WPS0!01!05 SoftX3000 MAP Signaling&Fault Analysis 20050524 B 1.0

5 January 2007 Internal use only
OWG003409 MAP Signaling

&
Fault Analysis
www.huawei.com
HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential

Page 1
HUAWEI TECHNOLOGIES CO., LTD.
Content
Chapter 1 MAP Protocols Introduction
Chapter 2 MAP messages Introduction
Chapter 3 Typical MAP Flows Introduction
Chapter 4 MAP Fault Cases Analysis
Training.huawei.com
HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 2

Overview of MAP protocols ： Network
entity

Overview of MAP protocols ： Interface model
MSC/VLR gsmSCF
E/G L J
MSC/VLR C/D HLR
A
E
F
SMS-GMSC
BSS EIR Gs Gr Gc SMS-IWMSC
Gf Gd
Gb
SGSN Gn GGSN
Gn Gp Gi
SGSN
GGSN PDN
Other PLMN

Overview of MAP protocols ： Protocol design
1 、 MAP protocol layers
MAP Service User MAP Service User
Service Interface
MAP Service Provider

Overview of MAP protocols ： Public Service
Primitive
1 、 Overview of public service primitive
Functions of Public Service Primitive  MAP Public Service Primitive

Establishment and Removal of MAP Dialog  MAP-OPEN Service Primitive
between MAP Service Users at the Same
Layer  MAP-CLOSE Service Primitive
Access Functions Supported by Various Layers  MAP-DELIMITER Service Primitive
below Application Layer
 MAP-U-ABORT Service Primitive
Report of Abnormalities
 MAP-P-ABORT Service Primitive
Processing of Different MAP Versions
Tests of Whether an Inherent MAP Session  MAP-NOTICE Service Primitive
Remain Activated at Each Terminal

Overview of MAP protocols ： Functional
versions comparison
1 、 Function
difference
MAP Phase1: Support Basic Supplementary Services instead of CAMEL
or GPRS. Basic Supplementary Services Supported: BAOC, BOIC,
BoIcexHC, BAIC, BIc-roam, CFU, CFB, CFNRy, and CFNRc.
MAP Phase2: Not Support CAMEL or GPRS; Functions of Supplementary
Services are Enhanced based on Phase1 Supplementary Services, for
Example, CLIP/CLIR, COLP/COLR, Call Waiting, Call Hold, Multi-party
Session, Closed User Group (CUG), and HOT BILLING.
MAP Phase2+: As Compared with Phase2, Phase2+ Supports CAMEL
and GPRS.CAMEL, whether at Phase1 or Phase2, is Supported at the
MAP Phase2+ alone. The GPRS Function is Added for Joint Location
Update for GSM/GPRS Mixed Users. Meanwhile, Some New
Functions, for Example, LCS Function, are Added to Phase2+.

Overview of MAP protocols ：
Functional versions comparison
2 、 Difference in service flow operation code

When the Authentication Set MAP Phase1 is Taken, the Operation code
SEND_PARAMETERS(9) is Used; Both MAP Phase2 and Phase2+ Employ the Operation
code SEND_AUTHENTICATION_INFO (56).
When the Previous VLR Takes IMSI MAP Phase1, it Employs the Operation code
SEND_PARAMETERS(9); Both MAP Phase2 and Phase2+ Employ the Operation code
SEND_IDENTIFICATION (55).
When a Short Message is Originated and Terminated at MAP Phase1 and MAP Phase2, it
Employs the Operation code of MAP Phase1: FORWARD_SHORT_MESSAGE(46); In Case
of MAP Phase2+, a Short Message is Originated by Employing the Operation code
MO_FORWARD_SM(46) and is Terminated by Employing the Operation code
MT_FORWARD_SM(44).
User Reappearance (including Short Message User Reappearance) at MAP Phase1 Employs
the Operation code NOTE_MS_PRESENT(48); In Case of MAP Phase2 and MAP Phase2+,
the Operation code READY_FORSM (66) will be Used.
Purge at MAP Phase1 is not Supported; In Case of MAP Phase2 and MAP Phase2+, Users are
Deleted from VLR and HLR is Informed by Means of the PURGE_MS (67) Operation.

Overview of MAP Protocols: Version
Negotiation
The process of version negotiation is following ：
1) In Communication, Party A’s MAP Function is set as Phase N while Party B’s
MAP Function is set as Phase M
2) Party B Initiates a Dialog Request by Means of Phase M:

• In Case of M=N, Version Negotiation is Unnecessary.
• In Case of M<N, Party A Receives this Dialog Request and This Service
Process is Conducted Based on Phase M.
• In Case of M > N, Party A Informs Party B in the Form of the
TC_U_ABORT Communication Primitive and the Dialog Request is Denied.
Meanwhile, TC_U_ABORT Carries the Maximum Version Number N
Supported by Party A; upon Receiving the TC_U_ABORT Denial
Instruction from Party A, Party B Initiates again a Dialog Request by Means
of Phase N and Subsequent Service Process is Conducted Based on
Phase N.

Content
Training.huawei.com

ASN.1 Coding
MAP Message Format
MAP Message Coding
MAP Message
Analysis

ASN.1 Coding ： Basic Information Element
１、 Basic Information Element
The Basic Information Element is called IE for short, including Tag,

Length and Content. The Tag is used to Distinguish between Different
IEs and Determine the Explanation of Content Fields, and the Length
Indicates the Number of Bytes Included in Content. According to the
Complexity of Content, the IE can be Divided into the Primitive and
Constructor. The Content of the Primitive is Simple Data Type and
the Content of the Constructor is One or Multiple Basic IEs.

ASN.1 Coding ： Tags
２、 Tag
Tag ： It makes up of one or more octets. It contains three parts: Class, Form
and Tag Code.
H G F E D C B A
Class Form Tag Code
Thereinto ， The Two Bits HG form the Class, which categorizes tags into four types:
HG = 00 Universal, it is the completely standardized tag defined in the X.209.
HG = 01 Application-Wide, it is applied to IEs of various TCAP application service ASEs (that is, TCAP user) in
SS7. For example, this type of tags are used for the tags of the transaction processing sublayer.
HG =10 Context-specific, It is used in the IEs specified in the upper-level Constructor. The sequence of other data
elements in the same constructor should also be considered for these IEs. This tag can be repeatedly used in
other constructors, for example this type of tags are used for all tags of the component processing sublayer.
HG=11 Private Use, It is reserved for use in IEs of national, network or private users. These IEs does not belong
to the protocol scope of the TC.

ASN.1 Coding ： Tags
２、 Tag
Format of bit F: Referring to the form of the IE

0: indicating that the IE is a Primitive
1: indicating that the IE is a constructor
Bits E-A are tag codes, indicating the sequence number of the tag, which can
be extended as multiple bytes. Its format is shown below:
Class Form Tag Code
ClassForm Tag Code
Extend Bit
00000~11110
1 MSB
～～
～～
Extend Bit LSB
0
（ A ）单字节格式（ B ）扩展格式

ASN.1 Coding ： Length
３、 Length
The length indicates the number of octets occupied by the content part, but does not
include the octets of the tag and length fields.
The length field has three coding modes:
a ） If the length is less than 128 octets, then the short format will be used. It occupies one byte
only; the eighth bit is set as 0 and the lower seven bits are the binary code value of the length.
b ） If the length is greater than or equal to 128 octets, then the long format will be used. In this
coding mode, the length of the code of the length field itself is 2-127. Where, the H bit of the
first byte is set as 1, the length of the binary code value length field of the G-A bit is subtracted
by 1, and the IE itself is represented with unsigned binary digit. Its MSB is the G bit of the
second byte and its LSB is the A bit of the last byte.
c ） In the Indefinite coding mode, the length field only occupies one octet and the start code is
always 10000000, which does not indicate the length of the IE, but is a tag of the indefinite
code. If this coding mode is used, a special End-Of-Content (EOC) indicator should be set at
the end of the IE. This indicator is processed as an IE. Its tag (Class) is Universal, its Form is
Primitive, its Tag Code is 0 and it does not have the Content part, so its length is 0. The
indefinite code can be used in the IE of any length, with its maximum length only restricted by
the maximum length of the SCCP message. This code can replace the length code of short or
long format. The only requirement is that the applied IE should be of the Constructor type,
since the EOC itself is a message element.

ASN.1 Coding: Example of Information Element
４、 Examples of IE
Example 1: 04 08 64 00 70 07 09 00 00 F1
04 is the tag, 08 is the length and all the other parts indicate the contents.
It can be known from the further analysis of 04 that this IE is of the universal class
which has completely standardized definition in the X.209. Meanwhile, the IE is
Primitive and the tag code is 4 . It can be known from X.209 that this tag
indicates the Octet String, that is, the content of the IE is an array of one octet.
In fact, the content of the IE indicates an IMSI.
Example 2: 6C 80 ...... 00 00
6C is the tag, 80 indicates the indefinite length, the last two 00 indicates the end
of the IE, and the omitted part in the middle indicates the content of the IE.
It can be known from the further analysis of the tag 6C that this IE is of
Application-wide class. The IE is a constructor applied in the TCAP functions in
SS7 and the tag code is C. According to the TCAP protocol, it can be known
that this IE indicates the component part of the TCAP.

ASN.1 Coding
MAP Message Format
MAP Message
Coding
MAP Message
Analysis

MAP message format ： message structure
The transmission of the MAP messages is based

upon the services provided by each protocol layer of
the TCAP, SCCP and MTP. An MAP message
transmitted over the signaling link also includes the
protocol data of the protocol layers of the TCAP,
SCCP and MTP. The format of a complete message
is shown in the following figure:
MTP SCCP
TCAP message MAP message
message message

MAP message format ： MAP message
F CK SIF LI FIB FSN BIB BSN F

8 16 2 6 1 7 1 7 8 Bytes sent first
Rout lable
Message type(UDT)
Protocol type
Pointer of the called address

Pointer of the calling party address
Data part pointer
Length of the called address
called address
Length of the calling party address
Calling party address

Data length
Data(TCAP message)

F ： Its code pattern is 01111110, which not only indicates the end of the previous
signal unit, but also indicates the start of the next signal unit. Multiple random F tags
can be inserted between two signal units. The F tag can reduce the processing
workload of the system in overload condition.
CK ： check error, the 16-bit cyclic redundant code is used to detect the errors
generated during the transmission of the signal unit.
Sequence number of signal units and retransmission indication bit
BSN ： Backward Sequence Number. The BSN indicates the sequence number
for the opposite part until all messages of the BSN have been received correctly.
BIB ： Backward (retransmission) Indication Bit. The BIB is used for reverse
indication of the opposite party starts the retransmission from the BSN+1
message.
FSN ： Forward sequence number, that is, the sequence number of the message.
FIB ： Forward (retransmission) Indication Bit. The FIB is used for reverse
indication of the start of the message retransmission.

LI ： Signal unit length indication bit. Its value is equal to the number of
octets between the LI field and the CK field. LI of FISU = 0, LI of LSSU = 1
or 2 and LI of MSU >2. Since the length of the LI field is 6 bits, with the
value range of 0-63, when the length is greater than or equal to 63, all the
values of LI are set as 63 to maintain the original structure.
SIO ： Service Indication Octet. The SIO is only used in MSC for indicating
the message type. The three levels of the MTP allocate messages to the
corresponding functional modules according to the SIO, and meanwhile,
it indicates whether a message is a national network message or an
international network message.
Lower 4 bits: DCBA, service indicator, where the SCCP is 0011.
Higher 4 bits: HGFE, Sub-service field, If HG=00, it indicates the international
network; if HG=01, it indicates the international backup network; if HG=10,
it indicates the national network and if HG=11, it indicates the national
backup network. The FE bits are standby.

ASN.1 Coding
MAP Message
Format
MAP Message Coding
MAP Message
Analysis

MAP message coding
For the detailed protocol of the MAP message, the

description of Abstract Syntax Notation (ASN.1) in the
CCITT Recommendation X.208 is used.
The operation code, operation type and operation time
limit corresponding to the MAP service message are
given in the ETSI GSM 09.02 specifications. Where,
the operation time limit includes three types: long,
intermediate and short time limits. The specific values
depend upon the specific implementation modes.
For Specific MAP Operation codes, See the Teaching
Course.

ASN.1 Coding
MAP Message Format
MAP Message Coding
MAP Message Analysis

MAP message analysis
118>> 30168 UDT 000000d 05FF09 03FF11 3F 3F 83 11 FF

03 09 FF 05 0D 09 81(SCCP) 03 0E 18 0B 12 06 00 12 04 68 31
39 31 00 00 0A 12 07 00 12 04 68 31 09 40 67 2A 62 28
(TCAP) 48 04 2B 81 11 00 6C 80 (Component Sublayer)

A1 80 02 01 00 02 01 02 30 16 04 08 64 00 30 31 08 00 51 F4
81 06 91 68 31 09 40 67 00 00 00 00

MTP Layer
3F 83 11 FF 03 09 FF 05 0D ：
3F----indicating the length of the whole MTP message. When the number
of all the message bytes is greater than 63 bytes, the byte is uniformly
set as 3F.
83----If the higher four bits are “8”, it indicates the network indicator,
indicating the national master network; if the lower four bits are “3”, it
indicates the service indicator, indicating the subsequent SCCP
message.
11 FF 03----the DPC is 03 FF 11
09 FF 05----the OPC is 05 FF 09
0D----SLS Signaling link selection code

SCCP Layer
09 81(SCCP) 03 0E 18 0B 12 06 00 12 04 68 31 39 31 00
00 0A 12 07 00 12 04 68 31 09 40 67 2A
09: indicating the message type is UDT.
81: If the higher four bits are “8”, it indicates that the Quality of Service (QoS) requires error return;
if the higher four bits are “0”, it indicates that the QoS does not require the error return. If the
lower four bits are “1”, it indicates that the protocol type of the SCCP is sequential
connectionless class 0.
03: The pointer of the called subscriber address: “03” means that the bytes starting with the third
byte after “03” indicate the called address.
0E: The pointer of the calling subscriber address: “0E” means that the bytes starting with the
fourteenth byte after “0E” indicate the calling address.
18: Data address pointer; “18” means that data addresses begin with the 24th byte after “18”.
0B 12 06 00 12 04 68 31 39 31 00 00 ----the called party’s GT code address. For details, see the
teaching course.
0A 12 07 00 12 04 68 31 09 40 67----Address of the calling GT code. The analysis method is the same
as that of the address of the called GT code.
22: length of SCCP data part, that is, length of a TCAP message, incating that the length is 34 octets.

TCAP layer: transaction processing sublayer
62 28 48 04 2B 81 11 00
62 ： The field code of the transaction part, that is, the message type tag of
the TCAP, indicating that the message type is a message Begin.
28 ： According to the composition of the IE, after the message type tag is
the IE length, so it can be seen that the “2A” before 62 indicates that the
length of this TCAP message is 42 (2AH) bytes.
48 ： Indicating the transaction ID in the message type so as to differentiate
different transactions. “48” indicates the source transaction ID tag.
04 ： According to the composition of an IE, after the Tag is the IE Length,
therefore “04” indicates that the length of the destination transaction
processing ID value is 4 bytes
2B 81 11 00 ： Source transaction ID value

TCAP layer: component processing sublayer
6C 80 A1 80 02 01 00 02 01 02 30 16 04 08 64 00 30 31
08 00 51 F4 81 06 91 68 31 09 40 67 00 00 00 00 00 00
6C ： Component part tag.
80 ： Indicates that the length of this component is indefinite.
A1 ： Part coding tag in component part; the value “A1” indicates that this part is invoking
part; “A2” indicates that this part is result (final) return part; “A3” indicates that this part
is error return part; “A4” indicates REJECT.
80 ： Length of IE, an indefinite length.
02 ： Local invoke tag 01 ： Operation code length. 00 ： The invoke ID value i
s 00.
02 ： Local operation code tag, indicating the operation conducted for the invoke this time.
01 ： Length of local operation code
02 ： Operation code, indicating the operation conductedfor the invoke this time.
30 ： Indicating the sequence tag, this item is optional in the returned component.
16 ： Length 04 ： Octet string 08 ： Length
64 00 22 07 08 00 51 F4 ： Mandatory location update parameter: IMSI
81 ： Tag 06 ： Length 91 ： Attribute
68 31 09 00 64 F7 ： optional parameter for location update: MSC number; F is a filler.
Content
Training.huawei.com

Chapter 3 Typical MAP Flows
Introduction
Location Management Service Flow

Data Recovery Flow
Call Processing Service Flow
Supplementary Service Operation
Flow
Short Message Service Flow
Typical Signaling Flows Analysis

Location Management Service Flow:
Location Update
Overview
Location update is used to update the mobile user location information
saved in network.This location information is used to provide roaming
mobile users with route address of incoming calls, short messages,
and unstructured supplementary service data.
To decrease update of user HLR, HLR only saves the information about
VLR and MSC users attach to.VLR contains more detailed location
information, that is, an location area where a user actual
roams.Therefore, each time a location area is changed, VLR needs
to be updated while HLR needs to do so only in the following cases:
When a user is registered at a new VLR and when VLR has no data of this user;
If the tag “HLR confirmation” or “confirmation of location information in HLR” is set
as “unconfirmed” due to reset of HLR or VLR, VLR receives the instruction that
the user appears.

Location Update
Location Update when MS Roams in the Same VLR
Area 　 A B
MS BS MSC VLR
A_LU_REQUEST
MAP_UPDATE_LOCATION_AREA
(note 1)
MAP_AUTHENTICATE
MAP_AUTHENTICATE ack
(note 2)
MAP_SET_CIPHERING_MODE
MAP_TRACE_SUBSCRIBER_
ACTIVITY
MAP_CHECK_IMEI
MAP_CHECK_IMEI ack
MAP_FORWARD_NEW_TMSI
A_LU_CONFIRM ack
MAP_FORW._NEW_TMSI ack

Location Update
Location Update when MS Roams in Different VLR Areas (Case
1) A B D
MS BS MSC VLR HLR
G D
PVLR
A_LU_REQUEST
MAP_UPDATE_
LOCATION_AREA MAP_SEND_IDENTIFICATION
MAP_SEND_IDENTIFICATION
ack
MAP_UPDATE_LOCATION
MAP_CANCEL_
LOCATION
MAP_CANCEL_
LOCATION ack
MAP_ACTIVATE_TRACE_MODE
MAP_TRACE_SUBSCR
_ACTIVITY MAP_ACTIVATE_TRACE_MODE ack
MAP_INSERT_SUBSCRIBER_DATA
MAP_INSERT_SUBSCR._DATA ack
MAP_UPDATE_LOCATION_AREA ack
MAP_UPDATE_
A_LU_CONFIRM LOCATION_AREA ack

Location Update
Location Update when MS Roams in Different VLR Areas (Case
2)
A B D
MS BS MSC VLR HLR
G D
PVLR
A_LU_REQUEST
MAP_UPDATE_
LOCATION_AREA
MAP_PROVIDE_IMSI
MAP_PROVIDE_IMSI
ack
MAP_UPDATE_LOCATION
MAP_TRACE_SUBSCR
_ACTIVITY MAP_ACTIVATE_TRACE_MODE ack
MAP_INSERT_SUBSCR._DATA ack
MAP_UPDATE_LOCATION_AREA ack
MAP_UPDATE_
A_LU_CONFIRM LOCATION_AREA ack

IMSI Separation
IMSI Separation
A B
MS BS MSC VLR
A_LU_Request
(DETACH IMSI)
MAP_DETACH_IMSI
IMSI separation (that is, power-off). User data in VDB still exist and the
user’s power-off mark has been set. In this case, if the user is the callee,
HLR will get the roam number from the VMSC where the user is located,
but it will not enter the flow of roam number allocation if it finds the user’s
power-off mark. MAP part clears directly and returns.

PURGE MS
Delete MS from VLR
D
VLR HLR
MAP_PURGE_MS
MAP_PURGE_MS_ack

Introduction

Data Recovery Flow
Flow

Data Recovery Flow: Data Recovery Resulting
from Called BMobile User D
MSC VLR HLR
MAP_PROVIDE_ROAMING_NUMBER
PROVIDE_ROAMING_NUMBER_ack
MAP_SEND_AUTHENTICATION_INFO
SEND_AUTHENTICATION_INFO_ack
MAP_RESTORE_DATA
MAP_ACTIVATE_TRACE_MODE ack
INSERT_SUBSCRIBER_DATA_ack
MAP_RESTORE_DATA_ack

Data Recovery Flow: Data Recovery Resulting
from Restarting
D
of HLR B
HLR VLR MSC
MAP_RESET
MAP_UPDATE_LOCATION_AREA or
MAP_PROCESS_ACCESS_REQUEST
MAP_UPDATE_LOCATION
MAP_ACTIVATE_TRACE_MODE ack
INSERT_SUBSCRIBER_DATA_ack
MAP_UPDATE_LOCATION_ack
MAP_FORWARD_CHECK_SS
and MAP_FORWARD_CHECK_SS
INDICATION
INDICATION (optional)
(if received from HLR)

Chapter 3 Typical MAP Flow
Introduction

Data Recovery Flow
Flow
Typical Signaling Flow Analysis

Call Processing Service Flow:
Get Routing Information
Network Gateway
MSC HLR VLR
I IAM
MAP_SEND_ROUTING
INFORMATION MAP_PROVIDE_SUBSCRIB
MSC ER INFORMATION
MAP_PROVIDE_SUBSCRIB
ER INFORMATION ack
MAP_SEND_ROUTING
INFORMATION ack
MAP_SEND_ROUTING
INFORMATION MAP_PROVIDE_ROAMING
NUMBER
MAP_PROVIDE_ROAMING
NUMBER ack
MAP_SEND_ROUTING
INFORMATION ack
I IAM MAP_RESTORE_DATA

Call Processing Service Flow: Query Anytime
gsmSCF
SCF HLR VLR
MAP_ANY TIME
INTERROGATION MAP_PROVIDE_SUBSCRIB
ER INFORMATION
MAP_PROVIDE_SUBSCRIB
MAP_ANY TIME ER INFORMATION ack
INTERROGATION ack

Introduction

Data Recovery Flow
Supplementary Service Operation Flow

Supplementary Service Operation Flow:
Register
MS MSC VLR HLR
PROCESS_ACCESS
A_REGISTER_SS
MAP_REGISTER_SS MAP_REGISTER_SS
MAP_REGISTER_SS ack
MAP_REGISTER_SS ack
A_REGISTER_SS ack
MAP_INS_SUBS_DATA

Supplementary Service Operation Flow: Delete
MS MSC VLR HLR
PROCESS_ACCESS
A_ERASE_SS
MAP_ERASE_SS MAP_ERASE_SS
MAP_ERASE_SS ack
MAP_ERASE_SS ack
A_ERASE_SS ack
MAP_INS_SUBS_DATA

Activate
MS MSC VLR HLR
PROCESS_ACCESS
A_ACTIVATE_SS
MAP_ACTIVATE_SS MAP_ACTIVATE_SS
MAP_GET_PW MAP_GET_PW
A_GET_PW
A_GET_PW ack
MAP_GET_PW ack MAP_GET_PW ack
MAP_ACTIVATE_SS ack
MAP_ACTIVATE_SS ack
A_ACTIVATE_SS ack
MAP_INS_SUBS_DATA

Deactivate
MS MSC VLR HLR
PROCESS_ACCESS
A_DEACTIVATE_SS
MAP_DEACTIVATE_SS
MAP_DEACTIVATE_SS
A_GET_PW
A_GET_PW ack
MAP_DEACT_SS ack
MAP_DEACTIV_SS ack
A_DEACTIV_SS ack
MAP_INS_SUBS_DATA

Supplementary Service Operation Flow: Query
MS MSC VLR HLR
PROCESS_ACCESS
A_INTERROGATE_SS
MAP_INTERROGATE_SS MAP_INTERROGATE_SS
MAP_INTERR_SS ack
MAP_INTERR_SS ack
A_INTERR_SS ack

Supplementary Service Operation Flow: Register
PasswordMS MSC VLR HLR
PROCESS_ACCESS
A_REGISTER_PW
MAP_REGISTER_PW
MAP_REGISTER_PW
A_GET_PW
A_GET_PW ack MAP_GET_PW ack

MAP_GET_PW ack
MAP_GET_PW
MAP_GET_PW
A_GET_PW
A_GET_PW ack
MAP_GET_PW
A_GET_PW MAP_GET_PW
A_GET_PW ack
MAP_REG_PW ack
MAP_REGISTER_PW ack
A_REGISTER_PW ack

Introduction

Data Recovery Flow
Flow

Short Message Service Flow: Mobile-originated
Short Message
Servicing Interworking
MS VLR SC
MSC or SGSN MSC
Short Message MAP_SEND_INFO_FOR_M

O_SMS
MAP_SEND_INFO_FOR_M
O_SMS
MAP_MO_FORWARD_SHORT_MESSAGE
Short Message
Short message
Short message MAP_MO_FORWARD_SHORT_MESSAGE_ACK Acknowledgement
Acknowledgement

Short Message Service Flow: Mobile-ended Short
Message  Delivery of Single Short Message
Servicing Gateway
MS VLR HLR SC
MSC or SGSN MSC
Short Message
MAP_SEND_ROUTING_
INFO_FOR_SM
MAP_SEND_ROUTING_
INFO_FOR_SM_ACK
MAP_MT_FORWARD_SHORT_MESSAGE
MAP_SEND_INFO_FOR_
MT_SMS
MAP_PAGE/MAP_SEARCH_FOR
_MOBILE_SUBSCRIBER
Page
Page response
MAP_PROCESS_ACCESS_REQUEST_ACK/
MAP_SEARCH_FOR_MOBILE_SUBSCRIBER_ACK
MAP_SEND_INFO_FOR
_MT_SMS_ACK
Short Message
Short message
Acknowledgement
MAP_MT_FORWARD_SHORT_MESSAGE_ACK Short message
Acknowledgement

Short Message Service Flow: Mobile-ended Short
Message  Delivery of Multiple Short Messages
Servicing Gateway
MS VLR HLR SC
MSC or SGSN MSC
Short Message
MAP_SEND_ROUTING_
INFO_FOR_SM
MAP_SEND_ROUTING_
INFO_FOR_SM_ACK
MAP_MT_FORWARD_SHORT_MESSAGE(note 1)
MAP_SEND_INFO_FOR_
MT_SMS
MAP_PAGE/MAP_SEARCH_FOR
_MOBILE_SUBSCRIBER
Page
Page response
MAP_PROCESS_ACCESS_REQUEST_ACK/
MAP_SEARCH_FOR_MOBILE_SUBSCRIBER_ACK
MAP_SEND_INFO_FOR
_MT_SMS_ACK
Short Message
Short message
Acknowledgement
Acknowledgement
Short Message
MAP_MT_FORWARD_SHORT_MESSAGE(note 2)
Short Message
Short message
Acknowledgement
Acknowledgement

Short Message Service Flow: Short Message
Alert
 User reappearance triggers short message alert
Servicing InterWorking
MS VLR HLR SC
MSC or SGSN MSC
CM Service Request /
Page response/
Location Updating
MAP_PROCESS_ACCESS_REQUEST /
MAP_READY_FOR_SM (Mobile Present) /

MAP_UPDATE_LOCATION/
Supplementary Service Control Request
MAP_READY_FOR_SM_ACK MAP_ALERT_SERVICE_
CENTRE (notes 1 and 2)
Alert Service
Centre
MAP_ALERT_SERVICE_
CENTRE_ACK

Alert
 User memory available triggers short message alert
Servicing InterWorking
MS VLR HLR SC
MSC or SGSN MSC
SM memory capacity
available MAP_READY_FOR_SM
(Memory Available)
MAP_READY_FOR_SM
(Memory Available)
MAP_READY_FOR_SM_ACK
MAP_READY_FOR_SM_ACK
SM memory capacity
available ack MAP_ALERT_SERVICE_
CENTRE
Alert Service
Centre
MAP_ALERT_SERVICE_
CENTRE_ACK

Alert
 Successful delivery of short messages triggers short message alert
Gateway InterWorking
HLR SC
MSC MSC
MAP_REPORT_SM_DELIVERY_STATUS
(Successful Transfer)
MAP_REPORT_SM_DELIVERY_STATUS_ACK
MAP_ALERT_SERVICE_
Alert Service
CENTRE (note)
Centre
MAP_ALERT_SERVICE_
CENTRE_ACK

Sending Status Report
Visited Gateway
HLR SC
MSC or SGSN MSC
MAP_MT_FORWARD_SHORT_MESSAGE_ACK/_NACK
(Absent subscriber_SM,unidentified
subscriber or memory capacity exceeded)
MAP_REPORT_SM_DELIVERY_STATUS
MAP_REPORT_SM_DELIVERY_STATUS_ACK
Short Message Negative

Acknowledgement

Introduction

Data Recovery Flow
Flow

Typical Signaling Flows Analysis: Call Message
Flow
Call message flow of the C/D interface

Flow
Call message analysis of the C/D interface
1 、 SEND_ROUTING_INFO
<SCCP NAT 4613 00b 000008 000009 09 81 03 0C 16
09 12 06 00 12 04 68 31 28 07 0A 12 08 00 11 04 68 31
09 82 F0 54 62 80 48 04 39 01 00 38 6B 80 28 80 06 07
00 11 86 05 01 01 01 A0 80 60 80 A1 80 06 07 04 00 00
01 00 05 02 00 00 00 00 00 00 00 00 00 00 6C 80 A1 80
02 01 00 02 01 16 30 14 80 07 91 68 31 28 07 10 55 AA
09 0A 01 04 04 04 04 02 80 90 00 00 00 00 00 00

Flow
2 、 PROVIDE_ROAMING_NO
>SCCP NAT 4645 004 000009 000008 09 81 03 0D 16
0A 52 07 00 11 04 68 31 09 82 F1 09 12 06 00 12 04 68 31
28 07 6B 62 80 48 04 38 01 01 8A 6B 80 28 80 06 07 00
11 86 05 01 01 01 A0 80 60 80 A1 80 06 07 04 00 00 01 00
03 02 00 00 00 00 00 00 00 00 00 00 6C 80 A1 80 02 01 04
02 01 04 302B 80 08 64 00 22 07 08 00 51 F5 81 06 91 68
31 09 82 F0 82 07 91 68 31 28 07 10 55 84 04 13 26 00 0D
A5 08 0A 01 01 04 03 04 01 A0 00 00 00 00 00 00

Flow
3 、 PROVIDE_ROAMING_NO_RSP
<SCCP NAT 4662 003 000008 000009 09 00 03 0C 16
09 12 06 00 12 04 68 31 28 07 0A 52 07 00 11 04 68 31 09
82 F1 57 64 80 49 04 38 01 01 8A 6B 80 28 80 06 07 00 11
86 05 01 01 01 A0 80 61 80 A1 80 06 07 04 00 00 01 00 03
02 00 00 A2 03 02 01 00 A3 05 A1 03 02 01 00 00 00 00 00
00 00 00 00 6C 80 A2 80 02 01 04 30 80 02 01 04 04 07 91
68 31 09 82 00 10 00 00 00 00 00 00 00 00

Flow
4 、 SEND_ROUTING_INFO_RSP
>SCCP NAT 4684 009 000009 000008 09 00 03 0D 16
0A 52 08 00 11 04 68 31 09 82 F0 09 52 06 00 12 04 68 31
28 07 63 64 80 49 04 39 01 00 38 6B 80 28 80 06 07 00 11
86 05 01 01 01 A0 80 61 80 A1 80 06 07 04 00 00 01 00 05
02 00 00 A2 03 02 01 00 A3 05 A1 03 02 01 00 00 00 00 00
00 00 00 00 6C 80 A2 80 02 01 00 30 80 02 01 16 30 13 04
08 64 00 22 07 08 00 51 F5 04 07 91 68 31 09 82 00 10 00
00 00 00 00 00 00 00

Typical Signaling Flows Analysis: Location
Update Flow
Location update message flow of the C/D interface

Update Flow
Location update message analysis of the C/D interface
1 、 SEND_AUTHENTICATION_INFO
<SCCP NAT 9100 005 000008 000009 09 81 03 0C
16 09 12 06 00 12 04 68 31 28 07 0A 12 08 00 11 04 68
31 09 82 F0 48 62 80 48 04 39 01 00 2C 6B 80 28 80
06 07 00 11 86 05 01 01 01 A0 80 60 80 A1 80 06 07 04
00 00 01 00 0E 02 00 00 00 00 00 00 00 00 00 00 6C 80
A1 80 02 01 00 02 01 38 04 08 64 00 22 07 08 00 51 F4
00 00 00 00 00 00

Update Flow
2 、 SEND_AUTHENTICATION_INFO_RSP
<SCCP NAT 9137 00d 000009 000008 09 00 03 0D 16 0A 52 08
00 11 04 68 31 09 82 F0 09 52 06 00 12 04 68 31 28 07 E1 64 80
49 04 39 01 00 2C 6B 80 28 80 06 07 00 11 86 05 01 01 01 A0
80 61 80 A1 80 06 07 04 00 00 01 00 0E 02 00 00 A2 03 02 01
00 A3 05 A1 03 02 01 00 00 00 00 00 00 00 00 00 6C 80 A2 80
02 01 00 30 80 02 01 38 30 81 90 30 22 04 10 11 11 11 11 11 11
11 11 11 11 11 11 11 11 11 11 04 04 02 02 02 02 04 08 03 03 03
03 03 03 03 03 30 22 04 10 11 11 11 11 11...

Update Flow
3 、 UPDATE_LOCATION
<SCCP NAT 9299 0006 000008 000009 09 81 03 0C 16 09 12 06

00 12 04 68 31 28 07 0A 12 08 00 11 04 68 31 09 82 F0 5A 62 80
48 04 39 01 00 2E 6B 80 28 80 06 07 00 11 86 05 01 01 01 A0
80 60 80 A1 80 06 07 04 00 00 01 00 01 02 00 00 00 00 00 00 00
00 00 00 6C 80 A1 80 02 01 00 02 01 02 30 1A 04 08 64 00 22
07 08 00 51 F4 81 06 91 68 31 09 82 F0 04 06 91 68 31 09 82 F1
00 00 00 00 00 00

Update Flow
4 、 INSERT_SUBSCRIBER_DATA
>SCCP NAT 9354 00e 000009 000008 09 00 03 0D 16 0A 52
08 00 11 04 68 31 09 82 F0 09 52 06 00 12 04 68 31 28 07 70 65
80 48 04 38 01 00 CD 49 04 39 01 00 2E 6B 80 28 80 06 07 00
11 86 05 01 01 01 A0 80 61 80 A1 80 06 07 04 00 00 01 00 01 02
00 00 A2 03 02 01 00 A3 05 A1 03 02 01 00 00 00 00 00 00 00
00 00 6C 80 A1 80 02 01 03 02 01 07 30 1E 8008 64 00 22 07 08
00 51 F4 81 07 91 68 31 28 07 10 45 82 01 01 83 01 00 A6 03 04
01 11 00 00 00 00 00 00

Update Flow
5 、 INSERT_SUBSCRIBER_DATA_ACK
<SCCP NAT 9355 007 000008 000009 09 00 03 0C
16 09 12 06 00 12 04 68 31 28 07 0A 12 08 00 11 04
68 31 09 82 F0 1B 65 　 80 48 04 39 01 00 2E 49 04
38 01 00 CD 6C 80 A2 80 02 01 03 00 00 00 00 00 00

Update Flow
6 、 UPDATE_LOCATION_ACK
>SCCP NAT 9375 000 000009 000008 09 00 03 0D
16 0A 52 08 00 11 04 68 31 09 82 F0 09 52 06 00 12 04
68 31 28 07 23 64 80 49 04 39 01 00 2E 6C 80 A2 80
02 01 00 30 80 02 01 02 04 05 91 68 31 28 07 00 00 00
00 00 00 00 00

Typical MAP Flows
Summary
According to the analysis of the call flow and the location updating
flow, it have already been known that the specific MAP service
message exists in the TCAP message in the form of component.
Generally, the message types of the MAP service correspond to
the operation codes in the TCAP message one by one.
However, during the message transfer, one message
corresponds to an invoke ID. An invoke ID is the only ID of a
message during the MAP dialogue. With the differentiation of the
invoke ID, a component can be “translated” into the
corresponding MAP service message.

5 January 2007 Internal use only
Thank You
www.huawei.com
www.huawei.com
HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential

Page 73
HUAWEI TECHNOLOGIES CO., LTD.

WPS0!01!05 SoftX3000 MAP Signaling&amp;Fault Analysis 20050524 B 1.0

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

WPS0!01!05 SoftX3000 MAP Signaling&amp;Fault Analysis 20050524 B 1.0

Uploaded by

Copyright:

Available Formats

5 January 2007 Internal use only

OWG003409 MAP Signaling

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential

Chapter 1 MAP Protocols Introduction

Chapter 2 MAP messages Introduction

Chapter 3 Typical MAP Flows Introduction

Chapter 4 MAP Fault Cases Analysis

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 2

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 3

MSC/VLR C/D HLR

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 4

1 、 MAP protocol layers

MAP Service User MAP Service User

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 5

1 、 Overview of public service primitive

Functions of Public Service Primitive  MAP Public Service Primitive

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 6

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 7

2 、 Difference in service flow operation code

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 8

2) Party B Initiates a Dialog Request by Means of Phase M:

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 9

Chapter 1 MAP Protocols Introduction

Chapter 2 MAP messages Introduction

Chapter 3 Typical MAP Flows Introduction

Chapter 4 MAP Fault Cases Analysis

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 10

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 11

１、 Basic Information Element

The Basic Information Element is called IE for short, including Tag,

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 12

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 13

Format of bit F: Referring to the form of the IE

Extend Bit LSB

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 14

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 15

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 16

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 17

The transmission of the MAP messages is based

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 18

F CK SIF LI FIB FSN BIB BSN F

Pointer of the called address

Calling party address

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 19

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 20

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 21

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 22

For the detailed protocol of the MAP message, the

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 23

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 24

MAP message analysis

118>> 30168 UDT 000000d 05FF09 03FF11 3F 3F 83 11 FF

(TCAP) 48 04 2B 81 11 00 6C 80 (Component Sublayer)

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 25

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 26

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 27

TCAP layer: transaction processing sublayer

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 28

Chapter 1 MAP Protocols Introduction

Chapter 2 MAP messages Introduction

Chapter 3 Typical MAP Flows Introduction

Chapter 4 MAP Fault Cases Analysis

HUAWEI TECHNOLOGIES Co., Ltd. HUAWEI Confidential Page 30

Location Management Service Flow

WPS0!01!05 SoftX3000 MAP Signaling&Fault Analysis 20050524 B 1.0

WPS0!01!05 SoftX3000 MAP Signaling&Fault Analysis 20050524 B 1.0