Chapter 2: ISDN and SS7

2.1 Signaling Systems

2.1.1 History of ISDN and SS7
Over the last 125 years, the telephone service providers have used many different types

of Signaling Systems to administer phone calls in various ways. This includes setting up

and removing each call from the telephone network. It also includes routing each call

from its origin to its destination. The term PSTN (Public Switched Telephone Network)

describes a shared system used by all telephone service providers throughout the U.S.

Telephone systems were originally set up to handle only voice traffic though analog

networks. Using T1s to time division multiplex (TDM) calls provided more efficient

utilization of each physical connection. In 1984 the telephone service providers started

using a system called ISDN (Integrated Services Digital Network) to administer calls

from private business locations having CPE (Customer Premise Equipment).

2.1.2 “In-band” and “out-of-band”.

ISDN systems are physically “in-band” and logically “out-of-band”. This means that

the same physical wires are used to multiplex both the voice traffic and the data traffic

required to administer the system. “Out-of-band” means that various increments of time

are dedicated for signaling and are not available for voice traffic.

Beginning in 1980, and by the end of 1999, almost all telephone service providers in the

United States implemented a signaling system called SS7 to administer the PSTN. Today

most telephone systems throughout the world use some version of SS7. In contrast with

ISDN, SS7 is both physically “out-of-band” and logically “out-of-band”.

Copyright © Keely Communications 2006. All rights reserved. Page 1 of 16

Chapter 2: ISDN and SS7
2.1.3 “Setting up” and “Tearing Down” Calls
“Physically Out-of Band” means that the network that “sets up” and “tears down” the

phone calls is totally separate from the network that provides the actual voice traffic.

“Setting up” a call means that a customer decides to make a call, dials the call and

is connected to the number he/she wanted to call. “Tearing down” the call means that

the call has ended and one party hangs up, making the trunk (telephone circuit)

available for another call.

2.2 Using the OSI Model For SS7

The functions of ISDN and SS7 follow the guidelines provided by the OSI

(Open Systems Interconnection) model. The OSI model has seven layers. ISDN uses

layers 1-3 of the OSI model and SS7 uses layers 1-7.

2.2.1 The Basic OSI Model

The OSI model is a general guideline for protocols between computer systems. The

“layers” of the OSI model are the following:

1. Physical
2. Data Link
3. Network
4. Transport
5. Session
6. Presentation
7. Application/ User processes.

One of the OSI guidelines is that communication “communication” between layers takes
place only through adjacent layers. For example communication between Layer 1
(Physical) and Layer 3 (Network) can only happen by going through Layer 2 (Data Link).

Copyright © Keely Communications 2006. All rights reserved. Page 2 of 16

Chapter 2: ISDN and SS7

2.2.2 OSI Compared to SS7

Figure 2-1 is an adaptation of the OSI model that is designed specifically for telephone

networks. Layers 1 and 2 for OSI and SS7 are very much alike, but the upper layers have

substantial differences. One difference is that SS7 “allows” Level 7 (ISUP) to

communicate directly with Layers 3, 4, 5, and 6.

Level 6, OAM Level 7, ISUP

Level 5, TCAP

Level 4, SCCP

MPT Level 3, Routing

MPT Level 2, Error Correction

MPT Level 1, Physical Layer

Figure 2-1 SS7 Levels

OAM (Operations, administration, management), TCAP (Transactions capabilities application part
SCCP (Signaling connection control part), MTP (Message transfer part), ISUP (ISDN user part)

2.2.2.1 MPT Level 1, 2 and 3

1. The first layer is called the “physical layer” and is also called “MTP 1”. This layer
includes the physical hardware as well as the T1 multiplexing method.

2. The second layer, “MTP 2”, provides error checking. It consists of three types of
message units: MSU (Message Signaling Unit), LSSU (Link Status Signaling Unit),
and FISU (Fill-In Signaling Unit). The MSU carries signals to level MTP 3, and
other upper layers. The LSSU message is used to connect and disconnect links. In an
operational network, these messages can indicate serious problems. FISU’s occupy
the link when there is no traffic. Using the analogy of a railroad train, the physical
layer would be the railroad track. A FISU would be like an empty railroad car. More
details about MPT 2 are provided in Section 2.5.1.

Copyright © Keely Communications 2006. All rights reserved. Page 3 of 16

Chapter 2: ISDN and SS7
3. The third layer, MTP 3, is involved in routing signaling messages. Key information
in this layer is the OPC (origination point code) and the DPC (destination point
code). This corresponds to identifying the switch closest to the person making the call
(OPC) and person receiving the call (DPC).

4. The fourth layer, SCCP, provides a variety of translating functions. One type of
translation would be converting “800 prefix” numbers to standard area codes. SCCP
is actually only part of the path for gathering information from databases. Chapter 4
will cover two types of SCCPs, called “Connectionless” and “Connection
Oriented”. The whole notion of “which protocol is on which layer” is somewhat
subjective. In Section 1.3.2 that (for the purposes of all of the lab experiments
described in this book) the “correct layer” will be defined as “that seen on the
K15”. The K15 shows both the SCCP and the ISUP to be on the 3rd Level.

5. The fifth layer, TCAP, provides a method for different telephone service providers to
communicate with each other. Wireline service providers use only TCAP. Wireless
service use TCAP, in addition to another protocol call “MAP” (Mobile Application
Part). In Lab Experiment #4, TCAP and MAP protocols will displayed by the
K15 on Level 4 (Compared to Level 5 in Figure 2-1).

6. The sixth layer, OAM, provides various tests to make sure that the PSTN network is
operating correctly. This book will not cover OAM protocols.

7. The seventh layer, ISUP, communicates directly with MTP 3, SCCP, TCAP, and
OAM. It is the primary “user interface” for studying SS7 messages related to “setting
up” and “tearing down” phone calls. There are 59 types of ISUP messages, but we
will discuss only the following 5 types: IAM, ANM, ACM, REL, and RLC. The other
52 ISUPs are listed in Appendix B.

(i) IAM (Initial Address Message). This message starts the call, namely a user has
dialed a number.

(ii) ACM (Address Complete Message). This indicates that the called party has been
found, and that the phone is ringing.

(iii) ANM (Answer Message). This shows that the called party (or answering
machine) has picked up the phone.

(iv) REL (Release Message). This occurs when either the calling or called party
hangs up the phone.

(v) RLC (Release Complete Message). This acknowledges the REL message and
makes the voice trunk available for another call.

Copyright © Keely Communications 2006. All rights reserved. Page 4 of 16

Chapter 2: ISDN and SS7
2.3 Using a Protocol Analyzer
A typical telephone network will receive thousands of signaling messages per second.

Technicians use instruments called “Protocol Analyzers” to sort though these messages

to find “a needle in a haystack” that can identify a problem. The figure titled

“Figure 2-2” is a display from a Tektronix K15 protocol analyzer.

2.3.1 The Pipeline

Figure 2-2 shows one of many types of “Pipelines” that the K15 can display. This

pipeline elements. Other types of pipelines are used to capture messages available at a

switch. For the lab experiments included with this text, however, the only available

pipeline has only three elements: “Recording File”, “Filter”, and “Monitor”.

Pipeline

“Short View”
Columns

“Frame
View”

“Packet
View”
Figure 2-2. Tektronix K15 Protocol Analyzer Display

Copyright © Keely Communications 2006. All rights reserved. Page 5 of 16

Chapter 2: ISDN and SS7
2.3.2 The “Short View”
The “Short View” displays the following information in each column:

#1: Column Title = “No”: The number of the message received. Figure 2-2 shows
message # 1709 through # 1729. The data file used for Experiment #1 (A-Link) in
the lab manual contains about 168,000 messages, sent during an 8-minute period.
This is a typical message rate. The data file used for Experiment #3 (Ater Link) in
the lab manual contains more than 880,000 messages

#2: Column Title = “Short Time”: The time the message was recorded. Using the first
two columns you can see that about 21 messages were being received every three
seconds on just the one monitored link. Another column heading, called “Long Time”
can be chosen for any lab experiment. This would display time to the nearest
microsecond.

#3: Column Title = “3. Prot”: The SS7 layer 3 protocol. On the A-Link these are either
“SCCP” or “ISUP”. Note that, on page 3 of this book, SCCP is said to be on the 4th
layer and ISUP on the 7th layer. The K15 shows both the SCCP and the ISUP to be on
the 3rd layer. The whole notion of “which protocol is on which layer” is somewhat
subjective. For the purposes of all of the lab experiments described in this book
the “correct layer” will be defined as “that seen on the K15”.

#4: Column Title = “3. Msg”: The type of ISUP (or SCCP) message. There are 59 types
of ISUP messages, as stated on page 3 of this book. There are 18 types of SCCP
messages.

#5: Column Title = “OPC”: The OPC (Origination Point Code). This identifies the
switch closest to the person making the call.

#6: Column Title = “DPC”: The DPC (Destination Point Code). This identifies the
switch closest to the called party.

#7: Column Title = “CIC”: The CIC (circuit identification code). This is the trunk
identifier.

#8: Column Title = “Calling Addsig”: This is the phone number for the person placing
the call.

#9: Column Title = “Called Addsig”: This is the phone number for the person receiving
the call. Note the database used for the Lab Experiments has been altered to remove
all of the calling and called phone numbers.

#10: Column Title = “REL cause”. There are 35 different reasons for releasing a call.
The most common reason is “normal clearing” which means that one party hangs

Copyright © Keely Communications 2006. All rights reserved. Page 6 of 16

Chapter 2: ISDN and SS7
up the phone. A detailed description of all 35 release messages is included as
“Appendix A” of this book. The information can be found within a very long
document provided by “Bellcore”, a United States organization that keeps
standardization documents for SS7.

There are more than 40 choices for column headings available for the “Short View”.

Additional column heading can be found the in “Frame View” and appended to the

“Short View”.

2.3.3 The “Frame View”

Each message in the “Short View” has a corresponding text in the “Frame View”. This

text includes all of the “1s” and “0s” involved in the message. The shortest message is a

“FISU” that is always 6 Bytes long. The “MSU” has a variable length that can be as long

as 273 Bytes. The Frame View also has many “Comments” and “Values”. The Frame

View will be discussed further in Chapter Section 2.5.

2.3.4 The “Packet View”

Figure 2-2 shows a third view at the bottom of this display. One function of this view is

to convert the Frame View text into a “hex” form in order to assist software developers.

Additional information provided in the packet view will be used during the Lab

Experiments.

Copyright © Keely Communications 2006. All rights reserved. Page 7 of 16

Chapter 2: ISDN and SS7
2.4 Applying Filters
2.4.1 Setting Protocols and Messages

Clicking on the “Filter Icon” within the “Pipeline” shown in Figure 2-2 brings up the
display shown in Figure 2-3.

Figure 2-3. Applying Filters

Copyright © Keely Communications 2006. All rights reserved. Page 8 of 16

Chapter 2: ISDN and SS7
2.4.2 Setting Cause Indicators and Cause Values

By selecting “ISUP” and the “REL” message we can see nothing but “Release
Messages”. By selecting “Cause Indicators”, “Cause Values” and “Temporary Failure”,
the display shown in Figure 2-4 can be displayed.

Figure 2-4. Result of Applying The “Temporary Failure” Filter

2.4.3 Computing Lost Revenue

Figure 2-4 shows that 23 calls could not be completed during a 6 minute period because

Of “Temporary Failure”. That’s 230 per hour, or 5,520 per day, or more than 2,000,000

lost calls per year!

At 11.6 cents per call, that’s a “lost revenue” of about $232,000 a year -- from just one
MSC!

Note that Lab Experiment #1 is very similar to the example shown in Figure 2-4.

Copyright © Keely Communications 2006. All rights reserved. Page 9 of 16

Chapter 2: ISDN and SS7

2.4.4. Timers Related to “Temporary Failure”.

When the switch sends an IAM it starts a timer called the TIAM timer, which is usually

set to count down from ten seconds to zero. If it reaches zero, it will result in a release

message with a cause value of "Temp Fail". So, what is really expected is for the

distant end to return an ACM or REL message within these 10 seconds. What kind of

release messages may be expected ? User Busy, Unassigned Number, Number Changed,

Misdialed Trunk Prefix, etc. The TACM timer has a similar function. When the destination

switch begins ringing the called party, it sends an ACM message and starts a TACM

timer, that is usually set to count down from sixty seconds. With the "ringing" set to

"ring" for one second and "pause" for four seconds, a "ring period" is five seconds

long. In the sixty seconds of the timer, the called party's telephone will have been rung 12

times. If they haven't answered after that many rings, they probably aren't home, or don't

want to be disturbed. So if the timer reaches zero, the switch releases all of the equipment

that was being used for this call (RF channel, terrestrial channel, CIC, ringing generator,

etc.) so it is available for other customers. It also returns a REL message with a cause

value "User Not Responding". When this is received at the originating office, it will

remove the ring-back tone and place a recording on the line that says something like,

"The party you are trying to reach is currently unavailable. Please try again later."

Copyright © Keely Communications 2006. All rights reserved. Page 10 of 16

Chapter 2: ISDN and SS7
2.4.5. Other “Bad Release Causes”

Seven “Bad Release Causes” other than “Temporary Failure” are identified in Figure 2-5.

Figure 2-5. “Bad Release Causes” other than “Temporary Failure”

Experiment #1 involves counting the number of each type and calculating the lost

revenue. Whenever a network needs to be evaluated the first step is to compare

measurements to any previously recorded “baseline data”. Problems should be

prioritized, based upon the lost revenue and the cost involved in repairing the problem.

Additional data usually will be needed in order to “solve” each problem.

Copyright © Keely Communications 2006. All rights reserved. Page 11 of 16

Chapter 2: ISDN and SS7

2.4.5. The Complete Tektronix K15 Protocol Analyzer

The complete Protocol Analyzer is shown in Figure 2-6. It weighs 11.8 kilograms and has

the following dimensions:

Height: 340 mm
Width: 365 mm
Depth: 227 mm

Figure 2-6. The Tektronix K15 Protocol Analyzer

Copyright © Keely Communications 2006. All rights reserved. Page 12 of 16

Chapter 2: ISDN and SS7

2.5. More About the Frame View

2.5.1 MPT Level 2

Level 2 messages, introduced in Section 2.2.2.1 will be covered in more detail, in order to

show some of the information available in the Frame View. The three MPT 2 messages

are:

1. FISU (Fill-In Signaling Unit). This is always 6 bytes long. The components are
shown in Figure 2-7. A typical network will normally process about 800 per second.
The K15 protocol analyzer is usually set up avoid displaying these messages because
they have limited value for troubleshooting a network. The components of a FISU
are:
a. CRC (Cyclic Redundancy Check). Used for error checking
b. LI (Length Indicator)
c. FSN (Forward Sequence Number)
d. BSN (Backward Sequence Number)
e. FLAG. This shows the beginning of a new sequence number.

2. LSSU (Link Status Signaling Unit). This is always seven or eight bytes long. A
typical network will normally process about 2 per minute. Compared to the FISU, the
added element is the SIO (Service Indicator Octet)

3. MSU (Message Signaling Unit). These have variable lengths and can be as long as
273 bytes. A typical network will normally process about 40 per second. The MSU
includes “Address” (also called “Routing”) information as well as “Message Data.
Figures 2-8 and 2-9 every “1” and “0” for an IAM message, which is one of the
longer versions of an MSU.

Copyright © Keely Communications 2006. All rights reserved. Page 13 of 16

Chapter 2: ISDN and SS7

Signaling Units
Header

C C F B F
L L
FISU R R S S
I A
C C N N
G
0

Header

C C S F B F
L L
LSSU R R I S S
I A
C C O N N
G
1

MSU

Message Data Address Header

C C F B F
SCCP, ISUP, MAP, DTAP,DPC, OPC, CIC, L L
R R S S
BSSAP, TCAP, INAP, etc.SLS, SLR, DLR I A
C C N N
G
>2
Variable Length up to 273 Bytes
3

Figure 2-7. MPT 2 Signaling Units

Copyright © Keely Communications 2006. All rights reserved. Page 14 of 16

Chapter 2: ISDN and SS7

2.5.2 Frame View for an IAM Message

Figures 2-8 and 2-9 show the an entire IAM (every one and zero) under the

column titled “BITMASK”. The corresponding ID names are shown in the

next column. Many “Comments and Values” are shown in that column.

Figure 2-8. Frame View for an IAM Message

Copyright © Keely Communications 2006. All rights reserved. Page 15 of 16

 Chapter 2: ISDN and SS7
2.5.3 Frame View for an IAM Message, Scrolled to the End
Some of the Lab experiments use the following added features of the Frame

View:

1. Some of the frame view comments can be “appended” to become a Short View
Column heading.

2. A cause value found in the Frame View can be used as a “short cut” for setting up the
filter to find other times that cause value occurred.

Figure 2-9. Frame View for an IAM Message, Scrolled to the End

Copyright © Keely Communications 2006. All rights reserved. Page 16 of 16