How 5G Works: NR, mmWave, and Network Slicing

5G NR (New Radio) is the fifth generation of cellular network technology, standardized by 3GPP beginning with Release 15 in 2018. Unlike the incremental jump from 3G to 4G LTE, 5G represents a fundamental redesign of the radio interface, the core network, and the service architecture. It introduces a flexible OFDM-based air interface, massive MIMO antenna arrays, network slicing, and a cloud-native core -- all engineered to serve three distinct service categories: enhanced mobile broadband (eMBB), ultra-reliable low-latency communications (URLLC), and massive machine-type communications (mMTC). Understanding how 5G actually works -- beneath the marketing claims of "100x speed" -- requires examining the radio layer, spectrum strategy, antenna physics, core network architecture, and the engineering tradeoffs that determine real-world performance.

Spectrum: mmWave vs Sub-6 GHz vs Low-Band

5G operates across three distinct spectrum tiers, each with fundamentally different propagation characteristics and capacity profiles:

• Low-band (below 1 GHz) -- Frequencies like 600 MHz (T-Mobile's n71) and 700 MHz. These signals penetrate buildings, travel kilometers, and provide reliable coverage in rural areas. The tradeoff is bandwidth: carriers typically hold 5-10 MHz of low-band spectrum per channel, which limits throughput to roughly 50-250 Mbps -- comparable to good LTE. Low-band 5G is often derisively called "fake 5G" because the user experience is barely distinguishable from LTE-Advanced.
• Mid-band / Sub-6 GHz (1-6 GHz) -- The sweet spot. C-band (3.7-3.98 GHz, auctioned by the FCC for $81 billion in 2021), the 2.5 GHz band (Sprint's legacy spectrum, now T-Mobile's AS21928), and 3.5 GHz CBRS. Mid-band offers 40-100 MHz channel bandwidths, delivering real-world speeds of 300 Mbps to 1 Gbps. Range is moderate: 1-3 km per cell with adequate indoor penetration in most construction types. This is where the majority of 5G's value is delivered globally.
• mmWave (24-100 GHz) -- Frequencies above 24 GHz, primarily 28 GHz (n261) and 39 GHz (n260) in the US. mmWave offers enormous bandwidth -- 400 MHz to 800 MHz per carrier, with carrier aggregation pushing beyond 1 GHz total. Peak speeds exceed 4 Gbps in ideal conditions. But the physics are unforgiving: mmWave signals are absorbed by foliage, glass, rain, and even the humidity in air. Range is 100-300 meters line-of-sight. A human body between the phone and the antenna can drop throughput by 20-30 dB. mmWave deployments are economically viable only in dense urban cores, stadiums, and airports.

The spectrum strategy a carrier chooses fundamentally determines the 5G experience their customers get. T-Mobile (AS21928) led with 2.5 GHz mid-band from Sprint's legacy holdings, giving it a nationwide mid-band advantage. AT&T (AS20057) initially focused on mmWave and low-band, then aggressively deployed C-band after the 2021 auction. Verizon bet heavily on mmWave for urban areas and has been backfilling with C-band. In practice, most carriers use dynamic spectrum sharing (DSS) to run 4G LTE and 5G NR simultaneously on the same frequencies, allowing a gradual transition without forklift upgrades.

The 5G NR Air Interface

5G NR uses CP-OFDM (Cyclic Prefix Orthogonal Frequency Division Multiplexing) for the downlink and both CP-OFDM and DFT-s-OFDM (Discrete Fourier Transform-spread OFDM) for the uplink. DFT-s-OFDM has a lower peak-to-average power ratio (PAPR), which extends handset battery life and improves uplink coverage at cell edges. This dual approach is a pragmatic engineering decision: OFDM provides the highest spectral efficiency, while DFT-s-OFDM conserves power in the device where battery life matters most.

The most important innovation in the NR physical layer is flexible numerology. Unlike LTE, which uses a fixed 15 kHz subcarrier spacing and 1 ms subframe, NR defines multiple numerologies indexed by μ:

• μ=0: 15 kHz subcarrier spacing, 1 ms slot duration -- identical to LTE, used for low-band and compatibility
• μ=1: 30 kHz spacing, 0.5 ms slot -- the default for sub-6 GHz deployments
• μ=2: 60 kHz spacing, 0.25 ms slot -- used for some sub-6 GHz and low mmWave
• μ=3: 120 kHz spacing, 0.125 ms slot -- the standard for mmWave (28/39 GHz)
• μ=4: 240 kHz spacing, 62.5 μs slot -- defined but rarely deployed

Wider subcarrier spacing reduces slot duration, which directly reduces latency. A μ=3 mmWave deployment has an air-interface latency floor of ~0.125 ms per slot, compared to 1 ms for μ=0. But wider spacing also reduces the number of subcarriers per channel, which is acceptable at mmWave frequencies where the channel bandwidth is already enormous (400+ MHz). The numerology choice trades spectral granularity against latency -- a fundamental physical constraint, not a software knob you can tune without consequences.

5G NR also supports mini-slots -- transmissions shorter than a full slot (as few as 2 OFDM symbols vs. the standard 14). Mini-slots enable preemption: a URLLC packet can interrupt an ongoing eMBB transmission mid-slot, reducing worst-case latency to under 1 ms at the radio layer. This mechanism is critical for industrial automation and autonomous vehicle use cases, though it comes at the cost of reduced eMBB throughput when URLLC traffic is present.

Massive MIMO and Beamforming

Traditional LTE base stations use 2-8 antenna elements. 5G NR base stations deploy massive MIMO (Multiple Input, Multiple Output) arrays with 32, 64, or even 128 antenna elements in a single panel. The mathematical basis is straightforward: with N antenna elements, you can form up to N independent spatial beams, and the theoretical capacity scales linearly with min(N_tx, N_rx). In practice, the gains are more modest due to spatial correlation and channel estimation overhead, but massive MIMO routinely delivers 3-5x the sector capacity of 4-antenna LTE. Massive MIMO achieves its greatest gains with TDD (Time Division Duplex) rather than FDD, because TDD allows the base station to exploit channel reciprocity — the uplink and downlink use the same frequency, so the base station can estimate the downlink channel from uplink measurements without requiring explicit CSI feedback from every user. This eliminates most of the feedback overhead that would otherwise scale linearly with the number of antenna elements and connected users.

Beamforming in 5G NR operates at two levels:

• Analog beamforming -- Phase shifters steer the entire array toward a single direction. This is the dominant technique at mmWave, where the array must concentrate all available power toward the user to overcome path loss. Analog beamforming is simple but inflexible: you can only serve one direction per beam at a time.
• Digital beamforming -- Each antenna element has its own radio chain (DAC/ADC, mixer, amplifier). The base station can form multiple simultaneous beams to serve different users in different directions. This enables multi-user MIMO (MU-MIMO), where the same time-frequency resource is reused across spatially separated users. Digital beamforming is standard at sub-6 GHz but prohibitively expensive at mmWave due to the cost and power consumption of high-frequency radio chains.
• Hybrid beamforming -- The practical compromise for mmWave. A small number of digital radio chains (4-8) each drive a sub-array of analog elements (8-32). This allows forming a few simultaneous beams while keeping cost and power manageable. Most mmWave 5G deployments use hybrid architectures.

Beam management in NR is a multi-step process. The base station periodically transmits SSB (Synchronization Signal Block) beams sweeping across the cell coverage area -- typically 4-8 beams at sub-6 GHz or 64 beams at mmWave. The UE (user equipment) measures these beams and reports the best ones. The base station then refines the beam direction using CSI-RS (Channel State Information Reference Signals) for finer-grained tracking. When a user moves and the current beam degrades, beam failure recovery kicks in -- the UE initiates a random-access procedure on an alternative beam. This entire beam management framework adds latency and signaling overhead that simply does not exist in LTE, which is one reason why the "zero latency" marketing around 5G is misleading.

SA vs NSA Architecture

3GPP defined two fundamental deployment modes for 5G:

Non-Standalone (NSA, Option 3x) was designed for rapid early deployment. In NSA, the 5G NR radio connects to the existing 4G EPC (Evolved Packet Core). The LTE eNB acts as the master node, managing the control plane (signaling, mobility, session management), while the 5G gNB acts as a secondary node providing additional data capacity. The UE maintains simultaneous connections to both LTE and NR via EN-DC (E-UTRA/NR Dual Connectivity).

NSA has significant limitations. All control signaling flows through LTE, so connection setup latency is bounded by LTE's control plane -- typically 50-100 ms. The UE cannot camp on 5G NR alone; it must first connect to LTE, then be handed to the 5G carrier. This means 5G coverage is artificially limited by LTE coverage. Network slicing, URLLC, and other advanced 5G features require the 5G Core and cannot work over the legacy EPC. NSA is a crutch, not a destination.

Standalone (SA) connects 5G NR directly to the 5G Core (5GC), a cloud-native service-based architecture. SA eliminates the LTE dependency entirely. The gNB handles both the control plane and data plane natively. Connection setup is faster (target: 10-20 ms). Network slicing becomes possible. Registration and session management use 5G-native signaling. SA is the target architecture, but deployment has been slower because it requires building out the 5GC from scratch -- a massive infrastructure investment that carriers have been reluctant to make while the LTE core still works.

As of 2025, most major US carriers operate a mix of NSA and SA. T-Mobile was the first to deploy nationwide SA, while AT&T and Verizon have been transitioning progressively. The practical impact for users: SA enables faster connection setup, lower latency, and features like VoNR (Voice over New Radio) -- 5G-native voice calls without falling back to LTE's VoLTE.

5G Core (5GC): Service-Based Architecture

The 5G Core is a clean-sheet redesign that breaks from the monolithic architecture of the 4G EPC. Instead of purpose-built network elements (MME, SGW, PGW), the 5GC decomposes network functions into microservices that communicate over HTTP/2 and TCP-based service APIs. The key network functions are:

• AMF (Access and Mobility Management Function) -- Handles UE registration, connection management, reachability, and mobility. Equivalent to part of the LTE MME.
• SMF (Session Management Function) -- Manages PDU (Protocol Data Unit) sessions, IP address allocation, and QoS policy enforcement. Controls the UPF.
• UPF (User Plane Function) -- The data plane element. Performs packet routing, forwarding, inspection, and QoS enforcement. The UPF is where user traffic actually flows -- everything else is control plane. UPFs can be deployed centrally or at the edge for low-latency use cases.
• NRF (Network Repository Function) -- A service registry. Network functions register themselves with the NRF and discover other functions through it. This enables dynamic scaling and failover without static configuration.
• NSSF (Network Slice Selection Function) -- Selects the appropriate network slice for a given UE and service type.
• AUSF / UDM (Authentication Server Function / Unified Data Management) -- Handles authentication (5G-AKA, EAP-AKA') and subscriber data management. SUPI (Subscription Permanent Identifier) replaces the LTE IMSI, and SUCI (Subscription Concealed Identifier) encrypts the subscriber identity over the air -- fixing a long-standing privacy vulnerability that enabled IMSI catchers.
• PCF (Policy Control Function) -- Makes policy decisions for QoS, charging, and network slicing. Replaces the LTE PCRF.
• NEF (Network Exposure Function) -- Exposes network capabilities and events to external applications via APIs, enabling third-party services to interact with network functions in a controlled manner.

The service-based architecture (SBA) means 5GC network functions communicate via RESTful APIs using JSON over HTTP/2, not the diameter/GTP-C protocols of LTE. This makes the 5GC deployable on standard cloud infrastructure -- Kubernetes, containers, commodity x86 servers -- rather than purpose-built telecom hardware. In theory, this enables operators to scale network functions independently, deploy updates without downtime, and leverage the cloud-native ecosystem. In practice, telecom vendors have been slow to deliver truly cloud-native implementations, and many "5GC" deployments are thinly containerized monoliths.

Network Slicing

Network slicing is arguably 5G's most architecturally significant innovation, though it remains one of the least deployed. A network slice is a logically isolated end-to-end network built on shared physical infrastructure. Each slice has its own set of network functions (or shared instances with isolation guarantees), its own QoS policies, and potentially its own UPF placement.

3GPP defines slices using an S-NSSAI (Single Network Slice Selection Assistance Information), which consists of:

• SST (Slice/Service Type) -- An 8-bit identifier. Standardized values: 1 = eMBB, 2 = URLLC, 3 = mMTC, 4 = V2X (vehicle-to-everything). Values 5-127 are reserved; 128-255 are operator-defined.
• SD (Slice Differentiator) -- An optional 24-bit field to distinguish between multiple slices of the same type (e.g., two different eMBB slices for different enterprise customers).

The NSSF selects the appropriate slice during UE registration. A single UE can connect to up to 8 slices simultaneously, each with different QoS characteristics routed through different SMF/UPF instances. The isolation is enforced at the UPF level: traffic from different slices flows through different forwarding pipelines, potentially on different physical paths.

The enterprise use case for slicing is compelling on paper: a factory could run its robotic control system on a URLLC slice with guaranteed sub-5ms latency and 99.9999% reliability, while employee smartphones use a standard eMBB slice on the same cell. In practice, slicing adoption has been slow because: (1) it requires SA mode, (2) carrier billing and provisioning systems were not designed for slice-level SLAs, (3) the additional operational complexity of managing per-slice network functions is substantial, and (4) most enterprises have not yet identified use cases that justify the premium pricing.

Edge Computing (MEC)

Multi-access Edge Computing (MEC) places compute and storage resources at the edge of the mobile network -- physically close to the radio access network, rather than in a centralized data center hundreds of miles away. In the 5G architecture, this is implemented by deploying a local UPF at the edge site (a cell tower aggregation point, a carrier's central office, or a small data center in a metro area). The SMF steers traffic matching certain criteria (destination IP ranges, application identifiers) to the local UPF, which routes it to co-located application servers rather than sending it through the backhaul to a distant core.

The latency reduction from MEC is real but often overstated. The air interface contributes 1-10 ms of latency depending on numerology and scheduling. The backhaul from the gNB to the core adds 5-20 ms. If the core is in a distant city and the application server is in yet another location, total RTT can exceed 50 ms. MEC can reduce the network component to 2-5 ms by keeping traffic local, but the air interface latency remains unchanged -- and for many applications, the processing time on the application server dominates anyway.

MEC is most valuable for applications that are both latency-sensitive and bandwidth-intensive: augmented reality, real-time video analytics, cloud gaming, and industrial IoT. The challenge is economic: every edge site needs power, cooling, physical security, and operational management. Carriers are partnering with cloud providers (AWS Wavelength, Azure Edge Zones, Google Distributed Cloud Edge) to share the infrastructure burden, essentially renting rack space and connectivity at the carrier's edge sites to hyperscalers who bring the compute platform and application ecosystem.

Backhaul and Fronthaul Requirements

5G's increased radio capacity creates a corresponding increase in transport network requirements. The RAN architecture has been split into three components: the RU (Radio Unit) at the antenna, the DU (Distributed Unit) handling real-time Layer 1/2 processing, and the CU (Centralized Unit) handling non-real-time Layer 2/3 functions. This split creates two distinct transport segments:

• Fronthaul (RU to DU) -- Carries digitized radio samples using eCPRI (enhanced Common Public Radio Interface) or O-RAN 7.2x split. Bandwidth requirements are extreme: a single 100 MHz NR carrier with 64T64R massive MIMO generates approximately 25 Gbps of fronthaul traffic. Fronthaul requires very low latency (sub-100 μs one-way) and high time synchronization accuracy (±1.5 μs for TDD). In practice, this means dedicated dark fiber between the RU and DU -- typically within a few km.
• Midhaul (DU to CU) -- Carries processed Layer 2 data. Bandwidth requirements are lower (proportional to actual user traffic, not raw radio samples) -- typically 1-10 Gbps. Latency budget is more relaxed: up to a few ms. Can run over switched Ethernet or even MPLS networks.
• Backhaul (CU to 5GC) -- Connects the RAN to the core network. Bandwidth scales with aggregated user traffic -- 10 Gbps to 100 Gbps for large cell sites. Latency requirements depend on the service: eMBB tolerates 10-20 ms, but URLLC requires sub-5 ms. Backhaul typically runs over carrier fiber, metro Ethernet, or in rural areas, microwave or even satellite links (though satellite backhaul struggles to meet 5G latency targets).

The transport network is often the most expensive part of a 5G deployment. A single macro cell site with massive MIMO needs multiple 25G or even 100G fiber links. Densifying the network with small cells at mmWave further multiplies the fiber requirement -- every small cell needs its own fiber or high-capacity wireless backhaul. This is why 5G buildout is concentrated in areas with existing dense fiber infrastructure and why rural 5G deployments lag significantly behind urban ones. The economics are similar to those facing submarine cable operators: the physical plant dominates the cost structure.

Open RAN (O-RAN)

Traditionally, the RAN is a vertically integrated system: the radio hardware, baseband processing, and software all come from a single vendor (Ericsson, Nokia, Samsung, or Huawei). Open RAN, driven by the O-RAN Alliance, aims to disaggregate these components through open interfaces and standardized APIs. The key elements are:

• O-RU -- Open Radio Unit, following the O-RAN 7.2x fronthaul split specification
• O-DU / O-CU -- Software-defined DU and CU running on commercial off-the-shelf (COTS) servers
• RIC (RAN Intelligent Controller) -- A new element that uses AI/ML to optimize RAN behavior in near-real-time (traffic steering, interference management, energy savings). The near-RT RIC operates on 10 ms - 1 s timescales; the non-RT RIC handles longer-term policy decisions.

Open RAN promises vendor diversity, cost reduction, and innovation through a multi-vendor ecosystem. The reality is more nuanced: interoperability between vendors remains challenging, performance of virtualized DU/CU on COTS hardware lags behind purpose-built ASICs (particularly for massive MIMO beamforming computations), and the integration burden shifts from the vendor to the operator. Nonetheless, carriers like Dish Network built their entire 5G network on Open RAN principles, and NTIA has funded $1.5 billion for Open RAN R&D. The long-term trajectory is clear, even if the short-term execution is messy.

Real-World Performance vs Marketing

5G marketing claims need aggressive calibration against reality. Here is what the numbers actually look like in deployed networks:

• "Up to 20 Gbps peak speed" -- This is the 3GPP theoretical maximum for eMBB, assuming 8-carrier aggregation across 400 MHz each with 8x8 MIMO. No deployed network comes close. Real-world mmWave peaks at 2-4 Gbps in ideal conditions with one user per cell. Sub-6 GHz peaks at 500 Mbps to 1.5 Gbps. Typical median speeds on US 5G networks in 2025 are 100-300 Mbps according to Ookla -- faster than LTE's 30-80 Mbps median, but not the transformative leap the marketing suggests.
• "1 ms latency" -- This refers to the air-interface target for URLLC, not end-to-end latency. Real-world end-to-end latency on 5G eMBB is 15-30 ms -- better than LTE's 30-60 ms, but nowhere near 1 ms. URLLC deployments achieving sub-5 ms end-to-end exist, but only in controlled private network environments with edge computing, not on public commercial networks.
• "1 million devices per km²" -- This is the mMTC connection density target, achievable with NB-IoT and LTE-M (which are technically part of the 5G spec under Release 16+). It does not mean a million smartphones. Actual cell-level capacity for active data sessions is hundreds to low thousands of simultaneous users, depending on spectrum and MIMO configuration.
• "99.999% reliability" -- A URLLC target for specific use cases (factory automation, remote surgery). It applies to the radio interface under controlled conditions with redundancy. It is not the reliability you experience on a commercial 5G network, which is subject to handover failures, congestion, and coverage gaps just like LTE.

The honest assessment: 5G mid-band delivers a genuine 2-3x improvement in speed and latency over LTE for typical users. mmWave delivers transformative speeds in very limited areas. Low-band 5G is LTE with a new icon on your phone. The real value of 5G lies not in consumer mobile broadband but in the architectural capabilities -- slicing, MEC, URLLC -- that enable new enterprise and industrial use cases. These are materializing slowly.

5G and the IP Layer

From the perspective of the wider internet, 5G is just another access technology. The UPF assigns the UE an IP address (IPv4, IPv6, or both via dual-stack), and from that point, traffic follows the same BGP-routed paths as any other packet. Carrier 5G traffic exits their network through peering points at internet exchange points and private interconnects, traveling across autonomous systems to reach its destination.

One notable difference: 5G carriers are increasingly deploying CGNAT (Carrier-Grade NAT) for IPv4 traffic due to address exhaustion, while offering native IPv6 addresses to 5G devices. T-Mobile has been particularly aggressive with IPv6 -- most T-Mobile 5G devices receive a /64 IPv6 prefix natively. This has implications for peer-to-peer connectivity, gaming, and any application that requires inbound connections.

The transport protocols users choose matter more than ever on 5G. QUIC/HTTP3's connection migration is particularly valuable on mobile: when a device moves between cells or switches from 5G to WiFi, QUIC can migrate the connection seamlessly using connection IDs rather than IP addresses, avoiding the TCP RST that would otherwise terminate the session. Similarly, TCP's congestion control algorithms need tuning for 5G's variable bandwidth characteristics -- the bandwidth can fluctuate dramatically as beams track, cells hand over, or the user moves from mmWave to sub-6 GHz coverage.

Spectrum Allocation and Regulatory Reality

5G spectrum policy varies dramatically by country, which directly affects network performance. The US has followed an auction model, with the C-band (3.7-3.98 GHz) auction alone generating $81 billion in revenue. The FCC allocated only 280 MHz of C-band for 5G; other countries allocated far more mid-band spectrum. China assigned 100-160 MHz of 3.5 GHz and 2.6 GHz spectrum to each of its three carriers. Germany, Japan, and South Korea allocated similar ranges in the 3.4-3.8 GHz band.

The US also faces unique coordination challenges. The C-band abuts aviation radar altimeters (4.2-4.4 GHz), leading to the FAA's extended fight with the FCC over interference risks -- resulting in reduced power levels and exclusion zones around airports that persist to this day. The 3.5 GHz CBRS band requires dynamic spectrum sharing with incumbent military radar through an SAS (Spectrum Access System), adding latency and reducing the spectrum's value for latency-sensitive applications. The 12 GHz band (12.2-12.7 GHz), potentially valuable for 5G, is contested between SpaceX Starlink and wireless carriers.

These regulatory realities mean that the 5G experience varies enormously by country, carrier, and even neighborhood. A user on mid-band 5G in Seoul (where carriers have 80-100 MHz of contiguous mid-band) will have a fundamentally different experience than a user in rural Montana on low-band 5G with 10 MHz of 600 MHz spectrum. The technology is the same; the spectrum is not.

5G Fixed Wireless Access

One of 5G's most commercially successful applications has been FWA (Fixed Wireless Access) -- using 5G as a home broadband replacement for wireline connections like cable or DSL. T-Mobile and Verizon together serve millions of FWA customers in the US, typically using mid-band spectrum with an outdoor or window-mounted CPE (Customer Premises Equipment).

FWA works because mid-band 5G can deliver 100-300 Mbps to a fixed location with a directional antenna, which is competitive with cable internet in many markets. The economics work for carriers because the cell sites are already built for mobile service -- FWA fills unused capacity during off-peak hours (home broadband usage peaks in the evening when mobile usage is lower). The risk is capacity: as FWA subscriber counts grow, the shared cell capacity starts to degrade mobile user experience. Carriers manage this through traffic shaping, deprioritization during congestion, and cell splitting.

What Comes Next

3GPP Release 18 (5G-Advanced) introduces further refinements: AI/ML integration into the RAN for predictive beam management and traffic steering, sidelink enhancements for direct device-to-device communication (critical for V2X), NR on unlicensed spectrum (NR-U, similar to WiFi's use of unlicensed bands), reduced capability (RedCap) devices for IoT that need more than NB-IoT but less than full NR, and non-terrestrial networks (NTN) for satellite-based 5G. 6G research is underway targeting the 2030 timeframe, exploring sub-THz frequencies (100-300 GHz), reconfigurable intelligent surfaces, and joint communication-sensing -- but 5G's deployment cycle has years left to run.

The honest take: 5G is a significant engineering achievement that delivers meaningful improvements in speed, latency, and capacity over LTE. It also introduces genuinely new architectural capabilities -- slicing, MEC, URLLC -- that have no LTE equivalent. But the gap between the marketed vision (instant downloads, remote surgery, autonomous vehicles) and deployed reality (somewhat faster phones, some home internet replacement) remains wide. The technology works; the business models and use cases are still catching up.

Explore Carrier Networks

5G devices connect to carrier autonomous systems that peer with the rest of the internet via BGP. You can explore how major 5G carriers connect to the global internet using the BGP looking glass:

• AS21928 -- T-Mobile US, the largest 5G carrier by mid-band coverage
• AS20057 -- AT&T Wireless
• AS22394 -- Verizon Wireless
• AS45143 -- SK Telecom (South Korea), an early 5G leader
• AS9808 -- China Mobile, the world's largest mobile carrier by subscribers
• Look up your own IP -- See how your connection reaches the internet