call tracing

��

AUTHORS

Subha [email protected]

Dama Prem [email protected]

ABSTRACT

Call tracing is very useful for offline analysis of the messages exchanged between variousnetwork elements during a call. This can be used in functional testing of network elements. Thispaper gives details on how a call can be traced from source to destination in GSM network. Thiscan be considered as a base for doing the same feature in next generation mobile networks.

WHITE PAPER CALL TRACE IN GSM

2 Wipro Technologies

� � �� !��#"%$ &

The mobile telecommunications industry has experienced unprecedented growth over the last tento twenty years. The popularity and use of mobile telephones will undoubtedly increase in thefuture with this kink of rapid growth.

The following diagram gives the basic mobile system in GSM.

Following are the components of the GSM network

° The Mobile Phone or Mobile Station, that is carried by the subscriber.° The Base Transceiver Station (BTS) which sends or receives signals from/to Mobile Station.

The Base Station Controller (BSC) which allocates resources to mobile and controls BTS.BSC and BTS together are called Base Station Subsystem (BSS).

° Mobile Switching Center (MSC) which switch the calls from one network to other network. Itaccesses the databases Home Location Register (HLR), Visitor Location Register (VLR) andEquipment Identity Register (EIR), to switch the calls. All the databases and MSC formsNetwork Subsystem (NSS).

° Operations and Maintenance Center, which oversees the proper operation and setup of thenetwork.

Base StationController (BSC)

Operation and MaintenanceCentre (OMC)

Air Interface (Um)

Air Interface (Um)

Abis InterfaceAbis Interface

Abis Interface

A Interface

Visitor LocationRegister (VLR)

Equipment IdentityRegister (EIR)

Home LocationRegister (HLR)

Mobile Switching Centre (MSC)

B InterfaceC Interface

F Interface

Standardized Interface

Non-Standardized Interface



Following are the interfaces between various network elements.

° The mobile station and the BSS communicate across the Um interface, also known as airinterface or radio link.

° BTS communicates with BSC across Abis interface° BSC communicates with MSC across A interface° MSC communicates with VLR across B interface° MSC communicates with HLR across C interface° MSC communicates with EIR across F interface° The interface between OMC and other network elements is not standardized

' ( )+*�,�-�*�.0/1/2,43658715:9;9

<>=@? ACBED�FHGJILKNM�OQPRP

A call can be either mobile originated call (MOC) or mobile terminated call (MTC). Mobileoriginating means the subscriber is making a call from mobile. Mobile terminated call means thesubscriber is receiving a call. Only the trigger for the initiation of the mobile to establish theconnection with BTS is different in MOC and MTC. The progress of the call from initiation issame in both the cases.

2.1.1 Mobile originated call

To make a call, radio resources are required. When the subscriber tries to make a call, themobile tries to acquire random access channel (RACH) using which it can request network toallocate resources. It sends CHAN_REQ message to BTS, through RACH. This message isreceived by BTS and it passes this information to BSC, through the message CHAN_RQD. Onreceiving this message, BSC allocates dedicated channel for this mobile and sends the messageCH_ACT to BTS, which instructs BTS to activate the channel specified in the message for thismobile. BTS activates the channel and send CH_ACT_ACK message to BSC. BSC then sendsIMM_ASS_CMD to the mobile on the access grant channel (AGCH), indicating that it hasassigned a dedicated channel. This message contains the channel details to which the mobileshould tune. Thus the dedicated channel is assigned to mobile and it starts using it.

Once the dedicated channel is assigned, BSC starts establishing a connection with the MSC. Thetransport mechanism defined to carry signaling information between BSS and MSC is SS7 stack(MTP and SCCP layers). BSS initiates a SCCP connection by sending Connection Request (CR)message with Layer 3 information indicating the need of SCCP connection. The MSC confirmsthe connection by sending Connection Confirm (CC) message to BSC. Then on the messagesget exchanged between BSC and MSC using the SCCP connection.

After the completion of authentication and ciphering procedure, BSC allocates traffic channel toMobile using DATA_REQ(Assignment_cmd). It also activates the traffic channel using CH_ACTmessage. Then on the mobile uses this traffic channel for the call.

If the mobile is trying to make a call with a mobile which is under the control of other MSC, or if itis other network, then MSC-MSC interaction is possible. For this interaction MSCs uses ISUP(Integrated Services Digital Network user Part). The ISDN User Part makes use of SCCP andMTP of SS7. ISUP setup, manage and release trunk circuits that carry voice and data betweenterminating line exchanges. ISUP is used for both ISDN and non-ISDN calls. However the callsthat originate and terminate at the same switch do not use ISUP signaling.

So, here if the mobile tries to reach a subscriber under the control of other MSC or if it is indifferent network, the originating MSC transmits ISUP Initial Address Message (IAM) to reserve aidle trunk circuit from the originating switch to the destination switch. The destination MSC then



finds out the location of called party by accessing HLR/VLR using Mobile Application Protocol(MAP) messages. Once it has located the called party, it rings the called party and transmits anISUP Address Complete (ACM) message to the originating MSC. When the called party picks upthe phone, the destination MSC terminates the ringing tone and transmits ISUP Answer Message(ANM) to the originating MSC. From then on the call proceeds.

When the calling party hangs-up first, mobile sends Disconnect message to BSC. On receivingthis MSC initiates the release by sending Release message to BSC. BSC sends this message toBTS and this is forwarded to the mobile station. The mobile station deallocates the radioresources. Then the MSC sends an ISUP Release message (REL) to release the trunk circuitbetween the two MSCs. On receiving REL, destination MSC disconnects the trunk from calledparty’s line and sends ISUP Release Complete (RLC) message to the originating MSC. ThusISUP connection is terminated. Now MSC starts terminating the radio resources and the SCCPconnections. It then sends SCCP Released (RLSD) to disconnect the SCCP connection. BSCreplies with SCCP Release Complete (RLC) message. Thus SCCP connection is terminated forthis mobile. BSC then sends RF_CH_REL message to BTS instructing BTS to release thechannel associated with the mobile. The BTS acknowledges by sending RF_CH_REL_ACKmessage. Now all the resources allocated to the mobile will be de-allocated.

2.1.2 Mobile terminated call

Here the mobile is receiving call from other mobile or other land line connection. When a mobilegets a call, the network pages the mobile indicating it to establish a radio link through themessage UDT(PAGING). On receiving this message, mobile initiates CCCH connection bysending CHAN_REQ. Rest is same as in Mobile Originated call.

S>T;S U�VHW0X�Y[ZE\^]

When the subscriber is moving away from the BTS/BSC while making a call, then the signalstrength is weakened due to which the call may be dropped. To avoid this, when the signalstrength is weakened the call is handed over to adjacent BTS/BSC towards which the mobile ismoving and for which the signal strengths is more. Thus handover is transferring the control on amobile from one network element to other network element.

Following are various types of handover.1. Intra cell handover, which involves in changing the channel or time slot of the channel that is

assigned to the mobile.2. Intra BSC handover, which involves in handing over the call to other cell, with in the scope of

BSC.3. Inter BSC, Intra MSC handover, which involves in handing over the call to other BSC with in

the scope of MSC4. Inter MSC handover, which involves in handing over the call to other MSC.

_>`;a b�cCd�e�fhgRcCikjml�n�eofhgpiEq

Geographically the network service area is divided into cells. More than one cell forms a LocationArea (LA). More than one LA forms a MSC/VLR area. Thus the MSC will control all thesubscribers present in the LA at particular point of time. Before an MS can make or receive callsit must register with the network by performing a function known as a Location Update (LU). Withthis, the network can keep track of he location of MSs in the network service area. To achievethis, each MS whenever it crosses the location area, will periodically perform LU procedure. Theresultant location information is stored in HLR and VLR, which will be accessed by MSC to switchthe call to the mobile.



r�s tvu�w�w x0y�z�{ u�w!z�|�}Ey1x

What is a connection?

Connection is a group of messages sent on a particular logical channel in an interface. Thestarting and ending messages of a connection are well defined. The type of connection dependson the type of logical channel.

For example on Abis interface following type of connections are possible.° CCCH - Common Control Channel° SDCCH - Stand alone Dedicated Control Channel° TCH - Traffic Channel

The establishment of CCCH connection starts with CHAN_RQD message and ends withIMM_ASS_CMD message. IMM_ASS_CMD message contains Request reference number andTDMA value. This set of parameter is unique for a call. CHAN_RQD message also containsthese two parameters. So the CCCH connection can be traced by using these two parameters.

The establishment of SDCCH and TCH starts with CH_ACT message and ends withRF_CH_REL_ACK message. All the messages that forms the part of the SDCCH/TCHconnection will have logical channel number. Using this all the messages that forms the part ofthe connection can be traced.

Similarly on A interface following type of connection is possible° SCCP - Signaling Connection Control PartThe establishment of SCCP connection starts with the message CR (sent by BSC or MSC) andends with RLC (sent by BSC or MSC). Every message of an SCCP connection has a connectionreference numbers called DLR (Destination Local Reference) or SLR (Source Local Reference)or both. This set of number is unique for a SCCP connection. Thus using this an SCCPconnection can be traced.

On E interface, that is the interface between 2 MSCs, following connection is possible° ISUP - Integrated Services Digital Network User Part

The establishment of ISUP connection starts with IAM message and ends with RLC message. AllISUP messages that belong to a single connection can be identified using the unique numberCIC. CIC (Circuit Identification Code) indicates the trunk circuit reserved by the originating switchto carry the call.

On B, C and F interface following connections are possible° MAP - Mobile Application Part

MAP is application layer protocol defined by GSM to manage the interfaces between differentnetwork elements in NSS. MAP uses the services of TCAP, MTP and SCCP. MAP connectionstarts with Begin message and ends with End message. A MAP connection in an interface can beidentified using Originating ID and Destination ID parameters. This set will be unique for a givenMAP connection.

While tracing a connection, care should be taken that the messages are exchanged between thesame network elements.



~�� v�E� �H��E�1�

What is call tracing?

Identification of all connections that forms the part of a call is called call trace.

Connection trace is easy, as the start and end messages are defined and also it spans in onlyone interface. But call trace spans across all interfaces. So complexity is involved in finding outthe link between the connections of different interfaces.

In order to trace a call from end to end we should first know how to group all the messagesbelonging to a particular call, because many subscribers will be making/receiving calls. Also,location updation procedure by mobile might also go on parallel. So tracing a call becomescomplex in these situations.

Based on certain parameters between the messages across different interfaces, a call can betraced from end to end. The following section describes how the tracing of a call can be done.

�>�@� ��H�1��E�p�0��H��^�1��o�4�>�0�Q��R�Q�E�J�[�N�2�o�H�R�

This section gives the details of how to identify different connections that form a part of a call. Wewill see how this can be done in each interface.

4.1.1 Abis Interface

CCCH connection and SDCCH connection in Abis interface can be mapped usingIMM_ASS_CMD message in CCCH connection and CH_ACT message in SDCCH connection.Both these messages will have the same channel number, if they form the part of same call. ThusCCCH and SDCCH connection can be traced. Similarly a TCH connection and an SDCCHconnection can be traced using DATA_REQ(Assignment_cmd) message in SDCCH connectionand CH_ACT message in TCH connection. Both these messages will have the same logicalchannel number.

Following figures gives the mapping of CCCH with SDCCH and SDCCH with TCH connectionsrespectively in Abis interface.

BTS

Request Referencenumber, TDMA

CHAN_RQD

CH_ACT

CH_ACT_ACK

IMM_ASS_CMD

Request Referencenumber, TDMA

ChannelNumber

ChannelNumber

BSC

ChannelNumber

Channel Number



4.1.2 A Interface

A Call can have more than one SCCP connection if there is a handover. When there is aHandover of the call from one channel to other channel, a new SCCP connection is formed. Thenew SCCP connection for a handover is requested through CR(HO_REQ), from MSC to BCE,which is the reason for the connection request. The response for this message is a ConnectionConfirm message, CC(HO_REQ_ACK(Handover_Cmd)) from BCE to MSC. This triggers aDT1(HO_CMD(Handover_Cmd)) from this MSC. Both the messages contain the same COM L3Info with identical values for channel description and handover request. Thus with these twomessages the old and the new SCCP connections can be linked. Following figure indicates themapping between two SCCP connections.

BSC1 MSC

CR (Layer 3 info)

CC

CR(HO_REQ)

SLR

DLR, SLR

SLR

BSC2

DT1(HO_RQD)

DLR

CC(HO_REQ_ACK(Handover_Cmd))

DLR, SLR

RLSD

RLC

DLR, SLR

DLR, SLR

DT1(HO_CMD(Handover_cmd))

DLR Handover referenceChannel number Handover reference

Channel number

Channel Number

Channel Number

Channel Number

Channel Number

CH_ACT_ACK

DATA_REQ (Assignment_cmd)

CH_ACT

Channel Number

BSC

RF_CH_REL

RF_CH_REL_ACK

RF_CH_REL

RF_CH_REL_ACK

Channeldescription

BTS

Channel Number



4.1.3 ISUP Interface

In case of ISUP, there can be only one connection that is possible in a call. The flow ofmessages in ISUP is as shown.

4.1.4 MAP Interface

A map call consists of many connections. Each map connection begins with a Begin messageand ends with an End message. In between Begin and the End message, Continue messagescan also be encountered. Each message has an Originating ID or a Destination ID or both. Somemessages of map connection have IMSI/TMSI, Roaming number, and Called party number. Twomap connections can be mapped with IMSI or TMSI or called party number.

Begin(SendParametersArg)

HLR VLR1

End(SendParametersRes)

OrigID= 4D

VLR2

Begin(UpdateLocationArg)

OrigID=F3 IMSI/TMSI IMSI/TMSI

DestnID=4D

Continue(InsertSubscriberdata)

OrigID=FA, DestnID=F3

Continue(InsertSubscriberdata)

OrigID=FA, DestnID=F3

End(UpdateLocationRes)

DestnID=F3

.

.

.

MSC1 MSC2

• •

IAM

ACM

REL

RLC

ANM

CIC = 5

CIC = 5

CIC = 5

CIC = 5

CIC = 5



�> ;¡ ¢¤£H¥�¥C¦¨§0©�ª[«N£Q¬R¬4oªC§0§0®H°¯�¦RªQ§0±²£Ho³�ªQ±o±J£H¬¨¬Q¦R§1¯�®H³�«�£Ho®H±

In previous sections, we saw how different connections in the same interface being mapped. Nowwe will see how to map all the connections across all the interfaces. If this mapping is done, thenend to end call can be traced.

4.2.1 Mapping from Abis to A interface and vice versa

The message in A interface that is used to link Abis messages are CR(COM L3 INFO). Justbefore this message, in Abis message, there is a message EST_IND(COM L3 INFO). The IMSI,TMSI or IMEI that is present in both the messages should be same. If that is case, the both thesemessages form a part of the call. Once a link message is got in other interface, then tracing thecall in that interface is easy. (As explained in above sections).

If there is a handover, the messages in A interface that are used to link Abis interface areDT1(HO_CMD(Handover_Cmd)) and CC(HO_REQ_ACK(Handover_Cmd)). Both the messageshave Handover Reference and the new channel description, which is given to the Abis link. Thisinformation is present in the messages CH_ACT and DATA_REQ(Handover_command) of Abisinterface. Through this link, the A and Abis interface messages can be linked.

The following figure gives the above mentioned mapping:

BTS BSC1

.

.

SLR

MSC

DT1(HO_RQD)

DLR

.

.

IMSI/TMSI/IMEI

Channelnumber

EST_IND (Layer 3 info)

CR (Layer 3 info)

DT1(HO_CMD(Handover_cmd))

DLR

DATA_REQ(HO_CMD)

Handover reference,Channel description

Handover reference,Channel description

BSC2

CR(HO_REQ)

SLR

CC(HO_REQ_ACK(Handover_cmd))

DLRHandover reference,Channel description

IMSI/TMSI/IMEI

.

.

Channelnumber



4.2.2 Mapping from A to ISUP interface

The link between A and ISUP interface is the Called Party Number or the Calling Party Number.The message IAM in ISUP interface is having Called Party Number as a Mandatory parameterand the Calling Party Number as the optional parameter. The message DT1(Set_up) in Ainterface is having Called Party Number as the Mandatory Parameter when it is a MOC. When itis a MTC, the DT1(Set_up) is having a Calling Party Number as the optional parameter. Thususing this, A and ISUP interface can be linked.

4.2.3 Mapping of MAP interface with other interfaces.

Following are the links from the MAP interface to other interfaces.

1. On A interface

° DT1 (Set-up) is an entry point, whose ISDN called party number matches with the MSISDN ofthe MAP call.

° “CR(COM_L3_INFO(…” is an entry point, whose IMSI or TMSI matches with the IMSI orTMSI of the MAP call.

2. On Abis interface

° DATA_REQ (Set-up) is an entry point, whose ISDN called party number matches with theMSISDN of the MAP call.

° UDT(PAGING) is an entry point, whose IMSI or TMSI matches with the IMSI or TMSI of theMAP call.

° PAGING_CMD is an entry point, whose IMSI or TMSI matches with the IMSI or TMSI of theMAP call

Thus whichever message is available, corresponding parameter as mentioned above has to beused to map MAP connections with other connections.

BSC MSC1 MSC2

CR(COM_L3_INFO(Paging_Respsonse))

.

.

CC

DT1(Set_up)

IAM

Calling party Number

Calling party Number,Called party Number

SLR

DLR,SLR

DLR

.

.

CIC



´�µ ¶v·�¸�¹»º ¼ ½1¾ ·�¸

Apart from testing the functionality of network elements, call trace is also helpful in analyzingproblems occurring in field. If any problem occurs, it may not be possible for the experts to go tothe problem site and analyze it. Instead, the messages exchanged can be registered and can beanalyzed offline. When a call is made, the messages exchanged between the network elementscan be registered in a file. This file can be read and the messages can be representedgraphically. Call tracing can be done for the messages in the file by selecting a message. Thetraced call can be highlighted and the messages can be analyzed for any discrepancies. Manualtracing of the call might involve lot of effort and expertise. Instead, if it is automated as stated inthis paper, then it will be very useful in analysis.

¿�À Á�Â1ÃhÂEÄ�ÂEÅ Æ1Â0Ç

1. GSM 4.08 – Mobile Radio interface layer 3 specification2. GSM 8.58 – Base Station Controller – Base Transceiver Station (BSC - BTS) interface Layer

3 specification3. GSM 8.08 – Mobile-services Switching Centre – Base Station System (MSC – BSS) interface

Layer 3 specification.4. GSM 9.02 – Mobile Application Part Specification5. GSM 1.04 – Abbreviations and Acronyms6. CCITT – Recommendations for Integrated Services Digital Network User Part (ISUP) – Q.761

to Q.7647. ITU – T Recommendations for Signalling Connection Control Part (SCCP) Q.711 – Q.715

È�É Ê�Ë1Ì�Í�Î>Ï�ÐÒÑ

BTS Base Transceiver StationBSC Base Station ControllerCIC Circuit Identification CodeCOM L3Info

Complete Layer three Information. The following areCOML3 Info that comes with CR in A interface andEST_IND in Abis:° CM Service Request° CM Reestablishment Request° Paging Response° Location Update Request° IMSI Detach Indication

DLR Destination Local ReferenceHLR Home Location RegisterIMSI International Mobile Subscriber IdentityISDN Integrated Services Digital NetworkISUP Integrated Services Digital Network User PartMAP Mobile Application PartMOC Mobile Originated CallMTP Message Transfer PartMSC Mobile-services Switching Centre, Mobile Switching CentreMSIN Mobile Subscriber Identification NumberMSISDN Mobile Station International ISDN numberMTC Mobile Terminated CallNE Network elementSCCP Signalling Control Connection partSLR Source Local ReferenceSS7 Signaling System 7. MTP and SCCP are part of it.TDMA Time Division Multiple AccessTMSI Temporary Mobile Subscriber IdentityVLR Visitor Location Register



About the Authors

Subha Narasimhan is a Systems Manager in Wireless Business Unit of Telecom andinternetworking Group at Wipro Technologies. She is a domain expert in Telecom (GSM, GPRS& UMTS) and Protocol systems. She has a master degree in Computer applications.

Dama Prem Kumar is a Systems Manager in Wireless Business Unit of Telecom andinternetworking Group at Wipro Technologies. He is a domain expert in Telecom (GSM, GPRS &UMTS) and Protocol systems. He has a Bachelors degree in Computer science and Engineering.

About Wipro Technologies

Wipro Technologies is the global technology services division of Wipro Limited (NYSE: WIT). Itprovides turnkey solutions for Finance, Retail, Utilities, Telecom and Technology clients. Thefocus is largely in the areas of information services outsourcing and technology softwaredevelopment. The company’s top clients include Lucent, Canon, Epson, Hitachi, Sony, Toshiba,Cisco, IBM, ARM, AT&T and Transco.

www.wipro.com

© Copyright 2002. Wipro Technologies. All rights reserved. No part of this document may be reproduced,stored in a retrieval system, transmitted in any form or by any means, electronic, mechanical, photocopying,recording, or otherwise, without express written permission from Wipro Technologies. Specifications subjectto change without notice. All other trademarks mentioned herein are the property of their respective owners.Specifications subject to change without notice.

call tracing

Documents