Call Tracing





 



AUTHORS Subha Narasimhan [email protected] Dama Prem Kumar [email protected]

ABSTRACT Call tracing is very useful for offline analysis of the messages exchanged between various network elements during a call. This can be used in functional testing of network elements. This paper gives details on how a call can be traced from source to destination in GSM network. This can be considered as a base for doing the same feature in next generation mobile networks.

WHITE PAPER

CALL TRACE IN GSM

  !#"%$ & The mobile telecommunications industry has experienced unprecedented growth over the last ten to twenty years. The popularity and use of mobile telephones will undoubtedly increase in the future with this kink of rapid growth. The following diagram gives the basic mobile system in GSM. Home Location Register (HLR)

Visitor Location Register (VLR)

Air Interface (Um)

C Interface

B Interface

Abis Interface A Interface

Mobile Switching Centre (MSC) F Interface

Base Station Controller (BSC) Air Interface (Um)

Equipment Identity Register (EIR) Abis Interface

Standardized Interface

Operation and Maintenance Centre (OMC)

Non-Standardized Interface

Following are the components of the GSM network ° ° °

°

2

The Mobile Phone or Mobile Station, that is carried by the subscriber. The Base Transceiver Station (BTS) which sends or receives signals from/to Mobile Station. The Base Station Controller (BSC) which allocates resources to mobile and controls BTS. BSC and BTS together are called Base Station Subsystem (BSS). Mobile Switching Center (MSC) which switch the calls from one network to other network. It accesses the databases Home Location Register (HLR), Visitor Location Register (VLR) and Equipment Identity Register (EIR), to switch the calls. All the databases and MSC forms Network Subsystem (NSS). Operations and Maintenance Center, which oversees the proper operation and setup of the network.

 Wipro Technologies

WHITE PAPER

CALL TRACE IN GSM

Following are the interfaces between various network elements. ° ° ° ° ° ° °

The mobile station and the BSS communicate across the Um interface, also known as air interface or radio link. BTS communicates with BSC across Abis interface BSC communicates with MSC across A interface MSC communicates with VLR across B interface MSC communicates with HLR across C interface MSC communicates with EIR across F interface The interface between OMC and other network elements is not standardized

' ( )+*,-*.0/1/2,43658715:9;9 <>=@? ACBEDFHGJILKNMOQPRP A call can be either mobile originated call (MOC) or mobile terminated call (MTC). Mobile originating means the subscriber is making a call from mobile. Mobile terminated call means the subscriber is receiving a call. Only the trigger for the initiation of the mobile to establish the connection with BTS is different in MOC and MTC. The progress of the call from initiation is same in both the cases. 2.1.1 Mobile originated call To make a call, radio resources are required. When the subscriber tries to make a call, the mobile tries to acquire random access channel (RACH) using which it can request network to allocate resources. It sends CHAN_REQ message to BTS, through RACH. This message is received by BTS and it passes this information to BSC, through the message CHAN_RQD. On receiving this message, BSC allocates dedicated channel for this mobile and sends the message CH_ACT to BTS, which instructs BTS to activate the channel specified in the message for this mobile. BTS activates the channel and send CH_ACT_ACK message to BSC. BSC then sends IMM_ASS_CMD to the mobile on the access grant channel (AGCH), indicating that it has assigned a dedicated channel. This message contains the channel details to which the mobile should tune. Thus the dedicated channel is assigned to mobile and it starts using it. Once the dedicated channel is assigned, BSC starts establishing a connection with the MSC. The transport mechanism defined to carry signaling information between BSS and MSC is SS7 stack (MTP and SCCP layers). BSS initiates a SCCP connection by sending Connection Request (CR) message with Layer 3 information indicating the need of SCCP connection. The MSC confirms the connection by sending Connection Confirm (CC) message to BSC. Then on the messages get exchanged between BSC and MSC using the SCCP connection. After the completion of authentication and ciphering procedure, BSC allocates traffic channel to Mobile using DATA_REQ(Assignment_cmd). It also activates the traffic channel using CH_ACT message. Then on the mobile uses this traffic channel for the call. If the mobile is trying to make a call with a mobile which is under the control of other MSC, or if it is other network, then MSC-MSC interaction is possible. For this interaction MSCs uses ISUP (Integrated Services Digital Network user Part). The ISDN User Part makes use of SCCP and MTP of SS7. ISUP setup, manage and release trunk circuits that carry voice and data between terminating line exchanges. ISUP is used for both ISDN and non-ISDN calls. However the calls that originate and terminate at the same switch do not use ISUP signaling. So, here if the mobile tries to reach a subscriber under the control of other MSC or if it is in different network, the originating MSC transmits ISUP Initial Address Message (IAM) to reserve a idle trunk circuit from the originating switch to the destination switch. The destination MSC then

3

 Wipro Technologies

WHITE PAPER

CALL TRACE IN GSM

finds out the location of called party by accessing HLR/VLR using Mobile Application Protocol (MAP) messages. Once it has located the called party, it rings the called party and transmits an ISUP Address Complete (ACM) message to the originating MSC. When the called party picks up the phone, the destination MSC terminates the ringing tone and transmits ISUP Answer Message (ANM) to the originating MSC. From then on the call proceeds. When the calling party hangs-up first, mobile sends Disconnect message to BSC. On receiving this MSC initiates the release by sending Release message to BSC. BSC sends this message to BTS and this is forwarded to the mobile station. The mobile station deallocates the radio resources. Then the MSC sends an ISUP Release message (REL) to release the trunk circuit between the two MSCs. On receiving REL, destination MSC disconnects the trunk from called party’s line and sends ISUP Release Complete (RLC) message to the originating MSC. Thus ISUP connection is terminated. Now MSC starts terminating the radio resources and the SCCP connections. It then sends SCCP Released (RLSD) to disconnect the SCCP connection. BSC replies with SCCP Release Complete (RLC) message. Thus SCCP connection is terminated for this mobile. BSC then sends RF_CH_REL message to BTS instructing BTS to release the channel associated with the mobile. The BTS acknowledges by sending RF_CH_REL_ACK message. Now all the resources allocated to the mobile will be de-allocated. 2.1.2 Mobile terminated call Here the mobile is receiving call from other mobile or other land line connection. When a mobile gets a call, the network pages the mobile indicating it to establish a radio link through the message UDT(PAGING). On receiving this message, mobile initiates CCCH connection by sending CHAN_REQ. Rest is same as in Mobile Originated call.

S>T;S

UVHW0XY[ZE\^]

When the subscriber is moving away from the BTS/BSC while making a call, then the signal strength is weakened due to which the call may be dropped. To avoid this, when the signal strength is weakened the call is handed over to adjacent BTS/BSC towards which the mobile is moving and for which the signal strengths is more. Thus handover is transferring the control on a mobile from one network element to other network element. Following are various types of handover. 1. Intra cell handover, which involves in changing the channel or time slot of the channel that is assigned to the mobile. 2. Intra BSC handover, which involves in handing over the call to other cell, with in the scope of BSC. 3. Inter BSC, Intra MSC handover, which involves in handing over the call to other BSC with in the scope of MSC 4. Inter MSC handover, which involves in handing over the call to other MSC.

_>`;a

bcCdefhgRcCikjmlneofhgpiEq

Geographically the network service area is divided into cells. More than one cell forms a Location Area (LA). More than one LA forms a MSC/VLR area. Thus the MSC will control all the subscribers present in the LA at particular point of time. Before an MS can make or receive calls it must register with the network by performing a function known as a Location Update (LU). With this, the network can keep track of he location of MSs in the network service area. To achieve this, each MS whenever it crosses the location area, will periodically perform LU procedure. The resultant location information is stored in HLR and VLR, which will be accessed by MSC to switch the call to the mobile.

4

 Wipro Technologies

WHITE PAPER

CALL TRACE IN GSM

rs tvuww x0yz{ uw!z|}Ey1x What is a connection? Connection is a group of messages sent on a particular logical channel in an interface. The starting and ending messages of a connection are well defined. The type of connection depends on the type of logical channel. For example on Abis interface following type of connections are possible. ° CCCH - Common Control Channel ° SDCCH - Stand alone Dedicated Control Channel ° TCH - Traffic Channel The establishment of CCCH connection starts with CHAN_RQD message and ends with IMM_ASS_CMD message. IMM_ASS_CMD message contains Request reference number and TDMA value. This set of parameter is unique for a call. CHAN_RQD message also contains these two parameters. So the CCCH connection can be traced by using these two parameters. The establishment of SDCCH and TCH starts with CH_ACT message and ends with RF_CH_REL_ACK message. All the messages that forms the part of the SDCCH/TCH connection will have logical channel number. Using this all the messages that forms the part of the connection can be traced. Similarly on A interface following type of connection is possible ° SCCP - Signaling Connection Control Part The establishment of SCCP connection starts with the message CR (sent by BSC or MSC) and ends with RLC (sent by BSC or MSC). Every message of an SCCP connection has a connection reference numbers called DLR (Destination Local Reference) or SLR (Source Local Reference) or both. This set of number is unique for a SCCP connection. Thus using this an SCCP connection can be traced. On E interface, that is the interface between 2 MSCs, following connection is possible ° ISUP - Integrated Services Digital Network User Part The establishment of ISUP connection starts with IAM message and ends with RLC message. All ISUP messages that belong to a single connection can be identified using the unique number CIC. CIC (Circuit Identification Code) indicates the trunk circuit reserved by the originating switch to carry the call. On B, C and F interface following connections are possible ° MAP - Mobile Application Part MAP is application layer protocol defined by GSM to manage the interfaces between different network elements in NSS. MAP uses the services of TCAP, MTP and SCCP. MAP connection starts with Begin message and ends with End message. A MAP connection in an interface can be identified using Originating ID and Destination ID parameters. This set will be unique for a given MAP connection. While tracing a connection, care should be taken that the messages are exchanged between the same network elements.

5

 Wipro Technologies

WHITE PAPER

CALL TRACE IN GSM

~ €vE‚ ‚Hƒ„E…1† What is call tracing? Identification of all connections that forms the part of a call is called call trace. Connection trace is easy, as the start and end messages are defined and also it spans in only one interface. But call trace spans across all interfaces. So complexity is involved in finding out the link between the connections of different interfaces. In order to trace a call from end to end we should first know how to group all the messages belonging to a particular call, because many subscribers will be making/receiving calls. Also, location updation procedure by mobile might also go on parallel. So tracing a call becomes complex in these situations. Based on certain parameters between the messages across different interfaces, a call can be traced from end to end. The following section describes how the tracing of a call can be done.

‡>ˆ@‰

Š‹ŒH1Ž’‘”“Ep0•–‹’‘”‘—ŒH˜—Œ^1Ž ™oš4>0ŒQ™›ŽRšQEœJš[‘N2™oHžRž

This section gives the details of how to identify different connections that form a part of a call. We will see how this can be done in each interface. 4.1.1 Abis Interface CCCH connection and SDCCH connection in Abis interface can be mapped using IMM_ASS_CMD message in CCCH connection and CH_ACT message in SDCCH connection. Both these messages will have the same channel number, if they form the part of same call. Thus CCCH and SDCCH connection can be traced. Similarly a TCH connection and an SDCCH connection can be traced using DATA_REQ(Assignment_cmd) message in SDCCH connection and CH_ACT message in TCH connection. Both these messages will have the same logical channel number. Following figures gives the mapping of CCCH with SDCCH and SDCCH with TCH connections respectively in Abis interface. BTS

BSC CHAN_RQD

Request Reference number, TDMA

Channel Number

CH_ACT Channel Number CH_ACT_ACK Channel Number IMM_ASS_CMD

Request Reference number, TDMA

6

Channel Number

 Wipro Technologies

WHITE PAPER

CALL TRACE IN GSM BSC

BTS CH_ACT Channel Number DATA_REQ (Assignment_cmd) Channel Number Channel description CH_ACT_ACK

Channel Number RF_CH_REL RF_CH_REL_ACK Channel Number RF_CH_REL Channel Number RF_CH_REL_ACK Channel Number

4.1.2

A Interface

A Call can have more than one SCCP connection if there is a handover. When there is a Handover of the call from one channel to other channel, a new SCCP connection is formed. The new SCCP connection for a handover is requested through CR(HO_REQ), from MSC to BCE, which is the reason for the connection request. The response for this message is a Connection Confirm message, CC(HO_REQ_ACK(Handover_Cmd)) from BCE to MSC. This triggers a DT1(HO_CMD(Handover_Cmd)) from this MSC. Both the messages contain the same COM L3 Info with identical values for channel description and handover request. Thus with these two messages the old and the new SCCP connections can be linked. Following figure indicates the mapping between two SCCP connections. BSC1

MSC

BSC2

CR (Layer 3 info) SLR CC DLR, SLR

DT1(HO_RQD) CR(HO_REQ) DLR

SLR

DT1(HO_CMD(Handover_cmd)) DLR Handover reference Channel number

CC(HO_REQ_ACK(Handover_Cmd)) DLR, SLR Handover reference Channel number

RLSD DLR, SLR RLC DLR, SLR

7

 Wipro Technologies

WHITE PAPER

CALL TRACE IN GSM

4.1.3 ISUP Interface In case of ISUP, there can be only one connection that is possible in a call. messages in ISUP is as shown. MSC1

The flow of

MSC2 IAM CIC = 5 ACM CIC = 5 ANM CIC = 5

• • REL

CIC = 5 RLC CIC = 5

4.1.4 MAP Interface A map call consists of many connections. Each map connection begins with a Begin message and ends with an End message. In between Begin and the End message, Continue messages can also be encountered. Each message has an Originating ID or a Destination ID or both. Some messages of map connection have IMSI/TMSI, Roaming number, and Called party number. Two map connections can be mapped with IMSI or TMSI or called party number. HLR

VLR1

Begin(UpdateLocationArg)

OrigID=F3

IMSI/TMSI

Continue(InsertSubscriberdata)

OrigID=FA, DestnID=F3

VLR2 Begin(SendParametersArg)

IMSI/TMSI

OrigID= 4D

End(SendParametersRes)

DestnID=4D

Continue(InsertSubscriberdata)

OrigID=FA, DestnID=F3

. . . End(UpdateLocationRes)

DestnID=F3

8

 Wipro Technologies

WHITE PAPER

Ÿ> ;¡

CALL TRACE IN GSM

¢¤£H¥¥C¦¨§0©–ª[«N£Q¬R¬4­oªC§0§0®H­°¯¦RªQ§0±²£H­o³—ªQ±o±J£H¬¨¬Q¦R§1¯®H³”«—£H­o®H±

In previous sections, we saw how different connections in the same interface being mapped. Now we will see how to map all the connections across all the interfaces. If this mapping is done, then end to end call can be traced. 4.2.1

Mapping from Abis to A interface and vice versa

The message in A interface that is used to link Abis messages are CR(COM L3 INFO). Just before this message, in Abis message, there is a message EST_IND(COM L3 INFO). The IMSI, TMSI or IMEI that is present in both the messages should be same. If that is case, the both these messages form a part of the call. Once a link message is got in other interface, then tracing the call in that interface is easy. (As explained in above sections). If there is a handover, the messages in A interface that are used to link Abis interface are DT1(HO_CMD(Handover_Cmd)) and CC(HO_REQ_ACK(Handover_Cmd)). Both the messages have Handover Reference and the new channel description, which is given to the Abis link. This information is present in the messages CH_ACT and DATA_REQ(Handover_command) of Abis interface. Through this link, the A and Abis interface messages can be linked. The following figure gives the above mentioned mapping:

BTS

BSC1

MSC

BSC2

. . EST_IND (Layer 3 info) CR (Layer 3 info) Channel number

IMSI/TMSI/IMEI

IMSI/TMSI/IMEI

. .

SLR

. . DT1(HO_RQD) CR(HO_REQ)

DLR SLR

CC(HO_REQ_ACK(Handover_ cmd)) DT1(HO_CMD(Handover_ cmd)) DATA_REQ(HO_CMD)

Channel number

9

Handover reference, Channel description

Handover reference, Channel description

DLR

Handover reference, Channel description

DLR

 Wipro Technologies

WHITE PAPER

4.2.2

CALL TRACE IN GSM

Mapping from A to ISUP interface

The link between A and ISUP interface is the Called Party Number or the Calling Party Number. The message IAM in ISUP interface is having Called Party Number as a Mandatory parameter and the Calling Party Number as the optional parameter. The message DT1(Set_up) in A interface is having Called Party Number as the Mandatory Parameter when it is a MOC. When it is a MTC, the DT1(Set_up) is having a Calling Party Number as the optional parameter. Thus using this, A and ISUP interface can be linked. BSC

MSC1

MSC2

. . CR(COM_L3_INFO(Paging _Respsonse)) SLR

CC

DLR,SLR DT1(Set_up) IAM DLR

Calling party Number CIC

. .

Calling party Number, Called party Number

4.2.3 Mapping of MAP interface with other interfaces. Following are the links from the MAP interface to other interfaces. 1. On A interface ° °

DT1 (Set-up) is an entry point, whose ISDN called party number matches with the MSISDN of the MAP call. “CR(COM_L3_INFO(…” is an entry point, whose IMSI or TMSI matches with the IMSI or TMSI of the MAP call.

2. On Abis interface ° ° °

DATA_REQ (Set-up) is an entry point, whose ISDN called party number matches with the MSISDN of the MAP call. UDT(PAGING) is an entry point, whose IMSI or TMSI matches with the IMSI or TMSI of the MAP call. PAGING_CMD is an entry point, whose IMSI or TMSI matches with the IMSI or TMSI of the MAP call

Thus whichever message is available, corresponding parameter as mentioned above has to be used to map MAP connections with other connections.

10

 Wipro Technologies

WHITE PAPER

CALL TRACE IN GSM

´µ ¶v·¸¹»º ¼ ½1¾ ·¸

Apart from testing the functionality of network elements, call trace is also helpful in analyzing problems occurring in field. If any problem occurs, it may not be possible for the experts to go to the problem site and analyze it. Instead, the messages exchanged can be registered and can be analyzed offline. When a call is made, the messages exchanged between the network elements can be registered in a file. This file can be read and the messages can be represented graphically. Call tracing can be done for the messages in the file by selecting a message. The traced call can be highlighted and the messages can be analyzed for any discrepancies. Manual tracing of the call might involve lot of effort and expertise. Instead, if it is automated as stated in this paper, then it will be very useful in analysis.

¿À ÁÂ1ÃhÂEÄÂEÅ Æ1Â0Ç

1. GSM 4.08 – Mobile Radio interface layer 3 specification 2. GSM 8.58 – Base Station Controller – Base Transceiver Station (BSC - BTS) interface Layer 3 specification 3. GSM 8.08 – Mobile-services Switching Centre – Base Station System (MSC – BSS) interface Layer 3 specification. 4. GSM 9.02 – Mobile Application Part Specification 5. GSM 1.04 – Abbreviations and Acronyms 6. CCITT – Recommendations for Integrated Services Digital Network User Part (ISUP) – Q.761 to Q.764 7. ITU – T Recommendations for Signalling Connection Control Part (SCCP) Q.711 – Q.715

ÈÉ ÊË1ÌÍÎ>ÏÐÒÑ BTS BSC CIC COM L3 Info

DLR HLR IMSI ISDN ISUP MAP MOC MTP MSC MSIN MSISDN MTC NE SCCP SLR SS7 TDMA TMSI VLR

11

Base Transceiver Station Base Station Controller Circuit Identification Code Complete Layer three Information. The following are COML3 Info that comes with CR in A interface and EST_IND in Abis: ° CM Service Request ° CM Reestablishment Request ° Paging Response ° Location Update Request ° IMSI Detach Indication Destination Local Reference Home Location Register International Mobile Subscriber Identity Integrated Services Digital Network Integrated Services Digital Network User Part Mobile Application Part Mobile Originated Call Message Transfer Part Mobile-services Switching Centre, Mobile Switching Centre Mobile Subscriber Identification Number Mobile Station International ISDN number Mobile Terminated Call Network element Signalling Control Connection part Source Local Reference Signaling System 7. MTP and SCCP are part of it. Time Division Multiple Access Temporary Mobile Subscriber Identity Visitor Location Register

 Wipro Technologies

WHITE PAPER

CALL TRACE IN GSM

About the Authors Subha Narasimhan is a Systems Manager in Wireless Business Unit of Telecom and internetworking Group at Wipro Technologies. She is a domain expert in Telecom (GSM, GPRS & UMTS) and Protocol systems. She has a master degree in Computer applications. Dama Prem Kumar is a Systems Manager in Wireless Business Unit of Telecom and internetworking Group at Wipro Technologies. He is a domain expert in Telecom (GSM, GPRS & UMTS) and Protocol systems. He has a Bachelors degree in Computer science and Engineering.

About Wipro Technologies Wipro Technologies is the global technology services division of Wipro Limited (NYSE: WIT). It provides turnkey solutions for Finance, Retail, Utilities, Telecom and Technology clients. The focus is largely in the areas of information services outsourcing and technology software development. The company’s top clients include Lucent, Canon, Epson, Hitachi, Sony, Toshiba, Cisco, IBM, ARM, AT&T and Transco. www.wipro.com © Copyright 2002. Wipro Technologies. All rights reserved. No part of this document may be reproduced, stored in a retrieval system, transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without express written permission from Wipro Technologies. Specifications subject to change without notice. All other trademarks mentioned herein are the property of their respective owners. Specifications subject to change without notice.

12

 Wipro Technologies