP-150083 2705 1 non-GPRS services 13.0.0 13.1.0
03-2015 CP-67 CP-150083 2706 1 Correction of MS reaction upon receipt of MM/GMM cause #25 13.0.0 13.1.0
03-2015 CP-67 CP-150070 2710 1 Introduction of extended TSC sets 13.0.0 13.1.0
ETSI
Release 18 827 3GPP TS 24.008 V18.4.0 (2023-09)
03-2015 CP-67 CP-150077 2712 1 Initiation of normal RAU due to CSFB 13.0.0 13.1.0
03-2015 Handling of Activate PDP context reject from the SGSN due to
CP-67 CP-150064 2714 2 APN based congestion control 13.0.0 13.1.0
03-2015 CP-67 CP-150064 2716 1 Correction on SM congestion control handling 13.0.0 13.1.0
03-2015 CP-67 CP-150069 2718 4 MS data retry handling for SM procedures 13.0.0 13.1.0
03-2015 CP-67 CP-150083 2719 2 Failure of LCS/RRLP procedures due to CM SERVICE ABORT 13.0.0 13.1.0
03-2015 CP-67 CP-150054 2722 Stopping T3396 for Unsuccessful MBMS context activation 13.0.0 13.1.0
03-2015 CP-67 CP-150075 2724 2 Clarification on WLAN offload indication 13.0.0 13.1.0
03-2015 CP-67 CP-150083 2728 1 Clarification to the Mobile Reachable Timer in timer table. 13.0.0 13.1.0
03-2015 CP-67 CP-150064 2737 1 Correction of TFT checks for secondary PDP contexts 13.0.0 13.1.0
03-2015 CP-67 CP-150083 2732 1 Conditions to reset the location update attempt counter 13.0.0 13.1.0
03-2015 CP-67 CP-150192 2727 3 Unsuccessful PDP context activation with #50 or #51 13.0.0 13.1.0
03-2015 Correcting SM re-activation attempts at PLMN change when only

CP-67 CP-150203 2711 5 one IP version is supported by the network. 13.0.0 13.1.0
06-2015 CP-68 CP-150315 2740 4 Correction of UE retry behaviour after rejection by the network 13.1.0 13.2.0
06-2015 CP-68 CP-150303 2743 2 Correction of TFT checks for secondary PDP contexts 13.1.0 13.2.0
06-2015 Initiating a location update upon receipt of RAU Reject with GMM
CP-68 CP-150323 2744 1 cause #10 13.1.0 13.2.0
06-2015 Handling of authentication timers after loss or release of

CP-68 CP-150329 2745 signalling connection 13.1.0 13.2.0
06-2015 Handling of access class barring when accessing the network for
CP-68 CP-150329 2746 1 emergency bearer sevices 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2747 Setting of the Device properties IE for CS emergency call 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2752 3 Correcting range from which a timer value for T3396 is drawn 13.1.0 13.2.0
06-2015 Clarifications on using PLMN Selector List after #14 "GPRS

CP-68 CP-150329 2753 1 services not allowed in this PLMN" for MS using SIM/USIM. 13.1.0 13.2.0
06-2015 CP-68 CP-150315 2755 Remove the note for SM cause value #27 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2757 1 Clarification on T3346 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2761 Correction on MS's behaviour for EWT from the lower layers 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2765 1 Handling of GMM cause code #10(implicitly detached) 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2766 1 Handling of timers T3245,T3246 and T3346 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2767 1 Handling of ESM cause value #50, #51 13.1.0 13.2.0
06-2015 Removal of dependency on GPRS update status from GMM-

CP-68 CP-150329 2768 DEREGISTERED.ATTEMPTING-TO-ATTACH 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2770 2 Clarification to respond to paging during congestion. 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2771 1 Clarification to allow IMSI Detach during congestion. 13.1.0 13.2.0
06-2015 Capability indicator for extended EARFCN value range in

CP-68 CP-150303 2776 7 GERAN 13.1.0 13.2.0
06-2015 Clarifications on EAB Override and Override Low Priority Access

CP-68 CP-150329 2778 1 Indicator 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2783 1 Clarification on TFT for abnormal cases of PDP Context 13.1.0 13.2.0
ETSI
Release 18 828 3GPP TS 24.008 V18.4.0 (2023-09)
modification
06-2015 CP-68 CP-150329 2785 Respond to paging with IMSI in Limited Service state 13.1.0 13.2.0
06-2015 Alignment of MS behaviour for EWT in Service Request

CP-68 CP-150329 2786 procedure 13.1.0 13.2.0
06-2015 CP-68 CP-150315 2789 2 MS back-off timer for GPRS session management rejections 13.1.0 13.2.0
06-2015 Removal of duplicate lines for RRC connection release

CP-68 CP-150329 2790 controlled by Timer T3240. 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2791 Aligning with SA2 requirement of NMO1 networks. 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2793 Timer table update for timer T3211 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2796 1 Stopping timer T3340 upon receiving downlink signalling 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2804 1 Clarifications on normal stop of timers T3246 and T3346 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2805 1 Correction of merged subclauses 13.1.0 13.2.0
06-2015 UE behaviour after SRVCC transfer of conference calls when

CP-68 CP-150329 2806 2 MSC does not support mid-call procedures 13.1.0 13.2.0
06-2015 CP-68 CP-150313 2782 2 Trigger to initate routeing area procedure (PSM) 13.1.0 13.2.0
06-2015 CP-68 CP-150329 2784 1 Enable ISR for Ps-only MS 13.1.0 13.2.0
06-2015 Updates to mobile reachable timer and network behaviour

CP-68 CP-150326 2800 3 because of MONTE 13.1.0 13.2.0
09-2015 Handling of Application specific Congestion control for Data

CP-69 CP-150534 2773 4 Communication (ACDC) 13.2.0 13.3.0
09-2015 Correction of the handling of the equivalent PLMN list after

CP-69 CP-150529 2777 2 location updating 13.2.0 13.3.0
09-2015 CP-69 CP-150526 2807 NBIFOM - Coding of NBIFOM PCO parameters 13.2.0 13.3.0
09-2015 CP-69 CP-150526 2808 2 NBIFOM - coding of Access usability 13.2.0 13.3.0
09-2015 CP-69 CP-150511 2813 Rollback of changes on reset attempt counters – 24.008 13.2.0 13.3.0
09-2015 CP-69 CP-150526 2816 2 NBIFOM - coding of RAN rules related indications 13.2.0 13.3.0
09-2015 CP-69 CP-150505 2819 Correction of SM cause for rejection of TFT operation 13.2.0 13.3.0
09-2015 Correction of criterion for clearing a maximum number of PDP

CP-69 CP-150529 2820 2 contexts 13.2.0 13.3.0
09-2015 Deactivation of PSM for MM and mobile originating CS

CP-69 CP-150529 2821 transactions 13.2.0 13.3.0
09-2015 CP-69 CP-150529 2822 2 Correction of criterion for stopping timers T3246 and T3346 13.2.0 13.3.0
09-2015 CP-69 CP-150516 2824 Removal of incorrect reference to PLMN selection 13.2.0 13.3.0
09-2015 CP-69 CP-150523 2825 2 Back-off timer mechanism for equivalent PLMNs 13.2.0 13.3.0
09-2015 CP-69 CP-150526 2832 1 Network-initiated IP flow mobility 13.2.0 13.3.0
09-2015 Correction of MS retry behaviour after rejection with #8, #27,

CP-69 CP-150523 2834 1 #32, #33 13.2.0 13.3.0
09-2015 MS-initiated detach for "switch off" and change of cell into a new
CP-69 CP-150529 2835 RAI 13.2.0 13.3.0
09-2015 Expiry of T3312 when the MS is attached for emergency bearer

CP-69 CP-150529 2836 1 services 13.2.0 13.3.0
09-2015 CP-69 CP-150529 2837 2 Clarification on the handling of the back-off timer when the MS is 13.2.0 13.3.0
ETSI
Release 18 829 3GPP TS 24.008 V18.4.0 (2023-09)
switched off
09-2015 CP-69 CP-150529 2839 Enhancement on NW initiated PDP context deactivation 13.2.0 13.3.0
09-2015 CP-69 CP-150529 2840 Handling of back-off timer at switch-on 13.2.0 13.3.0
09-2015 Delete the incorrect cause values in UE requested bearer

CP-69 CP-150585 2842 3 resource modification procedure 13.2.0 13.3.0
09-2015 CP-69 CP-150529 2844 Clarification to allow imsi detach only in registered area. 13.2.0 13.3.0
09-2015 CP-69 CP-150529 2845 Correction to reference 13.2.0 13.3.0
09-2015 CP-69 CP-150526 2831 1 UE-initiated IP flow mobility 13.2.0 13.3.0
09-2015 CP-69 CP-150536 2843 3 Introduction of extended idle mode DRX cycle 13.2.0 13.3.0
12-2015 Incorrect test condition on linkage of override EAB and override

CP-70 CP-150710 2811 3 NSLPI 13.3.0 13.4.0
12-2015 Define SM cause for the rejection of additional access to a PDN

CP-70 CP-150706 2848 1 connection 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2849 3 Alignment on NW initiated PDP context deactivation 13.3.0 13.4.0
12-2015 Addition of MS retry behaviour for MBMS session management

CP-70 CP-150702 2851 1 procedures 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2853 3 Signaling related to emergency bearer services 13.3.0 13.4.0
12-2015 CP-70 CP-150706 2854 1 Coding of NBIFOM container 13.3.0 13.4.0
12-2015 CP-70 CP-150713 2855 5 Extended DRX IE addition 13.3.0 13.4.0
12-2015 CP-70 CP-150713 2858 2 Extended DRX accepted by the network 13.3.0 13.4.0
12-2015 Inclusion of RAN rules and access usability IEs in NBIFOM

CP-70 CP-150706 2860 3 container 13.3.0 13.4.0
12-2015 Clarification while PLMN is in Forbidden PLMN for GPRS

CP-70 CP-150710 2864 2 Service List 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2865 1 Clarification for paging with P-TMSI 13.3.0 13.4.0
12-2015 CP-70 CP-150713 2866 3 Interaction between PSM and eDRX 13.3.0 13.4.0
12-2015 eDRX abbreviation, reference to TS 24.008 and some

CP-70 CP-150713 2867 3 corrections 13.3.0 13.4.0
12-2015 CP-70 CP-150713 2868 eDRX and emergency bearer services 13.3.0 13.4.0
12-2015 Lack of requirement on mandating repeating the request of

CP-70 CP-150713 2869 3 eDRX at RAU 13.3.0 13.4.0
12-2015 CP-70 CP-150713 2870 2 Support of eDRX in the MS 13.3.0 13.4.0
12-2015 Correction to the MS retry behaviour for PDP context activation

CP-70 CP-150702 2871 1 procedure 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2872 Void of unused reference 13.3.0 13.4.0
12-2015 CP-70 CP-150704 2873 2 Group specific congestion control 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2877 4 Clarification about timer T3245 usage 13.3.0 13.4.0
12-2015 Correction to MS-initiated secondary PDP context activation and

CP-70 CP-150702 2878 modification procedures after rejection with #32, #33 13.3.0 13.4.0
12-2015 CP-70 CP-150713 2879 use of the eDRX parameters provided by the network 13.3.0 13.4.0
12-2015 CP-70 CP-150713 2882 1 IMSI paging without eDRX parameters 13.3.0 13.4.0
ETSI
Release 18 830 3GPP TS 24.008 V18.4.0 (2023-09)
12-2015 Correction of MS-initiated detach request during routing area

CP-70 CP-150688 2885 2 updating procedure 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2886 T3245 timer range clarification 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2887 2 Correction to NOTE in Mobility Management timers – MS side 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2888 Clarification regarding update status in Legacy RAT 13.3.0 13.4.0
12-2015 CP-70 CP-150716 2891 Dedicated core networks 13.3.0 13.4.0
12-2015 CP-70 CP-150713 2892 1 Paging for an MS which the network accepted to use eDRX 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2893 Fixing underlined text 13.3.0 13.4.0
12-2015 CP-70 CP-150701 2894 P-CSCF Re-selection support over WLAN 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2895 3 Handling of back off timer T3346 and T3396 13.3.0 13.4.0
12-2015 CP-70 CP-150719 2897 1 ACDC handling for emergency call and IMS 13.3.0 13.4.0
12-2015 CP-70 CP-150719 2898 1 Handling of ACDC mechanism 13.3.0 13.4.0
12-2015 New time unit in GPRS Timer 3 IE in support of operations of

CP-70 CP-150710 2903 3 machine type devices 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2904 1 Incorrect reference about treating the active cell as barred 13.3.0 13.4.0
12-2015 CP-70 CP-150702 2905 Retry restriction for default APN 13.3.0 13.4.0
12-2015 CP-70 CP-150710 2906 Stop running T3423 13.3.0 13.4.0
03-2016 CP-71 CP-160069 2912 5 Handling of uncategorized app for ACDC 13.4.0 13.5.0
03-2016 CP-71 CP-160069 2913 ACDC applied to Iu mode only 13.4.0 13.5.0
03-2016 CP-71 CP-160072 2918 6 Paging handling for MSs using eDRX 13.4.0 13.5.0
03-2016 CP-71 CP-160085 2921 Correction on active timer in timer table 13.4.0 13.5.0
03-2016 CP-71 CP-160072 2923 1 Correction to Extended DRX parameters IE 13.4.0 13.5.0
03-2016 CP-71 CP-160072 2925 2 Handling when MS wants to disable eDRX 13.4.0 13.5.0
03-2016 Correction of handling NAS reject messages without integrity

CP-71 CP-160085 2927 6 protection 13.4.0 13.5.0
03-2016 CP-71 CP-160078 2929 NBIFOM mode for Network to MS direction 13.4.0 13.5.0
03-2016 CP-71 CP-160072 2930 Enabling eDRX when T3346 running 13.4.0 13.5.0
03-2016 CP-71 CP-160131 2931 2 PDP context deactivation without tear down indicator 13.4.0 13.5.0
03-2016 Correction of handling of timer T3346 and T3396 at detach

CP-71 CP-160085 2933 without switch-off 13.4.0 13.5.0
03-2016 CP-71 CP-160072 2936 Handling PRAU Accept without integrity protection. 13.4.0 13.5.0
03-2016 CP-71 CP-160085 2937 2 Naming service request guard timer 13.4.0 13.5.0
03-2016 CP-71 CP-160133 2938 2 eDRX cleanup 13.4.0 13.5.0
03-2016 CP-71 CP-160085 2940 1 Correction of SM Retry Timer to SM_RetryWaitTime 13.4.0 13.5.0
03-2016 CP-71 CP-160132 2945 Correction to T3250 in the Timer Table 13.4.0 13.5.0
06-2016 CP-72 CP-160312 2926 8 Use of eDRX in case of emergency bearer services 13.5.0 13.6.0
06-2016 CP-72 CP-160315 2932 5 Handling of T3396 for PDN connections established without APN 13.5.0 13.6.0
06-2016 CP-72 CP-160318 2944 5 Update of NAS timers to support extended coverage in GSM 13.5.0 13.6.0
ETSI
Release 18 831 3GPP TS 24.008 V18.4.0 (2023-09)
06-2016 Correction of the handing of the Re-attempt indicator IE for

CP-72 CP-160315 2946 cause #66 13.5.0 13.6.0
06-2016 Further corrections of handling of NAS reject messages without

CP-72 CP-160318 2947 integrity protection 13.5.0 13.6.0
06-2016 CP-72 CP-160312 2949 4 Addition of NB-IoT eDRX cycles 13.5.0 13.6.0
06-2016 CP-72 CP-160318 2952 1 Cleanup for NAS reject messages without Integrity protection 13.5.0 13.6.0
06-2016 CP-72 CP-160307 2954 1 Correction of ACDC handling for IMS service in UTRAN 13.5.0 13.6.0
06-2016 CP-72 CP-160312 2955 4 Addition of NB-IoT PTW periods 13.5.0 13.6.0
06-2016 CP-72 CP-160312 2956 1 Interaction between legacy DRX and eDRX 13.5.0 13.6.0
06-2016 Update to voice domain preference and UE's usage setting

CP-72 CP-160309 2958 1 conditions 13.5.0 13.6.0
06-2016 CP-72 CP-160318 2965 1 Handling of PLMN background scan timer during PSM 13.5.0 13.6.0
06-2016 CP-72 CP-160310 2968 1 Addition of integrity protection to GMM 13.5.0 13.6.0
06-2016 Local deactivation related to NBIFOM multi-access PDN

CP-72 CP-160325 2969 1 connection 13.5.0 13.6.0
06-2016 CP-72 CP-160325 2970 Delete the NBIFOM container IE 13.5.0 13.6.0
06-2016 CP-72 CP-160334 2973 1 CS domain congestion handling in Legacy. 13.5.0 13.6.0
06-2016 CP-72 CP-160309 2961 4 Link MTU for non-IP connection 13.5.0 13.6.0
06-2016 CP-72 CP-160309 2964 2 Addition of APN rate control parameters 13.5.0 13.6.0
06-2016 "Multiple accesses to a PDN connection not allowed" in NW-

CP-72 CP-160325 2967 1 initiated PDN disconnection procedure 13.5.0 13.6.0
06-2016 Correction of MS behaviour in substate ATTEMPTING-TO-

CP-72 CP-160331 2948 2 UPDATE 13.6.0 14.0.0
06-2016 CP-72 CP-160331 2953 Correction to back-off timer in SM timer table 13.6.0 14.0.0
06-2016 CP-72 CP-160331 2966 1 T3396 running due to the release message from network 13.6.0 14.0.0
06-2016 CP-72 CP-160330 2950 3 Addition of support for Non-IP data for EC-EGPRS 13.6.0 14.0.0
06-2016 CP-72 CP-160331 2971 1 Correction to the identification procedure 13.6.0 14.0.0
06-2016 CP-72 CP-160331 2972 1 Correction to the TMSI allocation procedure 13.6.0 14.0.0
ETSI
Release 18 832 3GPP TS 24.008 V18.4.0 (2023-09)
Change history
Date Meeting TDoc CR Rev Cat Subject/Comment New
version
2016-09 CT#73 CP-160492 2975 A Correction for non-supported eDRX values 14.1.0
2016-09 CT#73 CP-160491 2977 3 A Corrections to GPRS integrity protection in GSM 14.1.0
2016-09 CT#73 CP-160492 2980 A Wrong ordering of and repeated requirements on eDRX parameters 14.1.0
handling
2016-09 CT#73 CP-160491 2982 1 A Correction to IEI of Integrity protection algorithm 14.1.0
2016-09 CT#73 CP-160512 2985 1 B Support of SRVCC for eCall over IMS 14.1.0
2016-09 CT#73 CP-160510 2987 3 A Correction to GMM NAS timers for applying extension to support 14.1.0
CIoT_EC_GSM
2016-09 CT#73 CP-160486 2989 1 A Correction on eDRX values for NB-IoT 14.1.0
2016-09 CT#73 CP-160519 2990 1 F Correction on MS response to GMM common procedure 14.1.0
2016-09 CT#73 CP-160486 2992 1 A Correction to APN rate control 14.1.0
2016-09 CT#73 CP-160488 2994 1 A Introduction of (EC-)PCH monitoring support capability signalling in 14.1.0
MSRAC IE
2016-09 CT#73 CP-160563 2995 F Minor corrections for EC GPRS 14.1.0
2016-12 CT#74 CP-160798 2996 4 B Handover of emergency PDN connection from non-3GPP access to 14.2.0
3GPP access
2016-12 CT#74 CP-160753 2999 1 F Corrections to handling of non-integrity protected reject messages 14.2.0
2016-12 CT#74 CP-160753 3000 D Correcting other rate adaptation to other rate adaption 14.2.0
2016-12 CT#74 CP-160719 3002 A Correction of handling of PLMN-specific PS attempt counter 14.2.0
2016-12 CT#74 CP-160738 3003 2 B Addition of DCN ID handling for eDecor 14.2.0
2016-12 CT#74 CP-160725 3005 A Correction for GPRS integrity protection 14.2.0
2016-12 CT#74 CP-160725 3007 1 A Reset of IOV_Updates counter 14.2.0
2016-12 CT#74 CP-160745 3008 1 B Addition of Non-IP related cause values 14.2.0
2016-12 CT#74 CP-160738 3009 2 F DCN-ID in P-TMSI Reallocation Command Message 14.2.0
2016-12 CT#74 CP-160723 3011 A Correction of the remapping of unsupported eDRX timer values 14.2.0
2016-12 CT#74 CP-160753 3012 F 'Deactivated’ value in the T3412 extended value IE 14.2.0
2016-12 CT#74 CP-160753 3013 F Detach procedure triggered due to SIM/USIM removal 14.2.0
2016-12 CT#74 CP-160720 3015 A Alignment of MTU for CP user data 14.2.0
2016-12 CT#74 CP-160738 3016 1 B Trigger RAU at Default DCN-ID change 14.2.0
2016-12 CT#74 CP-160738 3017 2 B Addition of Iu mode DCN-ID provisioning 14.2.0
2016-12 CT#74 CP-160745 3018 F Normative handling on non-IP not supported for secondary PDP 14.2.0
context activation
2016-12 CT#74 CP-160738 3019 B Addition of PLMN ID of the selected CN operator handling for eDecor 14.2.0
2016-12 CT#74 CP-160719 3022 3 A Correction of handling of reject due to lack of subscription 14.2.0
2016-12 CT#74 CP-160719 3024 1 A Applicability of 2G GPRS integrity protection 14.2.0
2016-12 CT#74 CP-160810 3026 3 A Definition of value "0" of the TFT operation code in the traffic flow 14.2.0
template IE
2016-12 CT#74 CP-160718 3029 1 A Correction to cases which all PDP contexts to a given APN are 14.2.0
deactivated
2017-03 CT#75 CP-170136 2943 8 B DRVCC from WiFi to CS 14.3.0
2017-03 CT#75 CP-170129 3033 F Correction of cause value numbers for NonIP 14.3.0
2017-03 CT#75 CP-170121 3039 2 B Restriction of use of Coverage Enhancement 14.3.0
2017-03 CT#75 CP-170130 3040 7 B Introduction of 3GPP PS data off UE status and 3GPP PS data off 14.3.0
support indicator
2017-03 CT#75 CP-170119 3042 3 A Correction to the handling of non-integrity proctected reject 14.3.0
messages
2017-03 CT#75 CP-170129 3043 3 B Addition of ePCO for GPRS 14.3.0
2017-03 CT#75 CP-170122 3044 3 F Resolve DCN-ID length 14.3.0
2017-03 CT#75 CP-170119 3046 A Further corrections of handling of NAS reject messages without 14.3.0
integrity protection
2017-03 CT#75 CP-170136 3053 3 F (Sol A) Extended DRX parameters handling 14.3.0
2017-06 CT#76 CP-171089 3038 4 B Indicating policy related to emergency numbers/types received via 14.4.0
non-3GPP access
2017-06 CT#76 CP-171089 3056 3 B Emergency call detection when the UE is connected to both 3GPP 14.4.0
and WLAN access
2017-06 CT#76 CP-171084 3057 2 F Correction of ePCO for GPRS
2017-06 CT#76 CP-171073 3060 1 B Support for capability negotiation of reliable data service via PCO 14.4.0
2017-06 CT#76 CP-171092 3061 2 F Extend Call Disconnect cause with a new cause "Call completed 14.4.0
elsewhere"
2017-06 CT#76 CP-171073 3062 2 F MS support of restriction on enhanced coverage 14.4.0
2017-06 CT#76 CP-171092 3063 D Fixing figure and table labels 14.4.0
2017-06 CT#76 CP-171074 3064 1 B Addition of A/Gb mode DCN-ID provisioning 14.4.0
2017-06 CT#76 CP-171084 3065 F Correction to add SM #57 and SM#58 to SM cause IE 14.4.0
2017-06 CT#76 CP-171092 3067 1 F Correction on the length of Maximum uplink rate parameter 14.4.0
2017-06 CT#76 CP-171158 3069 4 A Further corrections to the handling of NAS reject messages without 14.4.0
integrity protection
2017-09 CT#77 CP-172111 3072 B Indicating, via LAU, policy related to emergency numbers/types 14.5.0
received via non-3GPP access
2017-09 CT#77 CP-172106 3073 F Correction of erroneous definition of extended protocol configuration 14.5.0
ETSI
Release 18 833 3GPP TS 24.008 V18.4.0 (2023-09)
options
ETSI
Release 18 834 3GPP TS 24.008 V18.4.0 (2023-09)
2017-09 CT#77 CP-172097 3074 F Correction of ill-defined condition "in GSM" 14.5.0
2017-09 CT#77 CP-172114 3075 2 F Extending time for sending DETACH REQUEST in EC GSM IoT 14.5.0
2017-09 CT#77 CP-172114 3076 1 B Introduction of Multilateration and indication of CC5 support 14.5.0
2017-09 CT#77 CP-172098 3080 1 F Handling of inter-RAT mobility for MS in eCall only mode capable of 14.5.0
eCall over IMS
2017-09 CT#77 CP-172114 3081 F Keep forbidden PLMN after receiving integrity protected MM/GMM 14.5.0
#11,14
2017-09 CT#77 CP-172087 3085 2 A Setting release of 3GPP TS 44.118 to Release 11 14.5.0
2017-09 CT#77 CP-172116 3070 2 F Extending maximum bitrate in QoS IE 15.0.0
2017-09 CT#77 CP-172116 3071 1 B Addition of MS NAS capability for support of dual connectivity with 15.0.0
NR
2017-09 CT#77 addition of missing IEI value 15.0.1
2017-12 CT#78 CP-173072 3086 F Handling of extended QoS IE 15.1.0
2017-12 CT#78 CP-173047 3087 1 A Correcting trigger for completion of CM Service Request procedure 15.1.0
2017-12 CT#78 CP-173078 3088 F Correction of the handling of counters for "SIM/USIM considered 15.1.0
invalid" events
2017-12 CT#78 CP-173045 3098 1 A Corrections to the eCall category bit usage 15.1.0
2017-12 CT#78 CP-173067 3100 A Correction to handling of non-integrity protected GMM #14 15.1.0
2017-12 CT#78 CP-173072 3101 2 B Extended Quality of Service IE applicability 15.1.0
2017-12 CT#78 CP-173078 3102 F Starting T3302 for NW initiated Deatch with no cause value and "re- 15.1.0
attach not required"
2017-12 CT#78 CP-173060 3104 1 A Enhancement of APN rate control for MO exception data 15.1.0
2017-12 CT#78 CP-173078 3105 F Correction to the handling of non-integrity protected reject messages 15.1.0
2017-12 CT#78 CP-173078 3106 F Correction to CC_U1_CALL_INIT State 15.1.0
2018-03 CT#79 CP-180081 3109 1 F Correction of references for Extended QoS IE 15.2.0
2018-03 CT#79 CP-180079 3111 B bSRVCC-MT NAS 15.2.0
2018-03 CT#79 CP-180089 3115 2 F Updating periodic RAU timer and PSM during service request 15.2.0
2018-03 CT#79 CP-180077 3116 4 B S-NSSAI of a PDN connection context vie (e)PCO 15.2.0
2018-03 CT#79 CP-180065 3118 2 A Correction of applicability of time value unit 110 in GPRS Timer 3 for 15.2.0
T3412 extended value IE
2018-03 CT#79 CP-180077 3119 1 B Session AMBR and QoS rules in (e)PCO 15.2.0
2018-03 CT#79 CP-180077 3121 B 5G SM - PDU session address lifetime PCO parameter 15.2.0
2018-03 CT#79 CP-180089 3122 5 D Identify the Local Emergency Number List 15.2.0
2018-03 CT#79 CP-180089 3123 F Corrections in handling of Attach/RAU reject with cause #3, #6 or #8 15.2.0
2018-03 CT#79 CP-180089 3124 1 F Corrections in handling GPRS Attach Reject with GMM cause #14 in 15.2.0
VPLMN
2018-06 CT#80 CP-181076 3126 F Applying EAB for access barring and skiping EAB for paging 15.3.0
2018-06 CT#80 CP-181076 3127 F Correction on ACDC for access control 15.3.0
2018-06 CT#80 CP-181059 3128 2 B Clarify that the newly introduced Extended Local Emergency Number 15.3.0
List does not apply to the CS domain
2018-06 CT#80 CP-181059 3129 1 B Intersystem change from N1 mode to A/Gb or Iu mode 15.3.0
2018-06 CT#80 CP-181076 3130 F Deleting equivalent PLMNs for network initiated detach 15.3.0
2018-06 CT#80 CP-181074 3131 1 B Enabling 3GPP PS data off in roaming 15.3.0
2018-06 CT#80 CP-181059 3132 2 B Adding 5GS NAS messages to clause 11 15.3.0
2018-06 CT#80 CP-181076 3134 F Wrong "slogan" for cause value 98, message not compatible with 15.3.0
protocol state
2018-06 CT#80 CP-181076 3135 2 F Corrections to handling of timer T3302 15.3.0
2018-06 CT#80 CP-181076 3136 C Incrementing of counter for "SIM/USIM considered invalid for non- 15.3.0
GPRS services" in Iu mode
2018-06 CT#80 CP-181076 3137 F Correction on service request as paging response 15.3.0
2018-09 CT#81 CP-182128 3133 1 B 5G QoS - PCO parameter due to restructuring QoS rules 15.4.0
2018-09 CT#81 CP-182158 3140 1 F Pass Emergency Number List to upper layers 15.4.0
2018-09 CT#81 CP-182128 3141 1 F Correction for MTUs for Ethernet and Unstructured PDU sessions 15.4.0
2018-09 CT#81 CP-182158 3143 1 B Introduction of capability support for Security for MTA in network 15.4.0
configuration without LLC security
2018-09 CT#81 CP-182128 3144 F Change NR coverage to NG-RAN coverage 15.4.0
2018-09 CT#81 CP-182128 3149 2 F Setting T3396 due to "DNN based congestion control" 15.4.0
2018-12 CT#82 CP-183066 3152 1 A Correction for 3GPP PS data off and non-IP user data packets 15.5.0
2018-12 CT#82 CP-183031 3153 F Correction in semantic of MTUs for Ethernet and Unstructured PDU 15.5.0
sessions
2018-12 CT#82 CP-183076 3155 1 F Correct validity of emergency number list 15.5.0
2018-12 CT#82 CP-183031 3156 1 F Addition of 5GSM cause value in PCO/ePCO (Solution 1) 15.5.0
2018-12 CT#82 CP-183076 3158 F CSN1 error - Multilateration and indication of CC5 support and 15.5.0
Security for MTA
2018-12 CT#82 CP-183076 3159 1 F Clarification during TMSI reallocation procedure. 15.5.0
2018-12 CT#82 CP-183066 3162 1 A Correction for indicating 3GPP PS data off status 15.5.0
2018-12 CT#82 CP-183031 3163 2 F Location area updating procedure upon moving from NG-RAN to 15.5.0
GERAN or UTRAN coverage
2018-12 CT#82 CP-183031 3164 1 F Clarification on the encoding of 5GC parameters in the PCO 15.5.0
2018-12 CT#82 CP-183076 3166 1 B Introduction of capability support for EC paging indication channel 15.5.0
monitoring
2019-03 CT#83 CP-190100 3165 2 F Collision between paging for non-GPRS services and MS initiated 15.6.0
ETSI
Release 18 835 3GPP TS 24.008 V18.4.0 (2023-09)
PS NAS procedures
ETSI
Release 18 836 3GPP TS 24.008 V18.4.0 (2023-09)
2019-03 CT#83 CP-190083 3168 2 F Removal of wrong reference for back-off timer 15.6.0
2019-03 CT#83 CP-190083 3169 2 F Including QoS rules or QoS flow descriptions with the length of two 15.6.0
octets in ePCO
2019-03 CT#83 CP-190106 3167 4 B SINE_5G: Back-off timer update for 5GS 16.0.0
2019-03 CT#83 CP-190215 3170 4 B Request Type for supporting UE access to RLOS 16.0.0
2019-06 CT#84 CP-191147 3171 B Ethernet based packet filters 16.1.0
2019-06 CT#84 CP-191137 3172 B PCO parameters for ACS information 16.1.0
2019-06 CT#84 CP-191144 3175 F "RLOS" request type in EPC network not supporting access to RLOS 16.1.0
2019-06 CT#84 CP-191144 3176 F Correction to referred specification for definition of RLOS 16.1.0
2019-06 CT#84 CP-191128 3177 1 B Small data rate control, PCO parameters 16.1.0
2019-06 CT#84 CP-191128 3178 B Update to the eDRX timers to reference UEs in NB-N1 and WB-N1 16.1.0
mode
2019-06 CT#84 CP-191131 3180 1 F Coordination between GMM and 5GMM 16.1.0
2019-06 CT#84 CP-191147 3182 1 F Detach procedure clarification 16.1.0
2019-06 CT#84 CP-191131 3184 B T3247 update 16.1.0
2019-06 CT#84 CP-191128 3185 1 B Update to timer table to allow the use of timer T3324 for MICO mode 16.1.0
2019-06 CT#84 CP-191128 3186 F Update reference to TS 24.250 16.1.0
2019-06 CT#84 CP-191147 3187 F Clarification for GMM cause #3, #6, #8, and #11 16.1.0
2019-06 CT#84 CP-191131 3189 1 F Indication of support for P-CSCF re-selection from UE to SMF 16.1.0
2019-09 CT#85 CP-192040 3193 1 A Multislot capability declaration for EC-GSM-IoT supporting MS 16.2.0
2019-09 CT#85 CP-192071 3194 F Keep equivalent PLMNs list for GMM cause #7 16.2.0
2019-09 CT#85 CP-192070 3195 F 5GSM cause #27 and #70 for back-off timer 16.2.0
2019-09 CT#85 CP-192072 3197 1 F T3247 for a UE operating in SNPN access mode 16.2.0
2019-12 CT#86 CP-193087 3199 1 F Coding for small data rate control status 16.3.0
2019-12 CT#86 CP-193091 3200 B CK and IK derivation for 5G-SRVCC 16.3.0
2019-12 CT#86 CP-193091 3201 B Call establishment for 5G-SRVCC 16.3.0
2019-12 CT#86 CP-193116 3202 1 F Correction of handling of GPRS detach procedure in ATTEMPTING- 16.3.0
TO-UPDATE
2019-12 CT#86 CP-193116 3203 1 F Corrections and enhancements for T3340 16.3.0
2019-12 CT#86 CP-193116 3204 F Correcting timer calculation for GPRS MS using EC-GSM-IoT 16.3.0
2019-12 CT#86 CP-193116 3207 F Correciton of the erroneous maximum length of the Quality of service 16.3.0
IE
2019-12 CT#86 CP-193084 3209 A Correction to the length of two octets support indicator 16.3.0
2020-03 CT#87e CP-200113 3211 1 B ATSSS PCO parameters for 5G-RG 16.4.0
2020-06 CT#88e CP-201131 3214 F Remove invalid cases in error handling for TFT operation 16.5.0
2020-06 CT#88e CP-201095 3216 1 B Encoding of initial APN data rate control parameters 16.5.0
2020-06 CT#88e CP-201131 3217 F Correction to Handling of T3321 timer 16.5.0
2020-06 CT#88e CP-201131 3218 1 F Clarification of the cause of start of T3245 16.5.0
2020-06 CT#88e CP-201131 3219 1 F Correction to handling of #3/#6/#8 16.5.0
2020-06 CT#88e CP-201131 3220 F Correction to handling of #9 16.5.0
2020-06 CT#88e CP-201131 3221 1 F Correction to handling of paging in GMM-REG.ATTEMPTING-TO- 16.5.0
UPDATE
2020-06 CT#88e CP-201131 3222 F Correction to handling of paging in MM IDLE ATTEMPTING TO 16.5.0
UPDATE state
2020-06 CT#88e CP-201131 3223 F Correction to GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH 16.5.0
2020-06 CT#88e CP-201131 3224 1 F Correction to GMM-DEREGISTERED.NORMAL-SERVICE 16.5.0
2020-06 CT#88e CP-201101 3225 F T3346 triggers for 5GS 16.5.0
2020-06 CT#88e CP-201321 3226 2 B Provisioning of DNS server security information to the UE 16.5.0
2020-06 CT#88e CP-201131 3227 F No retry in 4G for PDP type related SM causes 16.5.0
2020-09 CT#89e CP-202145 3229 3 A Information over 5GC 16.6.0
2020-09 CT#89e CP-202149 3232 1 F Align description of Request type values with its use in 5GS 16.6.0
2020-09 CT#89e CP-202166 3234 1 F Support P-CSCF and DNS IPv4 Address in ePCO for N1 mode in 16.6.0
Rel-16
2020-09 CT#89e CP-202166 3237 1 F Clarification for SR attempt count reset 16.6.0
2020-09 CT#89e CP-202166 3238 F Correction to typo in CR#3224 16.6.0
2020-09 CT#89e CP-202166 3239 F Handling of T3321 in AUTH REJ 16.6.0
2020-09 CT#89e CP-202170 3242 1 F T3245 for a UE operating in SNPN access mode: 24.008 16.6.0
2020-09 CT#89e CP-202184 3230 D Minor style correction 17.0.0
2020-09 CT#89e CP-202237 3235 1 F Detach in ATTEMPTING-TO-UPDATE 17.0.0
2020-09 CT#89e CP-202173 3236 1 F Updating the description of back-off timer 17.0.0
2020-09 CT#89e CP-202173 3240 1 F Fix of Table/Figure numbering issue 17.0.0
2020-12 CT#90e CP-203214 3243 2 F Clarification on timer T3211 normal stop 17.1.0
2020-12 CT#90e CP-203214 3244 1 F Update of the timers table for PDU session authentication command 17.1.0
2020-12 CT#90e CP-203223 3245 2 F Clarification on the EHPLMN list 17.1.0
2020-12 CT#90e CP-203168 3246 F Request type IE for keeping a PDU session in 5GCN/non-3GPP 17.1.0
access
2020-12 CT#90e CP-203209 3248 1 F Clarification on use of voice domain preference IE 17.1.0
2020-12 CT#90e CP-203168 3249 2 F Use of Equivalent PLMN list in 5GMM 17.1.0
2020-12 CT#90e CP-203214 3250 1 F Correction of T3247 in timer table 17.1.0
2020-12 CT#90e CP-203214 3251 F Correct octect numbering of additional parameters list 17.1.0
2021-03 CT#91e CP-210131 3252 1 F Adding the RFC reference of PAP/CHAP protocol identifier contents 17.2.0
and related abbreviations
ETSI
Release 18 837 3GPP TS 24.008 V18.4.0 (2023-09)
2021-03 CT#91e CP-210135 3254 1 D Inclusive language review – TS 24.008 17.2.0

2021-03 CT#91e CP-210114 3256 1 A Removing descriptions about a UE operating in SNPN access 17.2.0
operation mode
2021-03 CT#91e CP-210132 3258 1 F Correction to call state to be chosen after a b-SRVCC call transfer 17.2.0
2021-03 CT#91e CP-210133 3259 1 F Actions on T3247 expiry for other supported RATs 17.2.0
2021-03 CT#91e CP-210116 3261 1 F Add missing case for T3396 in timer table 17.2.0
2021-03 CT#91e CP-210107 3263 1 A Local IP address in TFT negotiation in 5GS for 5G-4G interworking 17.2.0
2021-06 CT#92e CP-211135 3267 1 F Correction on the number of the maximum size packet filters in TFT 17.3.0
2021-06 CT#92e CP-211137 3268 1 B PVS information providing in PDU session establishment for 17.3.0
onboarding
2021-06 CT#92e CP-211147 3270 1 F Extended DRX parameters applicable for N1 mode 17.3.0
2021-06 CT#92e CP-211149 3257 5 B ECS address support indication and provisioning in ePCO 17.3.0
2021-06 CT#92e CP-211150 3260 2 F Storage of counters related to non-integrity protected reject 17.3.0
messages
2021-09 CT#93e CP-212136 3271 1 B PCO parameters for reconfiguring DNS server addresses 17.4.0
2021-09 CT#93e CP-212136 3272 1 B PCO parameters for EAS rediscovery 17.4.0
2021-09 CT#93e CP-212120 3274 1 F Error in size of LI of DNS server security information with length of 17.4.0
two octets PCO parameter
2021-09 CT#93e CP-212154 3276 1 F DNS server security information UE capability 17.4.0
2021-09 CT#93e CP-212152 3278 - F Clarification of destination and source MAC addresses 17.4.0
2021-09 CT#93e CP-212152 3279 - F Handling of multiple S-TAGs in the Ethernet header 17.4.0
2021-09 CT#93e CP-212154 3280 1 F Clarification of PF for Ethernet PDN connection 17.4.0
2021-09 CT#93e CP-212153 3281 1 F Deleting forbidden PLMNs list when MS is switched off 17.4.0
2021-09 CT#93e CP-212140 3282 - F Clarification about stop T3346 17.4.0
2021-09 CT#93e CP-212153 3283 - F Clarification on T3512 17.4.0
2021-12 CT#94e CP-213030 3290 - F Clarification on GUTI used to map P-TMSI 17.5.0
2021-12 CT#94e CP-213030 3289 1 F Remove PLMN from the extension of the forbidden PLMNs list upon 17.5.0
T3247 expiry
2021-12 CT#94e CP-213032 3284 1 C Enabling extended idle mode DRX for NR connected to 5GC 17.5.0
2021-12 CT#94e CP-213044 3288 1 B PCOs for uplink control during EPS UUAA-SM 17.5.0
2021-12 CT#94e CP-213044 3285 3 B UAS services not allowed indication in PCO 17.5.0
2021-12 CT#94e CP-213050 3286 1 B Update on ECS configuration information 17.5.0
2021-12 CT#94e CP-213050 3287 1 B ECS Provider ID format 17.5.0
2022-03 CT#95e CP-220238 3302 1 F DNN and S-NSSAI associated with PVS address in ePCO 17.6.0
2022-03 CT#95e CP-220238 3301 1 F PVS information request PCO parameter 17.6.0
2022-03 CT#95e CP-220244 3299 2 B ePCO parameter for UUAA/C2 authorization in EPS 17.6.0
2022-03 CT#95e CP-220252 3298 1 B Spatial validity condition coding in PCO 17.6.0
2022-03 CT#95e CP-220252 3295 1 B EDC related PCO parameters 17.6.0
2022-03 CT#95e CP-220252 3300 B 17.6.0
Support of multiple ECS providers inf10.5.15410.5o delivery
2022-06 CT#96e CP-221212 3304 1 F MAC address range support indicator in PCO or ePCO 17.7.0
2022-06 CT#96e CP-221214 3308 1 F Correction on naming of ECS provider 17.7.0
2022-06 CT#96e CP-221223 3305 - F Clarification of coding for MSISDN in the PCO IE 17.7.0
2022-06 CT#96e CP-221223 3306 - F Handling of multiple C-TAGs in the Ethernet header 17.7.0
2022-06 CT#96e CP-221223 3307 - F Clarification for the encoding of MCC and MNC parameters in in TS 17.7.0
24.008
2022-06 CT#96e CP-221257 3303 1 B Call-pull-initiated indication 17.7.0
2022-09 CT#97e CP-222155 3317 - F Introduction of the extended PTW length values for IDLE eDRX 17.8.0
2022-09 CT#97e CP-222172 3309 1 F Correcting minor issues in TS 24.008 18.0.0
2022-09 CT#97e CP-222172 3310 1 F Correction to TFT IE 18.0.0
2022-09 CT#97e CP-222172 3313 1 F Clarification of the coding of Network Name IE 18.0.0
2022-12 CT#98e CP-223144 3318 1 F IPv4 local address type and IPv6 local address type 18.1.0
2022-12 CT#98e CP-223157 3321 1 D Editorial error fix 18.1.0
2022-12 CT#98e CP-223145 3322 3 B Introducing the secondary DN authentication and authorization over 18.1.0
EPC support indicator
2023-03 CT#99 CP-230313 3327 1 B Applicable defined eDRX value range update 18.2.0
2023-03 CT#99 CP-230253 3325 1 F Correction to the container ID for SDNAEPC indicators 18.2.0
2023-03 CT#99 CP-230253 3326 1 B Include DN-specific identity in PCO 18.2.0
2023-03 CT#99 CP-230234 3328 1 B Introduce new UE policy container PCO parameter 18.2.0
2023-06 CT#99 CP-231225 3332 - A Correction on PTW use for RedCap UE 18.3.0
2023-06 CT#99 CP-231266 3330 1 F Adding missing description for IEs of type 6 under clause 10.5 18.3.0
2023-09 CT#101 CP-232195 3338 - F Clarification on handling of received T3302 in RAU Accept message 18.4.0
2023-09 CT#101 CP-232196 3337 1 F Correction to TFT handlling for empty packet filter list in 3G 18.4.0
ETSI

3GPP TS 24.008

Uploaded by

Copyright:

Available Formats

3GPP TS 24.008

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

3GPP TS 24.008

Uploaded by

Copyright:

Available Formats

3GPP TS 24.008 V18.4.

3GPP support office address

No part may be reproduced except as authorized by written permission.

4.1.3.1.3 Substates of state GMM-REGISTERED..........................................................................................72

4.3.2.5.1 Authentication not accepted by the MS............................................................................................94

4.5.1.2 Abnormal cases....................................................................................................................................125

4.7.2.1.2a Handling of READY timer in the network in Iu mode and S1 mode.............................................150

4.7.5.2.6 Abnormal cases on the network side..............................................................................................227

5.1.2.1.2a CC prompt present (U0.2) $(CCBS)$............................................................................................273

5.2.2.3.2 Receipt of CALL CONFIRMED and ALERTING by the network...............................................286

5.4.3 Clearing initiated by the mobile station.....................................................................................................307

6.1.3.10 MBMS protocol configuration options................................................................................................369

9.2.12.1 Mobile Station Classmark....................................................................................................................388

9.3.25 Start DTMF Acknowledge.........................................................................................................................426

9.4.4.1 T3302 value..........................................................................................................................................437

9.4.15.2 Allocated P-TMSI................................................................................................................................453

9.5.2.2 Protocol configuration options.............................................................................................................463

9.5.11.1 Protocol configuration options.............................................................................................................474

9.5.25.2 MBMS protocol configuration options................................................................................................485

10.5.4.5.1 Static conditions for the bearer capability IE contents...................................................................570

10.5.7 GPRS Common information elements.......................................................................................................709

Annex A (informative): Example of subaddress information element coding........................................742

Annex B (normative): Compatibility checking...........................................................................................743

Annex D (informative): Examples of bearer capability information element coding............................747

Annex G (informative): 3GPP specific cause values for mobility management......................................757

G.1 Causes related to MS identification......................................................................................................

H.1 Normal class.........................................................................................................................................

H.5 Invalid message (e.g., parameter out of range) class............................................................................

I.1 Causes related to nature of request.......................................................................................................

Annex K (informative): Default Codings of Information Elements.........................................................772

K.1 Common information elements............................................................................................................

L.1 Mapping of NAS procedure to RRC establishment cause(Iu mode only)............................................

Annex O (normative): 3GPP capability exchange protocol......................................................................781

Annex P (normative): Mobility management for IMS voice termination...............................................787

Annex R (informative): Change History.....................................................................................................790

x the first digit:

1 presented to TSG for information;

2 presented to TSG for approval;

3 or greater indicates TSG approved document under change control.

1.1 Scope of the Technical Specification

1.2 Application to the interface structures

1.3 Structure of layer 3 procedures

1.4 Test procedures

1.5 Use of logical channels in A/Gb mode

vi) Standalone Dedicated Control CHannel (SDCCH): bi-directional;

i) SAPI 0: supports the transfer of signalling information including user-user information;

ii) SAPI 3: supports the transfer of user short messages.

1.6 Overview of control procedures

a) Clause 4 specifies elementary procedures for Mobility Management:

- mobility management common procedures (subclause 4.3):

- TMSI reallocation procedure (subclause 4.3.1);

- authentication procedure (subclause 4.3.2);

- identification procedure (subclause 4.3.3);

- IMSI detach procedure (subclause 4.3.4);

- abort procedure (subclause 4.3.5);

- MM information procedure (subclause 4.3.6).

- mobility management specific procedures (subclause 4.4):

- location updating procedure (subclause 4.4.1);