Reading a PDU session establishment trace without the spec open
A practical walkthrough of the messages in a PDU session establishment, in the order you will see them, with the fields that actually matter.
PDU session establishment is the procedure engineers are asked to debug most often and taught least well. Here is the sequence, and what to look at in each step.
1. The UE asks
The UE sends a PDU Session Establishment Request inside an UL NAS Transport message. The interesting fields are the PDU session ID, the requested S-NSSAI and the DNN. If the DNN is wrong, everything after this point is wasted effort, so check it first.
2. The AMF picks an SMF
The AMF queries the NRF for an SMF that serves that slice and DNN. This is where a missing or mismatched S-NSSAI shows up as a discovery failure rather than a session failure - a distinction worth making early, because they have completely different fixes.
3. Nsmf_PDUSession_CreateSMContext
The AMF calls the chosen SMF. If you get a 4xx back here, read the problem details in the JSON body before you read anything else. The SMF usually tells you exactly what it disliked.
4. The SMF fetches subscription data
Nudm_SDM_Get pulls the session management subscription data. Wrong or missing subscription data at this point produces a session reject that looks, from the UE side, identical to a radio problem.
5. N4 session establishment
The SMF picks a UPF and sends a PFCP Session Establishment Request. This carries the PDRs, FARs, QERs and URRs - the rules that describe what the UPF does to every packet. If the UPF rejects it, the cause value in the response is specific and useful.
6. N2 resource setup
The SMF returns the N2 SM information to the AMF, which sends it to the gNB in a PDU Session Resource Setup Request. The gNB sets up the radio bearer and returns its own tunnel endpoint.
7. N4 modification
The SMF now knows the downlink tunnel endpoint at the gNB, so it modifies the N4 session to point the FAR at it. Miss this and you get a session that looks established but carries no downlink traffic - a classic and very confusing symptom.
The debugging shortcut
When a session fails, work out which of these seven steps was the last one to complete. That alone narrows the fault to one interface and usually one configuration item. It is a faster method than reading the whole capture front to back.