Debugging RRC Setup failure
Why RRCSetupRequest fails or is rejected: RACH problems, RRCReject with wait times, msg3 decoding, and how to read the MAC PCAP.
8 min read
RRC connection establishment is a four-message handshake. Identify which of the four is missing and the cause space collapses immediately.
The handshake
UE gNB (lane) |-- msg1: PRACH preamble ---------->| |<-- msg2: RAR (grant) -------------| |-- msg3: RRCSetupRequest --------->| |<-- msg4: RRCSetup ----------------| |-- RRCSetupComplete -------------->|
| Missing at | Diagnosis | Fix |
|---|---|---|
| msg2 never arrives | PRACH not detected | Raise rf.tx_gain; verify prach_config_index matches SIB1 |
| msg2 arrives, msg3 not decoded | Wrong TA or power ramp | Check master_clock_rate; re-run lane calibration |
| RRCReject received | Congestion or wait time applied | Honour waitTime, retry; not a UE defect |
| msg4 arrives, no Complete | UE-side ASN.1 decode failure | Real UE bug — inspect the decoded RRCSetup |
| T300 expiry | No msg4 within timer | Check SINR; often a weak-link symptom |
Read the MAC PCAP
tshark -r ue_mac_nr.pcap -Y 'mac-nr.rar' -c 5 tshark -r ue_mac_nr.pcap -Y 'nr-rrc.rrcSetupRequest' tshark -r ue_mac_nr.pcap -Y 'nr-rrc.rrcReject' -T fields -e nr-rrc.waitTime
Distinguish UE bugs from environment
A genuine UE defect shows up as a decodable message that violates the specification — a malformed RRCSetupComplete, a missing mandatory IE, a wrong establishmentCause. Anything that looks like "nothing happened" is an environment problem until proven otherwise. The verdict field tells you which the test system believed: fail means a template mismatch (protocol), inconc means the test system could not tell (environment).
Run this against a real SDR lane
The tester is a service, not a box. Push a build, reserve a lane, get a verdict.