camel subscription information

Camel Subscription Information (CSI) In another tutorial, we have discussed the camel protocol.  The tutorial mentions introductory information about the camel subscription information(CSI) along with other protocol details. Here we will discuss in detail the structure and components of the camel subscription information. In CSI, subscription means, that a subscriber needs to have camel information in the subscriber profile on HLR or home location register.  …

Read morecamel subscription information

inap and camel protocol

INAP and CAMEL Protocol Tutorial INAP and CAMEL protocols belong to the SS7 protocol family.  These are application layer protocols. INAP is an intelligent network application protocol.  INAP is a broad term, for PSTN there are INCS1 and INCS2 standards that were developed for INAP. CAMEL protocol standard is developed for mobile networks.  Both use SS7 as base transport. Camel and INAP use the services …

Read moreinap and camel protocol

sccp address

SCCP Address  In SS7 network SCCP is the transport layer. It is the user of the MTP3 layer and service provider to the TCAP layer. MTP3 layer is the network layer that does the routing based on the ss7 point code.  SCCP does the routing on SSN and global title (GT).  Like any other protocol addressing, SCCP has a source and destination address in the …

Read moresccp address


SS7 Hack or SS7 Attack? SS7 hack or signaling system 7 hack is the process of getting calls or SMS for a subscriber, on another mobile number or in an application. These days many applications use confirmation of user identity using SMS or voice call.  If somehow call and SMS can be routed to another number then it is possible to hack. In this ss7 …

Read moreSS7 HACK

SS7 Protocol | Ss7 Protocol Tutorial

What is SS7 protocol?

SS7 protocol or signaling system 7,  is the legacy protocol used by the Traditional or legacy telephony system. SS7 standards defined by the standard body ITU-T(International Telecommunication Union Telecommunication Standardization Sector ).  E1 or T1 cables are used in ss7 for physical connections. An E1 having 32-time slots and T1 have 24-time slots, there are others as well.  The protocol is layer architecture, which follows the OSI model. The protocol layer below is the service provider, and the layer above is a service user.  SS7 trunks are setup between telephone exchange to carry ss7 signaling and voice. An ss7 trunk has multiple circuits for voice. When a call originates from a switch/exchange, an ISUP circuit is reserved from the trunk.



SS7 Trunk
SS7 Trunk

Now, these days there are other IP based telephony (VOIP) that are also very popular. VoIP is discussed in a separate post with SIP Trunking.

Ss7 protocol stack or Ss7 protocol Layers:

SS7 protocol stack or signaling system 7, have the following layers.

SS7 Protocol Stack
SS7 Protocol Stack

Message Transfer Part 1 (MTP1)

This is the physical layer of signaling system 7, which transfers bits over a physical channel. It has the physical ports to connect the wires.  A card may have its own CPU. When someone buys an SS7 card, it also comes with MTP2. 

Message Transfer Part 2( MTP2)

This is the data link layer. It transfers the error-free frames between two directly connected nodes. It maintains receiving and sending windows.

Functionalities of MTP2 layer:

Error Control checks the error in a received frame based on 16 bits CRC. Re transmits lost message or error message.
Sequencing maintains the sequencing of messages between directly connected nodes. Forward and backward sequencing numbers are maintained for sequence and retransmissions.
Link Alignment does link alignment based on the request from MTP3.
Flow control, if the receiver is slow, sending mtp2 gives an indication to its user for congestion.
Link Status, link status is given to the user, the status may be, in service, out of service or congestion.

Message Transfer Part 3(MTP3),

This is the network layer that implements mtp3 protocol. This does end to end routing of SS7 messages. This is the network layer in the ss7 protocol stack. For routing mtp3 routing, the level is defined. The routing level is defined in the MTP3 header, which contains OPC, DPC, and SLS. Mtp3 specification is given in Q.704.  DPC is the point code of destination ss7 node, OPC is the originating point code, and SLS is used for load distribution of MTP3 user messages over links.Mtp3 Routing Level

When a message is passed from MTP2 to MTP3, the routing level, SIO, and MTP3 user data is passed in the message.  MTP3 has two major functions, discrimination, and distribution. Discrimination function decides if the message is for the self node or for some other distance node. The discrimination function uses DPC.  If a message is for a self node, then it is passed to the distribution function.  The distribution function checks SI, which is part of SIO. The value of SI identifies the user of  MTP3. Eg id SI is 5, the message is delivered to the ISUP layer over MTP3, if the value of SI is 3 then the message is delivered to the SCCP layer over MTP3.

Mtp3 Layer Functions:

Remote Point code status management, mtp3 maintains the configuration and remote point code status. The status may be available or unavailable. The user of mtp3 gets pause or resume indications for a remote point code. While routing a message the status of remote point code is checked.
Link Alignment:
Once a link is configured at MTP2 and MTP3 level. MTP3 layer starts the link alignment by sending an alignment request to the MTP2 layer.  This starts link alignment at the mtp3 level. Once a link comes up on mtp2 level. Mtp3 receives an in-service indication from the MTP2 layer. MTP3 sends an SLTM message to the remote end. If SLTA received in response to SLTM then the link is marked up at mtp3 level. If the link is the first link in a link set then it’s an emergency link alignment procedure, else its normal link alignment procedure.
Transfer Prohibited (TFP): 
This is the MTP3 procedure by which a signaling point code can mark a route unavailable for a destination point code. This updates the routing table for a destination point code. When a signaling transfer point (STP), detects that a point code is not reachable. 
Load Sharing does the load sharing on over Linkset and links based on SLS received from the user.
Change Over, when a link fails the failed link’s traffic is distributed to the available links. 
Change Back, when a failed link comes back, the traffic is rerouted back to the link. 

Signaling Connection Control Part (SCCP) Protocol Layer

This is the transport layer and user of MTP3. Do the segmentation/reassembly of large messages if required. A user application is identified by an SSN (subsystem number at SCCP level). An SSN is a standard numeric value that identifies an application/node in the GSM network.

  • HLR – SSN 6
  • VLR-SSN 7
  • MSC – SSN 8
  • SGSN – SSN 149

The node on the SCCP layer is identified by a Global title. A global title is a sequence of digits, that is unique globally.  The phone number of a person is an example of a global title. SCCP layer does SSN management and global title translation.

SSN management:

SSN configured on the SCCP layer can be local or remote. Before sending a message to peer SSN, SCCP layers check the status of remote SSN, if is down message is dropped. To check the status of an SSN,  a peer transmits the SST and wait for SSA.  This procedure is optional, a remote SSN can be marked as available when peer point code comes up after successful link alignment.

Global Title Translation:

An SCCP address has called party and calling party address in the SCCP header, both addresses are global titles.  Upon receiving, SCCP checks if GT, matches the current node. If yes then the Called Party GT is translated to the point code of the current node. The message delivers to the local user identified by the called party SSN present in the incoming messages.

If a message is not of local use, the GT can be translated into another GT or PC. Or it can be forward to the next hope. If the current nodes know the point code which is serving the called party address then the gt is translated on point code else forwards to next hope.

SCCP message classes:
Class 0, connection less non sequenced message. 
Class 1, connection less sequenced delivery of messages.
Class 2, connection oriented without flow control.
Class 3, connection oriented with flow control. 

User Primitives of SCCP Layer:

A user primitive is the interface a layer provides to access its services, SCCP Provides request primitives, to request a service from layer and Indication primitives, to inform events received from the network.

Sccp Primitives (Connection Less) 
SCCP Connection Less Messages
SCCP Connection-Less Messages

Belongs to the class 0 and 1. No prior logical connection is setup. The messages are routed based on the called party address parameter. Class 0 messages are delivered not in sequence while class 1 messages delivered in sequence. ISUP and TCAP use connectionless SCCP protocol.

Data Request, this sends the user data in the SCCP protocol message. In UDT or XUDT SCCP messages, depends on the length of a user message. 
Data Indication, When a protocol data received from the network in UDT or XUDT.

Read moreSS7 Protocol | Ss7 Protocol Tutorial