SS7 deep dive (fields and protocols)

SS7 in three ideas

1. Out-of-band — signalling runs on its own network, separate from voice and data.
2. Still everywhere — underpins 2G/3G cores and international interconnects.
3. Below SMPP — SMPP faces applications; SS7 MAP moves SMS between networks.

The nodes (signalling points)

Every node is a Signalling Point (SP), addressed by a numeric Point Code (PC). STPs are installed in pairs for redundancy — signalling must never stop.

The protocol stack (bottom-up)

ISUP runs straight on MTP3; MAP and CAP go through SCCP and TCAP. The "letter" analogy: MAP/ISUP = the letter, TCAP = the conversation (matches answers to questions), SCCP = the address on the envelope (works across countries), MTP3 = local delivery, MTP1–2 = the truck.

MTP1 / MTP2 — one reliable link

• MTP1 = the physical link: a 64 kbps timeslot on an E1/T1 trunk (or IP via SIGTRAN).
• MTP2 = correct, in-order delivery over that one link. Three signal units:
• FISU — fill-in, keeps the link alive when idle.
• LSSU — link status (alignment, congestion).
• MSU — message signal unit, carries the real payload.
• Each has FSN/BSN (sequence + acknowledgement) and a CRC. Alignment/proving checks the error rate before a link goes into service.
• MTP2 is a bit like TCP, but only between two neighbouring nodes (each link starts over).

MTP3 — routing label and network management

The routing label (ITU-T): - DPC (Destination Point Code, 14 bits) — where the message goes. - OPC (Originating Point Code, 14 bits) — who sent it. - SLS (Signalling Link Selection, 4 bits) — picks one link, so one transaction keeps one path and one order. - SIO / Service Indicator — which user part: 0 = network management, 3 = SCCP, 5 = ISUP.

When links fail, MTP3 reroutes on its own (signalling network management): | Procedure | Trigger | Effect | |---|---|---| | Changeover | Link fails | Traffic moves to another link in the linkset | | Changeback | Link recovers | Traffic moves back once stable | | Forced rerouting | Route unavailable | Switch to an alternate route at once | | Controlled rerouting | Preferred route back | Migrate gradually, no missequencing | | Traffic flow control | Congestion | Upstream nodes throttle traffic |

Load sharing relies on the SLS: same value → same path → same order.

SCCP — Global Titles and subsystems

SCCP adds global addressing on top of MTP3. - Protocol classes: connectionless (class 0/1 — most MAP traffic; UDT for one transaction, XUDT for segmented large payloads) and connection-oriented (class 2/3 — CR/CC/CREF to set up, DT for data, RLSD to release). - Addressing: Global Title (GT) = a logical address (e.g. an MSISDN) + SSN (Subsystem Number) = which application (HLR, VLR, SMSC…). An STP translates GT → DPC + SSN (Global Title Translation, GTT), so no node needs to know every HLR in the world.

Inside a Global Title: | Field | Meaning | |---|---| | GTI | Which GT fields are present | | TT | Translation type — which table to use | | NP | Numbering plan: E.164 (MSISDN), E.212 (IMSI) | | NAI | International, national or subscriber number | | Digits | The address itself (e.g. the MSISDN) |

Common SSNs: 6 = HLR, 7 = VLR, 8 = MSC/SMSC.

TCAP — the RPC layer for MAP and CAP

• Packages: Unidirectional · Begin · Continue · End · Abort (a dialogue).
• Invoke ID matches each answer to its request.
• Application context (ACN) agrees the MAP/CAP version.
• Components: | Component | Type | Meaning | |---|---|---| | Invoke | Request | Run an operation (opcode inside) | | Return Result | Success | Final or partial answer | | Return Error | App failure | MAP/CAP error code inside | | Reject | Protocol failure | Malformed or unsupported |

MAP — the operations that move SMS and mobility

Other everyday MAP questions: SRI (for a call, returns an MSRN), provideRoamingNumber, sendAuthenticationInfo, cancelLocation, sendIMSI, registerSS (e.g. call forwarding), processUnstructuredSS-Request (USSD).

Mobile-terminated SMS via SS7 (the typical flow)

1. submit_sm — ESME → SMSC over SMPP.
2. SRI-SM — SMSC asks the HLR where the subscriber is.
3. mt-ForwardSM — to the serving MSC, then the handset.
4. Delivery receipt — back to the ESME as deliver_sm.

Stuck between submit_sm_resp and the DLR? Look at the SS7 hops in the middle first.

ISUP — voice call control (one CIC per circuit)

IAM (numbers + CIC) → ACM (ringing) → ANM (answered) → REL (hang-up + cause) → RLC (circuit freed). Q.850 causes: 16 normal · 17 busy · 18 no answer · 34 no circuit · 38 network down.

CAP / CAMEL — prepaid logic mid-call (phases 1–4)

1. InitialDP — the switch pauses the call and asks the SCP.
2. Report and charge — RRBE and ApplyCharging track answer, disconnect and balance.
3. Decide — Continue, Connect elsewhere, or ReleaseCall when credit runs out.

SIGTRAN — SS7 over IP

SCTP was chosen to mirror the redundancy of the old TDM network. Old vs new: MTP1→IP, MTP2→SCTP, MTP3→M3UA — and everything above (SCCP, TCAP, MAP) stays exactly the same.

One message through all the layers (example trace)

A single SRI-SM from SMSC to HLR, over an old E1 link:

Frame 1   SMSC → STP
├─ MTP1   E1 line, timeslot 16, 64 kbit/s          ◄ changes on every link (physical; not shown in a real trace)
├─ MTP2   MSU   FSN: 45   BSN: 12   CRC: OK          ◄ changes on every link
├─ MTP3   SI: SCCP(3)  OPC: 2-110-4  DPC: 2-110-1  SLS: 5   ◄ changes at every STP
├─ SCCP   Called: GT 385957381945  SSN 6 (HLR)  route on GT   ◄ same SMSC→HLR
│         Calling: GT 385980000101  SSN 8 (SMSC)
├─ TCAP   Begin   Originating Transaction ID: 0x1A2B3C4D       ◄ same SMSC→HLR
└─ MAP    sendRoutingInfoForSM   MSISDN: 385957381945          ◄ same SMSC→HLR

Over IP the bottom three become IP / SCTP / M3UA; everything from SCCP up is identical. GT stays the same end to end; the point code changes at every STP.

Security: no authentication — anyone with access can ask

Troubleshooting first checks

Remember this (Module 4): MTP moves messages between point codes; SCCP adds Global Titles (routed by STPs via GTT); TCAP carries MAP/CAP dialogues (Invoke ID + ACN). An SMS = SRI-SM + mt-ForwardSM. ISUP controls calls (CIC + Q.850). CAP does prepaid. SIGTRAN carries all of it over IP (M3UA/SCTP). No built-in authentication → filtering and firewalls are essential.