Inside the mobile core: how 5G networks route your data
Behind every cell tower sits the operator's core network, and in 5G it is a team of separate functions. Follow a phone as it signs on with the AMF, gets checked against the UDM, opens a PDU session through the SMF and sends its data through a GTP-U tunnel to the UPF. Then walk into the next cell and watch the core move the tunnel while your session and IP address stay the same.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01Which 5G core function handles registration and keeps track of where your phone is?
The AMF receives the phone's registration request (passed on by the gNB) and manages its mobility. The UDM holds subscriber data, the UPF forwards packets and the gNB is the base station.
02What is a PDU session?
3GPP TS 23.501 defines a PDU session as an association between the phone and a data network. The SMF sets it up and gives the phone its IP address.
03Your video streams down to your phone. Which core function do the video packets pass through?
User data travels only through the user plane: internet, UPF, a GTP-U tunnel to the gNB, then radio. The AMF, SMF and UDM are the control plane; they give instructions but never carry your data.
04What does the gNB do with your packet before sending it to the UPF?
Between the gNB and the UPF (the N3 link) each packet rides a GTP-U tunnel: an outer IP and UDP header (port 2152) plus a GTP-U header whose TEID says which session it belongs to.
05After you walk into the next cell and the handover is done, what has changed?
The two gNBs hand you over across Xn, then the path switch tells the UPF to send your packets to the new gNB. The UPF is the fixed anchor, so the session and address survive the move.
Glossary
- gNB
- The 5G base station (gNodeB). It handles the radio and connects to the core over fibre.
- AMF
- Access and Mobility Management Function: handles registration and keeps track of where each phone is.
- SMF
- Session Management Function: sets up PDU sessions, gives the phone an IP address and controls the UPF.
- UPF
- User Plane Function: forwards your packets between the tunnels and the internet; the fixed anchor when you move.
- UDM
- Unified Data Management: stores subscriber identities, plans and the data used to check SIMs.
- PDU session
- A data connection between the phone and one data network, such as the internet.
- GTP-U tunnel
- The wrapper that carries a session's packets between gNB and UPF; a tunnel number (TEID) marks which session they belong to.
- Control plane / user plane
- The control plane (AMF, SMF, UDM) decides and signals; the user plane (UPF, gNB) carries your actual data.
Notes and sources
- 198.51.100.23 and 203.0.113.10 are RFC 5737 documentation addresses, as are the operator-side tunnel addresses 192.0.2.1, 192.0.2.11 and 192.0.2.12; the subscriber identity uses the ITU-T E.212 test network code 001-01.
- Tunnel numbers (TEIDs), the session name "internet" and the cell sizes in the drawing are illustrative.
- A real 5G core has more functions than shown: the AUSF runs the SIM check with the UDM, the PCF sets policy and the NRF helps functions find each other.
- Many operators give phones an IPv6 address instead of, or as well as, an IPv4 one (documentation examples use 2001:db8::/32, RFC 3849).
- AMF, SMF and UDM talk through service-based interfaces (HTTP/2 APIs, TS 29.500), drawn as one shared line; the SMF controls the UPF over N4 (PFCP).
- 3GPP TS 23.501: System architecture for the 5G System
- 3GPP TS 23.502: Procedures for the 5G System (registration, PDU session, handover)
- 3GPP TS 29.281: GTP-U (GPRS Tunnelling Protocol, user plane)
- 3GPP TS 29.244: PFCP, the N4 interface between SMF and UPF
- 3GPP TS 33.501: Security architecture for 5G (SUCI, authentication)
- 3GPP TS 38.300: NR and NG-RAN overall description (Xn handover)
- RFC 5737: IPv4 addresses reserved for documentation
Quiz Unlocks after the last step.