Complete PDU session establishment, modification and release — every message named, N4/PFCP deep dive, UPF selection algorithm, charging integration, top field failures
1. What Is the SMF — The Simple Version
The SMF (Session Management Function) is the most signalling-intensive NF in the 5G Core. Everything else — AMF, PCF, UDM — handles identity, policy, and mobility. The SMF manages the lifecycle of the actual data pipe: the PDU session. Every time a device connects to the internet on a 5G SA network, the SMF is involved from the first byte of session setup to the final charging record.
The SMF sits at the intersection of control and user plane. It talks to the AMF (N11) for session relay, PCF (N7) for policy, UDM (N10) for subscription data, CHF (N40) for charging, and most critically the UPF (N4/PFCP) to program the actual forwarding rules. Get the SMF configuration wrong and users either cannot connect, get the wrong QoS, or generate incorrect charging records. All three happen in first SA deployments.
| 3GPP Reference |
| 3GPP TS 23.502 Section 4.3 — PDU Session Establishment, Modification, Release procedures |
| 3GPP TS 29.502 — Nsmf_PDUSession Service (SMF API exposed to AMF on N11) |
| 3GPP TS 29.244 — Interface between SMF and UPF: PFCP protocol specification |
| 3GPP TS 29.512 — Npcf_SMPolicyControl Service (N7 interface SMF-PCF) |
| 3GPP TS 32.255 — Charging in 5G System: SMF charging data requirements |
2. Architecture — What the SMF Connects To
| Interface | Peer NF | Protocol | What Flows Over It |
| N11 | AMF | HTTP/2 REST (SBI) | PDU session context, NAS relay, handover path switch updates |
| N7 | PCF | HTTP/2 REST (SBI) | PCC rules: 5QI, GBR/MBR, flow descriptions, charging rule IDs |
| N10 | UDM | HTTP/2 REST (SBI) | SM subscription data: Session-AMBR, default QoS, static IP |
| N40 | CHF | HTTP/2 REST (SBI) | Charging data requests, quota grants, CDR triggers |
| N4 | UPF | PFCP over UDP 8805 | Session rules: PDR/FAR/URR/QER install, usage reports, heartbeat |
| N16 | SMF (peer) | HTTP/2 REST | I-SMF to H-SMF context in roaming scenarios |
Table 1 — SMF interfaces. N4/PFCP to the UPF is the most latency-sensitive. Every session create/modify/delete requires a round-trip on N4.
3. Step-by-Step — PDU Session Establishment
Here is the complete flow when a UE establishes a data session on an SA 5G network. This is what happens every time a 5G device connects to the internet:
Step 1 — UE sends NAS: PDU Session Establishment Request to AMF via the gNB (N1 interface). The message carries: S-NSSAI (which slice), DNN (which data network), PDU Session ID (1–15, UE-chosen), PDU Type (IPv4/IPv6/Ethernet), and SSC Mode (Mode 1 = anchor UPF preserved on mobility).
Step 2 — AMF queries NRF for an SMF serving this S-NSSAI and DNN. NRF returns SMF endpoints. AMF selects one and sends N11: Nsmf_PDUSession_CreateSMContext Request including SUPI, DNN, S-NSSAI, UE location (TAI), NAS PDU. The SMF now owns this session.
Step 3 — SMF queries UDM on N10: Nudm_SDM_Get for SM subscription data. Returns: Session-AMBR (max aggregate bitrate), subscribed default QoS (5QI, ARP), static IP if assigned. SMF also registers itself as serving SMF for this SUPI via Nudm_UECM_Registration.
Step 4 — SMF invokes PCF on N7: Npcf_SMPolicyControl_Create Request. PCF returns SM Policy Decision containing: PCC rules (5QI per QoS flow, ARP, optional GBR/MBR), session rules (Session-AMBR), charging rule identifiers, and policy control request triggers. These rules drive both QoS at UPF and charging at CHF.
Step 5 — SMF selects a UPF using a five-stage algorithm: (1) DNN filter — only UPFs serving this DNN are candidates; (2) S-NSSAI filter — slice-specific UPF pools if configured; (3) location match — UE TAI mapped to nearest UPF site; (4) load balance — least-loaded UPF in selected site; (5) capability check — UPF must support required features (buffering, UL CL, URR metering). Any stage misconfigured = wrong UPF assigned silently.
Step 6 — SMF sends N4: PFCP Session Establishment Request to selected UPF. Installs the complete rule set: PDR (match UE GTP-U TEID for uplink; match UE IP for downlink), FAR (forward uplink to N6; buffer downlink — gNB TEID not yet known), URR (measure volume/time for charging — trigger at quota thresholds), QER (enforce Session-AMBR and per-flow GBR/MBR). UPF responds with its allocated N3 F-TEID.
Step 7 — SMF responds to AMF on N11: Nsmf_PDUSession_CreateSMContext Response. Contains UE IP address, Session-AMBR, N2 SM Information (QoS flow list with 5QI/ARP, UPF N3 F-TEID). AMF sends N2: PDU Session Resource Setup Request to gNB. gNB allocates DRB and GTP-U tunnel, sends RRC Reconfiguration to UE, confirms with N2: PDU Session Resource Setup Response containing gNB N3 F-TEID.
Step 8 — AMF forwards gNB N3 F-TEID to SMF via N11: Nsmf_PDUSession_UpdateSMContext. SMF immediately sends N4: PFCP Session Modification Request to UPF — this is the critical step most simplified diagrams skip. It updates the downlink FAR from Action=BUFFER to Action=FORWARD with the gNB’s TEID as Outer Header Creation target. Without this step completing successfully, downlink data is permanently buffered. The UPF now has a complete bidirectional forwarding path. Data flows.
| Pro Tip |
| The PFCP Session Modification in Step 8 is the single most common silent failure in early SA deployments. |
| If it times out — because UPF N4 queue is backed up — the UE gets an established session with working uplink but zero downlink. |
| No alarm fires. Users report “internet not working.” Diagnosis: check SMF logs for PFCP_SESSION_MODIFICATION_TIMEOUT. |
4. Key Parameters and Technical Terms
| Term / Parameter | Definition | Typical Value / Where It Matters |
| PDR — Packet Detection Rule | Matches incoming packets to a session. Evaluated in precedence order (lowest = highest priority). Contains: Source Interface, F-TEID (uplink), UE IP (downlink), SDF filters (per-flow). | Precedence 100 for specific flows; 65535 for default catch-all |
| FAR — Forwarding Action Rule | What to do with PDR-matched packets: FORWARD, BUFFER, or DROP. Contains Outer Header Creation (GTP-U TEID+IP) for forwarding. | Action=BUFFER initially for downlink. Updated to FORWARD with gNB TEID in Step 8. |
| URR — Usage Reporting Rule | Measures traffic volume and/or time. Triggers usage reports to SMF at configurable thresholds. Drives both online quota management and offline CDR generation. | Volume threshold: 1 GB = 1,073,741,824 bytes. Periodic: 3600s for postpaid CDR. |
| QER — QoS Enforcement Rule | Enforces MBR/GBR per session or per QoS flow. Gate status (OPEN/CLOSED). Tags packets with QFI (QoS Flow Identifier). | Session MBR: from Session-AMBR in UDM subscription. GBR for VoNR: 100 kbps UL+DL. |
| F-TEID | Fully Qualified TEID = IP address + 32-bit Tunnel Endpoint Identifier. Identifies one end of a GTP-U tunnel on N3 or N9. | Allocated by UPF in PFCP Session Establishment Response. Must match what gNB uses. |
| PFCP Heartbeat | SMF and UPF exchange PFCP Heartbeat Request/Response every heartbeatInterval. 3 missed = association failed. | Default interval: 60s. After 3 misses (180s): SMF declares UPF path failed. |
| PFCP T1/N1 | PFCP request retransmission: wait T1 seconds, retry N1 times before declaring failure. | Default T1=3s, N1=3. After 9s total: PFCP_SESSION_TIMEOUT. Tune for WAN N4 paths. |
| Session-AMBR | Aggregate Maximum Bit Rate for the entire PDU session. Enforced by UPF QER. | From UDM subscription. Caps total session throughput regardless of QoS flow count. |
| 5QI | 5G QoS Identifier — standardised per-flow QoS class. Defines priority, packet delay budget (PDB), packet error rate (PER). | 5QI=1: VoNR (GBR, PDB 100ms). 5QI=9: default internet (Non-GBR). See Table 3. |
| SSC Mode | Session and Service Continuity mode. Mode 1: anchor UPF preserved on mobility. Mode 2: new PDU session on new UPF. Mode 3: dual anchor during handover. | Mode 1 = default. Mode 2/3 needed for distributed UPF re-anchoring on UE mobility. |
| CHF — Charging Function | Handles both online credit control (prepaid quota) and offline CDR generation. Accessed by SMF on N40. | Circuit breaker mandatory: CHF outage must not fail PDU sessions — fall back to offline. |
| PFCP Association | Node-level handshake before any sessions. SMF and UPF exchange capabilities and supported features (UL CL, buffering, linked URR, etc.). | Established at SMF/UPF startup. Heartbeat maintains it. Loss = all sessions on that UPF become unserviceable. |
Table 2 — SMF/PFCP key parameters. PDR→FAR→URR→QER is the core PFCP programming model — all four rule types are installed per PDU session.
| 5QI | Resource Type | Priority | PDB (ms) | PER | Typical Service |
| 1 | GBR | 20 | 100 | 10⁻² | Conversational Voice (VoNR) |
| 2 | GBR | 40 | 150 | 10⁻³ | Conversational Video (VoNR video) |
| 3 | GBR | 30 | 50 | 10⁻³ | Real-time gaming, V2X |
| 4 | GBR | 50 | 300 | 10⁻⁶ | Non-conversational buffered video |
| 65 | GBR | 7 | 75 | 10⁻² | Mission critical PTT (MCPTT) |
| 5 | Non-GBR | 1 | 100 | 10⁻⁶ | IMS Signalling |
| 7 | Non-GBR | 70 | 100 | 10⁻³ | Live streaming, interactive gaming |
| 9 | Non-GBR | 90 | 300 | 10⁻⁶ | Default internet — best effort |
| 69 | Non-GBR | 5 | 60 | 10⁻⁶ | MCPTT signalling, emergency services |
| 80 | Non-GBR | 68 | 10 | 10⁻⁶ | Low-latency eMBB, cloud gaming |
Table 3 — Standardised 5QI values (3GPP TS 23.501 Table 5.7.4-1, selected entries). GBR flows require guaranteed radio resources from gNB scheduler. Non-GBR is best-effort subject to congestion.
5. Common Issues in the Field
Asymmetric Connectivity — Uploads Work, Downloads Fail
The most common SMF-layer failure in early SA deployments. The PDU session establishes successfully, uplink data flows normally, but the UE receives no downlink data. The root cause is almost always the PFCP Session Modification in Step 8 failing to complete. The UPF remains in Action=BUFFER mode for the downlink FAR — it keeps buffering packets indefinitely.
| Field Note: PFCP Session Modification Timeout — 0.3% of Sessions Affected |
| GCC SA deployment: 0.3% of PDU sessions showing zero downlink 1 week after go-live. |
| Users reported “5G connected but internet not working.” No alarms on any NF. |
| SMF log search: PFCP_SESSION_MODIFICATION_TIMEOUT occurring during busy hour. |
| Root cause: UPF N4 processing thread pool (4 threads) saturated during peak PDU session setup rate. |
| PFCP modification requests queued for 4-6 seconds. Default SMF T1 timer = 3s. Timeout before processing. |
| Fix 1: UPF N4 processing threads increased from 4 to 16. Fix 2: SMF T1 increased to 8s, N1 retries = 3. |
| Lesson: UPF N4 thread pool must be sized for peak setup rate + handover modification rate simultaneously. |
Wrong UPF Selected — Silent Traffic Misrouting
UPF selection uses a five-stage algorithm. A gap at any stage causes a silent fallback to the default UPF pool. In enterprise deployments this means OT traffic on the internet UPF. No alarm fires. The SMF does not log “wrong UPF selected” — it logs “UPF selected: internet-pool-upf-01” which looks correct unless you know what pool that UPF belongs to.
| Field Note: Enterprise Factory Traffic on Internet UPF — Compliance Breach |
| Smart factory private 5G deployment. New building extension TAIs not added to SMF TAI-UPF mapping. |
| SMF fell back silently to internet UPF pool for all devices in new extension. |
| Factory OT traffic traversing shared internet UPF for 3 months before quarterly security audit. |
| Fix: add all enterprise site TAIs to mapping before any new coverage area goes live. |
| Add monitoring: Prometheus alert if enterprise DNN session count on internet UPF pool > 0. |
CHF Unavailability Blocks All Prepaid Sessions
If the CHF is unreachable and there is no circuit breaker configured in the SMF, every new PDU session for an online-charging subscriber fails to establish. The SMF waits for a credit grant from CHF that never arrives. Postpaid subscribers are unaffected. This creates an apparent “5G works for some users, not others” incident that takes time to diagnose if the CHF alarm is not prominent.
6. Troubleshooting Approach
When session failures or performance issues appear, layer your investigation using the session lifecycle as a guide. Most SMF failures manifest at a specific step and have a specific counter to confirm.
| Symptom | Step Failing | SMF Log / Counter to Check | Fix |
| PDU session setup fails entirely | Step 2: NRF/SMF selection or Step 3: UDM N10 timeout | SMF: Nsmf_CreateSMContext error code; UDM response latency P95 | Scale NRF; check UDM N10 connectivity; enable NRF caching |
| Session up but zero downlink data | Step 8: PFCP Session Modification timeout | SMF: PFCP_SESSION_MODIFICATION_TIMEOUT; UPF N4 queue depth | Increase UPF N4 threads; tune T1/N1 timers |
| Wrong QoS — user gets wrong speed plan | Step 4: PCF returns wrong PCC rules or UDM returns wrong AMBR | SMF: Session-AMBR value in PFCP QER; PCF policy log | Check UDM subscription profile; check PCF policy for that SUPI |
| No charging — CDRs missing | Step 6: URR rules not installed or CHF N40 failure | SMF: URR install confirmation; CHF reachability status | Check CHF pod health; verify URR volume thresholds in SMF config |
| Session setup slow — latency > 300ms | Step 3/4: UDM or PCF high response latency | SMF: N10 response latency histogram; N7 response latency histogram | Scale UDM/PCF; check NRF discovery cache hit rate |
| All sessions fail for one UPF | N4: PFCP Association lost to that UPF | SMF: PFCP Association status; UPF pod health | Check UPF pod, N4 transport path, PFCP heartbeat timer |
| Prepaid users cannot connect, postpaid OK | N40: CHF unavailable, no circuit breaker | SMF: N40 timeout counter; CHF pod status | Deploy CHF circuit breaker: fall back to offline charging on N40 failure |
Table 4 — SMF troubleshooting by symptom. Each failure maps to a specific step in the session establishment flow.
7. Design Recommendations
Size SMF memory for worst-case concurrent PDU sessions. Estimate 10–16 MB per 1000 active sessions. At 10 million concurrent sessions: up to 100 GB across the SMF cluster. Set Kubernetes resource requests = limits (Guaranteed QoS class). An OOMKilled SMF pod drops every session it managed — potentially millions of users simultaneously.
N4 is a mission-critical interface. Treat it like a signalling link: DSCP CS6 marking, explicit bandwidth reservation, < 1 ms one-way latency between SMF and UPF. At 1 million active sessions with 60% hourly turnover plus handover-driven modifications: expect 2–5 million PFCP transactions per hour during busy hour. N4 traffic engineering is not optional.
Always configure a CHF circuit breaker. After N consecutive N40 timeouts, SMF falls back to offline charging for new sessions. Never hard-fail PDU session establishment because CHF is slow. A CHF outage should be a billing problem, not a connectivity outage.
Run load tests on UPF N4 thread pool before go-live. Simulate peak PDU session setup rate (registration storm scenario). If PFCP Session Establishment Response time P99 exceeds 1 second, increase N4 threads. The Step 8 modification timeout incidents that plague first SA deployments are almost always a UPF N4 capacity issue, not an SMF bug.
Complete your TAI-to-UPF mapping table before any site goes live. Build a CI/CD check that fails deployment if a new TAI is added to the RAN configuration without a corresponding SMF UPF mapping entry. This is the simplest way to prevent silent enterprise traffic misrouting.
8. Summary — Key Takeaways
| Topic | Key Takeaway |
| PDU session flow | 8-step flow. Step 8 (PFCP Modification with gNB TEID) is the critical step that completes the downlink path. If it fails silently: uploads work, downloads fail. |
| PFCP rules | 4 rule types: PDR (match), FAR (action), URR (measure), QER (enforce). Downlink FAR starts as BUFFER. Becomes FORWARD only after gNB TEID is known. |
| UPF selection | 5-stage algorithm: DNN→S-NSSAI→TAI location→load→capability. Missing TAI = silent wrong-pool assignment. Most dangerous in enterprise deployments. |
| N4 sizing | Mission-critical. Size UPF N4 threads for peak setup + handover modification rate simultaneously. Most “SMF bugs” in production are UPF N4 capacity issues. |
| CHF circuit breaker | Mandatory. CHF outage without circuit breaker = all prepaid PDU sessions fail. Fall back to offline charging, not hard reject. |
| SMF memory | requests=limits in K8s. OOMKill drops ALL sessions managed by that pod. Size for concurrent sessions + 100% headroom. |
| Charging | Online charging (prepaid): real-time quota via CHF. Offline (postpaid): CDR via CHF. URR volume thresholds drive both. 32-bit counter wraparound is a known bug in some UPF versions — use 64-bit. |
Table 5 — Post 02 summary. The PFCP rule set (PDR/FAR/URR/QER) and Step 8 downlink modification are the two things that cause the most production incidents.
Next: Post 03 — 5G Network Slicing & QoS
Muhammad Tahir Riaz
Data Analytics & Automation Consultant | 17+ years telecom | trmtelcocloudai.com