3GPP Sniffer
4G

LTE

Long Term Evolution

Rel-8 (2008)Rel-9 (2009)

Overview

Long Term Evolution (LTE) is 3GPP's fourth-generation radio access technology, standardized starting in Release 8. It replaced the WCDMA/HSPA air interface with OFDMA in the downlink and SC-FDMA in the uplink, and flattened the radio access network by merging the Node B and RNC functions into a single element, the eNodeB, connected directly to an all-IP core network (the Evolved Packet Core).

LTE was designed for packet-switched data from the outset, with voice delivered either via circuit-switched fallback (CSFB) to 2G/3G or, from Release 9 onward, natively over IP via VoLTE. It remains the dominant global radio access technology and continues to anchor many non-standalone 5G deployments (EN-DC).

📋 Specifications:TS 36.201 TS 36.300

Key Features

  • OFDMA downlink / SC-FDMA uplink air interface with scalable 1.4–20 MHz channel bandwidths
  • Flat, all-IP network architecture: eNodeB connects directly to the EPC over S1
  • Peak theoretical rates of 300 Mbps downlink / 75 Mbps uplink (2x2 MIMO, 20 MHz, Rel-8)
  • Sub-frame-based scheduling with 1 ms TTI for low-latency link adaptation
  • Support for FDD and TDD duplexing within a single core specification set
  • Self-organizing network (SON) capabilities for automated configuration and optimization

Network Architecture

E-UTRAN consists solely of eNodeBs, which handle all radio-related functions and connect to neighboring eNodeBs over X2 and to the Evolved Packet Core over S1.

ComponentFull NameFunction
eNodeBEvolved Node BRadio resource management, scheduling, mobility control, header compression, ciphering
MMEMobility Management EntityNAS signaling, idle-mode tracking, bearer management, authentication
S-GWServing GatewayLocal mobility anchor, packet routing/forwarding, lawful interception
P-GWPDN GatewayUE IP address allocation, packet filtering, policy enforcement, external PDN anchor
HSSHome Subscriber ServerMaster subscriber database for authentication and subscription profiles
PCRFPolicy and Charging Rules FunctionDynamic policy and charging control decisions

📋 Specifications:TS 23.401 TS 23.402 TS 36.300

Physical Layer

ParameterValue
Downlink multiple accessOFDMA
Uplink multiple accessSC-FDMA
Subcarrier spacing15 kHz
Slot / subframe / frame0.5 ms slot, 1 ms subframe, 10 ms frame
Channel bandwidths1.4, 3, 5, 10, 15, 20 MHz
ModulationQPSK, 16-QAM, 64-QAM (256-QAM from Rel-12 for downlink)
MIMOUp to 4x4 (8x8 in later releases) with codebook-based precoding

📋 Specifications:TS 36.211 TS 36.213 TS 36.212

Frequency Bands

FDD Bands (selected)

BandUplink (MHz)Downlink (MHz)Region
B11920–19802110–2170Global (2100 MHz)
B31710–17851805–1880Europe / APAC (1800 MHz)
B5824–849869–894Americas (850 MHz)
B72500–25702620–2690Europe / APAC (2600 MHz)
B13777–787746–756North America (700 MHz)
B20832–862791–821Europe (800 MHz digital dividend)

TDD Bands (selected)

BandFrequency (MHz)Region
B382570–2620Global
B402300–2400APAC
B412496–2690North America
B423400–3600Global (also 5G n78 overlap)

📋 Specifications:TS 36.101 TS 36.104

UE Categories

CategoryDL Peak RateUL Peak RateMIMO Layers
Cat 110.3 Mbps5.2 Mbps1
Cat 3102 Mbps51 Mbps2
Cat 4150.8 Mbps51 Mbps2
Cat 6301.5 Mbps51 Mbps2–4 (with CA)
Cat 9452.2 Mbps51 Mbps2–4 (with CA)
Cat M1 (eMTC)1 Mbps1 Mbps1

Services

  • Mobile broadband data over default and dedicated EPS bearers with QCI-based QoS
  • VoLTE — voice delivered as IMS-anchored VoIP over a dedicated GBR bearer
  • SMS over IP (SGs or IMS)
  • eMBMS — evolved Multimedia Broadcast Multicast Service for broadcast video/data
  • Circuit-switched fallback (CSFB) to UTRAN/GERAN for voice on networks without VoLTE

Security

LayerAlgorithm FamilyPurpose
NAS / AS cipheringEEA0, 128-EEA1 (SNOW 3G), 128-EEA2 (AES), 128-EEA3 (ZUC)User and signaling plane confidentiality
NAS / AS integrityEIA1, EIA2, EIA3Signaling message integrity protection
AuthenticationEPS-AKAMutual authentication between UE and network using USIM credentials
Key hierarchyK → CK/IK → KASME → KeNBLayered key derivation isolating radio keys from core keys

Key Procedures

Attach

  1. UE sends Attach Request (NAS) piggybacked on RRC Connection Setup Complete
  2. eNodeB forwards Initial UE Message to MME over S1AP
  3. MME authenticates the UE (EPS-AKA) and establishes NAS security
  4. MME creates a default EPS bearer via Create Session Request/Response with the S-GW/P-GW
  5. MME sends Initial Context Setup Request; eNodeB configures the radio bearer via RRC Reconfiguration
  6. UE completes Attach with Attach Complete, now in EMM-REGISTERED / ECM-CONNECTED state

Handover (X2-based)

  1. Source eNodeB triggers handover based on UE measurement reports (A3 event)
  2. Source eNodeB sends Handover Request to target eNodeB over X2AP
  3. Target eNodeB admits resources and returns Handover Request Acknowledge
  4. Source eNodeB commands the UE via RRC Reconfiguration with mobilityControlInfo
  5. UE synchronizes to the target cell and sends RRC Reconfiguration Complete
  6. Target eNodeB signals Path Switch Request to the MME to update the S1-U path

Paging

  1. Downlink data or NAS signaling arrives for an idle UE
  2. MME sends Paging over S1AP to all eNodeBs in the UE's tracking area
  3. eNodeBs broadcast a Paging message referencing the UE's S-TMSI
  4. UE initiates RRC Connection Establishment (Service Request) in response

📋 Specifications:TS 23.401 TS 36.331 TS 36.413

Power Saving

MechanismDescriptionIntroduced
DRX (Connected)UE sleeps between scheduled monitoring occasions while RRC_CONNECTEDRel-8
DRX (Idle)UE monitors paging occasions on a configurable cycle while idleRel-8
PSMPower Saving Mode — UE deregisters from the radio but stays registered with the core between activity burstsRel-12
eDRXExtended DRX cycles up to ~43 minutes for infrequent, delay-tolerant trafficRel-13

📋 Specifications:TS 36.304 TS 23.682

Interworking

AspectLTE / EPCUMTS / GPRS
Core networkEvolved Packet Core (flat, all-IP)GPRS core (SGSN/GGSN)
Handover interfaceS3/S4 (Gn/Gp-based interworking)Iu / Gb
VoiceVoLTE (IMS) or CSFB to 2G/3GNative circuit-switched voice
Mobility procedureTracking Area Update (TAU)Routing Area Update (RAU)

Extensions for Later Releases

  • Rel-9: Dual-layer beamforming, eMBMS, SON self-healing enhancements.
  • Rel-10 (LTE-Advanced): Carrier aggregation, relay nodes, enhanced MIMO — see the LTE-Advanced technology page.
  • Rel-12: Dual connectivity, D2D/ProSe, PSM for IoT power savings.
  • Rel-13 (LTE-Advanced Pro): NB-IoT, LAA, massive MIMO groundwork.

Comparison with Previous Generations

AspectGPRS/EDGE (2.5G)UMTS/HSPA (3G)LTE (4G)
AccessTDMAWCDMAOFDMA/SC-FDMA
Peak DL rate~236 kbps (EDGE)~42 Mbps (HSPA+)~300 Mbps (Rel-8, 2x2 20 MHz)
Core networkGPRS core (SGSN/GGSN)UMTS core (evolved GPRS core)EPC (flat, all-IP)
RAN architectureBSC/BTSRNC/Node BeNodeB only (flat)