1/7/13

Practical SS7, Part 3

SS7 for all

12.21.2011

Practical SS7, Part 3

Due to the increased attention to my rather old articles about the practical application of SS7 ( SS7 Practical Part 1 and Practical SS7 Part 2 ), I had to update the material and write a new article. In short, what this article. It's about how to run the SS7 stack on a personal computer with a minimum of effort in time and zero cost in terms of money. In this case, you will receive a full industrial SS7 stack from a known vendor - Dialogic (is a part of Intel) supports Sigtran (M2PA, M3UA, SUA), SCCP, TCAP, MAP, IS41 and INAP (hard to say which one). Who may be interested in: To all those who in one way or another connected (or is going to tie myself) with mobile networks. And it - students, graduate students, beginners and not engineers, developers.

A little about SS7 stack . Formerly called the manufacturer DataKinetics, then it was bought by Dialogic, and now it is part of Intel (name and left, because quite untwisted). Dialogic voice is known worldwide for its expensive but reliable voice (TDM) circuit boards and least expensive SDK. They are building a different IVR-system. And by my experience that a third of the proposed solutions in the global telecom IVR market - is based solutions Dialogic. What you will need: Option 1 . Two separate computer running MS Windows (from XP), Linux and Solaris. Option 2 . A computer with software virtualization. I recommend Oracle VirtualBox . The guest OS can be any of those listed in Option 1. The easiest way to Windows XP. Little nuance - a very desirable processor capable of hardware virtualization (Intel, since some of the Pentium IV. AMD - I do not know.) Otherwise the speed will be tiresome. Option 3 . One computer and one virtual server on Amazon. Amazon offers to try their services for free for a year, there
www.mib.net.ua/2011/12/practical-ss7-part-3.html 1/7

are instructions for setting up for Habre . An important point Sigtran will only work over VPN, firewall because Amazon does not understand the protocol SCTP. All further instructions will apply equally to options 1 and 2. In the case of Option 3 is the minor changes associated with addressing VPN-tunnel. In the future, I guess you are using Windows XP as the OS. Unlike Linux and Solaris minor and relate only to the installation process. Part 1. Installing the SS7 stack. All download links are on this Download: 1. DPK for Windows 2. Software Environment Programmer's Manual (useful later. also contains instructions for installing the stack in Linux and Solaris) 3. MAP Test Utility User Guide (this is the description of test tools that generate traffic. interest is at least Chapter 5 Running the MTU and MTR application) When the DSI is not necessary to mark drivers (SS7HD, SPCI, etc) - we will only work with Sigtran, which does not require special equipment. Once installed in the folder C: \ DSI \ UPD \ RUN will two important folders - MTU (generates protocol messages MAP) and MTR (responding to messages). MAP is a Mobile Application Part, protocol, which is responsible to the GSM network for many things, including - Registration and transfer SMS subscribers. These test applications generate few easy forms of communication, but most tellingly - MAP-FORWARD-SHORTMESSAGE. Simply put - send sms. At this stage of the installation is complete. Part 2. Description SS7 stack

The stack operates as follows: 1. First use a modular system. SS7 is a set of protocols. So, each of them is implemented in a separate module stack (ie the application). Let me explain with an example. If using SS7 over TDM (E1 through streams), the signal board handles MTP1 (physics) and MTP2 (link layer). On the server, run mtp3.exe (module MTP3 partly network layer model OSI), and then, depending on the purpose of the system: isup.exe (if the platform handles voice traffic);

1/7/13

Practical SS7, Part 3

sccp.exe + tcap.exe + map / inap.exe (for MAP / INAP traffic).

It is possible not to use the top-level module, and instead write a custom application for processing. Many manufacturers of software for mobile operators and arrive. 2. Each module has an ID (module_id), which is used to route messages within the stack. This is a number from 0 to 254, are usually written in a 16-hexadecimal format. Some modules have reserved rooms. You can read about in the Software Environment Manual. The document is difficult to understand because it was written more for developers and programmers has many specifics. 3. Starting stack provides utility gctload. She reads the main configuration file system.txt, creates a message queue in memory of all the modules run all the modules (registered in system.txt) and something else (I have all the details, unfortunately, I do not know.) in the file system . txt spelled all modules are initialized on startup, all applications (the path to the application, the startup). 4. Licensing. The most interesting thing :) Since the stack module, licenses are to each module. Plus, if a warning card, then it has space for special licence button protocol MTP2 (looks like a battery for the motherboard, but thicker). Novel signaling cards already use a software license. best part in the licensing of Dialogic is the use of test mode (trial mode). To use it you need to during the startup (m3ua.exe, m2pa.exe, sccp.exe) specify the key -t . A couple of years ago, trial mode is allowed to work 8 hours (than once had to use even in the production system). Now only 1 hour. Modules honestly admit this at the start and after one hour just to handle the traffic stop. To continue the stack should be restarted. Part 3. Starting SS7 stack. 1. If you are using Virtual Box, you must select the settings Bridged network (Network Bridge) and is likely to set the IP address manually. I
www.mib.net.ua/2011/12/practical-ss7-part-3.html 3/7

1/7/13

Practical SS7, Part 3

also earned a "virtual host adapter." Not sure that this is the only option, but through NAT, which is used by default, Sigtran most likely will not work. Another very important point - the need to turn off the fucking quarterback windose. I have half an hour could not understand why packets only go in one direction :) 2. Before starting to write the correct system.txt. Dialogic benefit here and helped in the folder C: \ DSI \ UPD \ RUN \ MTU \ M3UA_ CONFIG \ already have a ready example for the "sender" messages (emulation SMSC).

Similarly, in the folder C: \ DSI \ UPD \ RUN \ MTR \ M3UA_ CONFIG \ is an example for the "recipient" of communications. One problem - for example Linux, so move system.txt to our "root" (C: \ DSI \) and correct way in all FORK_PROCESS (system call, the OS is responsible for creating the process with a new process id). Additionally I had to remove the "read only" to the file. I finally got something (cite only the end of the file): FORK_PROCESS tim.exe FORK_PROCESS tick.exe FORK_PROCESS s7_mgt-d FORK_PROCESS s7_log-fss7.log-tt * * SCTP and SCTPD for non-native SCTP FORK_PROCESS sctp.exe FORK_PROCESS sctpd.exe * * SCTPn for native SCTP * FORK_PROCESS .. /.. /.. /.. / Sctpn * FORK_PROCESS HSTBIN \ m3ua-t FORK_PROCESS HSTBIN \ sccp-t FORK_PROCESS HSTBIN \ tcap-t FORK_PROCESS HSTBIN \ map-t

Important notice for those who set the stack on Linux / Solaris. Since this is a normal network operating systems (unlike Windows), then they already have the support of SCTP in the kernel. Dialogic strongly recommends the implementation of SCTP is the operating system. To do this, instead of sctp and sctpd,
www.mib.net.ua/2011/12/practical-ss7-part-3.html 4/7

1/7/13

Practical SS7, Part 3

you need to run only sctpn. 3. Check that the configuration is correct. To do this, you can try to run the stack. The first time it is better to make a console (Start-Run-cmd). Next go to the folder c: \ DSI, and in it perform gctload.exe In my case windose cursed the missing library, so called console PATH = get the current value of the search paths, and then PATH = copy the current path; C: \ DSI \ LIB32 (or LIB64, if you have a 64-bit OS) 4. gctload startup you a message: (3588) gctload: Verification started. (3588) gctload: Verification complete. (3588) gctload: Initialisation complete. S7_log: mod ID = 0xef, options = 0xaf0d, max_param_len = 320 S7_log: Writing log file ss7.log --- this log file. There will be written some useful messages. Read them, though sometimes difficult to Failed to Open s7_mgt Configuration file: config.txt config.txt -- we have not written, so do not pay attention Cannot open configuration file config.txt SS7 TCAP started in trial mode. This binary will terminate after one hour. --- and here's license for 1 hour SS7 MAP started in trial mode. This binary will terminate after one hour. SS7 SCCP started in trial mode. This binary will terminate after one hour. SS7 M3UA started in trial mode. This binary will terminate after one hour. 5. Important information. gctload can stop and Ctrl-C. But I do not highly recommend it. Previously, even in all the docs do not recommend. Necessary for the proper shutdown in another console do: gctload.exe-x Otherwise, there is a chance that the stack will leave the memory of their service the message queue and the next time will not run or will not work correctly. Maybe it has long been
www.mib.net.ua/2011/12/practical-ss7-part-3.html 5/7

1/7/13

Practical SS7, Part 3

corrected, but it is better not to risk it. 6. In system.txt Set launch s7_mgt. This application configuration SS7 stack parameters. By default, uses the file config.txt, an example of which is in the C: \ DSI \ UPD \ RUN \ MTU \ M3UA_ CONFIG \

This file requires more detailed corrections. * Local IP Address Configuration CNSYS: IPADDR = 192.168.0.1; - address of the interface that will be used to send / receive messages. Before you specify the address, make sure that the OS is in the same network. It is best to first check with the ping that the system can "see" each other, and then adjust the stack. And remember to disable DEFENDER windose. * SCTP Association configuration to Remote IPSP SNSLI: SNLINK = 1, IPADDR = 192.168.0.2 , SNTYPE = M3UA, SNEND = C ; - then the address of the second OS. I hope it is clear that the second computer addresses are reversed? SNEND determines who will be the server (SNEND = S), and who is the client (SNEND = C). Therefore put on the same machine C, on the other S. In this command, you can specify the ports (HPORT and PPORT), but in default 2905. * Remote Application Server Configuration SNRAI: RAS = 1, DPC = 2 - Specify the Destination Point Code remote system. Addressing this level MTP3 (M3UA, which we set up, is the realization MTP3 over SCTP). * Add Remote AS to Association SNALI: SNAL = 1, RAS = 1, SNLINK = 1 - this time it is necessary to read the documentation. But it seems to link the remote Application Server-specific association (association is analogous to the signaling link MTP2). * SCCP_CONFIG SCCP_CONFIG 1 0x8 0x0102 0x01 This shows us the local Point Code (one system is 1, the second with 2), SSF (a pointer to the protocol, which after MTP3. In this case it is SCCP (0x08). Options (0x0102) in the documentation, and their computation trivial task. It is necessary to translate the number to binary form, select the desired bit (make them equal to 1), then all put in a 16-hexadecimal. Send UIS - User In Service (0x01). Here my knowledge apart
www.mib.net.ua/2011/12/practical-ss7-part-3.html 6/7

1/7/13

Practical SS7, Part 3

from what is written in the documentation, so if you're interested - see Software Environment Manual. The other parameters do not touch. Save the file config.txt. 7. Now try to start the queue stack on both systems. If everything is correct, then the console will get something like this: S7_MGT Boot Complete - - important line. Says that the stack has started S7L: 00:08:48.131 I0000 M3UA Association Status: id = 0 UP S7L: 00:08:48.131 I0000 M3UA Indication: ASP UP, Association =0 S7L: 00:08:48.131 I0000 M3UA Notify: AS Inactive, Association = 0 ASP = 0 S7L: 00:08:48.131 I0000 M3UA Indication: ASP ACTIVE, Association = 0 AS = 0 S7L: 00:08:48.131 I0000 M3UA Indication: AS ACTIVE, AS = 0 S7L: 00:08:48.131 I0000 M3UA Notify: AS Active, Association = ASP = 0 0 - - The Association is available Once the stack is running, you can try to send sms. MTR.exe should already be running on the receiver side (application system.txt prescribed for MTR). MTU should be run manually at the console. Example run written by introducing parameters wrong (or no parameters). Although these and the parameters - wrong. Alternatively, you can try so: mtu.exe-d0-P2-A111-G222-s "Test" I highly recommend running Wireshark in one of the operating systems and monitor all messages to be transferred between systems. You can use the filter "sctp" for the initial setup, and then "sccp". If you have questions - ask in the comments. I will try to answer.
17 C omments Tags: SS7

www.mib.net.ua/2011/12/practical-ss7-part-3.html