3 What happens when a phone switches on

3.1 First it has to say who it is

A phone that has just found a cell is, as far as the core network is concerned, a stranger. Nobody has checked who it is, nobody holds a record of it, and nobody knows which base station would reach it.

Registration fixes all three at once. It runs the access-control checks — who are you, and does your subscription allow this here — and leaves a record of the device behind in the AMF, the function that keeps track of where a device is and whether it can be reached.

The identifier of that serving AMF is then written into the UDM, the subscriber database, so the rest of the network can find out who is looking after this subscriber §5.3.2.1.

Registration is not a one-off. A registered device updates its registration periodically so the network knows it is still there, again when it moves out of the area it was given, and again when its capabilities change §5.3.2.1.

3.2 Registered is not the same as connected

The document tracks a device with two independent state machines, because the two things they describe change on completely different timescales.

	Registration	Connection
The states	registered, deregistered	idle, connected
The question	does the network hold a record of this device?	is there a signalling connection right now?
Clause	§5.3.2.2.1	§5.3.3.2.1

An idle but registered device does two things and nothing else: it answers paging — the network calling out for it across a set of cells — and it starts a connection of its own when it has something to send §5.3.3.2.2.

Both state machines are kept per way in. A device can be registered over the mobile radio and not over Wi-Fi at the same moment, idle on one and connected on the other §5.3.3.2.1.

3.3 Then it asks for somewhere to send packets

Being registered still gets you nothing. The network can find you; it does not yet know which network you want to reach, what kind of traffic you will send or who is paying for it. All of that has to hang off something.

A PDU is a protocol data unit — a packet. A DNN is a Data Network Name, the string that says which network you get: the operator's internet service, its own system for calls and messages, a factory floor. The thing that holds it all together is called a PDU session.

One session is one device, one data network, one kind of packet, one promise about what happens to your address when you move. A device may hold several at once, to the same network or to different ones, over the radio and over Wi-Fi §5.6.1.

The request travels to the AMF, because that is the only place the device's signalling ends. The AMF does not act on it — it reads the session number in the message and hands it to an SMF, and every later message about that session goes to the same one §5.6.2.

The SMF then chooses a UPF and programs it, and packets start moving.

3.4 What is fixed once, and what may move

Almost everything agreed when a session is set up is then frozen for its lifetime: the data network name, the kind of packets, the continuity promise and the session's own number can none of them be changed afterwards.

The one thing that may change is which slice of the serving network the session runs on, because a device can carry a session into another operator's network §5.6.1.

The user plane is a different matter. When a device goes idle, the tunnels carrying its traffic are torn down while the session itself lives on in the core — which is why a phone that has been quiet for an hour still has its IP address when it wakes.

What those packets are actually promised is What the network promises, and how one network becomes many.