转载自：https://www.freesion.com/article/98531378588/， 用于个人保存使用，感谢那位博主。

LTE网络注册流程（1）

最近在学习lte网络相关内容，并做些简单记录，并且结合高通平台的qxdm log做简要分析。

首先，介绍下lte注册的总体流程，后续再完善整体结构，至于lte注册信令流程，网上搜索就有一堆的资料，笔者就不再上传了。

1.设备开机，plmn 选择，小区选择
plmn = mcc+mnc
过程如下，开机后，先从设备sim卡中获取上次注册的plmn,如果获取不到，则需要进行全频段扫描，获取一个Plmn列表，从中选择一个Plmn，选定Plmn后根据其对应频点找到同步信号，与小区进行时频的同步，从而获取小区的系统信息。

2.接收系统信息
系统信息，下图主要表示各个消息的作用。

接收到系统信息后，测量小区信号强度，判断小区是否能够驻留。小区的系统信息允许终端驻留，终端就会驻留到目标小区，并且选中该小区所在的Plmn，至此，目标小区就变成终端的服务小区。

3.随机接入
随机接入是终端与基站建立联系的过程，随机接入后，终端才能实现与小区的同步。与随机接入相关的消息MSG1-MSG4.

随机接入后，终端与基站建立起srb1，成功建立了rrc连接，后面就需要进行附着过程。

4.附着，建立默认承载
lte附着过程存在两个特点
双向鉴权，建立默认承载

附着过程包括，请求附着，获取终端用户id，鉴权，启动Nas信令安全通信，接受附着，建立srb2和默认承载完成附着。如下图

至此，lte注册流程就跑完了，下面贴上一张终端log图

关于附着之前的log没有抓取到，这里就不贴出来来了，后面我会对没一步具体介绍也做个简单的记录的，特么一些消息的重要信息

LTE网络注册流程（2）

本文说说lte系统信息吧，分为Mib和sib，sib系统信息存在sib1-sib12，主要介绍下mib,sib1 sib2 sib3 sib4 sib4的作用。

mib:
mib包含了非常重要的系统信息，包括小区标识（PCI），频率，当前系统帧号，发射天线个数及小区带宽，phich信道配置。

sib1信息
sib1也是重要的系统信息，终端附着到lte网络必不可少的，包含如plmn值，小区选择准则，小区工作频段指示，其他sib消息的调度信息。

sib2信息
sib2也携带了重要的系统信息，比如小区是否阻塞，是否允许UE驻留小区，所有物理信道配置，一些重要定时器的配置。

各种信道配置我也没整明白，下面就说主要定时器的作用。
T300：RRC 连接建立定时器
T301定时器：RRC重建定时器
T310：下行失步定时器
N310： 接受失步指示最大数目，与t310相关
等
如果需要了解，请自己去查下lte 各种定时器作用。

SIB3消息
包含了小区选择和重选的相关信息。

sib4,sib5
sib4包含lte网络内同频相邻小区信息，sib5包含lte网络内异频或者不同频段的相邻小区信息，主要包含了该小区的具体频率值，重选该小区的门限，小区重选优先级等。

关于小区重选准则如下：
1.向优先级高的小区重选
高优先级小区信号强度在指定时间内大于指定门限
ue在当前服务小区驻留时间大于1s
2.向同优先级小区重选
同等优先级小区的信号强度必须指定时间内持续大于当前服务小区信号强度
ue在当前服务小区驻留时间大于1s
3.向低优先级小区重选
没有优先级等于或者高于当前服务小区的优先级的小区的信号强度大于指定门限
当前服务小区信号强度小于指定门限
候选的低优先级小区信号强度指定时间内持续大于指定门限
ue在当前服务小区驻留时间大于1s

关于小区测量准则
1.如果服务小区是最高优先级小区，其信号强度持续时间内高于指定门限 不测量
2.如果服务小区的信号强度小于指定门限， 需要测量 系统内同异频小区信号强度
3.如果服务小区不是最高优先级小区，需要周期性测量比服务小区高优先级的小区信号强度
低于服务小区优先级的，只有服务小区信号强度小于指定门限时才会去测量。

LTE网络注册流程（3）

本文介绍下下lte网络注册的附着和建立默认承载的过程之中消息分析.

1.attach request
消息中主要包括：
EPS attach type 数据业务附着类型
EPS Mobile identity 终端用户标识（IMSI or GUTI）
UE Network Capbility 终端支持哪些加密和完整性保护算法
Tracking Area Identity 最后访问跟踪区TA
DRX Parameter 不连续接受配置
voice domain preference and UE’S Usage setting 语音业务参数
注意：建立默认承载的请求也在其中，这里就是lte中的又一大特色，一条rrc信令上搭载两条nas消息。

下面为一个消息具体示例

1.   22:52:12.665 [0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
2.   pkt_version = 1 (0x1)
3.   rel_number = 9 (0x9)
4.   rel_version_major = 5 (0x5)
5.   rel_version_minor = 0 (0x0)
6.   security_header_or_skip_ind = 0 (0x0)
7.   prot_disc = 7 (0x7) (EPS mobility management messages)
8.   msg_type = 65 (0x41) (Attach request)
9.   lte_emm_msg
10.   emm_attach_request
11.   tsc = 0 (0x0) (cached sec context)
12.   nas_key_set_id = 3 (0x3)
13.   att_type = 2 (0x2) (combined EPS/IMSI attach) //附着类型
14.   eps_mob_id //终端用户标识
15.   id_type = 6 (0x6) (GUTI) //GUTI
16.   odd_even_ind = 0 (0x0)
17.   Guti_1111 = 15 (0xf)
18.   mcc_1 = 3 (0x3) //MCC MNC
19.   mcc_2 = 1 (0x1)
20.   mcc_3 = 1 (0x1)
21.   mnc_3 = 0 (0x0)
22.   mnc_1 = 4 (0x4)
23.   mnc_2 = 8 (0x8)
24.   MME_group_id = 0 (0x0)
25.   MME_code = 0 (0x0)
26.   m_tmsi = 0 (0x0)
27.   ue_netwk_cap //终端支持哪些加密和完整性保护算法
28.   EEA0 = 1 (0x1) //lte加密算法支持能力
29.   EEA1_128 = 1 (0x1)
30.   EEA2_128 = 1 (0x1)
31.   EEA3_128 = 1 (0x1)
32.   EEA4 = 0 (0x0)
33.   EEA5 = 0 (0x0)
34.   EEA6 = 0 (0x0)
35.   EEA7 = 0 (0x0)
36.   EIA0 = 0 (0x0) //lte完整性保护算法支持能力
37.   EIA1_128 = 1 (0x1)
38.   EIA2_128 = 1 (0x1)
39.   EIA3_128 = 1 (0x1)
40.   EIA4 = 0 (0x0)
41.   EIA5 = 0 (0x0)
42.   EIA6 = 0 (0x0)
43.   EIA7 = 0 (0x0)
44.   oct5_incl = 1 (0x1)
45.   UEA0 = 1 (0x1) //3g加密算法支持能力
46.   UEA1 = 1 (0x1)
47.   UEA2 = 0 (0x0)
48.   UEA3 = 0 (0x0)
49.   UEA4 = 0 (0x0)
50.   UEA5 = 0 (0x0)
51.   UEA6 = 0 (0x0)
52.   UEA7 = 0 (0x0)
53.   oct6_incl = 1 (0x1)
54.   UCS2 = 0 (0x0)
55.   UIA1 = 1 (0x1) //3G完整性保护算法的支持能力
56.   UIA2 = 0 (0x0)
57.   UIA3 = 0 (0x0)
58.   UIA4 = 0 (0x0)
59.   UIA5 = 0 (0x0)
60.   UIA6 = 0 (0x0)
61.   UIA7 = 0 (0x0)
62.   oct7_incl = 1 (0x1)
63.   ProSedd = 0 (0x0)
64.   ProSe = 0 (0x0)
65.   H_245_ASH = 0 (0x0)
66.   ACC_CSFB = 1 (0x1)
67.   LPP = 1 (0x1)
68.   LCS = 0 (0x0)
69.   vcc_1xsr = 0 (0x0)
70.   NF = 1 (0x1)
71.   oct8_incl = 0 (0x0)
72.   oct9_incl = 0 (0x0)
73.   oct10_incl = 0 (0x0)
74.   oct11_incl = 0 (0x0)
75.   oct12_incl = 0 (0x0)
76.   oct13_incl = 0 (0x0)
77.   oct14_incl = 0 (0x0)
78.   oct15_incl = 0 (0x0)
79.   esm_msg_container //**默认承载
80.   eps_bearer_id_or_skip_id = 0 (0x0)
81.   prot_disc = 2 (0x2) (EPS session management messages)
82.   trans_id = 1 (0x1)
83.   msg_type = 208 (0xd0) (PDN connectivity request) //**默认承载请求
84.   lte_esm_msg
85.   pdn_connectivity_req
86.   pdn_type = 3 (0x3) (Ipv4v6) //PDN 类型
87.   req_type = 1 (0x1) (initial request) //请求类型
88.   info_trans_flag_incl = 1 (0x1)
89.   esm_info_trans_flag = 1 (0x1)
90.   access_pt_name_incl = 0 (0x0)
91.   prot_config_incl = 1 (0x1)
92.   prot_config
93.   ext = 1 (0x1)
94.   conf_prot = 0 (0x0)
95.   num_recs = 3 (0x3)
96.   sm_prot[0]
97.   protocol_id = 32801 (0x8021) (IPCP)
98.   prot_len = 16 (0x10)
99.   ipcp_prot
100.   ipcp_prot_id = 1 (0x1) (CONF_REQ)
101.   identifier = 0 (0x0)
102.   rfc1332_conf_req
103.   num_options = 2 (0x2)
104.   conf_options[0]
105.   type = 129 (0x81)
106.   rfc1877_primary_dns_server_add
107.   length = 6 (0x6)
108.   ip_addr = 0 (0x0) (0.0.0.0)
109.   conf_options[1]
110.   type = 131 (0x83)
111.   rfc1877_sec_dns_server_add
112.   length = 6 (0x6)
113.   ip_addr = 0 (0x0) (0.0.0.0)
114.   sm_prot[1]
115.   protocol_id = 13 (0xd) (DNS Server IPv4 Address Requestt)
116.   prot_len = 0 (0x0)
117.   sm_prot[2]
118.   protocol_id = 3 (0x3) (DNS Server IPv6 Addr Req)
119.   prot_len = 0 (0x0)
120.   num_recs2 = 6 (0x6)
121.   sm_container[0]
122.   container_id = 65280 (0xff00) (unknown)
123.   container_len = 3 (0x3)
124.   container_contents[0] = 19 (0x13)
125.   container_contents[1] = 1 (0x1)
126.   container_contents[2] = 132 (0x84)
127.   sm_container[1]
128.   container_id = 1 (0x1) (P-CSCF IPv6 Address Request)
129.   container_len = 0 (0x0)
130.   sm_container[2]
131.   container_id = 12 (0xc) (P-CSCF IPv4 Address Request)
132.   container_len = 0 (0x0)
133.   sm_container[3]
134.   container_id = 10 (0xa) (IP address allocation via NAS signalling)
135.   container_len = 0 (0x0)
136.   sm_container[4]
137.   container_id = 5 (0x5) (NWK Req Bearer Control indicator)
138.   container_len = 0 (0x0)
139.   sm_container[5]
140.   container_id = 16 (0x10) (Ipv4 Link MTU Request)
141.   container_len = 0 (0x0)
142.   dev_properties_incl = 0 (0x0)
143.   nbifom_incl = 0 (0x0)
144.   header_compression_config_inclu = 0 (0x0)
145.   ext_prot_config_incl = 0 (0x0)
146.   p_tmsi_sig_incl = 0 (0x0)
147.   add_guti_incl = 0 (0x0)
148.   reg_tai_incl = 1 (0x1)
149.   tracking_area_id
150.   mcc_mnc
151.   mcc_1 = 3 (0x3)
152.   mcc_2 = 1 (0x1)
153.   mcc_3 = 1 (0x1)
154.   mnc_3 = 0 (0x0)
155.   mnc_1 = 4 (0x4)
156.   mnc_2 = 8 (0x8)
157.   tracking_area_id = 11 (0xb)
158.   drx_params_incl = 1 (0x1)
159.   drx_params
160.   split_pg_cycle_code = 10 (0xa)
161.   cycle_len_coeff = 0 (0x0)
162.   split_on_ccch = 0 (0x0)
163.   non_drx_timer = 0 (0x0)
164.   ms_netwk_cap_incl = 1 (0x1)
165.   ms_netwk_cap
166.   length = 3 (0x3)
167.   r99 = 1 (0x1)
168.   GEA1 bits
169.   GEA/1 = 1 (0x1)
170.   SM capabilities via dedicated channels = 1 (0x1)
171.   SM capabilities via GPRS channels = 1 (0x1)
172.   UCS2 support = 0 (0x0)
173.   SS Screening Indicator = 1 (0x1)
174.   SoLSA Capability = 0 (0x0)
175.   Revision level indicator = 1 (0x1)
176.   PFC feature mode = 1 (0x1)
177.   Extended GEA bits
178.   GEA/2 = 1 (0x1)
179.   GEA/3 = 1 (0x1)
180.   GEA/4 = 0 (0x0)
181.   GEA/5 = 0 (0x0)
182.   GEA/6 = 0 (0x0)
183.   GEA/7 = 0 (0x0)
184.   LCS VA capability = 0 (0x0)
185.   PS inter-RAT HO from GERAN to UTRAN Iu mode capability = 0 (0x0)
186.   PS inter-RAT HO from GERAN to E-UTRAN S1 mode capability = 0 (0x0)
187.   EMM Combined procedures Capability = 1 (0x1)
188.   ISR support = 1 (0x1)
189.   SRVCC to GERAN/UTRAN capability = 1 (0x1)
190.   EPC capability = 1 (0x1)
191.   NF capability = 1 (0x1)
192.   spare_bits0_count = 0 (0x0)
193.   old_loc_area_id_incl = 0 (0x0)
194.   tmsi_stat_incl = 1 (0x1)
195.   tmsi_stat
196.   tmsi_flag = 0 (0x0)
197.   ms_class_mark2_incl = 1 (0x1)
198.   ms_class_mark2
199.   rev_level = 2 (0x2)
200.   es_ind = 0 (0x0)
201.   a5_1_alg_sup = 1 (0x1)
202.   rf_power_cap = 7 (0x7)
203.   pseudo_sync_cap = 0 (0x0)
204.   ss_screen_ind = 1 (0x1)
205.   sm_cap = 1 (0x1)
206.   vbs = 0 (0x0)
207.   vgcs = 0 (0x0)
208.   freq_cap = 0 (0x0)
209.   class_3_avail = 1 (0x1)
210.   lcsva_cap = 1 (0x1)
211.   ucs2 = 0 (0x0)
212.   solsa = 0 (0x0)
213.   cmsp = 1 (0x1)
214.   a5_3_alg_sup = 0 (0x0)
215.   a5_2_alg_sup = 0 (0x0)
216.   ms_class_mark3_incl = 0 (0x0)
217.   supp_codecs_incl = 1 (0x1)
218.   supp_codecs
219.   num_codecs = 2 (0x2)
220.   codecs[0]
221.   sysid = 4 (0x4)
222.   length = 2 (0x2)
223.   bitmap[0] = 96 (0x60)
224.   bitmap[1] = 4 (0x4)
225.   codecs[1]
226.   sysid = 0 (0x0)
227.   length = 2 (0x2)
228.   bitmap[0] = 31 (0x1f)
229.   bitmap[1] = 2 (0x2)
230.   add_update_type_incl = 0 (0x0)
231.   voice_domain_pref_incl = 1 (0x1)
232.   voice_domain_pref //语音业务相关参数
233.   length = 1 (0x1)
234.   UE_usage_setting = 1 (0x1) (Data centric)
235.   //volte 优先 cs语音
236.   voice_domain_pref_for_EUTRAN = 3 (0x3) (IMS PS Voice preferred, CS Voice as secondary)
237.   dev_properties_incl = 0 (0x0)
238.   old_guti_incl = 0 (0x0)
239.   ms_network_feature_incl = 1 (0x1)
240.   ms_network_feature_support
241.   ext_periodic_timers = 1 (0x1)
242.   network_resource_id_container_incl = 0 (0x0)
243.   t3324_incl = 0 (0x0)
244.   t3412_ext_incl = 0 (0x0)
245.   ext_drx_par_incl = 0 (0x0)
246.   ue_add_security_cap_incl = 0 (0x0)
247.   ue_status_incl = 0 (0x0)

2.获取终端id

1.   //请求
2.   22:52:12.897 [0xB0EC] LTE NAS EMM Plain OTA Incoming Message
3.   pkt_version = 1 (0x1)
4.   rel_number = 9 (0x9)
5.   rel_version_major = 5 (0x5)
6.   rel_version_minor = 0 (0x0)
7.   security_header_or_skip_ind = 0 (0x0)
8.   prot_disc = 7 (0x7) (EPS mobility management messages)
9.   msg_type = 85 (0x55) (Identity request) //获取终端id请求
10.   lte_emm_msg
11.   emm_id_req
12.   identity_type_2
13.   type_of_identity = 1 (0x1) //终端id类型（imsi or guti）
14.   //响应
15.   22:52:12.897 [0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
16.   pkt_version = 1 (0x1)
17.   rel_number = 9 (0x9)
18.   rel_version_major = 5 (0x5)
19.   rel_version_minor = 0 (0x0)
20.   security_header_or_skip_ind = 0 (0x0)
21.   prot_disc = 7 (0x7) (EPS mobility management messages)
22.   msg_type = 86 (0x56) (Identity response)
23.   lte_emm_msg
24.   emm_id_resp
25.   mobile_identity
26.   id_type_check = 9 (0x9)
27.   ident_type = 1 (0x1)
28.   odd_even_ind = 1 (0x1)
29.   num_ident = 15 (0xf) //获取到的Imsi 311480123456789
30.   ident[0] = 3 (0x3)
31.   ident[1] = 1 (0x1)
32.   ident[2] = 1 (0x1)
33.   ident[3] = 4 (0x4)
34.   ident[4] = 8 (0x8)
35.   ident[5] = 0 (0x0)
36.   ident[6] = 1 (0x1)
37.   ident[7] = 2 (0x2)
38.   ident[8] = 3 (0x3)
39.   ident[9] = 4 (0x4)
40.   ident[10] = 5 (0x5)
41.   ident[11] = 6 (0x6)
42.   ident[12] = 7 (0x7)
43.   ident[13] = 8 (0x8)
44.   ident[14] = 9 (0x9)

3.鉴权和安全通信
这里消息就不列出来了
鉴权过程，是双向鉴权，首先mme 给ue 转发鉴权请求，ue收到鉴权消息后会对网络进行鉴权，确认网络身份后，利用鉴权算法获取响应消息返回给网络，网络在通过响应对ue进行鉴权，判断用户是否为合法用户。

安全通信其实就是ue和网络商量出一组加密算法，作为相互传递消息时使用的，最终建立起安全通信。

4.接受附着
这里注意里终端用户在成功附着的同时，也会发生位置更新。
下面接受attach accept消息，主要包括下面内容：跟踪区TA列表，MME为终端分配的guti标识，定时器餐宿，EPS网络配置参数。

1.   22:52:13.806 [0xB0EC] LTE NAS EMM Plain OTA Incoming Message
2.   pkt_version = 1 (0x1)
3.   rel_number = 9 (0x9)
4.   rel_version_major = 5 (0x5)
5.   rel_version_minor = 0 (0x0)
6.   security_header_or_skip_ind = 0 (0x0)
7.   prot_disc = 7 (0x7) (EPS mobility management messages)
8.   msg_type = 66 (0x42) (Attach accept)
9.   lte_emm_msg
10.   emm_attach_accept
11.   attach_result = 1 (0x1) (EPS only) //附着结果
12.   t3412
13.   unit = 7 (0x7)
14.   timer_value = 1 (0x1)
15.   tai_list //TA列表
16.   num_tai_list = 1 (0x1)
17.   tai_list[0]
18.   list_type = 0 (0x0)
19.   num_element = 0 (0x0)
20.   mcc_mnc //网络的mcc mnc
21.   mcc_1 = 3 (0x3)
22.   mcc_2 = 1 (0x1)
23.   mcc_3 = 1 (0x1)
24.   mnc_3 = 0 (0x0)
25.   mnc_1 = 4 (0x4)
26.   mnc_2 = 8 (0x8)
27.   tac[0] = 11 (0xb)
28.   esm_msg_container
29.   eps_bearer_id_or_skip_id = 5 (0x5)
30.   prot_disc = 2 (0x2) (EPS session management messages)
31.   trans_id = 1 (0x1)
32.   msg_type = 193 (0xc1) (Activate default EPS bearer context request)
33.   lte_esm_msg
34.   act_def_eps_bearer_context_req
35.   eps_qos //qos服务质量
36.   qci = 5 (0x5) (QC5)
37.   oct4_incl = 0 (0x0)
38.   oct5_incl = 0 (0x0)
39.   oct6_incl = 0 (0x0)
40.   oct7_incl = 0 (0x0)
41.   oct8_incl = 0 (0x0)
42.   oct9_incl = 0 (0x0)
43.   oct10_incl = 0 (0x0)
44.   oct11_incl = 0 (0x0)
45.   oct12_incl = 0 (0x0)
46.   oct13_incl = 0 (0x0)
47.   oct14_incl = 0 (0x0)
48.   oct15_incl = 0 (0x0)
49.   access_point //接入方式，或者apn信息 apn 为ims
50.   num_acc_pt_val = 4 (0x4)
51.   acc_pt_name_val[0] = 3 (0x3) (length)
52.   acc_pt_name_val[1] = 105 (0x69) (i)
53.   acc_pt_name_val[2] = 109 (0x6d) (m)
54.   acc_pt_name_val[3] = 115 (0x73) (s)
55.   pdn_addr //pdn 地址
56.   pdn_addr_len = 9 (0x9)
57.   pdn_type = 2 (0x2) (IPv6)
58.   ipv6_interface_id = 0x000000000000001 (0:0:0:1)
59.   trans_id_incl = 1 (0x1)
60.   trans_id
61.   length = 1 (0x1)
62.   ti_flag = 0 (0x0)
63.   ti_value = 0 (0x0)
64.   qos_incl = 0 (0x0)
65.   llc_sapi_incl = 0 (0x0)
66.   radio_priority_incl = 0 (0x0)
67.   pkt_flow_id_incl = 0 (0x0)
68.   apn_ambr_incl = 0 (0x0)
69.   esm_cause_incl = 1 (0x1)
70.   esm_cause
71.   esm_cause = 51 (0x33) (PDN type IPv6 only allowed)
72.   prot_config_incl = 1 (0x1)
73.   prot_config
74.   ext = 1 (0x1)
75.   conf_prot = 0 (0x0)
76.   num_recs = 0 (0x0)
77.   num_recs2 = 2 (0x2)
78.   sm_container[0]
79.   container_id = 3 (0x3) (DNS Server IPv6 Address)
80.   container_len = 16 (0x10)
81.   address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
82.   sm_container[1]
83.   container_id = 1 (0x1) (P-CSCF IPV6 Address)
84.   container_len = 16 (0x10)
85.   address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
86.   connectivity_type_incl = 0 (0x0)
87.   wlan_offload_acceptability_incl = 0 (0x0)
88.   nbifom_incl = 0 (0x0)
89.   header_compression_config_inclu = 0 (0x0)
90.   ctrl_plane_only_ind_incl = 0 (0x0)
91.   ext_prot_config_incl = 0 (0x0)
92.   serv_plmn_rate_ctrl_incl = 0 (0x0)
93.   ext_apn_ambr_incl = 0 (0x0)
94.   ext_eps_qos_incl = 0 (0x0)
95.   guti_incl = 1 (0x1)
96.   guti //guti标识
97.   id_type = 6 (0x6) (GUTI)
98.   odd_even_ind = 0 (0x0)
99.   Guti_1111 = 15 (0xf)
100.   mcc_1 = 3 (0x3)
101.   mcc_2 = 1 (0x1)
102.   mcc_3 = 1 (0x1)
103.   mnc_3 = 0 (0x0)
104.   mnc_1 = 4 (0x4)
105.   mnc_2 = 8 (0x8)
106.   MME_group_id = 0 (0x0)
107.   MME_code = 0 (0x0)
108.   m_tmsi = 0 (0x0)
109.   loc_id_incl = 0 (0x0)
110.   ms_id_incl = 0 (0x0)
111.   emm_cause_incl = 1 (0x1)
112.   emm_cause
113.   cause_value = 18 (0x12) (CS domain not available)
114.   T3402_incl = 0 (0x0)
115.   T3423_incl = 0 (0x0)
116.   equ_plmns_incl = 0 (0x0)
117.   emergnecy_num_list_incl = 0 (0x0)
118.   eps_netwk_feature_support_incl = 1 (0x1)
119.   eps_netwk_feature_support //网络特性描述
120.   length = 1 (0x1)
121.   CPCIoT = 0 (0x0)
122.   ERwoPDN = 0 (0x0)
123.   ESRPS = 0 (0x0)
124.   CS_LCS = 0 (0x0) (No info about support of loc service via cs is available)
125.   EPC_LCS = 0 (0x0) (Location Services via EPC not supported)
126.   EMC_BS = 1 (0x1) (Emergency bearer services in S1 Mode supported)
127.   IMSVoPS = 1 (0x1) (IMS Vo PS Session in S1 Mode supported)
128.   add_update_result_incl = 0 (0x0)
129.   t3412_ext_incl = 0 (0x0)
130.   t3324_incl = 0 (0x0)
131.   ext_drx_par_incl = 0 (0x0)
132.   dcn_id_incl = 0 (0x0)
133.   sms_srvc_status_incl = 0 (0x0)
134.   non_3gpp_access_emerg_num_policy_incl = 0 (0x0)
135.   t3448_incl = 0 (0x0)
136.   nwk_policy_incl = 0 (0x0)
137.   t3447_ext_incl = 0 (0x0)
138.   ext_emergency_number_incl = 0 (0x0)
139.   cipher_ket_data_incl = 0 (0x0)

5.建立默认承载
消息中包括默认承载id，qos参数，分配的ip地址，dns地址，默认apn，来自hss的签约信息。

备注qci含义：
GBR
QCI=1: Example Services: Conversational voicemscbsc
　　QCI=2: Conversational Video (Live streaming)
　　QCI=3: Real Time Gaming
　　QCI=4: Non-conversational voice (buffered streaming)
Non-GBR
QCI=5: IMS signaling
　　QCI=6: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
　　QCI=7: Voice, Video (live streaming), interactive gaming
　　QCI=8: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
　　QCI=9: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)

1.   22:52:13.806 [0xB0E2] LTE NAS ESM Plain OTA Incoming Message
2.   pkt_version = 1 (0x1)
3.   rel_number = 9 (0x9)
4.   rel_version_major = 5 (0x5)
5.   rel_version_minor = 0 (0x0)
6.   eps_bearer_id_or_skip_id = 5 (0x5)
7.   prot_disc = 2 (0x2) (EPS session management messages)
8.   trans_id = 1 (0x1)
9.   msg_type = 193 (0xc1) (Activate default EPS bearer context request)
10.   lte_esm_msg
11.   act_def_eps_bearer_context_req
12.   eps_qos //qos参数
13.   qci = 5 (0x5) (QC5)
14.   oct4_incl = 0 (0x0)
15.   oct5_incl = 0 (0x0)
16.   oct6_incl = 0 (0x0)
17.   oct7_incl = 0 (0x0)
18.   oct8_incl = 0 (0x0)
19.   oct9_incl = 0 (0x0)
20.   oct10_incl = 0 (0x0)
21.   oct11_incl = 0 (0x0)
22.   oct12_incl = 0 (0x0)
23.   oct13_incl = 0 (0x0)
24.   oct14_incl = 0 (0x0)
25.   oct15_incl = 0 (0x0)
26.   access_point //接入apn ims
27.   num_acc_pt_val = 4 (0x4)
28.   acc_pt_name_val[0] = 3 (0x3) (length)
29.   acc_pt_name_val[1] = 105 (0x69) (i)
30.   acc_pt_name_val[2] = 109 (0x6d) (m)
31.   acc_pt_name_val[3] = 115 (0x73) (s)
32.   pdn_addr //分配的ip地址
33.   pdn_addr_len = 9 (0x9)
34.   pdn_type = 2 (0x2) (IPv6)
35.   ipv6_interface_id = 0x000000000000001 (0:0:0:1)
36.   trans_id_incl = 1 (0x1)
37.   trans_id
38.   length = 1 (0x1)
39.   ti_flag = 0 (0x0)
40.   ti_value = 0 (0x0)
41.   qos_incl = 0 (0x0)
42.   llc_sapi_incl = 0 (0x0)
43.   radio_priority_incl = 0 (0x0)
44.   pkt_flow_id_incl = 0 (0x0)
45.   apn_ambr_incl = 0 (0x0)
46.   esm_cause_incl = 1 (0x1)
47.   esm_cause
48.   esm_cause = 51 (0x33) (PDN type IPv6 only allowed)
49.   prot_config_incl = 1 (0x1)
50.   prot_config
51.   ext = 1 (0x1)
52.   conf_prot = 0 (0x0)
53.   num_recs = 0 (0x0)
54.   num_recs2 = 2 (0x2)
55.   sm_container[0]
56.   container_id = 3 (0x3) (DNS Server IPv6 Address)
57.   container_len = 16 (0x10)
58.   address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
59.   sm_container[1]
60.   container_id = 1 (0x1) (P-CSCF IPV6 Address)
61.   container_len = 16 (0x10)
62.   address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
63.   connectivity_type_incl = 0 (0x0)
64.   wlan_offload_acceptability_incl = 0 (0x0)
65.   nbifom_incl = 0 (0x0)
66.   header_compression_config_inclu = 0 (0x0)
67.   ctrl_plane_only_ind_incl = 0 (0x0)
68.   ext_prot_config_incl = 0 (0x0)
69.   serv_plmn_rate_ctrl_incl = 0 (0x0)
70.   ext_apn_ambr_incl = 0 (0x0)
71.   ext_eps_qos_incl = 0 (0x0)

最后终端给网络发送一个完成附着的响应，attach complete 消息中没有携带任何具体信息，可以理解为给Mme的礼貌性的回应。

至此，关于lte注册流程应该算是有个简单的了解了。