This page will explain only one IPv6 allocation in terms of NAS signaling and NDP (Network Discovery Protocol). If you are new to general IP allocation including PCO and the role of NDP, refer to following pages as well.
Regarding more details on specification, refer to following specifications
- 3GPP 23.401 - 5.3.1.2.2 Allocation, renewal and release of the IPv6 default prefix via IPv6 stateless address autoconfiguration.
- 3GPP 23.060 - 9.2.1.1 Stateless IPv6 Address Autoconfiguration
- 3GPP 29.061-Figure 11bb: Ipv6 Stateless Address Autoconfiguration
- 3GPP 29.061-Figure 11bc: Ipv6 Stateless Address Autoconfiguration for GTP-based S5/S8
- 3GPP 29.061-Figure 11bd: Ipv6 Stateless Address Autoconfiguration for PMIP-based S5/S8
- RFC4862 - IPv6 Stateless Address Autoconfiguration
- RFC6459 - IPv6 in 3rd Generation Partnership Project (3GPP),Evolved Packet System (EPS)
There are several different ways in which IPv6 is allocated. Overall logic is all same, but depending on whether it is for LTE or WCDMA or whether it is IPv6 only or IPv4v6 dual stack, a little bit different NAS message or different IE(Information Element) value.
- Case 1 : IPv6 only allocation in LTE
- Case 2 : IPv4v6 only allocation in WCDMA
- What the NAS Message Actually Carries
- Reference
Case 1 : IPv6 only allocation in LTE
The pictures below show one LTE attach in four steps. The UE asks for a dual stack bearer, the network answers with IPv6 alone, and the address the UE finally uses is not in the NAS message at all. Two of the four steps are NAS and two are ICMPv6.
The panels on the right of the picture above are those two NAS messages. The PDN connectivity request sets its PDN type value to IPv4v6. Its access point name reads 03696D73, which is a length octet followed by ims. The Activate default EPS bearer context request answers with a PDN type value of IPv6, and with a PDN address whose information ends in 01.
The last two steps of that sequence appear again below, with the ICMPv6 packets opened. They carry no NAS. They run in the user plane, on the link the default bearer has just created.
The UE asks for more than it gets : the PDN connectivity request carries PDN type IPv4v6, and the answer carries PDN type IPv6.The NAS answer carries an interface identifier, not an address : the PDN address information ends in 01, and that is the whole of what the network assigns.The Router Solicitation goes from fe80::1 to ff02::2 : the source is the link local address the UE built from the interface identifier the NAS message supplied.The Router Advertisement comes back to one address : from fe80::200:ff:fe00:2 to fe80::1, 110 octets, carrying one prefix information option.The advertised prefix is 2001:0:0:2:: with a prefix length of 64 : the valid lifetime reads 2592000 seconds and the preferred lifetime 604800.
24.301 clause 9.9.4.9 says what that NAS element can do. The PDN address element can assign an IPv4 address to the UE and provide the UE with an interface identifier to be used to build the IPv6 link local address. For PDN type IPv6 the contents are octets 4 to 11, and those eight octets are the interface identifier. The element has no room for a prefix.
23.401 clause 5.3.1.2.2 supplies the other half. The PDN GW allocates a globally unique 64 bit prefix by Router Advertisement. After the default bearer is up the UE may send a Router Solicitation to prompt that advertisement, and the advertisement carries the same prefix the bearer establishment provided.
The two halves meet in the capture. The interface identifier ends in 01, so the link local address is fe80::1, and the solicitation is sent from it. The advertised prefix is 2001:0:0:2:: with a prefix length of 64. The global address is then 2001:0:0:2::1, for a UE that keeps the same interface identifier.
The picture leaves out one field that belongs here too. 24.301 clause 6.5.1.3 requires an ESM cause in the Activate default EPS bearer context request whenever the network restricts the IP version. That cause is 51 for PDN type IPv6 only allowed, or 52 for single address bearers only allowed. The panel opens three branches of the message, so the cause is out of view rather than absent.
The NAS message settles the bottom 64 bits : 24.301 gives PDN type IPv6 an eight octet interface identifier and nothing more.The Router Advertisement settles the top 64 : 23.401 has the PDN GW allocate a globally unique 64 bit prefix that way.The link local address comes first : the UE needs one before it can send a Router Solicitation, which is why the interface identifier travels in NAS.Duplicate address detection is not needed : 23.401 makes the advertised prefix globally unique, so nothing else on the link can hold the same address.
Case 2 : IPv4v6 only allocation in WCDMA
The same four steps run in WCDMA, under different message names and with one real difference in the content. The network here grants both address families, and the NAS message carries a full 128 bit IPv6 address rather than an interface identifier.
The panels on the right of the picture above are the two session management messages. The Activate PDP context request carries a requested PDP address of PDP type IPv4v6. Its access point name reads 0570686F6E65, which is a length octet followed by phone. The Activate PDP context accept carries address information of C0A89D0B2011000000000000010000000000000001.
Those twenty octets split three ways. C0A89D0B is 192.168.157.11. The next eight octets read 2011:0:0:1, and the last eight read 0000000000000001, so the pair of them is 2011:0:0:1::1.
Steps 3 and 4 are shown in more detail below, as they were for LTE.
The requested PDP address names a type and no value : 24.008 clause 10.5.6.4 makes a contents length of 2 mean that no address is included and that dynamic addressing applies.The accept carries 22 octets of contents : two for the organisation and the type, four for the IPv4 address and sixteen for the IPv6 address. That fills the element to the 24 octets 24.008 allows.The Router Solicitation matches the LTE one : from fe80::1 to ff02::2, 62 octets, so this UE built its link local address the same way.The advertised prefix repeats the NAS address : 2011:0:0:1:: with a prefix length of 64, which is the top half of 2011:0:0:1::1.The flag octet reads 0xC0 : RFC 4861 section 4.6.2 puts L and A in the two top bits of that octet, so this advertisement sets both.
29.061 clause 11.2.1.3.2 explains the repetition. The prefix sent in the Router Advertisements shall be identical to the prefix returned in the Create PDP Context Response, and exactly one prefix shall be included. The two values therefore agree by requirement rather than by chance.
The same clause asks for two things this capture does not do. It wants the A flag set and the L flag cleared, because the prefix should not be used for on-link determination, and 0xC0 sets both. It also wants the lifetime of the prefix set to infinity, and the advertisement carries 2592000 and 604800 seconds instead. The box records one network and is left as it arrived.
29.061 clause 11.2.1.3.2 also settles which half of the NAS address matters. It says the IPv6 prefix of such a context is identified by the prefix part of the address only, and that the MS may select any value for the interface identifier part. The one exception is the link local address, whose interface identifier the GGSN assigns so that it cannot collide with the GGSN's own.
Activate PDP Context Request
The first of the two session management messages, decoded in full. It rides inside an RRC uplink direct transfer, so the opening lines of the box are RRC rather than NAS. The fields to find are the requested PDP address, the access point name and the protocol configuration options.
Activate PDP Context Request, decoded from an RRC uplink direct transfer,
DLT: 147, Payload: rrc.ul.dcch (Radio Resource Control (RRC) protocol)
UL-DCCH-Message
integrityCheckInfo
messageAuthenticationCode: 6bec984f [bit length 32, 0110 1011 1110 1100 1001 1000 0100 1111
decimal value 1810667599]
rrc-MessageSequenceNumber: 1
message: uplinkDirectTransfer (27)
uplinkDirectTransfer
cn-DomainIdentity: ps-domain (1)
nas-Message: 0a4105030e000000000000000000000000000002018d2806...
GSM A-I/F DTAP - Activate PDP Context Request
Protocol Discriminator: GPRS session management messages
.... 1010 = Protocol discriminator: GPRS session management messages (0x0a)
0... .... = TI flag: allocated by sender
.000 .... = TIO: 0
01.. .... = Sequence number: 1
DTAP GPRS Session Management Message Type: Activate PDP Context Request (0x41)
Network Service Access Point Identifier - Requested NSAPI
NSAPI: 0x05 (5)
LLC Service Access Point Identifier - Requested LLC SAPI
0000 .... = Spare bit(s): 0
.... 0011 = LLC SAPI: SAPI 3 (3)
Quality Of Service - Requested QoS
Length: 14
00.. .... = Spare bit(s): 0
..00 0... = Quality of Service Delay class: Subscribed delay class
(in MS to network direction) (0)
.... .000 = Reliability class: Subscribed reliability class (in MS to network direction) (0)
0000 .... = Peak throughput: Subscribed peak throughput/reserved (0)
.... 0... = Spare bit(s): 0
.... .000 = Precedence class: Subscribed precedence/reserved (0)
000. .... = Spare bit(s): 0
...0 0000 = Mean throughput: Subscribed peak throughput/reserved (0)
000. .... = Traffic class: Subscribed traffic class/Reserved (0)
...0 0... = Delivery order: Subscribed delivery order/Reserved (0)
.... .000 = Delivery of erroneous SDUs: Subscribed delivery of erroneous SDUs/Reserved (0)
Maximum SDU size: Subscribed maximum SDU size/reserved (0)
Maximum bitrate for uplink: Subscribed maximum bit rate for uplink/reserved (0)
Maximum bitrate for downlink: Subscribed maximum bit rate for downlink/reserved (0)
0000 .... = Residual Bit Error Rate (BER): Subscribed residual BER/Reserved (0)
.... 0000 = SDU error ratio: Subscribed SDU error ratio/Reserved (0)
0000 00.. = Transfer delay: Subscribed transfer delay/reserved (0)
.... ..00 = Traffic handling priority: Subscribed traffic handling priority/Reserved (0)
Guaranteed bitrate for uplink: Subscribed guaranteed bit rate for uplink/reserved (0)
Guaranteed bitrate for downlink: Subscribed guaranteed bit rate for downlink/reserved (0)
000. .... = Spare bit(s): 0
...0 .... = Signalling indication: Not optimised for signalling traffic
.... 0000 = Source statistics description: unknown (0)
Maximum bitrate for downlink (extended): Use the value indicated by
the Maximum bit rate for downlink (0)
Guaranteed bitrate for downlink (extended): Use the value indicated by
the Guaranteed bit rate for downlink (0)
Packet Data Protocol Address - Requested PDP address
Length: 2
0000 .... = Spare bit(s): 0
.... 0001 = PDP type organization: IETF allocated address (1)
PDP type number: IPv4v6 address (141)
Dynamic addressing
Access Point Name
Element ID: 0x28
Length: 6
APN: phone
Protocol Configuration Options
Element ID: 0x27
Length: 29
[Link direction: MS to network (0)]
1... .... = Extension: True
Configuration Protocol: PPP for use with IP PDP type or IP PDN type (0)
Protocol or Container ID: Internet Protocol Control Protocol (0x8021)
Length: 0x10 (16)
PPP IP Control Protocol
Code: Configuration Request (1)
Identifier: 0 (0x00)
Length: 16
Options: (12 bytes), Primary DNS Server IP Address, Secondary DNS Server IP Address
Primary DNS Server IP Address: 0.0.0.0
Type: Primary DNS Server IP Address (129)
Length: 6
Primary DNS Address: 0.0.0.0 (0.0.0.0)
Secondary DNS Server IP Address: 0.0.0.0
Type: Secondary DNS Server IP Address (131)
Length: 6
Secondary DNS Address: 0.0.0.0 (0.0.0.0)
Protocol or Container ID: DNS Server IPv4 Address Request (0x000d)
Length: 0x00 (0)
Protocol or Container ID: DNS Server IPv6 Address Request (0x0003)
Length: 0x00 (0)
Protocol or Container ID: MS Support of Network Requested Bearer Control indicator (0x0005)
Length: 0x00 (0)
The NAS payload is readable from its own hex string : nas-Message opens 0a4105030e. Those five octets are the protocol discriminator, message type 0x41, NSAPI 5, LLC SAPI 3 and a QoS length of 14.Every requested QoS value reads Subscribed : the UE asks for nothing in particular and leaves the whole profile to the network.The requested PDP address is two octets long : IPv4v6 with no value, which 24.008 reads as dynamic addressing.Three containers go up with length zero : 000D for the IPv4 DNS server, 0003 for the IPv6 DNS server, and 0005 for the MS support of network requested bearer control indicator.
The options element has a checkable length. 24.008 clause 10.5.6.3 gives every protocol unit two octets of identifier, one octet of length and then its contents, and codes a container the same way. Count them: one octet for the extension bit and the configuration protocol, nineteen for the IPCP unit, and three for each of the three containers. The total is 29, which is the length the decoder prints.
The unit under 8021 is not 3GPP material. The same clause sends the contents of each protocol unit to the RFC that owns the identifier, and calls those contents a PPP packet with the protocol and padding octets removed. The IPCP configuration request inside, with both of its DNS options set to 0.0.0.0, is therefore RFC 1332 material travelling in a NAS message.
Activate PDP Context Accept
The answer, decoded the same way. The QoS values are real numbers now rather than the word Subscribed, the PDP address carries both families, and the options element answers on two routes at once.
Activate PDP Context Accept, decoded from an RRC downlink direct transfer,
DLT: 147, Payload: rrc.dl.dcch (Radio Resource Control (RRC) protocol)
DL-DCCH-Message
integrityCheckInfo
messageAuthenticationCode: 36d2872b [bit length 32, 0011 0110 1101 0010 1000 0111 0010 1011
decimal value 919766827]
rrc-MessageSequenceNumber: 0
message: downlinkDirectTransfer (5)
downlinkDirectTransfer: r3 (0)
r3
downlinkDirectTransfer-r3
rrc-TransactionIdentifier: 0
cn-DomainIdentity: ps-domain (1)
nas-Message: 8a42030e23920a9396d3fe7400407f005000012b16018dc0...
GSM A-I/F DTAP - Activate PDP Context Accept
Protocol Discriminator: GPRS session management messages
.... 1010 = Protocol discriminator: GPRS session management messages (0x0a)
1... .... = TI flag: allocated by receiver
.000 .... = TIO: 0
01.. .... = Sequence number: 1
DTAP GPRS Session Management Message Type: Activate PDP Context Accept (0x42)
LLC Service Access Point Identifier - Negotiated LLC SAPI
0000 .... = Spare bit(s): 0
.... 0011 = LLC SAPI: SAPI 3 (3)
Quality Of Service - Negotiated QoS
Length: 14
00.. .... = Spare bit(s): 0
..10 0... = Quality of Service Delay class: Delay class 4 (best effort) (4)
.... .011 = Reliability class: Unacknowledged GTP/LLC, Ack RLC, Protected data (3)
1001 .... = Peak throughput: Up to 256 000 octet/s (9)
.... 0... = Spare bit(s): 0
.... .010 = Precedence class: Normal priority (2)
000. .... = Spare bit(s): 0
...0 1010 = Mean throughput: 100 000 octet/h (10)
100. .... = Traffic class: Background class (4)
...1 0... = Delivery order: Without delivery order ('no') (2)
.... .011 = Delivery of erroneous SDUs: Erroneous SDUs are not delivered('No') (3)
Maximum SDU size: 1500 octets (150)
Maximum bitrate for uplink: 5888 kbps (211)
Maximum bitrate for downlink: 8640 kbps (254)
0111 .... = Residual Bit Error Rate (BER): 1*10-5 (7)
.... 0100 = SDU error ratio: 1*10-4 (4)
0000 00.. = Transfer delay: Subscribed transfer delay/reserved (0)
.... ..00 = Traffic handling priority: Subscribed traffic handling priority/Reserved (0)
Guaranteed bitrate for uplink: 64 kbps (64)
Guaranteed bitrate for downlink: 568 kbps (127)
000. .... = Spare bit(s): 0
...0 .... = Signalling indication: Not optimised for signalling traffic
.... 0000 = Source statistics description: unknown (0)
Maximum bitrate for downlink (extended): 22 Mbps (80)
Guaranteed bitrate for downlink (extended): Use the value indicated by
the Guaranteed bit rate for downlink (0)
Radio Priority
Radio Priority (PDP or SMS): priority level 1 (highest) (1)
Packet Data Protocol Address - PDP address
Element ID: 0x2b
Length: 22
0000 .... = Spare bit(s): 0
.... 0001 = PDP type organization: IETF allocated address (1)
PDP type number: IPv4v6 address (141)
IPv4 address: 192.168.157.11 (192.168.157.11)
IPv6 address: 2011:0:0:1::1 (2011:0:0:1::1)
Protocol Configuration Options
Element ID: 0x27
Length: 40
[Link direction: Network to MS (1)]
1... .... = Extension: True
Configuration Protocol: PPP for use with IP PDP type or IP PDN type (0)
Protocol or Container ID: Internet Protocol Control Protocol (0x8021)
Length: 0x0a (10)
PPP IP Control Protocol
Code: Configuration Nak (3)
Identifier: 0 (0x00)
Length: 10
Options: (6 bytes), Primary DNS Server IP Address
Primary DNS Server IP Address: 192.168.157.18
Type: Primary DNS Server IP Address (129)
Length: 6
Primary DNS Address: 192.168.157.18 (192.168.157.18)
Protocol or Container ID: DNS Server IPv4 Address (0x000d)
Length: 0x04 (4)
IPv4: 192.168.157.18
Protocol or Container ID: DNS Server IPv6 Address (0x0003)
Length: 0x10 (16)
IPv6: 2011:0:0:1::2
The QoS profile arrives filled in : background traffic class, a maximum bitrate of 5888 kbps up and 8640 kbps down, and 22 Mbps on the extended downlink field.Both addresses arrive together : 192.168.157.11 and 2011:0:0:1::1, inside one 22 octet element.The IPCP answer is a Configuration Nak : the UE proposed 0.0.0.0 for both DNS servers, so the network corrects the primary rather than acknowledging the request.Only the primary DNS returns on the PPP route : the options field is six octets where the request carried twelve.Container 0005 does not come back : 24.008 names the downlink 0005 Selected Bearer Control Mode, and its absence leaves the MS on bearer control mode MS only.
The downlink options element adds up the same way. Count them again: one octet for the extension bit and the configuration protocol, thirteen for the IPCP unit, seven for the IPv4 DNS container, and nineteen for the IPv6 one. The total is 40.
One identifier changes meaning with direction here as well. 24.008 lists 000D as DNS Server IPv4 Address Request from the MS and as DNS Server IPv4 Address from the network, and treats 0003 the same way for IPv6. Going up they carry nothing. Coming down they carry four octets and sixteen.
The two routes do not say the same thing. The IPCP Nak names 192.168.157.18 as the primary DNS server and is silent about a secondary, while container 000D names that same address and container 0003 adds 2011:0:0:1::2. A UE reading only the PPP route gets no IPv6 DNS server at all.
The accept answers on two routes : the PPP negotiation under 8021, and the container list beside it.The container route is the one that carries IPv6 : IPCP has no option for an IPv6 DNS server.The length fields are all checkable : 22 for the PDP address, 40 for the options, and 10 for the IPCP unit.The values belong to one network : nothing in either box was corrected against a specification.
What the NAS Message Actually Carries
The two cases put different things in the same place, and that difference is the point of this page. The diagram below sets the two information elements side by side at the same scale, with the values from the captures underneath them.
The PDN address element of 24.301 beside the packet data protocol address element of 24.008, one octet per column and both at the same scale. The values under them come from the two captures on this page.
24.301 clause 9.9.4.9 keeps the LTE element small on purpose. The PDN address is a type 4 element of 7 to 15 octets. For PDN type IPv6 the contents run from octet 4 to octet 11, and the clause calls them an interface identifier to be used to build the IPv6 link local address.
24.008 clause 10.5.6.4 allows far more room. The packet data protocol address runs to 24 octets. For PDP type IPv4v6 octets 5 to 8 hold the IPv4 address and octets 9 to 24 hold the IPv6 address, all 128 bits of it.
Most of that room goes unused. 29.061 clause 11.2.1.3.2 says the IPv6 prefix of such a context is identified by the prefix part of the address only, and that the MS may select any value for the interface identifier part. 23.401 clause 5.3.1.2.2 is blunter for EPS: if the UE receives an IPv6 prefix from an SGSN during the PDP context activation procedure, it shall ignore it.
So the prefix in the WCDMA NAS message is advisory and the one in the Router Advertisement is binding. The LTE message carries only the part that has to travel in NAS. The UE needs a link local address before it can send the Router Solicitation at all.
One element carries 8 octets and the other 16 : 24.301 sends an interface identifier, and 24.008 sends a whole address.Only the lower 64 bits bind in either case : the prefix arrives in the Router Advertisement both times.The interface identifier has one required use : the link local address, so that the UE and the gateway cannot collide on the link they share.A UE may pick its own identifier for the global address : 23.401 and 29.061 both say so, and neither involves the network in that choice.
Reference
[1] 24.301 : 3GPP - Non-Access-Stratum protocol for EPS; Stage 3, v20.0.0. Clause 9.9.4.9 gives the PDN address element and its IPv6 interface identifier, and clause 6.5.1.3 gives the ESM cause sent when the network restricts the IP version.
[2] 24.008 : 3GPP - Mobile radio interface Layer 3 specification; Core network protocols; Stage 3, v20.0.0. Clause 10.5.6.4 gives the packet data protocol address, and clause 10.5.6.3 gives the protocol configuration options with a container identifier list for each direction.
[3] 23.401 : 3GPP - GPRS enhancements for E-UTRAN access, v20.0.0. Clause 5.3.1.2.2 gives the 64 bit prefix by Router Advertisement, the interface identifier for the link local address, and the rule that a prefix from an SGSN is ignored.
[4] 29.061 : 3GPP - Interworking between the PLMN supporting packet based services and PDNs, v20.0.0. Clause 11.2.1.3.2 gives the stateless autoconfiguration procedure, the flags and lifetime required in the prefix information option, and the prefix part as the only binding half of the address.
[5] RFC 4861 : IETF - Neighbor Discovery for IP version 6. Section 4.6.2 gives the prefix information option, whose flag octet opens with L and then A. Only that section was read for this page.