EPS Architecture (E-UTRAN + EPC) in LTE 4G

Introduction

The Evolved Packet System (EPS) is the complete 4G LTE system — not just the air interface, but the radio access network, the core, and every named link and protocol between them. It is the architecture an interviewer draws on a whiteboard, the one a core engineer configures, and the reference model every 5G concept is measured against.

EPS has exactly two halves: the radio side, E-UTRAN, a flat mesh of eNBs; and the all-IP core, EPC. Its two organising principles are worth stating up front because everything else is a consequence of them. First, the architecture is flat — the 3G radio controller is gone and its jobs live in the base station. Second, the control plane and user plane are rigorously separate — signalling nodes never touch your packets, and packet-forwarding nodes never make a policy decision, so an operator can scale each independently.

This page walks the whole system: what EPS is, the E-UTRAN mesh, each EPC node, every reference point and its protocol, the end-to-end and protocol-stack pictures, the bearer chain, and roaming. It is grounded in TS 23.401, TS 23.402 and TS 36.300.

Why the EPS architecture matters

Understanding the architecture matters because faults, features and interviews all live at the interfaces. When voice fails to set up, when a handover drops a call, when roaming traffic takes a slow path, the answer is almost always "which node, on which reference point, over which protocol" — and you cannot reason about that without the map. The plane separation in particular is the single idea that carries forward unchanged into 5G, so getting it right here pays off twice.

It also matters because EPS is the baseline for the 5G Core. Every EPC node has a 5G descendant, every reference point a 5G equivalent, and the LTE EPS bearer is the direct ancestor of the NR QoS flow. Learn the EPS map well and the 5GC is mostly a renaming exercise with a service-based twist.

What EPS Is

Where 3G had a hierarchy of controllers stacked above the base stations, LTE flattens everything. The whole 4G system — radio plus core — is the Evolved Packet System (EPS), and it has exactly two halves: the radio access network E-UTRAN (Evolved UMTS Terrestrial Radio Access Network) and the core network EPC (Evolved Packet Core). The UE reaches the network over the radio interface, the radio side carries its traffic to the core, and the core connects it to the outside world. There is no circuit-switched domain at all — voice rides as VoLTE over the same packet bearers as everything else, through an external IMS network reached beyond the core.

E-UTRAN — a Flat Mesh of eNBs

The radio access network is deliberately simple: it contains only one type of node, the eNB (evolved Node B). Each eNB terminates the radio protocols towards the UE and connects both sideways and upward. There is no separate controller sitting above it — the eNB does its own radio resource management, scheduling, admission control and handover decisions. It terminates the full radio protocol stack: PHY, MAC, RLC, PDCP and RRC.

Two link types define the mesh. Neighbouring eNBs connect to each other directly over the X2 interface — a peer-to-peer link used for handover coordination (including forwarding buffered downlink data during a handover) and inter-cell interference coordination. Each eNB also connects up to the core over the S1 interface, which itself splits into a control-plane part (S1-MME) and a user-plane part (S1-U). Crucially, S1 supports a many-to-many relationship (S1-flex): one eNB can connect to several MMEs and S-GWs in a pool, which gives load balancing and resilience if one core node fails.

Because the eNB owns the whole radio stack, all the time-critical decisions happen at the edge. Scheduling grants on the PDCCH are computed every millisecond inside the eNB; HARQ retransmissions never leave it; and when you move, the source eNB and target eNB negotiate the handover directly over X2, forward your in-flight downlink packets to the target, and only afterwards tell the core to switch the S1-U path with a Path Switch Request. Nothing in the core is in the millisecond loop, which is precisely what makes LTE feel responsive compared with the controller-heavy generations before it.

EPC Nodes at a Glance

The core is a handful of specialised nodes. Each one has a single clear job, and — most importantly — lives in exactly one plane. The control-plane nodes never touch a user packet; the user-plane nodes never make a policy decision.

Reference Points and Their Protocols

Every link between two nodes has a named reference point and a defined protocol. You should recognise each one, know whether it carries signalling (control) or bearer traffic (user), and — for interviews — know the exact protocol name that rides on it. The recurring pattern: user-plane bearer links tunnel packets in GTP-U; control-plane links between core nodes use GTP-C or Diameter; and the one radio-side signalling link, S1-MME, uses S1AP over SCTP.

A few things worth pinning down. S5 and S8 are the same reference point functionally — S8 is simply S5 stretched across a PLMN boundary for roaming. Both can run with GTP (the usual choice, one protocol family for both planes) or with PMIPv6, in which case control signalling for the bearer is handled differently and GTP-C is not used on that segment. The X2 interface is the only one besides Uu that lives in both planes: X2AP carries handover signalling, while a temporary GTP-U tunnel forwards the source cell's buffered downlink packets to the target during a handover so nothing is lost.

Notice also how the transport protocols cluster by job. Anything that carries user packets — S1-U, S5/S8, and the temporary X2 forwarding tunnel — uses GTP-U over UDP, because a lightweight, connectionless tunnel is exactly what a high-throughput bearer wants. Anything that sets bearers up between core nodes — S11, S10, and the GTP-C half of S5/S8 — uses GTP-C, the control sibling of the same protocol family. And anything that touches the subscriber or policy databases — S6a, S13, Gx, Rx — uses Diameter, the AAA-style signalling protocol. If you remember those three buckets (GTP-U for bearers, GTP-C for bearer control, Diameter for subscriber and policy), you can reconstruct most of the table from first principles, with S1AP/SCTP as the one radio-facing exception.

The Whole System in One Picture

Here is the EPS laid out end to end, with every major reference point drawn. Solid lines are the user plane (your packets); dashed lines are the control plane (signalling). Follow the solid path and you trace exactly where a downloaded byte travels; follow the dashed lines and you see how the network was told to set that path up.

Control-Plane vs User-Plane Protocol Stacks

The plane split is not just a diagram convention — each plane runs a completely different protocol stack. On the control plane, the radio-side NAS message from the UE is relayed transparently by the eNB to the MME inside S1AP, which rides on SCTP (chosen for reliable, in-sequence, multi-stream delivery). On the user plane, your IP packet is wrapped in a GTP-U tunnel that is re-terminated at every hop — eNB, then S-GW, then P-GW — until it is finally handed out raw over SGi.

The Bearer Path End to End

In LTE, QoS is not applied per packet — it is applied per bearer. A bearer is a logical pipe with a defined QoS between the UE and the P-GW, and it is built by concatenating segment bearers, each of which is just a GTP-U tunnel (or a radio bearer on the air). The whole chain is called an EPS bearer, and understanding how it decomposes is the single most useful thing to know about the LTE data path.

An EPS bearer spans UE ↔ P-GW. It is built from three concatenated segments. The radio bearer (DRB, Data Radio Bearer) runs UE ↔ eNB over Uu. The S1 bearer runs eNB ↔ S-GW as a GTP-U tunnel over S1-U. The S5/S8 bearer runs S-GW ↔ P-GW as a GTP-U tunnel over S5/S8. Two important composites are named: the E-RAB (E-UTRAN Radio Access Bearer) = DRB + S1 bearer, i.e. the whole UE-to-S-GW portion; and the S5/S8 bearer completes the path to the P-GW. Each segment is glued to the next by a mapping of GTP-U Tunnel Endpoint Identifiers (TEIDs).

Every UE that attaches gets one default bearer — a non-GBR (non-guaranteed-bit-rate) pipe that stays up for the life of the PDN connection and gives always-on IP connectivity. When something needs guaranteed QoS (a VoLTE call, say), the network adds a dedicated bearer on top, typically GBR, filtered by TFT (Traffic Flow Templates) so the right packets map to the right pipe. Each bearer carries a QCI (QoS Class Identifier) and ARP (Allocation and Retention Priority); the PCRF decides these and the P-GW enforces them.

Roaming — Home vs Visited PLMN

When you roam, your device attaches through another operator's radio and core — the visited PLMN (VPLMN) — but your subscription still lives in your home PLMN (HPLMN). The reference point that bridges the two is S8: it is exactly the S5 interface, but with the S-GW in the visited network and the P-GW in the home network. Authentication data still comes from your home HSS over S6a, reached from the visited MME.

There are two roaming architectures, and they differ in where your traffic breaks out to the internet. In home-routed roaming, the P-GW is in the HPLMN: your packets travel from the visited S-GW across S8 back to the home P-GW and reach the internet through your home operator. This keeps home policy and lawful-intercept in force but adds a long path. In local breakout (LBO), a P-GW in the VPLMN is used, so traffic reaches the internet locally in the visited country — lower latency, but policy must be coordinated between operators (the visited PCRF talks to the home PCRF over S9).

One detail that trips people up: no matter which architecture is used, the control plane always reaches home. The visited MME authenticates you against your home HSS over S6a, and your subscription profile — which APNs you may use, your default QoS, your roaming restrictions — is pulled from that home database. What roaming changes is purely the user-plane anchor: home-routed keeps that anchor (P-GW) at home for full home-operator control and charging, while local breakout moves it into the visited network to shorten the path. Historically almost all deployments were home-routed for exactly the billing and lawful-intercept reasons above; local breakout became interesting for latency-sensitive or high-volume traffic where backhauling every byte across a continent is wasteful.

Summary

The EPS is E-UTRAN plus EPC. The radio side is a flat mesh of eNBs that own the full radio stack (PHY/MAC/RLC/PDCP/RRC) and every millisecond-scale decision, joined to each other by X2 and to the core by S1 (S1-MME + S1-U, with S1-flex pooling). The core is a handful of single-purpose nodes split cleanly by plane: MME, HSS, PCRF and EIR on the control plane; S-GW and P-GW on the user plane.

Every link is a named reference point with a defined protocol, and they cluster by job: GTP-U for user-plane bearers (S1-U, S5/S8), GTP-C for bearer control between core nodes (S11, S10), Diameter for subscriber and policy (S6a, S13, Gx, Rx), and S1AP/SCTP as the one radio-facing signalling exception on which NAS is relayed transparently to the MME. Connectivity is delivered as an EPS bearer (DRB + S1 bearer + S5/S8 bearer), stitched by GTP-U TEIDs, with the E-RAB naming the UE↔S-GW portion. Roaming changes only the user-plane anchor — home-routed keeps the P-GW at home over S8, local breakout moves it to the visited network — while the control plane always reaches the home HSS. Learn this map and the 5G Core is largely a renaming of it.