Paging¶

Learning objectives¶

After reading this page, you will be able to:

• Explain the Why (why Paging is necessary) as the mechanism that delivers an incoming call to a UE in the idle state (CM-IDLE).
• Explain the difference between CM-IDLE / CM-CONNECTED, and which of these states Paging targets.
• Explain the idea of the Registration Area (the registration area = the TAI list), and why the UE is paged on an area basis.
• Follow the triggers of Paging (arrival of DL data / NW-initiated signaling) and the flow of UPF buffering → SMF notification → AMF decision → NGAP Paging.
• Explain, as a concept, how DRX / eDRX (discontinuous reception) relates to power saving and Paging timing.
• Explain the flow in which the UE responds to Paging by sending a Service Request and transitions from CM-IDLE → CM-CONNECTED.
• Contrast the differences between 4G (EPC) Paging (MME-initiated / S1AP Paging) and 5G Paging (AMF-initiated / NGAP Paging).

Prerequisites¶

It will go more smoothly if you understand the following first. If you are not there yet, start from the Curriculum.

• The UE must be registered — Paging is a procedure for a registered (5GMM-REGISTERED) UE. For the registration flow, see Initial Registration.
• N2 / NGAP (the gNB⇔AMF control interface; Paging is one of the NGAP procedures) → N2
• N4 / PFCP (SMF⇔UPF; carries the UPF's DL buffer and notification) → N4
• The roles of the main NFs → AMF / SMF / UPF

What you'll learn in this chapter¶

This chapter is limited to Network Triggered Paging. It is the procedure by which the network pages a UE in the CM-IDLE state when incoming data or NW-initiated signaling arrives for it. It focuses on the core perspective, especially the NGAP Paging (N2) that the AMF issues and the UPF buffering / SMF notification (N4) that triggers it.

The following are out of scope, or kept at the conceptual level, in this chapter.

• The internal details of the radio (RRC/RAN) — over-the-air Paging transmission and the physical-layer timing of DRX are touched on only as concepts; the focus is on the core's involvement.
• The detailed parameters of eDRX — the idea of power saving is explained, but concrete cycle values and parameter design are treated as implementation-dependent.
• The details of the Service Request procedure — this chapter outlines its positioning as the response to Paging, but the detailed steps of the Service Request procedure itself are covered in a separate chapter (as that chapter does not yet exist, it is referred to in plain text).
• RAN Paging while in RRC Inactive — as a concept unique to 5G, only an outline is given in Release differences and the FAQ.

Why — why Paging is necessary¶

Let's start from the Why (why it is needed). Even a registered UE does not hold on to the radio continuously while it is not communicating. Maintaining the radio connection at all times would quickly drain the UE's battery and exhaust the radio resources on the network side. So while there is no communication, the UE releases its dedicated radio connection and enters an idle state (CM-IDLE) to save battery.

But a UE in the idle state poses a problem. Even when incoming data or NW-initiated signaling arrives, the network does not know exactly which cell the UE is currently in (it does not track it on a per-cell basis). All it knows is a rough range — "it should be somewhere in this area (the Registration Area)."

Paging is the procedure by which the network calls out across the entire area to this idle UE, saying "there is something for you; please wake up." The paged UE re-establishes its radio connection (Service Request) and returns to a state in which it can communicate (CM-CONNECTED).

Overview¶

Paging broadly happens in the following flow.

DL data arrives for a UE in the idle state (CM-IDLE) → the UPF buffers that data and notifies the SMF (N4) → the SMF notifies the AMF that "there is something for this UE" (SBI equivalent to N11) → the AMF sends NGAP Paging to the group of gNBs covering that UE's Registration Area (TAI list) (N2) → each gNB pages over the air → the UE receives it and responds with a Service Request → the UE transitions to CM-CONNECTED, and the buffered data is delivered.

Basic Concept — a beginner-friendly explanation¶

To understand Paging, grasp three keywords.

1. CM-IDLE and CM-CONNECTED (the connection state)¶

CM = Connection Management. A registered UE has mainly two states, depending on the presence or absence of the N1 (NAS) signaling connection with the AMF and the N2 UE-associated connection between the gNB and the AMF.

• CM-IDLE (idle) — a state in which there is no signaling connection for that UE between the UE and the network. The UE has released its dedicated radio connection and is saving battery. The network does not track the UE on a per-cell basis.
• CM-CONNECTED (connected) — a state in which a signaling connection for that UE is established. Data and signaling can be exchanged immediately.

Paging is the trigger that pages a UE in CM-IDLE and brings it back to CM-CONNECTED (details in State Machine). Note that the RM state (Registration Management: REGISTERED / DEREGISTERED) is a separate axis; the target of Paging is a UE that is "RM=REGISTERED and CM=IDLE."

2. Registration Area (why paging on an area basis)¶

The Registration Area is the list of TAIs (Tracking Area Identity) that the AMF assigns to the UE. It is notified to the UE at registration accept (Registration Accept).

• As long as the UE moves within this area, it does not have to update its registration each time (= reduced signaling and power saving).
• Because the network does not track the UE on a per-cell basis, it does not know "exactly which cell" at the time of an incoming call.
• So Paging calls out across the entire Registration Area (= the cells of the TAs contained in the TAI list). If the UE is in some cell, the page reaches it.

3. DRX (why discontinuous reception saves power)¶

DRX = Discontinuous Reception. If a UE in CM-IDLE were to keep listening to the air around the clock in order to receive Paging, its battery would not last. So the UE listens to the paging channel only at fixed times (the Paging occasion) and rests its receiver otherwise. This is DRX.

• The network and the UE share the same DRX cycle, and align so that Paging is sent at the very moment the UE is awake.
• The longer the cycle, the more power is saved, but the latency until an incoming call is noticed increases.
• eDRX (extended DRX) is a power-saving extension that lengthens the cycle further (the detailed parameters are implementation-dependent and out of scope of this chapter).

Architecture¶

The elements involved in Paging and the interfaces that connect them. Starting from the arrival of DL data, the page propagates UPF → SMF → AMF → multiple gNBs (the Registration Area) → UE.

flowchart LR
    DN[("DN / external NW
(DL data source)")] -->|"DL data"| UPF
    UPF["UPF
(DL buffer)"] ---|"N4 (PFCP) Data Notification"| SMF["SMF"]
    SMF ---|"N11 equivalent (SBI) N1N2 Message Transfer"| AMF["AMF
(Paging decision)"]
    AMF ==>|"N2 (NGAP Paging)"| gNB1["gNB #1"]
    AMF ==>|"N2 (NGAP Paging)"| gNB2["gNB #2"]
    AMF ==>|"N2 (NGAP Paging)"| gNB3["gNB #3"]
    gNB1 -.->|"air Paging (RRC)"| UE(("UE
(CM-IDLE)"))
    gNB2 -.->|"air Paging (RRC)"| UE
    gNB3 -.->|"air Paging (RRC)"| UE

    subgraph RA["Registration Area (TAI list)"]
        gNB1
        gNB2
        gNB3
    end

    classDef core fill:#efe,stroke:#3a3,stroke-width:2px;
    class AMF,SMF,UPF core;

The role of each element is as follows.

• UPF — the forwarding point for DL data. When the destination UE is in CM-IDLE and the DL path is not established, it buffers the data and notifies the SMF (N4).
• SMF — receives the notification from the UPF and relays to the AMF that "DL data is arriving for this UE" (SBI equivalent to N11).
• AMF — the command center of Paging. When it judges the UE to be in CM-IDLE, it sends NGAP Paging to the group of gNBs covering that UE's Registration Area (N2).
• (R)AN / gNB — receives the NGAP Paging and transmits Paging over the air (RRC). The actual entity that pages on the radio side.
• UE — in CM-IDLE, in discontinuous reception (DRX). When it receives Paging, it responds with a Service Request.

For the details of the interfaces, see the Interface Dictionary.

Network Function (the NFs that appear)¶

Interface / Protocol¶

The interfaces and protocols used in this procedure.

For the details of protocols, see the Protocol Dictionary; for the list of interfaces, see the Interface Dictionary.

Procedure — Call Flow¶

This is the heart of this page. The main steps of Network Triggered Paging, starting from the arrival of DL data, are shown in a Mermaid sequenceDiagram. The basis is 3GPP TS 23.502 §4.2.3.3 (Network Triggered Service Request) and TS 38.413 (NGAP Paging) (the fine-grained section numbers are to be confirmed).

sequenceDiagram
    autonumber
    participant UE as UE (CM-IDLE)
    participant RAN as (R)AN / group of gNBs
    participant AMF
    participant SMF
    participant UPF

    Note over UPF: DL data for the destination UE arrives (DL path not established)
    UPF->>SMF: PFCP Session Report Request (Downlink Data Report)
    Note right of UPF: N4 / TS 29.244. The UPF buffers the DL data
    SMF->>AMF: Namf_Communication_N1N2MessageTransfer (DL notification)
    Note right of SMF: SBI equivalent to N11. To be confirmed: operation name/conditions

    Note over AMF: Judges the UE to be in CM-IDLE → decides on Paging
    AMF->>RAN: NGAP Paging (N2, to the group of gNBs of the Registration Area)
    Note right of AMF: TS 38.413. UE Paging Identity=5G-S-TMSI, TAI List, etc.
    RAN-->>UE: Paging over the air (RRC, the DRX Paging occasion)

    Note over UE: Receives the Paging → starts responding
    UE->>RAN: Initiate the Service Request procedure (NAS)
    RAN->>AMF: Carry the NAS via Initial UE Message, etc. (N2)
    Note over UE,AMF: Service Request details are in a separate chapter (this chapter gives an outline)

    Note over UE,AMF: UE context/AS security establishment, DL path re-establishment
    AMF->>SMF: Request DL path establishment (re-activation of the PDU Session)
    SMF->>UPF: Update the DL path (FAR, etc.) over N4
    UPF-->>UE: Deliver the buffered DL data
    Note over UE: Transitions to CM-CONNECTED and receives

Step-by-step explanation (numbers correspond to the diagram above)¶

1. UPF→SMF: DL data arrives for the destination UE, but because the UE is in CM-IDLE and the DL path (N3 tunnel) is not established, the UPF buffers the data and notifies the SMF via a PFCP Session Report Request (Downlink Data Report / DLDR) (N4 / TS 29.244). The IE name "Downlink Data Report" is a representative notation; the details are to be confirmed.
2. SMF→AMF: the SMF notifies the AMF that "DL data is arriving for this UE." The operation is assumed to be Namf_Communication_N1N2MessageTransfer (SBI equivalent to N11). The concrete operation name and conditions of application are to be confirmed.
3. AMF decision: the AMF checks the UE context, and when it judges it to be in CM-IDLE, it decides on Paging. If CM-CONNECTED, Paging is unnecessary.
4. AMF→(R)AN: the AMF sends NGAP Paging to the group of gNBs covering the UE's Registration Area (TAI list) (N2 / TS 38.413). Key IEs include UE Paging Identity (5G-S-TMSI), TAI List for Paging, Paging DRX, etc. (the IE names are to be confirmed, see Packet Analysis).
5. (R)AN→UE: each gNB transmits Paging (RRC) over the air. The UE receives it at the DRX Paging occasion (the radio-side details are out of scope).
6. UE→response: the UE that received the Paging initiates the Service Request procedure and carries the NAS to the AMF via Initial UE Message, etc. (N2). The details of the Service Request procedure are covered in a separate chapter (this chapter gives an outline).
7. Connection establishment / DL path re-establishment: the UE context and AS security are established, and the DL path is re-activated via AMF→SMF→UPF (N4). The UPF delivers the buffered DL data, and the UE receives it in CM-CONNECTED.

Reference: TS 23.502 §4.2.3.3 (Network Triggered Service Request, section number to be confirmed), TS 38.413 (NGAP Paging), TS 29.244 (PFCP Session Report).

Signal Flow¶

The key Messages organized in a table.

For the detailed IEs and reference specs of each Message, see the Message Dictionary. Some of the IE names are marked to be confirmed because they are implementation/version dependent.

State Machine¶

The CM (Connection Management) state transitions on the UE side. Paging is the trigger that brings a UE in CM-IDLE back to CM-CONNECTED (basis: TS 23.501 §5.3 series, section number to be confirmed).

stateDiagram-v2
    [*] --> CM_IDLE: after registration and connection release
    CM_IDLE --> CM_CONNECTED: Receive Paging → Service Request response
    CM_IDLE --> CM_CONNECTED: UE-initiated Service Request (origination / UL data)
    CM_CONNECTED --> CM_IDLE: AN Release (radio connection release / deactivation)
    CM_CONNECTED --> [*]

• CM-IDLE — idle. There is no signaling connection for the UE. The target of Paging. When it receives Paging here and responds with a Service Request, it moves to CM-CONNECTED.
• CM-CONNECTED — connected. Data/signaling are possible. After a period of no communication, etc., it returns to CM-IDLE via AN Release.

Packet Analysis (Wireshark)¶

The key points when analyzing Paging with Wireshark. On the core side, NGAP Paging (N2) and PFCP Session Report (N4) are what to observe.

Key Display Filters¶

Points to note when decoding (key IEs)¶

• NGAP Paging (AMF→gNB) — note the following IEs (the IE names are representative notations, to be confirmed).
  • UE Paging Identity — the identifier of the counterpart to page. Typically the 5G-S-TMSI (a shortened Paging ID derived from the TMSI).
  • TAI List for Paging — which group of TAs to call out to (= the scope of the Registration Area).
  • Paging DRX — the UE's DRX cycle information (so the gNB can align the Paging occasion).
• PFCP Session Report Request (UPF→SMF) — Report Type has Downlink Data Report (DLDR) set, indicating the arrival of DL data and the occurrence of buffering (IE name to be confirmed).

The nested structure of the message (NGAP Paging)¶

NGAP Paging has a structure in which the IEs for Paging are placed inside the NGAP-PDU. In the packet detail pane it is displayed hierarchically as follows (the notation is conceptual; the actual names are dissector dependent = to be confirmed).

NGAP-PDU
 └─ Paging (initiatingMessage)
     ├─ UE Paging Identity (5G-S-TMSI)
     ├─ TAI List for Paging
     └─ Paging DRX

Configuration¶

The structural-level key points of the configuration for making Paging work. Specific values and vendor-specific details (Cisco, etc.) are implementation-dependent, and no fictitious values are written here.

Registration Area / TAI list design (on the AMF side)¶

• TAI / TAC (Tracking Area) — defines the TAs the AMF serves. It must match the TA of the gNB.
• Registration Area (TAI list) assignment policy — the range of the TAI list assigned to the UE. Making it wider reduces registration updates but widens the Paging scope; making it narrower does the reverse (the trade-off in Basic Concept). The concrete assignment algorithm is implementation-dependent.
• GUAMI / 5G-S-TMSI assignment — the 5G-S-TMSI (Paging Identity) is derived from the AMF's GUAMI.

DRX / power saving related¶

• Default DRX cycle — the DRX cycle shared between the UE and the network. The values and configuration keys are implementation-dependent.
• eDRX (extended DRX) — a further power-saving extension. Its parameter design is implementation-dependent and out of scope of this chapter.

Trouble Shooting¶

Isolating typical Paging failures (in general terms). For the details of Cause values, see the Cause Dictionary.

Comparison with EPC¶

A comparison so that those experienced with 4G (EPC) can bridge to 5G. The basic philosophy of Paging (paging an idle terminal on an area basis) is common to 4G and 5G.

Release differences¶

The main topics related to Paging. Uncertain items are marked to be confirmed and not asserted.

• Rel-15 — the basic 5GC Paging procedure was established. The foundations of the CM state / Registration Area / NGAP Paging / DRX were specified.
• RRC Inactive (RAN Paging) — a UE state introduced in Rel-15. When the UE is in RRC_INACTIVE, it is the gNB (RAN), not the core (AMF), that performs RAN Paging within the RAN Notification Area (a separate layer from the core-initiated CN Paging). The scope of this chapter is core-initiated Paging, and RAN Paging is kept to a conceptual introduction (the details are to be confirmed).
• eDRX extensions — power-saving (MICO/eDRX) related extensions continue in each Release. The concrete parameters are implementation-dependent and to be confirmed.
• Rel-16 / Rel-17 / Rel-18 — the generations in which extensions to slicing, power saving, positioning, etc. advanced. The extent to which they were specifically woven into the Paging procedure itself is to be confirmed.

3GPP Specification¶

FAQ¶

Summary¶

• Paging is the procedure by which the network pages a UE in order to deliver an incoming call (DL data / NW-initiated signaling) to a registered UE in CM-IDLE.
• The broad flow is UPF buffering → SMF notification (N4→N11 equivalent) → AMF decision → NGAP Paging (N2) → air Paging (RRC) → the UE responds with a Service Request → CM-CONNECTED.
• The command center is the AMF (which sends NGAP Paging to the group of gNBs of the Registration Area). DL buffering is by the UPF, and the notification relay is by the SMF.
• Paging on a Registration Area (TAI list) basis is because the idle UE is not tracked on a per-cell basis. DRX achieves power saving through discontinuous reception (the trade-off between power saving and response latency).
• Against 4G Paging (MME-initiated / S1AP / S-TMSI), 5G is AMF-initiated / NGAP / 5G-S-TMSI. Buffering moves from the S-GW to the UPF.
• The basis is TS 23.502 §4.2.3.3 / TS 23.501 §5.3 series / TS 38.413 / TS 29.244 (some of the section numbers and IE names are to be confirmed).

Practice — comprehension check and exercises¶

Comprehension check¶

Exercises¶

Problem: Reorder the following main Paging (Network Triggered) steps into the correct order.

A. The AMF sends NGAP Paging to the group of gNBs of the Registration Area
B. The UPF buffers the DL data and notifies the SMF via a Session Report
C. The UE responds with a Service Request and moves to CM-CONNECTED
D. The gNB transmits Paging (RRC) over the air
E. The SMF notifies the AMF of the arrival of DL data (N11 equivalent)
F. The UPF delivers the buffered DL data

Next Step¶

The next steps to deepen your understanding.

• Service Request chapter (the details of the connection-resumption procedure as the response to Paging)
• Handover chapter (switching the connection while moving)
• Mobility Registration Update chapter (the registration update across Registration Areas = the equivalent of 4G's TAU)
• Related procedure: Initial Registration (the registration that is the prerequisite for Paging)
• Related NFs: AMF / SMF / UPF
• Related Interfaces: N2 / N4 / N1
• Dictionaries: Message Dictionary / Timer Dictionary / Cause Dictionary / Protocol Dictionary / NF Dictionary / Interface Dictionary