SS7 Introduction: Channel Associated vs.

Common Channel Signaling

1. Signaling Methods Overview

There are two primary ways to carry signaling for voice communications:

Channel Associated Signaling (CAS)

 The signaling information (used to establish, supervise, and tear down calls) is
carried within the voice path.

 Examples include:

o T1 Robbed Bit Signaling (common in North America): One bit is

"robbed" from every time slot to carry signaling.

o R2 Signaling (common elsewhere): One entire time slot in an E1 is

dedicated to signaling.

 Drawbacks:

o Inefficient bandwidth usage.

o Security vulnerabilities: signaling is accessible within the voice channel,

meaning a caller could manipulate it.

Common Channel Signaling (CCS)

 Signaling is separated from the voice path and carried over a dedicated
signaling channel.

 SS7 (Signaling System No. 7) is the most prominent protocol using CCS.

Sensitivity: Internal
  Benefits:

o More bandwidth and efficiency.

o Better security: voice and signaling are isolated.

o Faster call setup times.

o Enhanced flexibility and network architecture.

2. Advantages of Common Channel Signaling

 Efficiency: The voice path remains free of signaling data, maximizing

bandwidth for actual voice transmission.

 Security: Signaling is isolated and thus harder to intercept or tamper with.

 Scalability & Flexibility: Supports advanced services and complex call

routing.

 Performance: Faster call setup and teardown, contributing to improved voice

network performance.

Sensitivity: Internal
 3. SS7 Architecture: Service Switching Points (SSPs)

 SSP (Service Switching Point): In SS7 terminology, this refers to a

telephone switch or exchange.

 Example: "Exchange A" and "Exchange B" are SSPs.

 Voice traffic travels over voice circuits, while signaling traffic travels over
separate SS7 links (usually shown as green lines).

 Redundancy: Multiple signaling links are often used to ensure reliability.

 Call Setup:

o If a caller from Exchange A dials a number on Exchange B, the signaling

for this action is handled over SS7 signaling links using the ISUP
protocol.

4. SS7 Addressing and Routing

Sensitivity: Internal
  Similar to how IP networks use IP addresses, SS7 uses point codes to identify
nodes.

 ITU Format: 14-bit point codes (used outside North America).

 ANSI Format: 24-bit point codes (used in North America).

 Each SS7 node (e.g., each switch) has a unique point code.

 To establish a call or send a message, SS7 systems use:

o Destination Point Code (like a destination IP address)

o Originating Point Code (like a source IP address)

In SS7 Network all routes are statically configured:

 Unlike IP networks which use dynamic routing protocols, where the routes can
change dynamically. SS7 routes are statically configured.

 Every route in an SS7 network is manually set by network engineers.

 This ensures predictability and reliability in routing.

5. Nature of the SS7 Network

 The SS7 network is a private, closed system, accessible only to

telecommunications service providers.

 Not open to the public (unlike IP networks).

 Despite its age, SS7 remains essential in modern telecommunications,

particularly for voice and messaging services.

Channel-Associated vs. Common Channel Signaling

There are two primary methods for handling signaling in voice communications:
Channel-Associated Signaling (CAS) and Common Channel Signaling (CCS).

 CAS embeds signaling within the same path used for voice transmission. For
instance, in North America, T1 robbed-bit signaling steals one bit from each
timeslot for signaling. In other regions, R2 signaling robs an entire timeslot from
an E1 circuit.

 This method is inefficient as it consumes voice bandwidth and poses security

risks—signaling is exposed to the user and can potentially be manipulated.

Common Channel Signaling (CCS) was developed as a superior alternative. It

separates the signaling path from the voice path, allowing for:

 More secure and reliable signaling

Sensitivity: Internal
  Efficient bandwidth usage

 Improved call setup performance and reduced latency

 Greater architectural flexibility

SS7 Architecture and Nodes

Service Switching Points (SSPs)

 SSPs are telephone exchanges or switches that handle voice communication.

 They use dedicated signaling links (often shown as redundant green links in
diagrams) to send call setup, management, and teardown instructions.

 These signaling messages are transmitted via the SS7 protocol, specifically
using the ISUP layer.

Signal Transfer Points (STPs)

 STPs serve as routers within the SS7 network, directing signaling messages
based on the destination point code.

 They avoid the need for fully meshed signaling links between every pair of
exchanges, lowering both network complexity and cost.

 STPs also perform functions such as:

o Global Title Translation (GTT)

Sensitivity: Internal
 o Gateway Screening, which adds a layer of security to block
unauthorized messages.

Service Control Points (SCPs)

 SCPs deliver a service, I does not deliver a voice services but it deliver to the
SS7 network.

 They host databases and logic for:

o Caller name delivery

o Local Number Portability (LNP)

o Mobile network functions like the HLR (Home Location Register), VLR
(Visitor Location Register), and SMSC (Short Message Service Center)

 SSPs query SCPs to retrieve information needed to route or manage calls and
services appropriately, by presenting the caller’s name to the callee, for
example.

SS7 Addressing

 Every SS7 node is identified by a Point Code (similar in purpose to an IP

address).

o In ITU regions, point codes are 14 bits.

o In North America, point codes are 24 bits.

 Routing in SS7 is statically configured. Unlike dynamic routing protocols in IP

networks, SS7 paths are predefined for reliability and control.

Sensitivity: Internal
  The SS7 network is private and used exclusively by telecom service providers.

SS7 Protocol Stack and Layers

The SS7 protocol suite has layered architecture, loosely aligning with the OSI model:

1. MTP Level 1 (Physical Layer)

o Transmits raw bits over T1 (North America) or E1 (elsewhere).

2. MTP Level 2 (Data Link Layer)

o Ensures error-free transmission between adjacent nodes using framing

and retransmission mechanisms.

3. MTP Level 3 (Network Layer)

o Provides routing and network management, including link status

updates and addressing via point codes.

4. User Parts (Application Layer)

o ISUP: Used for setting up and tearing down voice calls.

o SCCP: Offers extended routing and services such as database queries.

o TCAP: Used for signaling applications like number portability, prepaid

services, and SMS.

Sensitivity: Internal
 Call Setup Flow Example

The flow of a basic voice call illustrates how SS7 signaling facilitates call setup:

 A user initiates a call via ISDN, and a Setup message is sent.

 The originating exchange sends an Initial Address Message (IAM) to the

transit and terminating exchanges.

 The terminating exchange replies with:

o Address Complete Message (ACM) – indicating the remote phone is

ringing.

o Answer Message (ANM) – confirming the call has been answered and
the voice path can be established.

 Intermediate SS7 messages carry all routing and control data between the
exchanges, ensuring efficient and secure call setup.

In cases where digits are sent progressively (overlap signaling), an SAM

(Subsequent Address Message) may be used, but this is an advanced case and
not always necessary.

Sensitivity: Internal
 📡 SS7 Architecture Overview

🧩 Key Nodes:

 SSPs (Service Switching Points) on the left – These are voice switches
(Class 4/5, mobile, etc.)

o Examples: Nortel DMS-100, AT&T 5ESS/4ESS, Siemens EWSD, Metaswitch,

Nokia switches, and many other.!

 STPs (Signal Transfer Points) in the middle – Two fully meshed mated
pairs (STP 1–4)

o Purpose: Route SS7 messages, add redundancy, reduce complexity

 SCPs (Service Control Points) on the right – Contain databases (CNAM, LNP,
VLR/HLR)

🔗 Link Types:

 A-links (Access Links) – From SSPs/SCPs to STPs (always redundant)

 B-links – Between mated pairs of STPs

 C-links / Cross-links – Connect STPs within a mated pair

 D-links / Diagonal Links – Between STPs in different layers (hierarchies)

Sensitivity: Internal
  F-links – Rare, mostly non-redundant; seen at the edge (e.g., PBX to STP)

Reliability Measures:

 Redundancy: Each SSP connects to 2 STPs via A-links.

 Overengineering: Each A-link is designed to carry ≤40–50% of total load so that

the other can fully take over if one fails.

🔍 Use Case: CNAM Gateway (Caller Name Lookup)

🧠 Problem:

 An external application (like a CRM or spam blocker) wants to find the caller
name for a given phone number.

 But SS7 networks are private and restricted to service providers.

🔁 Solution:

CNAM Gateway bridges that gap:

1. 👤 A user app sends a request via API (e.g., HTTP).

2. 🔀 The CNAM Gateway translates this API request into a TCAP query (a
signaling protocol in SS7).

3. 📬 The query travels through one or more STPs to reach the SCP holding the
CNAM database.

Sensitivity: Internal
 4. 📤 The SCP returns the caller name, which is converted back into an API response
and sent to the user app.

🔒 Security Note: The SS7 core is still protected — access is granted only through
gateways managed by service providers.

📱 Related Use Case:

Similar architecture supports:

 SMS delivery APIs (e.g., 2FA codes)

 LNP queries

 Banking/identity verification services via SS7 access points

SIGTRAN Overview

Sensitivity: Internal
 What is SIGTRAN?

Mark explained that SIGTRAN is essentially a way to carry SS7 signaling over IP
networks. It’s not a single protocol but rather a set of protocols standardized by the
IETF for transporting SS7 traffic over IP. This includes protocols like M2PA and M3UA,
which are the most relevant when discussing voice and SMS signaling over IP.

The SS7 signaling stack remains the same at the top, but SIGTRAN replaces the lower
layers — specifically, the traditional TDM-based transport — with IP-based
alternatives. So, instead of using MTP1 over T1/E1 lines, you would use Ethernet at
the physical layer, IP at the network layer, and SCTP at the transport layer. SCTP is
important here because it ensures message delivery and maintains the correct
sequence — something that SS7 relies heavily on.

Protocols in SIGTRAN

 M2PA: Used when there’s a need to mimic SS7’s lower-layer functions over IP. It
essentially provides a peer-to-peer link between SS7 nodes.

 M3UA: Used for backhauling signaling between a signaling gateway and an SS7
application server. It’s more flexible and commonly used in network core setups.

These protocols are defined in RFCs (Request for Comments documents), and while
most engineers won’t have to dig into them deeply, it’s good to understand they’re
there — the foundation under the surface.

Sensitivity: Internal
 Why Use SIGTRAN Instead of Traditional SS7 Links?

The presenters outlined several reasons service providers are moving away from TDM
and adopting SIGTRAN:

1. Cost: TDM circuits (like leased T1/E1 lines) are becoming more expensive to
maintain. Providers are hiking prices, especially for inter-state or international
lines.

Sensitivity: Internal
 2. Availability of IP Networks: IP is everywhere now. Private and public IP
networks are highly reliable and far more accessible than dedicated TDM lines.

3. Flexibility: Making changes to an SS7 setup over IP is much faster. You can
reconfigure IP destinations in minutes — whereas ordering and provisioning a
new TDM circuit could take weeks.

4. Reliability: IP networks, especially those with redundancy, are generally more

resilient. Unlike a TDM link that might go down due to something as simple as a
cable being dug up, IP networks can reroute and recover.

5. Migration & Modernization: Many providers are either being forced to move
off TDM or are proactively updating their infrastructure to be more future-proof.

Real-World Deployment Example

The conversation transitioned into a practical example involving the TelcoBridges

TSG 800, a signaling gateway product. In this scenario, a voice switch originally
connected to two STPs using TDM A-links. By deploying the TSG 800, one of those A-
links was replaced with a connection over IP using SIGTRAN.

The benefit? Reduced costs, improved flexibility, and leveraging the more robust IP
infrastructure. The presenters also mentioned how redundancy and self-healing
capabilities in IP networks further support this transition.

TelcoBridges Product Line: TSG800 and TSG3200

Mark then provided a quick overview of TelcoBridges' TCG product line:

Sensitivity: Internal
  TSG 800 and TSG 3200 are both hardware solutions that act as signaling
gateways or even full-fledged STPs (Signaling Transfer Points).

 The difference between the two models mainly lies in the number and types of
TDM interfaces.

 Both can interface with legacy SS7 TDM equipment (using T1/E1) and convert or
bridge that to SS7 over IP using SIGTRAN protocols.

 These devices are commonly used in two ways:

o As signaling gateways, bridging TDM and IP.

o As STPs, routing SS7 traffic between various TDM and IP nodes.

Përshkrimi shtesë për TSG800

Prezantuesi ndalet pak për të dhënë disa detaje teknike shtesë për pajisjen TSG800.
Ai thekson se jo të gjitha përdorimet e SS7 mund të mbështeten nga kjo pajisje, por
ajo është shumë e fuqishme për shumë aplikime. Në anën TDM, mund të lidhen deri
në 64 lidhje të SS7 me shpejtësi të ulët. Po ashtu, pajisja mbështet deri në 64 lidhje
Sigtran, që do të thotë se mund të komunikojë me deri në 64 nyje të ndryshme SS7
përmes rrjetit IP.

Sensitivity: Internal
 Për më tepër, pajisja mund të mbështesë një numër të caktuar rrugësh të SS7, që
është e rëndësishme kur ajo funksionon si një STP – pra si një nyje ruter për sinjalizim.
Mbështet edhe përkthimin e titullit global (GTT), që përdoret për të komunikuar me
databaza të rëndësishme si HLR, VLR, SMSC dhe SCP.

Burime shtesë për të mësuar më shumë

Për ata që duan të mësojnë më shumë, ekziston një seksion i dedikuar për SS7 në
wiki-n zyrtar të TelcoBridges: [Link]. Gjithashtu ka faqe të veçanta për
produktin TSG800 dhe një faqe për të kërkuar konsulencë nëse dëshironi ndihmë për
zbatim në rrjetin tuaj.

Janë gjithashtu mbi 30 video të regjistruara në YouTube, përfshirë trajnime, uebinare,

tutoriale mbi instalime, menaxhim, intervista me klientë, FAQ dhe podkaste. Ju mund
t’i gjeni në kanalin zyrtar: [Link]/telcobridges. Rekomandohet të abonoheni për
të marrë njoftime sa herë që shtohet përmbajtje e re, pasi ngarkohen disa video çdo
muaj – herë të plota dhe herë pjesë të shkëputura nga sesione më të gjata.

🧠 Q&A Highlights:

1. SS7 vs STIR/SHAKEN for robocalls:

o These are separate systems. STIR/SHAKEN is used on IP (VoIP)

networks, while SS7 is used in traditional telecom.

o Some experts are discussing ideas to use SS7 to help identify or block
robocalls, but it's still in theory.

2. SS7 link redundancy:

o SS7 connections often use two full-duplex links for redundancy and
reliability.

3. Is SS7 becoming obsolete due to VoLTE or RCS?

o No, SS7 is still very much in use, especially for mobile phone
registration, HLR communication, and SMS.

4. STP products for small operators:

o Small operators can use TSG-800 as a standalone Signal Transfer

Point (STP).

5. Can an STP be IP-only (no TDM)?

o Yes, using SIGTRAN (M3UA/M2PA over SCTP/IP) enables an IP-only

STP, also known as a Virtual STP.

Sensitivity: Internal
 6. Do SS7 devices support SMS?

o They transport SMS (via SS7), but don’t generate or display SMS. An
external API/software is needed to send/receive SMS using SS7.

7. Replacing TDM SS7 with Ethernet?

o Yes, operators can migrate SS7 links from TDM to Ethernet/IP, bypassing
older upstream providers by connecting directly to a new SS7 provider
over SIGTRAN.

8. Will fiber and VoIP make SS7 obsolete?

o Not exactly. It’s transitioning to SS7 over IP (SIGTRAN), but the SS7
protocol itself continues to be vital for many services.

9. SS7 in the Cloud / Virtual STPs:

o Yes, there's a trend toward cloud-based SS7, especially for rural

operators who are phasing out old T1 circuits.

10. ISUP layer recap:

o ISUP is the SS7 layer that handles voice call setup and teardown (e.g.,
IAM, ACM messages).

11. Does TSG-800 support SMPP?

o No, SMPP (used for SMS over IP) is different from SIGTRAN. A gateway
is required to translate between SMPP and SS7.

12. Is SS7 moving to virtual/cloud-based environments?

o Yes, many operators are moving to virtual SS7 systems over IP,
especially due to TDM hardware

Sensitivity: Internal
Sensitivity: Internal
Sensitivity: Internal
Sensitivity: Internal
Sensitivity: Internal