RRLP:posCapabilityReq

Hello all, I am trying to get a Positioning Capability Response from a MS by sending an Positioning Capability Request. I checked ETSI TS 144 031 (v9.2.0) to figure out how to build the package. Only the "extended-reference" field is mandatory and so I tried to send a package just with the content of that field. The "extend-reference" consists of the smlc-code and the transactionID. By testing I found out that I have to send at least 6 octets. The first octet is as usual the referenceNumber and to specify the rrlp component. The last 2 bits of the 3rd octet and the first 4 bits of the 4th octet are for the smlc-code. The rest of the 4th octet, the full 5th octet and the first 6 bits of the 6th octet are for the transactionID. Furthermore the first 3 bits of the second octet are for the choice extension. Anyway I have no clue what the meaning is of the last 6 bits of the 2nd octet and the first 6 bits of the 3rd octet although it seems like that the 4th bit of the second octet is an extension bit. However if I send a package I always get "Meassage too short" error. Adding octets does not help. Anyone has ever got a Positioning Capability Response for a Request? If yes I would really appreciate if that someone would share this Request with me. Wireshark always shows me that I have sent a Positioning Capability Request but the Response never comes but the error message. RRLP is implemented in the phone since I get responses for a Measure Position Request. I think by now I have sent around 500 packages :) One example I am using is: 0x30 0x0E 0x00 0xFF 0xA2 0x04 Best, Andreas