In 5G, the gNB is not a single box. Under the 3GPP higher-layer split (TS 38.401), it divides into a Central Unit (CU) that owns the upper radio-protocol layers and one or more Distributed Units (DU) that own the real-time lower layers — RLC, MAC, and PHY. The interface between them is F1, and its control plane, F1-C, runs the F1 Application Protocol (F1AP, TS 38.473) over SCTP.
This capture is a complete F1AP conversation from a real OCUDU (srsRAN-based) CU + DU — 32 frames that walk the entire arc: bring the interface up, register one UE, push a cell broadcast, then tear it all down.
What the capture showed
One UE's whole registration is relayed across F1. RRC connection setup, NAS authentication and security, access-stratum security, capability exchange, and the data radio bearer are all carried between CU and DU. The CU is the UE's RRC endpoint (and a NAS pipe to the AMF behind it); the DU relays transparently to the air and never interprets the RRC or NAS.
There is no IP layer. This is a Wireshark "Export PDUs" dump: each frame carries the raw F1AP PDU, with no Ethernet, IP, or SCTP header. You cannot read a message's direction from a 4-tuple — it comes from the 3GPP-defined originator of each F1AP procedure.
Security activates in two ordered layers. NAS security first (Security Mode Command and Complete, under a new 5G security context), then access-stratum security via an RRC SecurityModeCommand embedded inside UE Context Setup. Once NAS security is on, a control-plane trace can no longer decode the NAS bodies — the walkthrough names them by role, from their position in the flow.
The data radio bearer is added at Modification, not Setup. UE Context Setup establishes the signaling radio bearers; the DRB (DRB 1, 5QI 9) arrives at UE Context Modification, paired with the RRCReconfiguration that activates it on the UE.
The full walkthrough goes phase by phase through all 32 frames — F1 Setup, RRC setup carrying the initial NAS Registration Request, authentication, the two security activations, the DRB addition, a Public Warning System broadcast, and the UE Context Release and F1 Removal that tear it down.
Full walk-through: https://www.eventhelix.com/5G/f1ap-cu-du-registration/
Every arrow in the diagram was decoded and captioned by VisualEther straight from the raw Wireshark PCAP — no manual diagramming. VisualEther turns a PCAP into a sequence diagram and ships an MCP server so an AI agent can analyze a capture directly. Free Community edition: https://www.eventhelix.com/visualether/download
Top comments (0)