1. Chapter 6
LLC Protocol
Contents:
6.1 Functional description of the LLC layer
1. Functions of the LLC layer
2. Functional model of the LLC layer
3. LLC layer structure
4. Structure of TLLI
5. Logical Link States
6.2 Frame formats
1. LLC frames
2. LLC Transmission Modes in GPRS
3. LLC header fields-Control Field
4. LLC Acknowledged mode operation
5. Exchange Identification Parameter Negotiation
6. LLC layer parameter default values
7. Some LLC parameters
8. LLC header example

2. Chapter 6
LLC Protocol
Contents:
6.1 Functional description of the LLC layer
1. Functions of the LLC layer
2. Functional model of the LLC layer
3. LLC layer structure
4. Structure of TLLI
5. Logical Link States
6. Ciphering algorithm interface

3. Functions of the LLC layer
Application Application
TCP/UDP TCP/UDP
LLC layer functions provide the means for information transfer via peer-to-peer
IP v 4/6 IP v 4/6
LLC
Relay
SNDCP SNDCP GTP GTP
Logical link connections between an MS and SGSN pair.
LLC LLC
UDP / UDP /
TCP TCP
Relay L2
RLC RLC BSSGP BSSGP
IP IP
LLC includes functions for: MAC
GSM RF
MAC
GSM RF
NS
FR
L1
NS
FR
L1
L2
L1
L2
L1 L1
• the provision of one or more logical link connections discriminated between by
Ciphering
Ciphering means of a DLCI (Data Link Connection Identifier). A logical link connection is identified by a
DLCI consisting of two identifiers: a SAPI (Service Access Point Identifier) and a TLLI
(Temporary Logical Link Identifier).
The SAPI is used to identify the service access point on the SGSN side and the
Flow control
Flow control MS side of the LLC interface. An SAPI is carried in the address field of each LLC
frame.
The TLLI is used to identify a specific MS.
Sequence control
Sequence control
• sequence control, to maintain the
sequential order of frames across a logical
Notification of unrecoverable errors link connection;
Notification of unrecoverable errors
• detection of transmission, format and
operational errors on a logical link
End-to-End data exchange between MS and SGSN
End-to-End data exchange between MS and SGSN connection;
• recovery from detected transmission,
format and operational errors;
Transmission, format and operational error detection
Transmission, format and operational error detection • notification of unrecoverable errors;
and correction
and correction • flow control
• ciphering.

4. Functional model of the LLC layer
GPRS Mobility Management SNDCP TOM SMS
Layer 3
LLGMM LLGMM LL3 LL5 LL9 LL11 TOM2 TOM8 LLSMS
LLC layer
Logical
Link
Logical Entity
Link SAPI=7
Logical Entity
Link SAPI=8
Logical Entity
Logical Logical
Link SAPI=2
Link Logical Link
Entity
SAPI=11
Management Link Entity
Entity Logical
Link
Entity SAPI=9
Logical SAPI=5
Entity
Link SAPI=3
Entity
SAPI=1
Multiplex Procedure
LLC layer
GRR BSSGP
RLC/MAC layer MS SGSN BSSGP layer
RLC/MAC BSSGP
Signalling Signalling and data transfer
The default values for SAPIs 3, 5, 9, and 11 have been chosen to correspond with the four GPRS quality of
service delay classes, see 3GPP TS 22.060 [3]. However, there is no fixed relationship between SAPI and delay
class. The LLC layer parameters for any SAPI can be negotiated to support any QoS profile, see 3GPP
TS 23.060.

5. LLC layer structure
The logical link layer consists of multiple Logical Link Entities (LLEs), identified by Service Access Point
Identifiers (SAPI) that control the information flow of individual connections.
Functions provided by each LLE are: unacknowledged information transfer
acknowledged information transfer
flow control in ABM operation
frame error detection.
The Logical Link Management Entity (LLME) manages the resources that have an impact on individual
connections.
Functions provided by the LLME are: parameter initialization
error processing
connection flow control invocation.
Multiplex procedure
On frame transmission, the multiplex procedure generates and inserts the FCS (Frame Check Sequences),
performs the frame ciphering function, and provides SAPI-based logical link control layer contention resolution
between the various LLEs.
On frame reception, the multiplex procedure performs the frame decipher function and checks the FCS. If the
frame passes the FCS check, the multiplex procedure distributes the frame to the appropriate logical link entity
based on the DLCI (Data Link Connection Identifier).
GPRS Mobility Management/Session Management (GMM/SM) uses the services of the LLC layer to transfer
messages between the MS and the SGSN.
It includes functions such as attach and authentication, and transport of session management messages for
functions such as PDP context activation and deactivation.
The Short Message Service (SMS) uses the services of the LLC layer to transfer short messages between the
MS and the SGSN.
Tunneling of Messages TOM is a generic protocol layer used for the exchange of TOM Protocol Envelopes
between the MS and the SGSN.

6. Structure of TLLI
The TLLI (Temporary Logical Link Identifier) is used to identify a specific MS. TLLI assignment is controlled by
GMM. Please note that the TLLI is not part of the LLC header, it is carried by lower layer protocols (RLC/MAC or
BSSGP) or in higher layer messages (attach request,...)
A TLLI (32 bits) is built by the MS or by the SGSN either on the basis of the P-TMSI (local or foreign TLLI), or
directly (random or auxiliary TLLI).
7 6 5 4 3 2 1 0
At MS:
Bit 0 - 29
A local TLLI is derived from the P-TMSI allocated by the SGSN, and from P-TMSI
Local TLLI is valid only in the Routing Area (RA) associated with the P-TMSI. 1 1
7 6 5 4 3 2 1 0
A foreign TLLI id also derived from the P-TMSI but the P-TMSI is Bit 0 - 29
Foreign TLLI allocated in another Routing Area from P-TMSI
1 0
7 6 5 4 3 2 1 0
Random TLLI The random TLLI is selected randomly by the MS, and is
Bit 0 - 26
used when the MS does not have al valid P-TMSI.
Random Number
0 1 1 1 1
at SGSN:
At the SGSN it is only possible to build an auxiliary TLLI.
An auxiliary TLLI is selected by the SGSN and is used by the SGSN 7 6 5 4 3 2 1 0
Auxiliary TLLI and MS to unambiguously identify an Anonymous Access MM and
PDP Context. (Pleaso note starting with Rel 99. Anonymous PDP Bit 0 - 26
context is not possible any more and auxiliary TLLi not found in Auxiliary
3GPP 23.003 GPRS netrworks anymore!! 0 1 1 1 0

7. Logical Link States
A logical link entity may be in one of three basic states:
TLLI Unassigned state: unacknowledged information transfer is possible
TLLI Unassigned State in the MS-to-SGSN direction for SAPI=1 (GMM/SM)
(only GMM signaling)
Available SAPI: 1
TLLI Assigned / ADM (Asynchronous
Disconnected Mode) state: in this state a TLLI
has been assigned and unacknowledged
information transfer is possible
GPRS
attach TLLI Assigned/
ADM State Available SAPI: 1, 2, 3, 5, 7, 8, 9, 11
(GMM/SM signaling)
ABM establishment
procedure
ABM (Asynchronous Balanced Mode) state: this state is established by ABM State
means of an ABM establishment procedure and both acknowledged and (Required for acknowledged
unacknowledged information transfer is possible. user data)
Available SAPI: 3, 5, 9, 11
GPRS Mobility Management (GMM) controls TLLI assignment

8. Ciphering algorithm interface
The ciphering algorithm has three input parameters:
- the ciphering key (Kc);
- the frame-dependent input (Input); and
- the transfer direction (Direction).
The ciphering algorithm has one output parameter:
- Output.
The relationship between the input and output parameters and the ciphering algorithm is illustrated below:
Input -32 bits (depends on LLC
frame number)
Direction - 1 bit (0 for UL, 1 for DL)
Input Direction Input Direction
Kc - 64 bits, Cipher Key
Unciphered -an LLC UI or I Frame
Frame max 1523 octets Ciphering Ciphering
Kc Kc
Output -same length as LLC Algorithm Algorithm
Output Output
XOR XOR
Ciphered Frame Deciphered Frame
Unciphered Frame
MS or SGSN SGSN or MS
Once ciphering is started not only user data but almost all Signalling is sent encrypted. This makes the
analyses of messages on Gb impossible!

9. Chapter 6
LLC Protocol
6.2 Frame formats
1. LLC frames
2. LLC Transmission Modes in GPRS
3. LLC header fields-Control Field
4. LLC Acknowledged mode operation
5. Exchange Identification Parameter Negotiation
6. LLC layer parameter default values
7. Some LLC parameters
8. LLC header example

10. LLC frames
8 7 6 5 4 3 2 1 An LLC frame consists of 4 fields:
PDC/R X X SAPI
Address field, which consists of one byte, containing several
information elements (1 octet).
Control field
Protocol Discriminator bit (PD) indicates whether a frame is
an LLC frame or belongs to a different protocol. LLC frames
have the PD bit set to 0.
Information field Command/Response bit (C/R) identifies the frame as either a
command or a response.
Service Access Point Identifier (SAPI) identifies an LLE that
should process an LLC frame and also a layer-3 entity that is
Frame Check Sequence to receive information carried by the LLC.
(FCS) (3 octets)
 Control field, which identifies the type of frame uniquely. It has typically a length between 1 and 3 octets. The
content of the Control field follows on the next pages (up to 36 octets).
 Information field (if present), which carries signaling or user data of the layer 3 protocols GMM/SM, SNDCP
or SMS (140 to 1520 octets).
 Frame Check Sequence, which consists of a 24 bit Cyclic Redundancy Check (CRC) code. The CRC-24 is
used to detect bit errors in the frame header and information fields. The FCS field contains the value of a CRC
calculation that is performed over the entire contents of the header and information for protected service. The
FCS field contains the value of a CRC calculation that is performed over the frame header and 5 bytes of the
information filed only for unprotected service. The CRC calculation is done before ciphering at the transmitting
side, and after deciphering at the receiving side.

11. LLC Transmission Modes in GPRS
Acknowledged Mode In acknowledged mode, the receipt of LL ‑PDUs are confirmed.
The LLC layer retransmits LL ‑PDUs if confirmation has not been received within a I-frame
timeout period.
If there is no data in the other direction one may find: S-frame
Unacknowledged mode
In unacknowledged mode, no confirmations are required. Signalling
and SMS shall be transmitted in unacknowledged mode. It offers two options:
- transport of protected information. FCS is done over the complete LL PDU. An error will result UI-frame
in discarding the frame.
- Transport of unprotected information, the FCS is done only on header. LLC is disabled to
detect errors in the LLC information field.
Mainly when LLC connnections are established or released: U-frame
usage of Rel 97/98 Reliability Classes QoS parameter 3GPP TS 03.60 (Rel 98)
Reliability LLC Data
GTP Mode LLC Frame Mode RLC Block Mode Traffic Type
Class Protection
Non real-time traffic, error-sensitive application
1 Acknowledged Acknowledged Protected Acknowledged
that cannot cope with data loss.
Non real-time traffic, error-sensitive application
2 Unacknowledged Acknowledged Protected Acknowledged
that can cope with infrequent data loss.
Non real-time traffic, error-sensitive application
3 Unacknowledged Unacknowledged Protected Acknowledged
that can cope with data loss, GMM/SM, and SMS.
Real-time traffic, error-sensitive application that
4 Unacknowledged Unacknowledged Protected Unacknowledged
can cope with data loss.
Real-time traffic, error non-sensitive application
5 Unacknowledged Unacknowledged Unprotected Unacknowledged
that can cope with data loss.
For real-time traffic, the QoS profile also requires appropriate settings for delay and throughput.

12. LLC header fields:-Control Field I
The Control Field with a length between 1 and 3 Byte identifies the type of the frame. With GPRS four different
types are possible. To distinguish between the different types of frames the bits 6-8 from the first byte is used:
7 6 5 4 3 2 1 0
Information Frame (I-frames) is used to transmit
I-frame 0 X X X X X X X informations (Layer 3) which must be acknowledged.
A Supervisory Frames (S-frames) is the acknowledgment
S-frame 1 0 X X X X X X for I-frames.
To transmit Unconfirmed Informations a UI-frame is used.
UI-frame 1 1 0 X X X X X These UI-frames are numbered but not acknowledged frame
The U (numbered) format shall be used to provide additional
U-frame 1 1 1 X X X X X logical link control functions. This format contains no
sequence number.
I-frame and S-frame contain an A (Acknowledgement Request) bit: A=1 Ack requested,
A=0 no Ack requested
7 6 5 4 3 2 1 0
I-frame 0 A X X X X X X Numbered I frames also carry supervisory information (S
frame), and are for this reason also called I+S frames. A
separate S frame is sent when there is no information field
S-frame 1 0 A X X X X X to be transferred.
I-frame = I+S-frame

13. LLC header fields: Control Field II
Following bits indicate the type of messages:
7 6 5 4 3 2 1 0
I-frame 0 A X X X X X X U-frame 1 1 1 X M4 M3 M2 M1
X X X X X X X X
X X X X X X S1 S2
S-frame 1 0 A X X X X X
Disconnect Mode (DM) response
X X X X X X S1 S2 Disconnect (DISC) command
Unnumbered Acknowledge (UA): response
Set asynchronous balanced mode (SABM) command
Frame reject (FRMR) response
Receive Ready (RR) command / response Exchange Identification (XID) command / response
Acknowledgement (ACK) command / response
Selective Acknowledgement (SACK) command / response
Receive not ready (RNR) command /response Format Command Response M4 M3 M2 M1
--- DM 0 0 0 1
Format Command Response S1 S2 DISC --- 0 1 0 0
RR RR 0 0 --- UA 0 1 1 0
Unnumbered
Information + ACK ACK 0 1 SABM --- 0 1 1 1
Supervisory RNR RNR 1 0 --- FRMR 1 0 0 0
SACK SACK 1 1 XID XID 1 0 1 1

14. LLC header fields: Control Field III
Acknowledged Mode
I-frame 0 A X N(S) N(S)N(S) N(S) N(S)
Send sequence number N(S) identifies the I-frame and is incremented
N(S) N(S) N(S) N(S) X N(R) N(R) N(R) by 1 with each successive I-frame.
Receive sequence number N(R) denotes the expected send
sequence number of the next in-sequence received I frame. At the time
N(R) N(R) N(R) N(R)N(R) N(R) S1 S2 that a frame of the above types is designated for transmission, the
value of N(R) is set to the value of the receive state variable V(R).
S-frame 1 0 A X X N(R) N(R) N(R)
N(R) N(R) N(R) N(R) N(R) N(R) S1 S2 Unconfirmed sequence number N(U)
Unacknowledged mode
N(U) is the confirmed sequence number of UI-frames.
No verification of sequence numbers is performed for UI frames.
Therefore, an UI frame may be lost without notification to the layer 3
UI-frame 1 1 0 X X N(U) N(U) N(U) entity if a logical link exception occurs during transmission of the frame.
The U format is used to provide additional logical link control functions.
N(U) N(U) N(U) N(U) N(U) N(U) E PM This format contains no sequence number.
Encryption mode bit (E) The E bit is used to indicate whether the information and FCS fields of the UI frame are encrypted (ciphered)
to provide user data confidentiality.
Protected Mode bit (PM) The PM bit is used to indicate whether the FCS field shall be calculated using both the frame header and
information fields. The PM bit is set to 1 to indicate that the FCS covers the frame header and information fields. The PM bit is set to 0
to indicate that the FCS covers only the frame header field and the first 4 octets of the information field. This permits UI frames to
transport "unprotected" information, such that errors beyond the first 4 octets of the information field do not result in the frame being
discarded
Poll/Final bit (P/F) LLC functions
All U frames contain the Poll/Final (P/F) bit. The P/F bit serves a
function in both command frames and response frames. In command
U-frame 1 1 1 P/F M4 M3 M2 M1 frames the P/F bit is referred to as the P bit. In response frames it is
referred to as the F bit.

15. LLC header fields: Control Field IV
In Asynchronous Balanced Mode, all I+S and S SACK frames contain R(n), the SACK bitmap. At the time that a
SACK frame is designated for transmission, the value of each bit R(n) in the bitmap is set to 0 or 1 depending on
whether I frame number N(R) + n has been received or not.
R(n) = 1 indicates that the LLE transmitting the SACK frame has correctly received I frame number N(R) + n.
R(n) = 0 indicates that the LLE transmitting the SACK frame has not correctly received I frame number N(R) + n.
Octet Octet
I-frame 0 A X N(S) N(S)N(S) N(S) N(S) 1 S-frame 1 0 A X X N(R) N(R) N(R) 1
N(S) N(S) N(S) N(S) X N(R) N(R) N(R) 2 N(R) N(R) N(R) N(R) N(R) N(R) S1 S2 2
N(R) N(R) N(R) N(R)N(R) N(R) S1 S2 3 R(1) R(2) R(3) R(4) R(5) R(6) R(7) R(8) 3
X X X K 4 R(9) R(10) R(11) R(12) R(13) R(14) R(17) R(16) 4
R(1) R(2) R(3) R(4) R(5) R(6) R(7) R(8) 5
R(9) R(10) R(11) R(12) R(13) R(14) R(17) R(16) 6
R R R R R R R
(249) (250) (251) (252) (253) (254) (255)
X 34 (max)
R R R R R R R
X 36 (max)
(249) (250) (251) (252) (253) (254) (255)
:
K Bitmap length indicator

16. LLC Acknowledged mode operation
V(S) V(R) V(A)
MS SGSN V(S) V(R) V(A)
SABM (SAPI)
0 0 0
UA successful
0 0 0 ABM establishment
I (RR, N(S)=0, N(R)=0)
1 0 0 0 1 0
S(RR, N(R)=1)
1 0 1
2 0 1 I (RR, A=0, N(S)=1, N(R)=0) 0 2 0
3 0 1 I (RR, A=1, N(S)=2, N(R)=0)
I(RR, N(S)=0, N(R)=3) 0 3 0
3 1 3 1 3 0
4 1 3
I (RR, A=1, N(S)=4, N(R)=1)
5 1 3 1 3 1
S (ACK, N(R)=3)
I (RR, A=1, N(S)=3, N(R)=1) 1 5 1
S (RR, N(R)=5)
5 1 5
V(S) is the Send State Variable. The transmitting LLE holds here the number of the next I-frame to be
transmitted. As soon as the next I-frames was sent, its value is increased by one (mod 512). If a frame is
retransmitted, its value is not increased.
V(A) represents the Acknowledged State Variable. V(A) denotes the last frame, which has not yet been
confirmed, i.e. V(A) – 1 equals N(S) of the last acknowledged frame. V(S) may exceed V(A) by k. k
can range between 1 and 255.
V(R) is the Received State Variable. It identifies the next in-sequence I-frame to be received at the LLE. It is
incremented by one, if it received an error-free, in-sequence I-frame with N(S)=V(R).

17. Exchange Identification Parameter Negotiation
VERSION: LLC version number
Negotiation Procedure during ABM procedure
IOV-UI: ciphering Input offset value for UI frames, common for all SAPIs of a
SABM (T200 = 300, N200 = 4) TLLI
IOV-I: ciphering Input offset value for I frames, for the SAPI under
UA (T200 = 300, kD = 1) negotiation
T200: retransmission time-out
N200: maximum number of retransmissions
N201-U: maximum information field length for U and UI frames
Negotiation Procedure with XID N201-I: maximum information field length for I frames
mD: I frame buffer size in the downlink direction
XID (P=1, N201-I=500, mD=250, L3-Par) mU: I frame buffer size in the uplink direction
kD: window size in the downlink direction
XID (F=1, N201-I=500, mD=250, L3-Par) kU: window size in the uplink direction
The negotiation procedure is one-step, e.g. one side starts the process by sending an XID command or a
SABM command containing an Information field, offering a certain set of parameters from the applicable
parameter repertoire the sending entity wants to negotiate, proposing values within the allowed range. In return,
the other side sends an XID response or an UA frame with an information field, either confirming these
parameter values by returning the requested values, or offering higher or lower ones in their place.
Both entities supports the negotiated values, however under certain conditions one or more parameters may
need to be re-negotiated (e.g., in the case of a change in SGSN).
Without any prior XID exchange, default values apply.

18. LLC layer parameter default values (3GPP 04.64)
LLC SAPI 1 SAPI 2 SAPI 3 SAPI 5 SAPI 7 SAPI 8 SAPI 9 SAPI 11
Parameter GMM TOM 2 User Data 3 User Data 5 SMS TOM 8 User Data 9 User
Data 11
Version 0
IOV‑UI 0
IOV‑I Note 2 Note 2 227 • SAPI 227 • SAPI Note 2 Note 2 227 • SAPI 227 • SAPI
T200 and T201 5s 5s 5s 10 s 20 s 20 s 20 s 40 s
N200 3 3 3 3 3 3 3 3
N201‑U 400 270 500 500 270 270 500 500
N201‑I Note 2 Note 2 1 503 1 503 Note 2 Note 2 1 503 1 503
mD Note 2 Note 2 1 520 760 Note 2 Note 2 380 190
mU Note 2 Note 2 1 520 760 Note 2 Note 2 380 190
kD Note 2 Note 2 16 8 Note 2 Note 2 4 2
kU Note 2 Note 2 16 8 Note 2 Note 2 4 2
NOTE 1: Proper LLC operation requires that timer T200 be greater than the maximum time between transmission of command
frames and the reception of their corresponding response or acknowledgement frames.
NOTE 2: This parameter applies to ABM procedures. ABM operation is not allowed for GMM, SMS, and TOM that use only
UI frames for information transfer.
NOTE 3: The default values for SAPIs 3, 5, 9, and 11 have been chosen to correspond with the four GPRS quality of service
delay classes, see 3GPP TS 02.60. However, there is no fixed relationship between SAPI and delay class. The LLC layer
parameters for any SAPI can be negotiated to support any QoS profile, see 3GPP TS 03.60.
NOTE 4: Proper LLC operation requires that the values for N201 ‑U and N201 ‑I are not greater than the maximum number of
octets in an information field that can be transmitted or retransmitted over the Gb interface, see 3GPP TS 08.18. It is the
responsibility of the SGSN to negotiate N201 ‑U and N201 ‑I to values compatible with the usage of the Gb interface.

19. Some LLC parameters
The maximum length of the information field is defined by the N201
parameter N201-U for LLC UI and
Information field N201-I for LLC I&S frames N201: min 140, max 1520 octets
Only for acknowledged mode
MS SGSN
Dataframe
T200 No Ack !
1. retransmission
T200 No Ack !
2. retransmission
No Ack !
N200 th. retransmission
T200 No Ack !
release

20. LLC header example
|GPRS IP, RFC 791 12.81 (IP_791) DTGR (= Datagram) |GPRS Logical Link Control, SMG#31, 04.64
V6.7.0 (TS 101 351) (LLC670) UI (= Unnumbered information) |
|Unnumbered information |
|0------- |Protocol Discriminator |LLC |
|-1------ |Command/Response |MS->SGSN: Resp | SGSN->MS: Cmd |
|--00---- |Spare |0 |
|----0011 |SAPI |QOS priority level 1 |
|110----- |Format indicator |UI-Frame |
|---00--- |Spare |0 |
|***b9*** |N(U) |415 |
|------0- |Encryption function bit |encryption |
|-------1 |Protect data bit |FCS for frame + data field |
|**B500** |DATA |35 10 80 37 38 39 30 31 32 33 34 35 |