SS7 was first introduced in the 1970s and initially was designed for large scale setting up and tearing down of calls, but due to it’s layered architecture and prominence in the industry has been used for signalling between some CS network elements in Mobile Networks, including transporting messages between the MSC and any BSCs or RNCs it’s serving.
This is going to be fairly brief and Osmocom specific, keep in mind SS7 is a giant topic so there’s a huge amount we won’t cover.
Point Codes – SS7 Addressing & Routing
Historically SS7 networks were carried over TDM links of various types, and not over TCP/IP.
A point code is a unique address associated with each network element for addressing messages between network elements, it’s function is similar to that of an IP Address you’d use in IP networks.
When STP messaging is sent it includes a Source Point Code (SPC) and Destination Point Code (DPC).
The Signalling Transfer Point
Instead of a one-to-one connection between each SS7 device and every other SS7 device, a network element called a Signaling Transfer Point (STP) is used, which acts somewhat like a router.
The STP has an internal routing table made up of the Point Codes it has connections to and some logic to know how to get to each of them.
When it receives an SS7 message, the STP looks at the Destination point code, and finds if it has a path to that point code. If it does, it forwards the SS7 message on to the destination.
Like a router, an STP doesn’t really concern itself with the upper layer protocols and what they contain – As point codes are set in the MTP3 layer that’s the only layer the STP looks at and the upper layers aren’t really “any of its business”.
Sigtran & SS7 Over IP
As the world moved towards IP enabled everything, TDM based Sigtran Networks became increasingly expensive to maintain and operate, so a IETF taskforce called SIGTRAN was created to look at moving SS7 traffic to IP.
The first layer of SS7 were dropped it primarily concerned the physical side of the network, and in the Osmocom implementation the MTP3 layer and up were put into SCTP packets and carried on the network.
Notice I said SCTP and not TCP or UDP? I’ve touched upon SCTP on this blog before, it’s as if you took the best bits of TCP without the issues like head of line blocking and added multi-homing of connections.
To establish an SS7 connection over IP the MTP3 message an SCTP socket is established from the device to the STP, and then an ASP Maintenance message is sent, followed by a Registration Request containing it’s point code, and presto, we have a connection.
The Osmo STP
The Osmocom STP acts in a very trusting manner by default,
When a device wants to connect to the STP it does so via a REG_REQ (Registration Request) containing it’s Point Code. The STP accepts the connection with a REG_RSP (Registration Response).
For as long as that connection stays up any SS7 messages destined to that point code of the device that just registered, the STP will now how to get it there.
Assuming you’ve already installed the OsmoSTP you can access it on 4239:
[email protected]:/etc/osmocom# telnet localhost 4239 Trying 127.0.0.1… Connected to localhost. Welcome to the OsmoSTP VTY interface OsmoSTP>
After running enable we can check the current routing table:
OsmoSTP# show cs7 instance 0 sccp users SS7 instance 0 has no SCCP OsmoSTP# show cs7 instance 0 ro OsmoSTP# show cs7 instance 0 route Routing table = system C=Cong Q=QoS P=Prio Destination C Q P Linkset Name Linkset Non-adj Route 0.23.1/14 0 as-rkm-1 ? ? ? 0.23.3/14 0 as-rkm-2 ? ? ? OsmoSTP# show cs7 instance 0 as all Routing Routing Key Cic Cic Traffic AS Name State Context Dpc Si Opc Ssn Min Max Mode as-rkm-1 AS_ACTIVE 1 0.23.1 override as-rkm-2 AS_ACTIVE 2 0.23.3 override OsmoSTP# show cs7 instance 0 asp Effect Primary ASP Name AS Name State Type Remote IP Addr:Rmt Port SCTP ------------ ------------ ------------- ---- ----------------------- ---------- asp-dyn-0 ? ASP_ACTIVE m3ua 127.0.0.1:52192 asp-dyn-1 ? ASP_ACTIVE m3ua 127.0.0.1:33570
Below is a packet capture showing a connection from an MSC to the STP.