SDAP in 5G NR: The Sublayer That Moved QoS to the gNB

The one sublayer NR actually added

For a decade your user-plane access stratum topped out at PDCP. You can draw it from memory: PDCP, RLC, MAC, PHY. Ciphering and reordering at the top, OFDM at the bottom, and nothing above PDCP but the GTP tunnel handing the eNB its S1-U traffic. That stack was complete. There was no layer whose job was to look at a packet and decide how the radio should treat it, because in LTE the radio never made that decision. The core did, before the packet ever reached the eNB.

NR adds one box on top of that stack, and only one. It is SDAP, the Service Data Adaptation Protocol (TS 37.324), the single genuinely new sublayer in the NR user-plane access stratum. SDAP is small. A one-byte header and a mapping table. But it quietly took the QoS decision away from the core and handed it to the gNB, and in doing so it dissolved the clean "one bearer, one QoS" picture you have relied on at the radio your whole career.

This article goes deep on that one sublayer: why it had to exist, what it does on the wire, the byte it adds, and the debugging trap it sets for engineers coming from LTE.

Why LTE never needed it

Start with what made LTE simple, because that is exactly what SDAP replaces. In LTE the unit of quality of service was the bearer. An EPS bearer carried a single QCI and an ARP, and it mapped one-to-one onto a Data Radio Bearer on the air. The core set that bearer up; the eNB faithfully carried it. The chain ran SDF → TFT → EPS bearer → DRB, and crucially the eNB did not reclassify anything. A packet arrived on a GTP tunnel that already corresponded to a specific bearer with a specific QoS, and the eNB's job was to schedule it, not to decide what it deserved. One bearer in, one DRB out, same QoS the whole way.

That is why the LTE stack needed no adaptation layer. There was nothing to adapt. The mapping from a service data flow to a radio bearer had already been resolved in the core and frozen into the bearer itself by the time the packet hit PDCP. Want different treatment for one flow? Stand up a whole new bearer. Rigid, but conceptually clean, and it meant the radio side never had to carry any per-flow information at all.

NR breaks that one-to-one. The finest unit of QoS is no longer the bearer; it is the QoS Flow, identified by a QFI (QoS Flow Identifier), and many flows ride inside a single PDU session (TS 23.501). If you want the flow model itself, the 5QI and QoS-flow reference covers the characteristics each flow inherits. What matters for SDAP is the consequence: once multiple flows with different treatments share one PDU session, something on the radio side has to look at each packet, know which flow it belongs to, and decide which DRB it should ride. LTE pushed that decision into the core and baked it into the bearer. NR pulls it onto the radio. SDAP is the layer that holds it.

What SDAP actually does

SDAP has a deliberately narrow remit. It does two things, and you should be able to recite both (TS 37.324 §4.2.2):

1. It maps QoS Flows onto Data Radio Bearers.
2. It marks each packet with its QFI in an SDAP header.

That is the whole job. Everything else SDAP touches — reflective QoS, the default bearer, the header bits — hangs off those two functions. There is exactly one SDAP entity per PDU session, and SDAP exists only for DRBs. Signalling radio bearers have no SDAP; RRC does not ride it. If you are staring at an SRB, there is no SDAP entity in the picture at all.

The mapping is the part that rewires your mental model, so be precise about its shape. It is many-to-one: several QoS Flows can map onto a single DRB, but a given flow maps to exactly one DRB at a time. A PDU session might carry six flows over two DRBs, four flows sharing one bearer and two on another. The bearer is no longer a proxy for a single QoS treatment. It is a pipe that can carry a mix of flows.

And here is the shift that matters most coming from LTE: the gNB controls that mapping, not the core. The SMF defines the QoS Flows and their characteristics and tells the gNB which flows exist on a PDU session. But the decision about which DRB each flow rides — how many DRBs to use, and whether to move a flow from one DRB to another — is made on the radio side by the gNB, and it can change that mapping without involving the core at all. The gNB owning radio-side resources is the same principle that drives the CU/DU functional split. In LTE, flow-to-bearer mapping lived in the core and was frozen into the bearer. In NR, the core hands the gNB a set of flows and the gNB does the radio-side mapping itself. That decoupling — core defines flows, radio maps them to bearers — is the entire reason SDAP exists.

The one-byte header

SDAP's header is small, and its smallness is the point. It is one byte (TS 37.324 §6.2). The dominant field is the QFI, six bits, carrying the QoS Flow Identifier so the receiving side knows which of up to 64 flows this packet belongs to. The remaining two bits are control flags, and which ones are present depends on direction.

The first thing to know is that the header is configurable per DRB. RRC tells the SDAP entity, for each DRB, whether an SDAP header is present or absent (TS 37.324 §5.1). A DRB carrying a single flow with no need for per-packet marking can be configured header-absent — the QFI is implicit because there is only one flow on that bearer, so there is no byte of overhead at all. A DRB carrying multiple flows, or one that needs reflective QoS, is configured header-present, and every SDAP data PDU on it carries the one-byte header. So "does SDAP add a byte?" gets the honest engineer's answer: only when it has to.

Direction changes what the two non-QFI bits mean:

In the downlink, the header carries the QFI plus the two reflective-QoS control bits, RQI and RDI. In the uplink, the UE's data PDU carries the QFI so the gNB can confirm which flow it sent — the reflective bits are a downlink-only instruction, so they do not appear going up. SDAP also defines a short control PDU in the uplink to confirm an end-marker for reflective mapping, but for day-to-day tracing the data PDU with its QFI is what you will see.

Reflective QoS: the bit that replaces the uplink TFT

This is the SDAP feature with no LTE analogue, and it is worth slowing down for because it is the cleverest thing the layer does.

In LTE, the uplink mapping was signalled explicitly. The network sent the UE an uplink Traffic Flow Template — a set of packet filters — so the UE knew which uplink packets belonged to which bearer. Every bearer that needed uplink classification got a TFT pushed to it. That is signalling the network has to generate and maintain for each flow.

NR offers a way to skip most of that. The two reflective bits in the downlink SDAP header tell the UE to mirror the downlink mapping in the uplink, so the network does not have to signal an uplink rule at all:

• RDI (Reflective DRB-mapping Indication) tells the UE: for the QFI in this packet, send your matching uplink traffic on the DRB this downlink packet arrived on. The UE observes the DL flow-to-DRB mapping and reflects it upward.
• RQI (Reflective QoS Indication) is the trigger one level up, at the NAS/QoS-rule layer: it tells the UE to derive an uplink QoS rule for this flow from the downlink packet — effectively building the uplink classification the LTE TFT used to carry, but inferred from observed downlink traffic instead of signalled. Because that rule lives at NAS, this is where the NAS and RRC layers divide responsibility: RRC configures the SDAP entity, but the derived QoS rule sits above it.

Keep the two straight by what they control. RDI is about the DRB — which radio bearer the uplink flow rides. RQI is about the QoS rule — how the UE classifies uplink packets into the flow in the first place. Together they let the network establish an uplink mapping by example: send a downlink packet with the bits set, and the UE works out the matching uplink behaviour on its own. Flows come and go without a round of explicit uplink signalling for each one. Reflective QoS is optional and per-flow; where it is not used, the uplink mapping is signalled explicitly via a QoS rule, the modern relative of the TFT.

The default DRB: where unclassified flows land

One more piece keeps the system robust. For each PDU session, one DRB can be configured as the default DRB (TS 37.324 §5.3). When SDAP receives an uplink packet for a QoS Flow that has no explicit mapping rule — no configured flow-to-DRB binding and no reflective rule derived yet — it does not drop it. It sends it on the default DRB.

This is the safety net that makes the many-to-one mapping practical. The gNB does not need a rule in place for every conceivable flow before traffic can move; anything unmapped falls through to the default bearer and still gets carried. It is the radio-side echo of the default QoS flow that always exists on a PDU session, established when the PDU session is first set up: there is always somewhere for a packet to go.

The LTE-engineer gotcha: "which bearer" stops being a clean question

Here is the trap, and it is a debugging trap more than a theoretical one. For your whole LTE career, the bearer was the unit of QoS, and "which bearer is this traffic on?" was a complete diagnostic question. The bearer told you the QCI, the ARP, the treatment — one bearer, one behaviour, mapped one-to-one to a DRB. You could reason about a UE's QoS by enumerating its bearers.

In NR that question no longer resolves cleanly, for two reasons that both trace straight back to SDAP:

• A DRB can carry many QoS Flows. Knowing a packet is on DRB 2 no longer tells you its treatment, because DRB 2 might carry three flows with three different QFIs. The treatment lives with the flow (the QFI), not the bearer. To answer "what QoS is this getting?" you read the QFI out of the SDAP header, then look up that flow's characteristics. The bearer alone will not tell you.
• The gNB can remap flows to DRBs without telling the core. Because the radio side owns the mapping, a flow you saw on one DRB can be moved to another by the gNB as a purely radio-side decision. A core-side trace will not show that remap, because the core was never involved. Two captures taken minutes apart can legitimately show the same flow on different bearers.

So retrain the instinct. On the radio, the bearer is now a transport pipe that may multiplex several flows, and the flow — not the bearer — carries the QoS identity. When you trace 5G user-plane QoS, you follow the QFI in the SDAP header, and you remember that the flow-to-DRB binding is the gNB's to set and to change. The SDAP header sits one layer above PDCP, so it is also the first thing to read before you start isolating PDCP, RLC, and MAC behaviour on a stalled bearer. If you want to drill the whole user-plane trace end to end, start a free 7-day trial — no credit card — and walk a captured QoS flow through the stack in the lab.

The takeaway

LTE's user-plane stack stopped at PDCP because it never had to make a QoS decision — the core resolved flow-to-bearer mapping and froze it into a bearer the eNB simply carried, one-to-one, onto a DRB. NR adds exactly one sublayer, SDAP, to do the job LTE pushed into the core: map QoS Flows onto Data Radio Bearers (many-to-one, controlled by the gNB) and mark each packet with its QFI in a one-byte header that is present only when a bearer needs it. Reflective QoS — the RDI and RQI bits in the downlink — lets the network establish the uplink mapping by example instead of signalling an explicit rule for every flow, retiring the LTE uplink TFT. The default DRB catches anything unmapped. The practical residue is one sentence: on the 5G radio, the bearer is no longer the unit of QoS — the QoS Flow is — so read the QFI, not the bearer, and remember the gNB can move flows between bearers without the core ever knowing.