While analyzing an LTE Attach procedure in Wireshark, I came across an interesting case of Authentication Synchronization Failure during the EPS AKA authentication procedure.
๐๐น๐ผ๐ ๐ผ๐ฏ๐๐ฒ๐ฟ๐๐ฒ๐ฑ
UE โ MME: Attach Request + PDN Connectivity Request
MME โ UE: Authentication Request (RAND + AUTN)
UE โ MME: Authentication Failure โ Synch failure (Cause 21), with AUTS for re-synchronization
MME โ UE: Authentication Request (Retry, with corrected vector)
UE โ MME: Authentication Response (RES)
๐ช๐ต๐ฎ๐ ๐ต๐ฎ๐ฝ๐ฝ๐ฒ๐ป๐ ๐ฑ๐๐ฟ๐ถ๐ป๐ด ๐ฆ๐๐ป๐ฐ๐ต ๐๐ฎ๐ถ๐น๐๐ฟ๐ฒ?
During LTE AKA authentication, the UE/USIM validates the AUTN received from the network. One of the key parameters involved in this validation is the Sequence Number (SQN).
If the SQN embedded in AUTN falls outside the UEโs acceptable window, the USIM rejects the vector and the UE responds with:
Authentication Failure โ Synch failure (21)
Along with this, the UE includes AUTS (SQN_MS โ AK, and MAC-S), which the network forwards to the HSS for SQN re-synchronization. Once resynced, the MME retries authentication with a fresh vector, and the UE responds normally.
๐ช๐ต๐ฎ๐ ๐ ๐ฐ๐ต๐ฒ๐ฐ๐ธ๐ฒ๐ฑ ๐ถ๐ป ๐ช๐ถ๐ฟ๐ฒ๐๐ต๐ฎ๐ฟ๐ธ
Authentication Request
RAND
AUTN
SQN โ AK
AMF
Authentication Failure Cause
AUTS
SQN_MS โ AK
MAC-S
Authentication Response / RES
๐๐ฒ๐ ๐๐ฎ๐ธ๐ฒ๐ฎ๐๐ฎ๐
A packet-level view makes it much easier to understand where authentication is failing and whether the issue is related to SQN synchronization between the UE/USIM and the networkโs authentication context.
This was a good practical example of using Wireshark + NAS message analysis for LTE protocol troubleshooting.
LinkedIn: 