SS7

  1. Signalling system 7
    1. Service switching point (SSP)
    2. Signal transfer point (STP)
    3. Service control point (SCP)
    4. Linkset
    5. Signalling
  2. Message transfer protocol (MTP)
    1. MTP L1
    2. MTP L2
      1. FISU
      2. LSSU
      3. MSU
    3. MTP L3
      1. SMH/SNM MSU SIF
      2. SNM link management
      3. SNM route managmement
  3. Databases
    1. 800 DB
    2. Line information DB (LIDB)
    3. Local number portability DB (LNPDB)
    4. Home location register (HLR)
    5. Visitor location register (VLR)
  4. Signalling connection control part (SCCP)
    1. SCCP UDT
    2. SCCP UDTS
    3. SCCP address indicator parameter
  5. ISDN user part (ISUP)
    1. ISUP call setup & teardown
    2. ISUP user message
  6. Transaction capabilities application part (TCAP)
    1. TCAP user message

Signalling system 7

  • OOB signalling in PSTN: SSP, STP, SCP
  • point code ≈ IP address
  • homologation: certify HW and SW that connects to country’s PSTN
  • static routing, based on endpoint type and type of available links
  • address signalling
    • en-bloc: whole called number in a single message
    • overlap: > 1 message
  • message transfer point (MTP)

Service switching point (SSP)

  • end office switch: originate, terminate calls
  • circuit-switching: for voice
  • not circuit-switching: DB query with SCP (e.g., 800 number)
  • upstream: SS7
  • downstream: ISDN PRI, channel-associated switching (CAS)
  • tandem switch ≡ SSP + STP

Signal transfer point (STP)

  • always in pairs
  • signalling routing
  • traffic monitoring
  • global title translation
    • SSP may have no DPC for SCP, offloading it to STP
    • STP may return DPC and subsystem number for DB, may route to another STP
  • gateway STP
    • protocol conversion (national → ITU)
    • network interconnect
    • security (e.g., screening)

Service control point (SCP)

  • DB access for IN application, not DB itself
  • upstream: SS7
  • downstream: X.25
  • subsystem number = DB ID, unique

Linkset

  • several links to single endpoint
  • ≈ port-channel/ECMP
  • combined linkset – to mated STP with different PC

Signalling

  1. associated
    • signalling and voice path are directly connected between endpoints
  2. non-associated
    • signalling through several STP
  3. quasi-associated
    • signalling through 1 STP (endpoints – connected)

Message transfer protocol (MTP)

MTP L1

  • OSI L1
  • DS0, E1/T1, V.35

MTP L2

  • reliable P2P links
  • CRC, packet sequencing, link status monitoring
  • signal units
    • fill-in signal unit (FISU): error detection, no retransmit
    • link status signal unit (LSSU): L2 and L3 link status
    • message signal unit (MSU): transports SCCP, TUP, ISUP, TCAP

FISU

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                                +-+-+-+-+-+-+-+-+
                                                |     Flag      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Back Seq Num |B| Fwd Seq Num |F| Len Indic |Rsv|     CRC16     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Flag: 01111110, end of signal unit
Backwards sequence number (BSN): last received FSN, acknowledge reception
Forward sequence number (FSN)
F: forward indicator bit (FIB)
B: backward indicator bit (BIB)
FIB ≠ BIB ≡ retransmit request
Length indicator:

  • 0: FISU
  • 1-2: LSSU
  • 3-63: MSU

LSSU

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                |     Flag      |Back Seq Num |B| Fwd Seq Num |F|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Len Indic |Rsv|   Status field (8/16 bits)    |     CRC16     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Flag: 01111110, end of signal unit
Backwards sequence number (BSN): last received FSN, acknowledge reception
Forward sequence number (FSN)
F: forward indicator bit (FIB)
B: backward indicator bit (BIB)
FIB ≠ BIB ≡ retransmit request
Length indicator:

  • 0: FISU
  • 1-2: LSSU
  • 3-63: MSU

Status field:

  • 0x00: out of alignment ≡ link failed, alignment needed
  • 0x01: normal alignment
  • 0x02: emergency alignment
  • 0x03: out of service
    • not the processor failure
    • stop MSU, start FISU
  • 0x04: processor outage
    • processor failed ≡ no connection to upper-layer protocols
    • stop MSU, start FISU
  • 0x05: busy
    • L2 congestion
    • stop MSU, start FISU

MSU

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Flag      |Back Seq Num |B| Fwd Seq Num |F| Len Indic |Rsv|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  SI   |  SSF  |      Service information field (MTP L3)       \ 
+-+-+-+-+-+-+-+-+          (1-272 bytes)        +-+-+-+-+-+-+-+-+
\                                               |     CRC16     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Flag: 01111110, end of signal unit
Backwards sequence number (BSN): last received FSN, acknowledge reception
Forward sequence number (FSN)
F: forward indicator bit (FIB)
B: backward indicator bit (BIB)
FIB ≠ BIB ≡ retransmit request
Length indicator:

  • 0: FISU
  • 1-2: LSSU
  • 3-63: MSU

Service information (SI):

  • 0x0: SNM message
  • 0x1: maintenance regular message
  • 0x2: maintenance special message
  • 0x3: SCCP
  • 0x4: TUP
  • 0x5: ISUP
  • 0x6: data user part (DUP), circuit-based message
  • 0x7: DUP, facility message

SSF: subservice field

  • 0x0: international
  • 0x1: reserved
  • 0x2: national
  • 0x3: reserved

Service information field: ULP data, routing label, control information

MTP L3

  • in SIF MSU
  • signalling message handling (SMM) ≡ SS7 routing
  • signalling network management (SNM) ≡ reroute on failure
  • if target user is not available for processing – send User Port Unavailable (UPU) back
  • buffer exceeded → Onset of Congestion messages in SNM
  • no VOQ ⇒ all dst congested

SMH/SNM MSU SIF

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Destination point code   |   Originating code point  |  SLS  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                         User message                          /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

SLS: signalling link selector

  1. link activation
    • LSSU SLTM (signalling link test message)
    • SLTA (SLTM acknowledgement)
  2. link restoration
    • LSSU, link alignment
  3. link deactivation

SNM route managmement

  1. transfer prohibited (TFP): if route to endpoint is lost, notify directly connected nodes
  2. transfer allowed (TFA): cancel TFP
  3. transfer restricted (TFR): notify adjacent nodes to use other link, if possible
  4. transfer controlled (TFC): notify sender about congestion on adjacent node
  5. signalling route set test: ≈ ping on control plane level
  6. congestion test: update congestion status
  7. cluster router set test
  8. changeover order (COO): between signalling points, notify about link being unavailable
  9. changeover ack (COA): after switching to alternate link, retransmit lost data over FSN/BSN
  10. changeback declaration (CBD): intention to switch back over, all messages → into changeback buffer (CBB)
  11. changeback ack (CBA): after CBA is received, messages in CBB can be sent over old link again

Databases

800 DB

  • services numbers 8**, 9** – returns real number
  • 800 are not routed as global title address

Line information DB (LIDB)

  • user info: PIN, calling card (for billing)

Local number portability DB (LNPDB)

  • 10 digits location routing number (LRN) SSP, that services the number

Home location register (HLR)

  • cellular
  • current phone location, billing

Visitor location register (VLR)

  • cellular
  • info about roaming subscriber

Signalling connection control part (SCCP)

  • transport for TCAP and ISUP
  • unitdata message (UDT): query DB, DB response (via SCP)
  • unitdata service message (UDTS): error notification
  • connection-oriented (not used) and connectionless service

SCCP UDT

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                                +-+-+-+-+-+-+-+-+
                                                | Message type  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Protocol class |          Called Party Addresss (CDA)          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Calling Party Address (CGA)          |               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+               /
\                         Subsystem data                        \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Message type:

  • 0x09: UDT
  • 0x0a: UDTS

SCCP UDTS

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                                +-+-+-+-+-+-+-+-+
                                                | Message type  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Return cause  |          Called Party Addresss (CDA)          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Calling Party Address (CGA)          |               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+               /
\                         Subsystem data                        \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Message type:

  • 0x09: UDT
  • 0x0a: UDTS

SCCP address indicator parameter

   0     1     2     3     4     5     6     7
+-----+-----+-----+-----+-----+-----+-----+-----+
| PCI |SSNI |Global title indicator | RI  | Rsv |
+-----+-----+-----+-----+-----+-----+-----+-----+

PCI: point code indicator, 1 ≡ address contains signalling point code
SSNI: SSN indicator, 1 ≡ address = subsystem number
RI: raising indicator

  • 0 ≡ GTT needed
  • 1 ≡ route using SSN

ISDN user part (ISUP)

  • connect/disconnect calls
  • setup/teardown circuit
  • switch-to-switch
  • messages:
    1. initial address message (IAM): initiate call setup
    2. address completion message (ACM): notify caller about ringing
    3. answer message (ANM): notify caller about off-hook event on called
    4. call progress (CPG): ≈ ACM, strictly after ACM
    5. info request (INR): request extra info
    6. information (INF)
    7. suspend (SUS): pause call without releasing resources
    8. release (REL): end call and release resources
    9. release complete (RLC): trunk is free
    10. continuity test (COT): test trunk
    11. resume (RES): resume suspended call
    12. forward transfer (FOT)

ISUP call setup & teardown


sub1            originating         intermediate        terminating               sub2
                  switch               switch             switch
      off-hook
    ----------->             
      dial tone
    <-----------
       digits
    ----------->
                              IAM
                            ------>
                              ACM
                            <------               IAM
                                                ------>
                                                  ACM
                                                <------
                                                                                 not busy          
                              ANM                 ANM                 off-hook  
                            <------             <------            <-----------       
                                    
                                        voice
    <=========================================================================>

                                                                      on-hook
                                                                   <-----------
                                                  SUS
                              SUS               <------
                            <------
      on-hook
    ----------->              REL
                            ------>               REL
                                                ------>
                                                  RLC
                              RLC               <------
                            <------

ISUP user message

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                                +-+-+-+-+-+-+-+-+
                                                | Message type  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                             Data                              /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Message type:

  • 0x01: IAM
  • 0x03: INR
  • 0x04: INF
  • 0x05: COT
  • 0x06: ACM
  • 0x08: FOT
  • 0x09: ANM
  • 0x0c: REL
  • 0x0d: SUS
  • 0x0e: RES
  • 0x10: RLC
  • 0x2c: CPG

Transaction capabilities application part (TCAP)

  • non-circuit based messages, DB query (via SCP)
  • end-to-end

TCAP user message

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                | Message type  |  Total length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                              TLV                              /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Message type:

  • 0x61: unidirectional
  • 0x62: begin
  • 0x64: end
  • 0x65: continue
  • 0x67: abort

Total length: bytes