LTE Protocol Stack Explained
The LTE protocol stack is the layered protocol architecture that lets the UE, eNodeB, and EPC exchange signaling and user data across the LTE system.
At the radio-access side, LTE separates user-plane transport through PDCP, RLC, MAC, and PHY from control-plane signaling through RRC and NAS. The eNodeB then bridges that radio stack toward EPC-facing protocols such as S1AP and GTP-U.
LTE Protocol Stack Diagram
Quick facts
| Main radio user-plane layers | PDCP, RLC, MAC, and PHY |
|---|---|
| Main radio control layer | RRC between UE and eNodeB |
| Core-facing UE control layer | NAS between UE and MME, transported through the access network |
| S1 control protocol | S1AP between eNodeB and MME |
| EPC user-plane transport | GTP-U on S1-U and S5/S8 |
| Troubleshooting value | Separates radio, bearer, NAS, interface, and external service problems into the right layers |
Contents
- LTE Protocol Stack Diagram
- LTE Protocol Stack in the Architecture
- The Two Big Splits in the LTE Stack
- LTE User-Plane Protocol Stack
- LTE Control-Plane Protocol Stack
- LTE Protocol Stack by Network Element
- S1 Protocol Stack
- X2 Protocol Stack
- LTE Bearers and the Protocol Stack
- LTE Security and the Protocol Stack
- Why the LTE Protocol Stack Matters for Troubleshooting
- LTE Protocol Stack vs 5G Protocol Stack
- Key takeaways
- FAQ
- References
LTE Protocol Stack in the Architecture
At the highest level, the LTE protocol stack spans the UE, the eNodeB, and the EPC. The UE and eNodeB share the LTE air-interface stack, while the eNodeB and EPC use S1 protocols on the control and user planes.
The NAS protocol is exchanged between the UE and the MME, but it is not terminated in the eNodeB. Instead, NAS is carried through the access-side signaling path using RRC and S1AP.
| Network element | Main protocol role |
|---|---|
| UE | Runs NAS, RRC, PDCP, RLC, MAC, and PHY. |
| eNodeB | Terminates RRC and radio layers, then bridges to S1AP and GTP-U toward EPC. |
| MME | Terminates NAS and uses EPC control-plane interfaces such as S1-MME, S11, and S6a. |
| S-GW / P-GW | Carry and control EPC user-plane paths using GTP-based interfaces. |
The Two Big Splits in the LTE Stack
LTE protocol design is easiest to understand through two separations: user plane vs control plane, and Access Stratum vs Non-Access Stratum.
| Split | Meaning |
|---|---|
| User plane | Carries actual service traffic such as IP packets, application traffic, and voice media. |
| Control plane | Carries signaling for connection control, bearer activation, mobility, security, and session management. |
| Access Stratum (AS) | Radio-access protocols such as RRC, PDCP, RLC, MAC, and PHY. |
| Non-Access Stratum (NAS) | UE-to-MME signaling for EPS mobility, security, and bearer/session control. |
LTE User-Plane Protocol Stack
The LTE radio user plane carries IP or higher-layer payload through the radio protocol layers before traffic continues into EPC user-plane tunnels.
| Layer | Role in the LTE user plane |
|---|---|
| PDCP | Highest radio user-plane layer before packets enter lower radio transfer handling. |
| RLC | Radio link layer below PDCP and above MAC. |
| MAC | Medium access layer below RLC and above PHY. |
| PHY | Physical over-the-air transmission and reception layer. |
- Radio-side user-plane path: IP payload -> PDCP -> RLC -> MAC -> PHY.
- EPC-side user-plane path: eNodeB -> S1-U -> S-GW -> S5/S8 -> P-GW -> SGi.
LTE Control-Plane Protocol Stack
The LTE control plane carries signaling rather than user payload. On the radio side, RRC controls the UE-to-eNodeB access state. Above RRC, NAS connects the UE to EPC control functions, especially the MME.
Control-plane signaling still uses lower radio layers below RRC, because signaling must also be transported over the air interface.
| Protocol | Control-plane role |
|---|---|
| NAS | UE-to-MME signaling for mobility management, EPS security, and bearer/session activation. |
| RRC | UE-to-eNodeB radio control for connection setup, reconfiguration, measurements, mobility, and radio bearer control. |
| PDCP / RLC / MAC / PHY | Lower radio transport used by both user-plane traffic and control-plane signaling. |
| S1AP | eNodeB-to-MME signaling on S1-MME, including NAS transport. |
LTE Protocol Stack by Network Element
Each LTE node sees a different part of the protocol stack. This is the key to avoiding common analysis mistakes, such as expecting the eNodeB to terminate NAS or treating S1-U as a radio-layer problem.
| Node | Protocol stack view |
|---|---|
| UE | NAS toward MME; RRC toward eNodeB; PDCP, RLC, MAC, and PHY for radio transport. |
| eNodeB | RRC and lower radio layers toward UE; S1AP toward MME; GTP-U toward S-GW; X2AP toward neighboring eNodeBs. |
| MME | NAS termination, S1AP control signaling, S11 GTPv2-C, and S6a Diameter. |
| S-GW / P-GW | GTP-U user-plane handling and GTP-C/GTPv2-C control-plane handling across gateway interfaces. |
S1 Protocol Stack
The S1 interface is split into S1-MME for control plane and S1-U for user plane. This is one of the most important protocol-stack splits in LTE.
| S1 side | Simplified stack | Purpose |
|---|---|---|
| S1-MME | NAS / S1AP / SCTP / IP | Control-plane signaling between eNodeB and MME, including NAS transport. |
| S1-U | IP payload / GTP-U / UDP / IP | User-plane tunnel between eNodeB and S-GW. |
X2 Protocol Stack
The X2 interface connects eNodeBs to each other. It is split into X2-C for inter-eNodeB control signaling and X2-U for user-plane forwarding support during mobility.
| X2 side | Simplified stack | Purpose |
|---|---|---|
| X2-C | X2AP / SCTP / IP | Inter-eNodeB signaling, mobility preparation, coordination, and context handling. |
| X2-U | User payload / GTP-U / UDP / IP | User-plane forwarding between eNodeBs where the mobility procedure requires it. |
LTE Bearers and the Protocol Stack
The LTE protocol stack is tightly bound to the LTE bearer model. A bearer is not just an abstract service concept; it is realized through protocol layers and interface tunnels across the UE, eNodeB, S-GW, and P-GW.
On the access side, user data traverses PDCP, RLC, MAC, and PHY, then continues over S1-U and deeper EPC bearer paths. On the control side, NAS, RRC, and S1AP help establish and coordinate the state needed for those bearers.
- Radio bearer: UE to eNodeB.
- S1 bearer: eNodeB to S-GW over S1-U.
- S5/S8 bearer: S-GW to P-GW.
- EPS bearer: end-to-end LTE bearer concept across access and core.
LTE Security and the Protocol Stack
LTE security also follows the protocol-stack split. NAS security applies to NAS signaling between the UE and MME, while access-stratum security applies to the radio-access-side layers.
This matters in troubleshooting because a signaling failure may be a NAS security problem, an RRC configuration issue, a PDCP/RLC delivery issue, or a transport problem beyond the eNodeB.
Why the LTE Protocol Stack Matters for Troubleshooting
The LTE stack gives engineers a clean way to place failures in the right layer. That does not solve the failure by itself, but it prevents a radio problem, NAS problem, bearer problem, and SGi reachability problem from being mixed together.
| Problem area | First layers or interfaces to inspect |
|---|---|
| Radio-side issue | PHY, MAC, RLC, PDCP, and RRC. |
| EPC signaling issue | NAS, S1AP, GTPv2-C, and Diameter where relevant. |
| Data-path issue | PDCP/RLC/MAC/PHY, GTP-U on S1-U, S5/S8 user plane, and SGi reachability. |
| Mobility issue | RRC, measurement configuration, X2AP/S1AP, S1-U/X2-U forwarding, and bearer state. |
LTE Protocol Stack vs 5G Protocol Stack
LTE and 5G share a layered design mindset, but the access-to-core architecture changes. LTE centers on E-UTRAN, EPC, S1, X2, S1AP, NAS, and GTP-based EPC paths. 5G changes the RAN and core interface model while keeping the idea that user plane, control plane, access stratum, and NAS need to be analyzed separately.
- LTE: RRC, PDCP, RLC, MAC, PHY, NAS, S1AP, X2AP, GTP-U, and GTP-C.
- 5G: similar layering mindset, but different RAN/core architecture and interface names.
Key takeaways
- The LTE protocol stack is built around PDCP, RLC, MAC, PHY, RRC, and NAS.
- LTE separates user plane from control plane and access stratum from NAS/core signaling.
- The eNodeB bridges the LTE radio stack to EPC protocols such as S1AP and GTP-U.
- Bearer realization depends on protocol layers across the radio side, S1-U, S5/S8, and SGi.
- Understanding the LTE stack is essential for analyzing bearers, mobility, signaling, security, and troubleshooting.
FAQ
What are the main layers of the LTE protocol stack?
The main LTE radio layers are PDCP, RLC, MAC, and PHY for the user plane, with RRC on the radio control plane and NAS above the access stratum toward the EPC.
What is the difference between LTE user plane and control plane?
The user plane carries service data, while the control plane carries signaling for connection control, bearer activation, mobility, security, and session management.
Is NAS part of the LTE radio stack?
NAS is part of LTE/EPS signaling, but it is not terminated in the eNodeB. It runs between the UE and MME and is transported through the access network.
What protocol does LTE use between eNodeB and MME?
LTE uses S1AP between the eNodeB and MME on the S1-MME control-plane interface, with NAS messages transported along that path.
What protocol carries LTE user data in the EPC?
LTE user data is carried using GTP-U on EPC user-plane interfaces such as S1-U and S5/S8.
Related pages
References
- 3GPP TS 23.401 / ETSI TS 123 401 - EPS architecture EPS architecture reference for NAS, bearers, EPC connectivity, and the LTE control/user-plane model.
- 3GPP TS 36.401 / ETSI TS 136 401 - E-UTRAN architecture E-UTRAN architecture reference for S1/X2 layering, radio network layer, transport network layer, S1AP, and X2AP.
- 3GPP TS 36.300 / ETSI TS 136 300 - E-UTRA and E-UTRAN overall description Overall E-UTRAN description covering RRC, PDCP, RLC, MAC, PHY, bearers, and access architecture.
- 3GPP TS 36.410 / ETSI TS 136 410 - S1 general aspects S1 interface reference for S1-MME and S1-U access point structure.
- 3GPP TS 29.274 / ETSI TS 129 274 - GTPv2-C GTPv2-C reference for EPC control-plane tunnel and bearer signaling.
- 3GPP TS 29.281 / ETSI TS 129 281 - GTP-U GTP-U reference for LTE/EPS user-plane transport on interfaces such as S1-U and S5/S8.