If you liked it, or content was helpful to you please add "+1" to article you used or share it on facebook or so.
Make it easier to find for others who could need those information, allow them find these articles on the spot. But.. it's your call.
Recommendations until now


Aug 13, 2013

Terminating the SMS over SGs interface

All the best to you on the workaholic day! As I was told by the BBC in the morning.

Recently I've been asked to investigate curious case which on the SMS duplicates. On the end it appeared it's more than just duplicates issue, but because of confidentiality agreements I will not speak about that.

From the begining I would like to add that on the bottom of this article you will find a trace from live MME node. Sometimes to see the real signaling is better than just the call flow. Also I have to add that the trace was collected only on the MME, that's why signaling steps not involving the MME are not present there.

SMS over the SGs

SMS Active Mode

As the Figure 1 caption stays presented call flow is for the idle mode.
According to the specification the if the UE is in active mode, the only difference is that steps 6, 7, 8 are missing, also in the step 9d the MME includes the E-CGI and TAI. 

SMS Idle Mode


At first I would like to start with the call flow, so here it is.
Fig. 1. Mobile terminating the SMS - idle mode











1. The combined EPS/IMSI attach procedure.
2-4. The SC initiates transfer of mobile terminating SMS. The HLR is requested for routing number for SMS services and the SMS message is forwarded to the MSC/VLR where the MS/UE is CS attached.
5. The MSC/VLR sends a Paging (IMSI, VLR TMSI, Location Information, SMS indicator) message to the MME.
6. The MME initiates the paging procedure by sending the Paging message to each eNodeB with cells belonging to the tracking area(s) in which the UE is registered. The UE is paged with its S-TMSI.
7. The MS/UE is paged by the eNodeBs.
8. The UE sends a Service Request message to the MME. The UE indicates its S-TMSI in the RRC signalling. The MME sends the S1-AP Initial Context Setup Request message to the eNodeB and the eNodeB establishes the Radio Bearers.
8a. The MME sends a Service Request message to the MSC. In order to permit the MSC to create an accurate charging record, the MME adds the IMEISV, the local time zone, the Mobile Station Classmark 2, and the UE's current TAI and E-CGI.
9a. The MSC/VLR builds the SMS message to be sent as defined in Spec (i.e. the SMS message consists of CP DATA/RP DATA/TPDU/SMS DELIVER parts). The MSC/VLR forwards the SMS message to the MME in a Downlink Unitdata message.
9b. The MME encapsulates the SMS message in a NAS message and sends the message to the MS/UE.
9c, 9d. The MS/UE acknowledges receipt of the SMS message to the MSC/VLR.
10. The MS/UE returns a delivery report. The delivery report is encapsulated in an NAS message and sent to the MME.
11. The MME forwards the delivery report to the MSC/VLR in an Uplink Unitdata message.
12-13. The delivery report is forwarded to the SC.
14-15. In parallel to steps 12-13, the MSC/VLR acknowledges receipt of the delivery report to the MS/UE.
16. The MSC/VLR indicates to the MME that no more NAS messages need to be tunnelled - Release Request.

The below is a SMS over SGs trace. It has been splited into sections as the steps from Fig. 1., hope you will find it helpful.


SMS over SGs trace



STEP 5


INBOUND>>>>>  11:50:41:569 Eventid:173001(3)
SGS Rx PDU, from MSC-VLR-IP:29118 to MME-SGs-Interface-IP:29118 (48)

 SGs-AP (48 bytes)
  PAGING_REQUEST(0x1)
    IMSI
      2*************7
    VLR_NAME
      0x0************f444146
        4****5
         . M S C I N . ** L . ********
    SERVICE_INDICATOR
      SMS(0x2)
    TMSI
      0x69d3ad95
    LOCATION_AREA_IDENTIFIER
      MCC[2**] MNC[**] LAC[2*7]


STEP 6



<<<<OUTBOUND  11:50:41:569 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-1-IP:36422 (43)

 S1 Application Part (S1AP) (43 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   PAGING (10)
    Criticality
      | 01.. .... | Ignore (1)
    PAGING Value :
      | .010 0111 | Length Determinant : 39
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 4
            IE : 1
              Protocol IE ID : UEIdentityIdxValue (80)
              Criticality
                | 01.. .... | Ignore (1)
              UEIdentityIdxValue Value :
                | .000 0010 | Length Determinant : 2
                Value :
                  | 1101 1100 | | 01.. .... | 0x371
            IE : 2
              Protocol IE ID : UEPagID (43)
              Criticality
                | 01.. .... | Ignore (1)
              UEPagID Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  | 0... .... | Ext bit : 0
                  | .0.. .... | Choice index : 0
                    S-TMSI
                      | ..0. .... | Ext bit : 0
                      Bit map :
                        | ...0 .... | IE Extensions : Not present
                      MMEC
                        0x**
                      M-TMSI
                        0xc4a12020
            IE : 3
              Protocol IE ID : CNDomain (109)
              Criticality
                | 01.. .... | Ignore (1)
              CNDomain Value :
                | .000 0001 | Length Determinant : 1
                Value :
                  | 0... .... | PS (0)
            IE : 4
              Protocol IE ID : TAILst (46)
              Criticality
                | 01.. .... | Ignore (1)
              TAILst Value :
                | .000 1011 | Length Determinant : 11
                Value :
                  Item Count : 1
                    Item : 1
                      TAI Item
                        Protocol IE ID : TAIItem (47)
                        Criticality
                          | 01.. .... | Ignore (1)
                          | .000 0110 | Length Determinant : 6
                          Value :
                                | 0... .... | Ext bit : 0
                                Bit map :
                                  | .0.. .... | IE Extensions : Not present
                                PLMN Identity
                                  0x***51
                                TAC
                                  0x**04


<<<<OUTBOUND  11:50:41:569 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-2-IP:36422 (43)

 S1 Application Part (S1AP) (43 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   PAGING (10)
    Criticality
      | 01.. .... | Ignore (1)
    PAGING Value :
      | .010 0111 | Length Determinant : 39
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 4
            IE : 1
              Protocol IE ID : UEIdentityIdxValue (80)
              Criticality
                | 01.. .... | Ignore (1)
              UEIdentityIdxValue Value :
                | .000 0010 | Length Determinant : 2
                Value :
                  | 1101 1100 | | 01.. .... | 0x**1
            IE : 2
              Protocol IE ID : UEPagID (43)
              Criticality
                | 01.. .... | Ignore (1)
              UEPagID Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  | 0... .... | Ext bit : 0
                  | .0.. .... | Choice index : 0
                    S-TMSI
                      | ..0. .... | Ext bit : 0
                      Bit map :
                        | ...0 .... | IE Extensions : Not present
                      MMEC
                        0x**
                      M-TMSI
                        0xc4a12020
            IE : 3
              Protocol IE ID : CNDomain (109)
              Criticality
                | 01.. .... | Ignore (1)
              CNDomain Value :
                | .000 0001 | Length Determinant : 1
                Value :
                  | 0... .... | PS (0)
            IE : 4
              Protocol IE ID : TAILst (46)
              Criticality
                | 01.. .... | Ignore (1)
              TAILst Value :
                | .000 1011 | Length Determinant : 11
                Value :
                  Item Count : 1
                    Item : 1
                      TAI Item
                        Protocol IE ID : TAIItem (47)
                        Criticality
                          | 01.. .... | Ignore (1)
                          | .000 0110 | Length Determinant : 6
                          Value :
                                | 0... .... | Ext bit : 0
                                Bit map :
                                  | .0.. .... | IE Extensions : Not present
                                PLMN Identity
                                  0x***451
                                TAC
                                  0x**04


<<<<OUTBOUND  11:50:41:569 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-3-IP:36422 (43)

 S1 Application Part (S1AP) (43 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   PAGING (10)
    Criticality
      | 01.. .... | Ignore (1)
    PAGING Value :
      | .010 0111 | Length Determinant : 39
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 4
            IE : 1
              Protocol IE ID : UEIdentityIdxValue (80)
              Criticality
                | 01.. .... | Ignore (1)
              UEIdentityIdxValue Value :
                | .000 0010 | Length Determinant : 2
                Value :
                  | 1101 1100 | | 01.. .... | 0x**1
            IE : 2
              Protocol IE ID : UEPagID (43)
              Criticality
                | 01.. .... | Ignore (1)
              UEPagID Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  | 0... .... | Ext bit : 0
                  | .0.. .... | Choice index : 0
                    S-TMSI
                      | ..0. .... | Ext bit : 0
                      Bit map :
                        | ...0 .... | IE Extensions : Not present
                      MMEC
                        0x**
                      M-TMSI
                        0xc4a12020
            IE : 3
              Protocol IE ID : CNDomain (109)
              Criticality
                | 01.. .... | Ignore (1)
              CNDomain Value :
                | .000 0001 | Length Determinant : 1
                Value :
                  | 0... .... | PS (0)
            IE : 4
              Protocol IE ID : TAILst (46)
              Criticality
                | 01.. .... | Ignore (1)
              TAILst Value :
                | .000 1011 | Length Determinant : 11
                Value :
                  Item Count : 1
                    Item : 1
                      TAI Item
                        Protocol IE ID : TAIItem (47)
                        Criticality
                          | 01.. .... | Ignore (1)
                          | .000 0110 | Length Determinant : 6
                          Value :
                                | 0... .... | Ext bit : 0
                                Bit map :
                                  | .0.. .... | IE Extensions : Not present
                                PLMN Identity
                                  0x***451
                                TAC
                                  0x**04


<<<<OUTBOUND  11:50:41:569 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-4-IP:36422 (43)

 S1 Application Part (S1AP) (43 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   PAGING (10)
    Criticality
      | 01.. .... | Ignore (1)
    PAGING Value :
      | .010 0111 | Length Determinant : 39
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 4
            IE : 1
              Protocol IE ID : UEIdentityIdxValue (80)
              Criticality
                | 01.. .... | Ignore (1)
              UEIdentityIdxValue Value :
                | .000 0010 | Length Determinant : 2
                Value :
                  | 1101 1100 | | 01.. .... | 0x**1
            IE : 2
              Protocol IE ID : UEPagID (43)
              Criticality
                | 01.. .... | Ignore (1)
              UEPagID Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  | 0... .... | Ext bit : 0
                  | .0.. .... | Choice index : 0
                    S-TMSI
                      | ..0. .... | Ext bit : 0
                      Bit map :
                        | ...0 .... | IE Extensions : Not present
                      MMEC
                        0x**
                      M-TMSI
                        0xc4a12020
            IE : 3
              Protocol IE ID : CNDomain (109)
              Criticality
                | 01.. .... | Ignore (1)
              CNDomain Value :
                | .000 0001 | Length Determinant : 1
                Value :
                  | 0... .... | PS (0)
            IE : 4
              Protocol IE ID : TAILst (46)
              Criticality
                | 01.. .... | Ignore (1)
              TAILst Value :
                | .000 1011 | Length Determinant : 11
                Value :
                  Item Count : 1
                    Item : 1
                      TAI Item
                        Protocol IE ID : TAIItem (47)
                        Criticality
                          | 01.. .... | Ignore (1)
                          | .000 0110 | Length Determinant : 6
                          Value :
                                | 0... .... | Ext bit : 0
                                Bit map :
                                  | .0.. .... | IE Extensions : Not present
                                PLMN Identity
                                  0x***451
                                TAC
                                  0x**04


<<<<OUTBOUND  11:50:41:570 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-5-IP:36422 (43)

 S1 Application Part (S1AP) (43 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   PAGING (10)
    Criticality
      | 01.. .... | Ignore (1)
    PAGING Value :
      | .010 0111 | Length Determinant : 39
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 4
            IE : 1
              Protocol IE ID : UEIdentityIdxValue (80)
              Criticality
                | 01.. .... | Ignore (1)
              UEIdentityIdxValue Value :
                | .000 0010 | Length Determinant : 2
                Value :
                  | 1101 1100 | | 01.. .... | 0x**1
            IE : 2
              Protocol IE ID : UEPagID (43)
              Criticality
                | 01.. .... | Ignore (1)
              UEPagID Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  | 0... .... | Ext bit : 0
                  | .0.. .... | Choice index : 0
                    S-TMSI
                      | ..0. .... | Ext bit : 0
                      Bit map :
                        | ...0 .... | IE Extensions : Not present
                      MMEC
                        0x**
                      M-TMSI
                        0xc4a12020
            IE : 3
              Protocol IE ID : CNDomain (109)
              Criticality
                | 01.. .... | Ignore (1)
              CNDomain Value :
                | .000 0001 | Length Determinant : 1
                Value :
                  | 0... .... | PS (0)
            IE : 4
              Protocol IE ID : TAILst (46)
              Criticality
                | 01.. .... | Ignore (1)
              TAILst Value :
                | .000 1011 | Length Determinant : 11
                Value :
                  Item Count : 1
                    Item : 1
                      TAI Item
                        Protocol IE ID : TAIItem (47)
                        Criticality
                          | 01.. .... | Ignore (1)
                          | .000 0110 | Length Determinant : 6
                          Value :
                                | 0... .... | Ext bit : 0
                                Bit map :
                                  | .0.. .... | IE Extensions : Not present
                                PLMN Identity
                                  0x***451
                                TAC
                                  0x**04


<<<<OUTBOUND  11:50:41:570 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-6-IP:36422 (43)

 S1 Application Part (S1AP) (43 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   PAGING (10)
    Criticality
      | 01.. .... | Ignore (1)
    PAGING Value :
      | .010 0111 | Length Determinant : 39
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 4
            IE : 1
              Protocol IE ID : UEIdentityIdxValue (80)
              Criticality
                | 01.. .... | Ignore (1)
              UEIdentityIdxValue Value :
                | .000 0010 | Length Determinant : 2
                Value :
                  | 1101 1100 | | 01.. .... | 0x**1
            IE : 2
              Protocol IE ID : UEPagID (43)
              Criticality
                | 01.. .... | Ignore (1)
              UEPagID Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  | 0... .... | Ext bit : 0
                  | .0.. .... | Choice index : 0
                    S-TMSI
                      | ..0. .... | Ext bit : 0
                      Bit map :
                        | ...0 .... | IE Extensions : Not present
                      MMEC
                        0x**
                      M-TMSI
                        0xc4a12020
            IE : 3
              Protocol IE ID : CNDomain (109)
              Criticality
                | 01.. .... | Ignore (1)
              CNDomain Value :
                | .000 0001 | Length Determinant : 1
                Value :
                  | 0... .... | PS (0)
            IE : 4
              Protocol IE ID : TAILst (46)
              Criticality
                | 01.. .... | Ignore (1)
              TAILst Value :
                | .000 1011 | Length Determinant : 11
                Value :
                  Item Count : 1
                    Item : 1
                      TAI Item
                        Protocol IE ID : TAIItem (47)
                        Criticality
                          | 01.. .... | Ignore (1)
                          | .000 0110 | Length Determinant : 6
                          Value :
                                | 0... .... | Ext bit : 0
                                Bit map :
                                  | .0.. .... | IE Extensions : Not present
                                PLMN Identity
                                  0x***451
                                TAC
                                  0x**04


STEP 8



INBOUND>>>>>  11:50:42:796 Eventid:155212(3)
S1AP Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (60)

 S1 Application Part (S1AP) (60 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   INITIAL UE MESSAGE (12)
    Criticality
      | 01.. .... | Ignore (1)
    INITIAL UE MESSAGE Value :
      | .011 1000 | Length Determinant : 56
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 6
            IE : 1
              Protocol IE ID : eNB_UE_S1AP_ID (8)
              Criticality
                | 00.. .... | Reject (0)
              eNB_UE_S1AP_ID Value :
                | .000 0011 | Length Determinant : 3
                Value :
                  | 01.. .... | Length Determinant : 2
                  2632 (0xa48)
            IE : 2
              Protocol IE ID : NAS_PDU (26)
              Criticality
                | 00.. .... | Reject (0)
              NAS_PDU Value :
                | .000 0101 | Length Determinant : 5
                Value :
                  | .000 0100 | Length Determinant : 4
                  0xc7162927
                    EPS Mobility Management
                      Protocol Discriminator
                         EPS MOBILITY MANAGEMENT MESSAGES(0x7)
                      Security Header Type
                         NAS_MSG_SECURITY_HDR_SERVICE_REQUEST(0xc)
                      KSI and Sequence Number
                         KSI
                           (0x0)
                         SEQUENCE NUMBER
                           (0x16)
                      Short MAC
                        (0x2927)
                         NAS_MSG_SECURITY_HDR_SERVICE_REQUEST(0xc)

            IE : 3
              Protocol IE ID : TAI (67)
              Criticality
                | 00.. .... | Reject (0)
              TAI Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  Bit map :
                    | 0... .... | IE Extensions : Not present
                  PLMN Identity
                    0x***451
                  TAC
                    0x**04
            IE : 4
              Protocol IE ID : EUTRAN_CGI_ID (100)
              Criticality
                | 01.. .... | Ignore (1)
              EUTRAN_CGI_ID Value :
                | .000 1000 | Length Determinant : 8
                Value :
                  | 0... .... | Ext bit : 0
                  Bit map :
                    | .0.. .... | IE Extensions : Not present
                  PLMN Identity
                    0x***451
                  Cell Identity
                    | 0000 0000 | + 20 bits : 0x****114
            IE : 5
              Protocol IE ID : RRC_Establishment_Cause (134)
              Criticality
                | 01.. .... | Ignore (1)
              RRC_Establishment_Cause Value :
                | .000 0001 | Length Determinant : 1
                Value :
                  | 0... .... | Ext bit : 0
                  | .010 .... | mt-Access (2)
            IE : 6
              Protocol IE ID : S_TMSI (96)
              Criticality
                | 00.. .... | Reject (0)
              S_TMSI Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  | 0... .... | Ext bit : 0
                  Bit map :
                    | .0.. .... | IE Extensions : Not present
                  MMEC
                    0x**
                  M-TMSI
                    0xc4a12020


INBOUND>>>>>  11:50:42:796 Eventid:153001(3)
NAS Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (4)

 Non Access Stratum (NAS) (4 bytes)
  EPS Mobility Management
    Protocol Discriminator
       EPS MOBILITY MANAGEMENT MESSAGES(0x7)
    Security Header Type
       NAS_MSG_SECURITY_HDR_SERVICE_REQUEST(0xc)
    KSI and Sequence Number
       KSI
         (0x0)
       SEQUENCE NUMBER
         (0x16)
    Short MAC
      (0x2927)
       NAS_MSG_SECURITY_HDR_SERVICE_REQUEST(0xc)


<<<<OUTBOUND  11:50:42:797 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-5-IP:36422 (152)

 S1 Application Part (S1AP) (152 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   INITIAL CONTEXT SETUP (9)
    Criticality
      | 00.. .... | Reject (0)
    INITIAL CONTEXT SETUP Value :
      | ..00 0000 | | 1001 0011 | Length Determinant : 147
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 7
            IE : 1
              Protocol IE ID : MME_UE_S1AP_ID (0)
              Criticality
                | 00.. .... | Reject (0)
              MME_UE_S1AP_ID Value :
                | .000 0101 | Length Determinant : 5
                Value :
                  | 11.. .... | Length Determinant : 4
                  33586054 (0x2007b86)
            IE : 2
              Protocol IE ID : eNB_UE_S1AP_ID (8)
              Criticality
                | 00.. .... | Reject (0)
              eNB_UE_S1AP_ID Value :
                | .000 0011 | Length Determinant : 3
                Value :
                  | 01.. .... | Length Determinant : 2
                  2632 (0xa48)
            IE : 3
              Protocol IE ID : aggregateMaxBitrate (66)
              Criticality
                | 00.. .... | Reject (0)
              aggregateMaxBitrate Value :
                | .000 1010 | Length Determinant : 10
                Value :
                  | 0... .... | Ext bit : 0
                  Bit map :
                    | .0.. .... | IE Extensions : Not present
                  UE Aggregate Maximum Bitrate Downlink
                    | ..01 1... | Length Determinant : 4
                    256000000 bps
                  UE Aggregate Maximum Bitrate Uplink
                    | 011. .... | Length Determinant : 4
                    100000000 bps
            IE : 4
              Protocol IE ID : E-RABToBeSetupLstCtxtSUReq (24)
              Criticality
                | 00.. .... | Reject (0)
              E-RABToBeSetupLstCtxtSUReq Value :
                | .001 0011 | Length Determinant : 19
                Value :
                  Item Count : 1
                    Item : 1
                      E-RAB To Be Setup Item
                        Protocol IE ID : E-RABToBeSetupItemCtxtSUReq (52)
                        Criticality
                          | 00.. .... | Reject (0)
                          | .000 1110 | Length Determinant : 14
                          Value :
                                | 0... .... | Ext bit : 0
                                Bit map :
                                  | .0.. .... | NAS-PDU : Not present
                                  | ..0. .... | IE Extensions : Not present
                                E-RAB ID
                                  | ...0 .... | Ext bit : 0
                                  | .... 0101 | 5 (0x05)
                                E-RAB Level QOS Parameters
                                  | 0... .... | Ext bit : 0
                                  Bit map :
                                    | .0.. .... | GBR QOS Information : Not present
                                    | ..0. .... | IE Extensions : Not present
                                  QCI
                                    8 (0x08)
                                  Allocation and Retention Priority
                                    | 0... .... | Ext bit : 0
                                    Bit map :
                                      | .0.. .... | IE Extensions : Not present
                                    Priority Level
                                      | ..01 10.. | 6 (0x06)
                                    Pre-emption Capability
                                      | .... ..0. | shall-not-trigger-pre-emption (0)
                                    Pre-emption Vulnerability
                                      | .... ...1 | pre-emptable (1)
                                Transport Layer Address
                                  | 0... .... | Ext bit : 0
                                  | .000 1111 | | 1... .... | Length Determinant : 32
                                  | 0000 1010 | + 24 bits : 0x0ac8e908
                                GTP-TEID
                                  0xb3d6606b
            IE : 5
              Protocol IE ID : UESecurityCapabilities (107)
              Criticality
                | 00.. .... | Reject (0)
              UESecurityCapabilities Value :
                | .000 0101 | Length Determinant : 5
                Value :
                  | 0... .... | Ext bit : 0
                  Bit map :
                    | .0.. .... | IE Extensions : Not present
                  Encryption Algorithms
                    | ..0. .... | Ext bit : 0
                    | ...1 1000 | + 11 bits : 0xc000
                  Integrity Protection Algorithms
                    | ...0 .... | Ext bit : 0
                    | .... 1100 | + 12 bits : 0xc000
            IE : 6
              Protocol IE ID : SecurityKey (73)
              Criticality
                | 00.. .... | Reject (0)
              SecurityKey Value :
                | .010 0000 | Length Determinant : 32
                Value :
0x38237196a333f8b7fb516fe8a48bd53a932b1142bf3ca8402fbf4919f73b7fe8
            IE : 7
              Protocol IE ID : UERadioCapblty (74)
              Criticality
                | 01.. .... | Ignore (1)
              UERadioCapblty Value :
                | .010 1010 | Length Determinant : 42
                Value :
                  | .010 1001 | Length Determinant : 41
                  0x013801024c520000208313050b8fff0b8fff0b8ffebe1ff901103004870ca74a926020580000000000


INBOUND>>>>>  11:50:42:914 Eventid:155212(3)
S1AP Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (42)

 S1 Application Part (S1AP) (42 bytes)
  | 0... .... | Ext bit : 0
  | .01. .... | Choice index : Successful Outcome (1)
    Procedure Code :   INITIAL CONTEXT SETUP (9)
    Criticality
      | 00.. .... | Reject (0)
    INITIAL CONTEXT SETUP Value :
      | .010 0110 | Length Determinant : 38
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 3
            IE : 1
              Protocol IE ID : MME_UE_S1AP_ID (0)
              Criticality
                | 01.. .... | Ignore (1)
              MME_UE_S1AP_ID Value :
                | .000 0101 | Length Determinant : 5
                Value :
                  | 11.. .... | Length Determinant : 4
                  33586054 (0x2007b86)
            IE : 2
              Protocol IE ID : eNB_UE_S1AP_ID (8)
              Criticality
                | 01.. .... | Ignore (1)
              eNB_UE_S1AP_ID Value :
                | .000 0011 | Length Determinant : 3
                Value :
                  | 01.. .... | Length Determinant : 2
                  2632 (0xa48)
            IE : 3
              Protocol IE ID : E-RABSetupLstCtxtSURes (51)
              Criticality
                | 01.. .... | Ignore (1)
              E-RABSetupLstCtxtSURes Value :
                | .000 1111 | Length Determinant : 15
                Value :
                  Item Count : 1
                    Item : 1
                      E-RAB Setup Item
                        Protocol IE ID : E-RABSetupItemCtxtSURes (50)
                        Criticality
                          | 01.. .... | Ignore (1)
                          | .000 1010 | Length Determinant : 10
                          Value :
                                | 0... .... | Ext bit : 0
                                Bit map :
                                  | .0.. .... | IE Extensions : Not present
                                E-RAB ID
                                  | ..0. .... | Ext bit : 0
                                  | ...0 101. | 5 (0x05)
                                Transport Layer Address
                                  | .... ...0 | Ext bit : 0
                                  | 0001 1111 | Length Determinant : 32
                                  | 0110 0100 | + 24 bits : 0x644d100b
                                GTP-TEID
                                  0xe82dd55f


***CONTROL*** 11:50:42:915 Eventid:147118
imsi 2*************7, MME-EGTPC-BRR-STATE for brr-id 5 changed from MME_EGTPC_STATE_ACTIVE to MME_EGTPC_STATE_MOD_BRR_REQ_PENDING

<<<<OUTBOUND  11:50:42:915 Eventid:141005(3)
[MME-S11]GTPv2C Tx PDU, from MME-S11-Interface-IP:30513 to SPGW-S11-Interface-IP:2123 (44)
TEID: 0xB3D0006B, Message type: EGTP_MODIFY_BEARER_REQUEST (0x22)
Sequence Number: 0x7C2220 (8135200)
GTP HEADER
        Version number: 2
        TEID flag: Present
        Piggybacking flag: Not present
        Message Length: 0x0028 (40)

INFORMATION ELEMENTS
        RADIO ACCESS TECH:
            Type: 82  Length: 1  Inst: 0
            Value: EUTRAN (6)
            Hex: 5200 0100 06

        DELAY VALUE:
            Type: 92  Length: 1  Inst: 0
            Value: 1
            Hex: 5C00 0100 01

        BEARER CONTEXT TO BE MODIFIED:
            Type: 93  Length: 18  Inst: 0
            Value:
                EPS BEARER ID:
                    Type: 73  Length: 1  Inst: 0
                    Value: 5
                    Hex: 4900 0100 05

                ENB-DATA FTEID:
                    Type: 87  Length: 9  Inst: 0
                    Value:
                        Interface: ENODE-B S1-U
                        IPv4 Flag: 1
                        IPv6 Flag: 0
                        Teid: 0xE82DD55F
                        IPV4 Addr: eNB-5-IP
                    Hex: 5700 **** **** 2DD5 5F64 **** 0B

            Hex: 5D00 **** **** **** 0557 0009 **** E82D
                 D55F 644D 100B



INBOUND>>>>>  11:50:42:919 Eventid:141004(3)
[MME-S11]GTPv2C Rx PDU, from SPGW-S11-Interface-IP:2123 to MME-S11-Interface-IP:30513 (46)
TEID: 0x808C8020, Message type: EGTP_MODIFY_BEARER_RESPONSE (0x23)
Sequence Number: 0x7C2220 (8135200)
GTP HEADER
        Version number: 2
        TEID flag: Present
        Piggybacking flag: Not present
        Message Length: 0x002A (42)

INFORMATION ELEMENTS
        CAUSE:
            Type: 2  Length: 2  Inst: 0
            Value:
                Cause: EGTP_CAUSE_REQ_ACCEPTED (0x10)
                PCE: 0
                BCE: 0
                CS: 0
            Hex: 0200 0200 1000

        BEARER CONTEXT MODIFIED:
            Type: 93  Length: 24  Inst: 0
            Value:
                EPS BEARER ID:
                    Type: 73  Length: 1  Inst: 0
                    Value: 5
                    Hex: 4900 0100 05

                CAUSE:
                    Type: 2  Length: 2  Inst: 0
                    Value:
                        Cause: EGTP_CAUSE_REQ_ACCEPTED (0x10)
                        PCE: 0
                        BCE: 0
                        CS: 0
                    Hex: 0200 0200 1000

                SGW-DATA FTEID:
                    Type: 87  Length: 9  Inst: 0
                    Value:
                        Interface: SGW S1-U
                        IPv4 Flag: 1
                        IPv6 Flag: 0
                        Teid: 0xB3D6606B
                        IPV4 Addr: SGW-S1U-Interface-IP
                    Hex: 5700 **** **** **** 08

            Hex: 5D00 **** **** **** 0AC8 E908



***CONTROL*** 11:50:42:919 Eventid:147118
imsi 2*************7, MME-EGTPC-BRR-STATE for brr-id 5 changed from MME_EGTPC_STATE_MOD_BRR_REQ_PENDING to MME_EGTPC_STATE_ACTIVE



STEP 8a


<<<<OUTBOUND  11:50:42:919 Eventid:173002(3)
SGS Tx PDU, from MME-SGs-Interface-IP:29118 to MSC-VLR-IP:29118 (51)

 SGs-AP (51 bytes)
  SERVICE_REQUEST(0x6)
    IMSI
      2************7
    SERVICE_INDICATOR
      SMS(0x2)
    IMEISV
      3***************2
    UE_TIME_ZONE
      0x40
    MOBILE_STATION_CLASSMARK_2
      {0x57, 0x58, 0xa6}
        REVISION
        ES_IND
        RF_POWER_CAP
        PS_CAP
        SS_SCREEN_IND
        SM_CAP
        CM3
        LCSVA_CAP
        CMSP
        A5_3
    TRACKING_AREA_IDENTITY
      MCC[2**] MNC[**] TAC[***80]
    E_UTRAN_CELL_GLOBAL_IDENTITY
      MCC[2**] MNC[**] CELLID[0x****4]
    UE_EMM_MODE
      EMM_IDLE(0x0)


STEP 9a - The Text Message itself!

INBOUND>>>>>  11:50:42:958 Eventid:173001(3)
SGS Rx PDU, from MSC-VLR-IP:29118 to MME-SGs-Interface-IP:29118 (49)

 SGs-AP (49 bytes)
  DOWNLINK_UNITDATA(0x7)
    IMSI
      2*************7
    NAS_MESSAGE_CONTAINER
      0x09012101010791447758100650001504
        0c914457758853500000318070110514
        4002b518
         . . . . . . . D w X . . P . . .
         . . D W u . S P . . 1 . p . . .
         . . . .


STEP 9b

<<<<OUTBOUND  11:50:42:958 Eventid:153002(3)
NAS Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-5-IP:36422 (45)

 Non Access Stratum (NAS) (45 bytes)
       NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)
         MAC = 0x****928c
         NAS Count = 0x54
  EPS Mobility Management
    Protocol Discriminator
       EPS MOBILITY MANAGEMENT MESSAGES(0x7)
    Security Header Type
       NAS_MSG_SECURITY_HDR_PLAIN_NAS_MSG(0x0)
    Message Type
       DL_NAS_TRANSPORT(0x62)
    NAS Msg Container
      0x09012101010791447758100650001504
        0c914457758853500000318070110514
        4002b518
         . . . . . . . D w X . . P . . .
         . . D W u . S P . . 1 . p . . .
         . . . .

<<<<OUTBOUND  11:50:42:958 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-5-IP:36422 (73)

 S1 Application Part (S1AP) (73 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   DOWNLINK NAS TRANSPORT (11)
    Criticality
      | 01.. .... | Ignore (1)
    DOWNLINK NAS TRANSPORT Value :
      | .100 0101 | Length Determinant : 69
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 3
            IE : 1
              Protocol IE ID : MME_UE_S1AP_ID (0)
              Criticality
                | 00.. .... | Reject (0)
              MME_UE_S1AP_ID Value :
                | .000 0101 | Length Determinant : 5
                Value :
                  | 11.. .... | Length Determinant : 4
                  33586054 (0x2007b86)
            IE : 2
              Protocol IE ID : eNB_UE_S1AP_ID (8)
              Criticality
                | 00.. .... | Reject (0)
              eNB_UE_S1AP_ID Value :
                | .000 0011 | Length Determinant : 3
                Value :
                  | 01.. .... | Length Determinant : 2
                  2632 (0xa48)
            IE : 3
              Protocol IE ID : NAS_PDU (26)
              Criticality
                | 00.. .... | Reject (0)
              NAS_PDU Value :
                | .010 1110 | Length Determinant : 46
                Value :
                  | .010 1101 | Length Determinant : 45
                  0x272d93928c54aa85e1459b26906f68c5c97401213c4060ceebb39215e64d2c607f5badbd0322a051c57b490d2c
                         NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)
                           MAC = 0x****928c
                           NAS Count = 0x54


STEP 9c


INBOUND>>>>>  11:50:43:016 Eventid:155212(3)
S1AP Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (61)

 S1 Application Part (S1AP) (61 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   UPLINK NAS TRANSPORT (13)
    Criticality
      | 01.. .... | Ignore (1)
    UPLINK NAS TRANSPORT Value :
      | .011 1001 | Length Determinant : 57
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 5
            IE : 1
              Protocol IE ID : MME_UE_S1AP_ID (0)
              Criticality
                | 00.. .... | Reject (0)
              MME_UE_S1AP_ID Value :
                | .000 0101 | Length Determinant : 5
                Value :
                  | 11.. .... | Length Determinant : 4
                  33586054 (0x2007b86)
            IE : 2
              Protocol IE ID : eNB_UE_S1AP_ID (8)
              Criticality
                | 00.. .... | Reject (0)
              eNB_UE_S1AP_ID Value :
                | .000 0011 | Length Determinant : 3
                Value :
                  | 01.. .... | Length Determinant : 2
                  2632 (0xa48)
            IE : 3
              Protocol IE ID : NAS_PDU (26)
              Criticality
                | 00.. .... | Reject (0)
              NAS_PDU Value :
                | .000 1100 | Length Determinant : 12
                Value :
                  | .000 1011 | Length Determinant : 11
                  0x27a06c90d89768eefaac5b
                         NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)
                           MAC = 0x****0d8
                           NAS Count = 0x97

            IE : 4
              Protocol IE ID : EUTRAN_CGI_ID (100)
              Criticality
                | 01.. .... | Ignore (1)
              EUTRAN_CGI_ID Value :
                | .000 1000 | Length Determinant : 8
                Value :
                  | 0... .... | Ext bit : 0
                  Bit map :
                    | .0.. .... | IE Extensions : Not present
                  PLMN Identity
                    0x***451
                  Cell Identity
                    | 0000 0000 | + 20 bits : 0x****114
            IE : 5
              Protocol IE ID : TAI (67)
              Criticality
                | 01.. .... | Ignore (1)
              TAI Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  Bit map :
                    | 0... .... | IE Extensions : Not present
                  PLMN Identity
                    0x***451
                  TAC
                    0x**04


INBOUND>>>>>  11:50:43:016 Eventid:153001(3)
NAS Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (11)

 Non Access Stratum (NAS) (11 bytes)
       NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)
         MAC = 0x****90d8
         NAS Count = 0x97
  EPS Mobility Management
    Protocol Discriminator
       EPS MOBILITY MANAGEMENT MESSAGES(0x7)
    Security Header Type
       NAS_MSG_SECURITY_HDR_PLAIN_NAS_MSG(0x0)
    Message Type
       UL_NAS_TRANSPORT(0x63)
    NAS Msg Container
      0x8904
         . .


STEP 9d


<<<<OUTBOUND  11:50:43:016 Eventid:173002(3)
SGS Tx PDU, from MME-SGs-Interface-IP:29118 to MSC-VLR-IP:29118 (49)

 SGs-AP (49 bytes)
  UPLINK_UNITDATA(0x8)
    IMSI
      2*************7
    NAS_MESSAGE_CONTAINER
      0x8904
         . .
    IMEISV
      3**************2
    UE_TIME_ZONE
      0x40
    MOBILE_STATION_CLASSMARK_2
      {0x57, 0x58, 0xa6}
        REVISION
        ES_IND
        RF_POWER_CAP
        PS_CAP
        SS_SCREEN_IND
        SM_CAP
        CM3
        LCSVA_CAP
        CMSP
        A5_3
    TRACKING_AREA_IDENTITY
      MCC[2**] MNC[**] TAC[***80]
    E_UTRAN_CELL_GLOBAL_IDENTITY
      MCC[2**] MNC[**] CELLID[0x***4]


STEP 10

INBOUND>>>>>  11:50:43:112 Eventid:155212(3)
S1AP Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (68)

 S1 Application Part (S1AP) (68 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   UPLINK NAS TRANSPORT (13)
    Criticality
      | 01.. .... | Ignore (1)
    UPLINK NAS TRANSPORT Value :
      | .100 0000 | Length Determinant : 64
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 5
            IE : 1
              Protocol IE ID : MME_UE_S1AP_ID (0)
              Criticality
                | 00.. .... | Reject (0)
              MME_UE_S1AP_ID Value :
                | .000 0101 | Length Determinant : 5
                Value :
                  | 11.. .... | Length Determinant : 4
                  33586054 (0x2007b86)
            IE : 2
              Protocol IE ID : eNB_UE_S1AP_ID (8)
              Criticality
                | 00.. .... | Reject (0)
              eNB_UE_S1AP_ID Value :
                | .000 0011 | Length Determinant : 3
                Value :
                  | 01.. .... | Length Determinant : 2
                  2632 (0xa48)
            IE : 3
              Protocol IE ID : NAS_PDU (26)
              Criticality
                | 00.. .... | Reject (0)
              NAS_PDU Value :
                | .001 0011 | Length Determinant : 19
                Value :
                  | .001 0010 | Length Determinant : 18
                  0x27cc04c41698fbfe9394bc21d4ecfa567375
                         NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)
                           MAC = 0x****c416
                           NAS Count = 0x98

            IE : 4
              Protocol IE ID : EUTRAN_CGI_ID (100)
              Criticality
                | 01.. .... | Ignore (1)
              EUTRAN_CGI_ID Value :
                | .000 1000 | Length Determinant : 8
                Value :
                  | 0... .... | Ext bit : 0
                  Bit map :
                    | .0.. .... | IE Extensions : Not present
                  PLMN Identity
                    0x***451
                  Cell Identity
                    | 0000 0000 | + 20 bits : 0x****114
            IE : 5
              Protocol IE ID : TAI (67)
              Criticality
                | 01.. .... | Ignore (1)
              TAI Value :
                | .000 0110 | Length Determinant : 6
                Value :
                  Bit map :
                    | 0... .... | IE Extensions : Not present
                  PLMN Identity
                    0x***451
                  TAC
                    0x**04


INBOUND>>>>>  11:50:43:112 Eventid:153001(3)
NAS Rx PDU, from eNB-5-IP:36422 to MME-S1MME-Interface-IP:36412 (18)

 Non Access Stratum (NAS) (18 bytes)
       NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)
         MAC = 0x****c416
         NAS Count = 0x98
  EPS Mobility Management
    Protocol Discriminator
       EPS MOBILITY MANAGEMENT MESSAGES(0x7)
    Security Header Type
       NAS_MSG_SECURITY_HDR_PLAIN_NAS_MSG(0x0)
    Message Type
       UL_NAS_TRANSPORT(0x63)
    NAS Msg Container
      0x890106020141020000
         . . . . . A . . .


STEP 11


<<<<OUTBOUND  11:50:43:112 Eventid:173002(3)
SGS Tx PDU, from MME-SGs-Interface-IP:29118 to MSC-VLR-IP:29118 (56)

 SGs-AP (56 bytes)
  UPLINK_UNITDATA(0x8)
    IMSI
      2*************7
    NAS_MESSAGE_CONTAINER
      0x890106020141020000
         . . . . . A . . .
    IMEISV
      3**************2
    UE_TIME_ZONE
      0x40
    MOBILE_STATION_CLASSMARK_2
      {0x57, 0x58, 0xa6}
        REVISION
        ES_IND
        RF_POWER_CAP
        PS_CAP
        SS_SCREEN_IND
        SM_CAP
        CM3
        LCSVA_CAP
        CMSP
        A5_3
    TRACKING_AREA_IDENTITY
      MCC[2**] MNC[**] TAC[***80]
    E_UTRAN_CELL_GLOBAL_IDENTITY
      MCC[2**] MNC[**] CELLID[0x***4]


STEP 14

INBOUND>>>>>  11:50:43:152 Eventid:173001(3)
SGS Rx PDU, from MSC-VLR-IP:29118 to MME-SGs-Interface-IP:29118 (15)

 SGs-AP (15 bytes)
  DOWNLINK_UNITDATA(0x7)
    IMSI
      2*************7
    NAS_MESSAGE_CONTAINER
      0x0904
         . .

STEP 15

<<<<OUTBOUND  11:50:43:152 Eventid:153002(3)
NAS Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-5-IP:36422 (11)

 Non Access Stratum (NAS) (11 bytes)
       NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)
         MAC = 0x****f7ce
         NAS Count = 0x55
  EPS Mobility Management
    Protocol Discriminator
       EPS MOBILITY MANAGEMENT MESSAGES(0x7)
    Security Header Type
       NAS_MSG_SECURITY_HDR_PLAIN_NAS_MSG(0x0)
    Message Type
       DL_NAS_TRANSPORT(0x62)
    NAS Msg Container
      0x0904
         . .

<<<<OUTBOUND  11:50:43:152 Eventid:155213(3)
S1AP Tx PDU, from MME-S1MME-Interface-IP:36412 to eNB-5-IP:36422 (39)

 S1 Application Part (S1AP) (39 bytes)
  | 0... .... | Ext bit : 0
  | .00. .... | Choice index : Initiating Message (0)
    Procedure Code :   DOWNLINK NAS TRANSPORT (11)
    Criticality
      | 01.. .... | Ignore (1)
    DOWNLINK NAS TRANSPORT Value :
      | .010 0011 | Length Determinant : 35
      Value :
        | 0... .... | Ext bit : 0
          IEs Count : 3
            IE : 1
              Protocol IE ID : MME_UE_S1AP_ID (0)
              Criticality
                | 00.. .... | Reject (0)
              MME_UE_S1AP_ID Value :
                | .000 0101 | Length Determinant : 5
                Value :
                  | 11.. .... | Length Determinant : 4
                  33586054 (0x2007b86)
            IE : 2
              Protocol IE ID : eNB_UE_S1AP_ID (8)
              Criticality
                | 00.. .... | Reject (0)
              eNB_UE_S1AP_ID Value :
                | .000 0011 | Length Determinant : 3
                Value :
                  | 01.. .... | Length Determinant : 2
                  2632 (0xa48)
            IE : 3
              Protocol IE ID : NAS_PDU (26)
              Criticality
                | 00.. .... | Reject (0)
              NAS_PDU Value :
                | .000 1100 | Length Determinant : 12
                Value :
                  | .000 1011 | Length Determinant : 11
                  0x27c5e8f7ce55b8c0730024
                         NAS_MSG_SECURITY_HDR_INTEGRITY_PROTECTED_CIPHERED(0x2)
                           MAC = 0x****7ce
                           NAS Count = 0x55



STEP 16


INBOUND>>>>>  11:50:43:162 Eventid:173001(3)
SGS Rx PDU, from MSC-VLR-IP:29118 to MME-SGs-Interface-IP:29118 (11)

 SGs-AP (11 bytes)
  RELEASE_REQUEST(0x1b)
    IMSI
      2*************7



Source:
My own experience
3GPP TS 23.272
Details about the delivery exchange between MSC and SC can be found in 3GPP TS 23.040