STIC TCAP Training

Lucent TechnologiesBell Labs Innovations

SS7-TCAPSS7-TCAP

SS7-TCAP ParserSS7-TCAP ParserBy Amar BajracharyaBy Amar Bajracharya

[email protected]@lucent.com913-338-8922913-338-8922


SS7-TCAPSS7-TCAP

SS7 For Wireless• Mobile Application Part• Wireless Roaming and Call Control• Wireless Intelligent Network• Service Portability• Updating Location Registers• Basic Circuit Setup


SS7-TCAPSS7-TCAP

Wireless Architecture

HLR RF Signal

RF Signal

SS7 TIA/EIA-41

T1

T1

VLRSS7

Network

PSTN

VMS

CDMA

TDMA

AMPS

MSC


SS7-TCAPSS7-TCAP

SS7 Protocol ArchitectureApplication

Services (eg. MAP)

ISDNUserPart

(ISUP)

Telephone User Part

(TUP)Transaction Capabilities

(TCAP)

Signaling Connection Control Part(SCCP)

Message Transfer Part(MTP)

Level 1-3

Level 4

Level 4-6

Level 7


SS7-TCAPSS7-TCAP

TIA/EIA/ANSI - 41• Defined by TIA/EIA in accordance with ANSI• Known as formerly IS-41• Independent of Air Interface(e.g. CDMA,TDMA)• Supports capabilities

– Intersystem Handoff– Supplementary call features while roaming(Service Qualification)– Intersystem operations, administration and maintenance– Location Management – Call Delivery– Basic Call Feature (CF,CW,TWC etc.)


SS7-TCAPSS7-TCAP

MTP/SCCP Header LayoutsUnused Octet

Service Information Octet(0x83/0x93)

Destination Point Code

Originating Point Code

0 0 0 Signaling Link Selection

Message Type:UniData Message

UDS option: 0/8 Protocal Class :0

SCCP Called Party Address Pointer :3

SCCP Calling Party Address Pointer :5

Data field pointer :7

Length Indicator:2

Address type :0xc1

Subsystem Number :5

Length Indicator :2

Address Type :0xc1

Subsystem Number :5

Length Indicator

S

C

C

P

MTP

MTP+SCCP Rev. A INVOKE (21 Octets)

Unused Octet






UDS option: 0 Protocal Class :0




Length Indicator:2

Address type :0xc1

Subsystem Number :5

Length Indicator :2

Address Type :0xc1

Subsystem Number :5

Length Indicator

S

C

C

P

MTP

MTP+SCCP Rev. A RESPONSE (21 Octets)


SS7-TCAPSS7-TCAP

MTP/SCCP Cont.Unused Octet










Length Indicator:8

Address type :0x89

Subsystem Number :0

Translation Type : 3

2nd Digit NPA 1st Digit NPA

1st Digit XX 3rd Digit NPA

3rd Digit NXX 2nd Digit NXX

2nd Digit XXXX 1st Digit XXXX

4th Digit XXXX 3rd Digit XXXX

Length Indicator :5

Address Type :0xc3

Subsystem Number :6/7/8


Length Indicator

S

C

C

P

MTP

MTP+SCCP(GTT) Rev. B INVOKE (30 Octets)


SS7-TCAPSS7-TCAP

MTP/SCCP Cont.Unused Octet










Length Indicator:2

Address type :0xc1

Subsystem Number :5/6/7/8

Length Indicator :5

Address Type :0xc3



Length Indicator

S

C

C

P

MTP

MTP+SCCP(non-GTT) Rev. B INVOKE (24 Octets)

Unused Octet










Length Indicator:2

Address type :0xc1


Length Indicator :5

Address Type :0xc3



Length Indicator

S

C

C

P

MTP

MTP+SCCP(non-GTT) Rev. B RESPONSE (24 Octets)


SS7-TCAPSS7-TCAP

TCAP Message Structure• Defines the overall structure that application should follow• Each application defines its own unique parameters(e.g. asking 10 people to

write one page letter)• Handle multiple tasks within the same message• Uniquely identify each message• Carry-on dialogue between applications• Vary the parameters exchanged based on the application• Consists of

– Transaction Portion(protocol control information)– Component Portion(data concerning the particular application)


SS7-TCAPSS7-TCAP

TCAP Transaction Portion• TCAP Package Type

– Unidirectional, Query with permission, Query without permission, Response, Conversation with permission, Conversation without permission, Abort

• Total TCAP Length• Transaction ID


SS7-TCAPSS7-TCAP

Mobile Applications Part(MAP)

• MAP– Defines the protocols and procedures for communications between systems in Wireless Network

• TCAP– Defines operations between processes

• SCCP– Supports enhanced routing functions and defines mobile systems (MAP,HLR,VLR,MSC etc.)

• MTP– Provides reliable message routing and delivery


SS7-TCAPSS7-TCAP

TCAP Component Portion• One or more operations within a transaction• One or more components may present in a

single operation• Components can request action or provide a

response• Type:- Invoke, Return Result, Return Error,

Reject


SS7-TCAPSS7-TCAP

TCAP Invoke FormatPackage Type Identifier

Total TCAP Message Length

Transaction ID Identifier

Transaction ID Length

Transaction ID

Component Sequence Identifier

Component Sequence Length

Component Type Identifier

Component Length

Component ID Identifier

Component ID Length

Component ID

Operation Code Identifier

Operation Code Length = 2

Operation Code Family

Operation Code Specifier

Parameter Set Identifier

Parameter Set Length

Parameter Set


SS7-TCAPSS7-TCAP

TCAP Return Result Format

Package Type Identifier




Transaction ID




Component Length


Component ID Length

Component ID



Parameter Set


SS7-TCAPSS7-TCAP

TCAP Return Error FormatPackage Type Identifier




Transaction ID




Component Length


Component ID Length

Component ID

Error Code Identifier

Error Code Length

Error Code



Parameter Set


SS7-TCAPSS7-TCAP

TCAP Return Error Cont.• Unrecognized MIN (0x81)• Unrecognized ESN(0x82)• MIN/HLR Mismatch(0x83)• Operation Sequence Problem(0x84)• Resource Shortage(0x85)• Operation not Supported (0x86)• Trunk Unavailable (0x87)• Parameter Error (0x88)• System Failure (0x89)• Unrecognized Parameter Value (0x8a)• Feature Inactive (0x8b)• Missing Parameter (0x8c)


SS7-TCAPSS7-TCAP

TCAP Reject FormatPackage Type Identifier




Transaction ID




Component Length


Component ID Length

Component ID

Problem Code Identifier

Problem Code Length

Problem Code



Parameter Set


SS7-TCAPSS7-TCAP

Roamer RegistrationSS7

MSC (New) VLR (New) HLR VLR (Old) MSC (Old)Registration Registration Registration Registration

CancellationCancellationNotificationNotification

Registration

Notification

Registration

Notification

Registration

Cancellation

Registration

Cancellation

Qualification

Request

Qualification

Request


SS7-TCAPSS7-TCAP

PSTN To Mobile CallSS7

PSTN SW. MSC(HOME) HLR VLR (Visit) MSC (Visit)IAM(Initial Address) Location Request Route Request Route Request

MIN = 913 486 6146MIN = 913 486 6146DN = 913 486 6146CPID = 913 486 6146

Route Request

TLDN = 913 444 1111Route Request

TLDN = 913 444 1111Location Request

TLDN = 913 444 1111IAM(Initial Address) CPID = 913 444 1111

Address Complete

AnswerAnswer

Address Complete

Circuit Switched Connection

ReleaseRelease

Release Complete Release Complete


SS7-TCAPSS7-TCAP

PSTN Call Delivery To VMSS7

PSTN SW. MSC(HOME) HLR VLR (Visit) MSC (Visit)IAM(Initial Address) Location Request Route Request Route Request

MIN = 913 486 6146MIN = 913 486 6146DN = 913 486 6146CPID = 913 486 6146

Route Request

TLDN = 913 444 1111Route Request

TLDN = 913 444 1111Location Request

TLDN = 913 444 1111IAM(Initial Address) CPID = 913 444 1111

Address Incomplete

Redirection Request

TTN(TransToNum) Req

TTN RR

No Answer

Redirection Request RR

Voice Mail

Call Delivery To VM


SS7-TCAPSS7-TCAP

Decoding MTP/SCCP Header

<< OUT >> 14:31:15 SMS DEL_PP OTID=62 6 0 48OPC=214-170-003 DPC=214-170-051 CLD_SSN= 105 CLG_SSN=08 ,CLG_OPC =214-170-003 CDMASOWD2=00 0a 02 SERV_CELL=02 02 (514) SN=74 01 2d 74 MIN=9135044390 SMS_DATA=15 00 01 02 05 00 04 00 30 00 [000] 00 83 33 aa d6 03 aa d6 21 09 00 03 05 0a 02 c1 [016] 69 05 c3 08 03 aa d6 3a e2 38 c7 04 62 06 00 48 [032] e8 30 e9 2e cf 01 01 d1 02 09 35 f2 25 9f 82 5b [048] 03 00 0a 02 82 02 02 02 89 04 74 01 2d 74 88 05 [064] 19 53 40 34 09 9f 69 0a 15 00 01 02 05 00 04 00 [080] 30 00

Unused Octet







SCCP Called Party Address Pointer

SCCP Calling Party Address Pointer

Data field pointer

Length Indicator

Address type

Subsystem Number

Length Indicator

Address Type

Subsystem Number


Length Indicator

S

C

C

P

MTP


SS7-TCAPSS7-TCAP





Transaction ID




Component Length


Component ID Length

Component ID

Operation Code Identifier

Operation Code Length = 2

Operation Code Family

Operation Code Specifier



Parameter Set

<< OUT >> 14:31:15 SMS DEL_PP OTID=62 6 0 48

OPC=214-170-003 DPC=214-170-051 CLD_SSN= 105 CLG_SSN=08 ,

CLG_OPC =214-170-003 CDMASOWD2=00 0a 02 SERV_CELL=02 02 (514) SN=74 01 2d 74

MIN=9135044390 SMS_DATA=15 00 01 02 05 00 04 00 30 00

[000] 00 83 33 aa d6 03 aa d6 21 09 00 03 05 0a 02 c1

[016] 69 05 c3 08 03 aa d6 3a e2 38 c7 04 62 06 00 48

[032] e8 30 e9 2e cf 01 01 d1 02 09 35 f2 25 9f 82 5b

[048] 03 00 0a 02 82 02 02 02 89 04 74 01 2d 74 88 05

[064] 19 53 40 34 09 9f 69 0a 15 00 01 02 05 00 04 00

[080] 30 00

Decoding TCAP Portion


SS7-TCAPSS7-TCAP

<< OUT >> 14:31:15 SMS DEL_PP OTID=62 6 0 48

OPC=214-170-003 DPC=214-170-051 CLD_SSN= 105 CLG_SSN=08 ,

CLG_OPC =214-170-003 CDMASOWD2=00 0a 02 SERV_CELL=02 02 (514) SN=74 01 2d 74

MIN=9135044390 SMS_DATA=15 00 01 02 05 00 04 00 30 00

[000] 00 83 33 aa d6 03 aa d6 21 09 00 03 05 0a 02 c1

[016] 69 05 c3 08 03 aa d6 3a e2 38 c7 04 62 06 00 48

[032] e8 30 e9 2e cf 01 01 d1 02 09 35 f2 25 9f 82 5b

[048] 03 00 0a 02 82 02 02 02 89 04 74 01 2d 74 88 05

[064] 19 53 40 34 09 9f 69 0a 15 00 01 02 05 00 04 00

[080] 30 00

Parameter DecompositionParameter ID Code

Length

Parameter Set/ Parameter Value

CDMA Single One Way Delay(9f 82 5b)

Serving Cell (0x82)

ESN(0x89)

MIN(0x88)

SMS Data(9f 69 0a)


SS7-TCAPSS7-TCAP

<< IN >> 14:31:16 SMS DEL_PP_RR DTID=62 6 0 48OPC=214-170-051 DPC=214-170-003 CLD_SSN= 05 CLG_SSN=105 ,CLG_OPC =214-170-051 SN=74 01 2d 74 MIN=9135044390 MSC_ID=03 e4 01 CDMASOWD2=00 05 02 SERV_CELL=02 02 (514)[000] 00 93 03 aa d6 33 aa d6 eb 09 80 03 05 0a 02 c1 [016] 05 05 c3 69 33 aa d6 31 e4 2f c7 04 62 06 00 48 [032] e8 27 ea 25 cf 01 01 f2 20 89 04 74 01 2d 74 88 [048] 05 19 53 40 34 09 95 03 03 e4 01 9f 82 5b 06 00 [064] 05 02 38 4f 00 82 02 02 02

Return Result Decomposition





Transaction ID




Component Length


Component ID Length

Component ID



Parameter Set


SS7-TCAPSS7-TCAP

<< OUT >> 17:01:17 REG NOT OTID=62 1b 1 e4OPC=214-170-003 DPC=214-171-000 CLD_SSN=00 ,CLD_TT =03 ,CLD_GT_DGTS = (9135109710)CLG_SSN=05 ,CLG_OPC =214-170-003 MIN=9135109710 SN=f1 95 00 49 QUAL_CODE=03 (VAL/PROF)SYS_TYP=03 (LUCENT) TERMTYP=20 TRANSCAP=00 60 TRIG_CAP=0f 0b 01 MSC_ID=03 e4 01 LOC_AREA=00 02 SMS_ADDR=00 00 d3 03 aa d6 08 [000] 00 83 00 ab d6 03 aa d6 68 09 00 03 0b 10 08 89 [016] 00 03 19 53 01 79 01 05 c3 05 03 aa d6 5a e2 58 [032] c7 04 62 1b 01 e4 e8 50 e9 4e cf 01 03 d1 02 09 [048] 0d f2 45 88 05 19 53 01 79 01 89 04 f1 95 00 49 [064] 91 01 03 96 01 03 9f 2f 01 20 9f 7b 02 00 60 bf [080] 82 18 11 9f 82 15 03 0f 0b 01 9f ff 22 01 03 9f [096] ff 23 01 01 95 03 03 e4 01 9f 21 02 00 02 9f 68 [112] 07 00 00 d3 03 aa d6 08

<< IN >> 17:01:18 [000] 00 83 03 aa d6 67 aa d6 de 09 00 03 05 07 02 c1 [016] 05 02 c1 06 b4 e4 81 b1 c7 04 62 1b 01 e4 e8 81 [032] a8 ea 81 a5 cf 01 03 f2 81 9f 96 01 03 8e 02 02 [048] 0c 84 06 08 00 21 04 10 77 88 05 19 53 01 79 01 [064] 95 03 03 e0 01 9f 4e 01 01 99 04 ea 5f 2c 04 9f [080] 56 06 08 00 21 04 10 77 9f 5c 02 00 00 9f 81 11 [096] 01 0c 9f 5d 09 06 00 21 0a 19 53 01 79 01 97 01 [112] 07 9f 62 04 00 00 00 00 9f 73 01 03 9f 75 01 03 [128] 98 01 02 bf 81 30 2a 9f 81 2f 02 00 0d 9f 81 2f [144] 02 00 05 9f 81 2f 02 00 0c 9f 81 2f 02 00 04 9f [160] 81 2f 02 80 00 9f 81 2f 02 00 03 9f 81 2f 02 00 [176] 01 bf 82 14 14 bf 82 16 10 9f 20 05 00 10 aa d6 [192] 0e 9f 82 1b 04 dc 01 e0 e1

Exercise


SS7-TCAPSS7-TCAP

Tools To Capture TCAP Message• TCmon

– Run the command from RTR Shell– tcmon -X –t0 –[link#] –[port#] –DSCCP –ON –o{filename} &

• Where link# is the logical link to terminating application. –gtt for global title, -e# for PC routing• Four ports are available from –p176 to –p179• -DSCCP option for capturing SCCP header

– To view the trace online, run tail• tail –f {filename} &

– Dangerous to run for a long time – To stop : First kill the tail by

• ps –ax|grep tail• Identify your tail process• kill –9 [process id]• And, turn off the tcmon by• tcmon - –[link#] –[port#] -OFF


SS7-TCAPSS7-TCAP

Tools To Capture TCAP Message• Uxcptrace

– Can be run from RTR Shell as well as OMP Shell– Recommended to run from OMP Shell– From OMP Shell at your home directory, type

• UXcptrace –s[#] –mXXXXXXXXXX –CPtclevel # -ON –on –r –OMP– Where –s[#] is the port number, 1-14 ports are available to use.– -mXXXXXXXXXX is the MIN#, Instead of MIN, MDN can be used – dXXXXXXXXXX– -CPtclevel # can be 1 or 2. CPtclevel 1 captures the TCAP operation code only. CPtclevel 2 will capture op. code as

well as parameters.– -OMP should be placed at the end of the command

– Then, type• UXprint –c –r >{filename} &

– If don’t need to direct to the file, the filename does not need to be specified

• tail –f {filename} &– To turn off:

• kill –9 [Uxprint’s process ID]• UXcptrace –s[#] -zap


SS7-TCAPSS7-TCAP

UXcptrace TCAP Message Example

[CDN 2]: T01:TC1:TCAP Sent PkgType e2 OpCode 2f to pcrid 1523 15:55:24.395

[CDN 2]: T01:TC1: MSID 9135a99775 MSID15 f00000000000003dc9c41 ESN 01303b8c

[CDN 2]: T01:TC2: 00000000 00000000 02950000 0000009b

[CDN 2]: T01:TC2: 0093c4aa d601aad6 00090003 050a02c1

[CDN 2]: T01:TC2: 0e05c307 01aad683 e28180c7 04620600

[CDN 2]: T01:TC2: aae878e9 76cf0106 d102092f f26d9503

[CDN 2]: T01:TC2: 03e70188 05195390 79578904 9f56a488

[CDN 2]: T01:TC2: 810703e7 0102d095 009f6204 00000000

[CDN 2]: T01:TC2: 9f7b0208 6b9f2102 10018409 0100210a

[CDN 2]: T01:TC2: 19839563 89820201 019f5d09 0000210a

[CDN 2]: T01:TC2: 19539079 579f5009 0200210a 19539079

[CDN 2]: T01:TC2: 579f8217 0101bf82 18119f82 15030f0b

[CDN 2]: T01:TC2: 019fff22 01039fff 23010130 39169f5d

[CDN 2]: T01:TC1:TCAP Rcvd PkgType e4 OpCode 2f from pcrid 1523 15:55:25.195

[CDN 2]: T01:TC1: MSID 9135a99775 MSID15 f00000000000005f3 ESN 01303ae0

[CDN 2]: T01:TC2: 00000000 05f30000 028d0000 00d20026

[CDN 2]: T01:TC2: 009301aa d610aad6 1d090003 050702c1

[CDN 2]: T01:TC2: 0702c10e 11e40fc7 04620600 aae807ea

[CDN 2]: T01:TC2: 05cf0106 f2000000 91385936 00010000

[CDN 2]: CP1 ECID ab8 rcvd TCAP RSP OpCode 2f Type 1 Waiting 0

Operation Code(Invoke 2f-ORREQ)

Message Block

Operation Code(Return Result(e4) 2f- ORREQ)


SS7-TCAPSS7-TCAP

GlossaryCDMA - Code Division Multiple Access TUP – Telephone User PartEIA - Electrical Industry Association VLR – Visiting Location RegisterESN – Electronic Serial NumberGTT – Global Title TranslationHLR – Home Location RegisterISUP – ISDN User PartMAP – Mobile Application PartMIN – Mobile Identification NumberMSC – Mobile Switching CenterMTP – Message Transfer PartOMP – Operation and Maintenance PlatformSCCP - Signaling Channel Connection PartSS7 – Signaling System 7TCAP - Transaction Capabilities Application Part TDMA – Time Division Multiple Access TIA - Telecommunications Industry Association TLDN – Temporary Local Dialing NumberTTN – Transfer To Number

Documents

STIC TCAP Training