Chapter 2: ISDN and SS7: 2.1 Signaling Systems

Chapter 2: ISDN and SS7
2.1 Signaling Systems

2.1.1 History of ISDN and SS7
Over the last 125 years, the telephone service providers have used many different types of Signaling Systems to administer phone calls in various ways. This includes setting up and removing each call from the telephone network. It also includes routing each call from its origin to its destination. The term PSTN (Public Switched Telephone Network) describes a shared system used by all telephone service providers throughout the U.S. Telephone systems were originally set up to handle only voice traffic though analog networks. Using T1s to time division multiplex (TDM) calls provided more efficient utilization of each physical connection. In 1984 the telephone service providers started using a system called ISDN (Integrated Services Digital Network) to administer calls from private business locations having CPE (Customer Premise Equipment).
2.1.2 In-band and out-of-band.

ISDN systems are physically in-band and logically out-of-band. This means that the same physical wires are used to multiplex both the voice traffic and the data traffic required to administer the system. Out-of-band means that various increments of time are dedicated for signaling and are not available for voice traffic. Beginning in 1980, and by the end of 1999, almost all telephone service providers in the United States implemented a signaling system called SS7 to administer the PSTN. Today most telephone systems throughout the world use some version of SS7. In contrast with ISDN, SS7 is both physically out-of-band and logically out-of-band.
Copyright Keely Communications 2006. All rights reserved.
Page 1 of 16

2.1.3 Setting up and Tearing Down Calls
Physically Out-of Band means that the network that sets up and tears down the phone calls is totally separate from the network that provides the actual voice traffic. Setting up a call means that a customer decides to make a call, dials the call and is connected to the number he/she wanted to call. Tearing down the call means that the call has ended and one party hangs up, making the trunk (telephone circuit) available for another call.
2.2
Using the OSI Model For SS7
The functions of ISDN and SS7 follow the guidelines provided by the OSI (Open Systems Interconnection) model. The OSI model has seven layers. ISDN uses layers 1-3 of the OSI model and SS7 uses layers 1-7.
2.2.1 The Basic OSI Model

The OSI model is a general guideline for protocols between computer systems. The layers of the OSI model are the following: 1. 2. 3. 4. 5. 6. 7. Physical Data Link Network Transport Session Presentation Application/ User processes.
One of the OSI guidelines is that communication communication between layers takes place only through adjacent layers. For example communication between Layer 1 (Physical) and Layer 3 (Network) can only happen by going through Layer 2 (Data Link).
Page 2 of 16

2.2.2 OSI Compared to SS7
Figure 2-1 is an adaptation of the OSI model that is designed specifically for telephone networks. Layers 1 and 2 for OSI and SS7 are very much alike, but the upper layers have substantial differences. One difference is that SS7 allows Level 7 (ISUP) to communicate directly with Layers 3, 4, 5, and 6.
Level 6, OAM Level 5, TCAP Level 4, SCCP
Level 7, ISUP
MPT Level 3, Routing MPT Level 2, Error Correction MPT Level 1, Physical Layer Figure 2-1 SS7 Levels
OAM (Operations, administration, management), TCAP (Transactions capabilities application part SCCP (Signaling connection control part), MTP (Message transfer part), ISUP (ISDN user part)
2.2.2.1
MPT Level 1, 2 and 3
1. The first layer is called the physical layer and is also called MTP 1. This layer includes the physical hardware as well as the T1 multiplexing method.
2. The second layer, MTP 2, provides error checking. It consists of three types of message units: MSU (Message Signaling Unit), LSSU (Link Status Signaling Unit), and FISU (Fill-In Signaling Unit). The MSU carries signals to level MTP 3, and other upper layers. The LSSU message is used to connect and disconnect links. In an operational network, these messages can indicate serious problems. FISUs occupy the link when there is no traffic. Using the analogy of a railroad train, the physical layer would be the railroad track. A FISU would be like an empty railroad car. More details about MPT 2 are provided in Section 2.5.1.
Page 3 of 16

3. The third layer, MTP 3, is involved in routing signaling messages. Key information in this layer is the OPC (origination point code) and the DPC (destination point code). This corresponds to identifying the switch closest to the person making the call (OPC) and person receiving the call (DPC). 4. The fourth layer, SCCP, provides a variety of translating functions. One type of translation would be converting 800 prefix numbers to standard area codes. SCCP is actually only part of the path for gathering information from databases. Chapter 4 will cover two types of SCCPs, called Connectionless and Connection Oriented. The whole notion of which protocol is on which layer is somewhat subjective. In Section 1.3.2 that (for the purposes of all of the lab experiments described in this book) the correct layer will be defined as that seen on the K15. The K15 shows both the SCCP and the ISUP to be on the 3rd Level. 5. The fifth layer, TCAP, provides a method for different telephone service providers to communicate with each other. Wireline service providers use only TCAP. Wireless service use TCAP, in addition to another protocol call MAP (Mobile Application Part). In Lab Experiment #4, TCAP and MAP protocols will displayed by the K15 on Level 4 (Compared to Level 5 in Figure 2-1). 6. The sixth layer, OAM, provides various tests to make sure that the PSTN network is operating correctly. This book will not cover OAM protocols. 7. The seventh layer, ISUP, communicates directly with MTP 3, SCCP, TCAP, and OAM. It is the primary user interface for studying SS7 messages related to setting up and tearing down phone calls. There are 59 types of ISUP messages, but we will discuss only the following 5 types: IAM, ANM, ACM, REL, and RLC. The other 52 ISUPs are listed in Appendix B. (i) IAM (Initial Address Message). This message starts the call, namely a user has dialed a number. (ii) ACM (Address Complete Message). This indicates that the called party has been found, and that the phone is ringing. (iii) ANM (Answer Message). This shows that the called party (or answering machine) has picked up the phone. (iv) REL (Release Message). This occurs when either the calling or called party hangs up the phone. (v) RLC (Release Complete Message). This acknowledges the REL message and makes the voice trunk available for another call.
Page 4 of 16

2.3 Using a Protocol Analyzer
A typical telephone network will receive thousands of signaling messages per second. Technicians use instruments called Protocol Analyzers to sort though these messages to find a needle in a haystack that can identify a problem. The figure titled Figure 2-2 is a display from a Tektronix K15 protocol analyzer. 2.3.1 The Pipeline
Figure 2-2 shows one of many types of Pipelines that the K15 can display. This pipeline elements. Other types of pipelines are used to capture messages available at a switch. For the lab experiments included with this text, however, the only available pipeline has only three elements: Recording File, Filter, and Monitor.
Pipeline
Short View
Columns
Frame View
Packet View Figure 2-2. Tektronix K15 Protocol Analyzer Display
Page 5 of 16

2.3.2 The Short View
The Short View displays the following information in each column: #1: Column Title = No: The number of the message received. Figure 2-2 shows message # 1709 through # 1729. The data file used for Experiment #1 (A-Link) in the lab manual contains about 168,000 messages, sent during an 8-minute period. This is a typical message rate. The data file used for Experiment #3 (Ater Link) in the lab manual contains more than 880,000 messages #2: Column Title = Short Time: The time the message was recorded. Using the first two columns you can see that about 21 messages were being received every three seconds on just the one monitored link. Another column heading, called Long Time can be chosen for any lab experiment. This would display time to the nearest microsecond.
#3: Column Title = 3. Prot: The SS7 layer 3 protocol. On the A-Link these are either SCCP or ISUP. Note that, on page 3 of this book, SCCP is said to be on the 4th layer and ISUP on the 7th layer. The K15 shows both the SCCP and the ISUP to be on the 3rd layer. The whole notion of which protocol is on which layer is somewhat subjective. For the purposes of all of the lab experiments described in this book the correct layer will be defined as that seen on the K15. #4: Column Title = 3. Msg: The type of ISUP (or SCCP) message. There are 59 types of ISUP messages, as stated on page 3 of this book. There are 18 types of SCCP messages. #5: Column Title = OPC: The OPC (Origination Point Code). This identifies the switch closest to the person making the call. #6: Column Title = DPC: The DPC (Destination Point Code). This identifies the switch closest to the called party. #7: Column Title = CIC: The CIC (circuit identification code). This is the trunk identifier. #8: Column Title = Calling Addsig: This is the phone number for the person placing the call. #9: Column Title = Called Addsig: This is the phone number for the person receiving the call. Note the database used for the Lab Experiments has been altered to remove all of the calling and called phone numbers. #10: Column Title = REL cause. There are 35 different reasons for releasing a call. The most common reason is normal clearing which means that one party hangs
Page 6 of 16

up the phone. A detailed description of all 35 release messages is included as Appendix A of this book. The information can be found within a very long document provided by Bellcore, a United States organization that keeps standardization documents for SS7. There are more than 40 choices for column headings available for the Short View. Additional column heading can be found the in Frame View and appended to the Short View.
2.3.3 The Frame View

Each message in the Short View has a corresponding text in the Frame View. This text includes all of the 1s and 0s involved in the message. The shortest message is a FISU that is always 6 Bytes long. The MSU has a variable length that can be as long as 273 Bytes. The Frame View also has many Comments and Values. The Frame View will be discussed further in Chapter Section 2.5.
2.3.4 The Packet View

Figure 2-2 shows a third view at the bottom of this display. One function of this view is to convert the Frame View text into a hex form in order to assist software developers. Additional information provided in the packet view will be used during the Lab Experiments.
Page 7 of 16

2.4
2.4.1
Applying Filters
Setting Protocols and Messages
Clicking on the Filter Icon within the Pipeline shown in Figure 2-2 brings up the display shown in Figure 2-3.
Figure 2-3. Applying Filters
Page 8 of 16

2.4.2 Setting Cause Indicators and Cause Values By selecting ISUP and the REL message we can see nothing but Release Messages. By selecting Cause Indicators, Cause Values and Temporary Failure, the display shown in Figure 2-4 can be displayed.
Figure 2-4. Result of Applying The Temporary Failure Filter 2.4.3 Computing Lost Revenue
Figure 2-4 shows that 23 calls could not be completed during a 6 minute period because Of Temporary Failure. Thats 230 per hour, or 5,520 per day, or more than 2,000,000 lost calls per year! At 11.6 cents per call, thats a lost revenue of about $232,000 a year -- from just one MSC! Note that Lab Experiment #1 is very similar to the example shown in Figure 2-4.
Page 9 of 16

2.4.4. Timers Related to Temporary Failure.
When the switch sends an IAM it starts a timer called the TIAM timer, which is usually set to count down from ten seconds to zero. If it reaches zero, it will result in a release message with a cause value of "Temp Fail". So, what is really expected is for the distant end to return an ACM or REL message within these 10 seconds. What kind of release messages may be expected ? User Busy, Unassigned Number, Number Changed, Misdialed Trunk Prefix, etc. The TACM timer has a similar function. When the destination switch begins ringing the called party, it sends an ACM message and starts a TACM timer, that is usually set to count down from sixty seconds. With the "ringing" set to "ring" for one second and "pause" for four seconds, a "ring period" is five seconds long. In the sixty seconds of the timer, the called party's telephone will have been rung 12 times. If they haven't answered after that many rings, they probably aren't home, or don't want to be disturbed. So if the timer reaches zero, the switch releases all of the equipment that was being used for this call (RF channel, terrestrial channel, CIC, ringing generator, etc.) so it is available for other customers. It also returns a REL message with a cause value "User Not Responding". When this is received at the originating office, it will remove the ring-back tone and place a recording on the line that says something like, "The party you are trying to reach is currently unavailable. Please try again later."
Page 10 of 16

2.4.5. Other Bad Release Causes
Seven Bad Release Causes other than Temporary Failure are identified in Figure 2-5.
Figure 2-5. Bad Release Causes other than Temporary Failure

Experiment #1 involves counting the number of each type and calculating the lost revenue. Whenever a network needs to be evaluated the first step is to compare measurements to any previously recorded baseline data. Problems should be prioritized, based upon the lost revenue and the cost involved in repairing the problem. Additional data usually will be needed in order to solve each problem.
Page 11 of 16
2.4.5. The Complete Tektronix K15 Protocol Analyzer

The complete Protocol Analyzer is shown in Figure 2-6. It weighs 11.8 kilograms and has the following dimensions: Height: 340 mm Width: 365 mm Depth: 227 mm
Figure 2-6. The Tektronix K15 Protocol Analyzer
Page 12 of 16

2.5. More About the Frame View 2.5.1 MPT Level 2
Level 2 messages, introduced in Section 2.2.2.1 will be covered in more detail, in order to show some of the information available in the Frame View. The three MPT 2 messages are: 1. FISU (Fill-In Signaling Unit). This is always 6 bytes long. The components are shown in Figure 2-7. A typical network will normally process about 800 per second. The K15 protocol analyzer is usually set up avoid displaying these messages because they have limited value for troubleshooting a network. The components of a FISU are: a. CRC (Cyclic Redundancy Check). Used for error checking b. LI (Length Indicator) c. FSN (Forward Sequence Number) d. BSN (Backward Sequence Number) e. FLAG. This shows the beginning of a new sequence number. 2. LSSU (Link Status Signaling Unit). This is always seven or eight bytes long. A typical network will normally process about 2 per minute. Compared to the FISU, the added element is the SIO (Service Indicator Octet) 3. MSU (Message Signaling Unit). These have variable lengths and can be as long as 273 bytes. A typical network will normally process about 40 per second. The MSU includes Address (also called Routing) information as well as Message Data. Figures 2-8 and 2-9 every 1 and 0 for an IAM message, which is one of the longer versions of an MSU.
Page 13 of 16

Signaling Units
Header
FISU
C R C
C R C
L I
F S N
B S N
F L A G
Header
F L A G
LSSU R
C
C R C
S I O
L I
F S N
B S N
1 MSU Message Data Address
Header
F L A G
C R C
C R C
SCCP, ISUP, MAP, DTAP, DPC, OPC, CIC, L BSSAP, TCAP, INAP, etc. SLS, SLR, DLR I
F S N
B S N
>2
Variable Length up to 273 Bytes
Figure 2-7. MPT 2 Signaling Units
Page 14 of 16

2.5.2 Frame View for an IAM Message
Figures 2-8 and 2-9 show the an entire IAM (every one and zero) under the column titled BITMASK. The corresponding ID names are shown in the next column. Many Comments and Values are shown in that column.
Figure 2-8. Frame View for an IAM Message
Page 15 of 16

2.5.3
Frame View for an IAM Message, Scrolled to the End
Some of the Lab experiments use the following added features of the Frame View: 1. Some of the frame view comments can be appended to become a Short View Column heading. 2. A cause value found in the Frame View can be used as a short cut for setting up the filter to find other times that cause value occurred.
Figure 2-9. Frame View for an IAM Message, Scrolled to the End
Page 16 of 16

Chapter 2: ISDN and SS7: 2.1 Signaling Systems

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter 2: ISDN and SS7: 2.1 Signaling Systems

Uploaded by

Copyright:

Available Formats

Chapter 2: ISDN and SS7

2.1 Signaling Systems

2.1.2 In-band and out-of-band.

Copyright Keely Communications 2006. All rights reserved.