Printable View
What is actually happening in an RRC CONNECTION REQUEST with establishment cause: mt-access.
I have observed this was happening in response to paging message mainly. Both paging message and rrc reqst have the same mmec and s-tmsi meaning it is a paging response to the paging done for this Ue.
What is the information contained in the paging response in rrc reqst message with
cause: mt-access.??
I think "mt" maybe stand for Mobile Terminal. UE request connection to get a call?Quote:
Originally Posted by eta004
I'm not sure...
Brgds,
Quote:
Originally Posted by eta004
This is generally a paging request coming for specific UE, due to some ping/data coming for UE..
Generally if you see only MT att increase then it can be an attack from some website/server on specific Subnets/IPs of your eNBs and UEs.We have such attacks multiple times each year..Analyze Wireshark logs and try to find out the IPs doing alot of pings but no reply in response.
RRC connection request with establishment cause mt-access contained: Ue-Identity (S-TMSI or randomValue) and the establishment cause (mt-Access)
RRCConnectionRequest-r8-IEs ::= SEQUENCE {
ue-Identity InitialUE-Identity,
establishmentCause EstablishmentCause,
spare BIT STRING (SIZE (1))
}
InitialUE-Identity ::= CHOICE {
s-TMSI S-TMSI,
randomValue BIT STRING (SIZE (40))
}
EstablishmentCause ::= ENUMERATED {
emergency, highPriorityAccess, mt-Access, mo-Signalling,
mo-Data, delayTolerantAccess-v1020, mo-VoiceCall-v1280, spare1}
mt stands for mobile terminating or commonly known as the Bnumber. That's why it is associated with paging.
https://tech.queryhome.com/69801/con...ess-signalling
you can search for signalling in LTE . bR.