Iu: flimsy TMSI

Hi Daniel and 3G folks, about our difficulty in maintaining a prolonged link with the UE, I found a bit of discrepancy concerning the TMSIs used. When looking at a pcap where we authenticate and MM LU / GMM Attach successfully on CS / PS, and with TMSI assignment enabled in CSCN, I see TMSIs in these places: 1) UE sends TMSI in "(GMM) Attach Request" (PS) 2) SGSN sends TMSI in "(GMM) Attach Accept" (PS) 3) CSCN sends TMSI in "Location Update Accept" (CS) All these TMSIs differ. When I look in the RRC log of the hnb, it is logging a TMSI for pretty much every received message on CS and PS domains. But it is always and only logging the TMSI matching 1), i.e. the TMSI originally sent on the PS domain. To rephrase, the same TMSI is logged for PS and CS domain messages; for the MM LU Accept as well as the GMM Attach Accept, the hnb logs TMSI 1) even though the CN sent TMSIs 3) and 2), respectively. For 1) and 2), it seems that the SGSN should accept and use the TMSI sent by the UE during the Attach Request, right? For 3), according to the RRC log, it seems that the UE expects to see the very same TMSI in CS that it sent to PS -- that'd be a problem. On the other hand, when noting that, in the Location Updating Request, the UE identified itself using the IMSI and not a TMSI, it may be indeed the correct choice to disable TMSI use for CS? I must admit that I'm not firm in the IMSI/TMSI realm, and staring at 3GPP 04.08 doesn't clarify it right away, so I'd appreciate some feedback from this list. I can stare some more, but maybe you guys are quicker. Thanks! ~Neels -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Holger Freyther, Harald Welte