Download - STIC TCAP Training
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
SS7-TCAP ParserSS7-TCAP ParserBy Amar BajracharyaBy Amar Bajracharya
[email protected]@lucent.com913-338-8922913-338-8922
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
SS7 For Wireless• Mobile Application Part• Wireless Roaming and Call Control• Wireless Intelligent Network• Service Portability• Updating Location Registers• Basic Circuit Setup
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
Wireless Architecture
HLR RF Signal
RF Signal
SS7 TIA/EIA-41
T1
T1
VLRSS7
Network
PSTN
VMS
CDMA
TDMA
AMPS
MSC
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
SS7 Protocol ArchitectureApplication
Services (eg. MAP)
ISDNUserPart
(ISUP)
Telephone User Part
(TUP)Transaction Capabilities
(TCAP)
Signaling Connection Control Part(SCCP)
Message Transfer Part(MTP)
Level 1-3
Level 4
Level 4-6
Level 7
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TIA/EIA/ANSI - 41• Defined by TIA/EIA in accordance with ANSI• Known as formerly IS-41• Independent of Air Interface(e.g. CDMA,TDMA)• Supports capabilities
– Intersystem Handoff– Supplementary call features while roaming(Service Qualification)– Intersystem operations, administration and maintenance– Location Management – Call Delivery– Basic Call Feature (CF,CW,TWC etc.)
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
MTP/SCCP Header LayoutsUnused Octet
Service Information Octet(0x83/0x93)
Destination Point Code
Originating Point Code
0 0 0 Signaling Link Selection
Message Type:UniData Message
UDS option: 0/8 Protocal Class :0
SCCP Called Party Address Pointer :3
SCCP Calling Party Address Pointer :5
Data field pointer :7
Length Indicator:2
Address type :0xc1
Subsystem Number :5
Length Indicator :2
Address Type :0xc1
Subsystem Number :5
Length Indicator
S
C
C
P
MTP
MTP+SCCP Rev. A INVOKE (21 Octets)
Unused Octet
Service Information Octet(0x83/0x93)
Destination Point Code
Originating Point Code
0 0 0 Signaling Link Selection
Message Type:UniData Message
UDS option: 0 Protocal Class :0
SCCP Called Party Address Pointer :3
SCCP Calling Party Address Pointer :5
Data field pointer :7
Length Indicator:2
Address type :0xc1
Subsystem Number :5
Length Indicator :2
Address Type :0xc1
Subsystem Number :5
Length Indicator
S
C
C
P
MTP
MTP+SCCP Rev. A RESPONSE (21 Octets)
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
MTP/SCCP Cont.Unused Octet
Service Information Octet(0x83/0x93)
Destination Point Code
Originating Point Code
0 0 0 Signaling Link Selection
Message Type:UniData Message
UDS option: 0/8 Protocal Class :0
SCCP Called Party Address Pointer :3
SCCP Calling Party Address Pointer :11
Data field pointer :16
Length Indicator:8
Address type :0x89
Subsystem Number :0
Translation Type : 3
2nd Digit NPA 1st Digit NPA
1st Digit XX 3rd Digit NPA
3rd Digit NXX 2nd Digit NXX
2nd Digit XXXX 1st Digit XXXX
4th Digit XXXX 3rd Digit XXXX
Length Indicator :5
Address Type :0xc3
Subsystem Number :6/7/8
Originating Point Code
Length Indicator
S
C
C
P
MTP
MTP+SCCP(GTT) Rev. B INVOKE (30 Octets)
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
MTP/SCCP Cont.Unused Octet
Service Information Octet(0x83/0x93)
Destination Point Code
Originating Point Code
0 0 0 Signaling Link Selection
Message Type:UniData Message
UDS option: 0/8 Protocal Class :0
SCCP Called Party Address Pointer :3
SCCP Calling Party Address Pointer :5
Data field pointer :10
Length Indicator:2
Address type :0xc1
Subsystem Number :5/6/7/8
Length Indicator :5
Address Type :0xc3
Subsystem Number :5/6/7/8
Originating Point Code
Length Indicator
S
C
C
P
MTP
MTP+SCCP(non-GTT) Rev. B INVOKE (24 Octets)
Unused Octet
Service Information Octet(0x83/0x93)
Destination Point Code
Originating Point Code
0 0 0 Signaling Link Selection
Message Type:UniData Message
UDS option: 0/8 Protocal Class :0
SCCP Called Party Address Pointer :3
SCCP Calling Party Address Pointer :5
Data field pointer :10
Length Indicator:2
Address type :0xc1
Subsystem Number :5/6/7/8
Length Indicator :5
Address Type :0xc3
Subsystem Number :5/6/7/8
Originating Point Code
Length Indicator
S
C
C
P
MTP
MTP+SCCP(non-GTT) Rev. B RESPONSE (24 Octets)
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TCAP Message Structure• Defines the overall structure that application should follow• Each application defines its own unique parameters(e.g. asking 10 people to
write one page letter)• Handle multiple tasks within the same message• Uniquely identify each message• Carry-on dialogue between applications• Vary the parameters exchanged based on the application• Consists of
– Transaction Portion(protocol control information)– Component Portion(data concerning the particular application)
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TCAP Transaction Portion• TCAP Package Type
– Unidirectional, Query with permission, Query without permission, Response, Conversation with permission, Conversation without permission, Abort
• Total TCAP Length• Transaction ID
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
Mobile Applications Part(MAP)
• MAP– Defines the protocols and procedures for communications between systems in Wireless Network
• TCAP– Defines operations between processes
• SCCP– Supports enhanced routing functions and defines mobile systems (MAP,HLR,VLR,MSC etc.)
• MTP– Provides reliable message routing and delivery
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TCAP Component Portion• One or more operations within a transaction• One or more components may present in a
single operation• Components can request action or provide a
response• Type:- Invoke, Return Result, Return Error,
Reject
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TCAP Invoke FormatPackage Type Identifier
Total TCAP Message Length
Transaction ID Identifier
Transaction ID Length
Transaction ID
Component Sequence Identifier
Component Sequence Length
Component Type Identifier
Component Length
Component ID Identifier
Component ID Length
Component ID
Operation Code Identifier
Operation Code Length = 2
Operation Code Family
Operation Code Specifier
Parameter Set Identifier
Parameter Set Length
Parameter Set
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TCAP Return Result Format
Package Type Identifier
Total TCAP Message Length
Transaction ID Identifier
Transaction ID Length
Transaction ID
Component Sequence Identifier
Component Sequence Length
Component Type Identifier
Component Length
Component ID Identifier
Component ID Length
Component ID
Parameter Set Identifier
Parameter Set Length
Parameter Set
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TCAP Return Error FormatPackage Type Identifier
Total TCAP Message Length
Transaction ID Identifier
Transaction ID Length
Transaction ID
Component Sequence Identifier
Component Sequence Length
Component Type Identifier
Component Length
Component ID Identifier
Component ID Length
Component ID
Error Code Identifier
Error Code Length
Error Code
Parameter Set Identifier
Parameter Set Length
Parameter Set
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TCAP Return Error Cont.• Unrecognized MIN (0x81)• Unrecognized ESN(0x82)• MIN/HLR Mismatch(0x83)• Operation Sequence Problem(0x84)• Resource Shortage(0x85)• Operation not Supported (0x86)• Trunk Unavailable (0x87)• Parameter Error (0x88)• System Failure (0x89)• Unrecognized Parameter Value (0x8a)• Feature Inactive (0x8b)• Missing Parameter (0x8c)
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
TCAP Reject FormatPackage Type Identifier
Total TCAP Message Length
Transaction ID Identifier
Transaction ID Length
Transaction ID
Component Sequence Identifier
Component Sequence Length
Component Type Identifier
Component Length
Component ID Identifier
Component ID Length
Component ID
Problem Code Identifier
Problem Code Length
Problem Code
Parameter Set Identifier
Parameter Set Length
Parameter Set
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
Roamer RegistrationSS7
MSC (New) VLR (New) HLR VLR (Old) MSC (Old)Registration Registration Registration Registration
CancellationCancellationNotificationNotification
Registration
Notification
Registration
Notification
Registration
Cancellation
Registration
Cancellation
Qualification
Request
Qualification
Request
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
PSTN To Mobile CallSS7
PSTN SW. MSC(HOME) HLR VLR (Visit) MSC (Visit)IAM(Initial Address) Location Request Route Request Route Request
MIN = 913 486 6146MIN = 913 486 6146DN = 913 486 6146CPID = 913 486 6146
Route Request
TLDN = 913 444 1111Route Request
TLDN = 913 444 1111Location Request
TLDN = 913 444 1111IAM(Initial Address) CPID = 913 444 1111
Address Complete
AnswerAnswer
Address Complete
Circuit Switched Connection
ReleaseRelease
Release Complete Release Complete
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
PSTN Call Delivery To VMSS7
PSTN SW. MSC(HOME) HLR VLR (Visit) MSC (Visit)IAM(Initial Address) Location Request Route Request Route Request
MIN = 913 486 6146MIN = 913 486 6146DN = 913 486 6146CPID = 913 486 6146
Route Request
TLDN = 913 444 1111Route Request
TLDN = 913 444 1111Location Request
TLDN = 913 444 1111IAM(Initial Address) CPID = 913 444 1111
Address Incomplete
Redirection Request
TTN(TransToNum) Req
TTN RR
No Answer
Redirection Request RR
Voice Mail
Call Delivery To VM
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
Decoding MTP/SCCP Header
<< OUT >> 14:31:15 SMS DEL_PP OTID=62 6 0 48OPC=214-170-003 DPC=214-170-051 CLD_SSN= 105 CLG_SSN=08 ,CLG_OPC =214-170-003 CDMASOWD2=00 0a 02 SERV_CELL=02 02 (514) SN=74 01 2d 74 MIN=9135044390 SMS_DATA=15 00 01 02 05 00 04 00 30 00 [000] 00 83 33 aa d6 03 aa d6 21 09 00 03 05 0a 02 c1 [016] 69 05 c3 08 03 aa d6 3a e2 38 c7 04 62 06 00 48 [032] e8 30 e9 2e cf 01 01 d1 02 09 35 f2 25 9f 82 5b [048] 03 00 0a 02 82 02 02 02 89 04 74 01 2d 74 88 05 [064] 19 53 40 34 09 9f 69 0a 15 00 01 02 05 00 04 00 [080] 30 00
Unused Octet
Service Information Octet(0x83/0x93)
Destination Point Code
Originating Point Code
0 0 0 Signaling Link Selection
Message Type:UniData Message
UDS option: 0/8 Protocal Class :0
SCCP Called Party Address Pointer
SCCP Calling Party Address Pointer
Data field pointer
Length Indicator
Address type
Subsystem Number
Length Indicator
Address Type
Subsystem Number
Originating Point Code
Length Indicator
S
C
C
P
MTP
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
Package Type Identifier
Total TCAP Message Length
Transaction ID Identifier
Transaction ID Length
Transaction ID
Component Sequence Identifier
Component Sequence Length
Component Type Identifier
Component Length
Component ID Identifier
Component ID Length
Component ID
Operation Code Identifier
Operation Code Length = 2
Operation Code Family
Operation Code Specifier
Parameter Set Identifier
Parameter Set Length
Parameter Set
<< OUT >> 14:31:15 SMS DEL_PP OTID=62 6 0 48
OPC=214-170-003 DPC=214-170-051 CLD_SSN= 105 CLG_SSN=08 ,
CLG_OPC =214-170-003 CDMASOWD2=00 0a 02 SERV_CELL=02 02 (514) SN=74 01 2d 74
MIN=9135044390 SMS_DATA=15 00 01 02 05 00 04 00 30 00
[000] 00 83 33 aa d6 03 aa d6 21 09 00 03 05 0a 02 c1
[016] 69 05 c3 08 03 aa d6 3a e2 38 c7 04 62 06 00 48
[032] e8 30 e9 2e cf 01 01 d1 02 09 35 f2 25 9f 82 5b
[048] 03 00 0a 02 82 02 02 02 89 04 74 01 2d 74 88 05
[064] 19 53 40 34 09 9f 69 0a 15 00 01 02 05 00 04 00
[080] 30 00
Decoding TCAP Portion
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
<< OUT >> 14:31:15 SMS DEL_PP OTID=62 6 0 48
OPC=214-170-003 DPC=214-170-051 CLD_SSN= 105 CLG_SSN=08 ,
CLG_OPC =214-170-003 CDMASOWD2=00 0a 02 SERV_CELL=02 02 (514) SN=74 01 2d 74
MIN=9135044390 SMS_DATA=15 00 01 02 05 00 04 00 30 00
[000] 00 83 33 aa d6 03 aa d6 21 09 00 03 05 0a 02 c1
[016] 69 05 c3 08 03 aa d6 3a e2 38 c7 04 62 06 00 48
[032] e8 30 e9 2e cf 01 01 d1 02 09 35 f2 25 9f 82 5b
[048] 03 00 0a 02 82 02 02 02 89 04 74 01 2d 74 88 05
[064] 19 53 40 34 09 9f 69 0a 15 00 01 02 05 00 04 00
[080] 30 00
Parameter DecompositionParameter ID Code
Length
Parameter Set/ Parameter Value
CDMA Single One Way Delay(9f 82 5b)
Serving Cell (0x82)
ESN(0x89)
MIN(0x88)
SMS Data(9f 69 0a)
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
<< IN >> 14:31:16 SMS DEL_PP_RR DTID=62 6 0 48OPC=214-170-051 DPC=214-170-003 CLD_SSN= 05 CLG_SSN=105 ,CLG_OPC =214-170-051 SN=74 01 2d 74 MIN=9135044390 MSC_ID=03 e4 01 CDMASOWD2=00 05 02 SERV_CELL=02 02 (514)[000] 00 93 03 aa d6 33 aa d6 eb 09 80 03 05 0a 02 c1 [016] 05 05 c3 69 33 aa d6 31 e4 2f c7 04 62 06 00 48 [032] e8 27 ea 25 cf 01 01 f2 20 89 04 74 01 2d 74 88 [048] 05 19 53 40 34 09 95 03 03 e4 01 9f 82 5b 06 00 [064] 05 02 38 4f 00 82 02 02 02
Return Result Decomposition
Package Type Identifier
Total TCAP Message Length
Transaction ID Identifier
Transaction ID Length
Transaction ID
Component Sequence Identifier
Component Sequence Length
Component Type Identifier
Component Length
Component ID Identifier
Component ID Length
Component ID
Parameter Set Identifier
Parameter Set Length
Parameter Set
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
<< OUT >> 17:01:17 REG NOT OTID=62 1b 1 e4OPC=214-170-003 DPC=214-171-000 CLD_SSN=00 ,CLD_TT =03 ,CLD_GT_DGTS = (9135109710)CLG_SSN=05 ,CLG_OPC =214-170-003 MIN=9135109710 SN=f1 95 00 49 QUAL_CODE=03 (VAL/PROF)SYS_TYP=03 (LUCENT) TERMTYP=20 TRANSCAP=00 60 TRIG_CAP=0f 0b 01 MSC_ID=03 e4 01 LOC_AREA=00 02 SMS_ADDR=00 00 d3 03 aa d6 08 [000] 00 83 00 ab d6 03 aa d6 68 09 00 03 0b 10 08 89 [016] 00 03 19 53 01 79 01 05 c3 05 03 aa d6 5a e2 58 [032] c7 04 62 1b 01 e4 e8 50 e9 4e cf 01 03 d1 02 09 [048] 0d f2 45 88 05 19 53 01 79 01 89 04 f1 95 00 49 [064] 91 01 03 96 01 03 9f 2f 01 20 9f 7b 02 00 60 bf [080] 82 18 11 9f 82 15 03 0f 0b 01 9f ff 22 01 03 9f [096] ff 23 01 01 95 03 03 e4 01 9f 21 02 00 02 9f 68 [112] 07 00 00 d3 03 aa d6 08
<< IN >> 17:01:18 [000] 00 83 03 aa d6 67 aa d6 de 09 00 03 05 07 02 c1 [016] 05 02 c1 06 b4 e4 81 b1 c7 04 62 1b 01 e4 e8 81 [032] a8 ea 81 a5 cf 01 03 f2 81 9f 96 01 03 8e 02 02 [048] 0c 84 06 08 00 21 04 10 77 88 05 19 53 01 79 01 [064] 95 03 03 e0 01 9f 4e 01 01 99 04 ea 5f 2c 04 9f [080] 56 06 08 00 21 04 10 77 9f 5c 02 00 00 9f 81 11 [096] 01 0c 9f 5d 09 06 00 21 0a 19 53 01 79 01 97 01 [112] 07 9f 62 04 00 00 00 00 9f 73 01 03 9f 75 01 03 [128] 98 01 02 bf 81 30 2a 9f 81 2f 02 00 0d 9f 81 2f [144] 02 00 05 9f 81 2f 02 00 0c 9f 81 2f 02 00 04 9f [160] 81 2f 02 80 00 9f 81 2f 02 00 03 9f 81 2f 02 00 [176] 01 bf 82 14 14 bf 82 16 10 9f 20 05 00 10 aa d6 [192] 0e 9f 82 1b 04 dc 01 e0 e1
Exercise
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
Tools To Capture TCAP Message• TCmon
– Run the command from RTR Shell– tcmon -X –t0 –[link#] –[port#] –DSCCP –ON –o{filename} &
• Where link# is the logical link to terminating application. –gtt for global title, -e# for PC routing• Four ports are available from –p176 to –p179• -DSCCP option for capturing SCCP header
– To view the trace online, run tail• tail –f {filename} &
– Dangerous to run for a long time – To stop : First kill the tail by
• ps –ax|grep tail• Identify your tail process• kill –9 [process id]• And, turn off the tcmon by• tcmon - –[link#] –[port#] -OFF
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
Tools To Capture TCAP Message• Uxcptrace
– Can be run from RTR Shell as well as OMP Shell– Recommended to run from OMP Shell– From OMP Shell at your home directory, type
• UXcptrace –s[#] –mXXXXXXXXXX –CPtclevel # -ON –on –r –OMP– Where –s[#] is the port number, 1-14 ports are available to use.– -mXXXXXXXXXX is the MIN#, Instead of MIN, MDN can be used – dXXXXXXXXXX– -CPtclevel # can be 1 or 2. CPtclevel 1 captures the TCAP operation code only. CPtclevel 2 will capture op. code as
well as parameters.– -OMP should be placed at the end of the command
– Then, type• UXprint –c –r >{filename} &
– If don’t need to direct to the file, the filename does not need to be specified
• tail –f {filename} &– To turn off:
• kill –9 [Uxprint’s process ID]• UXcptrace –s[#] -zap
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
UXcptrace TCAP Message Example
[CDN 2]: T01:TC1:TCAP Sent PkgType e2 OpCode 2f to pcrid 1523 15:55:24.395
[CDN 2]: T01:TC1: MSID 9135a99775 MSID15 f00000000000003dc9c41 ESN 01303b8c
[CDN 2]: T01:TC2: 00000000 00000000 02950000 0000009b
[CDN 2]: T01:TC2: 0093c4aa d601aad6 00090003 050a02c1
[CDN 2]: T01:TC2: 0e05c307 01aad683 e28180c7 04620600
[CDN 2]: T01:TC2: aae878e9 76cf0106 d102092f f26d9503
[CDN 2]: T01:TC2: 03e70188 05195390 79578904 9f56a488
[CDN 2]: T01:TC2: 810703e7 0102d095 009f6204 00000000
[CDN 2]: T01:TC2: 9f7b0208 6b9f2102 10018409 0100210a
[CDN 2]: T01:TC2: 19839563 89820201 019f5d09 0000210a
[CDN 2]: T01:TC2: 19539079 579f5009 0200210a 19539079
[CDN 2]: T01:TC2: 579f8217 0101bf82 18119f82 15030f0b
[CDN 2]: T01:TC2: 019fff22 01039fff 23010130 39169f5d
[CDN 2]: T01:TC1:TCAP Rcvd PkgType e4 OpCode 2f from pcrid 1523 15:55:25.195
[CDN 2]: T01:TC1: MSID 9135a99775 MSID15 f00000000000005f3 ESN 01303ae0
[CDN 2]: T01:TC2: 00000000 05f30000 028d0000 00d20026
[CDN 2]: T01:TC2: 009301aa d610aad6 1d090003 050702c1
[CDN 2]: T01:TC2: 0702c10e 11e40fc7 04620600 aae807ea
[CDN 2]: T01:TC2: 05cf0106 f2000000 91385936 00010000
[CDN 2]: CP1 ECID ab8 rcvd TCAP RSP OpCode 2f Type 1 Waiting 0
Operation Code(Invoke 2f-ORREQ)
Message Block
Operation Code(Return Result(e4) 2f- ORREQ)
Lucent TechnologiesBell Labs Innovations
SS7-TCAPSS7-TCAP
GlossaryCDMA - Code Division Multiple Access TUP – Telephone User PartEIA - Electrical Industry Association VLR – Visiting Location RegisterESN – Electronic Serial NumberGTT – Global Title TranslationHLR – Home Location RegisterISUP – ISDN User PartMAP – Mobile Application PartMIN – Mobile Identification NumberMSC – Mobile Switching CenterMTP – Message Transfer PartOMP – Operation and Maintenance PlatformSCCP - Signaling Channel Connection PartSS7 – Signaling System 7TCAP - Transaction Capabilities Application Part TDMA – Time Division Multiple Access TIA - Telecommunications Industry Association TLDN – Temporary Local Dialing NumberTTN – Transfer To Number