Voice calls, from 2G circuit to VoLTE and VoNR

Voice is the oldest mobile service and the one that changed the most under the hood. The user still dials a number and hears ringing — but the machinery moved from circuits (a dedicated line for the whole call) to packets (voice cut into small IP packets, like data).

Two worlds of voice

Why it matters: SS7 still carries the call logic in 2G/3G, SIP carries it in 4G/5G, and the interconnect between operators is often still ISUP over TDM or SIGTRAN. So you must know both worlds.

1. A classic CS call (2G/3G) step by step

Mobile-originated (MO) call: 1. Phone asks the radio network for a channel (RACH → SDCCH in 2G; RRC connection in 3G). 2. Phone sends CM Service Request + SETUP (dialled number) to the MSC. 3. MSC checks the VLR (is the subscriber allowed? barred? enough credit via CAMEL?). 4. MSC analyses the number. If it is another operator's number it routes onward using ISUP IAM (Initial Address Message). 5. Far end answers with ACM (ringing) then ANM (answered). Billing starts at ANM. 6. Either side hangs up → REL (release) → RLC (release complete). The cause code (Q.850) explains why.

Mobile-terminated (MT) call — finding the called phone:

This is why roaming is a signalling story: every roamed MT call needs SRI + PRN across the world, and why SRI is abused to locate subscribers.

Voice codecs you will see

Transcoding (converting between codecs) costs quality and money. TrFO (Transcoder-Free Operation) and TFO try to avoid it.

2. Why VoLTE exists

4G LTE is all-IP — it has no circuit-switched domain at all. So to make a call you either: 1. Fall back to 2G/3G for the call (CSFB, Circuit-Switched Fallback), or 2. Carry the call as IP packets inside LTE (VoLTE).

3. IMS — the IP Multimedia Subsystem

IMS is the "telephone company in software": a set of SIP servers that does what MSC + HLR + SMSC did, using IP.

VoLTE call — the shape of it

1. Attach to LTE; the network creates the default bearer (QCI 9, internet) and a second default bearer for IMS signalling (QCI 5, APN ims).
2. Phone does IMS registration: SIP REGISTER → P-CSCF → I-CSCF → S-CSCF (with HSS authentication, "IMS AKA").
3. To call: phone sends SIP INVITE (with SDP listing codecs and the IP/port for audio).
4. Far end answers 180 Ringing → 200 OK → phone sends ACK. Audio flows as RTP packets.
5. The P-CSCF asks the PCRF (Rx interface, Diameter) for QoS; the PCRF/PGW sets up a dedicated bearer, QCI 1 (guaranteed bit rate, low delay) for the audio.
6. BYE ends the call.

RTP / RTCP carry audio and its quality statistics; SDP describes codecs and ports; QCI 1 gives voice priority; QCI 5 is for IMS signalling; QCI 9 is default internet.

4. Calls between networks (interconnect)

• PSTN / TDM interconnect — ISUP circuits (E1/T1) between exchanges; still common.
• SIP trunk — the same call as SIP over IP between SBCs.
• IPX — the IP Packet eXchange: a managed, private IP network between operators that carries SIP, Diameter, GTP, SMPP, etc. with quality guarantees.
• Wholesale / carriers — A-party operator → one or more transit carriers → B-party operator. Each hop takes a margin. CLI (Calling Line Identification) spoofing and grey routes (cheap, unauthorised paths) happen here.
• Number portability — a ported number must be looked up (MNP, via ENUM/HLR lookup/central database) before routing, or the call goes to the old operator. In SS7 this is an MNP-SRF doing a relay; in IP, ENUM/NP-DB.

Anti-spoofing: STIR/SHAKEN

A system for signing caller ID in SIP calls (US/Canada; similar efforts in other countries). STIR = Secure Telephony Identity Revisited; SHAKEN = Signature-based Handling of Asserted information using toKENs. The originating network signs the call with a certificate; the terminating network verifies it and can label or block spoofed calls.

5. Charging — who pays for a call

TAP = Transferred Account Procedure (visited operator bills home operator for roaming usage). RAP = Returned Account Procedure (returns errors). BCE / NRTRDE = near-real-time roaming data exchange for fraud detection.

6. Common call problems and what they mean

Remember this: 2G/3G voice = SS7 + circuits. 4G/5G voice = SIP over IMS + a QoS bearer. CSFB / SRVCC / EPS fallback exist because networks and phones don't all support the new way at once. Whatever the generation, the question is always the same: find the subscriber, route the call, charge for it.