1. MO SMS over SGs, UE -> SMC
[0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 99 (0x63) (Uplink NAS transport)
lte_emm_msg
emm_ul_nas_transport
nas_msg_container
trans_id = 0 (0x0)
prot_disc = 9 (0x9) (GSM_SMS_MESSAGES)
msg_type = 1 (0x1)
sms_prot
sms_cp_data //CM layer, SM-LL
sms_cp_user_data
length = 30 (0x1e)
rp_message
mti = 0 (0x0)
message_reference = 1 (0x1)
sms_rp_message_body //Relay Layer, SM-RL
rp_data_from_ue
orig_addr
length = 0 (0x0)
dest_addr //中继 - 短信中心号码
length = 8 (0x8)
ext = 1 (0x1)
type = 1 (0x1)
num_plan_id = 1 (0x1)
number[0] = 8 (0x8)
number[1] = 6 (0x6)
number[2] = 1 (0x1)
number[3] = 3 (0x3)
number[4] = 0 (0x0)
number[5] = 1 (0x1)
number[6] = 0 (0x0)
number[7] = 8 (0x8)
number[8] = 8 (0x8)
number[9] = 8 (0x8)
number[10] = 5 (0x5)
number[11] = 0 (0x0)
number[12] = 0 (0x0)
number[13] = 15 (0xf)
user_data
length = 17 (0x11)
sms_tpdu_prot //Transfer Layer, SM-TL
mti = 1 (0x1)
sm_tl_sms_submit
reply_path = 0 (0x0)
udh_indicator = 0 (0x0)
stat_rep_req = 0 (0x0)
validity_per_fmt = 2 (0x2)
reject_dup = 0 (0x0)
msg_ref = 65 (0x41)
dest_address // 目标号码
length = 13 (0xd)
type_of_number = 1 (0x1)
number_plan_id = 1 (0x1)
addr_value[0] = 8 (0x8)
addr_value[1] = 6 (0x6)
addr_value[2] = 1 (0x1)
addr_value[3] = 8 (0x8)
addr_value[4] = 9 (0x9)
addr_value[5] = 3 (0x3)
addr_value[6] = 6 (0x6)
addr_value[7] = 0 (0x0)
addr_value[8] = 4 (0x4)
addr_value[9] = 7 (0x7)
addr_value[10] = 5 (0x5)
addr_value[11] = 2 (0x2)
addr_value[12] = 0 (0x0)
addr_value[13] = 15 (0xf)
prot_id = 0 (0x0) (no interworking, SME-to-SME)
data_coding_scheme = 8 (0x8) (0x08 gen compressed=0 msg_class_bit=0, charset=2, class=0)
integer_validity_per = 0 (0x0)
tp_user_data // 实际数据
user_data_len = 2 (0x2)
sm_tp_user_data_unicode_16
user_data_16_bit[0] = 20013 (0x4e2d) (0x4e2d)
user_data_16_bit[1] = 0 (0x0) (0x0)
2. CP_ACK, SMC -> UE
[0xB0EC] LTE NAS EMM Plain OTA Incoming Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 98 (0x62) (Downlink NAS transport)
lte_emm_msg
emm_dl_nas_transport
nas_msg_container
trans_id = 8 (0x8)
prot_disc = 9 (0x9) (GSM_SMS_MESSAGES)
msg_type = 4 (0x4)
sms_prot
sms_cp_ack // CP-ACK
3. RP-ACK with submit report, SMC -> UE
[0xB0EC] LTE NAS EMM Plain OTA Incoming Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 98 (0x62) (Downlink NAS transport)
lte_emm_msg
emm_dl_nas_transport
nas_msg_container
trans_id = 8 (0x8)
prot_disc = 9 (0x9) (GSM_SMS_MESSAGES)
msg_type = 1 (0x1)
sms_prot
sms_cp_data // CM
sms_cp_user_data
length = 13 (0xd)
rp_message
mti = 3 (0x3)
message_reference = 1 (0x1)
sms_rp_message_body // RL
rp_ack_to_ue // RP-ACK
user_data_incl = 1 (0x1)
user_data
length = 9 (0x9)
sms_tpdu_prot // TL
mti = 1 (0x1)
sm_tl_sms_submit_report
udh_indicator = 0 (0x0)
param_ind = 0 (0x0)
serv_cent_time_stamp_date = 1184128 (0x121180) (11/08/21)
serv_cent_time_stamp_time = 147492 (0x24024) (20:04:42)
serv_cent_time_stamp_tz = 35 (0x23) (0x23 +12:30)
4. CP_ACK of submit report, UE -> SMC
[0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 99 (0x63) (Uplink NAS transport)
lte_emm_msg
emm_ul_nas_transport
nas_msg_container
trans_id = 0 (0x0)
prot_disc = 9 (0x9) (GSM_SMS_MESSAGES)
msg_type = 4 (0x4)
sms_prot
sms_cp_ack // CP-ACK of submit report