WCDMA OTA message flow - MT voice call

[MT call]
BS>>>MS: paging, DL_PCCH
BS<<<MS: rrcConnectionRequest(terminatingConversationalCall), UL_CCCH
BS>>>MS: rrcConnectionSetup, DL_CCCH
BS<<<MS: rrcConnectionSetupComplete, UL_DCCH
BS<<<MS: NAS: paging response, UL_DCCH
BS>>>MS: NAS: MM,Authentication Request, DL_DCCH
BS<<<MS: NAS: MM,Authentication Response, UL_DCCH
BS>>>MS: securityModeCommand, DL_DCCH
BS<<<MS: securityModeComplete, UL_DCCH
BS>>>MS: NAS: CC,Setup (Network to MS direction), DL_DCCH
BS<<<MS: NAS: CC,Call confirmed, UL_DCCH
BS>>>MS: radioBearerSetup, DL_DCCH
BS<<<MS: radioBearerSetupComplete, UL_DCCH
BS<<<MS: NAS: CC,Alerting, UL_DCCH
BS<<<MS: NAS: CC,Connect, UL_DCCH
BS>>>MS: NAS: CC,Connect acknowledge, DL_DCCH

[disconnect from network]
BS>>>MS: NAS: CC,Disconnect (Network to MS direction), DL_DCCH
BS<<<MS: NAS: CC,Release, UL_DCCH
BS>>>MS: NAS: CC,Release complete, DL_DCCH
BS>>>MS: rrcConnectionRelease, DL_DCCH
BS<<<MS: rrcConnectionReleaseComplete(3 times), UL_DCCH

[disconnect from device]
BS<<<MS: NAS: CC,Disconnect (MS to Network direction), UL_DCCH
BS>>>MS: NAS: CC,Release, DL_DCCH
BS<<<MS: NAS: CC,Release complete, UL_DCCH
BS>>>MS: rrcConnectionRelease, DL_DCCH
BS<<<MS: rrcConnectionReleaseComplete(3 times), UL_DCCH

WCDMA OTA message flow - MO voice call

[Establish MO call]
BS<<<MS: rrcConnectionRequest(originatingConversationalCall), UL_CCCH
BS>>>MS: rrcConnectionSetup, DL_CCCH
BS<<<MS: rrcConnectionSetupComplete, UL_DCCH
BS<<<MS: NAS: CM service request, UL_DCCH
BS>>>MS: NAS: MM,Authentication Request, DL_DCCH
BS<<<MS: NAS: MM,Authentication Response, UL_DCCH
BS>>>MS: securityModeCommand, DL_DCCH
BS<<<MS: securityModeComplete, UL_DCCH
BS<<<MS: NAS: CC,Setup (MS to network direction), UL_DCCH
BS>>>MS: NAS: CC,Call proceeding, DL_DCCH
BS>>>MS: radioBearerSetup, DL_DCCH
BS<<<MS: radioBearerSetupComplete, UL_DCCH
BS>>>MS: NAS: CC,Alerting, DL_DCCH
BS>>>MS: NAS: CC,Connect, DL_DCCH
BS<<<MS: NAS: CC,Connect acknowledge, UL_DCCH

[disconnect from network]
BS>>>MS: NAS: CC,Disconnect (Network to MS direction), DL_DCCH
BS<<<MS: NAS: CC,Release, UL_DCCH
BS>>>MS: NAS: CC,Release complete, DL_DCCH
BS>>>MS: rrcConnectionRelease, DL_DCCH
BS<<<MS: rrcConnectionReleaseComplete(3 times), UL_DCCH

[disconnect from device]
BS<<<MS: NAS: CC,Disconnect (MS to Network direction), UL_DCCH
BS>>>MS: NAS: CC,Release, DL_DCCH
BS<<<MS: NAS: CC,Release complete, UL_DCCH
BS>>>MS: rrcConnectionRelease, DL_DCCH
BS<<<MS: rrcConnectionReleaseComplete(3 times), UL_DCCH

WCDMA OTA message flow - registration

BS>>>MS: systemInformationN, DL_BCCH_BCH
BS<<<MS: rrcConnectionRequest, UL_CCCH
BS>>>MS: rrcConnectionSetup, DL_CCCH
BS<<<MS: rrcConnectionSetupComplete, UL_DCCH
BS<<<MS: NAS: Location Updating Request, UL_DCCH
BS<<<MS: NAS: Attach request(ps-domain), UL_DCCH
BS>>>MS: NAS: Authentication Request, DL_DCCH
BS<<<MS: NAS: Authentication Response, UL_DCCH
BS>>>MS: securityModeCommand, DL_DCCH
BS<<<MS: securityModeComplete, UL_DCCH
BS>>>MS: NAS: Identity Request, DL_DCCH
BS<<<MS: NAS: Identity Response, UL_DCCH
BS>>>MS: NAS: Location updating Accept, DL_DCCH
BS<<<MS: NAS: TMSI Reallocation Complete, UL_DCCH
BS>>>MS: NAS: Authentication and ciphering request(ps-domain), DL_DCCH
BS<<<MS: NAS: Authentication and ciphering response(ps-domain), UL_DCCH
BS>>>MS: securityModeCommand, DL_DCCH
BS<<<MS: securityModeComplete, UL_DCCH
BS>>>MS: NAS: Identity request(GMM), DL_DCCH
BS<<<MS: NAS: Identity response(GMM), UL_DCCH
BS>>>MS: NAS: Attach accept(ps-domain), DL_DCCH
BS<<<MS: NAS: Attach complete(ps-domain), UL_DCCH
......
BS>>>MS: rrcConnectionRelease, DL_DCCH
BS<<<MS: rrcConnectionReleaseComplete(3 times), UL_DCCH

LTE OTA message - basic flow

MIB
BS>>>MS: SIP, BCCH_DL_SCH
BS>>>MS: SIP2, BCCH_DL_SCH
BS<<<MS: rrcConnectionRequest, UL_CCCH
BS>>>MS: rrcConnectionSetup, DL_CCCH
BS<<<MS: rrcConnectionSetupComplete, UL_DCCH
NAS: Attach request, ESM: PDN connectivity request
BS>>>MS: NAS: Authentication request, DL_DCCH
BS<<<MS: NAS: Authentication response, UL_DCCH
BS>>>MS: NAS: Security mode command, DL_DCCH
BS<<<MS: NAS: Security mode complete, UL_DCCH
BS>>>MS: securityModeCommand, DL_DCCH
BS<<<MS: securityModeComplete, UL_DCCH
BS>>>MS: ueCapabilityEnquiry, DL_DCCH
BS<<<MS: ueCapabilityInformation, UL_DCCH
BS>>>MS: rrcConnectionReconfiguration, DL_DCCH
NAS: Attach accept, ESM: Activate default EPS bearer context request
BS<<<MS: rrcConnectionReconfigurationComplete, UL_DCCH
BS<<<MS: NAS: Attach complete, UL_DCCH
ESM: Activate default EPS bearer context accept
BS<<<MS: NAS: PDN connectivity request(IPv4, IPv6), UL_DCCH

Note for OTA message decode

For WCDMA OTA message, start decode from the 5th Byte.

For LTE OTA message, start decode from the 14th Byte.