Reflective QoS & the SDAP Header in 5G NR

Introduction

Reflective QoS is the 5G mechanism that lets a UE work out its own uplink QoS handling by observing the downlink, rather than being told every rule explicitly. It spans two specifications: the QoS-model behaviour (the RQA authorization, the derived QoS rule, the reflective-QoS timer) lives in TS 23.501 and its NAS realisation, while the header bits that carry it (RQI, RDI) and the SDAP handling live in TS 37.324.

It comes into play whenever the network wants a flow's uplink to match its downlink treatment without spending signalling on it — typically for the many short-lived, symmetric, best-effort flows a UE generates. It is optional and per-flow: the network authorizes it with RQA, triggers it with a bit on ordinary user-plane packets, and lets a timer clean it up. Nothing extra is sent on the control plane.

Because it is inferred rather than signalled, reflective QoS is a feature you must understand as a lifecycle — authorize, trigger, refresh, expire — and as a division of labour between two layers (NAS and AS) driven by two separate bits. Get those two axes straight and the whole feature is simple.

Why Reflective QoS is Needed

Without reflective QoS, every uplink flow needs an explicitly signalled QoS rule: the network has to build a packet filter set, a QFI and a precedence, and push it to the UE over NAS — and update or tear it down later. For a handful of long-lived flows that is fine. But a busy UE can open and close many short conversations (each a fresh IP flow), and most of them are symmetric — a request out, a response in, or a stream whose uplink mirrors its downlink. Signalling a bespoke uplink rule for each is pure overhead and adds setup latency.

Reflective QoS removes that overhead for exactly those flows. Since the network is already sending the downlink and already knows the correct treatment, it simply marks that downlink and lets the UE infer the matching uplink handling. The recurring cost drops to a single bit riding on packets the network was going to send anyway, and the mapping stays in step automatically as traffic comes and goes.

The Core Idea

Every uplink packet a UE sends has to answer two questions before it leaves the phone. First, at the NAS layer: which QoS flow does this packet belong to? — i.e. which QFI should be stamped on it. Second, at the AS layer inside SDAP: which DRB (radio bearer) should carry a packet with that QFI? The network could answer both by explicitly signalling the UE a full set of rules over NAS and RRC. Reflective QoS avoids that entirely: for any flow the network is already sending downlink, the UE can derive both answers by copying the treatment it observes on the received packets. No explicit uplink rule is signalled at all.

The scheme is deliberately one-directional. The UE mirrors the network; the network never mirrors the UE, because the network already owns the authoritative mapping and configures its own downlink. That asymmetry is why every field that drives reflection lives only in the downlink header, and why the whole feature has to be explicitly authorized by the network before a UE is allowed to apply it — which we will come to with the RQA attribute.

The SDAP Header, Field by Field

Reflective QoS rides entirely on the SDAP Data PDU header, so it only works on a DRB that has been configured with an SDAP header present (sdap-HeaderDL = present). A headerless DRB carries no QFI, RQI or RDI, and therefore cannot drive reflection at all. The header is a single octet, but its layout differs between downlink and uplink because only the downlink needs the two reflection bits.

Two things stand out. First, the QFI is only 6 bits, capping a PDU session at 64 distinct QoS flows. Second, the uplink header simply has no RQI/RDI — it carries the QFI the UE has chosen, a D/C bit distinguishing an SDAP data PDU from a control PDU, and a reserved bit. There is nothing for the UE to "reflect back" to the network, which is exactly as intended: reflection flows one way. When the UE finally transmits, all it does is stamp the QFI it derived into that 6-bit field and hand the packet to the DRB it derived.

RQI and RDI — Two Bits, Two Layers

The two reflection bits look similar but act on different layers and update different things. Getting the split clear is the whole point of understanding reflective QoS.

Walk through what happens when a downlink SDAP data PDU arrives with both bits set. The SDAP entity reads RDI = 1, notes the QFI in the header and the DRB the PDU came in on, and installs the mapping "uplink traffic of this QFI goes on this DRB." Independently, because RQI = 1, SDAP informs the NAS layer, which inspects the packet (its IP 5-tuple, for example) and constructs a derived QoS rule: a packet filter plus the QFI to apply. From then on, when the application generates an uplink packet that matches that filter, NAS stamps it with the derived QFI, and SDAP routes it onto the DRB the RDI step selected. The UE has reconstructed the network's full uplink treatment from a single received packet.

The two bits are independent. RDI alone updates only the radio-bearer choice; RQI alone updates only the NAS classification. In practice a flow that the network wants fully reflected will see both set, but the fields are separable so the network can, for instance, reflect the DRB mapping while leaving the flow classification to an explicitly signalled rule. Note also that the downlink RQI is carried end-to-end: the UPF sets a Reflective QoS Indicator in the N3 GTP-U encapsulation header, and the gNB relays it as the RQI bit in the SDAP header over the air.

RQA — Authorizing Reflection per Flow

The UE is not allowed to reflect just because it saw a bit set. Reflective QoS must first be authorized for the specific QoS flow, and that authorization is carried by the RQA (Reflective QoS Attribute) — a NAS-level, per-QoS-flow parameter. During PDU session establishment or modification, the SMF may include the RQA among the QoS flow's parameters (in the QoS profile toward the RAN and in the QoS rules toward the UE). The presence of RQA on a flow tells the UE: "for this flow, if you receive a downlink packet with RQI set, you are permitted to derive and maintain a QoS rule for it."

It is worth separating the two roles cleanly. RQA is the authorization, signalled once (and infrequently) at the QoS-flow level over NAS. RQI is the trigger, carried on every downlink data packet that should refresh the reflected state. So even with reflective QoS in use, the only recurring signalling is a single bit riding on user-plane packets the network was already going to send — there is no separate control message per rule. That is the whole economy of the scheme.

The Reflective-QoS Timer and Ageing Rules

A reflected mapping is only an inference from recent downlink activity, so it must not live forever. If a flow stops arriving downlink, the evidence the UE used to learn its mapping has gone, and keeping the derived rule indefinitely would waste UE state and risk sending uplink on a bearer or flow the network no longer expects. The 5G QoS model handles this with a per-rule reflective-QoS timer (the RQ Timer), whose value the network provides — either a specific value per PDU session or a default value that applies when none is signalled.

The mechanics are simple. When a downlink packet with RQI set arrives for a flow, the UE creates the derived QoS rule if it does not exist, or refreshes it if it does — and in either case (re)starts the timer associated with that rule. Continued downlink traffic keeps restarting the timer, so an active flow's derived rule never expires. If the downlink goes quiet and the timer runs out without a refresh, the UE deletes the derived QoS rule. The flow's uplink then falls back to whatever mapping remains — an explicitly signalled rule if one exists, otherwise the default QoS rule and the default DRB — until a new reflected packet re-establishes it.

The RQ timer value is signalled to the UE over NAS. It is carried as the Reflective QoS Timer value in the PDU session's session-management parameters; when the network does not signal a specific value, a default (order of tens of seconds) applies. The timer is per derived rule, so different reflected flows age out independently based on their own downlink activity.

This self-cleaning behaviour is exactly what makes reflective QoS safe to leave on as a lightweight default. Mappings appear on their own when traffic flows, refresh themselves while it continues, and disappear on their own when it stops — all without the network ever issuing a create, modify or delete command for them.

Reflective vs Explicit Mapping

Reflective QoS does not replace explicit signalling; the two coexist, and the UE holds both kinds of rule at once. Explicitly signalled QoS rules come to the UE over NAS during PDU session establishment or modification and are authoritative and long-lived. Derived QoS rules are the reflected ones, built from the downlink and aged by the timer. When the UE classifies an uplink packet, signalled rules take precedence over derived rules, and any packet matching no rule at all is handled by the default QoS rule on the default DRB.

So when is explicit mapping preferred despite the extra signalling? Whenever the network needs certainty rather than inference. A guaranteed-bit-rate flow, a flow with strict latency requirements, or any flow whose uplink treatment must be fixed and predictable is better served by an explicit rule that does not depend on downlink activity to stay alive and cannot be aged out at an awkward moment. Reflective QoS shines in the opposite regime: large numbers of ordinary, best-effort or dynamically appearing flows where hand-configuring uplink rules for each would be pure overhead, and where "follow the downlink" is a perfectly good policy.

What You Gain, and What It Costs

The headline benefit is reduced control signalling and faster adaptation. The network steers uplink QoS just by marking the downlink it is already transmitting — no separate NAS round trip, no RRCReconfiguration to install or change an uplink rule, and no per-rule tear-down because the timer handles removal. For a busy cell with many UEs and many short-lived flows, avoiding a burst of dedicated signalling per flow per UE is a real saving in both control-plane load and setup latency.

The costs are modest but real. The UE carries a little more machinery: it must inspect downlink packets, build packet filters for derived rules, maintain the reflected QFI→DRB mapping, and run a timer per derived rule. There is a one-bit-per-packet header overhead for RQI and RDI (already part of the SDAP header octet, so effectively free once an SDAP header is present). And there is a philosophical cost: reflected treatment is inferred, not guaranteed, so it is inappropriate for flows that demand deterministic QoS. For those, the network spends the signalling and pins the rule explicitly. For everything else, reflective QoS is the lightweight default that keeps uplink and downlink consistent almost for free.

Summary

Reflective QoS is "the uplink copies the downlink": rather than signalling explicit uplink rules, the network marks the downlink it is already sending and the UE mirrors that treatment. It is specified in TS 23.501 (the QoS-model behaviour) and TS 37.324 (the SDAP header and handling), and it exists only because 5G QoS is per-flow.

Hold three things in mind. The two bits, two layers: RDI drives the AS/SDAP step (uplink QFI → same DRB the downlink arrived on); RQI drives the NAS step (build a derived QoS rule that classifies uplink into that QFI). The authorize-then-trigger split: RQA is the standing per-flow permission signalled once over NAS; RQI is the per-packet trigger. And the self-cleaning lifecycle: a derived rule is created on a marked packet, refreshed while downlink continues, and aged out by the reflective-QoS (RQ) timer when it stops.

Use it for the many ordinary, symmetric, bursty flows where "follow the downlink" is good enough; pin GBR and strict-latency flows with explicit rules that cannot be aged out. Reflective and explicit rules coexist per UE and even per PDU session, with signalled rules always taking precedence over derived ones.

Quick LTE 4G / 5G NR Interview Questions — What Reflective QoS Solves